feat(config): 添加HSC公司配置和部署脚本

云

9 小时以前 b6c0dc29218252bf207440446276b53d66ba35e1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
package cn.iocoder.yudao.module.system.framework.agent;
 
import cn.iocoder.yudao.framework.security.core.service.SecurityFrameworkService;
import cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils;
import jakarta.annotation.Resource;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
 
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.List;
 
/** 桥接统一鉴权：服务令牌 + 当前登录用户 + 业务权限，缺一不可。 */
@Component
public class SystemAgentBridgeGuard {
 
    public static final String PERMISSION_ITEM_IMPORT = "mdm:item:import";
 
    /** 各业务模块的导入权限；会话创建与附件读取只需命中其中任意一项。 */
    public static final List<String> IMPORT_PERMISSIONS = List.of(
            PERMISSION_ITEM_IMPORT,
            "srm:supplier:create",
            "mes:md-item:create",
            "mes:qc-template:create",
            "mes:pro-mps:create",
            "mes:pro-route:create");
 
    @Value("${yudao.agent.bridge-service-token:}")
    private String bridgeServiceToken;
 
    @Resource
    private SecurityFrameworkService securityFrameworkService;
    @Resource
    private SystemAgentDelegationService delegationService;
 
    public void verifyServiceToken(String provided) {
        if (bridgeServiceToken == null || bridgeServiceToken.isBlank() || provided == null
                || !MessageDigest.isEqual(bridgeServiceToken.getBytes(StandardCharsets.UTF_8),
                provided.getBytes(StandardCharsets.UTF_8))) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "SERVICE_TOKEN_INVALID",
                    "智能体服务身份无效，请检查服务密钥配置");
        }
    }
 
    /** 只确认服务身份与当前登录用户；具体能力由调用方逐项收紧。 */
    public AgentPrincipal requireAuthenticated(String providedServiceToken) {
        verifyServiceToken(providedServiceToken);
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (userId == null) {
            throw new AgentBridgeException(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "未登录或登录已过期");
        }
        return principalOf(userId);
    }
 
    public AgentPrincipal require(String providedServiceToken, String permission) {
        verifyServiceToken(providedServiceToken);
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (userId == null) {
            throw new AgentBridgeException(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "未登录或登录已过期");
        }
        if (!securityFrameworkService.hasPermission(permission)) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "FORBIDDEN",
                    "当前用户缺少数据导入权限（" + permission + "）");
        }
        return principalOf(userId);
    }
 
    public AgentPrincipal require(String providedServiceToken, String delegationToken, String taskId,
                                  String operation, String permission, String moduleId, Long attachmentId) {
        verifyServiceToken(providedServiceToken);
        if (delegationToken != null && !delegationToken.isBlank()) {
            return delegationService.require(delegationToken, taskId, operation, permission, moduleId, attachmentId);
        }
        return require(providedServiceToken, permission);
    }
 
    /** 会话与附件入口无法预知模块，只要求具备任意一项导入权限。 */
    public AgentPrincipal requireAny(String providedServiceToken) {
        verifyServiceToken(providedServiceToken);
        Long userId = SecurityFrameworkUtils.getLoginUserId();
        if (userId == null) {
            throw new AgentBridgeException(HttpStatus.UNAUTHORIZED, "UNAUTHORIZED", "未登录或登录已过期");
        }
        if (!securityFrameworkService.hasAnyPermissions(IMPORT_PERMISSIONS.toArray(String[]::new))) {
            throw new AgentBridgeException(HttpStatus.FORBIDDEN, "FORBIDDEN", "当前用户缺少数据导入权限");
        }
        return principalOf(userId);
    }
 
 
    public AgentPrincipal requireAny(String providedServiceToken, String delegationToken, String taskId,
                                     String operation, String moduleId, Long attachmentId) {
        if (delegationToken == null || delegationToken.isBlank()) {
            return requireAny(providedServiceToken);
        }
        verifyServiceToken(providedServiceToken);
        AgentBridgeException last = null;
        for (String permission : IMPORT_PERMISSIONS) {
            try {
                return delegationService.require(delegationToken, taskId, operation, permission, moduleId, attachmentId);
            } catch (AgentBridgeException ex) {
                last = ex;
                if (!"DELEGATION_SCOPE_MISMATCH".equals(ex.getErrorCode())
                        && !"DELEGATION_PERMISSION_REVOKED".equals(ex.getErrorCode())) {
                    throw ex;
                }
            }
        }
        throw last == null ? new AgentBridgeException(HttpStatus.FORBIDDEN, "FORBIDDEN", "委托票据权限不足") : last;
    }
 
    private AgentPrincipal principalOf(Long userId) {
        return new AgentPrincipal(userId, "live");
    }
}