diff --git a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignDemo.java b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignDemo.java index e4dde3bf..a3180938 100644 --- a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignDemo.java +++ b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignDemo.java @@ -1,10 +1,13 @@ package com.zdxt.enforcementcode.common.util; import cn.hutool.core.util.IdUtil; +import cn.hutool.crypto.SecureUtil; +import cn.hutool.crypto.asymmetric.KeyType; import cn.hutool.http.HttpRequest; import cn.hutool.http.HttpResponse; import com.alibaba.fastjson2.JSONObject; +import java.nio.charset.StandardCharsets; import java.util.HashMap; import java.util.Map; @@ -15,12 +18,23 @@ public class ApiSignDemo { private static final String BASE_URL = "http://localhost:8080"; + // 平台公钥：加密请求体 + private static final String PLATFORM_PUBLIC_KEY = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD4u2+dXNQvhTFDJNGvuz4TQAaVpg5Fse0YbPdHbDolpiglbDEuCfuhbekiJiB/9m3h1uArMvXHde26+F8SG2PFjljAmKFuMWkOwH6Zi5Ho7bGRr+nMFZfcEucZOcgb2yMV9RhDrPm5bGtOAgxCf33xKRH08fFzuhZ+T3DvSbpEwQIDAQAB"; + // 调用方私钥：解密响应体 + private static final String CALLER_PRIVATE_KEY = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAK6n1r9N+OSANSVfU6I89EJ+i+fJUNgB4sKdUh/79H/ks1d4gvhsdsytPDkFo27xCz6qw7OtXHJt9vK9KQ/gKMMC+uGoTOWnys8OOn9iGTwZ0DHmzMHrZi6aNZ5DDqO4GzNiro/2h+lZMTDMNTG8zGVuzyFPqQEv7XRq0CmEq76NAgMBAAECgYAaDIlQXgI9nkuO5+FS5LFvi201ZEas+NcHvKwHfi4QtxzyclRiVdcAHuRJAujFvqi1L4Xhsf0EShdXS9QofH/Hmtia7sSqDSzJ06jR4EDucJfUYKfHEcVBroRjjwgGwmtQ6IMp9lVqiqRQWvkwG9xyfPjbqNx/1NvuQ+Mc521kwQJBAOM/a1O9pKS8e/ZT3R2mtDliOuua0y7oT5gq9mqo6HBgDBY/whyxy0MJdnsuKRcgXxu3RBVjq6panNEex1r6D20CQQDEwPR3sRV2ECUQk6k+yDwD1QnkKAbROeGvcp4DSEJwLjNCUkUmL2eQECgFesSTlf1AbGC2NrOaI7L6QsXeklehAkAvXLlmw6C8ANipN0Nfea4YQ6PaFPOs1Bg6s8GV60w+l5YNUQ6I4nllqGQ8OhuwSTvpT+Htv084+xex8gNEr9dlAkBuReL+bm6j1Bqh9tCFkn4oe69mg5SGkVVPGwM6vbYW3531Dt0YsLrvgE6d+5fPS+I7yEJP/cqdmmKGZwQ1YXnhAkEAp6Vd2Q5OXdS/SUezCGf8xhb9SBaPQChgzfgC//N0iug+fDfaSnShHn0LKpBf7yEBvk0M4La7cqnyY233nYHTrQ=="; + public static void main(String[] args) throws Exception { System.out.println("========================================"); - System.out.println(" 模拟第三方请求 - 完整加签示例"); + System.out.println(" 模拟第三方请求 - 加签 + 加解密"); System.out.println("========================================\n"); - // ① 生成签名参数 + // ===================================================================== + // ① 加签：生成 HMAC-SHA256 签名 + // ===================================================================== + // timestamp: 毫秒级时间戳（13位），服务端校验与服务器时间差不超过配置阈值 + // nonce: 随机字符串，防止重放攻击 + // 签名原文: 将 appKey、timestamp、nonce 按 key 字母排序后拼接为 key=value&key=value 格式 + // 签名值: 使用 HmacSHA256 算法 + appSecret 对签名原文计算摘要，结果 Base64 编码 String timestamp = String.valueOf(System.currentTimeMillis()); String nonce = IdUtil.fastSimpleUUID(); @@ -29,7 +43,9 @@ public class ApiSignDemo { signParams.put("timestamp", timestamp); signParams.put("nonce", nonce); + // buildSignContent: TreeMap 排序 → 过滤空值 → 拼接 "appKey=xxx&nonce=xxx×tamp=xxx" String signContent = ApiSignUtil.buildSignContent(signParams); + // hmacSign: HmacSHA256(签名原文, appSecret) → Base64 编码 String sign = ApiSignUtil.hmacSign(signContent, APP_SECRET); System.out.println("【签名参数】"); @@ -40,29 +56,55 @@ public class ApiSignDemo { System.out.println(" Sign: " + sign); System.out.println(); - // ② 构建请求体 - JSONObject body = new