forked from rongchao/epmet-cloud-rizhao
wxz
4 years ago
32 changed files with 1056 additions and 21 deletions
@ -0,0 +1,15 @@ |
|||
<?xml version="1.0" encoding="UTF-8"?> |
|||
<project xmlns="http://maven.apache.org/POM/4.0.0" |
|||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
|||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
|||
<parent> |
|||
<artifactId>epmet-commons</artifactId> |
|||
<groupId>com.epmet</groupId> |
|||
<version>2.0.0</version> |
|||
</parent> |
|||
<modelVersion>4.0.0</modelVersion> |
|||
|
|||
<artifactId>epmet-commons-openapi</artifactId> |
|||
|
|||
|
|||
</project> |
|||
@ -0,0 +1,8 @@ |
|||
package com.epmet.openapi.constant; |
|||
|
|||
/** |
|||
* 认证方式 |
|||
*/ |
|||
public interface AuthTypes { |
|||
String TAKE_TOKEN = "take_token"; |
|||
} |
|||
@ -0,0 +1,10 @@ |
|||
package com.epmet.openapi.constant; |
|||
|
|||
/** |
|||
* 集群内的Header key |
|||
*/ |
|||
public interface InClusterHeaderKeys { |
|||
|
|||
String APP_ID = "AppId"; |
|||
|
|||
} |
|||
@ -0,0 +1,14 @@ |
|||
package com.epmet.openapi.constant; |
|||
|
|||
/** |
|||
* url请求参数key |
|||
*/ |
|||
public class RequestParamKeys { |
|||
|
|||
public static String APP_ID = "app_id"; |
|||
public static String AUTH_TYPE = "auth_type"; |
|||
public static String TIMESTAMP = "timestamp"; |
|||
public static String SIGN = "sign"; |
|||
public static String NONCE = "nonce"; |
|||
|
|||
} |
|||
@ -0,0 +1,26 @@ |
|||
<?xml version="1.0" encoding="UTF-8"?> |
|||
<project xmlns="http://maven.apache.org/POM/4.0.0" |
|||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
|||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
|||
<parent> |
|||
<artifactId>epmet-commons</artifactId> |
|||
<groupId>com.epmet</groupId> |
|||
<version>2.0.0</version> |
|||
</parent> |
|||
<modelVersion>4.0.0</modelVersion> |
|||
|
|||
<artifactId>epmet-commons-security</artifactId> |
|||
|
|||
<dependencies> |
|||
<dependency> |
|||
<groupId>com.epmet</groupId> |
|||
<artifactId>epmet-commons-tools</artifactId> |
|||
<version>2.0.0</version> |
|||
</dependency> |
|||
<dependency> |
|||
<groupId>io.jsonwebtoken</groupId> |
|||
<artifactId>jjwt</artifactId> |
|||
<version>0.7.0</version> |
|||
</dependency> |
|||
</dependencies> |
|||
</project> |
|||
@ -0,0 +1,131 @@ |
|||
/** |
|||
* Copyright (c) 2018 人人开源 All rights reserved. |
|||
* <p> |
|||
* https://www.renren.io
|
|||
* <p> |
|||
* 版权所有，侵权必究！ |
|||
*/ |
|||
|
|||
package com.epmet.commons.security.jwt; |
|||
|
|||
import io.jsonwebtoken.Claims; |
|||
import io.jsonwebtoken.Jwts; |
|||
import io.jsonwebtoken.SignatureAlgorithm; |
|||
import org.joda.time.DateTime; |
|||
import org.slf4j.Logger; |
|||
import org.slf4j.LoggerFactory; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.stereotype.Component; |
|||
|
|||
import java.util.Date; |
|||
import java.util.HashMap; |
|||
import java.util.Map; |
|||
|
|||
/** |
|||
* Jwt工具类 |
|||
* |
|||
* @author Mark sunlightcs@gmail.com |
|||
* @since 1.0.0 |
|||
*/ |
|||
@Component |
|||
public class JwtUtils { |
|||
private static final Logger logger = LoggerFactory.getLogger(JwtUtils.class); |
|||
|
|||
public Claims getClaimByToken(String token, String secret) { |
|||
try { |
|||
return Jwts.parser() |
|||
.setSigningKey(secret) |
|||
.parseClaimsJws(token) |
|||
.getBody(); |
|||
} catch (Exception e) { |
|||
logger.debug("validate is token error, token = " + token, e); |
|||
return null; |
|||
} |
|||
} |
|||
|
|||
/** |
|||
* @return java.util.Date |
|||
* @param token |
|||
* @Author yinzuomei |
|||
* @Description 获取token的有效期截止时间 |
|||
* @Date 2020/3/18 22:17 |
|||
