package jnpf.dmsPermission;
|
|
import lombok.AllArgsConstructor;
|
import lombok.Data;
|
import lombok.RequiredArgsConstructor;
|
import org.springframework.stereotype.Component;
|
|
import javax.crypto.Mac;
|
import javax.crypto.spec.SecretKeySpec;
|
import java.nio.charset.StandardCharsets;
|
import java.security.GeneralSecurityException;
|
import java.security.MessageDigest;
|
import java.util.Base64;
|
import java.util.UUID;
|
|
@Component
|
@RequiredArgsConstructor
|
public class DmsFileCenterCursorCodec {
|
private static final String VERSION = "1";
|
private static final String HMAC_ALGORITHM = "HmacSHA256";
|
|
private final DmsPermissionProperties properties;
|
|
public String encode(String kind, String tenantId, String userId, UUID parentId,
|
String queryFingerprint, Cursor cursor) {
|
String payload = String.join("|",
|
VERSION,
|
field(kind),
|
field(tenantId),
|
field(userId),
|
field(parentId == null ? null : parentId.toString()),
|
field(queryFingerprint),
|
field(cursor.getName()),
|
field(uuid(cursor.getDocumentId())),
|
field(cursor.getVersionNo() == null ? null : cursor.getVersionNo().toString()),
|
field(uuid(cursor.getId())));
|
return base64(payload.getBytes(StandardCharsets.UTF_8)) + "." + base64(sign(payload));
|
}
|
|
public Cursor decode(String value, String expectedKind, String expectedTenantId,
|
String expectedUserId, UUID expectedParentId, String expectedFingerprint) {
|
if (value == null || value.trim().isEmpty()) {
|
return new Cursor(null, null, null, null);
|
}
|
try {
|
String[] token = value.split("\\.", -1);
|
if (token.length != 2) {
|
throw new IllegalArgumentException("cursor token parts");
|
}
|
String payload = new String(Base64.getUrlDecoder().decode(token[0]), StandardCharsets.UTF_8);
|
byte[] providedSignature = Base64.getUrlDecoder().decode(token[1]);
|
if (!MessageDigest.isEqual(providedSignature, sign(payload))) {
|
throw new IllegalArgumentException("cursor signature");
|
}
|
String[] parts = payload.split("\\|", -1);
|
if (parts.length != 10 || !VERSION.equals(parts[0])) {
|
throw new IllegalArgumentException("cursor payload");
|
}
|
String kind = unfield(parts[1]);
|
String tenantId = unfield(parts[2]);
|
String userId = unfield(parts[3]);
|
UUID parentId = uuid(unfield(parts[4]));
|
String fingerprint = unfield(parts[5]);
|
if (!expectedKind.equals(kind)
|
|| !expectedTenantId.equals(tenantId)
|
|| !expectedUserId.equals(userId)
|
|| !java.util.Objects.equals(expectedParentId, parentId)
|
|| !expectedFingerprint.equals(fingerprint)) {
|
throw new IllegalArgumentException("cursor context");
|
}
|
return new Cursor(
|
unfield(parts[6]),
|
uuid(unfield(parts[7])),
|
number(unfield(parts[8])),
|
uuid(unfield(parts[9])));
|
} catch (RuntimeException ex) {
|
throw DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST,
|
"分页 cursor 无效或不属于当前用户、目录和查询条件");
|
}
|
}
|
|
public String fingerprint(String value) {
|
try {
|
MessageDigest digest = MessageDigest.getInstance("SHA-256");
|
return base64(digest.digest((value == null ? "" : value).getBytes(StandardCharsets.UTF_8)));
|
} catch (GeneralSecurityException ex) {
|
throw new IllegalStateException("SHA-256 unavailable", ex);
|
}
|
}
|
|
private byte[] sign(String payload) {
|
String secret = properties.getCursorSigningSecret();
|
if (secret == null || secret.length() < 16) {
|
throw new IllegalStateException("dms.permission.cursor-signing-secret 至少需要 16 个字符");
|
}
|
try {
|
Mac mac = Mac.getInstance(HMAC_ALGORITHM);
|
mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), HMAC_ALGORITHM));
|
return mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
|
} catch (GeneralSecurityException ex) {
|
throw new IllegalStateException("HMAC-SHA256 unavailable", ex);
|
}
|
}
|
|
private String field(String value) {
|
return value == null ? "" : base64(value.getBytes(StandardCharsets.UTF_8));
|
}
|
|
private String unfield(String value) {
|
return value.isEmpty() ? null : new String(Base64.getUrlDecoder().decode(value), StandardCharsets.UTF_8);
|
}
|
|
private String base64(byte[] value) {
|
return Base64.getUrlEncoder().withoutPadding().encodeToString(value);
|
}
|
|
private String uuid(UUID value) {
|
return value == null ? null : value.toString();
|
}
|
|
private UUID uuid(String value) {
|
return value == null ? null : UUID.fromString(value);
|
}
|
|
private Long number(String value) {
|
return value == null ? null : Long.valueOf(value);
|
}
|
|
@Data
|
@AllArgsConstructor
|
public static class Cursor {
|
private String name;
|
private UUID documentId;
|
private Long versionNo;
|
private UUID id;
|
}
|
}
|
