Gateway：路由、认证与接口保护

<dependency>
    <groupId>dev.macula.boot</groupId>
    <artifactId>macula-boot-starter-cloud-alibaba-scg</artifactId>
</dependency>

<dependency>
    <groupId>dev.macula.boot</groupId>
    <artifactId>macula-boot-starter-cloud-tencent-scg</artifactId>
</dependency>

server:
  port: ${GATEWAY_PORT:8080}
spring:
  application:
    name: ${APP_NAME:application-gateway}
  data:
    redis:
      host: ${REDIS_HOST:127.0.0.1}
      port: ${REDIS_PORT:6379}
      password: ${REDIS_PASSWORD:}
  cloud:
    gateway:
      server:
        webflux:
          routes:
            - id: business-api
              uri: lb://business-service
              predicates:
                - Path=/api/**
              filters:
                - StripPrefix=1
            - id: business-websocket
              uri: lb:ws://message-service
              predicates:
                - Path=/ws/**
              filters:
                - StripPrefix=1
  security:
    oauth2:
      resourceserver:
        opaquetoken:
          client-id: ${IAM_CLIENT_ID}
          client-secret: ${IAM_CLIENT_SECRET}
          introspection-uri: ${IAM_INTROSPECTION_URI}
  reactor:
    context-propagation: auto

macula:
  gateway:
    sign-switch: true
    crypto-switch: true
    force-sign: true
    force-crypto: true
    protect-urls:
      sign:
        - /api/**
      crypto:
        - /api/**

macula:
  gateway:
    security:
      ignore-urls: []
      only-auth-urls: []
      default-url-require-check: true

Authorization: hmac username="<AK>", algorithm="hmac-sha256", signature="<Base64签名>"
Date: <当前请求的 HTTP-date>

Authorization: Bearer sk-<平台签发的APIKey>

macula:
  gateway:
    apikey:
      enabled: true

Authorization: Bearer <网关签发的JWT>

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: ${GATEWAY_JWK_SET_URI}

public interface CryptoService {
    String getSm2PublicKey();
    String decryptSm4Key(String key);
    String encrypt(String plainText, String sm4Key);
    String decrypt(String secretText, String sm4Key);
}

import cn.hutool.core.util.HexUtil;
import cn.hutool.crypto.SecureUtil;
import cn.hutool.crypto.SmUtil;
import cn.hutool.crypto.asymmetric.KeyType;
import cn.hutool.crypto.asymmetric.SM2;
import dev.macula.boot.starter.cloud.gateway.crypto.CryptoService;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.stereotype.Component;

import java.security.KeyPair;

/**
 * {@code LocalCryptoService} 本地加解密服务
 *
 * @author rain
 * @since 5.0.0
 */
@Component
public class LocalCryptoService implements CryptoService, InitializingBean {
    private SM2 sm2;

    @Override
    public String getSm2PublicKey() {
        return HexUtil.encodeHexStr(sm2.getQ(false));
    }

    @Override
    public String decryptSm4Key(String key) {
        // TODO 缓存解密过后的密钥
        return sm2.decryptStr(key, KeyType.PrivateKey);
    }

    @Override
    public String encrypt(String plainText, String sm4Key) {
        return SmUtil.sm4(HexUtil.decodeHex(sm4Key)).encryptBase64(plainText);
    }

    @Override
    public String decrypt(String secretText, String sm4Key) {
        return SmUtil.sm4(HexUtil.decodeHex(sm4Key)).decryptStr(secretText);
    }

    @Override
    public void afterPropertiesSet() {
        KeyPair pair = SecureUtil.generateKeyPair("SM2");
        sm2 = SmUtil.sm2(pair.getPrivate(), pair.getPublic());
    }
}

sm4-key: <SM2加密后的SM4密钥>
timestamp: <Unix毫秒时间戳>
nonce: <本次请求的唯一随机串>
algorithm: SHA-256
signature: <签名的十六进制字符串>

params = Query 按 key 排序，仅取每个 key 的第一个值，非空时用 & 连接 key=value
POST / PUT / PATCH 且请求体非空时：
  params = params + "SHA-256=" + lowercaseHex(SHA256(原始请求体字节))

plain = 原始请求路径 + params + 解密得到的SM4密钥字符串 + timestamp + nonce
signature = hex(Digest(algorithm, plain))

spring:
  data:
    redis:
      host: 127.0.0.1
      port: ${REDIS_PORT:6379}
      password: ${REDIS_PASSWORD:}
      system:
        host: ${SYSTEM_REDIS_HOST:127.0.0.1}
        port: ${SYSTEM_REDIS_PORT:6379}
        password: ${SYSTEM_REDIS_PASSWORD}

/**
 * {@code RedisConfiguration} Redis配置
 *
 * @author rain
 * @since 2023/4/21 11:50
 */
@Configuration
public class RedisConfiguration {
    @Bean
    @Primary
    @ConfigurationProperties(prefix = "spring.data.redis")
    public DataRedisProperties redisProperties() {
        return new DataRedisProperties();
    }

    @Bean
    @ConfigurationProperties(prefix = "spring.data.redis.system")
    public DataRedisProperties sysRedisProperties() {
        return new DataRedisProperties();
    }

    @Primary
    @Bean(destroyMethod = "shutdown")
    public RedissonClient redissonClient(ApplicationContext ctx, DataRedisProperties redisProperties) throws Exception {
        Config config = RedissonConfigBuilder.create().build(ctx, redisProperties, new RedissonProperties());
        return Redisson.create(config);
    }

    @Bean(destroyMethod = "shutdown")
    public RedissonClient sysRedissonClient(ApplicationContext ctx, DataRedisProperties sysRedisProperties)
        throws Exception {
        Config config = RedissonConfigBuilder.create().build(ctx, sysRedisProperties, new RedissonProperties());
        return Redisson.create(config);
    }

    @Bean(name = "sysRedisTemplate")
    public RedisTemplate<String, Object> sysRedisTemplate(
        @Qualifier("sysRedissonClient") RedissonClient sysRedissonClient) {
        //数据泛型类型
        RedisTemplate<String, Object> template = new RedisTemplate<>();
        //设置连接工厂（Jedis或Lettuce）
        template.setConnectionFactory(new RedissonConnectionFactory(sysRedissonClient));

        //设置key的序列化方式---String
        template.setKeySerializer(RedisSerializer.string());
        template.setHashKeySerializer(RedisSerializer.string());
        //初始化RedisTemplate的参数设置
        template.afterPropertiesSet();
        return template;
    }
}

POST /gateway/rm/opaqueToken
Authorization: hmac username="<AK>", algorithm="hmac-sha256", signature="<Base64签名>"
Date: <当前请求的HTTP-date>
Content-Type: application/json

{"token":"<需要清除网关缓存的外部Token>"}

macula:
  cloud:
    gray:
      enabled: true
  gateway:
    gray:
      enabled: true

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-gateway-server-webflux</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-loadbalancer</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

<dependency>
    <groupId>dev.macula.boot</groupId>
    <artifactId>macula-boot-starter-redis</artifactId>
</dependency>

<dependency>
    <groupId>dev.macula.boot</groupId>
    <artifactId>macula-boot-commons</artifactId>
</dependency>

<dependency>
    <groupId>com.nimbusds</groupId>
    <artifactId>oauth2-oidc-sdk</artifactId>
</dependency>

<dependency>
    <groupId>com.github.ben-manes.caffeine</groupId>
    <artifactId>caffeine</artifactId>
</dependency>

<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-tracing</artifactId>
</dependency>