java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(phase3): 收口父子单与全链路验收

Browse Source
This commit is contained in:
ouyangxq
2026-08-10 12:23:43 +08:00
parent b294695169
commit 75d5fd4e26
55 changed files with 1110 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common-security/src/test/java/com/baiyue/common/security/JwtClaimsMapperTest.java
+19 -1
View File
@@ -27,13 +27,31 @@ class JwtClaimsMapperTest {
.claim("roles", List.of("ADMIN"))
.build();
BaiyueJwtAuthenticationToken authentication = new JwtClaimsMapper().map(jwt);
AccessTokenSession session = new AccessTokenSession(1, 42L,
java.util.Set.of("ADMIN"), java.util.Set.of("order:read", "order:create"));
BaiyueJwtAuthenticationToken authentication = new JwtClaimsMapper().map(jwt, session);
assertThat(authentication.getPrincipal().userId()).isEqualTo(42L);
assertThat(authentication.getPrincipal().tenantId()).isEqualTo(7L);
assertThat(authentication.getAuthorities()).extracting("authority")
.contains("order:read", "order:create", "ROLE_ADMIN", "APP_MERCHANT");
}
@Test
void ignoresAuthorizationClaimsInJwt() {
Jwt jwt = Jwt.withTokenValue("token").header("alg", "none").subject("42")
.issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(60))
.claim("user_id", 42L).claim("tenant_id", 0L).claim("app_code", "PLATFORM")
.claim("permissions", List.of("platform:forged"))
.claim("roles", List.of("FORGED")).build();
BaiyueJwtAuthenticationToken authentication = new JwtClaimsMapper().map(jwt,
new AccessTokenSession(1, 42L, java.util.Set.of(), java.util.Set.of("platform:real")));
assertThat(authentication.getAuthorities()).extracting("authority")
.contains("platform:real", "APP_PLATFORM")
.doesNotContain("platform:forged", "ROLE_FORGED");
}
@Test
void fallsBackToNumericSubjectForUserId() {
Jwt jwt = Jwt.withTokenValue("token")