gxwebsoft
efccb786fe
- 新增开放平台配置块 application.yml，配置 JWKS、公钥地址、issuer、audience 及接口前缀 - 新增 OpenPlatformSecurityConfig，独立安全链路匹配 /api/open/** 请求 - JwtAuthenticationFilter 增加 shouldNotFilter 跳过 /api/open/**，避免 RS256 验签异常 - 新增 OpenTenantContext 与拦截器，令牌中 tenant_id 作为唯一租户来源，防止伪造请求头 - MybatisPlusConfig 优先使用 OpenTenantContext 里的租户 ID，确保数据隔离正确 - sys_order 表显式在 OrderMapper.xml 中使用 tenant_id 条件过滤，支持开放链路多租户隔离 - 新增开放平台订单分页查询接口 /api/open/v1/order/page，使用独立参数与返回值结构 - 出参 OpenOrderVO 支持手机号脱敏，保障数据安全，且只暴露必要字段 - 调整 SecurityConfig 加 @Order(2)，让位给开放链路的 SecurityConfig @Order(1) - TenantController.page 增加安全修复，未登录状态拒绝访问，防止匿名读取全部租户数据 - 新增开放平台专用异常处理及认证、权限拒绝响应，避免泄露内部异常信息 - 新增 pom 依赖 spring-boot-starter-oauth2-resource-server，用于 RS256 JWT 验签 - 完整开放平台对接文档 docs/OPEN_PLATFORM_INTEGRATION.md，涵盖设计理念与接口契约 - 增加 OpenOrderVO 单元测试，覆盖手机号脱敏、空列表处理等场景，提高可靠性
187 lines
5.3 KiB
YAML
187 lines
5.3 KiB
YAML
# 端口
|
||
server:
|
||
port: 8000
|
||
# socketIo
|
||
socketio:
|
||
port: 9191
|
||
# 多环境配置
|
||
spring:
|
||
profiles:
|
||
active: dev
|
||
|
||
application:
|
||
name: server
|
||
|
||
# 允许bean定义覆盖，解决RabbitMQConfig和JacksonConfig中的objectMapper bean冲突
|
||
main:
|
||
allow-bean-definition-overriding: true
|
||
|
||
# 连接池配置
|
||
datasource:
|
||
druid:
|
||
initial-size: 5
|
||
min-idle: 5
|
||
max-active: 20
|
||
max-wait: 30000
|
||
time-between-eviction-runs-millis: 60000
|
||
min-evictable-idle-time-millis: 300000
|
||
test-while-idle: true
|
||
test-on-borrow: true
|
||
test-on-return: false
|
||
remove-abandoned: true
|
||
remove-abandoned-timeout: 1800
|
||
#pool-prepared-statements: false
|
||
#max-pool-prepared-statement-per-connection-size: 20
|
||
filters: stat, wall
|
||
validation-query: SELECT 'x'
|
||
aop-patterns: com.gxwebsoft.*.*.service.*
|
||
stat-view-servlet:
|
||
url-pattern: /druid/*
|
||
reset-enable: true
|
||
login-username: admin
|
||
login-password: admin
|
||
|
||
# json时间格式设置
|
||
jackson:
|
||
time-zone: GMT+8
|
||
date-format: yyyy-MM-dd HH:mm:ss
|
||
serialization:
|
||
write-dates-as-timestamps: false
|
||
write-date-timestamps-as-nanoseconds: false
|
||
deserialization:
|
||
read-date-timestamps-as-nanoseconds: false
|
||
|
||
# 设置上传文件大小
|
||
servlet:
|
||
multipart:
|
||
max-file-size: 500MB
|
||
max-request-size: 500MB
|
||
redis:
|
||
database: 0
|
||
host: 1Panel-redis-Q1LE
|
||
port: 6379
|
||
password: redis_WSDb88
|
||
|
||
# RabbitMQ 配置
|
||
rabbitmq:
|
||
host: 1Panel-rabbitmq-kvHZ
|
||
port: 5672
|
||
username: rabbitmq
|
||
password: rabbitmq
|
||
virtual-host: /
|
||
# 开启确认模式
|
||
publisher-confirm-type: correlated
|
||
# 开启Return模式
|
||
publisher-returns: true
|
||
|
||
# 邮件服务器配置
|
||
mail:
|
||
host: smtp.qq.com
|
||
username: 170083662@qq.com
|
||
password: mnfokualhfaucaie
|
||
default-encoding: UTF-8
|
||
properties:
|
||
mail:
|
||
smtp:
|
||
auth: true
|
||
socketFactory:
|
||
class: javax.net.ssl.SSLSocketFactory
|
||
port: 465
|
||
|
||
# Mybatis-plus配置
|
||
mybatis-plus:
|
||
