Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix：日志和防重放补充

Browse Source
This commit is contained in:
waner 2026-05-22 16:01:26 +08:00
parent 2ddb448351
commit e06317c883
13 changed files with 111 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java
View File

@ -79,6 +79,7 @@ public class AuthAdminController {
@PostMapping("/super-admin/ukeys/issue-sign")
@Operation(summary = "签发并绑定超级管理员 UKey", description = "系统初始化后登记超级管理员 UKey，不要求已有登录态。")
@AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定超级管理员 UKey")
public ApiResponse<UKeySignResult> issueSuperAdminUkeyBindingSign(
@Valid @RequestBody UKeySignDTO request
) {
@ -94,6 +95,7 @@ public class AuthAdminController {
@Operation(summary = "签发并绑定管理员 UKey", description = "仅允许 SUPER_ADMIN FULL 会话登记或重绑定管理员 UKey；超级管理员重绑定需传 ukeyBindingId。")
@ReplayProtected
@RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
@AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定管理员 UKey")
public ApiResponse<UKeySignResult> issueUkeyBindingSign(
@PathVariable("roleCode") String roleCode,
@Valid @RequestBody UKeySignDTO request,

1
src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java
View File

@ -61,6 +61,7 @@ public class AuthController {
@PostMapping("/logout")
@Operation(summary = "退出当前会话", description = "使当前会话失效。")
@AuditedOperation(module = ModuleCode.AUTH, action = ActionType.LOGOUT, summary = "退出当前会话")
@ReplayProtected
public ApiResponse<Void> logout(HttpServletRequest request) {
authService.logout((String) request.getAttribute(InternalApiAuthInterceptor.ATTR_SESSION_TOKEN));
return ApiResponse.success();

12
src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java
View File

@ -3,6 +3,9 @@ import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.device.dto.network.*;
import com.cisd.tms.modules.device.entity.PageResult;
import com.cisd.tms.modules.device.service.NetworkConfigService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.validation.Valid;
@ -37,6 +40,7 @@ public class NetworkConfigController {
@Operation(summary = "配置网卡", description = "配置指定网卡的 IPv4 或 IPv6 地址、前缀长度、网关和状态")
@PostMapping("/card/configure")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置网卡")
public ApiResponse<Void> configureNetworkCard(@RequestBody @Validated NetworkConfigureRequest request) {
networkConfigService.configureNetworkCard(request);
return ApiResponse.success();
@ -44,6 +48,7 @@ public class NetworkConfigController {
@Operation(summary = "新增网卡配置", description = "新增或配置指定网卡的网络地址信息")
@PostMapping("/card/add")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增网卡配置")
public ApiResponse<Void> addNetworkCard(@RequestBody @Validated NetworkConfigureRequest req) {
networkConfigService.configureNetworkCard(req);
return ApiResponse.success();
@ -51,6 +56,7 @@ public class NetworkConfigController {
@Operation(summary = "删除网卡 IP 配置", description = "删除指定网卡下的某条 IPv4 或 IPv6 地址配置")
@PostMapping("/card/delete")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除网卡IP配置")
public ApiResponse<Void> deleteNetworkCardRecord(@RequestBody NetworkDeleteRequest req) {
networkConfigService.deleteNetworkCardRecord(req);
return ApiResponse.success();
@ -65,6 +71,7 @@ public class NetworkConfigController {
@Operation(summary = "删除 Bond", description = "删除指定 Bond 聚合接口及其从属网卡连接配置")
@PostMapping("/bond/delete/{bondName}")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除Bond")
public ApiResponse<Void> deleteBond(@PathVariable String bondName) {
networkConfigService.deleteBond(bondName);
return ApiResponse.success();
@ -79,6 +86,7 @@ public class NetworkConfigController {
@Operation(summary = "创建Bond", description = "创建一个新的Bond聚合接口，需指定名称、模式和从属接口")
@PostMapping("/bond/create")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "创建Bond")
public ApiResponse<Void> createBond(@Valid @RequestBody BondCreateRequest req) {
networkConfigService.createBond(req);
return ApiResponse.success();
@ -86,6 +94,7 @@ public class NetworkConfigController {
@Operation(summary = "配置 Bond", description = "修改指定 Bond 的模式、IP 地址、网关、从属物理网卡和激活状态")
@PostMapping("/bond/config")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置Bond")
public ApiResponse<Void> configBond(@Valid @RequestBody BondConfigRequest req) {
networkConfigService.configBond(req);
return ApiResponse.success();
@ -99,6 +108,7 @@ public class NetworkConfigController {
@Operation(summary = "新增路由", description = "新增一条 IPv4 或 IPv6 静态路由配置，可指定目标地址、前缀长度、网口和下一跳")
@PostMapping("/route/add")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增路由")
public ApiResponse<Void> routeAdd(@Valid @RequestBody RouteCreateRequest req) {
networkConfigService.addRoute(req);
return ApiResponse.success();
@ -106,6 +116,7 @@ public class NetworkConfigController {
@Operation(summary = "修改路由", description = "修改一条已有静态路由，通过删除旧路由并新增新路由实现")
@PostMapping("/route/update")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "修改路由")
public ApiResponse<Void> routeUpdate(@Valid @RequestBody RouteUpdateRequest req) {
networkConfigService.updateRoute(req);
return ApiResponse.success();
@ -113,6 +124,7 @@ public class NetworkConfigController {
@Operation(summary = "删除路由", description = "删除指定网口下的一条 IPv4 或 IPv6 静态路由配置")
@PostMapping("/route/delete")
@AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除路由")
public ApiResponse<Void> routeDelete(@Valid @RequestBody RouteDeleteRequest req) {
networkConfigService.deleteRoute(req);
return ApiResponse.success();

