Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix：u盾绑定

Browse Source
This commit is contained in:
waner
2026-05-14 09:39:09 +08:00
parent c55ae9a35e
commit 34e4e274a8
19 changed files with 725 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java
+1 -6
View File
@@ -1,8 +1,6 @@
package com.cisd.tms.modules.auth.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.dto.AdminChangePasswordRequest;
import com.cisd.tms.modules.auth.dto.AuthUserListResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
@@ -93,7 +91,7 @@ public class AuthAdminController {
}
@PostMapping("/roles/{roleCode}/ukeys/issue-sign")
@Operation(summary = "签发并绑定其他管理员 UKey", description = "仅允许 SUPER_ADMIN FULL 会话登记其他管理员的 UKey。")
@Operation(summary = "签发并绑定管理员 UKey", description = "仅允许 SUPER_ADMIN FULL 会话登记或重绑定管理员 UKey；超级管理员重绑定需传 ukeyBindingId。")
@ReplayProtected
@RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<UKeySignResult> issueUkeyBindingSign(
@@ -101,9 +99,6 @@ public class AuthAdminController {
@Valid @RequestBody UKeySignDTO request,
HttpServletRequest httpRequest
) {
if (RoleCode.SUPER_ADMIN.getCode().equals(roleCode)) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "use super-admin ukey binding endpoint");
}
return ApiResponse.success(authAdminService.issueUkeyBindingSign(
(String) httpRequest.getAttribute(InternalApiAuthInterceptor.ATTR_ROLE_CODE),
(String) httpRequest.getAttribute(InternalApiAuthInterceptor.ATTR_AUTH_LEVEL),
src/main/java/com/cisd/tms/modules/auth/mapper/AuthSessionMapper.java
+2
View File
@@ -24,4 +24,6 @@ public interface AuthSessionMapper extends BaseMapperX<AuthSessionEntity> {
@Param("authenticatedPrincipalsJson") String authenticatedPrincipalsJson,
@Param("now") LocalDateTime now
);
int deleteAll();
}
src/main/java/com/cisd/tms/modules/auth/mapper/RoleUkeyBindingMapper.java
+7
View File
@@ -12,4 +12,11 @@ public interface RoleUkeyBindingMapper extends BaseMapperX<RoleUkeyBindingEntity
List<RoleUkeyBindingEntity> selectActiveByRoleCodeAndUid(@Param("roleCode") String roleCode, @Param("uid") Integer uid);
List<RoleUkeyBindingEntity> selectActiveByRoleCode(@Param("roleCode") String roleCode);
List<RoleUkeyBindingEntity> selectActiveByUkeyIdentity(
@Param("ukeySerial") String ukeySerial,
@Param("ukeyPubkey") String ukeyPubkey
);
int deleteAll();
}
src/main/java/com/cisd/tms/modules/auth/repository/AuthSessionRepository.java
+2
View File
@@ -21,4 +21,6 @@ public interface AuthSessionRepository {
void save(AuthSessionEntity entity);
void update(AuthSessionEntity entity);
void deleteAll();
}
src/main/java/com/cisd/tms/modules/auth/repository/RoleUkeyBindingRepository.java
+7
View File
@@ -2,14 +2,21 @@ package com.cisd.tms.modules.auth.repository;
import com.cisd.tms.modules.auth.entity.RoleUkeyBindingEntity;
import java.util.List;
import java.util.Optional;
public interface RoleUkeyBindingRepository {
Optional<RoleUkeyBindingEntity> findById(Long id);
List<RoleUkeyBindingEntity> findActiveByRoleCodeAndUid(String roleCode, Integer uid);
List<RoleUkeyBindingEntity> findActiveByRoleCode(String roleCode);
List<RoleUkeyBindingEntity> findActiveByUkeyIdentity(String ukeySerial, String ukeyPubkey);
void save(RoleUkeyBindingEntity entity);
void update(RoleUkeyBindingEntity entity);
