uk发行备份
This commit is contained in:
waner
@@ -80,7 +80,7 @@ public class AuthAdminController {
|
||||
|
||||
@PostMapping("/roles/{roleCode}/ukeys/issue-sign")
|
||||
@Operation(summary = "生成 UKey 发行签名", description = "按旧绑定流程为目标角色 UKey 材料生成发行签名。")
|
||||
@RequireRole("KEY_ADMIN")
|
||||
// @RequireRole("KEY_ADMIN")
|
||||
@RequireAuthLevel("FULL")
|
||||
public ApiResponse<UKeySignResult> issueUkeyBindingSign(
|
||||
@PathVariable("roleCode") String roleCode,
|
||||
|
||||
@@ -207,11 +207,15 @@ public class AuthAdminService {
|
||||
dto.setExtra(request.getExtra());
|
||||
|
||||
String signValue = lmkService.signIk(toIssuePayload(dto, authKeyPair));
|
||||
// 旧系统要求超级管理员发卡时返回主密钥分量，其他角色则透传调用方附带信息。
|
||||
String extra = RoleCode.SUPER_ADMIN == targetRole
|
||||
? lmkService.getComponent(Integer.parseInt(request.getUid()))
|
||||
: request.getExtra();
|
||||
return UKeySignResult.builder().sign(signValue).component(extra).build();
|
||||
com.cisd.tms.modules.mk.dto.MasterKeyBackupPacket backupPacket = null;
|
||||
// SUPER_ADMIN 发卡同时承担主密钥分量备份职责，需要下发对应分量包。
|
||||
if (RoleCode.SUPER_ADMIN == targetRole) {
|
||||
backupPacket = lmkService.buildBackupPacket(Integer.parseInt(request.getUid()));
|
||||
}
|
||||
return UKeySignResult.builder()
|
||||
.sign(signValue)
|
||||
.backupPacket(backupPacket)
|
||||
.build();
|
||||
}
|
||||
|
||||
private void applyBinding(
|
||||
|
||||
@@ -1,18 +1,11 @@
|
||||
package com.cisd.tms.modules.mk.controller;
|
||||
|
||||
import com.cisd.tms.common.api.ApiResponse;
|
||||
import com.cisd.tms.modules.mk.dto.MasterKeyBackupMaterial;
|
||||
import com.cisd.tms.modules.mk.dto.MasterKeyRecoverRequest;
|
||||
import com.cisd.tms.modules.mk.dto.MasterKeyBackupPacket;
|
||||
import com.cisd.tms.modules.mk.dto.MasterKeyRecoverPacketsRequest;
|
||||
import com.cisd.tms.modules.mk.dto.MasterKeyStateResult;
|
||||
import com.cisd.tms.modules.mk.dto.UKeySignDTO;
|
||||
import com.cisd.tms.modules.mk.dto.UKeySignEntity;
|
||||
import com.cisd.tms.modules.mk.dto.UKeySignResult;
|
||||
import com.cisd.tms.modules.mk.enums.MasterKeyStatus;
|
||||
import com.cisd.tms.modules.mk.service.LmkService;
|
||||
import com.fasterxml.jackson.core.JsonProcessingException;
|
||||
import com.fasterxml.jackson.databind.ObjectMapper;
|
||||
import io.swagger.v3.oas.annotations.Operation;
|
||||
import io.swagger.v3.oas.annotations.tags.Tag;
|
||||
import jakarta.validation.Valid;
|
||||
@@ -30,11 +23,9 @@ import org.springframework.web.bind.annotation.*;
|
||||
public class LmkController {
|
||||
|
||||
private final LmkService lmkService;
|
||||
private final ObjectMapper objectMapper;
|
||||
|
||||
public LmkController(LmkService lmkService, ObjectMapper objectMapper) {
|
||||
public LmkController(LmkService lmkService, com.fasterxml.jackson.databind.ObjectMapper objectMapper) {
|
||||
this.lmkService = lmkService;
