From 77aa5a845e06edeaffe6d29f89b01e4fbb6ed8d5 Mon Sep 17 00:00:00 2001
From: ouyangxq <775153912@qq.com>
Date: Sat, 8 Aug 2026 10:22:41 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=81=E8=AE=B8=E5=8C=BF=E5=90=8D?=
 =?UTF-8?q?=E5=85=91=E6=8D=A2=E5=AE=A2=E6=88=B7=E4=BB=A3=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E6=8E=88=E6=9D=83=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../baiyue/auth/config/AuthSecurityConfig.java    | 15 +++++++++++++--
 .../auth/config/AuthSecurityConfigTest.java       | 15 +++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 auth/src/test/java/com/baiyue/auth/config/AuthSecurityConfigTest.java

diff --git a/auth/src/main/java/com/baiyue/auth/config/AuthSecurityConfig.java b/auth/src/main/java/com/baiyue/auth/config/AuthSecurityConfig.java
index 31a2e7d6e..7362715cc 100644
--- a/auth/src/main/java/com/baiyue/auth/config/AuthSecurityConfig.java
+++ b/auth/src/main/java/com/baiyue/auth/config/AuthSecurityConfig.java
@@ -25,6 +25,18 @@ import java.nio.charset.StandardCharsets;
 @Configuration
 @EnableConfigurationProperties(AuthSecurityProperties.class)
 public class AuthSecurityConfig {
+    static final String[] PUBLIC_AUTH_ENDPOINTS = {
+        "/api/auth/register",
+        "/api/auth/login",
+        "/api/auth/refresh",
+        "/api/auth/logout",
+        "/api/auth/impersonations/exchange",
+        "/actuator/health",
+        "/v3/api-docs/**",
+        "/swagger-ui/**",
+        "/swagger-ui.html"
+    };
+
     @Bean
     PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); }
 
@@ -47,8 +59,7 @@ public class AuthSecurityConfig {
             .exceptionHandling(errors -> errors
                 .authenticationEntryPoint(entryPoint).accessDeniedHandler(deniedHandler))
             .authorizeHttpRequests(auth -> auth
-                .requestMatchers("/api/auth/register", "/api/auth/login", "/api/auth/refresh", "/api/auth/logout",
-                    "/actuator/health", "/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html").permitAll()
+                .requestMatchers(PUBLIC_AUTH_ENDPOINTS).permitAll()
                 .requestMatchers("/internal/auth/**").permitAll()
                 .anyRequest().authenticated())
             .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
diff --git a/auth/src/test/java/com/baiyue/auth/config/AuthSecurityConfigTest.java b/auth/src/test/java/com/baiyue/auth/config/AuthSecurityConfigTest.java
new file mode 100644
index 000000000..a9a601220
--- /dev/null
+++ b/auth/src/test/java/com/baiyue/auth/config/AuthSecurityConfigTest.java
@@ -0,0 +1,15 @@
+package com.baiyue.auth.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AuthSecurityConfigTest {
+    @Test
+    void permitsAnonymousImpersonationCodeExchange() {
+        assertTrue(Arrays.asList(AuthSecurityConfig.PUBLIC_AUTH_ENDPOINTS)
+            .contains("/api/auth/impersonations/exchange"));
+    }
+}