yescent/par
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: PSK 认证支持多个 X-Email 头，依次匹配账户

Browse Source
This commit is contained in:
mediabot-pt
2026-06-29 17:00:56 +08:00
parent f69c75368c
commit c9dc78b6ef
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
View File

@@ -14,6 +14,7 @@ import org.springframework.web.servlet.HandlerInterceptor;
import java.io.IOException; import java.io.IOException;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.util.Base64; import java.util.Base64;
import java.util.Enumeration;
/** /**
* API 鉴权拦截器 * API 鉴权拦截器
@@ -62,17 +63,23 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
// 方式 2：PSK 签名 // 方式 2：PSK 签名
String sig = request.getHeader(HEADER_SIGNATURE); String sig = request.getHeader(HEADER_SIGNATURE);
String ts = request.getHeader(HEADER_TIMESTAMP); String ts = request.getHeader(HEADER_TIMESTAMP);
String email = request.getHeader(HEADER_EMAIL); if (sig != null && ts != null) {
if (sig != null && ts != null && email != null) {
try { try {
if (pskService.verify(request.getMethod(), request.getRequestURI(), if (pskService.verify(request.getMethod(), request.getRequestURI(),
Long.parseLong(ts), sig) != null) { Long.parseLong(ts), sig) != null) {
// X-Email 仅标识身份，不参与签名 // X-Email 支持多值，依次尝试匹配账户
Account account = accountService.findByAnyEmail(email); Account account = null;
String matchedEmail = null;
var emails = request.getHeaders(HEADER_EMAIL);
while (emails != null && emails.hasMoreElements()) {
String e = emails.nextElement();
account = accountService.findByAnyEmail(e);
if (account != null) { matchedEmail = e; break; }
}
request.setAttribute("accountId", account != null ? account.getId() : 0L); request.setAttribute("accountId", account != null ? account.getId() : 0L);
request.setAttribute("trustLevel", account != null ? account.getTrustLevel() request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
: com.par.core.enums.TrustLevel.TRUSTED); : com.par.core.enums.TrustLevel.TRUSTED);
request.setAttribute("authEmail", email); request.setAttribute("authEmail", matchedEmail);
return true; return true;
} }
} catch (NumberFormatException ignored) {} } catch (NumberFormatException ignored) {}