4
src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java
View File

@ -8,6 +8,9 @@ import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.device.dto.TimeConfigRequest;
import com.cisd.tms.modules.device.service.TimeConfigService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.tags.Tag;
import lombok.RequiredArgsConstructor;
@ -25,6 +28,7 @@ public class TimeConfigController {
private final TimeConfigService timeConfigService;
@PostMapping("/time-config")
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "配置系统时间")
public ApiResponse<Void> configureTime(@RequestBody TimeConfigRequest request) {
//todo 鉴权
timeConfigService.processTimeConfig(request);

4
src/main/java/com/cisd/tms/modules/file/controller/FileController.java
View File

@ -4,6 +4,9 @@ import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.file.dto.FileDetailResponse;
import com.cisd.tms.modules.file.dto.FileUploadResponse;
import com.cisd.tms.modules.file.service.FileService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.Parameter;
@ -28,6 +31,7 @@ public class FileController {
// 内部上传入口，前端先拿到 fileId，再把 fileId 传给初始化相关接口。
@PostMapping("/upload")
@ReplayProtected
@AuditedOperation(module = ModuleCode.SYSTEM, action = ActionType.IMPORT, summary = "上传内部文件")
@Operation(summary = "上传初始化文件", description = "上传许可证、配置包等初始化依赖文件，返回 fileId 供后续任务引用。")
public ApiResponse<FileUploadResponse> upload(
@Parameter(description = "待上传的初始化文件")

6
src/main/java/com/cisd/tms/modules/log/controller/AuditLogRestoreController.java
View File

@ -4,7 +4,11 @@ package com.cisd.tms.modules.log.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.modules.log.service.AuditLogRestoreService;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import lombok.RequiredArgsConstructor;
@ -27,6 +31,8 @@ public class AuditLogRestoreController {
summary = "导入 ZIP 恢复审计日志",
description = "上传审计日志的备份压缩包（.zip），系统将进行解密、验签并落库。"
)
@ReplayProtected
@AuditedOperation(module = ModuleCode.LOG, action = ActionType.RECOVER, summary = "恢复审计日志备份")
public ApiResponse<String> restoreFromZip(@RequestParam("file") MultipartFile file) {
if (file.isEmpty() || !file.getOriginalFilename().endsWith(".zip")) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "上传有效的 ZIP 格式备份文件");

6
src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java
View File

@ -4,9 +4,13 @@ import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.dto.BackupConfigRequest;
import com.cisd.tms.modules.log.dto.BackupConfigResponse;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.modules.log.service.BackupConfigService;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import lombok.RequiredArgsConstructor;
@ -35,6 +39,8 @@ public class BackupConfigController {
*/
@Operation(summary = "保存或更新备份配置", description = "创建新的备份配置或覆盖更新已有的全局备份配置")
@PostMapping
@ReplayProtected
@AuditedOperation(module = ModuleCode.LOG, action = ActionType.UPDATE, summary = "保存审计日志备份配置")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> saveOrUpdateConfig(@Validated @RequestBody BackupConfigRequest req) {
backupConfigService.saveOrUpdateConfig(req);

7
src/main/java/com/cisd/tms/modules/log/controller/BackupController.java
View File

