build / build-push (push) Successful in 48s
- 治理面浏览器 SSO(/api/internal/admin/*):cas-client-core 3.5.1 固定 service 票据校验
(ctx 为空、外链前缀由 Caddy 剥离,按请求路径拼 service 必 404,故用固定回跳靶点);
未登录双形态应答——带 yschapirequest:1 出 200+{code:302,urlToRedirectTo}(平台同构,
alova 直接整页跳),裸调用出 401 治理面信封;OPENGW_SSO_ENABLED 默认关,
回滚=清 env 重新 Apply,不回退镜像
- 机器面(/api/internal/* 其余)收口 InternalTokenFilter:只认 X-Internal-Token,
值走 OPENGW_INTERNAL_TOKEN env,空=灰度放行(projman 路由同步不打断);
比较用 XOR 折叠常量时间(String.equals 提前短路有时序侧信道;MessageDigest.isEqual
在 JDK8 非 const-time,JDK9 才修)
- 注册表重载抽 RegistryReloader:机器面 /routes/refresh 与控制台按钮
/admin/routes/reload 共用同一实现(一接口面一种认证,不做令牌 OR 会话混判)
- 治理会话 cookie 改名 OPENGW_SESSION:ctx 为空时默认 JSESSIONID(Path=/) 会与
base 域各应用同名叠放进同一个 Cookie 头
- session 端点在 CAS 面未装配时回空 ssoHost:前端据此隐藏「退出」,不在匿名端点
泄漏 CAS 基址、灰度期不出现平台级注销入口
- 新增 44 用例:面守卫机械钉桩(全仓控制器映射必须声明鉴权归属)+ 装配红线
(默认关/序位/固定 service 原样采用)+ 双形态应答 + 令牌三态/灰度窗 + 重载器
147 lines
6.4 KiB
XML
147 lines
6.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||
<modelVersion>4.0.0</modelVersion>
|
||
|
||
<parent>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-parent</artifactId>
|
||
<version>2.7.18</version>
|
||
<relativePath/>
|
||
</parent>
|
||
|
||
<groupId>com.yunhai.platform</groupId>
|
||
<artifactId>open-gateway</artifactId>
|
||
<version>1.0.0-SNAPSHOT</version>
|
||
<packaging>jar</packaging>
|
||
<name>open-gateway</name>
|
||
<description>开放接口网关:容器网内 oapi 统一入口(路由/验签/转发/台账),后期对外 open 域名唯一鉴权面</description>
|
||
|
||
<properties>
|
||
<java.version>1.8</java.version>
|
||
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
||
</properties>
|
||
|
||
<dependencyManagement>
|
||
<!-- 基础平台版本管理(yh-* 架包与 spring-boot-dependencies 对齐);形态同 UserBase/Notice -->
|
||
<dependencies>
|
||
<dependency>
|
||
<groupId>com.yunhai.platform</groupId>
|
||
<artifactId>yh-platform-dependencies</artifactId>
|
||
<version>1.0.0-SNAPSHOT</version>
|
||
<type>pom</type>
|
||
<scope>import</scope>
|
||
</dependency>
|
||
</dependencies>
|
||
</dependencyManagement>
|
||
|
||
<dependencies>
|
||
<!-- 白名单(开放接口中心 T0.8):本清单外依赖不得引入。
|
||
2026-10-09 例外授权:org.jasig.cas.client:cas-client-core(治理面浏览器 SSO 票据校验,
|
||
版本与 Notice/UserBase 逐字一致,见下)。仍不得引 yh-auth starter——平台注入的
|
||
YH_SSO_SERVER_URL_PREFIX 已在容器 env 中,starter 的
|
||
{@code @ConditionalOnProperty(yh.sso.server-url-prefix)} 会被动点燃并以默认
|
||
/api/* 圈住机器面,且其 serverName() 正则会丢掉外链前缀导致回跳 404。 -->
|
||
<dependency>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-web</artifactId>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-data-jpa</artifactId>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-actuator</artifactId>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>com.github.ben-manes.caffeine</groupId>
|
||
<artifactId>caffeine</artifactId>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>org.apache.httpcomponents</groupId>
