java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: gate overseas receiving and harden phase4 workflows

Browse Source
This commit is contained in:
ouyangxq
2026-08-25 10:31:04 +08:00
parent cb78bc6b41
commit 52b9fc382f
93 changed files with 2779 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gateway-overseas/src/test/java/com/baiyue/gateway/config/PdaSessionValidationDeploymentContractTest.java
+43
View File
@@ -0,0 +1,43 @@
package com.baiyue.gateway.config;
import org.junit.jupiter.api.Test;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import static org.assertj.core.api.Assertions.assertThat;
class PdaSessionValidationDeploymentContractTest {
@Test
void nacosComposeAndJenkinsDeploymentRequireOnlyEnvironmentBackedAuthCoordinates() throws Exception {
String application = read("gateway-overseas/src/main/resources/application.yml");
String nacos = read("config/nacos/overseas/baiyue-common.yml");
String compose = read("deploy/docker-compose.overseas.yml");
String deployServices = read("deploy/scripts/deploy-services.sh");
String deployBuiltService = read("deploy/scripts/deploy-built-service.sh");
String jenkins = read("Jenkinsfile");
for (String source : new String[]{application, nacos, compose}) {
assertThat(source).contains("AUTH_SESSION_VALIDATION_URL", "INTERNAL_SERVICE_TOKEN",
"PDA_SESSION_VALIDATION_TIMEOUT");
}
assertThat(deployServices).contains("gateway-overseas", "AUTH_SESSION_VALIDATION_URL");
assertThat(deployBuiltService).contains("gateway-overseas", "AUTH_SESSION_VALIDATION_URL");
assertThat(jenkins).contains("'gateway-overseas': 'SERVICE_GATEWAY_OVERSEAS'", "'auth': 'SERVICE_AUTH'",
"'iam': 'SERVICE_IAM'");
assertThat(application).doesNotContain("/internal/auth/accounts/overseas-session/validate");
assertThat(read("gateway-overseas/src/main/resources/application-overseas.yml"))
.doesNotContain("/internal/auth/**", "/internal/auth/accounts/overseas-session/validate");
assertThat(read("gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpPdaSessionValidationClient.java"))
.contains("new Request(userId, tokenVersion, overseasWarehouseId)",
".header(\"X-Internal-Service-Token\"")
.doesNotContain("Authorization", "accessToken", "rawToken", "getTokenValue");
}
private static String read(String relative) throws Exception {
Path path = Path.of(relative);
if (!Files.exists(path)) path = Path.of("..").resolve(relative);
return Files.readString(path, StandardCharsets.UTF_8);
}
}
gateway-overseas/src/test/java/com/baiyue/gateway/config/RequiredClaimsJwtValidatorTest.java
+14 -1
View File
@@ -21,11 +21,22 @@ class RequiredClaimsJwtValidatorTest {
assertThat(validator.validate(jwt(false)).hasErrors()).isTrue();
}
@Test
void rejectsMissingAccountTokenVersion() {
Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("1001")
.issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
.claim("tenant_id", "0").claim("app_code", "PLATFORM")
.claim("permission_version", 3L).claim("authorities", List.of())
.build();
assertThat(validator.validate(value).hasErrors()).isTrue();
}
@Test
void rejectsMissingAuthorities() {
Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("1001")
.issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
.claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("permission_version", 3L)
.claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("token_version", 1)
.claim("permission_version", 3L)
.build();
assertThat(validator.validate(value).hasErrors()).isTrue();
}
@@ -54,6 +65,7 @@ class RequiredClaimsJwtValidatorTest {
Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("not-a-user")
.issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
.claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("permission_version", -1L)
.claim("token_version", 1)
.claim("authorities", List.of()).build();
assertThat(validator.validate(value).hasErrors()).isTrue();
}
@@ -72,6 +84,7 @@ class RequiredClaimsJwtValidatorTest {
.expiresAt(Instant.now().plusSeconds(300))
.claim("tenant_id", tenantId)
.claim("app_code", appCode)
.claim("token_version", 1)
.claim("authorities", authorities);
if (includePermissionVersion) {
builder.claim("permission_version", 3L);