@ -13,6 +13,10 @@ import com.cisd.tms.modules.log.entity.BackupRecordEntity;
import com.cisd.tms.modules.log.repository.BackupRecordRepository;
import com.cisd.tms.modules.log.service.AuditBackupService;
import com.cisd.tms.modules.log.service.BackupRecordService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import lombok.RequiredArgsConstructor;
@ -37,6 +41,8 @@ public class BackupController {
@PostMapping()
@Operation(summary = "触发手动备份", description = "执行一次审计日志的备份任务，生成 ZIP 备份包")
@ReplayProtected
@AuditedOperation(module = ModuleCode.LOG, action = ActionType.BACKUP, summary = "触发审计日志备份")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> backup() {
auditBackupService.manualBackup();
@ -54,6 +60,7 @@ public class BackupController {
@GetMapping("/record/download/{recordId}")
@Operation(summary = "下载备份文件", description = "根据记录的唯一编码 (recordId) 下载对应的 ZIP 备份压缩包文件")
@AuditedOperation(module = ModuleCode.LOG, action = ActionType.EXPORT, summary = "下载审计日志备份文件")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ResponseEntity<Resource> downloadBackupFile(@PathVariable("recordId") String recordId) {

6
src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java
View File

@ -7,12 +7,16 @@ import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.dto.AuditLogReviewRequest;
import com.cisd.tms.modules.log.dto.OperationAuditLogPageRequest;
import com.cisd.tms.modules.log.dto.OperationAuditLogPageResponse;
import com.cisd.tms.modules.log.dto.OperationAuditLogResponse;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.modules.log.service.OperationAuditService;
import com.cisd.tms.security.internal.InternalApiAuthInterceptor;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.servlet.http.HttpServletRequest;
@ -47,7 +51,9 @@ public class OperationAuditController {
@Operation(summary = "审核审计日志", description = "审计管理员对特定的审计日志进行审核操作及意见批注")
@PostMapping("/{logId}/review")
@ReplayProtected
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
@AuditedOperation(module = ModuleCode.LOG, action = ActionType.UPDATE, summary = "审核审计日志")
public ApiResponse<Void> reviewLog(@PathVariable String logId, @RequestBody AuditLogReviewRequest req) {
String auditorUser = ""; // 默认

7
src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java
View File

@ -6,6 +6,9 @@ import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.modules.mk.dto.*;
import com.cisd.tms.modules.mk.service.LmkService;
import com.cisd.tms.modules.mk.service.MasterKeyActivateService;
@ -35,6 +38,7 @@ public class LmkController {
@PostMapping("/masterKey/init")
@Operation(summary = "初始化主密钥", description = "执行密码卡初始化识别、主密钥生成加载、内部密钥生成，并返回主密钥状态与校验值。")
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.CREATE, summary = "初始化主密钥")
public ApiResponse<MasterKeyStateResult> initMasterKey() {
return ApiResponse.success(lmkService.initMasterKey());
}
@ -43,6 +47,7 @@ public class LmkController {
@Operation(summary = "销毁主密钥", description = "销毁当前密码卡中的主密钥，失败直接抛出异常。")
@ReplayProtected
@RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "销毁主密钥")
public ApiResponse<Void> destroyMasterKey() {
//销毁主密钥、内部密钥、用户密钥
lmkService.destroyMasterKey();
@ -62,6 +67,7 @@ public class LmkController {
*/
@PostMapping("/masterKey/recover")
@Operation(summary = "恢复全部密钥", description = "请求体需传入两份按 packetIndex 标识的备份包。两份备份包必须分别对应 packetIndex=1、2。服务端会依次恢复 LMK、IK 和用户密钥。")
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.RECOVER, summary = "恢复全部密钥")
public ApiResponse<Void> recoverLmkEx(@Valid @RequestBody MasterKeyRecoverPacketsRequest request) {
validatePacketIndexes(request.getPackets());
lmkService.recoverKeyPackets(request.getPackets());
@ -71,6 +77,7 @@ public class LmkController {
@PostMapping("/masterKey/activate")
@Operation(summary = "设备激活")
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.ENABLE, summary = "设备激活")
public ApiResponse<Void> Activate(@RequestBody MasterKeyActivateRequest masterKeyActivateRequest) {
masterKeyActivateService.activate(masterKeyActivateRequest);
return ApiResponse.success();

10
src/main/java/com/cisd/tms/modules/openapi/service/controller/OpenApiController.java
View File

