优化

common-security/src/main/java/com/baiyue/common/security/AuthenticatedUser.java

@@ -8,7 +8,13 @@ import java.util.Set;
  */
 public record AuthenticatedUser(Long userId, Long tenantId, Long operatorTenantId, Long membershipId,
                                 String username, String appCode, String clientType,
-                                Set<String> permissions) implements Principal {
+                                Set<String> permissions, boolean impersonated, Long actorUserId,
+                                Long actorMembershipId, boolean passwordChangeRequired) implements Principal {
+    public AuthenticatedUser(Long userId, Long tenantId, Long operatorTenantId, Long membershipId,
+                             String username, String appCode, String clientType, Set<String> permissions) {
+        this(userId, tenantId, operatorTenantId, membershipId, username, appCode, clientType,
+                permissions, false, null, null, false);
+    }
     public AuthenticatedUser {
         permissions = permissions == null ? Set.of() : Set.copyOf(permissions);
     }
@@ -18,4 +24,3 @@ public record AuthenticatedUser(Long userId, Long tenantId, Long operatorTenantI
         return username;
     }
 }
-

common-security/src/main/java/com/baiyue/common/security/JwtClaimsMapper.java

@@ -34,7 +34,11 @@ public class JwtClaimsMapper {
                 username,
                 jwt.getClaimAsString("app_code"),
                 jwt.getClaimAsString("client_type"),
-                permissions);
+                permissions,
+                Boolean.TRUE.equals(jwt.getClaim("impersonated")),
+                longClaim(jwt, "actor_user_id"),
+                longClaim(jwt, "actor_membership_id"),
+                Boolean.TRUE.equals(jwt.getClaim("password_change_required")));
         List<SimpleGrantedAuthority> authorities = permissions.stream()
                 .map(SimpleGrantedAuthority::new).toList();
         return new BaiyueJwtAuthenticationToken(user, jwt.getTokenValue(), authorities);
@@ -74,4 +78,3 @@ public class JwtClaimsMapper {
         return "unknown";
     }
 }
-

common-security/src/test/java/com/baiyue/common/security/JwtClaimsMapperTest.java

@@ -49,4 +49,26 @@ class JwtClaimsMapperTest {
         assertThat(authentication.getPrincipal().userId()).isEqualTo(99L);
         assertThat(authentication.getAuthorities()).extracting("authority").contains("APP_PLATFORM");
     }
+
+    @Test
+    void mapsImpersonationAndForcedPasswordClaims() {
+        Jwt jwt = Jwt.withTokenValue("token")
+                .header("alg", "none")
+                .subject("99")
+                .issuedAt(Instant.now())
+                .expiresAt(Instant.now().plusSeconds(60))
+                .claim("tenant_id", 7L)
+                .claim("app_code", "MERCHANT")
+                .claim("impersonated", true)
+                .claim("actor_user_id", 42L)
+                .claim("actor_membership_id", 43L)
+                .claim("password_change_required", true)
+                .build();
+
+        AuthenticatedUser user = new JwtClaimsMapper().map(jwt).getPrincipal();
+        assertThat(user.impersonated()).isTrue();
+        assertThat(user.actorUserId()).isEqualTo(42L);
+        assertThat(user.actorMembershipId()).isEqualTo(43L);
+        assertThat(user.passwordChangeRequired()).isTrue();
+    }
 }