fix(security): F01 授权门禁不可被配置关闭 + F02 业务坐标按可信来源隔离（含唯一键 SQL）

2026-10-28 11:46:20 +08:00
parent 302216a07c
commit 8a1294aef2
17 changed files with 366 additions and 211 deletions
@@ -71,51 +71,44 @@ public class FlowInstanceService {
     * null=存量调用方，指纹核对缺省关）。
     */
    public String payloadHash;
+    /** Assigned only by authenticated server-side source resolution; not a request DTO field. */
+    public String sourcePrincipalId;
    }

    /** 代发起结果：instanceId + duplicated（命中既有办件=true，含重启重提） */
    @Transactional
    public ApplyOutcome apply(ApplyCommand cmd) {
-        FlwInstance existing = instanceRepository
-                .findBySchIdAndBizTypeAndBizId(cmd.schId, cmd.bizType, cmd.bizId).orElse(null);
+        FlwInstance existing = findOwned(cmd);
        if (existing != null) {
+            requireSameOwner(existing, cmd);
            int status = existing.getStatus();
            if (status == FlwEnums.InstanceStatus.APPROVING.getCode()
                    || status == FlwEnums.InstanceStatus.COMPLETED.getCode()) {
                return new ApplyOutcome(existing.getId(), true);
            }
-            // 30/40：R4 重启推进（复用办件行，定义/快照/时间刷新，重新走 START）
            restart(existing, cmd);
            return new ApplyOutcome(existing.getId(), true);
        }
-        FlwInstance instance = new FlwInstance();
-        instance.setSchId(cmd.schId);
-        instance.setDefId(cmd.def.getId());
-        instance.setDefCode(cmd.def.getCode());
-        instance.setDefVersion(cmd.def.getVersion());
-        instance.setBizType(cmd.bizType);
-        instance.setBizId(cmd.bizId);
-        instance.setBizTitle(cmd.bizTitle);
-        instance.setBizUrl(cmd.bizUrl);
-        instance.setBizSnapshot(cmd.bizSnapshot);
-        instance.setFormDataJson(cmd.formDataJson);
-        instance.setAssignJson(cmd.assignJson);
-        instance.setApplyAppKey(cmd.applyAppKey);
-        instance.setApplyAppCode(cmd.applyAppCode);
-        instance.setSubmitterId(cmd.submitterId);
-        instance.setSubmitterName(cmd.submitterName);
-        instance.setStatus(FlwEnums.InstanceStatus.APPROVING.getCode());
-        instance.setSubmitTime(LocalDateTime.now());
-        instanceRepository.saveAndFlush(instance);
-        appendTraceEvent(instance, FlwEnums.TaskStatus.NODE_SUBMIT, "发起申请",
-                FlwEnums.TaskStatus.SUBMITTED, cmd.submitterId, cmd.submitterName);
-        flowEngine.startAdvance(instance, cmd.def);
-        publishSubmitted(instance);
-        return new ApplyOutcome(instance.getId(), false);
+        FlwInstance created = createInstance(cmd, java.util.UUID.randomUUID().toString(), 1, cmd.sourcePrincipalId, 1, true);
+        return new ApplyOutcome(created.getId(), false);
+    }
+
+    private FlwInstance findOwned(ApplyCommand cmd) {
+        if (cmd.schId == null || cmd.schId <= 0 || cmd.sourcePrincipalId == null
+                || !cmd.sourcePrincipalId.matches("[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")) {
+            throw new BizException(ErrorCode.FORBIDDEN, "缺少可信来源或有效申报学校");
+        }
+        FlwInstance existing = instanceRepository.findBySchIdAndSourcePrincipalIdAndBizTypeAndBizIdAndLegacySlot(
+                cmd.schId, cmd.sourcePrincipalId, cmd.bizType, cmd.bizId, 1).orElse(null);
+        if (existing == null && instanceRepository.findFirstBySchIdAndSourcePrincipalIdAndBizTypeAndBizIdOrderByApplyRoundDesc(
+                cmd.schId, cmd.sourcePrincipalId, cmd.bizType, cmd.bizId).isPresent()) {
+            throw new BizException(ErrorCode.FORBIDDEN, "该业务对象已有正式命令实例，请使用原命令通道");
+        }
+        return existing;
    }

    private void restart(FlwInstance instance, ApplyCommand cmd) {
-        restart(instance, cmd, null, null);
+        restart(instance, cmd, java.util.UUID.randomUUID().toString(), instance.getApplyRound());
    }

