package jnpf.bizcommon.audit.service;
|
|
import jnpf.audit.AuditConsts;
|
import jnpf.audit.model.AuditEventDTO;
|
import jnpf.audit.model.AuditRelatedSignDTO;
|
import jnpf.bizcommon.audit.service.sign.AuditSignEvidence;
|
import jnpf.bizcommon.audit.service.sign.AuditSignEvidenceReader;
|
import jnpf.bizcommon.audit.service.sign.AuditSignMetaData;
|
import jnpf.util.JsonUtil;
|
import lombok.RequiredArgsConstructor;
|
import lombok.extern.slf4j.Slf4j;
|
import org.springframework.stereotype.Service;
|
|
import java.nio.charset.StandardCharsets;
|
import java.security.MessageDigest;
|
import java.util.ArrayList;
|
import java.util.LinkedHashSet;
|
import java.util.List;
|
import java.util.LinkedHashMap;
|
import java.util.Map;
|
import java.util.Set;
|
|
/** 为数据接口、{@code @AuditLog} 和 DMS 受控操作补充请求所携带的电子签名事实。 */
|
@Slf4j
|
@Service
|
@RequiredArgsConstructor
|
public class DataInterfaceSignAuditService {
|
|
private static final String SIGN_ACTION = "SIGN";
|
private static final String REQUEST_SIGN_FIELD = "__request_biz_sign__";
|
private static final String DATA_INTERFACE = "DATA_INTERFACE";
|
private static final String DMS_FOLDER = "DMS_FOLDER";
|
private static final String DMS_FILE = "DMS_FILE";
|
private static final String DMS_PERMISSION = "DMS_PERMISSION";
|
private static final String DMS_LOAN_COPY = "DMS_LOAN_COPY";
|
private static final String PRIMARY = "PRIMARY";
|
private static final String REVIEW = "REVIEW";
|
|
private final AuditSignEvidenceReader signEvidenceReader;
|
private final AuditEventService auditEventService;
|
|
/**
|
* 处理旧 relatedSignId 和新 relatedSigns。异常向上交给审计投递器进入 spool 重试，
|
* 调用发生在审计服务内部，不会影响已经提交的原始业务请求。
|
*/
|
public void recordRelatedSign(AuditEventDTO businessEvent) {
|
if (businessEvent == null || !isBusinessEvent(businessEvent.getEventType())) {
|
return;
|
}
|
List<RelatedSign> relatedSigns = normalizeRelatedSigns(businessEvent);
|
if (relatedSigns.isEmpty()) {
|
return;
|
}
|
List<String> signIds = new ArrayList<>(relatedSigns.size());
|
for (RelatedSign related : relatedSigns) {
|
signIds.add(related.signId);
|
}
|
Map<String, AuditSignEvidence> evidences = signEvidenceReader.read(
|
signIds, businessEvent.getTenantId());
|
Set<String> roles = new LinkedHashSet<>();
|
for (RelatedSign related : relatedSigns) {
|
recordRelatedSign(businessEvent, related, evidences.get(related.signId), roles);
|
}
|
}
|
|
private void recordRelatedSign(AuditEventDTO businessEvent, RelatedSign related,
|
AuditSignEvidence evidence, Set<String> roles) {
|
if (evidence == null) {
|
missingEvidence(businessEvent, "未查询到同租户签名记录", related.signId);
|
return;
|
}
|
if (isBlank(evidence.operatorId())
|
|| !evidence.operatorId().equals(businessEvent.getOperatorId())) {
|
missingEvidence(businessEvent, "签名归属与当前操作人不一致", related.signId);
|
return;
|
}
|
AuditSignMetaData metaData = AuditSignMetaData.parse(evidence.metaData());
|
String evidenceRole = metaData.isReviewButton() ? REVIEW : PRIMARY;
|
String signatureRole = related.role == null ? evidenceRole : related.role;
|
if (isDmsControlledType(businessEvent.getBizType()) && related.role != null
|
&& !related.role.equals(evidenceRole)) {
|
throw new IllegalArgumentException("DMS 签名角色与签名凭证不一致: " + related.signId);
|
}
|