**/ |
|||
public Date getExpiration(String token, String secret){ |
|||
try { |
|||
return Jwts.parser() |
|||
.setSigningKey(secret) |
|||
.parseClaimsJws(token) |
|||
.getBody().getExpiration(); |
|||
} catch (Exception e) { |
|||
logger.debug("validate is token error, token = " + token, e); |
|||
return null; |
|||
} |
|||
} |
|||
|
|||
/** |
|||
* @return java.lang.String |
|||
* @Author yinzuomei |
|||
* @Description 根据app+client+userId生成token |
|||
* @Date 2020/3/18 22:29 |
|||
**/ |
|||
public String createToken(Map<String, Object> claims, int expire, String secret) { |
|||
return Jwts.builder() |
|||
.setHeaderParam("typ", "JWT") |
|||
.setClaims(claims) |
|||
.setIssuedAt(new Date()) |
|||
.setExpiration(DateTime.now().plusSeconds(expire).toDate()) |
|||
.signWith(SignatureAlgorithm.HS512, secret) |
|||
.compact(); |
|||
} |
|||
|
|||
/** |
|||
* @Description 创建Token |
|||
* @return Token |
|||
* @param claims 载荷信息 |
|||
* @param expireTime 过期时间 |
|||
* @param secret 秘钥 |
|||
* @author wxz |
|||
* @date 2021.03.26 13:33 |
|||
*/ |
|||
public String createToken(Map<String, Object> claims, Date expireTime, String secret) { |
|||
return Jwts.builder() |
|||
.setHeaderParam("typ", "JWT") |
|||
.setClaims(claims) |
|||
.setIssuedAt(new Date()) |
|||
.setExpiration(expireTime) |
|||
.signWith(SignatureAlgorithm.HS512, secret) |
|||
.compact(); |
|||
} |
|||
|
|||
/** |
|||
* token是否过期 |
|||
* |
|||
* @return true：过期 |
|||
*/ |
|||
public boolean isTokenExpired(Date expiration) { |
|||
return expiration.before(new Date()); |
|||
} |
|||
|
|||
public static void main(String[] args) { |
|||
Map<String, Object> map=new HashMap<>(); |
|||
map.put("app","gov"); |
|||
map.put("client","wxmp"); |
|||
map.put("userId","100526ABC"); |
|||
String tokenStr=Jwts.builder() |
|||
.setHeaderParam("typ", "JWT") |
|||
.setClaims(map) |
|||
.setIssuedAt(new Date()) |
|||
.setExpiration(DateTime.now().plusSeconds(604800).toDate()) |
|||
.signWith(SignatureAlgorithm.HS512, "7016867071f0ebf1c46f123eaaf4b9d6[elink.epmet]") |
|||
.compact(); |
|||
System.out.println(tokenStr); |
|||
Claims claims= Jwts.parser() |
|||
.setSigningKey("7016867071f0ebf1c46f123eaaf4b9d6[elink.epmet]") |
|||
.parseClaimsJws(tokenStr) |
|||
.getBody(); |
|||
System.out.println("app="+ claims.get("app")); |
|||
System.out.println("client="+ claims.get("client")); |
|||
System.out.println("userId="+ claims.get("userId")); |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,109 @@ |
|||
package com.epmet.commons.security.sign.openapi; |
|||
|
|||
import com.epmet.commons.tools.utils.Md5Util; |
|||
|
|||
import java.util.*; |
|||
|
|||
/** |
|||
* OpenApi签名工具 |
|||
*/ |
|||
public class OpenApiSignUtils { |
|||
|
|||
/** |
|||
* @Description 创建签名 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.22 16:47 |
|||
*/ |
|||
public static String createSign(Map<String, String> contentMap, String signKey) { |
|||
String str2beSigned = mapToSignStr(contentMap); |
|||
str2beSigned = str2beSigned.concat("&sign_key=").concat(signKey); |
|||
return Md5Util.md5(str2beSigned); |
|||
} |
|||
|
|||
/** |
|||
* @Description 验签 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.22 16:51 |
|||
*/ |
|||
public static boolean checkSign(Map<String, String> contentMap, String signKey) { |
|||
String newSign = createSign(contentMap, signKey); |
|||
return newSign.equals(contentMap.get("sign")); |
|||
} |
|||
|
|||
/** |
|||
* @Description map转化为签名明文 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.22 16:47 |
|||
*/ |
|||
public static String mapToSignStr(Map<String, String> map) { |
|||
