1、修复小程序手机号登录问题

2、调整OA

blade-service/blade-system/src/main/resources/application.yml

@@ -32,3 +32,8 @@ iam:
     authorization: ${IAM_SSO_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}
     profile-authorization: ${IAM_SSO_PROFILE_AUTHORIZATION:YjNlZmU0ODEwMzJiNGJhZTpkYzQ5NDY1NmQ4MzE0NThjODI5MzlmNzA2ZjliNDY3MQ==}
     page-size: ${IAM_SSO_ACCOUNT_PAGE_SIZE:50}
+
+# OA人员同步走同一 gwzh 网关，仅需 Authorization（与可用 curl 一致）
+thirdParty:
+  oa:
+    authorization: ${OA_AUTHORIZATION:${IAM_SSO_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}}

blade-third-party-api/blade-oa-api/src/main/java/org/springblade/thirdparty/oa/config/OAFeignClientConfig.java

@@ -1,42 +1,26 @@
 package org.springblade.thirdparty.oa.config;
 
 import feign.Request;
-import feign.RequestInterceptor;
+import org.springblade.thirdparty.oa.interceptor.OARequestInterceptor;
-import jakarta.annotation.Resource;
-import org.springblade.core.tool.utils.StringUtil;
 import org.springframework.context.annotation.Bean;
 
 import java.util.concurrent.TimeUnit;
 
 /**
+ * OA Feign 客户端配置
+ *
  * @author bfhuange
  * @since 2024/12/18
  */
 public class OAFeignClientConfig {
-	@Resource
-	OAProperties oaProperties;
 
 	@Bean
-    public RequestInterceptor requestInterceptor() {
+	public OARequestInterceptor requestInterceptor(OAProperties oaProperties) {
-        return template -> {
+		return new OARequestInterceptor(oaProperties);
-            // 空实现屏蔽 全局拦截器 BladeFeignRequestInterceptor
-			template.header("Authorization", normalizeAuthorization(oaProperties.getAuthorization()));
-        };
 	}
 
 	@Bean
 	public Request.Options options() {
 		return new Request.Options(10, TimeUnit.SECONDS, 120, TimeUnit.SECONDS, true);
 	}
-
-	private String normalizeAuthorization(String authorization) {
-		if (StringUtil.isBlank(authorization)) {
-			return authorization;
-		}
-		if (StringUtil.startsWithIgnoreCase(authorization, "Basic ")
-			|| StringUtil.startsWithIgnoreCase(authorization, "Bearer ")) {
-			return authorization;
-		}
-		return "Basic " + authorization;
-	}
 }

blade-third-party-api/blade-oa-api/src/main/java/org/springblade/thirdparty/oa/config/OAProperties.java

@@ -17,7 +17,7 @@ public class OAProperties {
     private String baseUrl;
 
     /**
-     * authorization
+     * gwzh 网关 Authorization（Basic），与可用 curl 一致
      */
     private String authorization;
 }

blade-third-party-api/blade-oa-api/src/main/java/org/springblade/thirdparty/oa/interceptor/OARequestInterceptor.java