@ -11,6 +11,10 @@ import com.cisd.tms.modules.openapi.service.dto.RawVerifyRequest;
import com.cisd.tms.modules.openapi.service.dto.RawVerifyResponse;
import com.cisd.tms.modules.openapi.service.dto.UploadCertRequest;
import com.cisd.tms.modules.openapi.service.impl.OpenApiService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
import com.cisd.tms.modules.log.enums.ActionType;
import com.cisd.tms.modules.log.enums.ModuleCode;
import com.cisd.tms.security.internal.ReplayProtected;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.validation.Valid;
@ -38,6 +42,8 @@ public class OpenApiController {
@PostMapping("/rawSign")
@Operation(summary = "裸签名", description = "基于 SM3 SM2 算法进行签名，返回 Base64 编码的签名值")
@ReplayProtected
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.EXECUTE, summary = "执行裸签名")
public ApiResponse<RawSignResponse> rawSign(@Valid @RequestBody RawSignRequest request) {
log.info("收到裸签名请求, DN: {}, sessionId: {}", request.getDn(), request.getSessionId());
@ -116,6 +122,8 @@ public class OpenApiController {
@PostMapping("/dettachedSign")
@Operation(summary = "分离签名", description = "基于 SM3 SM2 算法进行分离签名，返回 Base64 编码的签名值")
@ReplayProtected
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.EXECUTE, summary = "执行分离签名")
public ApiResponse<RawSignResponse> dettachedSign(@Valid @RequestBody DettachedSignRequest request) {
log.info("收到分离签名请求, DN: {}, sessionId: {}", request.getDn(), request.getSessionId());
@ -157,6 +165,8 @@ public class OpenApiController {
@PostMapping("/uploadCert")
@Operation(summary = "上传证书", description = "上传并导入证书")
@ReplayProtected
@AuditedOperation(module = ModuleCode.KEY, action = ActionType.IMPORT, summary = "上传并导入证书")
public ApiResponse<ImportCertificateResponse> uploadCert(@Valid @RequestBody UploadCertRequest request) {
log.info("收到上传证书请求, sessionId: {}", request.getSessionId());

1
src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java
View File

@ -33,6 +33,7 @@ public class UpgradeController {
@PostMapping("/upgrade-packages")
@Operation(summary = "上传离线升级包", description = "上传离线升级包，返回 fileId 供升级预检和任务创建使用。")
// @ReplayProtected
@AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.IMPORT, summary = "上传离线升级包")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<FileUploadResponse> uploadPackage(
@Parameter(description = "待上传的离线升级包")

53
src/test/java/com/cisd/tms/security/internal/ReplayProtectedEndpointsTest.java
View File