Set<String> keySet = map.keySet(); |
|||
String[] keyArray = (String[])keySet.toArray(new String[keySet.size()]); |
|||
Arrays.sort(keyArray); |
|||
StringBuilder sb = new StringBuilder(); |
|||
|
|||
for(int i = 0; i < keyArray.length; ++i) { |
|||
String key = keyArray[i]; |
|||
String val = (String)map.get(key); |
|||
if (val != null && val.trim().length() > 0 && !"sign".equals(key)) { |
|||
if (!sb.toString().isEmpty()) { |
|||
sb.append("&"); |
|||
} |
|||
|
|||
sb.append(key).append("=").append((String)map.get(key)); |
|||
} |
|||
} |
|||
|
|||
return sb.toString(); |
|||
} |
|||
|
|||
public static void main(String[] args) { |
|||
generateGetAccessTokenSign(); |
|||
System.out.println("=============="); |
|||
generateGetOrgDetailSign(); |
|||
} |
|||
|
|||
private static void generateGetAccessTokenSign() { |
|||
long now = System.currentTimeMillis(); |
|||
System.out.println(now); |
|||
|
|||
String uuid = UUID.randomUUID().toString().replace("-", ""); |
|||
|
|||
HashMap<String, String> content = new HashMap<>(); |
|||
content.put("app_id", "7d98b8af2d05752b4225709c4cfd4bd0"); |
|||
content.put("timestamp", String.valueOf(now)); |
|||
content.put("nonce", uuid); |
|||
content.put("auth_type", "take_token"); |
|||
|
|||
String secret = "3209ee9f41704482be1a1fb5873a25376f2899191ca846119d44168316bc3e44"; |
|||
|
|||
String sign = createSign(content, secret); |
|||
|
|||
System.out.println("时间戳:" + now); |
|||
System.out.println("随机数:" + uuid); |
|||
System.out.println("签名：" + sign); |
|||
} |
|||
|
|||
private static void generateGetOrgDetailSign() { |
|||
long now = System.currentTimeMillis(); |
|||
String uuid = UUID.randomUUID().toString().replace("-", "");; |
|||
System.out.println("时间戳:" + now); |
|||
System.out.println("随机数:" + uuid); |
|||
|
|||
HashMap<String, String> content = new HashMap<>(); |
|||
//content.put("orgId", "aaa");
|
|||
//content.put("test", null);
|
|||
content.put("gridId", "12128e0f614f1c00a058ea9a107033b2"); |
|||
content.put("app_id", "7d98b8af2d05752b4225709c4cfd4bd0"); |
|||
content.put("timestamp", String.valueOf(now)); |
|||
content.put("nonce", uuid); |
|||
content.put("auth_type", "take_token"); |
|||
|
|||
String secret = "3209ee9f41704482be1a1fb5873a25376f2899191ca846119d44168316bc3e44"; |
|||
|
|||
String sign = createSign(content, secret); |
|||
System.out.println("签名：" + sign); |
|||
} |
|||
} |
|||
@ -0,0 +1,91 @@ |
|||
package com.epmet.auth; |
|||
|
|||
import com.epmet.commons.security.jwt.JwtUtils; |
|||
import com.epmet.commons.security.sign.openapi.OpenApiSignUtils; |
|||
import com.epmet.commons.tools.exception.EpmetErrorCode; |
|||
import com.epmet.commons.tools.exception.RenException; |
|||
import com.epmet.commons.tools.redis.RedisKeys; |
|||
import com.epmet.commons.tools.redis.RedisUtils; |
|||
import com.epmet.commons.tools.utils.Result; |
|||
import com.epmet.commons.tools.utils.SpringContextUtils; |
|||
import com.epmet.feign.EpmetCommonServiceOpenFeignClient; |
|||
import com.epmet.openapi.constant.InClusterHeaderKeys; |
|||
import com.epmet.openapi.constant.RequestParamKeys; |
|||
import io.jsonwebtoken.Claims; |
|||
import io.jsonwebtoken.Jwts; |
|||
import org.apache.commons.lang3.StringUtils; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.http.server.reactive.ServerHttpRequest; |
|||
import org.springframework.stereotype.Component; |
|||
import org.springframework.web.server.ServerWebExchange; |
|||
|
|||
import java.util.Date; |
|||
|
|||
/** |
|||
* 外部应用认证处理器：来平台token的方式 |
|||
*/ |
|||
@Component |
|||
public class ExtAppTakeTokenAuthProcessor extends ExtAppAuthProcessor { |
|||
|
|||
