From ce5b20d421936830a459be5067ac495a9152c316 Mon Sep 17 00:00:00 2001 From: waner Date: Mon, 30 Mar 2026 16:35:53 +0800 Subject: [PATCH] refactor: use canonical role codes for ukey signing --- .../modules/auth/service/AuthAdminService.java | 15 +++------------ .../tms/modules/auth/service/AuthService.java | 12 ++---------- .../cisd/tms/modules/mk/dto/UKeySignEntity.java | 3 ++- .../auth/controller/AuthControllerTest.java | 2 +- .../auth/service/AuthAdminServiceTest.java | 4 ++-- .../tms/modules/auth/service/AuthServiceTest.java | 4 ++-- .../modules/mk/controller/LmkControllerTest.java | 4 ++-- 7 files changed, 14 insertions(+), 30 deletions(-) diff --git a/src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java b/src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java index d8aa658..694f665 100644 --- a/src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java +++ b/src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java @@ -196,12 +196,12 @@ public class AuthAdminService { ) { requireKeyAdminFull(operatorRoleCode, operatorAuthLevel); RoleCode targetRole = resolveRoleCode(targetRoleCode); - String legacyRole = toLegacyRole(targetRole); String authKeyPair = lmkService.exportIkPublicKeyHex(); UKeySignDTO dto = new UKeySignDTO(); dto.setPubKey(request.getPubKey()); - dto.setRole(legacyRole); + // 新卡统一使用规范角色编码，不再兼容旧卡角色字符串。 + dto.setRole(targetRole.getCode()); dto.setUid(request.getUid()); dto.setRid(request.getRid()); dto.setExtra(request.getExtra()); @@ -259,7 +259,7 @@ public class AuthAdminService { try { UKeySignDTO dto = new UKeySignDTO(); dto.setPubKey(ukeyPubkey); - dto.setRole(toLegacyRole(resolveRoleCode(targetRoleCode))); + dto.setRole(resolveRoleCode(targetRoleCode).getCode()); dto.setUid(uid); dto.setRid(rid); String authKeyPair = lmkService.exportIkPublicKeyHex(); @@ -278,13 +278,4 @@ public class AuthAdminService { throw new IllegalStateException("serialize ukey issue payload failed", ex); } } - - private String toLegacyRole(RoleCode roleCode) { - return switch (roleCode) { - case SUPER_ADMIN -> "superadmin"; - case KEY_ADMIN -> "keyadmin"; - case AUDIT_ADMIN -> "auditadmin"; - case OPS_ADMIN -> "configadmin"; - }; - } } diff --git a/src/main/java/com/cisd/tms/modules/auth/service/AuthService.java b/src/main/java/com/cisd/tms/modules/auth/service/AuthService.java index bad1b31..5311682 100644 --- a/src/main/java/com/cisd/tms/modules/auth/service/AuthService.java +++ b/src/main/java/com/cisd/tms/modules/auth/service/AuthService.java @@ -378,7 +378,8 @@ public class AuthService { private String buildIssuePayload(String roleCode, UkeyLoginProof proof, String authKeyPair) { UKeySignDTO dto = new UKeySignDTO(); dto.setPubKey(proof.getPubKey()); - dto.setRole(toLegacyRole(RoleCode.valueOf(roleCode))); + // 新卡统一使用规范角色编码参与签名和验签。 + dto.setRole(RoleCode.valueOf(roleCode).getCode()); dto.setUid(proof.getUid()); dto.setRid(proof.getRid()); try { @@ -388,15 +389,6 @@ public class AuthService { } } - private String toLegacyRole(RoleCode roleCode) { - return switch (roleCode) { - case SUPER_ADMIN -> "superadmin"; - case KEY_ADMIN -> "keyadmin"; - case AUDIT_ADMIN -> "auditadmin"; - case OPS_ADMIN -> "configadmin"; - }; - } - private AuthSessionEntity buildSession(String roleCode, AuthMethod authMethod, AuthLevel authLevel) { LocalDateTime issuedAt = now(); AuthSessionEntity entity = new AuthSessionEntity(); diff --git a/src/main/java/com/cisd/tms/modules/mk/dto/UKeySignEntity.java b/src/main/java/com/cisd/tms/modules/mk/dto/UKeySignEntity.java index 90fc647..08bc036 100644 --- a/src/main/java/com/cisd/tms/modules/mk/dto/UKeySignEntity.java +++ b/src/main/java/com/cisd/tms/modules/mk/dto/UKeySignEntity.java @@ -18,7 +18,8 @@ public class UKeySignEntity { */ private String authKeyPair; /** - * 登录角色名称，如：superadmin、keyadmin、configadmin、auditadmin + * 参与签名的角色编码。 + * 新卡统一使用规范角色编码，如：SUPER_ADMIN、KEY_ADMIN、AUDIT_ADMIN、OPS_ADMIN。 */ private String role; /** diff --git a/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java b/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java index 67c38ec..ee3cd8c 100644 --- a/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java +++ b/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java @@ -289,7 +289,7 @@ class AuthControllerTest { .content(""" { "pubKey": "PUB-NEW", - "role": "superadmin", + "role": "SUPER_ADMIN", "uid": "1", "rid": "RID-001", "extra": "EXTRA-001" diff --git a/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java b/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java index a8c1cac..7cca1e9 100644 --- a/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java +++ b/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java @@ -131,7 +131,7 @@ class AuthAdminServiceTest { Assertions.assertEquals("SIG-NEW", updated.getIssuerSign()); Assertions.assertEquals(LocalDateTime.of(2026, 3, 23, 3, 0), updated.getBoundAt()); org.mockito.Mockito.verify(lmkService).verifyIk( - "{\"pubKey\":\"PUB-NEW\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"1\",\"rid\":\"RID-001\"}", + "{\"pubKey\":\"PUB-NEW\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"1\",\"rid\":\"RID-001\"}", "SIG-NEW" ); } @@ -193,7 +193,7 @@ class AuthAdminServiceTest { Assertions.assertEquals("ISSUE-SIGN-001", result.getSign()); Assertions.assertEquals("COMP-001", result.getComponent()); org.mockito.Mockito.verify(lmkService).signIk( - "{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"1\",\"rid\":\"RID-001\"}" + "{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"1\",\"rid\":\"RID-001\"}" ); } diff --git a/src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java b/src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java index db6e096..234e348 100644 --- a/src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java +++ b/src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java @@ -417,11 +417,11 @@ class AuthServiceTest { Assertions.assertEquals(AuthLevel.FULL.name(), response.getAuthLevel()); org.mockito.Mockito.verify(randomService).assertIssued(RoleCode.KEY_ADMIN.getCode(), List.of("RB-1", "RB-2")); org.mockito.Mockito.verify(verifier).verifyIssuedBinding( - "{\"pubKey\":\"PUB-1\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"keyadmin\",\"uid\":\"4\",\"rid\":\"4\"}", + "{\"pubKey\":\"PUB-1\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"KEY_ADMIN\",\"uid\":\"4\",\"rid\":\"4\"}", "ISSUE-1" ); org.mockito.Mockito.verify(verifier).verifyIssuedBinding( - "{\"pubKey\":\"PUB-2\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"keyadmin\",\"uid\":\"5\",\"rid\":\"5\"}", + "{\"pubKey\":\"PUB-2\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"KEY_ADMIN\",\"uid\":\"5\",\"rid\":\"5\"}", "ISSUE-2" ); org.mockito.Mockito.verify(verifier).verifyLoginSignature("PUB-1", "LOGIN-DATA-1", "LOGIN-SIGN-1"); diff --git a/src/test/java/com/cisd/tms/modules/mk/controller/LmkControllerTest.java b/src/test/java/com/cisd/tms/modules/mk/controller/LmkControllerTest.java index 521b947..2b6dd25 100644 --- a/src/test/java/com/cisd/tms/modules/mk/controller/LmkControllerTest.java +++ b/src/test/java/com/cisd/tms/modules/mk/controller/LmkControllerTest.java @@ -49,7 +49,7 @@ class LmkControllerTest { .content(""" { "pubKey": "PUB-001", - "role": "superadmin", + "role": "SUPER_ADMIN", "uid": "2", "rid": "RID-001", "extra": "ignored-extra" @@ -66,7 +66,7 @@ class LmkControllerTest { .andExpect(content().string(containsString("\"USER-SIGN-COMP-002\""))) .andExpect(content().string(containsString("\"USER-ENC-COMP-002\""))); - Mockito.verify(lmkService).signIk(eq("{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"2\",\"rid\":\"RID-001\"}")); + Mockito.verify(lmkService).signIk(eq("{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"2\",\"rid\":\"RID-001\"}")); Mockito.verify(lmkService).buildBackupPacket(2); }