Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix:权限调整

Browse Source
This commit is contained in:
waner
2026-05-19 17:12:53 +08:00
parent a30c029fc4
commit 58dc015e01
14 changed files with 651 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/cisd/tms/modules/init/config/InitExecutorProperties.java
+3 -1
View File
@@ -15,6 +15,8 @@ public class InitExecutorProperties {
private static final String DEFAULT_STANDARD_RUN_USER = "cmep4i";
private static final String DEFAULT_STANDARD_VENDOR_STEP_RUNNER_COMMAND =
"/usr/local/sbin/tms-run-standard-vendor-step";
private static final String DEFAULT_RABBITMQ_CTL_COMMAND =
"sudo -n /usr/local/sbin/tms-rabbitmqctl";
private Mode mode = Mode.SIMULATE;
private int timeoutSec = 600;
@@ -104,7 +106,7 @@ public class InitExecutorProperties {
private String rabbitAdminUsername = "admin";
private String rabbitAdminPassword = "admin";
// RabbitMQ 管理命令路径
private String rabbitmqCtlCommand = "rabbitmqctl";
private String rabbitmqCtlCommand = DEFAULT_RABBITMQ_CTL_COMMAND;
private String rabbitmqAdminCommand = "/usr/sbin/rabbitmqadmin";
// 标准版 RabbitMQ 初始化脚本（创建admin/通道账号、替换队列脚本机构号）
private String standardRabbitSetupScriptPath = "";
src/main/java/com/cisd/tms/modules/init/executor/ConfigurableInitStepExecutor.java
+51 -1
View File
@@ -684,6 +684,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
private String resolveRabbitmqCtlCommand() {
List<String> candidates = new ArrayList<>();
candidates.add(firstNonBlank(properties.getRabbitmqCtlCommand(), "rabbitmqctl"));
candidates.add("sudo -n /usr/local/sbin/tms-rabbitmqctl");
candidates.add("/usr/local/rabbitmq/sbin/rabbitmqctl");
candidates.add("/usr/local/rabbitmq-server/sbin/rabbitmqctl");
candidates.add("/usr/sbin/rabbitmqctl");
@@ -694,6 +695,12 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
if (isBlank(candidate)) {
continue;
}
if (candidateHasArguments(candidate)) {
if (isRunnableCommandPrefix(candidate)) {
return candidate;
}
continue;
}
if (candidate.contains("/")) {
try {
Path path = Paths.get(candidate).normalize().toAbsolutePath();
@@ -716,6 +723,37 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
);
}
private boolean isRunnableCommandPrefix(String command) {
List<String> parts = splitCommandPrefix(command);
if (parts.isEmpty()) {
return false;
}
String executable = parts.get(0);
if (executable.contains("/")) {
try {
Path path = Paths.get(executable).normalize().toAbsolutePath();
return Files.exists(path) && Files.isRegularFile(path);
} catch (InvalidPathException ex) {
return false;
}
}
return !isBlank(findExecutableInPath(executable));
}
private boolean candidateHasArguments(String command) {
return splitCommandPrefix(command).size() > 1;
}
private List<String> splitCommandPrefix(String command) {
String value = normalize(command);
if (isBlank(value)) {
return List.of();
}
return Arrays.stream(value.split("\\s+"))
.filter(part -> !isBlank(part))
.toList();
}
private String findExecutableInPath(String commandName) {
String pathValue = System.getenv("PATH");
if (isBlank(pathValue)) {
@@ -1920,7 +1958,19 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
}
private int runRabbitmqCommand(Path logFile, List<String> command, boolean ignoreFailure) throws IOException, InterruptedException {
return runCommand(logFile, command, ignoreFailure, null, buildRabbitmqEnvironment());
return runCommand(logFile, expandRabbitmqCommand(command), ignoreFailure, null, buildRabbitmqEnvironment());
}
private List<String> expandRabbitmqCommand(List<String> command) {
if (command == null || command.isEmpty()) {
return List.of();
}
List<String> expanded = new ArrayList<>(splitCommandPrefix(command.get(0)));
if (expanded.isEmpty()) {
expanded.add(command.get(0));
}
expanded.addAll(command.subList(1, command.size()));
return expanded;
}
private int runCommand(Path logFile, List<String> command, boolean ignoreFailure) throws IOException, InterruptedException {
src/main/resources/application.yml
+6 -7
View File
@@ -13,7 +13,7 @@ spring:
server:
# TMS HTTP 服务监听端口。
port: 8080
port: 8088
management:
endpoints:
@@ -135,9 +135,8 @@ tms:
rabbit-admin-username: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_USERNAME:admin}
# RabbitMQ 管理员密码（预制）。
rabbit-admin-password: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_PASSWORD:admin}
# RabbitMQ 控制命令（用于新增用户、授权等）。
# 建议线上配置为绝对路径，例如 /usr/local/rabbitmq/sbin/rabbitmqctl。
rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:/usr/local/rabbitmq/sbin/rabbitmqctl}
# RabbitMQ 控制命令（用于新增用户、授权等）；默认通过 root 受控 wrapper 执行，避免 tms 与 RabbitMQ 服务端 Erlang cookie 不一致。
rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:sudo -n /usr/local/sbin/tms-rabbitmqctl}
# RabbitMQ Admin CLI 命令路径（用于创建队列等）。
rabbitmq-admin-command: ${TMS_INIT_EXECUTOR_RABBITMQ_ADMIN_COMMAND:/usr/sbin/rabbitmqadmin}
# 标准版 RabbitMQ 初始化脚本路径（保留兼容；MQ_USER_APPLY 当前优先直接调用 rabbitmqctl/rabbitmqadmin）。
@@ -322,7 +321,7 @@ tms:
# 备份/恢复标准收发器业务库名；第一版默认使用 CMEP。
cmep-database-name: ${TMS_BACKUP_CMEP_DATABASE_NAME:CMEP}
# 恢复完成后的最小健康检查地址。
health-check-url: ${TMS_BACKUP_HEALTH_CHECK_URL:http://127.0.0.1:8080/actuator/health}
health-check-url: ${TMS_BACKUP_HEALTH_CHECK_URL:http://127.0.0.1:8088/actuator/health}
# 健康检查请求超时（秒）。
health-check-timeout-seconds: ${TMS_BACKUP_HEALTH_CHECK_TIMEOUT_SECONDS:5}
# 健康检查最大等待时间（秒）；TMS 启动命令返回后，Spring Boot 仍可能需要一段时间才监听端口。
@@ -340,7 +339,7 @@ tms:
internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token}
internal-auth:
# 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。
enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:false}
enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true}
# 关闭内部鉴权后，注入请求上下文的调试角色。
debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:OPS_ADMIN}
# 关闭内部鉴权后，注入请求上下文的调试认证等级。
@@ -349,7 +348,7 @@ tms:
debug-session-token: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_SESSION_TOKEN:DEBUG-BYPASS}
replay:
# 是否启用防重放校验；本地 Postman/联调可临时设为 false，生产环境应保持 true。
enabled: ${TMS_SECURITY_REPLAY_ENABLED:false}
enabled: ${TMS_SECURITY_REPLAY_ENABLED:true}
openapi:
# 外部签名服务接口允许的时间戳偏差（秒），防重放。
timestamp-skew-seconds: 300