From 1d2524718ff4f3dc49126e30eeaf2510b89848f5 Mon Sep 17 00:00:00 2001 From: waner Date: Tue, 28 Apr 2026 10:15:29 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E5=96=84=E6=9D=83=E9=99=90=E8=A1=A5?= =?UTF-8?q?=E5=85=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../auth/controller/AuthAdminController.java | 2 +- .../modules/auth/controller/AuthController.java | 1 + .../device/controller/DeviceController.java | 6 ++++++ .../device/controller/IpWhitelistController.java | 7 +++++++ .../device/controller/TimeConfigController.java | 3 +++ .../modules/init/controller/InitController.java | 8 ++++++++ .../log/controller/BackupConfigController.java | 5 +++++ .../modules/log/controller/BackupController.java | 6 ++++++ .../log/controller/OperationAuditController.java | 6 ++++++ .../tms/modules/mk/controller/LmkController.java | 13 ++++--------- .../upgrade/controller/UpgradeController.java | 15 ++++++++++++--- 11 files changed, 59 insertions(+), 13 deletions(-) diff --git a/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java b/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java index 3b046d8..8079e33 100644 --- a/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java +++ b/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java @@ -47,7 +47,7 @@ public class AuthAdminController { @GetMapping("/users") @Operation(summary = "查询用户管理列表", description = "按角色类型和状态分页查询角色席位账号列表。") -// @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL) + @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse listUsers( @RequestParam(value = "roleCode", required = false) String roleCode, @RequestParam(value = "status", required = false) String status, diff --git a/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java b/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java index f3cd519..815432c 100644 --- a/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java +++ b/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java @@ -44,6 +44,7 @@ public class AuthController { } @PostMapping("/captcha") + @Deprecated @Operation(summary = "生成验证码", description = "为口令登录流程生成一次性验证码。") public ApiResponse issueCaptcha() { return ApiResponse.success(authService.issueCaptcha()); diff --git a/src/main/java/com/cisd/tms/modules/device/controller/DeviceController.java b/src/main/java/com/cisd/tms/modules/device/controller/DeviceController.java index 7240f21..5dbf1a6 100644 --- a/src/main/java/com/cisd/tms/modules/device/controller/DeviceController.java +++ b/src/main/java/com/cisd/tms/modules/device/controller/DeviceController.java @@ -1,6 +1,9 @@ package com.cisd.tms.modules.device.controller; import com.cisd.tms.common.api.ApiResponse; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.device.dto.DeviceActionResponse; import com.cisd.tms.modules.device.dto.DeviceInfoResponse; import com.cisd.tms.modules.device.dto.DeviceProfileResponse; @@ -46,12 +49,14 @@ public class DeviceController { @GetMapping("/profile") @Operation(summary = "查询设备画像", description = "返回设备静态信息，包括设备信息、硬件信息和按初始化方案裁剪后的软件版本信息。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse profile() { return ApiResponse.success(deviceProfileService.profile()); } @GetMapping("/runtime-status") @Operation(summary = "查询设备运行状态", description = "返回硬件实时资源使用情况、加密卡状态，以及按初始化配置裁剪后的软件运行状态。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse runtimeStatus() { return ApiResponse.success(deviceRuntimeStatusService.loadRuntimeStatus()); } @@ -60,6 +65,7 @@ public class DeviceController { @Operation(summary = "重启设备服务", description = "受理设备重启请求，并记录触发操作的内部用户。") @ReplayProtected @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.RESTART, summary = "重启设备服务") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse restart(HttpServletRequest request) { String operator = (String) request.getAttribute(InternalApiAuthInterceptor.ATTR_ROLE_CODE); return ApiResponse.success(deviceService.restart(operator)); diff --git a/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java b/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java index ce876e5..9eb8d0a 100644 --- a/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java +++ b/src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java @@ -2,6 +2,9 @@ package com.cisd.tms.modules.device.controller; import com.baomidou.mybatisplus.core.metadata.IPage; import com.cisd.tms.common.api.ApiResponse; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.device.dto.network.IpWhitelistRequest; import com.cisd.tms.modules.device.dto.network.IpWhitelistResponse; import com.cisd.tms.modules.device.service.IpWhitelistService; @@ -29,6 +32,7 @@ public class IpWhitelistController { @Operation(summary = "添加IP白名单", description = "新增一条IP白名单记录") @ReplayProtected @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.CREATE, summary = "添加IP白名单") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse addWhitelist(@RequestBody IpWhitelistRequest req) { ipWhitelistService.addWhitelist(req); return ApiResponse.success(); @@ -39,6 +43,7 @@ public class IpWhitelistController { @Operation(summary = "更新IP白名单", description = "根据ID更新IP白名单信息") @ReplayProtected @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "更新IP白名单") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse updateWhitelist(@RequestBody IpWhitelistRequest req) { ipWhitelistService.updateWhitelist(req); return ApiResponse.success(); @@ -48,6 +53,7 @@ public class IpWhitelistController { @Operation(summary = "删除IP白名单", description = "根据ID删除指定IP白名单") @ReplayProtected @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.DELETE, summary = "删除IP白名单") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse deleteWhitelist(@PathVariable Long id) { ipWhitelistService.deleteWhitelist(id); return ApiResponse.success(); @@ -56,6 +62,7 @@ public class IpWhitelistController { @GetMapping("/page") @Operation(summary = "分页查询IP白名单", description = "支持分页查询IP白名单列表") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse> getWhitelistPage(@RequestParam int pageNum, @RequestParam int pageSize, @Parameter( diff --git a/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java b/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java index 0b013b1..c0dd582 100644 --- a/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java +++ b/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java @@ -3,6 +3,9 @@ package com.cisd.tms.modules.device.controller; import com.cisd.tms.common.api.ApiResponse; import com.cisd.tms.common.enums.ErrorCode; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.device.dto.TimeConfigRequest; import com.cisd.tms.modules.device.service.TimeConfigService; import com.cisd.tms.security.internal.ReplayProtected; diff --git a/src/main/java/com/cisd/tms/modules/init/controller/InitController.java b/src/main/java/com/cisd/tms/modules/init/controller/InitController.java index 33e4f3a..5ef0483 100644 --- a/src/main/java/com/cisd/tms/modules/init/controller/InitController.java +++ b/src/main/java/com/cisd/tms/modules/init/controller/InitController.java @@ -1,6 +1,9 @@ package com.cisd.tms.modules.init.controller; import com.cisd.tms.common.api.ApiResponse; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.init.dto.*; import com.cisd.tms.modules.init.service.InitService; import com.cisd.tms.modules.log.annotation.AuditedOperation; @@ -122,6 +125,7 @@ public class InitController { @Operation(summary = "创建重置任务", description = "自动读取当前设备有效初始化快照生成重置任务和步骤记录，任务初始状态为 PENDING。") @ReplayProtected @AuditedOperation(module = ModuleCode.INIT, action = ActionType.CREATE, summary = "创建重置任务") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse createResetTask() { return ApiResponse.success(initService.createResetTask()); } @@ -130,6 +134,7 @@ public class InitController { @Operation(summary = "执行重置任务", description = "异步受理重置任务执行请求，立即返回当前任务快照，实际步骤在后台继续运行。") @ReplayProtected @AuditedOperation(module = ModuleCode.INIT, action = ActionType.EXECUTE, summary = "执行重置任务") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse executeResetTask( @Parameter(description = "重置任务唯一标识") @PathVariable String taskId @@ -139,6 +144,7 @@ public class InitController { @GetMapping("/reset/tasks/{taskId}") @Operation(summary = "查询重置任务详情", description = "返回重置任务的主状态、产品类型和原始计划快照。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse resetTaskDetail( @Parameter(description = "重置任务唯一标识") @PathVariable String taskId @@ -148,6 +154,7 @@ public class InitController { @GetMapping("/reset/tasks/{taskId}/steps") @Operation(summary = "查询重置任务步骤", description = "返回重置任务下全部步骤的执行状态和命令信息。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse> resetTaskSteps( @Parameter(description = "重置任务唯一标识") @PathVariable String taskId @@ -157,6 +164,7 @@ public class InitController { @GetMapping("/reset/tasks/{taskId}/steps/{stepNo}/log") @Operation(summary = "查询重置步骤日志", description = "返回指定重置任务步骤的日志路径和日志内容，用于定位失败原因。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse resetTaskStepLog( @Parameter(description = "重置任务唯一标识") @PathVariable String taskId, diff --git a/src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java b/src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java index 06db5ba..f9c35b0 100644 --- a/src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java +++ b/src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java @@ -1,6 +1,9 @@ package com.cisd.tms.modules.log.controller; import com.cisd.tms.common.api.ApiResponse; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.log.dto.BackupConfigRequest; import com.cisd.tms.modules.log.dto.BackupConfigResponse; import com.cisd.tms.modules.log.service.BackupConfigService; @@ -21,6 +24,7 @@ public class BackupConfigController { @Operation(summary = "查询全局备份配置", description = "获取系统当前的审计日志备份策略，如果未配置过则返回 null") @GetMapping + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse getConfig() { BackupConfigResponse config = backupConfigService.getConfig(); return ApiResponse.success(config); @@ -31,6 +35,7 @@ public class BackupConfigController { */ @Operation(summary = "保存或更新备份配置", description = "创建新的备份配置或覆盖更新已有的全局备份配置") @PostMapping + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse saveOrUpdateConfig(@Validated @RequestBody BackupConfigRequest req) { backupConfigService.saveOrUpdateConfig(req); return ApiResponse.success(); diff --git a/src/main/java/com/cisd/tms/modules/log/controller/BackupController.java b/src/main/java/com/cisd/tms/modules/log/controller/BackupController.java index 59f1774..760b970 100644 --- a/src/main/java/com/cisd/tms/modules/log/controller/BackupController.java +++ b/src/main/java/com/cisd/tms/modules/log/controller/BackupController.java @@ -4,6 +4,9 @@ import com.baomidou.mybatisplus.core.metadata.IPage; import com.cisd.tms.common.api.ApiResponse; import com.cisd.tms.common.enums.ErrorCode; import com.cisd.tms.common.exception.BizException; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.log.dto.BackupRecordPageRequest; import com.cisd.tms.modules.log.dto.BackupRecordResponse; import com.cisd.tms.modules.log.entity.BackupRecordEntity; @@ -34,6 +37,7 @@ public class BackupController { @PostMapping() @Operation(summary = "触发手动备份", description = "执行一次审计日志的备份任务，生成 ZIP 备份包") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse backup() { auditBackupService.manualBackup(); return ApiResponse.success(); @@ -41,6 +45,7 @@ public class BackupController { @PostMapping("/record/page") @Operation(summary = "分页查询备份记录", description = "根据条件（例如：备份类型、操作日期）分页获取历史备份记录列表") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse> queryPage(@RequestBody BackupRecordPageRequest req) { IPage pageResult = backupRecordService.queryPage(req); return ApiResponse.success(pageResult); @@ -49,6 +54,7 @@ public class BackupController { @GetMapping("/record/download/{recordId}") @Operation(summary = "下载备份文件", description = "根据记录的唯一编码 (recordId) 下载对应的 ZIP 备份压缩包文件") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL) public ResponseEntity downloadBackupFile(@PathVariable("recordId") String recordId) { BackupRecordEntity record = backupRecordRepository.findByRecordId(recordId).orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "备份记录不存在")); diff --git a/src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java b/src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java index 2df0d73..13c1a2e 100644 --- a/src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java +++ b/src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java @@ -4,6 +4,9 @@ import com.baomidou.mybatisplus.core.metadata.IPage; import com.cisd.tms.common.api.ApiResponse; import com.cisd.tms.common.enums.ErrorCode; import com.cisd.tms.common.exception.BizException; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.log.dto.AuditLogReviewRequest; import com.cisd.tms.modules.log.dto.OperationAuditLogPageRequest; import com.cisd.tms.modules.log.dto.OperationAuditLogPageResponse; @@ -28,6 +31,7 @@ public class OperationAuditController { @Operation(summary = "分页查询审计日志", description = "根据筛选条件分页获取系统的操作审计日志列表") @PostMapping("/page") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse> queryPage(@RequestBody OperationAuditLogPageRequest req) { IPage pageResult = auditService.queryPage(req); return ApiResponse.success(pageResult); @@ -35,6 +39,7 @@ public class OperationAuditController { @Operation(summary = "获取审计日志详情", description = "根据日志的唯一标识 LogId 获取单条日志的完整信息") @GetMapping("/{logId}") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse getDetail(@PathVariable String logId) { OperationAuditLogResponse detail = auditService.getDetail(logId); return ApiResponse.success(detail); @@ -42,6 +47,7 @@ public class OperationAuditController { @Operation(summary = "审核审计日志", description = "审计管理员对特定的审计日志进行审核操作及意见批注") @PostMapping("/{logId}/review") + @RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse reviewLog(@PathVariable String logId, @RequestBody AuditLogReviewRequest req) { String auditorUser = ""; // 默认 diff --git a/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java b/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java index 2d38822..66f755f 100644 --- a/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java +++ b/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java @@ -3,6 +3,9 @@ package com.cisd.tms.modules.mk.controller; import com.cisd.tms.common.api.ApiResponse; import com.cisd.tms.common.enums.ErrorCode; import