void deleteAll();
}
src/main/java/com/cisd/tms/modules/auth/repository/impl/AuthSessionRepositoryImpl.java
+5
View File
@@ -51,4 +51,9 @@ public class AuthSessionRepositoryImpl implements AuthSessionRepository {
public void update(AuthSessionEntity entity) {
authSessionMapper.updateById(entity);
}
@Override
public void deleteAll() {
authSessionMapper.deleteAll();
}
}
src/main/java/com/cisd/tms/modules/auth/repository/impl/RoleUkeyBindingRepositoryImpl.java
+16
View File
@@ -4,6 +4,7 @@ import com.cisd.tms.modules.auth.entity.RoleUkeyBindingEntity;
import com.cisd.tms.modules.auth.mapper.RoleUkeyBindingMapper;
import com.cisd.tms.modules.auth.repository.RoleUkeyBindingRepository;
import java.util.List;
import java.util.Optional;
import org.springframework.stereotype.Repository;
@Repository
@@ -15,6 +16,11 @@ public class RoleUkeyBindingRepositoryImpl implements RoleUkeyBindingRepository
this.roleUkeyBindingMapper = roleUkeyBindingMapper;
}
@Override
public Optional<RoleUkeyBindingEntity> findById(Long id) {
return Optional.ofNullable(roleUkeyBindingMapper.selectById(id));
}
@Override
public List<RoleUkeyBindingEntity> findActiveByRoleCodeAndUid(String roleCode, Integer uid) {
return roleUkeyBindingMapper.selectActiveByRoleCodeAndUid(roleCode, uid);
@@ -25,6 +31,11 @@ public class RoleUkeyBindingRepositoryImpl implements RoleUkeyBindingRepository
return roleUkeyBindingMapper.selectActiveByRoleCode(roleCode);
}
@Override
public List<RoleUkeyBindingEntity> findActiveByUkeyIdentity(String ukeySerial, String ukeyPubkey) {
return roleUkeyBindingMapper.selectActiveByUkeyIdentity(ukeySerial, ukeyPubkey);
}
@Override
public void save(RoleUkeyBindingEntity entity) {
roleUkeyBindingMapper.insert(entity);
@@ -34,4 +45,9 @@ public class RoleUkeyBindingRepositoryImpl implements RoleUkeyBindingRepository
public void update(RoleUkeyBindingEntity entity) {
roleUkeyBindingMapper.updateById(entity);
}
@Override
public void deleteAll() {
roleUkeyBindingMapper.deleteAll();
}
}
src/main/java/com/cisd/tms/modules/auth/service/AuthSecurityResetService.java
+6
View File
@@ -0,0 +1,6 @@
package com.cisd.tms.modules.auth.service;
public interface AuthSecurityResetService {
void resetAfterMasterKeyInitialized();
}
src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java
+103 -14
View File
@@ -136,6 +136,7 @@ public class AuthAdminServiceImpl implements AuthAdminService {
.sorted(Comparator
.comparingInt((AuthUserListItemResponse item) -> roleOrder(item.getRoleCode()))
.thenComparing(AuthUserListItemResponse::getUid, Comparator.nullsLast(Integer::compareTo))
.thenComparingInt(this::ukeyDisplayOrder)
.thenComparing(AuthUserListItemResponse::getUkeyBindingId, Comparator.nullsLast(Long::compareTo))
.thenComparing(AuthUserListItemResponse::getUkeySerialNo, Comparator.nullsLast(String::compareTo)))
.toList();
@@ -180,19 +181,29 @@ public class AuthAdminServiceImpl implements AuthAdminService {
.stream()
.toList();
if (bindings.isEmpty()) {
return Stream.of(toUserListItem(account, role, null));
return Stream.of(toUserListItem(account, role, null, null));
}
return bindings.stream().map(binding -> toUserListItem(account, role, binding));
List<AuthUserListItemResponse> items = new ArrayList<>();