    /**
@@ -349,15 +342,14 @@ public class FlowInstanceService {
     */
    @Transactional
    public GuardedOutcome applyGuarded(ApplyCommand cmd, ApplyRetryPolicy policy) {
-        FlwInstance existing = instanceRepository
-                .findBySchIdAndBizTypeAndBizId(cmd.schId, cmd.bizType, cmd.bizId).orElse(null);
+        FlwInstance existing = findOwned(cmd);
        if (existing != null) {
            return settleExisting(existing, cmd, policy);
        }
        String token = policy == null ? null : trimToNull(policy.requestToken);
        Integer round = policy == null || policy.attempt == null ? Integer.valueOf(1) : policy.attempt;
-        createInstance(cmd, token, round);
-        return new GuardedOutcome(instanceOf(cmd), false, FlowApplyRetryModels.Branch.CREATED, round);
+        FlwInstance created = createInstance(cmd, token, round, cmd.sourcePrincipalId, 1, true);
+        return new GuardedOutcome(created.getId(), false, FlowApplyRetryModels.Branch.CREATED, round);
    }

    private GuardedOutcome settleExisting(FlwInstance existing, ApplyCommand cmd, ApplyRetryPolicy policy) {
@@ -441,14 +433,15 @@ public class FlowInstanceService {
        publishSubmitted(instance);
    }

-    private void createInstance(ApplyCommand cmd, String token, Integer round) {
-        createInstance(cmd, token, round, null);
+    private FlwInstance createInstance(ApplyCommand cmd, String token, Integer round, String source) {
+        return createInstance(cmd, token, round, source, null, false);
    }

-    private FlwInstance createInstance(ApplyCommand cmd, String token, Integer round, String source) {
+    private FlwInstance createInstance(ApplyCommand cmd, String token, Integer round, String source,
+                                      Integer legacySlot, boolean start) {
        FlwInstance instance = new FlwInstance();
        instance.setSourcePrincipalId(source);
-        instance.setLegacySlot(source == null ? 1 : null);
+        instance.setLegacySlot(legacySlot);
        instance.setSchId(cmd.schId);
        instance.setDefId(cmd.def.getId());
        instance.setDefCode(cmd.def.getCode());
@@ -472,31 +465,19 @@ public class FlowInstanceService {
        instanceRepository.saveAndFlush(instance);
        appendTraceEvent(instance, FlwEnums.TaskStatus.NODE_SUBMIT, "发起申请",
                FlwEnums.TaskStatus.SUBMITTED, cmd.submitterId, cmd.submitterName);
-        if (source == null) {
+        if (start) {
            flowEngine.startAdvance(instance, cmd.def);
            publishSubmitted(instance);
        }
        return instance;
    }

-    /**
-     * 旧 {@link #apply(ApplyCommand)} 的建件段复用（行为逐字不变，只是把 new 出来的那段抽出来）。
-     * 这里不复用 createInstance 是因为旧路径不写 token/round（保持存量行 NULL，不伪装"有守卫"）。
-     */
-    private Long instanceOf(ApplyCommand cmd) {
-        FlwInstance created = instanceRepository
-                .findBySchIdAndBizTypeAndBizId(cmd.schId, cmd.bizType, cmd.bizId).orElse(null);
-        return created == null ? null : created.getId();
-    }
-
    /**
     * 归属复核：调用应用 / 提交者 / 流程线三者任一明确不符都拒（C.3"不能把别的应用
-     * 相同 bizType 键当自己的结果"）。两侧都非空才判——历史行没有 token/appKey 快照，
-     * 不能因为"当年没记"就把存量件判成别人的。
+     * 相同 bizType 键当自己的结果"）。来源必须存在且匹配，不用 appKey 快照替代来源 UUID。
     */
    private void requireSameOwner(FlwInstance existing, ApplyCommand cmd) {
-        if (existing.getApplyAppKey() != null && cmd.applyAppKey != null
-                && !existing.getApplyAppKey().equals(cmd.applyAppKey)) {
+        if (cmd.sourcePrincipalId == null || !cmd.sourcePrincipalId.equals(existing.getSourcePrincipalId())) {
            throw new BizException(ErrorCode.FORBIDDEN,
                    "该业务键的办件属于另一调用应用（bizType=" + cmd.bizType + " bizId=" + cmd.bizId + "）");
        }