|
||
<artifactId>httpclient</artifactId>
|
||
</dependency>
|
||
<!-- 复用 starter 的 SignKeyResolver/SignUtil(密钥链单一事实源);密钥解析永远 fail-closed -->
|
||
<dependency>
|
||
<groupId>com.yunhai.platform</groupId>
|
||
<artifactId>yh-app-auth-spring-boot-starter</artifactId>
|
||
<version>1.0.0-SNAPSHOT</version>
|
||
</dependency>
|
||
<!-- starter 将 data-redis 标 optional(未引 Redis 的服务回退配置式 Provider),不传递;
|
||
网关密钥链必须走 Redis(sign:app:*),按 T0.8 白名单意图显式引入 -->
|
||
<dependency>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-data-redis</artifactId>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>com.mysql</groupId>
|
||
<artifactId>mysql-connector-j</artifactId>
|
||
<scope>runtime</scope>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>com.h2database</groupId>
|
||
<artifactId>h2</artifactId>
|
||
<scope>test</scope>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-starter-test</artifactId>
|
||
<scope>test</scope>
|
||
</dependency>
|
||
<dependency>
|
||
<groupId>org.projectlombok</groupId>
|
||
<artifactId>lombok</artifactId>
|
||
<optional>true</optional>
|
||
</dependency>
|
||
<!-- 接口规范:管理面(/api/internal/**)成功响应统一包装为 {code,msg,data},与 notice/userbase
|
||
前端解析形态一致;同时传递引入 yh-utils-core(ErrorCode / BasePageQuery / BasePageResult)。
|
||
oapi 转发链不经 Controller(Filter 直写 response),不受本 starter 的 ResponseBodyAdvice 影响。 -->
|
||
<dependency>
|
||
<groupId>com.yunhai.platform</groupId>
|
||
<artifactId>yh-api-std</artifactId>
|
||
</dependency>
|
||
<!-- Swagger / OpenAPI 文档(springdoc,兼容 Boot 2.7;版本对齐 UserBase/Notice) -->
|
||
<dependency>
|
||
<groupId>org.springdoc</groupId>
|
||
<artifactId>springdoc-openapi-ui</artifactId>
|
||
<version>1.7.0</version>
|
||
</dependency>
|
||
<!-- CAS 客户端(治理面浏览器 SSO 的票据校验)。只用 cas-client-core、不引平台 yh-auth starter,
|
||
接法见 com.yunhai.platform.gateway.sso 包注释。版本与 Notice/UserBase 及本地 .m2 一致。 -->
|
||
<dependency>
|
||
<groupId>org.jasig.cas.client</groupId>
|
||
<artifactId>cas-client-core</artifactId>
|
||
<version>3.5.1</version>
|
||
</dependency>
|
||
</dependencies>
|
||
|
||
<build>
|
||
<plugins>
|
||
<plugin>
|
||
<groupId>org.springframework.boot</groupId>
|
||
<artifactId>spring-boot-maven-plugin</artifactId>
|
||
<configuration>
|
||
<excludes>
|
||
<exclude>
|
||
<groupId>org.projectlombok</groupId>
|
||
<artifactId>lombok</artifactId>
|
||
</exclude>
|
||
</excludes>
|
||
</configuration>
|
||
</plugin>
|
||
</plugins>
|
||
</build>
|
||
|
||
<repositories>
|
||
<repository>
|
||
<id>nexus-public</id>
|
||
<name>bsch/nexus public</name>
|
||
<url>http://nexus.yunhaixingtong.com/repository/maven-public/</url>
|
||
<releases><enabled>true</enabled></releases>
|
||
<snapshots><enabled>true</enabled></snapshots>
|
||
</repository>
|
||
</repositories>
|
||
</project>
|