yescent/par
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: PSK 认证不再依赖账户查询，clientId 即身份

Browse Source 
- PSK 签名通过后直接用 X-Client-Id 作为提交者标识
- 不再查 account 表，提交者=clientId
- 保留 Bearer Token 方式供 Web 管理后台使用
This commit is contained in:
mediabot-pt
2026-06-29 22:34:50 +08:00
parent dd113ebf09
commit e8a30d5e54
1 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
View File

@@ -34,6 +34,8 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
private static final String HEADER_SIGNATURE = "X-Signature";
private static final String HEADER_TIMESTAMP = "X-Timestamp";
private static final String HEADER_EMAIL = "X-Email";
/** 客户端安装 ID（PSK 模式下的提交者标识） */
private static final String HEADER_CLIENT_ID = "X-Client-Id";
private static final long TOKEN_EXPIRY_HOURS = 24;
@@ -60,26 +62,21 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
return false;
}
// 方式 2：PSK 签名
// 方式 2：PSK 签名（无需账户，clientId 即身份）
String sig = request.getHeader(HEADER_SIGNATURE);
String ts = request.getHeader(HEADER_TIMESTAMP);
if (sig != null && ts != null) {
try {
if (pskService.verify(request.getMethod(), request.getRequestURI(),
Long.parseLong(ts), sig) != null) {
// X-Email 支持多值，依次尝试匹配账户
Account account = null;
String matchedEmail = null;
var emails = request.getHeaders(HEADER_EMAIL);
while (emails != null && emails.hasMoreElements()) {
String e = emails.nextElement();
account = accountService.findByAnyEmail(e);
if (account != null) { matchedEmail = e; break; }
// clientId 作为提交者标识（优先 X-Client-Id，其次 X-Email）
String clientId = request.getHeader(HEADER_CLIENT_ID);
if (clientId == null || clientId.isBlank()) {
clientId = request.getHeader(HEADER_EMAIL);
}
request.setAttribute("accountId", account != null ? account.getId() : 0L);
request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
: com.par.core.enums.TrustLevel.TRUSTED);
request.setAttribute("authEmail", matchedEmail);
request.setAttribute("accountId", 0L);
request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
request.setAttribute("clientId", clientId);
return true;
}
} catch (NumberFormatException ignored) {}