diff --git a/src/main/java/com/cisd/tms/modules/cert/controller/CertificateController.java b/src/main/java/com/cisd/tms/modules/cert/controller/CertificateController.java index 8206574..7efd325 100644 --- a/src/main/java/com/cisd/tms/modules/cert/controller/CertificateController.java +++ b/src/main/java/com/cisd/tms/modules/cert/controller/CertificateController.java @@ -46,7 +46,7 @@ public class CertificateController { @PostMapping("/import") @Operation(summary = "导入证书", description = "导入 PEM 或 DER 格式的实体/用户证书。系统会校验证书有效期、证书链、KeyUsage、CRL 吊销状态，并根据公钥匹配结果识别实体证书或用户证书。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.IMPORT, summary = "导入证书") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse importCertificate( @@ -65,7 +65,7 @@ public class CertificateController { @PostMapping("/delete") @Operation(summary = "删除证书", description = "根据证书 ID 删除实体/用户证书记录。该操作需要 KEY_ADMIN FULL 会话并启用重放保护和审计。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "删除证书") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse delete(@Valid @RequestBody IdRequest request) { diff --git a/src/main/java/com/cisd/tms/modules/cert/controller/CrlController.java b/src/main/java/com/cisd/tms/modules/cert/controller/CrlController.java index ad707e3..a91613d 100644 --- a/src/main/java/com/cisd/tms/modules/cert/controller/CrlController.java +++ b/src/main/java/com/cisd/tms/modules/cert/controller/CrlController.java @@ -39,7 +39,7 @@ public class CrlController { @PostMapping("/import") @Operation(summary = "导入CRL", description = "导入 PEM 或 DER 格式的 X.509 CRL。系统会校验 CRL 时间窗口、重复指纹、签发者可信 CA、KeyUsage.cRLSign 和 CRL 签名。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.IMPORT, summary = "导入证书吊销列表") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse importCrl( @@ -65,7 +65,7 @@ public class CrlController { @PostMapping("/delete") @Operation(summary = "删除CRL", description = "根据 CRL ID 删除 CRL 元数据及其吊销明细。删除后对应吊销记录不再参与证书运行状态判断。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "删除证书吊销列表") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse delete(@Valid @RequestBody IdRequest request) { diff --git a/src/main/java/com/cisd/tms/modules/cert/controller/EntityController.java b/src/main/java/com/cisd/tms/modules/cert/controller/EntityController.java index edb1900..40b5d44 100644 --- a/src/main/java/com/cisd/tms/modules/cert/controller/EntityController.java +++ b/src/main/java/com/cisd/tms/modules/cert/controller/EntityController.java @@ -46,7 +46,7 @@ public class EntityController { @PostMapping("/create") @Operation(summary = "创建证书实体", description = "为机构创建证书实体并在密码卡中生成签名密钥对。支持 SM2/RSA，当前 P10 生成仅支持 SM2 实体。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.CREATE, summary = "创建证书实体") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse create(@Valid @RequestBody EntityCreateRequest request) { @@ -55,7 +55,7 @@ public class EntityController { @PostMapping("/update") @Operation(summary = "更新证书实体", description = "更新证书实体的机构号、机构名称和允许访问 IP 列表，不修改算法类型、密钥索引或密钥材料。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.UPDATE, summary = "更新证书实体") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse update(@Valid @RequestBody EntityUpdateRequest request) { @@ -65,7 +65,7 @@ public class EntityController { @PostMapping("/delete") @Operation(summary = "删除证书实体", description = "删除证书实体并删除密码卡中的对应用户密钥。若实体已绑定证书，需要先删除证书。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "删除证书实体") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse delete(@Valid @RequestBody IdRequest request) { @@ -75,7 +75,7 @@ public class EntityController { @PostMapping("/gen-p10") @Operation(summary = "生成P10证书请求", description = "使用实体签名密钥生成 PKCS#10 证书请求，并保存证书主题、P10 内容和证书模式。当前仅支持 SM2。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.EXECUTE, summary = "生成证书请求") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse genP10(@Valid @RequestBody EntityGenP10Request request) { diff --git a/src/main/java/com/cisd/tms/modules/cert/controller/TrustedCertController.java b/src/main/java/com/cisd/tms/modules/cert/controller/TrustedCertController.java index 460f433..1c10d6f 100644 --- a/src/main/java/com/cisd/tms/modules/cert/controller/TrustedCertController.java +++ b/src/main/java/com/cisd/tms/modules/cert/controller/TrustedCertController.java @@ -48,7 +48,7 @@ public class TrustedCertController { @PostMapping("/import") @Operation(summary = "导入可信CA证书", description = "导入 PEM 或 DER 格式的可信 CA 证书。系统会校验证书有效期、CA 属性、KeyUsage.keyCertSign，以及非根 CA 的签发链。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.IMPORT, summary = "导入可信证书") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse importTrusted( @@ -67,7 +67,7 @@ public class TrustedCertController { @PostMapping("/delete") @Operation(summary = "删除可信CA证书", description = "删除可信 CA 证书。存在下级 CA 或已签发本地证书时，默认返回依赖数量；传入 force=true 时执行强制删除。") -// @ReplayProtected + @ReplayProtected @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "删除可信证书") @RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL) public ApiResponse delete(@Valid @RequestBody TrustedCertDeleteRequest request) { diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml index 46b163d..9a2f919 100644 --- a/src/main/resources/application.yml +++ b/src/main/resources/application.yml @@ -227,7 +227,7 @@ tms: internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token} internal-auth: # 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。 - enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:false} + enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true} # 关闭内部鉴权后，注入请求上下文的调试角色。 debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:KEY_ADMIN} # 关闭内部鉴权后，注入请求上下文的调试认证等级。