From ae8d0ed7d23729fecfecc352213819b36cc78db0 Mon Sep 17 00:00:00 2001
From: mediabot-pt <295750538+mediabot-pt@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:58:56 +0800
Subject: [PATCH] =?UTF-8?q?refactor:=20PSK=20=E7=AD=BE=E5=90=8D=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=20METHOD:path:timestamp=20=E6=A0=BC=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 签名内容不再包含 email，email 仅作审计
- 改用 METHOD:path:timestamp 防重放到不同端点
- X-Email 头改为可选
- medibot 签名: HMAC(PSK, 'POST:/api/v1/sites/x/submit:1234567890')
---
 .../java/com/par/api/controller/AuthController.java   |  3 ++-
 .../com/par/core/interceptor/HmacAuthInterceptor.java |  6 +++---
 .../main/java/com/par/core/service/PskService.java    | 11 +++++------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/par-api/src/main/java/com/par/api/controller/AuthController.java b/par-api/src/main/java/com/par/api/controller/AuthController.java
index fdf7a4a..c780733 100644
--- a/par-api/src/main/java/com/par/api/controller/AuthController.java
+++ b/par-api/src/main/java/com/par/api/controller/AuthController.java
@@ -106,7 +106,8 @@ public class AuthController {
         String sig = request.getHeader("X-Medibot-Signature");
         if (ts == null || sig == null) return false;
         try {
-            return pskService.verify(email, Long.parseLong(ts), sig) != null;
+            return pskService.verify(request.getMethod(), request.getRequestURI(),
+                    Long.parseLong(ts), sig) != null;
         } catch (NumberFormatException e) {
             return false;
         }
diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 1e6e70f..4adefdf 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -62,10 +62,10 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
         // 方式 2：PSK 签名
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
-        String email = request.getHeader(HEADER_EMAIL);
-        if (sig != null && ts != null && email != null) {
+        if (sig != null && ts != null) {
             try {
-                if (pskService.verify(email, Long.parseLong(ts), sig) != null) {
+                if (pskService.verify(request.getMethod(), request.getRequestURI(),
+                        Long.parseLong(ts), sig) != null) {
                     request.setAttribute("accountId", 0L);
                     request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
                     return true;
diff --git a/par-core/src/main/java/com/par/core/service/PskService.java b/par-core/src/main/java/com/par/core/service/PskService.java
index 2614669..0d27518 100644
--- a/par-core/src/main/java/com/par/core/service/PskService.java
+++ b/par-core/src/main/java/com/par/core/service/PskService.java
@@ -84,16 +84,15 @@ public class PskService {
 
     /**
      * 使用所有活跃 PSK 逐一验证签名
-     * signContent = email + ":" + timestamp
-     * @return 匹配的 PSK 版本号，null 表示验证失败
+     * signContent = METHOD:path:timestamp
+     * @return "ok" 表示验证通过，null 表示失败
      */
-    public String verify(String email, long timestamp, String signature) {
+    public String verify(String method, String path, long timestamp, String signature) {
         long now = System.currentTimeMillis() / 1000;
         if (Math.abs(now - timestamp) > 300) return null; // 5 分钟窗口
-        String payload = email.toLowerCase().trim() + ":" + timestamp;
+        String payload = method.toUpperCase() + ":" + path + ":" + timestamp;
 
-        String[] secrets = getActiveSecrets();
-        for (String secret : secrets) {
+        for (String secret : getActiveSecrets()) {
             if (HmacUtil.verify(secret, payload, signature)) {
                 return "ok";
             }