package com.tcm.training.admin.app.auth.service;
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
import com.nimbusds.jose.JOSEException;
|
import com.nimbusds.jose.JWSAlgorithm;
|
import com.nimbusds.jose.crypto.RSASSAVerifier;
|
import com.nimbusds.jose.jwk.JWK;
|
import com.nimbusds.jose.jwk.JWKSet;
|
import com.nimbusds.jose.jwk.RSAKey;
|
import com.nimbusds.jwt.JWTClaimsSet;
|
import com.nimbusds.jwt.SignedJWT;
|
import com.tcm.training.admin.app.auth.config.AppAppleAuthProperties;
|
import com.tcm.training.admin.app.auth.dto.AppAppleLoginRequest;
|
import org.slf4j.Logger;
|
import org.slf4j.LoggerFactory;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.stereotype.Service;
|
import org.springframework.web.client.RestOperations;
|
import org.springframework.web.client.RestTemplate;
|
|
import java.text.ParseException;
|
import java.util.Date;
|
import java.util.List;
|
|
/**
|
* 苹果登录验签客户端，负责校验 identityToken 并提取最小身份标识。
|
*/
|
@Service
|
public class AppAppleAuthClient {
|
|
private static final Logger log = LoggerFactory.getLogger(AppAppleAuthClient.class);
|
|
private final AppAppleAuthProperties properties;
|
private final ObjectMapper objectMapper;
|
private final RestOperations restOperations;
|
|
/**
|
* 使用默认 HTTP 客户端构造苹果认证客户端。
|
*/
|
@Autowired
|
public AppAppleAuthClient(AppAppleAuthProperties properties, ObjectMapper objectMapper) {
|
this(properties, objectMapper, new RestTemplate());
|
}
|
|
/**
|
* 注入苹果配置、JSON 解析器与 HTTP 客户端。
|
*/
|
AppAppleAuthClient(AppAppleAuthProperties properties,
|
ObjectMapper objectMapper,
|
RestOperations restOperations) {
|
this.properties = properties;
|
this.objectMapper = objectMapper;
|
this.restOperations = restOperations;
|
}
|
|
/**
|
* 校验苹果 identityToken 并提取本地登录所需的最小身份资料。
|
*/
|
public AppAppleUserProfile resolveUserProfile(AppAppleLoginRequest request) {
|
if (request == null) {
|
throw new IllegalArgumentException("苹果授权信息不完整");
|
}
|
if (!properties.isConfigured()) {
|
throw new IllegalArgumentException("苹果登录暂未配置，请稍后重试");
|
}
|
|
String identityToken = trimToNull(request.getIdentityToken());
|
String userIdentifier = trimToNull(request.getUserIdentifier());
|
String authorizationCode = trimToNull(request.getAuthorizationCode());
|
if (identityToken == null) {
|
throw new IllegalArgumentException("苹果授权信息不完整");
|
}
|
|
SignedJWT signedJwt = parseSignedJwt(identityToken);
|
verifySignature(signedJwt);
|
JWTClaimsSet claimsSet = parseClaims(signedJwt);
|
validateClaims(claimsSet);
|
|
String subject = trimToNull(claimsSet.getSubject());
|
if (subject == null) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
if (userIdentifier != null && !userIdentifier.equals(subject)) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
|
AppAppleUserProfile profile = new AppAppleUserProfile();
|
profile.setSubject(subject);
|
profile.setUserIdentifier(userIdentifier == null ? subject : userIdentifier);
|
profile.setAuthorizationCode(authorizationCode);
|
return profile;
|
}
|
|
/**
|
* 解析苹果返回的 JWT。
|
*/
|
private SignedJWT parseSignedJwt(String identityToken) {
|
try {
|
return SignedJWT.parse(identityToken);
|
} catch (ParseException ex) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
}
|
|
/**
|
* 校验苹果 JWT 签名。
|
*/
|
private void verifySignature(SignedJWT signedJwt) {
|
try {
|
if (!JWSAlgorithm.RS256.equals(signedJwt.getHeader().getAlgorithm())) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
String keyId = trimToNull(signedJwt.getHeader().getKeyID());
|
if (keyId == null) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
RSAKey rsaKey = loadRsaKey(keyId);
|
if (!signedJwt.verify(new RSASSAVerifier(rsaKey.toRSAPublicKey()))) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
} catch (JOSEException ex) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
}
|
|
/**
|
* 读取并匹配苹果公钥。
|
*/
|
private RSAKey loadRsaKey(String keyId) {
|
JWKSet jwkSet = loadJwkSet();
|
List<JWK> keys = jwkSet.getKeys();
|
for (JWK key : keys) {
|
if (!(key instanceof RSAKey)) {
|
continue;
|
}
|
if (keyId.equals(key.getKeyID())) {
|
return (RSAKey) key;
|
}
|
}
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
|
/**
|
* 拉取苹果 JWKS 公钥集合。
|
*/
|
private JWKSet loadJwkSet() {
|
try {
|
String responseBody = restOperations.getForObject(properties.getJwksUrl(), String.class);
|
if (responseBody == null || responseBody.trim().isEmpty()) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
objectMapper.readTree(responseBody);
|
return JWKSet.parse(responseBody);
|
} catch (IllegalArgumentException ex) {
|
throw ex;
|
} catch (Exception ex) {
|
log.error("拉取苹果 JWKS 失败: url={}", properties.getJwksUrl(), ex);
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
}
|
|
/**
|
* 解析 JWT Claims。
|
*/
|
private JWTClaimsSet parseClaims(SignedJWT signedJwt) {
|
try {
|
return signedJwt.getJWTClaimsSet();
|
} catch (ParseException ex) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
}
|
|
/**
|
* 校验 JWT Claims 是否满足本系统登录要求。
|
*/
|
private void validateClaims(JWTClaimsSet claimsSet) {
|
String issuer = trimToNull(claimsSet.getIssuer());
|
if (!properties.getIssuer().equals(issuer)) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
String audience = resolveAudience(claimsSet.getAudience());
|
if (!properties.getClientId().equals(audience)) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
Date expireAt = claimsSet.getExpirationTime();
|
if (expireAt == null || expireAt.before(new Date())) {
|
throw new IllegalArgumentException("苹果登录授权失败");
|
}
|
}
|
|
/**
|
* 读取 audience，当前仅接受单值 clientId。
|
*/
|
private String resolveAudience(List<String> audienceList) {
|
if (audienceList == null || audienceList.isEmpty()) {
|
return null;
|
}
|
return trimToNull(audienceList.get(0));
|
}
|
|
/**
|
* 将空白字符串归一化为 null。
|
*/
|
private String trimToNull(String value) {
|
if (value == null) {
|
return null;
|
}
|
String trimmed = value.trim();
|
return trimmed.isEmpty() ? null : trimmed;
|
}
|
}
|