for (int index = 0; index < bindings.size(); index++) {
String bindingLabel = index == 0 ? "主U盾" : "备份U盾";
items.add(toUserListItem(account, role, bindings.get(index), bindingLabel));
}
return items.stream();
}
private AuthUserListItemResponse toUserListItem(AuthFullAccountEntity account, RoleAccountEntity role, RoleUkeyBindingEntity binding) {
private AuthUserListItemResponse toUserListItem(
AuthFullAccountEntity account,
RoleAccountEntity role,
RoleUkeyBindingEntity binding,
String bindingLabel
) {
String effectiveStatus = effectiveStatus(role, account);
AuthUserListItemResponse item = new AuthUserListItemResponse();
item.setRoleCode(account.getRoleCode());
item.setRoleName(role == null ? roleDisplayName(account.getRoleCode()) : role.getDisplayName());
item.setUid(account.getUid());
item.setUsername(account.getAccountName());
item.setDisplayName(account.getDisplayName());
item.setDisplayName(bindingLabel == null ? account.getDisplayName() : account.getDisplayName() + "-" + bindingLabel);
item.setStatus(effectiveStatus);
item.setStatusName(statusName(effectiveStatus));
item.setLastLoginAt(account.getLastLoginAt());
@@ -203,6 +214,20 @@ public class AuthAdminServiceImpl implements AuthAdminService {
return item;
}
private int ukeyDisplayOrder(AuthUserListItemResponse item) {
String displayName = item.getDisplayName();
if (displayName == null) {
return 0;
}
if (displayName.endsWith("-主U盾")) {
return 0;
}
if (displayName.endsWith("-备份U盾")) {
return 1;
}
return 0;
}
private String effectiveStatus(RoleAccountEntity role, AuthFullAccountEntity account) {
if (role != null && !RoleAccountStatus.ACTIVE.name().equals(role.getStatus())) {
return role.getStatus();
@@ -287,6 +312,9 @@ public class AuthAdminServiceImpl implements AuthAdminService {
authFullAccountRepository.findByRoleCodeAndUid(targetRoleCode, uid)
.orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "目标角色完整账号不存在"));
if (RoleCode.SUPER_ADMIN != targetRole) {
unbindActiveSeatBindings(targetRoleCode, uid);
}
RoleUkeyBindingEntity binding = findExistingActiveBinding(targetRoleCode, uid, ukeySerial, ukeyPubkey);
if (binding.getId() == null) {
binding.setId((long) Math.abs(Objects.hash(targetRoleCode, uid, ukeySerial, TraceIdUtil.newTraceId())));
@@ -302,6 +330,16 @@ public class AuthAdminServiceImpl implements AuthAdminService {
roleUkeyBindingRepository.update(binding);
}
private void rebindSuperAdminUkey(
RoleUkeyBindingEntity binding,
String ukeySerial,
String ukeyPubkey,
String issuerSign
) {
applyBinding(binding, ukeySerial, ukeyPubkey, issuerSign);
roleUkeyBindingRepository.update(binding);
}
private RoleUkeyBindingEntity findExistingActiveBinding(
String roleCode,
Integer uid,
@@ -315,6 +353,29 @@ public class AuthAdminServiceImpl implements AuthAdminService {
.orElseGet(RoleUkeyBindingEntity::new);
}
private void unbindActiveSeatBindings(String roleCode, Integer uid) {
for (RoleUkeyBindingEntity existing : roleUkeyBindingRepository.findActiveByRoleCodeAndUid(roleCode, uid)) {
existing.setStatus("UNBOUND");
existing.setUnboundAt(now());
roleUkeyBindingRepository.update(existing);
}
}
private RoleUkeyBindingEntity loadSuperAdminBindingForRebind(Integer uid, Long ukeyBindingId) {