@ -4,7 +4,12 @@ import com.cisd.tms.modules.auth.controller.AuthAdminController;
import com.cisd.tms.modules.auth.controller.AuthController;
import com.cisd.tms.modules.device.controller.*;
import com.cisd.tms.modules.init.controller.InitController;
import com.cisd.tms.modules.log.controller.AuditLogRestoreController;
import com.cisd.tms.modules.log.controller.BackupConfigController;
import com.cisd.tms.modules.log.controller.BackupController;
import com.cisd.tms.modules.log.controller.OperationAuditController;
import com.cisd.tms.modules.mk.controller.LmkController;
import com.cisd.tms.modules.openapi.service.controller.OpenApiController;
import com.cisd.tms.modules.upgrade.controller.UpgradeController;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
@ -24,10 +29,10 @@ class ReplayProtectedEndpointsTest {
@Test
void shouldProtectSelectedUpgradeActions() throws Exception {
Assertions.assertNotNull(annotation(UpgradeController.class, "uploadPackage", org.springframework.web.multipart.MultipartFile.class));
Assertions.assertNotNull(annotation(UpgradeController.class, "create", com.cisd.tms.modules.upgrade.dto.UpgradeCreateTaskRequest.class));
Assertions.assertNotNull(annotation(UpgradeController.class, "execute", String.class));
Assertions.assertNotNull(annotation(UpgradeController.class, "rollback", String.class));
Assertions.assertNotNull(effectiveAnnotation(UpgradeController.class, "uploadPackage", org.springframework.web.multipart.MultipartFile.class));
Assertions.assertNotNull(effectiveAnnotation(UpgradeController.class, "create", com.cisd.tms.modules.upgrade.dto.UpgradeCreateTaskRequest.class));
Assertions.assertNotNull(effectiveAnnotation(UpgradeController.class, "execute", String.class));
Assertions.assertNotNull(effectiveAnnotation(UpgradeController.class, "rollback", String.class));
}
@Test
@ -43,8 +48,37 @@ class ReplayProtectedEndpointsTest {
String.class, com.cisd.tms.modules.mk.dto.UKeySignDTO.class, jakarta.servlet.http.HttpServletRequest.class));
Assertions.assertNull(effectiveAnnotation(AuthAdminController.class, "issueSuperAdminUkeyBindingSign",
com.cisd.tms.modules.mk.dto.UKeySignDTO.class));
Assertions.assertNotNull(AnnotatedElementUtils.findMergedAnnotation(TimeConfigController.class, ReplayProtected.class));
Assertions.assertNotNull(AnnotatedElementUtils.findMergedAnnotation(CryptoCardController.class, ReplayProtected.class));
Assertions.assertNotNull(effectiveAnnotation(AuthController.class, "logout", jakarta.servlet.http.HttpServletRequest.class));
Assertions.assertNull(AnnotatedElementUtils.findMergedAnnotation(TimeConfigController.class, ReplayProtected.class));
Assertions.assertNull(AnnotatedElementUtils.findMergedAnnotation(CryptoCardController.class, ReplayProtected.class));
}
@Test
void shouldProtectAuditLogBackupAndRestoreStateChanges() throws Exception {
Assertions.assertNotNull(effectiveAnnotation(BackupController.class, "backup"));
Assertions.assertNotNull(effectiveAnnotation(BackupConfigController.class, "saveOrUpdateConfig",
com.cisd.tms.modules.log.dto.BackupConfigRequest.class));
Assertions.assertNotNull(effectiveAnnotation(OperationAuditController.class, "reviewLog",
String.class, com.cisd.tms.modules.log.dto.AuditLogReviewRequest.class));
Assertions.assertNotNull(effectiveAnnotation(AuditLogRestoreController.class, "restoreFromZip",
org.springframework.web.multipart.MultipartFile.class));
}
@Test
void shouldProtectOpenApiSigningAndCertificateMutationOnly() throws Exception {
Assertions.assertNotNull(effectiveAnnotation(OpenApiController.class, "rawSign",
com.cisd.tms.modules.openapi.service.dto.RawSignRequest.class));
Assertions.assertNotNull(effectiveAnnotation(OpenApiController.class, "dettachedSign",
com.cisd.tms.modules.openapi.service.dto.DettachedSignRequest.class));
Assertions.assertNotNull(effectiveAnnotation(OpenApiController.class, "uploadCert",
com.cisd.tms.modules.openapi.service.dto.UploadCertRequest.class));
Assertions.assertNull(effectiveAnnotation(OpenApiController.class, "rawVerify",
com.cisd.tms.modules.openapi.service.dto.RawVerifyRequest.class));
Assertions.assertNull(effectiveAnnotation(OpenApiController.class, "dettachedVerify",
com.cisd.tms.modules.openapi.service.dto.DettachedVerifyRequest.class));
Assertions.assertNull(effectiveAnnotation(OpenApiController.class, "dettachedVerifySimple",
com.cisd.tms.modules.openapi.service.dto.DettachedVerifyRequest.class));
}
@Test
@ -59,14 +93,13 @@ class ReplayProtectedEndpointsTest {
com.cisd.tms.modules.device.dto.network.IpWhitelistRequest.class));
Assertions.assertNotNull(effectiveAnnotation(IpWhitelistController.class, "deleteWhitelist", Long.class));
Assertions.assertNull(effectiveAnnotation(IpWhitelistController.class, "getWhitelistPage",
com.cisd.tms.modules.device.dto.network.IpWhitelistRequest.class));
int.class, int.class, String.class));
Assertions.assertNotNull(effectiveAnnotation(LmkController.class, "initMasterKey"));
Assertions.assertNull(effectiveAnnotation(LmkController.class, "initMasterKey"));
Assertions.assertNotNull(effectiveAnnotation(LmkController.class, "destroyMasterKey"));
Assertions.assertNotNull(effectiveAnnotation(LmkController.class, "recoverLmkEx",
Assertions.assertNull(effectiveAnnotation(LmkController.class, "recoverLmkEx",
com.cisd.tms.modules.mk.dto.MasterKeyRecoverPacketsRequest.class));
Assertions.assertNull(effectiveAnnotation(LmkController.class, "queryMasterKeyStatus"));
Assertions.assertNull(effectiveAnnotation(LmkController.class, "signIk", String.class));
}
private static ReplayProtected annotation(Class<?> type, String methodName, Class<?>... parameterTypes) throws Exception {