From e8a30d5e541a3babf1bb07b5ce88589862e1ee4c Mon Sep 17 00:00:00 2001
From: mediabot-pt <295750538+mediabot-pt@users.noreply.github.com>
Date: Mon, 29 Jun 2026 22:34:50 +0800
Subject: [PATCH] =?UTF-8?q?refactor:=20PSK=20=E8=AE=A4=E8=AF=81=E4=B8=8D?=
 =?UTF-8?q?=E5=86=8D=E4=BE=9D=E8=B5=96=E8=B4=A6=E6=88=B7=E6=9F=A5=E8=AF=A2?=
 =?UTF-8?q?=EF=BC=8CclientId=20=E5=8D=B3=E8=BA=AB=E4=BB=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- PSK 签名通过后直接用 X-Client-Id 作为提交者标识
- 不再查 account 表，提交者=clientId
- 保留 Bearer Token 方式供 Web 管理后台使用
---
 .../core/interceptor/HmacAuthInterceptor.java | 23 ++++++++-----------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 1ab603e..586bcce 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -34,6 +34,8 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
     private static final String HEADER_SIGNATURE = "X-Signature";
     private static final String HEADER_TIMESTAMP = "X-Timestamp";
     private static final String HEADER_EMAIL = "X-Email";
+    /** 客户端安装 ID（PSK 模式下的提交者标识） */
+    private static final String HEADER_CLIENT_ID = "X-Client-Id";
 
     private static final long TOKEN_EXPIRY_HOURS = 24;
 
@@ -60,26 +62,21 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
             return false;
         }
 
-        // 方式 2：PSK 签名
+        // 方式 2：PSK 签名（无需账户，clientId 即身份）
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
         if (sig != null && ts != null) {
             try {
                 if (pskService.verify(request.getMethod(), request.getRequestURI(),
                         Long.parseLong(ts), sig) != null) {
-                    // X-Email 支持多值，依次尝试匹配账户
-                    Account account = null;
-                    String matchedEmail = null;
-                    var emails = request.getHeaders(HEADER_EMAIL);
-                    while (emails != null && emails.hasMoreElements()) {
-                        String e = emails.nextElement();
-                        account = accountService.findByAnyEmail(e);
-                        if (account != null) { matchedEmail = e; break; }
+                    // clientId 作为提交者标识（优先 X-Client-Id，其次 X-Email）
+                    String clientId = request.getHeader(HEADER_CLIENT_ID);
+                    if (clientId == null || clientId.isBlank()) {
+                        clientId = request.getHeader(HEADER_EMAIL);
                     }
-                    request.setAttribute("accountId", account != null ? account.getId() : 0L);
-                    request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
-                            : com.par.core.enums.TrustLevel.TRUSTED);
-                    request.setAttribute("authEmail", matchedEmail);
+                    request.setAttribute("accountId", 0L);
+                    request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
+                    request.setAttribute("clientId", clientId);
                     return true;
                 }
             } catch (NumberFormatException ignored) {}