Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: use canonical role codes for ukey signing

Browse Source
This commit is contained in:
waner 2026-03-30 16:35:53 +08:00
parent 7a7503c35e
commit ce5b20d421
7 changed files with 14 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java
View File

@ -196,12 +196,12 @@ public class AuthAdminService {
) { ) {
requireKeyAdminFull(operatorRoleCode, operatorAuthLevel); requireKeyAdminFull(operatorRoleCode, operatorAuthLevel);
RoleCode targetRole = resolveRoleCode(targetRoleCode); RoleCode targetRole = resolveRoleCode(targetRoleCode);
String legacyRole = toLegacyRole(targetRole);
String authKeyPair = lmkService.exportIkPublicKeyHex(); String authKeyPair = lmkService.exportIkPublicKeyHex();
UKeySignDTO dto = new UKeySignDTO(); UKeySignDTO dto = new UKeySignDTO();
dto.setPubKey(request.getPubKey()); dto.setPubKey(request.getPubKey());
dto.setRole(legacyRole); // 新卡统一使用规范角色编码，不再兼容旧卡角色字符串。
dto.setRole(targetRole.getCode());
dto.setUid(request.getUid()); dto.setUid(request.getUid());
dto.setRid(request.getRid()); dto.setRid(request.getRid());
dto.setExtra(request.getExtra()); dto.setExtra(request.getExtra());
@ -259,7 +259,7 @@ public class AuthAdminService {
try { try {
UKeySignDTO dto = new UKeySignDTO(); UKeySignDTO dto = new UKeySignDTO();
dto.setPubKey(ukeyPubkey); dto.setPubKey(ukeyPubkey);
dto.setRole(toLegacyRole(resolveRoleCode(targetRoleCode))); dto.setRole(resolveRoleCode(targetRoleCode).getCode());
dto.setUid(uid); dto.setUid(uid);
dto.setRid(rid); dto.setRid(rid);
String authKeyPair = lmkService.exportIkPublicKeyHex(); String authKeyPair = lmkService.exportIkPublicKeyHex();
@ -278,13 +278,4 @@ public class AuthAdminService {
throw new IllegalStateException("serialize ukey issue payload failed", ex); throw new IllegalStateException("serialize ukey issue payload failed", ex);
} }
} }
private String toLegacyRole(RoleCode roleCode) {
return switch (roleCode) {
case SUPER_ADMIN -> "superadmin";
case KEY_ADMIN -> "keyadmin";
case AUDIT_ADMIN -> "auditadmin";
case OPS_ADMIN -> "configadmin";
};
}
} }

12
src/main/java/com/cisd/tms/modules/auth/service/AuthService.java
View File

@ -378,7 +378,8 @@ public class AuthService {
private String buildIssuePayload(String roleCode, UkeyLoginProof proof, String authKeyPair) { private String buildIssuePayload(String roleCode, UkeyLoginProof proof, String authKeyPair) {
UKeySignDTO dto = new UKeySignDTO(); UKeySignDTO dto = new UKeySignDTO();
dto.setPubKey(proof.getPubKey()); dto.setPubKey(proof.getPubKey());
dto.setRole(toLegacyRole(RoleCode.valueOf(roleCode))); // 新卡统一使用规范角色编码参与签名和验签。
dto.setRole(RoleCode.valueOf(roleCode).getCode());
dto.setUid(proof.getUid()); dto.setUid(proof.getUid());
dto.setRid(proof.getRid()); dto.setRid(proof.getRid());
try { try {
@ -388,15 +389,6 @@ public class AuthService {
} }
} }
private String toLegacyRole(RoleCode roleCode) {
return switch (roleCode) {
case SUPER_ADMIN -> "superadmin";
case KEY_ADMIN -> "keyadmin";
case AUDIT_ADMIN -> "auditadmin";
case OPS_ADMIN -> "configadmin";
};
}
private AuthSessionEntity buildSession(String roleCode, AuthMethod authMethod, AuthLevel authLevel) { private AuthSessionEntity buildSession(String roleCode, AuthMethod authMethod, AuthLevel authLevel) {
LocalDateTime issuedAt = now(); LocalDateTime issuedAt = now();
AuthSessionEntity entity = new AuthSessionEntity(); AuthSessionEntity entity = new AuthSessionEntity();

3
src/main/java/com/cisd/tms/modules/mk/dto/UKeySignEntity.java
View File

@ -18,7 +18,8 @@ public class UKeySignEntity {
*/ */
private String authKeyPair; private String authKeyPair;
/** /**
* 登录角色名称，如：superadmin、keyadmin、configadmin、auditadmin * 参与签名的角色编码。
* 新卡统一使用规范角色编码，如：SUPER_ADMIN、KEY_ADMIN、AUDIT_ADMIN、OPS_ADMIN。
*/ */
private String role; private String role;
/** /**