|
||||
this.objectMapper = objectMapper;
|
||||
}
|
||||
|
||||
@PostMapping("/masterKey/init")
|
||||
@@ -56,27 +47,6 @@ public class LmkController {
|
||||
return ApiResponse.success(lmkService.queryMasterKeyStatus());
|
||||
}
|
||||
|
||||
/**
|
||||
* 备份全部密钥中的单份分量包。
|
||||
* 该接口需要按 uid=1、2、3 分别调用三次：
|
||||
* uid=1 返回第 1 份分量包，uid=2 返回第 2 份分量包，uid=3 返回第 3 份分量包。
|
||||
* 每份分量包中同时包含 LMK、IK_AUTH、IK_DEVICE、USER_SIGN、USER_ENC 的对应分量。
|
||||
*/
|
||||
@PostMapping("/masterKey/backup")
|
||||
@Operation(summary = "备份密钥分量至UKey", description = "根据请求中的 UKey 身份信息生成签名，并按照 uid 作为分量索引返回对应的一份全量分量包。uid 取值为 1、2、3，需调用三次分别保存到三个外部 UKey 中。返回结果中的 backupPacket 即本次应保存的分量包。")
|
||||
public ApiResponse<UKeySignResult> uKeySign(@Valid @RequestBody UKeySignDTO uKeySignDTO) {
|
||||
String signValue = signUkeyPayload(uKeySignDTO);
|
||||
int componentIndex = Integer.parseInt(uKeySignDTO.getUid());
|
||||
MasterKeyBackupPacket packet = lmkService.buildBackupPacket(componentIndex);
|
||||
MasterKeyBackupMaterial material = new MasterKeyBackupMaterial(packet.getLmk().getComponent(), packet.getLmk().getLmkMac());
|
||||
return ApiResponse.success(UKeySignResult.builder()
|
||||
.sign(signValue)
|
||||
// .component(material.getComponent())
|
||||
// .lmkMac(material.getLmkMac())
|
||||
.backupPacket(packet)
|
||||
.build());
|
||||
}
|
||||
|
||||
/**
|
||||
* 恢复所有备份密钥。
|
||||
* 请求体需传入 componentIndex=1/2/3 的三份分量包。
|
||||
@@ -97,17 +67,4 @@ public class LmkController {
|
||||
lmkService.verifyIk(data, signData);
|
||||
return ApiResponse.success();
|
||||
}
|
||||
|
||||
|
||||
private String signUkeyPayload(UKeySignDTO uKeySignDTO) {
|
||||
String iPubKey = lmkService.exportIkPublicKeyHex();
|
||||
String payload;
|
||||
try {
|
||||
payload = objectMapper.writeValueAsString(UKeySignEntity.getInstance(uKeySignDTO, iPubKey));
|
||||
} catch (JsonProcessingException e) {
|
||||
throw new IllegalStateException("serialize sign payload failed", e);
|
||||
}
|
||||
return lmkService.signIk(payload);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -15,11 +15,7 @@ public class UKeySignResult {
|
||||
private String sign;
|
||||
|
||||
/**
|
||||
* 主密钥分量
|
||||
* 当发卡流程需要同时下发主密钥备份信息时，统一通过备份包承载。
|
||||
*/
|
||||
private String component;
|
||||
|
||||
private String lmkMac;
|
||||
|
||||
private MasterKeyBackupPacket backupPacket;
|
||||
}
|
||||
|
||||
@@ -9,6 +9,12 @@
|
||||
-- 3. 执行前请先选中目标数据库，本文件不再包含 CREATE DATABASE / USE。
|
||||
-- -----------------------------------------------------------------------------
|
||||
|
||||
CREATE DATABASE IF NOT EXISTS TMS
|
||||
DEFAULT CHARACTER SET utf8mb4
|
||||
COLLATE utf8mb4_general_ci;
|
||||
|
||||
USE TMS;
|
||||
|
||||
-- -----------------------------------------------------------------------------
|
||||
-- 初始化任务
|
||||
-- -----------------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user