com.cisd.tms.common.exception.BizException; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.mk.dto.MasterKeyBackupPacket; import com.cisd.tms.modules.mk.dto.MasterKeyRecoverRequest; import com.cisd.tms.modules.mk.dto.MasterKeyRecoverPacketsRequest; @@ -42,6 +45,7 @@ public class LmkController { @PostMapping("/masterKey/destroy") @Operation(summary = "销毁主密钥", description = "销毁当前密码卡中的主密钥，失败直接抛出异常。") @ReplayProtected + @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse destroyMasterKey() { //销毁主密钥、内部密钥、用户密钥 lmkService.destroyMasterKey(); @@ -68,15 +72,6 @@ public class LmkController { return ApiResponse.success(); } - @GetMapping("/masterKey/sign") - @Operation(summary = "签名测试", description = "") - public ApiResponse signIk(@RequestParam String data) { - String signData = lmkService.signIk(data); - log.info("signData:{}", signData); - lmkService.verifyIk(data, signData); - return ApiResponse.success(); - } - private void validatePacketIndexes(List packets) { if (packets == null || packets.size() != 2) { throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "packets size must be 2"); diff --git a/src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java b/src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java index d3915e6..e6134b1 100644 --- a/src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java +++ b/src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java @@ -1,6 +1,9 @@ package com.cisd.tms.modules.upgrade.controller; import com.cisd.tms.common.api.ApiResponse; +import com.cisd.tms.modules.auth.enums.AuthLevel; +import com.cisd.tms.modules.auth.enums.RoleCode; +import com.cisd.tms.modules.auth.security.RequireInternalAuth; import com.cisd.tms.modules.file.dto.FileUploadResponse; import com.cisd.tms.modules.file.service.FileService; import com.cisd.tms.modules.log.annotation.AuditedOperation; @@ -20,6 +23,7 @@ import org.springframework.web.multipart.MultipartFile; @RestController @RequestMapping("/api/v1") @RequiredArgsConstructor +@ReplayProtected @Tag(name = "离线升级管理", description = "离线升级包上传、预检、任务创建、执行和升级记录查询接口") public class UpgradeController { @@ -29,6 +33,7 @@ public class UpgradeController { @PostMapping("/upgrade-packages") @Operation(summary = "上传离线升级包", description = "上传离线升级包，返回 fileId 供升级预检和任务创建使用。") // @ReplayProtected + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse uploadPackage( @Parameter(description = "待上传的离线升级包") @RequestParam("file") MultipartFile file @@ -38,21 +43,22 @@ public class UpgradeController { @PostMapping("/upgrades/previews") @Operation(summary = "预检离线升级包", description = "根据 fileId 解析升级包，校验摘要和签名，并返回版本变化和是否允许升级。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse preview(@Valid @RequestBody UpgradePreviewRequest request) { return ApiResponse.success(upgradeService.preview(request)); } @PostMapping("/upgrades") @Operation(summary = "创建离线升级任务", description = "根据 fileId 创建离线升级任务，状态初始为 PENDING_CONFIRM。") -// @ReplayProtected @AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.CREATE, summary = "创建离线升级任务") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse create(@Valid @RequestBody UpgradeCreateTaskRequest request) { return ApiResponse.success(upgradeService.createTask(request)); } @PostMapping("/upgrades/{taskId}/execute") @Operation(summary = "执行离线升级任务", description = "异步受理升级执行请求，立即返回任务当前快照。") -// @ReplayProtected + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) @AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.EXECUTE, summary = "执行离线升级任务") public ApiResponse execute( @Parameter(description = "升级任务号") @@ -63,7 +69,7 @@ public class UpgradeController { @PostMapping("/upgrades/{taskId}/rollback") @Operation(summary = "回滚离线升级任务", description = "异步受理升级回滚请求，立即返回任务当前快照。") -// @ReplayProtected + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL) @AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.ROLLBACK, summary = "回滚离线升级任务") public ApiResponse rollback( @Parameter(description = "升级任务号") @@ -74,6 +80,7 @@ public class UpgradeController { @GetMapping("/upgrades") @Operation(summary = "查询升级记录列表", description = "分页查询升级任务列表，支持按升级对象、状态和升级日期筛选。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse list( @RequestParam(defaultValue = "1") int page, @RequestParam(defaultValue = "10") int pageSize, @@ -87,6 +94,7 @@ public class UpgradeController { @GetMapping("/upgrades/{taskId}") @Operation(summary = "查询升级任务详情", description = "返回单个升级任务的状态、版本变化和日志路径等信息。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse detail( @Parameter(description = "升级任务号") @PathVariable String taskId @@ -96,6 +104,7 @@ public class UpgradeController { @GetMapping("/upgrades/{taskId}/log") @Operation(summary = "查询升级任务日志", description = "读取升级任务的日志文件内容，返回升级执行日志。") + @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED) public ApiResponse log( @Parameter(description = "升级任务号") @PathVariable String taskId