@Autowired |
|||
private JwtUtils jwtTokenUtils; |
|||
|
|||
@Autowired |
|||
private RedisUtils redisUtils; |
|||
|
|||
@Override |
|||
public void auth(String appId, String token, Long ts, ServerWebExchange exchange) { |
|||
String secret = getSecret(appId); |
|||
|
|||
// 1.过期验证
|
|||
String accessTokenInCache = redisUtils.getString(RedisKeys.getOpenApiAccessTokenKey(appId)); |
|||
Date expiration = jwtTokenUtils.getExpiration(token, secret); |
|||
if (StringUtils.isBlank(accessTokenInCache) || |
|||
expiration == null || |
|||
jwtTokenUtils.isTokenExpired(expiration) |
|||
) { |
|||
|
|||
throw new RenException(EpmetErrorCode.OPEN_API_TOKEN_EXPIRED.getCode(), |
|||
EpmetErrorCode.OPEN_API_TOKEN_EXPIRED.getMsg()); |
|||
} |
|||
|
|||
// 2.验签
|
|||
// 验签暂时放到具体接口中，不放在gateway
|
|||
//openApiSignUtils.checkSign();
|
|||
|
|||
// 2. 获取claims
|
|||
Claims claims = jwtTokenUtils.getClaimByToken(token, secret); |
|||
String appIdInAccessToken = claims.get(RequestParamKeys.APP_ID, String.class); |
|||
|
|||
if (!appId.equals(appIdInAccessToken)) { |
|||
// 参数列表的appId和token中封装的不一致
|
|||
throw new RenException(EpmetErrorCode.OPEN_API_PARAMS_APPID_DIFF.getCode(), |
|||
EpmetErrorCode.OPEN_API_PARAMS_APPID_DIFF.getMsg()); |
|||
} |
|||
|
|||
// 3.将app_id放入header中
|
|||
ServerHttpRequest.Builder mutate = exchange.getRequest().mutate(); |
|||
mutate.header(InClusterHeaderKeys.APP_ID, new String[]{appId}); |
|||
exchange.mutate().request(mutate.build()).build(); |
|||
} |
|||
|
|||
/** |
|||
* @return |
|||
* @Description 获取秘钥 |
|||
* @author wxz |
|||
* @date 2021.03.23 14:12 |
|||
*/ |
|||
private String getSecret(String appId) { |
|||
EpmetCommonServiceOpenFeignClient commonService = SpringContextUtils.getBean(EpmetCommonServiceOpenFeignClient.class); |
|||
Result<String> result = commonService.getSecret(appId); |
|||
if (result == null || !result.success()) { |
|||
throw new RenException("fetchToken方式的外部应用认证，获取secret失败"); |
|||
} |
|||
String secret = result.getData(); |
|||
if (StringUtils.isBlank(secret)) { |
|||
throw new RenException("fetchToken方式的外部应用认证，获取secret失败"); |
|||
} |
|||
|
|||
return secret; |
|||
} |
|||
} |
|||
@ -0,0 +1,19 @@ |
|||
package com.epmet.utils; |
|||
|
|||
import org.springframework.http.server.reactive.ServerHttpRequest; |
|||
import org.springframework.util.MultiValueMap; |
|||
|
|||
public class ServerHttpRequestUtils { |
|||
|
|||
/** |
|||
* @Description 从url中获取appId |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.25 15:13 |
|||
*/ |
|||
public static String getRequestParam(ServerHttpRequest request, String paramName) { |
|||
MultiValueMap<String, String> queryParams = request.getQueryParams(); |
|||
return queryParams.getFirst(paramName); |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,15 @@ |
|||
package com.epmet.dto.form.openapi; |
|||
|
|||
import lombok.Data; |
|||
|
|||
import javax.validation.constraints.NotBlank; |
|||
|
|||
@Data |
|||
public class GetOrgDetailFormDTO extends OpenApiBaseFormDTO { |
|||
|
|||
@NotBlank(message = "orgId不能为空") |
|||
private String orgId; |
|||
|
|||
private String test; |
|||
|
|||
} |
|||
@ -0,0 +1,31 @@ |
|||
package com.epmet.dto.form.openapi; |
|||
|
|||
import lombok.Data; |
|||
|
|||
import javax.validation.constraints.NotBlank; |
|||
import javax.validation.constraints.NotNull; |
|||
|
|||
/** |
|||
* open api基础类 |
|||
*/ |
|||
@Data |
|||
public class OpenApiBaseFormDTO { |
|||
|
|||
public interface GetAccessTokenGroup {} |
|||
|
|||
@NotBlank(message = "签名不能为空", groups = { GetAccessTokenGroup.class }) |
|||
private String sign; |
|||
|
|||
/** |
|||
