优化

gateway/src/main/java/com/baiyue/gateway/config/AppScopeAuthorizationManager.java

@@ -26,7 +26,18 @@ final class AppScopeAuthorizationManager implements ReactiveAuthorizationManager
     }
 
     private boolean hasExpectedScope(Authentication authentication) {
-        return authentication instanceof JwtAuthenticationToken jwt
-                && expectedAppCode.equals(jwt.getToken().getClaimAsString("app_code"));
+        if (!(authentication instanceof JwtAuthenticationToken jwt)
+                || !expectedAppCode.equals(jwt.getToken().getClaimAsString("app_code"))) {
+            return false;
+        }
+        Object tenantIdClaim = jwt.getToken().getClaim("tenant_id");
+        if (!(tenantIdClaim instanceof Number tenantId)) {
+            return false;
+        }
+        return switch (expectedAppCode) {
+            case "PLATFORM" -> tenantId.longValue() == 0L;
+            case "MERCHANT" -> tenantId.longValue() > 0L;
+            default -> false;
+        };
     }
 }

gateway/src/main/java/com/baiyue/gateway/config/GatewaySecurityConfig.java

@@ -35,6 +35,7 @@ public class GatewaySecurityConfig {
                                                    CorsConfigurationSource corsConfigurationSource) {
         var exchanges = http.authorizeExchange();
         exchanges.pathMatchers(HttpMethod.OPTIONS, "/**").permitAll();
+        exchanges.pathMatchers("/api/iam/**").denyAll();
         properties.permitPaths().forEach(path -> exchanges.pathMatchers(path).permitAll());
         exchanges.pathMatchers("/api/merchant/**")
                 .access(new AppScopeAuthorizationManager("MERCHANT"));

gateway/src/main/resources/application.yml

@@ -49,7 +49,7 @@ spring:
         - id: iam-service
           uri: lb://iam-service
           predicates:
-            - Path=/api/iam/**,/api/platform/v1/iam/**,/api/merchant/v1/iam/**
+            - Path=/api/platform/v1/iam/**,/api/merchant/v1/iam/**
         - id: audit-service
           uri: lb://audit-service
           predicates: