// chain-cloud-gateway filter/AuthFilter.java
public interface AuthFilter {

    /**
     * 解析token（认证）
     */
    AuthUserInfoDTO check(String token);

    /**
     * 权限校验（授权）
     */
    Boolean auth(String token, AuthUserInfoDTO authUserInfo, String path);

    /**
     * token 请求头名称，默认 Authorization
     */
    default String tokenHeaderName() {
        return Constants.GATEWAY.AUTHORIZATION;
    }
}

// chain-cloud-gateway filter/TokenGatewayFilter.java
@Slf4j
public class TokenGatewayFilter implements GatewayFilter, Ordered {

    private AuthFilter authFilter;
    private MyConfig myConfig;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        // 1. 白名单直接放行
        String path = exchange.getRequest().getPath().toString();
        if (StrUtil.startWithAny(path, this.myConfig.getNoAuthPaths())) {
            return chain.filter(exchange);
        }

        // 2. 取 token，校验
        String token = exchange.getRequest().getHeaders().getFirst(this.authFilter.tokenHeaderName());
        if (StrUtil.isEmpty(token)) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }
        AuthUserInfoDTO authUserInfoDTO = null;
        try {
            authUserInfoDTO = this.authFilter.check(token);
        } catch (Exception e) {
            // token不可用，不做处理
        }
        if (ObjectUtil.isEmpty(authUserInfoDTO)) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }

        // 3. 校验权限
        Boolean auth = false;
        try {
            auth = this.authFilter.auth(token, authUserInfoDTO, path);
        } catch (Exception e) {
            log.error("鉴权失败, token = {}", token, e);
        }
        if (!auth) {
            exchange.getResponse().setStatusCode(HttpStatus.BAD_REQUEST);
            return exchange.getResponse().setComplete();
        }

        // 4. 向下游传递用户信息和 token
        exchange.getRequest().mutate().header(Constants.GATEWAY.USERINFO,
                JSONUtil.toJsonStr(authUserInfoDTO));
        exchange.getRequest().mutate().header(Constants.GATEWAY.TOKEN, token);
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return Integer.MIN_VALUE;      // 最先执行
    }
}

// CustomerTokenGatewayFilterFactory.java
/**
 * 用户端token拦截处理
 * 用户端使用自定义 RSA-256 JWT（仅包含 userId），
 * 与 itcast-auth SDK 的 token 机制不同。
 * 从 access_token 请求头获取 token，
 * 使用 JwtUtils + RSA 公钥校验，不需要做角色权限校验。
 */
@Slf4j @Component
public class CustomerTokenGatewayFilterFactory
        extends AbstractGatewayFilterFactory<Object> implements AuthFilter {

    @Resource private JwtProperties jwtProperties;

    @Override
    public GatewayFilter apply(Object config) {
        return new TokenGatewayFilter(myConfig, this);
    }

    @Override
    public AuthUserInfoDTO check(String token) {
        var claims = JwtUtils.checkToken(token, jwtProperties.getPublicKey());
        if (claims == null) return null;
        var userIdObj = claims.get(Constants.GATEWAY.USER_ID);
        if (userIdObj == null) return null;
        var userInfo = new AuthUserInfoDTO();
        userInfo.setUserId(Long.valueOf(userIdObj.toString()));
        return userInfo;
    }

    @Override
    public Boolean auth(String token, AuthUserInfoDTO authUserInfoDTO, String path) {
        return true;        // 不做角色校验
    }

    @Override
    public String tokenHeaderName() {
        return Constants.GATEWAY.ACCESS_TOKEN;      // "access_token"，不是 Authorization
    }
}

// DriverTokenGatewayFilterFactory.java
@Resource TokenCheckService tokenCheckService;               // itcast-auth-sdk

@Value("${role.driver}")
private List<Long> driverRoleIds;

@Override
public AuthUserInfoDTO check(String token) {
    return tokenCheckService.parserToken(token);              // SDK 解析 + 验签
}

@Override
public Boolean auth(String token, AuthUserInfoDTO authUserInfo, String path) {
    Long userId = authUserInfo.getUserId();
    AuthTemplate authTemplate = AuthTemplateFactory.get(token);
    Result<List<Long>> roleByUserId = authTemplate.opsForRole().findRoleByUserId(userId);
    if (roleByUserId.getCode() == 0) {
        List<Long> data = roleByUserId.getData();
        if (CollUtil.isNotEmpty(data)) {
            // 用户角色 ∩ 端要求的角色集合，非空即通过
            Collection<Long> intersection = CollUtil.intersection(data, driverRoleIds);
            if (CollUtil.isNotEmpty(intersection)) {
                return true;
            }
        }
    }
    return false;
}

// CourierTokenGatewayFilterFactory.java（全文 30 行）
public class CourierTokenGatewayFilterFactory
        extends AbstractGatewayFilterFactory<Object> implements AuthFilter {
    @Override public GatewayFilter apply(Object config) { return null; }
    @Override public AuthUserInfoDTO check(String token) { return null; }
    @Override public Boolean auth(String token, AuthUserInfoDTO dto, String path) { return null; }
}

- id: chain-cloud-ms-web-courier
  uri: lb://chain-cloud-ms-web-courier
  predicates:
    - Path=/courier/**
  filters:
    - StripPrefix=1
#  - CourierToken                                     ← 注释掉了
    - AddRequestHeader=X-Request-From, chain-cloud-gateway

// chain-cloud-common util/JwtUtils.java
public static String createToken(Map<String, Object> claims,
                                 String privateKeyStr, int dateOffset, DateField dateField) {
    RSA rsa = new RSA(privateKeyStr, null);
    Map<String, Object> header = MapUtil.<String, Object>builder()
            .put(JwsHeader.TYPE, JwsHeader.JWT_TYPE)
            .put(JwsHeader.ALGORITHM, SignatureAlgorithm.RS256.getValue()).build();
    return Jwts.builder()
            .setHeader(header)
            .setClaims(claims)
            .signWith(SignatureAlgorithm.RS256, rsa.getPrivateKey())
            .setExpiration(DateUtil.offset(new Date(), dateField, dateOffset))
            .compact();
}

public static Map<String, Object> checkToken(String token, String publicKeyStr) {
    RSA rsa = new RSA(null, publicKeyStr);
    try {
        return Jwts.parser()
                .setSigningKey(rsa.getPublicKey())
                .parseClaimsJws(token)
                .getBody();
    } catch (ExpiredJwtException e) {
        // token已经过期！                    ← 消息被注释掉了
    } catch (Exception e) {
        log.error("token非法传入，token = {}", token, e);
    }
    return null;              // 过期和非法都返回 null，无法区分
}

// TokenServiceImpl.java
public static final String REDIS_REFRESH_TOKEN_PREFIX = "CC_CUSTOMER_REFRESH_TOKEN_";

public String createAccessToken(Map<String, Object> claims) {
    // 短令牌有效期单位：分钟
    return JwtUtils.createToken(claims, jwtProperties.getPrivateKey(),
            jwtProperties.getAccessTtl(), DateField.MINUTE);
}

@Override
public String createRefreshToken(Map<String, Object> claims) {
    // 长令牌有效期单位：小时
    Integer ttl = jwtProperties.getRefreshTtl();
    String refreshToken = JwtUtils.createToken(claims, jwtProperties.getPrivateKey(), ttl);

    // 长令牌只能使用一次，需要将其存储到 redis 中，变成有状态的
    String userId = claims.get(Constants.GATEWAY.USER_ID).toString();
    stringRedisTemplate.opsForValue().set(REDIS_REFRESH_TOKEN_PREFIX + userId, refreshToken);
    return refreshToken;
}

第 1 跳：Gateway → 下游（HTTP header）
   header: userInfo  = AuthUserInfoDTO 的 JSON
   header: token     = 原始 token
   header: X-Request-From = chain-cloud-gateway
                ↓
第 2 跳：下游 Web 模块的拦截器 → ThreadLocal
   UserInterceptor   : X-Request-From 校验 + userInfo 解析 → UserThreadLocal
   TokenInterceptor  : token 解析 → AuthTemplateThreadLocal
                ↓
第 3 跳：Feign 调用 → 再下一个服务
   UserFeignRequestInterceptor: userInfo 重新注入到 Feign header