* 时间戳，ms |
|||
*/ |
|||
@NotNull(message = "时间戳不能为空", groups = { GetAccessTokenGroup.class }) |
|||
private Long timestamp; |
|||
|
|||
/** |
|||
* 随机数，每次请求唯一 |
|||
*/ |
|||
@NotBlank(message = "随机字段nonce不能为空", groups = { GetAccessTokenGroup.class }) |
|||
private String nonce; |
|||
|
|||
} |
|||
@ -0,0 +1,12 @@ |
|||
package com.epmet.dto.result.openapi; |
|||
|
|||
import lombok.Data; |
|||
|
|||
@Data |
|||
public class GetAccessTokenResultDTO { |
|||
|
|||
private String accessToken; |
|||
|
|||
private Long expireTime; |
|||
|
|||
} |
|||
@ -0,0 +1,13 @@ |
|||
package com.epmet.annotation; |
|||
|
|||
import java.lang.annotation.*; |
|||
|
|||
/** |
|||
* OpenApi验签注解 |
|||
*/ |
|||
@Target(ElementType.METHOD) |
|||
@Retention(RetentionPolicy.RUNTIME) |
|||
@Documented |
|||
public @interface OpenApiCheckSign { |
|||
|
|||
} |
|||
@ -0,0 +1,218 @@ |
|||
package com.epmet.aspect; |
|||
|
|||
import com.epmet.commons.mybatis.aspect.DataFilterAspect; |
|||
import com.epmet.commons.security.sign.openapi.OpenApiSignUtils; |
|||
import com.epmet.commons.tools.exception.EpmetErrorCode; |
|||
import com.epmet.commons.tools.exception.RenException; |
|||
import com.epmet.commons.tools.redis.RedisKeys; |
|||
import com.epmet.commons.tools.redis.RedisUtils; |
|||
import com.epmet.commons.tools.utils.ConvertUtils; |
|||
import com.epmet.commons.tools.utils.Result; |
|||
import com.epmet.feign.EpmetCommonServiceOpenFeignClient; |
|||
import com.epmet.openapi.constant.RequestParamKeys; |
|||
import org.apache.commons.lang3.StringUtils; |
|||
import org.aspectj.lang.JoinPoint; |
|||
import org.aspectj.lang.annotation.Aspect; |
|||
import org.aspectj.lang.annotation.Before; |
|||
import org.aspectj.lang.reflect.MethodSignature; |
|||
import org.slf4j.Logger; |
|||
import org.slf4j.LoggerFactory; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.core.annotation.Order; |
|||
import org.springframework.stereotype.Component; |
|||
import org.springframework.web.bind.annotation.RequestBody; |
|||
import org.springframework.web.context.request.RequestAttributes; |
|||
import org.springframework.web.context.request.RequestContextHolder; |
|||
import org.springframework.web.context.request.ServletRequestAttributes; |
|||
|
|||
import javax.servlet.http.HttpServletRequest; |
|||
import java.lang.reflect.Method; |
|||
import java.lang.reflect.Parameter; |
|||
import java.util.HashMap; |
|||
import java.util.Map; |
|||
|
|||
/** |
|||
* OpenApi检查请求切面 |
|||
* 1.验签防止参数篡改 |
|||
* 2.timestamp+nonce防止请求重放攻击 |
|||
*/ |
|||
@Aspect |
|||
@Component |
|||
@Order(1) |
|||
public class OpenApiRequestCheckAspect { |
|||
|
|||
@Autowired |
|||
private RedisUtils redisUtils; |
|||
|
|||
@Autowired |
|||
private EpmetCommonServiceOpenFeignClient commonServiceOpenFeignClient; |
|||
|
|||
//请求时差单位：s
|
|||
long requestTimeSecDiff = 120; |
|||
//请求时差，单位：ms
|
|||
long requestTimeMillSecDiff = requestTimeSecDiff * 1000;//单位：ms
|
|||
|
|||
private static final Logger log = LoggerFactory.getLogger(DataFilterAspect.class); |
|||
|
|||
/** |
|||
* @Description 验签 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.24 13:39 |
|||
*/ |
|||
@Before("execution(* com.epmet.controller.*Controller*.*(..)) && @annotation(com.epmet.annotation.OpenApiCheckSign)") |
|||
public void check(JoinPoint point) { |
|||
Object[] args = point.getArgs(); |
|||
MethodSignature methodSignature = (MethodSignature) point.getSignature(); |
|||
Method method = methodSignature.getMethod(); |
|||
Parameter[] parameters = method.getParameters(); |
|||
|
|||
HttpServletRequest request = getRequest(); |
|||
|
|||