if (ukeyBindingId == null) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "超级管理员UKey重绑定必须指定ukeyBindingId");
}
RoleUkeyBindingEntity binding = roleUkeyBindingRepository.findById(ukeyBindingId)
.orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "超级管理员UKey绑定记录不存在"));
boolean matchesSuperAdminSeat = RoleCode.SUPER_ADMIN.getCode().equals(binding.getRoleCode())
&& Objects.equals(uid, binding.getUid())
&& "ACTIVE".equals(binding.getStatus());
if (!matchesSuperAdminSeat) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "ukeyBindingId不属于目标超级管理员席位");
}
return binding;
}
@Override
public UKeySignResult issueUkeyBindingSign(
String operatorRoleCode,
@@ -324,6 +385,17 @@ public class AuthAdminServiceImpl implements AuthAdminService {
) {
RoleCode targetRole = resolveRoleCode(targetRoleCode);
validateRoleUid(targetRole, request.getUid());
if (request.getUkeySerial() == null || request.getUkeySerial().isBlank()) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "ukeySerial不能为空");
}
boolean bootstrapSuperAdmin = RoleCode.SUPER_ADMIN == targetRole && operatorRoleCode == null && operatorAuthLevel == null;
RoleUkeyBindingEntity superAdminRebindTarget = null;
if (RoleCode.SUPER_ADMIN == targetRole && !bootstrapSuperAdmin) {
superAdminRebindTarget = loadSuperAdminBindingForRebind(request.getUid(), request.getUkeyBindingId());
rejectUkeyBoundToAnotherBinding(request.getUkeySerial(), request.getPubKey(), superAdminRebindTarget.getId());
} else {
rejectUkeyBoundToDifferentSeat(targetRole.getCode(), request.getUid(), request.getUkeySerial(), request.getPubKey());
}
String authKeyPair = lmkService.exportIkPublicKeyHex();
UKeySignDTO dto = new UKeySignDTO();
@@ -332,19 +404,20 @@ public class AuthAdminServiceImpl implements AuthAdminService {
String signValue = lmkService.signIk(toIssuePayload(dto, authKeyPair, targetRole.getCode()));
MasterKeyBackupPacket backupPacket = null;
if (request.getUkeySerial() == null || request.getUkeySerial().isBlank()) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "ukeySerial不能为空");
}
if (RoleCode.SUPER_ADMIN == targetRole) {
backupPacket = lmkService.buildBackupPacket(request.getUid());
}
bindUkey(
targetRole.getCode(),
request.getUid(),
request.getUkeySerial(),
request.getPubKey(),
signValue
);
if (superAdminRebindTarget != null) {
rebindSuperAdminUkey(superAdminRebindTarget, request.getUkeySerial(), request.getPubKey(), signValue);
} else {
bindUkey(
targetRole.getCode(),
request.getUid(),
request.getUkeySerial(),
request.getPubKey(),
signValue
);
}
enableRoleAfterUkeyBindingIfReady(targetRole);
return UKeySignResult.builder()
.sign(signValue)
@@ -352,6 +425,22 @@ public class AuthAdminServiceImpl implements AuthAdminService {
.build();
}
private void rejectUkeyBoundToDifferentSeat(String roleCode, Integer uid, String ukeySerial, String ukeyPubkey) {
boolean boundToDifferentSeat = roleUkeyBindingRepository.findActiveByUkeyIdentity(ukeySerial, ukeyPubkey).stream()
.anyMatch(binding -> !Objects.equals(binding.getRoleCode(), roleCode) || !Objects.equals(binding.getUid(), uid));
if (boundToDifferentSeat) {
throw new BizException(ErrorCode.CONFLICT.getCode(), "UKey已绑定到其他角色席位");
}
}
private void rejectUkeyBoundToAnotherBinding(String ukeySerial, String ukeyPubkey, Long allowedBindingId) {