2
src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
View File

@ -289,7 +289,7 @@ class AuthControllerTest {
.content(""" .content("""
{ {
"pubKey": "PUB-NEW", "pubKey": "PUB-NEW",
"role": "superadmin", "role": "SUPER_ADMIN",
"uid": "1", "uid": "1",
"rid": "RID-001", "rid": "RID-001",
"extra": "EXTRA-001" "extra": "EXTRA-001"

4
src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
View File

@ -131,7 +131,7 @@ class AuthAdminServiceTest {
Assertions.assertEquals("SIG-NEW", updated.getIssuerSign()); Assertions.assertEquals("SIG-NEW", updated.getIssuerSign());
Assertions.assertEquals(LocalDateTime.of(2026, 3, 23, 3, 0), updated.getBoundAt()); Assertions.assertEquals(LocalDateTime.of(2026, 3, 23, 3, 0), updated.getBoundAt());
org.mockito.Mockito.verify(lmkService).verifyIk( org.mockito.Mockito.verify(lmkService).verifyIk(
"{\"pubKey\":\"PUB-NEW\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"1\",\"rid\":\"RID-001\"}", "{\"pubKey\":\"PUB-NEW\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"1\",\"rid\":\"RID-001\"}",
"SIG-NEW" "SIG-NEW"
); );
} }
@ -193,7 +193,7 @@ class AuthAdminServiceTest {
Assertions.assertEquals("ISSUE-SIGN-001", result.getSign()); Assertions.assertEquals("ISSUE-SIGN-001", result.getSign());
Assertions.assertEquals("COMP-001", result.getComponent()); Assertions.assertEquals("COMP-001", result.getComponent());
org.mockito.Mockito.verify(lmkService).signIk( org.mockito.Mockito.verify(lmkService).signIk(
"{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"1\",\"rid\":\"RID-001\"}" "{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"1\",\"rid\":\"RID-001\"}"
); );
} }

4
src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java
View File

@ -417,11 +417,11 @@ class AuthServiceTest {
Assertions.assertEquals(AuthLevel.FULL.name(), response.getAuthLevel()); Assertions.assertEquals(AuthLevel.FULL.name(), response.getAuthLevel());
org.mockito.Mockito.verify(randomService).assertIssued(RoleCode.KEY_ADMIN.getCode(), List.of("RB-1", "RB-2")); org.mockito.Mockito.verify(randomService).assertIssued(RoleCode.KEY_ADMIN.getCode(), List.of("RB-1", "RB-2"));
org.mockito.Mockito.verify(verifier).verifyIssuedBinding( org.mockito.Mockito.verify(verifier).verifyIssuedBinding(
"{\"pubKey\":\"PUB-1\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"keyadmin\",\"uid\":\"4\",\"rid\":\"4\"}", "{\"pubKey\":\"PUB-1\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"KEY_ADMIN\",\"uid\":\"4\",\"rid\":\"4\"}",
"ISSUE-1" "ISSUE-1"
); );
org.mockito.Mockito.verify(verifier).verifyIssuedBinding( org.mockito.Mockito.verify(verifier).verifyIssuedBinding(
"{\"pubKey\":\"PUB-2\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"keyadmin\",\"uid\":\"5\",\"rid\":\"5\"}", "{\"pubKey\":\"PUB-2\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"KEY_ADMIN\",\"uid\":\"5\",\"rid\":\"5\"}",
"ISSUE-2" "ISSUE-2"
); );
org.mockito.Mockito.verify(verifier).verifyLoginSignature("PUB-1", "LOGIN-DATA-1", "LOGIN-SIGN-1"); org.mockito.Mockito.verify(verifier).verifyLoginSignature("PUB-1", "LOGIN-DATA-1", "LOGIN-SIGN-1");

4
src/test/java/com/cisd/tms/modules/mk/controller/LmkControllerTest.java
View File

@ -49,7 +49,7 @@ class LmkControllerTest {
.content(""" .content("""
{ {
"pubKey": "PUB-001", "pubKey": "PUB-001",
"role": "superadmin", "role": "SUPER_ADMIN",
"uid": "2", "uid": "2",
"rid": "RID-001", "rid": "RID-001",
"extra": "ignored-extra" "extra": "ignored-extra"
@ -66,7 +66,7 @@ class LmkControllerTest {
.andExpect(content().string(containsString("\"USER-SIGN-COMP-002\""))) .andExpect(content().string(containsString("\"USER-SIGN-COMP-002\"")))
.andExpect(content().string(containsString("\"USER-ENC-COMP-002\""))); .andExpect(content().string(containsString("\"USER-ENC-COMP-002\"")));
Mockito.verify(lmkService).signIk(eq("{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"superadmin\",\"uid\":\"2\",\"rid\":\"RID-001\"}")); Mockito.verify(lmkService).signIk(eq("{\"pubKey\":\"PUB-001\",\"authKeyPair\":\"IK-PUB-001\",\"role\":\"SUPER_ADMIN\",\"uid\":\"2\",\"rid\":\"RID-001\"}"));
Mockito.verify(lmkService).buildBackupPacket(2); Mockito.verify(lmkService).buildBackupPacket(2);
} }