Map<String, String> argMap = new HashMap<>(); |
|||
for (int i = 0; i < parameters.length; i++) { |
|||
if (parameters[i].isAnnotationPresent(RequestBody.class)) { |
|||
try { |
|||
argMap = ConvertUtils.entityToMap(args[i]); |
|||
} catch (Exception e) { |
|||
throw new RenException("验签参数转化发生异常"); |
|||
} |
|||
|
|||
break; |
|||
} |
|||
} |
|||
|
|||
fillRequestParamsInfoArgMap(argMap, request); |
|||
if (!OpenApiSignUtils.checkSign(argMap, getSecret(argMap.get(RequestParamKeys.APP_ID)))) { |
|||
// 验签失败
|
|||
throw new RenException(EpmetErrorCode.OPEN_API_SIGN_ERROR.getCode()); |
|||
} |
|||
checkRepeatRequest(argMap); |
|||
} |
|||
|
|||
/** |
|||
* @Description 填充url请求参数到map中，用来签名 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.26 10:13 |
|||
*/ |
|||
private void fillRequestParamsInfoArgMap(Map<String, String> argMap, HttpServletRequest request) { |
|||
fillRequestParamsInfoArgMap(argMap, request, RequestParamKeys.APP_ID); |
|||
fillRequestParamsInfoArgMap(argMap, request, RequestParamKeys.AUTH_TYPE); |
|||
fillRequestParamsInfoArgMap(argMap, request, RequestParamKeys.NONCE); |
|||
fillRequestParamsInfoArgMap(argMap, request, RequestParamKeys.TIMESTAMP); |
|||
fillRequestParamsInfoArgMap(argMap, request, RequestParamKeys.SIGN); |
|||
} |
|||
|
|||
private void fillRequestParamsInfoArgMap(Map<String, String> argMap, HttpServletRequest request, String paramName) { |
|||
String paramValue = request.getParameter(paramName); |
|||
if (StringUtils.isNotBlank(paramName)) { |
|||
argMap.put(paramName, paramValue); |
|||
} |
|||
} |
|||
|
|||
/** |
|||
* 检查请求重放 |
|||
* @param argMap |
|||
*/ |
|||
void checkRepeatRequest(Map<String, String> argMap) { |
|||
String timestampStr = argMap.get(RequestParamKeys.TIMESTAMP); |
|||
if (StringUtils.isBlank(timestampStr)) { |
|||
throw new RenException(EpmetErrorCode.OPEN_API_PARAMS_MISSING.getCode()); |
|||
} |
|||
long timestamp = Long.valueOf(timestampStr).longValue(); |
|||
long now = System.currentTimeMillis(); |
|||
|
|||
if (Math.abs(now - timestamp) > requestTimeMillSecDiff) { |
|||
// 只允许1分钟之内的请求，允许服务器之间时差为1分钟
|
|||
throw new RenException(EpmetErrorCode.OPEN_API_REQUEST_EXPIRED.getCode(), |
|||
String.format("请求已过期，允许时差为%s s", requestTimeSecDiff)); |
|||
} |
|||
String nonce = argMap.get(RequestParamKeys.NONCE); |
|||
String nonceInCache = redisUtils.getString(RedisKeys.getOpenApiNonceKey(nonce)); |
|||
if (StringUtils.isNotBlank(nonceInCache)) { |
|||
throw new RenException(EpmetErrorCode.OPEN_API_REQUEST_REPEAT.getCode()); |
|||
} |
|||
//将nonce缓存到redis，有效期1分钟
|
|||
redisUtils.set(RedisKeys.getOpenApiNonceKey(nonce), System.currentTimeMillis(), requestTimeSecDiff); |
|||
} |
|||
|
|||
/** |
|||
* @return |
|||
* @Description 取secret |
|||
* @author wxz |
|||
* @date 2021.03.24 12:49 |
|||
*/ |
|||
private String getSecret(String appId) { |
|||
String secret = (String) redisUtils.get(RedisKeys.getExternalAppSecretKey(appId)); |
|||
if (StringUtils.isBlank(secret)) { |
|||
Result<String> result = commonServiceOpenFeignClient.getSecret(appId); |
|||
if (!result.success()) { |
|||
throw new RenException("调用common service查询secret失败"); |
|||
} |
|||
secret = result.getData(); |
|||
if (StringUtils.isBlank(secret)) { |
|||
throw new RenException(String.format("根据appId%s没有找到对应的secret", appId)); |
|||
} |
|||
redisUtils.set(RedisKeys.getExternalAppSecretKey(appId), secret); |
|||
} |
|||
return secret; |
|||
} |
|||
|
|||
/** |
|||
* @return |
|||
* @Description 获取request |
|||
* @author wxz |
|||
* @date 2021.03.24 12:52 |
|||
*/ |
|||
public HttpServletRequest getRequest() { |
|||
RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes(); |
|||
ServletRequestAttributes sra = (ServletRequestAttributes) requestAttributes; |
|||
return sra.getRequest(); |
|||
} |
|||
|
|||
/** |
|||
* @return |
|||
* @Description 获取appId |
|||
* @author wxz |
|||
* @date 2021.03.24 12:53 |
|||
*/ |
|||
//public String getAppId(Parameter[] parameters, Object[] args) {
|
|||
// HttpServletRequest request = getRequest();
|
|||
// String appId = request.getHeader("AppId");
|
|||
// if (StringUtils.isBlank(appId)) {
|
|||
// for (int i = 0; i < parameters.length; i++) {
|
|||
// if (parameters[i].isAnnotationPresent(RequestBody.class)) {
|
|||
// Object arg = args[i];
|
|||
// try {
|
|||
// appId = getAppIdFromDTO(arg);
|
|||
// } catch (IllegalAccessException e) {
|
|||
// e.printStackTrace();
|
|||
// }
|
|||
// }
|
|||
// }
|
|||
// }
|
|||
// if (StringUtils.isBlank(appId)) {
|
|||
// throw new RenException("未携带AppId");
|
|||
// }
|
|||
// return appId;
|
|||
//}
|
|||
|
|||
//private String getAppIdFromDTO(Object dto) throws IllegalAccessException {
|
|||
// Field[] declaredFields = dto.getClass().getDeclaredFields();
|
|||
// for (int i = 0; i < declaredFields.length; i++) {
|
|||
// Field field = declaredFields[i];
|
|||
// String fieldName = field.getName();
|
|||
// if ("appId".equals(fieldName)) {
|
|||
// field.setAccessible(true);
|
|||
// String value = (String) field.get(dto);
|
|||
// return value;
|
|||
// }
|
|||
// }
|
|||
// return null;
|
|||
//}
|
|||
|
|||
public static void main(String[] args) { |
|||
System.out.println(System.currentTimeMillis()); |
|||
} |
|||
} |
|||
@ -0,0 +1,15 @@ |
|||
package com.epmet.config; |
|||
|
|||
import lombok.Data; |
|||
import org.springframework.beans.factory.annotation.Value; |
|||
import org.springframework.context.annotation.Configuration; |
|||
import org.springframework.stereotype.Component; |
|||
|
|||
@Component |
|||
@Data |
|||
public class OpenApiConfig { |
|||
|
|||
@Value("${openApi.accessToken.expire}") |
|||
private int accessTokenExpire; |
|||
|
|||
} |
|||
@ -0,0 +1,60 @@ |
|||
package com.epmet.controller; |
|||
|
|||
import com.epmet.annotation.OpenApiCheckSign; |
|||
import com.epmet.commons.tools.exception.RenException; |
|||
import com.epmet.commons.tools.redis.RedisKeys; |
|||
import com.epmet.commons.tools.redis.RedisUtils; |
|||
import com.epmet.commons.tools.utils.Result; |
|||
import com.epmet.dto.result.openapi.GetAccessTokenResultDTO; |
|||
import com.epmet.feign.EpmetCommonServiceOpenFeignClient; |
|||
import com.epmet.service.OpenApiAccessTokenService; |
|||
import org.apache.commons.lang3.StringUtils; |
|||
import org.slf4j.Logger; |
|||
import org.slf4j.LoggerFactory; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.web.bind.annotation.*; |
|||
|
|||
@RestController |
|||
@RequestMapping("open-api") |
|||
public class OpenApiAccessTokenController { |
|||
|
|||
@Autowired |
|||
private OpenApiAccessTokenService openApiAccessTokenService; |
|||
|
|||
@Autowired |
|||
private EpmetCommonServiceOpenFeignClient commonServiceOpenFeignClient; |
|||
|
|||
@Autowired |
|||
private RedisUtils redisUtils; |
|||
|
|||
private Logger logger = LoggerFactory.getLogger(OpenApiAccessTokenController.class); |
|||
|
|||
/** |
|||
* @Description 获取AccessToken |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.23 09:52 |
|||
*/ |
|||
@OpenApiCheckSign |
|||
@PostMapping("get-access-token") |
|||
public Result<GetAccessTokenResultDTO> getAccessToken(@RequestParam("app_id") String appId) { |
|||
// 1.取secret
|
|||
String secret = (String)redisUtils.get(RedisKeys.getExternalAppSecretKey(appId)); |
