From f69c75368c12460b3fe22488b20d3dfdbe764cb1 Mon Sep 17 00:00:00 2001 From: mediabot-pt <295750538+mediabot-pt@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:59:49 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20PSK=20=E8=AF=B7=E6=B1=82=E6=81=A2?= =?UTF-8?q?=E5=A4=8D=20X-Email=20=E5=A4=B4=E7=94=A8=E4=BA=8E=E8=BA=AB?= =?UTF-8?q?=E4=BB=BD=E8=AF=86=E5=88=AB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - X-Email 参与身份查找但不参与签名 - 已注册邮箱：对应该账户 accountId/trustLevel - 未注册邮箱：accountId=0, trustLevel=TRUSTED - audit 日志通过 authEmail attribute 追踪 --- .../com/par/core/interceptor/HmacAuthInterceptor.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java index 4adefdf..54a940e 100644 --- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java +++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java @@ -62,12 +62,17 @@ public class HmacAuthInterceptor implements HandlerInterceptor { // 方式 2：PSK 签名 String sig = request.getHeader(HEADER_SIGNATURE); String ts = request.getHeader(HEADER_TIMESTAMP); - if (sig != null && ts != null) { + String email = request.getHeader(HEADER_EMAIL); + if (sig != null && ts != null && email != null) { try { if (pskService.verify(request.getMethod(), request.getRequestURI(), Long.parseLong(ts), sig) != null) { - request.setAttribute("accountId", 0L); - request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED); + // X-Email 仅标识身份，不参与签名 + Account account = accountService.findByAnyEmail(email); + request.setAttribute("accountId", account != null ? account.getId() : 0L); + request.setAttribute("trustLevel", account != null ? account.getTrustLevel() + : com.par.core.enums.TrustLevel.TRUSTED); + request.setAttribute("authEmail", email); return true; } } catch (NumberFormatException ignored) {}