// chain-cloud-common interceptor/UserInterceptor.java
/**
 * 统一对请求的合法性进行校验，需要进行2个方面的校验，
 * 一、请求头中是否携带了X-Request-From，判断是否来源网关
 * 二、请求头中是否存在userInfo，如果不存在则说明是非法请求，响应403状态码
 * 如果是合法请求，将userInfo存储到ThreadLocal中
 */
@Component
public class UserInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
                             Object handler) throws Exception {
        if (!(handler instanceof HandlerMethod)) return true;

        HandlerMethod handlerMethod = (HandlerMethod) handler;
        if (handlerMethod.hasMethodAnnotation(NoAuthorization.class)) {
            return true;                       // 标注了免鉴权
        }

        // 一、校验来源：必须来自网关
        String from = request.getHeader("X-Request-From");
        if (!StrUtil.equals(from, "chain-cloud-gateway")) {
            response.setStatus(403);
            return false;                      // ← 防止绕过网关直连微服务
        }

        // 二、校验 userInfo 存在
        String userInfo = request.getHeader("userInfo");
        if (Base64.isBase64(userInfo)) {
            userInfo = Base64.decodeStr(userInfo);      // 兼容 Base64 编码
        }
        if (StrUtil.isEmpty(userInfo)) {
            response.setStatus(403);
            return false;
        }

        UserThreadLocal.set(JSONUtil.toBean(userInfo, AuthUserInfo.class));
        return true;
    }

    @Override
    public void afterCompletion(...) {
        UserThreadLocal.remove();              // 必须清理，否则线程复用会串号
    }
}

// chain-cloud-common util/UserThreadLocal.java
public static Long getUserId() {
    AuthUserInfo userInfo = LOCAL.get();
    if (userInfo == null || userInfo.getUserId() == null) {
        throw new CCException("token异常");         // 不返回 null，强制调用方判空
    }
    return userInfo.getUserId();
}

// chain-cloud-common vo/AuthUserInfo.java
@Data
public class AuthUserInfo extends BaseMsg {
    @Alias("sub")          private Long userId;        // 权限中心 JWT 用 sub
    private String account;
    private String name;
    @Alias("orgid")        private Long orgId;
    @Alias("stationid")    private Long stationId;
    private Boolean administrator;
}

# chain-cloud-gateway/src/main/resources/bootstrap-local.yml
spring:
  gateway:
    discovery:
      locator:
        enabled: true     # 自动为 Nacos 上注册的每个服务创建路由
    routes:
      - id: chain-cloud-ms-web-courier
        uri: lb://chain-cloud-ms-web-courier
        predicates:
          - Path=/courier/**
        filters:
          - StripPrefix=1                       # 去掉 /courier 前缀
          - AddRequestHeader=X-Request-From, chain-cloud-gateway
      - id: chain-cloud-ms-web-customer
        uri: lb://chain-cloud-ms-web-customer
        predicates:
          - Path=/customer/**
        filters:
          - StripPrefix=1
          - CustomerToken                       # ← 每条路由配自己的过滤器
          - AddRequestHeader=X-Request-From, chain-cloud-gateway
      - id: chain-cloud-ms-web-driver
        ... - DriverToken ...
      - id: chain-cloud-ms-web-manager
        ... - ManagerToken ...
      - id: chain-cloud-ms-trade
        uri: lb://chain-cloud-ms-trade
        predicates:
          - Path=/trade/notify/**               # 支付回调专用通道
        filters:
          - StripPrefix=1
          - AddRequestHeader=X-Request-From, chain-cloud-gateway
    default-filters:
      - DedupeResponseHeader=Access-Control-Allow-Origin Access-Control-Allow-Credentials, RETAIN_FIRST

cc:
  noAuthPaths:
    - /courier/login/account
    - /customer/user/login
    - /customer/user/refresh
    - /driver/login/account
    - /manager/login
    - /manager/captcha
    - /courier/swagger-ui.html       # swagger 系列
    - /customer/swagger-ui.html
    ...

