fix: project overseas authorization outside jwt

2026-09-07 11:37:06 +08:00
parent 6b479d1a68
commit 4963889024
33 changed files with 382 additions and 92 deletions
@@ -26,19 +26,19 @@ class RequiredClaimsJwtValidatorTest {
        Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("1001")
                .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
                .claim("tenant_id", "0").claim("app_code", "PLATFORM")
-                .claim("permission_version", 3L).claim("authorities", List.of())
+                .claim("permission_version", 3L)
                .build();
        assertThat(validator.validate(value).hasErrors()).isTrue();
    }

    @Test
-    void rejectsMissingAuthorities() {
+    void acceptsTokenWithoutAuthoritiesBecauseProjectionOwnsAuthorization() {
        Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("1001")
            .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
            .claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("token_version", 1)
            .claim("permission_version", 3L)
            .build();
-        assertThat(validator.validate(value).hasErrors()).isTrue();
+        assertThat(validator.validate(value).hasErrors()).isFalse();
    }

    @Test