JSONObject(); - body.put("planType", 1); - body.put("planDate", "2026-09-03"); - body.put("planTime", 1); - body.put("enforceContent", "日常环保执法检查0904"); - body.put("enterpriseName", "深新粤云（深圳）信息技术有限公司圳市XX科技有限公司"); - body.put("enterpriseNumber", "91440300769156389U"); - body.put("contactPerson", "张三"); - body.put("contactPhone", "13800138000"); - body.put("enforceUserNames", "测试1,测试2"); - body.put("enforceUserIds", "17608417058,17608416858"); - body.put("deptId", "20210922212955057-A601-27251E588"); - body.put("deptName", "深圳市司法局"); - body.put("createBy", "17608417058"); - body.put("remark", "测试数据"); - body.put("outSerialNo", "LG20260903001"); - - System.out.println("【请求体】"); - System.out.println(" " + body.toJSONString()); + // ===================================================================== + // ② 构建业务请求体（JSON 格式，与 Controller 的 @RequestBody Bo 类字段对应） + // ===================================================================== + String rawBody = """ + { + "planType": 1, + "planDate": "2026-09-03", + "planTime": 1, + "enforceContent": "日常环保执法检查0904", + "enterpriseName": "深新粤云（深圳）信息技术有限公司圳市XX科技有限公司", + "enterpriseNumber": "91440300769156389U", + "contactPerson": "张三", + "contactPhone": "13800138000", + "enforceUserNames": "测试1,测试2", + "enforceUserIds": "17608417058,17608416858", + "deptId": "20210922212955057-A601-27251E588", + "deptName": "深圳市司法局", + "createBy": "17608417058", + "remark": "测试数据", + "outSerialNo": "LG20260903001" + }"""; + + System.out.println("【原始请求体】"); + System.out.println(" " + rawBody); + System.out.println(); + + // ===================================================================== + // ③ 加密请求体：RSA 公钥加密（使用平台公钥，服务端用平台私钥解密） + // ===================================================================== + // 加密后的密文是 Base64 编码的字符串，不再是可读的 JSON + // 服务端 ApiCryptoFilter 会用 platformPrivateKey 解密还原为原始 JSON + String requestBody = ApiSignUtil.rsaEncrypt(rawBody, PLATFORM_PUBLIC_KEY); + System.out.println("【加密后请求体】"); + System.out.println(" " + requestBody.substring(0, Math.min(80, requestBody.length())) + "..."); System.out.println(); - // ③ 发起 HTTP 请求 + // ===================================================================== + // ④ 发起 HTTP POST 请求 + // ===================================================================== + // 请求头说明： + // App-Key: 应用标识，服务端通过它查 sys_api_platform_config 获取密钥和渠道信息 + // Timestamp: 毫秒级时间戳，服务端校验请求是否过期 + // Nonce: 随机串，防重放 + // Sign: HMAC-SHA256 签名值，服务端用 appSecret 验签 + // Encrypted: 标记请求体已加密，触发服务端 ApiCryptoFilter 解密逻辑 + // Content-Type: 固定为 application/json + // + // 服务端处理链路： + // ApiCryptoFilter(解密请求体) → ApiSignInterceptor(验签) → Controller(业务处理) String url = BASE_URL + "/external/api/lg/plan/saveOrUpdatePlan"; System.out.println("【发送请求】"); System.out.println(" URL: " + url); @@ -72,23 +114,34 @@ public class ApiSignDemo { .header("Timestamp", timestamp) .header("Nonce", nonce) .header("Sign", sign) + .header("Encrypted", "true") .header("Content-Type", "application/json;charset=UTF-8") - .body(body.toJSONString()) + .body(requestBody) .timeout(10000) .execute(); System.out.println(" 状态码: " + response.getStatus()); + System.out.println(" Encrypted: " + response.header("Encrypted")); System.out.println(); - // ④ 输出响应 + // ===================================================================== + // ⑤ 解密响应体：RSA 私钥解密（服务端用调用方公钥加密，调用方用自己的私钥解密） + // ===================================================================== + // 