boolean boundToAnotherBinding = roleUkeyBindingRepository.findActiveByUkeyIdentity(ukeySerial, ukeyPubkey).stream()
.anyMatch(binding -> !Objects.equals(binding.getId(), allowedBindingId));
if (boundToAnotherBinding) {
throw new BizException(ErrorCode.CONFLICT.getCode(), "UKey已绑定到其他角色席位");
}
}
private void applyBinding(
RoleUkeyBindingEntity binding,
String ukeySerial,
src/main/java/com/cisd/tms/modules/auth/service/impl/AuthSecurityResetServiceImpl.java
+178
View File
@@ -0,0 +1,178 @@
package com.cisd.tms.modules.auth.service.impl;
import com.cisd.tms.modules.auth.entity.AuthFullAccountEntity;
import com.cisd.tms.modules.auth.entity.RoleAccountEntity;
import com.cisd.tms.modules.auth.enums.RoleAccountStatus;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.repository.AuthFullAccountRepository;
import com.cisd.tms.modules.auth.repository.AuthSessionRepository;
import com.cisd.tms.modules.auth.repository.RoleAccountRepository;
import com.cisd.tms.modules.auth.repository.RoleUkeyBindingRepository;
import com.cisd.tms.modules.auth.service.AuthSecurityResetService;
import java.time.Clock;
import java.time.LocalDateTime;
import java.time.ZoneOffset;
import java.util.List;
import java.util.Map;
import java.util.function.Function;
import java.util.stream.Collectors;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
@Service
public class AuthSecurityResetServiceImpl implements AuthSecurityResetService {
private final RoleAccountRepository roleAccountRepository;
private final AuthFullAccountRepository authFullAccountRepository;
private final RoleUkeyBindingRepository roleUkeyBindingRepository;
private final AuthSessionRepository authSessionRepository;
private final Clock clock;
public AuthSecurityResetServiceImpl(
RoleAccountRepository roleAccountRepository,
AuthFullAccountRepository authFullAccountRepository,
RoleUkeyBindingRepository roleUkeyBindingRepository,
AuthSessionRepository authSessionRepository,
Clock clock
) {
this.roleAccountRepository = roleAccountRepository;
this.authFullAccountRepository = authFullAccountRepository;
this.roleUkeyBindingRepository = roleUkeyBindingRepository;
this.authSessionRepository = authSessionRepository;
this.clock = clock;
}
@Override
@Transactional
public void resetAfterMasterKeyInitialized() {
roleUkeyBindingRepository.deleteAll();
authSessionRepository.deleteAll();
Map<String, RoleAccountEntity> rolesByCode = roleAccountRepository.findAll().stream()
.collect(Collectors.toMap(RoleAccountEntity::getRoleCode, Function.identity(), (left, right) -> left));
for (SeedRole seed : seedRoles()) {
RoleAccountEntity role = rolesByCode.getOrDefault(seed.roleCode(), new RoleAccountEntity());
boolean existing = role.getRoleCode() != null;
if (!existing) {
role.setId(seed.id());
}
role.setRoleCode(seed.roleCode());
role.setDisplayName(seed.displayName());
role.setRequiredUkeyCount(seed.requiredUkeyCount());
role.setStatus(seed.status());
if (existing) {
roleAccountRepository.update(role);
} else {
roleAccountRepository.save(role);
}
}
LocalDateTime current = LocalDateTime.ofInstant(clock.instant(), ZoneOffset.UTC);
Map<String, AuthFullAccountEntity> accountsBySeat = authFullAccountRepository.findAll().stream()
.collect(Collectors.toMap(
