From c9dc78b6ef57a3bde99cc86c54ea67ce48e46c6b Mon Sep 17 00:00:00 2001
From: mediabot-pt <295750538+mediabot-pt@users.noreply.github.com>
Date: Mon, 29 Jun 2026 17:00:56 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20PSK=20=E8=AE=A4=E8=AF=81=E6=94=AF?=
 =?UTF-8?q?=E6=8C=81=E5=A4=9A=E4=B8=AA=20X-Email=20=E5=A4=B4=EF=BC=8C?=
 =?UTF-8?q?=E4=BE=9D=E6=AC=A1=E5=8C=B9=E9=85=8D=E8=B4=A6=E6=88=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../core/interceptor/HmacAuthInterceptor.java   | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 54a940e..1ab603e 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -14,6 +14,7 @@ import org.springframework.web.servlet.HandlerInterceptor;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
+import java.util.Enumeration;
 
 /**
  * API 鉴权拦截器
@@ -62,17 +63,23 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
         // 方式 2：PSK 签名
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
-        String email = request.getHeader(HEADER_EMAIL);
-        if (sig != null && ts != null && email != null) {
+        if (sig != null && ts != null) {
             try {
                 if (pskService.verify(request.getMethod(), request.getRequestURI(),
                         Long.parseLong(ts), sig) != null) {
-                    // X-Email 仅标识身份，不参与签名
-                    Account account = accountService.findByAnyEmail(email);
+                    // X-Email 支持多值，依次尝试匹配账户
+                    Account account = null;
+                    String matchedEmail = null;
+                    var emails = request.getHeaders(HEADER_EMAIL);
+                    while (emails != null && emails.hasMoreElements()) {
+                        String e = emails.nextElement();
+                        account = accountService.findByAnyEmail(e);
+                        if (account != null) { matchedEmail = e; break; }
+                    }
                     request.setAttribute("accountId", account != null ? account.getId() : 0L);
                     request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
                             : com.par.core.enums.TrustLevel.TRUSTED);
-                    request.setAttribute("authEmail", email);
+                    request.setAttribute("authEmail", matchedEmail);
                     return true;
                 }
             } catch (NumberFormatException ignored) {}