暂存提交

lastleg-service/src/main/java/com/baiyue/lastleg/security/InternalServiceTokenGuard.java

@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.security;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+
+@Component
+public class InternalServiceTokenGuard {
+    private final String expectedToken;
+    public InternalServiceTokenGuard(@Value("${baiyue.security.internal-service-token:}") String expectedToken) { this.expectedToken=expectedToken; }
+    public void verify(String actualToken) {
+        if(expectedToken==null||expectedToken.isBlank()) throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"内部事件接收令牌未配置");
+        byte[] expected=expectedToken.getBytes(StandardCharsets.UTF_8);
+        byte[] actual=actualToken==null?new byte[0]:actualToken.getBytes(StandardCharsets.UTF_8);
+        if(!MessageDigest.isEqual(expected,actual)) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED,"内部服务令牌无效");
+    }
+}