if (StrUtil.startWithAny(path, this.myConfig.getNoAuthPaths())) {
    return chain.filter(exchange);
}

private static final Set<String> EXACT = Set.of(
    "/customer/user/login", "/customer/user/refresh",
    "/manager/login", "/manager/captcha", "/driver/login/account",
    "/courier/login/account");

if (EXACT.contains(path) || SWAGGER_PREFIXES.stream().anyMatch(path::startsWith)) {
    return chain.filter(exchange);
}

// ❌ 在 GatewayFilter 里做阻塞 DB 查询
@Override
public Mono<Void> filter(ServerHttpRequest req, ServerHttpResponse resp, GatewayFilterChain chain) {
    UserDTO user = userService.getById(1);      // 阻塞！
    return chain.filter(exchange);
}

// 1. 角色数据加本地缓存，避免每次请求打权限中心
@Cacheable(value = "userRoles", key = "#userId", unless = "#result == null")
public List<Long> findRoleByUserId(Long userId) { ... }

// 2. 或者改用 @CircuitBreaker + 熔断降级：权限中心挂了，按"放行"或"拒绝"降级
@CircuitBreaker(name = "auth", fallbackMethod = "authFallback")
public Boolean auth(...) { ... }

用户身份在网关被验证过  →  但下游服务必须"相信"这个身份  →  而信任的载体是 HTTP header

// ❌ 危险：只按 ID 查
public OrderDTO findById(Long id) {
    return orderFeign.findById(id);
}

// ✅ 安全：ID + 当前登录用户 双重条件
public OrderDTO findById(Long id) {
    Long userId = UserThreadLocal.getUserId();
    LambdaQueryWrapper<OrderEntity> w = Wrappers.lambdaQuery();
    w.eq(OrderEntity::getId, id)
     .eq(OrderEntity::getMemberId, userId);      // ← 关键
    return baseMapper.selectOne(w);
}

// 把 UserThreadLocal.getUserId() 自动塞进所有 where 条件
@Intercepts(@Signature(type = Executor.class, method = "update",
                        args = { MappedStatement.class, Object.class }))
public class TenantLineInnerInterceptor implements InnerInterceptor { ... }

// TokenGatewayFilter.java:73-77
// 4. 校验通过，向下游传递用户信息和token
exchange.getRequest().mutate().header(Constants.GATEWAY.USERINFO, JSONUtil.toJsonStr(authUserInfoDTO));
exchange.getRequest().mutate().header(Constants.GATEWAY.TOKEN, token);
// 4.1 校验通过放行
return chain.filter(exchange);

// 4. 校验通过，向下游传递用户信息和 token
ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
        .header(Constants.GATEWAY.USERINFO, JSONUtil.toJsonStr(authUserInfoDTO))
        .header(Constants.GATEWAY.TOKEN, token)
        .build();

exchange = exchange.mutate().request(mutatedRequest).build();

return chain.filter(exchange);

网关放行 → 下游 UserInterceptor 读 X-Request-From
  → AddRequestHeader 滤镜加上了，通过 ✅
  → 读 userInfo 头 → 没有（因为上面那两行是空操作）→ 返回 403 ❌

// chain-cloud-common interceptor/UserFeignRequestInterceptor.java
/**
 * 如果需要通过Feign将用户信息向下游微服务传递，
 * 需要在配置文件中设置：cc.feign.user = true
 */
@Component
@ConditionalOnProperty(prefix = "cc.feign", value = "user")
public class UserFeignRequestInterceptor implements RequestInterceptor {
    @Override
    public void apply(RequestTemplate template) {
        String userInfo = Base64.encode(JSONUtil.toJsonStr(UserThreadLocal.get()));
        template.header("userInfo", userInfo);
        template.header("X-Request-From", "cc-chaincloud-gateway");    // ← 多了个 cc- 前缀！
    }
}

public GatewayFilter apply(Object config) { return null; }
public AuthUserInfoDTO check(String token) { return null; }
public Boolean auth(String token, AuthUserInfoDTO dto, String path) { return null; }

apply() 返回 null  →  Spring Cloud Gateway 启动时或路由匹配时 NPE

Boolean auth = false;
try {
    auth = this.authFilter.auth(...);     // 返回 null
} catch (Exception e) {
    log.error("鉴权失败", e);
}
if (!auth) {                              // ← 对 null 拆箱，抛 NPE
    ...
}

} catch (ExpiredJwtException e) {
    // System.out.println("token已经过期！");      ← 整行被注释掉了
} catch (Exception e) {
    log.error("token非法传入，token = {}", token, e);
}
return null;              // 两种情况都返回 null

// 修改 checkToken：区分过期和非法
public static Map<String, Object> checkToken(String token, String publicKeyStr) {
    RSA rsa = new RSA(null, publicKeyStr);
    try {
        return Jwts.parser()
                .setSigningKey(rsa.getPublicKey())
                .parseClaimsJws(token).getBody();
    } catch (ExpiredJwtException e) {
        throw new TokenExpiredException("token已过期");      // ← 独立的异常类型
    } catch (SignatureException e) {
        throw new TokenInvalidException("token签名非法");
    } catch (MalformedJwtException e) {
        throw new TokenInvalidException("token格式错误");
    }
}

// 网关按异常类型返回不同状态
try {
    authUserInfoDTO = this.authFilter.check(token);
} catch (TokenExpiredException e) {
    // 401 + 特殊错误码，让客户端知道该刷新
    return writeError(exchange, 401, "TOKEN_EXPIRED");
} catch (TokenInvalidException e) {
    // 401 + 另一个错误码，让客户端知道该重新登录
    return writeError(exchange, 401, "TOKEN_INVALID");
}

log.error("token非法传入，token = {}", token, e);

- /customer/user/login
- /customer/user/refresh

private static final String[] EXCLUDE_PATH_PATTERNS = new String[]{
        "/swagger-ui.html", "/webjars/**", "/swagger-resources", "/v2/api-docs",
        "/user/login/**", "/user/refresh/**"};

// chain-cloud-common annotation/NoAuthorization.java
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface NoAuthorization { }

// UserInterceptor
if (handlerMethod.hasMethodAnnotation(NoAuthorization.class)) {
    return true;    // 需要接口方法上标注 @NoAuthorization
}

@SpringBootTest(webEnvironment = RANDOM_PORT)
class AuthPropagationIT {

    @Test
    void 网关到最深层服务的身份透传() {
        // 1. 从 auth 服务拿一个真实 token
        String token = loginAs("admin");

        // 2. 从外部（绕过网关）打 BFF，验证 403（说明 X-Request-From 校验有效）
        assertThat(HttpUtil.get("http://127.0.0.1:18093/order/list", token))
            .contains("403");

        // 3. 从网关打 BFF，验证能拿到数据
        ResponseEntity<String> resp = HttpUtil.get("http://127.0.0.1:9527/manager/order/list", token);
        assertThat(resp.getStatusCode()).isEqualTo(200);

        // 4. ★ 关键断言：在 BFF 侧打印/暴露 UserThreadLocal.getUserId()，断言非空
        assertThat(managerService.currentUserId()).isEqualTo(expectedUserId);

        // 5. ★ 跨服务断言：Feign 调用链路上游服务能看到同一个 userId
        assertThat(orderService.findByOrderId(orderId).getMemberId())
            .isEqualTo(expectedUserId);
    }
}

access token  （短，比如 30 分钟）
  → 无状态，网关验签即可，不查 Redis
  → 泄漏的影响窗口小
  → 权限变更的生效延迟 ≤ 30 分钟（可接受）

refresh token（长，比如 7 天）
  → 有状态，存 Redis，且用一次就删（rotation）
  → 每次刷新都重新走一遍鉴权/权限检查
  → 所以权限变更的生效延迟 = 下次刷新时间（< 30 分钟）
  → 而且 refresh token 泄漏后最多被用一次，很快失效

Redis Session 方案：
  每次请求 → 网关查 Redis → 1 万 QPS 就是 1 万次 Redis 访问
  C 端用户几千万 → Session 数据量巨大
  移动端弱网，Redis 抖动直接影响登录态

  每次请求 → 网关验签（RSA 纯 CPU，微秒级）→ 零 IO

String from = request.getHeader("X-Request-From");
boolean fromGateway = "chain-cloud-gateway".equals(from);
boolean fromInternalFeign = "cc-chaincloud-gateway".equals(from);   // 区分开
if (!fromGateway && !fromInternalFeign) { response.setStatus(403); return false; }