服务端 ApiCryptoFilter 处理完业务后，用 callerPublicKey 加密响应体 + // 调用方收到密文后，用 callerPrivateKey 解密还原为原始 JSON 响应 String responseBody = response.body(); - System.out.println("【响应结果】"); - try { - JSONObject json = JSONObject.parseObject(responseBody); - System.out.println(" " + json.toString()); - } catch (Exception e) { - System.out.println(" " + responseBody); - } + System.out.println("【加密响应】"); + System.out.println(" " + (responseBody.length() > 200 ? responseBody.substring(0, 200) + "..." : responseBody)); + System.out.println(); + + // SecureUtil.rsa(privateKey, null): 用调用方私钥构造 RSA 解密器 + // decryptStr: Base64 解码密文 → RSA 私钥解密 → UTF-8 字符串 + String decryptedResponse = SecureUtil.rsa(CALLER_PRIVATE_KEY, null) + .decryptStr(responseBody, KeyType.PrivateKey, StandardCharsets.UTF_8); + + System.out.println("【解密后响应】"); + JSONObject json = JSONObject.parseObject(decryptedResponse); + System.out.println(" " + json.toString()); response.close(); System.out.println(); diff --git a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignUtil.java b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignUtil.java index e096483b..f02b6b1e 100644 --- a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignUtil.java +++ b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/common/util/ApiSignUtil.java @@ -101,26 +101,29 @@ public class ApiSignUtil { String platformPublicKey = platformRsa.getPublicKeyBase64(); String platformPrivateKey = platformRsa.getPrivateKeyBase64(); - RSA callerRsa = SecureUtil.rsa(); - String callerPublicKey = callerRsa.getPublicKeyBase64(); - - String sql = "INSERT INTO sys_api_platform_config " + - "(channel_name, channel_no, app_key, app_secret, " + - "platform_public_key, platform_private_key, caller_public_key, " + - "sign_enabled, encrypt_enabled, status, create_time) VALUES (\n" + - " '龙岗', 'longgang', '" + appKey + "', '" + appSecret + "',\n" + - " '" + platformPublicKey + "',\n" + - " '" + platformPrivateKey + "',\n" + - " '" + callerPublicKey + "',\n" + - " 1, 0, '0', NOW()\n" + - ");"; - - System.out.println(sql); - System.out.println(); - System.out.println("=== 密钥信息(交给调用方) ==="); - System.out.println("app_key: " + appKey); - System.out.println("app_secret: " + appSecret + " (HMAC签名用)"); - System.out.println("platformPublicKey: " + platformPublicKey + " (加密请求用)"); + System.out.println("app_platformPublicKeykey: " + platformPublicKey); + System.out.println("platformPrivateKey: " + platformPrivateKey); +// +// RSA callerRsa = SecureUtil.rsa(); +// String callerPublicKey = callerRsa.getPublicKeyBase64(); +// +// String sql = "INSERT INTO sys_api_platform_config " + +// "(channel_name, channel_no, app_key, app_secret, " + +// "platform_public_key, platform_private_key, caller_public_key, " + +// "sign_enabled, encrypt_enabled, status, create_time) VALUES (\n" + +// " '龙岗', 'longgang', '" + appKey + "', '" + appSecret + "',\n" + +// " '" + platformPublicKey + "',\n" + +// " '" + platformPrivateKey + "',\n" + +// " '" + callerPublicKey + "',\n" + +// " 1, 0, '0', NOW()\n" + +// ");"; +// +// System.out.println(sql); +// System.out.println(); +// System.out.println("=== 密钥信息(交给调用方) ==="); +// System.out.println("app_key: " + appKey); +// System.out.println("app_secret: " + appSecret + " (HMAC签名用)"); +// System.out.println("platformPublicKey: " + platformPublicKey + " (加密请求用)"); }