@@ -0,0 +1,122 @@
+/**
+ * BladeX Commercial License Agreement
+ * Copyright (c) 2018-2099, https://bladex.cn. All rights reserved.
+ * <p>
+ * Use of this software is governed by the Commercial License Agreement
+ * obtained after purchasing a license from BladeX.
+ * <p>
+ * 1. This software is for development use only under a valid license
+ * from BladeX.
+ * <p>
+ * 2. Redistribution of this software's source code to any third party
+ * without a commercial license is strictly prohibited.
+ * <p>
+ * 3. Licensees may copyright their own code but cannot use segments
+ * from this software for such purposes. Copyright of this software
+ * remains with BladeX.
+ * <p>
+ * Using this software signifies agreement to this License, and the software
+ * must not be used for illegal purposes.
+ * <p>
+ * THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY. The author is
+ * not liable for any claims arising from secondary or illegal development.
+ * <p>
+ * Author: Chill Zhuang (bladejava@qq.com)
+ */
+package org.springblade.thirdparty.oa.interceptor;
+
+import feign.RequestInterceptor;
+import feign.RequestTemplate;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springblade.core.tool.utils.StringUtil;
+import org.springblade.thirdparty.oa.config.OAProperties;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+
+/**
+ * OA Feign 请求拦截器。
+ * <p>
+ * 对齐可用 curl：仅发送 Authorization + Content-Type，并清掉登录请求透传头，
+ * 避免 nginx 因 Host/Content-Length/Blade-Auth 等返回 400。
+ *
+ * @author Chill
+ */
+@Slf4j
+@RequiredArgsConstructor
+public class OARequestInterceptor implements RequestInterceptor {
+
+	private static final String BASIC_PREFIX = "Basic ";
+	private static final String BEARER_PREFIX = "Bearer ";
+	private static final Set<String> STRIP_HEADERS = Set.of(
+		HttpHeaders.HOST.toLowerCase(Locale.ROOT),
+		HttpHeaders.CONTENT_LENGTH.toLowerCase(Locale.ROOT),
+		HttpHeaders.CONTENT_TYPE.toLowerCase(Locale.ROOT),
+		HttpHeaders.ACCEPT.toLowerCase(Locale.ROOT),
+		HttpHeaders.CONNECTION.toLowerCase(Locale.ROOT),
+		HttpHeaders.TRANSFER_ENCODING.toLowerCase(Locale.ROOT),
+		HttpHeaders.COOKIE.toLowerCase(Locale.ROOT),
+		HttpHeaders.AUTHORIZATION.toLowerCase(Locale.ROOT),
+		HttpHeaders.ACCEPT_ENCODING.toLowerCase(Locale.ROOT),
+		HttpHeaders.ORIGIN.toLowerCase(Locale.ROOT),
+		HttpHeaders.REFERER.toLowerCase(Locale.ROOT),
+		HttpHeaders.EXPECT.toLowerCase(Locale.ROOT),
+		"keep-alive",
+		"upgrade",
+		"te",
+		"trailer",
+		"forwarded",
+		"x-real-ip",
+		"x-request-id",
+		"blade-auth",
+		"blade-requested-with",
+		"tenant-id",
+		"auth"
+	);
+
+	private final OAProperties oaProperties;
+
+	@Override
+	public void apply(RequestTemplate template) {
+		stripForwardedHeaders(template);
+		// 与可用 curl 保持一致：Authorization + Content-Type
+		template.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);
+
+		String authorization = normalizeAuthorization(oaProperties.getAuthorization());
+		if (StringUtil.isNotBlank(authorization)) {
+			template.header(HttpHeaders.AUTHORIZATION, authorization);
+		} else {
+			log.warn("OA Feign 未配置 third-party.oa.authorization，gwzh 网关可能拒绝请求");
+		}
+	}
+
+	private void stripForwardedHeaders(RequestTemplate template) {
+		List<String> headerNames = new ArrayList<>(template.headers().keySet());
+		for (String headerName : headerNames) {
+			String lowerName = headerName.toLowerCase(Locale.ROOT);
+			if (STRIP_HEADERS.contains(lowerName)
+				|| lowerName.startsWith("x-forwarded-")
+				|| lowerName.startsWith("blade-")
+				|| lowerName.startsWith("x-b3-")
+				|| lowerName.startsWith("sw8")) {
+				template.removeHeader(headerName);
+			}
+		}
+	}
+
+	private String normalizeAuthorization(String authorization) {
+		if (StringUtil.isBlank(authorization)) {
+			return authorization;
+		}
+		if (StringUtil.startsWithIgnoreCase(authorization, BASIC_PREFIX)
+			|| StringUtil.startsWithIgnoreCase(authorization, BEARER_PREFIX)) {
+			return authorization;
+		}
+		return BASIC_PREFIX + authorization;
+	}
+}

doc/nacos/blade-dev.yaml

@@ -88,6 +88,7 @@ thirdParty:
     # OA开放接口地址
     baseUrl: http://127.0.0.1:8080
     queryPersonPageUrl: /gwzh/OA/OA_GET_USER_LIST
+    authorization: ${OA_AUTHORIZATION:${IAM_SSO_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}}
   track:
     # 轨迹开放接口地址
     baseUrl: http://127.0.0.1:8080

doc/nacos/blade-prod.yaml

@@ -60,6 +60,7 @@ thirdParty:
     # OA开放接口地址
     baseUrl: http://127.0.0.1:8080
     queryPersonPageUrl: /gwzh/OA/OA_GET_USER_LIST
+    authorization: ${OA_AUTHORIZATION:${IAM_SSO_AUTHORIZATION:Z3d6aF90bXMtOVJJU0RVN1U6YW0yYkcwWnBJZ0RQZmtrSjNaZkZjUDBSaGFuSEtxQng=}}
   track:
     # 轨迹开放接口地址
     baseUrl: http://127.0.0.1:8080

doc/nacos/third-party-api.yaml

@@ -12,6 +12,7 @@ thirdParty:
     # OA开放接口地址
     baseUrl: ${OA_BASE_URL:http://127.0.0.1:8080}
     queryPersonPageUrl: ${OA_QUERY_PERSON_PAGE_URL:/gwzh/OA/OA_GET_USER_LIST}
+    authorization: ${OA_AUTHORIZATION:${IAM_SSO_AUTHORIZATION:}}
   track:
     # 轨迹开放接口地址
     baseUrl: ${TRACK_BASE_URL:http://127.0.0.1:8080}