if (!roles.add(signatureRole)) {
|
throw new IllegalArgumentException("同一操作不能包含多个 " + signatureRole + " 签名");
|
}
|
Map<String, Object> extra = new LinkedHashMap<>();
|
extra.put("signField", REQUEST_SIGN_FIELD);
|
extra.put("signatureRole", signatureRole);
|
extra.put("auditSource", businessEvent.getBizType());
|
extra.put("businessTargetTable", businessEvent.getTargetTable());
|
extra.put("affectedTargetIds", affectedTargetIds(businessEvent));
|
if (!isBlank(evidence.accountName())) {
|
extra.put("accountName", evidence.accountName());
|
}
|
if (!isBlank(evidence.opType())) {
|
extra.put("opType", evidence.opType());
|
}
|
|
AuditEventDTO signEvent = AuditEventDTO.builder()
|
.clientEventId(signClientEventId(businessEvent, related.signId, signatureRole))
|
.operationId(businessEvent.getOperationId())
|
.eventTime(evidence.signedAt() == null
|
? businessEvent.getEventTime() : evidence.signedAt())
|
.tenantId(businessEvent.getTenantId())
|
.operatorId(evidence.operatorId())
|
.operatorName(businessEvent.getOperatorName())
|
.operatorOrgId(businessEvent.getOperatorOrgId())
|
.appName(businessEvent.getAppName())
|
.bizModule(businessEvent.getBizModule())
|
.ip(businessEvent.getIp())
|
.ipRegion(businessEvent.getIpRegion())
|
.browser(businessEvent.getBrowser())
|
.os(businessEvent.getOs())
|
.requestUri(businessEvent.getRequestUri())
|
.eventType(AuditConsts.TYPE_E_SIGNATURE)
|
.actionCode(SIGN_ACTION)
|
.actionLabel(actionLabel(signatureRole))
|
.sourceLayer(3)
|
.targetTable(AuditSignEvidenceReader.SIGN_TABLE)
|
.targetId(related.signId)
|
.bizType(businessEvent.getBizType())
|
.bizCode(businessEvent.getBizCode())
|
.reason(evidence.note())
|
.extra(JsonUtil.getObjectToString(extra))
|
.recordTitle(businessEvent.getRecordTitle())
|
.entryType(businessEvent.getEntryType())
|
.entryId(businessEvent.getEntryId())
|
.entryName(businessEvent.getEntryName())
|
.build();
|
auditEventService.saveIdempotent(signEvent);
|
}
|
|
private static List<RelatedSign> normalizeRelatedSigns(AuditEventDTO event) {
|
Map<String, RelatedSign> normalized = new LinkedHashMap<>();
|
if (!isBlank(event.getRelatedSignId())) {
|
String signId = event.getRelatedSignId().trim();
|
normalized.put(signId, new RelatedSign(signId, null));
|
}
|
if (event.getRelatedSigns() != null) {
|
for (AuditRelatedSignDTO item : event.getRelatedSigns()) {
|
if (item == null || isBlank(item.getSignId())) {
|
continue;
|
}
|
String signId = item.getSignId().trim();
|
String role = normalizeRole(item.getRole());
|
RelatedSign previous = normalized.put(signId, new RelatedSign(signId, role));
|
if (previous != null && previous.role != null && role != null
|
&& !previous.role.equals(role)) {
|
throw new IllegalArgumentException("同一签名 ID 不能同时声明为主签和复核签: " + signId);
|
}
|
}
|
}
|
return new ArrayList<>(normalized.values());
|
}
|
|
private void missingEvidence(AuditEventDTO event, String message, String signId) {
|
if (isDmsControlledType(event.getBizType())) {
|
throw new IllegalStateException(message + ": " + signId);
|
}
|
log.warn("[RELATED-SIGN-AUDIT] {}，跳过签名事件 clientEventId={} signId={}",
|
message, event.getClientEventId(), signId);
|
}
|
|
private static String signClientEventId(AuditEventDTO event, String signId, String role) {
|
