解决网络配置接口冲突

src/main/resources/application.yml

@@ -2,6 +2,11 @@ spring:
   application:
     # Spring 应用名；用于日志、注册中心标识等。
     name: tms-framework
+  servlet:
+    multipart:
+      # Spring/Tomcat multipart 解析上限；必须不小于业务上传上限，否则请求会在进入 Controller 前被拒绝。
+      max-file-size: ${TMS_FILE_STORAGE_MAX_FILE_SIZE_BYTES:104857600}
+      max-request-size: ${TMS_FILE_STORAGE_MAX_FILE_SIZE_BYTES:104857600}
   profiles:
     # 默认激活环境；可通过 --spring.profiles.active=prod 覆盖。
     active: dev
@@ -173,7 +178,7 @@ tms:
     # 升级任务统一日志目录。
     log-dir: ${TMS_UPGRADE_LOG_DIR:/home/tms/tmp/tms-upgrade-logs}
     # 升级包验签使用的公钥 PEM 文件路径；为空时升级预检会拒绝通过。
-    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:}
+    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/cert/public_key.pem}
   mk:
     init-identify:
       # SDFE_InitIdentify 旧 PIN（Base64 编码）；主密钥初始化接口会读取该值。

src/main/resources/db/migration/V1__tms_schema_full.sql

@@ -110,7 +110,7 @@ VALUES
     (1002, 'TLQ', '消息队列', 'V8.1.11', 'MANUAL', NOW(), '出厂预置'),
     (1003, 'TIDB', '数据库', 'V8.1.0', 'MANUAL', NOW(), '出厂预置'),
     (1004, 'NGINX', 'Nginx', 'V1.20', 'MANUAL', NOW(), '出厂预置'),
-    (1005, 'APP', '标准收发器企业版', 'V1.3.2', 'MANUAL', NOW(), '出厂预置'),
+    (1005, 'RECEIVER', '标准收发器', 'V1.3.2', 'MANUAL', NOW(), '出厂预置'),
     (1006, 'TMS', 'CISD终端管理服务', 'V1.0.0', 'MANUAL', NOW(), '出厂预置')
 ON DUPLICATE KEY UPDATE
     component_name = VALUES(component_name),
@@ -234,6 +234,45 @@ CREATE TABLE IF NOT EXISTS tms_auth_audit_log (
     KEY idx_tms_auth_audit_log_role_code (role_code)
 );
 
+-- -----------------------------------------------------------------------------
+-- 防重放与安全事件
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_replay_nonce (
+    id BIGINT PRIMARY KEY,
+    scope VARCHAR(32) NOT NULL COMMENT '防重放作用域：OPENAPI / INTERNAL_API',
+    principal_id VARCHAR(128) NOT NULL COMMENT '主体标识：appId / sessionToken',
+    nonce VARCHAR(128) NOT NULL,
+    request_timestamp BIGINT NOT NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    body_hash VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    user_agent VARCHAR(512) NULL,
+    expires_at DATETIME(3) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
+    KEY idx_tms_replay_nonce_expires_at (expires_at),
+    KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
+);
+
+CREATE TABLE IF NOT EXISTS tms_security_event (
+    id BIGINT PRIMARY KEY,
+    event_type VARCHAR(64) NOT NULL,
+    scope VARCHAR(32) NOT NULL,
+    principal_id VARCHAR(128) NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    nonce VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    detail_json JSON NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    KEY idx_tms_security_event_event_type (event_type),
+    KEY idx_tms_security_event_scope_principal (scope, principal_id)
+);
+
 INSERT IGNORE INTO tms_role_account (
     id,
     role_code,

src/main/resources/db/migration/V4__device_software_version_rename_app_to_receiver.sql

@@ -0,0 +1,19 @@
+-- 组件版本表统一使用 RECEIVER 表示标准收发器，废弃旧编码 APP。
+-- 若环境中已存在 RECEIVER 行，则保留 RECEIVER 并删除旧 APP，避免唯一键冲突。
+DELETE FROM tms_device_software_version
+WHERE component_code = 'APP'
+  AND EXISTS (
+    SELECT 1
+    FROM (SELECT id FROM tms_device_software_version WHERE component_code = 'RECEIVER') receiver_row
+  );
+
+UPDATE tms_device_software_version
+SET component_code = 'RECEIVER',
+    component_name = '标准收发器',
+    update_time = CURRENT_TIMESTAMP
+WHERE component_code = 'APP';
+
+UPDATE tms_device_software_version
+SET component_name = '标准收发器',
+    update_time = CURRENT_TIMESTAMP
+WHERE component_code = 'RECEIVER';

src/main/resources/db/migration/V5__add_replay_protection_tables.sql

@@ -0,0 +1,38 @@
+-- -----------------------------------------------------------------------------
+-- Replay protection tables
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_replay_nonce (
+    id BIGINT PRIMARY KEY,
+    scope VARCHAR(32) NOT NULL COMMENT '防重放作用域：OPENAPI / INTERNAL_API',
+    principal_id VARCHAR(128) NOT NULL COMMENT '主体标识：appId / sessionToken',
+    nonce VARCHAR(128) NOT NULL,
+    request_timestamp BIGINT NOT NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    body_hash VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    user_agent VARCHAR(512) NULL,
+    expires_at DATETIME(3) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
+    KEY idx_tms_replay_nonce_expires_at (expires_at),
+    KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
+);
+
+CREATE TABLE IF NOT EXISTS tms_security_event (
+    id BIGINT PRIMARY KEY,
+    event_type VARCHAR(64) NOT NULL,
+    scope VARCHAR(32) NOT NULL,
+    principal_id VARCHAR(128) NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    nonce VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    detail_json JSON NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    KEY idx_tms_security_event_event_type (event_type),
+    KEY idx_tms_security_event_scope_principal (scope, principal_id)
+);