account -> seatKey(account.getRoleCode(), account.getUid()),
Function.identity(),
(left, right) -> left
));
for (SeedFullAccount seed : seedFullAccounts()) {
AuthFullAccountEntity account = accountsBySeat.getOrDefault(seatKey(seed.roleCode(), seed.uid()), new AuthFullAccountEntity());
boolean existing = account.getRoleCode() != null;
if (!existing) {
account.setId(seed.id());
}
account.setRoleCode(seed.roleCode());
account.setUid(seed.uid());
account.setAccountName(seed.accountName());
account.setDisplayName(seed.displayName());
account.setPasswordHash(seed.passwordHash());
account.setPasswordSalt(seed.passwordSalt());
account.setStatus(RoleAccountStatus.ACTIVE.name());
account.setNeedChangePassword(Boolean.TRUE);
account.setPasswordChangedAt(current);
account.setFailedCount(0);
account.setLockedUntil(null);
account.setLastLoginAt(null);
account.setLastActiveAt(null);
if (existing) {
authFullAccountRepository.update(account);
} else {
authFullAccountRepository.save(account);
}
}
}
private String seatKey(String roleCode, Integer uid) {
return roleCode + "#" + uid;
}
private List<SeedRole> seedRoles() {
return List.of(
new SeedRole(11001L, RoleCode.SUPER_ADMIN.getCode(), "超级管理员", 2, RoleAccountStatus.ACTIVE.name()),
new SeedRole(11002L, RoleCode.KEY_ADMIN.getCode(), "密钥管理员", 1, RoleAccountStatus.ACTIVE.name()),
new SeedRole(11003L, RoleCode.AUDIT_ADMIN.getCode(), "审计管理员", 1, RoleAccountStatus.UNENABLED.name()),
new SeedRole(11004L, RoleCode.OPS_ADMIN.getCode(), "运维管理员", 1, RoleAccountStatus.UNENABLED.name())
);
}
private List<SeedFullAccount> seedFullAccounts() {
return List.of(
new SeedFullAccount(
12101L,
RoleCode.SUPER_ADMIN.getCode(),
1,
"super-admin-full-01",
"超级管理员UKey席位一",
"Viuew8WE+qziUZwGGU0x25cUpzsTF+QvQFU0uhb+yVA=",
"init-super-admin-salt-20260325"
),
new SeedFullAccount(
12102L,
RoleCode.SUPER_ADMIN.getCode(),
2,
"super-admin-full-02",
"超级管理员UKey席位二",
"Viuew8WE+qziUZwGGU0x25cUpzsTF+QvQFU0uhb+yVA=",
"init-super-admin-salt-20260325"
),
new SeedFullAccount(
12103L,
RoleCode.KEY_ADMIN.getCode(),
1,
"key-admin-full-01",
"密钥管理员UKey席位",
"/xqmDy3A/q9X5p7XWznIPSBabQ6bxTLAPgtHQ6Be33c=",
"init-key-admin-salt-20260325"
),
new SeedFullAccount(
12104L,
RoleCode.AUDIT_ADMIN.getCode(),
1,
"audit-admin-full-01",
"审计管理员UKey席位",
"j/J1LKyUOzVEJfbbHe2dwKBKNdabRk502olk/LWIwhg=",
"init-audit-admin-salt-20260325"
),
new SeedFullAccount(
12105L,
RoleCode.OPS_ADMIN.getCode(),
1,
"ops-admin-full-01",
"运维管理员UKey席位",
"2e9F4aCgsDb+AuD1LrBEqEg8yjy3ODo27UHtx06vj/A=",
"init-ops-admin-salt-20260325"
)
);
}
private record SeedRole(Long id, String roleCode, String displayName, int requiredUkeyCount, String status) {
}
private record SeedFullAccount(
Long id,
String roleCode,
int uid,
String accountName,
String displayName,
String passwordHash,
String passwordSalt
) {
}
}
src/main/java/com/cisd/tms/modules/mk/dto/UKeySignDTO.java
+5
View File
@@ -20,6 +20,11 @@ public class UKeySignDTO {
*/
@NotBlank(message = "ukeySerial不能为空")
private String ukeySerial;
/**
* 角色 UKey 绑定记录 ID。超级管理员主/备 UKey 重绑定时用于精确定位目标记录。
*/
private Long ukeyBindingId;
/**
* 角色内固定席位编号。
src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java
+19 -2
View File
@@ -9,6 +9,7 @@ import com.cisd.tms.integration.crypto.pcie.jna.EccRefPublicKey;