if (DATA_INTERFACE.equals(event.getBizType())) {
|
return digestId("DIS-", value(event.getOperationId()) + "\n" + value(signId));
|
}
|
String prefix = DMS_FILE.equals(event.getBizType()) ? "DFF-"
|
: (DMS_PERMISSION.equals(event.getBizType()) ? "DFP-"
|
: (DMS_FOLDER.equals(event.getBizType()) ? "DFS-"
|
: (DMS_LOAN_COPY.equals(event.getBizType()) ? "DLC-" : "ARS-")));
|
String bizTypePart = "ARS-".equals(prefix) ? value(event.getBizType()) + "\n" : "";
|
return digestId(prefix, bizTypePart + value(event.getOperationId()) + "\n"
|
+ value(signId) + "\n" + value(role));
|
}
|
|
private static String digestId(String prefix, String source) {
|
try {
|
byte[] digest = MessageDigest.getInstance("SHA-256")
|
.digest(source.getBytes(StandardCharsets.UTF_8));
|
StringBuilder hex = new StringBuilder(prefix);
|
for (byte item : digest) {
|
hex.append(String.format("%02x", item & 0xff));
|
}
|
return hex.toString();
|
} catch (Exception e) {
|
throw new IllegalStateException("生成关联签名事件幂等键失败", e);
|
}
|
}
|
|
private static String actionLabel(String role) {
|
return REVIEW.equals(role) ? "复审签名" : "电子签名";
|
}
|
|
private static boolean isBusinessEvent(String eventType) {
|
return AuditConsts.TYPE_DATA_CHANGE.equals(eventType)
|
|| AuditConsts.TYPE_BIZ_ACTION.equals(eventType);
|
}
|
|
private static boolean isDmsControlledType(String bizType) {
|
return DMS_FOLDER.equals(bizType) || DMS_FILE.equals(bizType)
|
|| DMS_PERMISSION.equals(bizType) || DMS_LOAN_COPY.equals(bizType);
|
}
|
|
@SuppressWarnings("unchecked")
|
private static List<String> affectedTargetIds(AuditEventDTO event) {
|
Set<String> ids = new LinkedHashSet<>();
|
if (!isBlank(event.getTargetId())) {
|
ids.add(event.getTargetId());
|
}
|
if (!DMS_PERMISSION.equals(event.getBizType()) || isBlank(event.getExtra())) {
|
return new ArrayList<>(ids);
|
}
|
try {
|
Map<String, Object> extra = JsonUtil.stringToMap(event.getExtra());
|
Object targets = extra == null ? null : extra.get("affectedTargets");
|
if (targets instanceof Iterable) {
|
for (Object target : (Iterable<Object>) targets) {
|
if (!(target instanceof Map)) continue;
|
Object resourceId = ((Map<String, Object>) target).get("resourceId");
|
if (resourceId != null && !String.valueOf(resourceId).trim().isEmpty()) {
|
ids.add(String.valueOf(resourceId).trim());
|
}
|
}
|
}
|
} catch (RuntimeException ex) {
|
log.warn("[RELATED-SIGN-AUDIT] DMS permission affectedTargets parse failed clientEventId={}",
|
event.getClientEventId(), ex);
|
}
|
return new ArrayList<>(ids);
|
}
|
|
private static String normalizeRole(String role) {
|
if (isBlank(role)) {
|
return null;
|
}
|
String normalized = role.trim().toUpperCase(java.util.Locale.ROOT);
|
if (!PRIMARY.equals(normalized) && !REVIEW.equals(normalized)) {
|
throw new IllegalArgumentException("签名角色只允许 PRIMARY 或 REVIEW");
|
}
|
return normalized;
|
}
|
|
private static String value(String text) {
|
return text == null ? "" : text;
|
}
|
|
private static boolean isBlank(String text) {
|
return text == null || text.trim().isEmpty();
|
}
|
|
private static final class RelatedSign {
|
private final String signId;
|
private final String role;
|
|
private RelatedSign(String signId, String role) {
|
this.signId = signId;
|
this.role = role;
|
}
|
}
|
}
|