|||
if (StringUtils.isBlank(secret)) { |
|||
Result<String> result = commonServiceOpenFeignClient.getSecret(appId); |
|||
if (!result.success()) { |
|||
throw new RenException("调用common service查询secret失败"); |
|||
} |
|||
secret = result.getData(); |
|||
if (StringUtils.isBlank(secret)) { |
|||
throw new RenException(String.format("根据appId%s没有找到对应的secret", appId)); |
|||
} |
|||
redisUtils.set(RedisKeys.getExternalAppSecretKey(appId), secret); |
|||
} |
|||
|
|||
//2.生成token
|
|||
GetAccessTokenResultDTO content = openApiAccessTokenService.getAccessToken(appId, secret); |
|||
return new Result<GetAccessTokenResultDTO>().ok(content); |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,27 @@ |
|||
package com.epmet.controller; |
|||
|
|||
import com.epmet.annotation.OpenApiCheckSign; |
|||
import com.epmet.commons.tools.utils.Result; |
|||
import com.epmet.dto.form.openapi.GetOrgDetailFormDTO; |
|||
import org.springframework.web.bind.annotation.*; |
|||
|
|||
@RestController |
|||
@RequestMapping("open-api") |
|||
public class OpenApiOrgController { |
|||
|
|||
/** |
|||
* @Description OpenApiCheckSign是验签注解，OpenApi的接口请加上该注解 |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.24 12:55 |
|||
*/ |
|||
@OpenApiCheckSign |
|||
@PostMapping("/get-org-detail") |
|||
public Result getOrgDetail(@RequestBody GetOrgDetailFormDTO input, |
|||
@RequestHeader("AppId") String appId) { |
|||
return new Result().ok("测试org"); |
|||
} |
|||
|
|||
|
|||
|
|||
} |
|||
@ -0,0 +1,17 @@ |
|||
package com.epmet.service; |
|||
|
|||
import com.epmet.dto.result.openapi.GetAccessTokenResultDTO; |
|||
|
|||
/** |
|||
* access token的service |
|||
*/ |
|||
public interface OpenApiAccessTokenService { |
|||
|
|||
/** |
|||
* @Description 获取AccessToken |
|||
* @return |
|||
* @author wxz |
|||
* @date 2021.03.22 22:57 |
|||
*/ |
|||
GetAccessTokenResultDTO getAccessToken(String appId, String secret); |
|||
} |
|||
@ -0,0 +1,45 @@ |
|||
package com.epmet.service.impl; |
|||
|
|||
import com.epmet.commons.security.jwt.JwtUtils; |
|||
import com.epmet.commons.tools.redis.RedisKeys; |
|||
import com.epmet.commons.tools.redis.RedisUtils; |
|||
import com.epmet.config.OpenApiConfig; |
|||
import com.epmet.dto.result.openapi.GetAccessTokenResultDTO; |
|||
import com.epmet.openapi.constant.RequestParamKeys; |
|||
import com.epmet.service.OpenApiAccessTokenService; |
|||
import org.joda.time.DateTime; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.stereotype.Service; |
|||
|
|||
import java.util.Date; |
|||
import java.util.HashMap; |
|||
|
|||
@Service |
|||
public class OpenApiAccessTokenServiceImpl implements OpenApiAccessTokenService { |
|||
|
|||
@Autowired |
|||
private JwtUtils jwtTokenUtils; |
|||
|
|||
@Autowired |
|||
private OpenApiConfig openApiConfig; |
|||
|
|||
@Autowired |
|||
private RedisUtils redisUtils; |
|||
|
|||
@Override |
|||
public GetAccessTokenResultDTO getAccessToken(String appId, String secret) { |
|||
HashMap<String, Object> claim = new HashMap<>(); |
|||
claim.put(RequestParamKeys.APP_ID, appId); |
|||
|
|||
Date expireTime = DateTime.now().plusSeconds(openApiConfig.getAccessTokenExpire()).toDate(); |
|||
String token = jwtTokenUtils.createToken(claim, expireTime, secret); |
|||
// 缓存token
|
|||
redisUtils.set(RedisKeys.getOpenApiAccessTokenKey(appId), token, openApiConfig.getAccessTokenExpire()); |
|||
|
|||
GetAccessTokenResultDTO content = new GetAccessTokenResultDTO(); |
|||
content.setAccessToken(token); |
|||
content.setExpireTime(expireTime.getTime()); |
|||
|
|||
return content; |
|||
} |
|||
} |
|||
Loading…
Reference in new issue