mapper-locations: classpath*:com/gxwebsoft/**/*Mapper.xml
|
||
configuration:
|
||
map-underscore-to-camel-case: true
|
||
cache-enabled: true
|
||
global-config:
|
||
:banner: false
|
||
db-config:
|
||
id-type: auto
|
||
logic-delete-value: 1
|
||
logic-not-delete-value: 0
|
||
|
||
# 框架配置
|
||
config:
|
||
open-office-home: C:/OpenOffice4/
|
||
swagger-base-package: com.gxwebsoft
|
||
swagger-title: 网宿软件 API文档
|
||
swagger-description: websoft - 基于java spring、vue3、antd构建的前后端分离快速开发框架
|
||
swagger-version: 2.0
|
||
token-key: WLgNsWJ8rPjRtnjzX/Gx2RGS80Kwnm/ZeLbvIL+NrBs=
|
||
server-url: https://server.websoft.top/api
|
||
file-server: https://file.websoft.top
|
||
# 微信扫码H5页面访问地址（用于微信扫码登录跳转）
|
||
wechat-scan-url: https://websopy.websoft.top
|
||
upload-path: /Users/gxwebsoft/Documents/uploads
|
||
local-upload-path: /Users/gxwebsoft/Documents/uploads
|
||
|
||
# websopy 服务地址（用于同步用户数据）
|
||
websopyUrl: https://websopy-api.websoft.top
|
||
|
||
# 内部服务调用密钥（调用 websopy 等内部接口时使用，请务必与 websopy 端保持一致）
|
||
internal-key: ${INTERNAL_KEY:websopy-internal-2025}
|
||
|
||
# 阿里云OSS云存储
|
||
endpoint: https://oss-cn-shenzhen.aliyuncs.com
|
||
accessKeyId: LTAI5tGXuJku8MK7TA6gQMZw
|
||
accessKeySecret: rimTK5ldtCtNZ9V9S5np6JToJtYuh2
|
||
bucketName: oss-gxwebsoft
|
||
bucketDomain: https://oss.wsdns.cn
|
||
aliyunDomain: https://oss-gxwebsoft.oss-cn-shenzhen.aliyuncs.com
|
||
|
||
# MQ同步配置
|
||
sync:
|
||
# 是否启用MQ（设为false则使用原有直接同步方式）
|
||
mq:
|
||
enabled: true
|
||
|
||
# JWT配置
|
||
jwt:
|
||
secret: websoft-jwt-secret-key-2025-dev-environment
|
||
expire: 86400 # token过期时间(秒) 24小时
|
||
|
||
# 证书配置
|
||
certificate:
|
||
# 证书加载模式: CLASSPATH, FILESYSTEM, VOLUME
|
||
load-mode: CLASSPATH
|
||
# Docker挂载卷证书路径
|
||
cert-root-path: /app/certs
|
||
# 开发环境证书路径前缀
|
||
dev-cert-path: certs/dev
|
||
|
||
# 微信支付证书配置
|
||
wechat-pay:
|
||
dev:
|
||
api-v3-key: "zGufUcqa7ovgxRL0kF5OlPr482EZwtn9"
|
||
private-key-file: "apiclient_key.pem"
|
||
apiclient-cert-file: "apiclient_cert.pem"
|
||
wechatpay-cert-file: "wechatpay_cert.pem"
|
||
prod-base-path: "/file"
|
||
cert-dir: "wechat"
|
||
|
||
# 支付宝证书配置
|
||
alipay:
|
||
cert-dir: "alipay"
|
||
app-private-key-file: "app_private_key.pem"
|
||
app-cert-public-key-file: "appCertPublicKey.crt"
|
||
alipay-cert-public-key-file: "alipayCertPublicKey.crt"
|
||
alipay-root-cert-file: "alipayRootCert.crt"
|
||
|
||
# 开放平台（base-api）对接配置
|
||
# 业务服务只做本地验签，不共享密钥；/api/open/** 走独立安全链。
|
||
open-platform:
|
||
enabled: true
|
||
# base-api 的 JWKS 公钥地址
|
||
# 注意：不要改用 spring.security.oauth2.resourceserver.jwt.issuer-uri，
|
||
# Spring 会去做 OIDC 发现（base-api 没有该文档）导致启动失败。
|
||
jwk-set-uri: https://base-api.websoft.top/api/v1/oauth/jwks
|
||
# 必须与 base-api 令牌里的 iss 完全一致
|
||
issuer: https://base-api.websoft.top/api
|
||
# 必须与 base-api 令牌里的 aud 一致
|
||
audience: websoft-open-platform
|
||
# 对外接口前缀，版本号由 controller 的 @RequestMapping 决定
|
||
path-prefix: /api/open
|
||
# 返回给第三方前是否对手机号脱敏
|
||
mask-sensitive: true
|