import com.cisd.tms.integration.crypto.pcie.jna.EccSignature;
import com.cisd.tms.integration.crypto.pcie.model.*;
import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
import com.cisd.tms.modules.auth.service.AuthSecurityResetService;
import com.cisd.tms.modules.mk.common.LMKConstant;
import com.cisd.tms.modules.mk.config.MasterKeyInitProperties;
import com.cisd.tms.modules.mk.dto.MasterKeyBackupMaterial;
@@ -31,9 +32,9 @@ import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.bouncycastle.util.encoders.Hex;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
/**
@@ -41,7 +42,6 @@ import org.springframework.stereotype.Service;
*/
@Slf4j
@Service
@RequiredArgsConstructor
public class LmkServiceImpl implements LmkService {
// 对外接口只暴露两份备份包：packet 1 = {1,2}，packet 2 = {2,3}。
@@ -67,9 +67,25 @@ public class LmkServiceImpl implements LmkService {
private final PcieCryptoService pcieCryptoService;
private final MasterKeyInitProperties masterKeyInitProperties;
private final AuthSecurityResetService authSecurityResetService;
private final Object backupRoundLock = new Object();
private CachedBackupRound cachedBackupRound;
@Autowired
public LmkServiceImpl(
PcieCryptoService pcieCryptoService,
MasterKeyInitProperties masterKeyInitProperties,
AuthSecurityResetService authSecurityResetService
) {
this.pcieCryptoService = pcieCryptoService;
this.masterKeyInitProperties = masterKeyInitProperties;
this.authSecurityResetService = authSecurityResetService;
}
public LmkServiceImpl(PcieCryptoService pcieCryptoService, MasterKeyInitProperties masterKeyInitProperties) {
this(pcieCryptoService, masterKeyInitProperties, () -> { });
}
@Override
public MasterKeyStateResult initMasterKey() {
if (pcieCryptoService.checkLmk()) {
@@ -83,6 +99,7 @@ public class LmkServiceImpl implements LmkService {
MasterKeyStateResult result = new MasterKeyStateResult();
result.setStatus(true);
result.setSeedMac(Hex.toHexString(pcieCryptoService.initializeMasterKey(oldPin, newPin)));
authSecurityResetService.resetAfterMasterKeyInitialized();
return result;
}
src/main/resources/mapper/auth/AuthSessionMapper.xml
+4
View File
@@ -79,4 +79,8 @@
AND expires_at IS NOT NULL
AND expires_at > #{now}
</select>
<delete id="deleteAll">
DELETE FROM tms_auth_session
</delete>
</mapper>
src/main/resources/mapper/auth/RoleUkeyBindingMapper.xml
+24 -2
View File
@@ -34,7 +34,7 @@
WHERE role_code = #{roleCode}
AND uid = #{uid}
AND status = 'ACTIVE'
ORDER BY bound_at DESC, id DESC
ORDER BY bound_at ASC, id ASC
</select>
<select id="selectActiveByRoleCode" parameterType="string" resultMap="RoleUkeyBindingResultMap">
@@ -52,6 +52,28 @@
FROM tms_role_ukey_binding
WHERE role_code = #{roleCode}
AND status = 'ACTIVE'
ORDER BY uid ASC
ORDER BY uid ASC, bound_at ASC, id ASC
</select>
<select id="selectActiveByUkeyIdentity" resultMap="RoleUkeyBindingResultMap">
SELECT id,
role_code,
uid,
ukey_serial,
ukey_pubkey,
issuer_sign,
status,
bound_at,
unbound_at,
create_time,
update_time
FROM tms_role_ukey_binding
WHERE status = 'ACTIVE'
AND (ukey_serial = #{ukeySerial} OR ukey_pubkey = #{ukeyPubkey})
ORDER BY bound_at DESC, id DESC
</select>
<delete id="deleteAll">
DELETE FROM tms_role_ukey_binding
</delete>
</mapper>