wjh/IoT-OpenApi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 实现IP白名单严格拦截、三方Webhook多租户事件订阅与MCP专线业务调用

Browse Source
This commit is contained in:
wjh
2026-10-09 11:51:23 +08:00
parent c6bd736e7f
commit 00a9dcaf2f
11 changed files with 603 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/iot/gateway/oauth/OAuth2TokenController.java
+13 -2
View File
@@ -37,7 +37,8 @@ public class OAuth2TokenController {
@RequestParam(value = "client_id", required = false) String formClientId,
@RequestParam(value = "client_secret", required = false) String formClientSecret,
@RequestParam(value = "scope", required = false) String formScope,
@RequestBody(required = false) Map<String, String> jsonBody) {
@RequestBody(required = false) Map<String, String> jsonBody,
jakarta.servlet.http.HttpServletRequest request) {
String grantType = formGrantType != null ? formGrantType : (jsonBody != null ? jsonBody.get("grant_type") : null);
String clientId = formClientId != null ? formClientId : (jsonBody != null ? jsonBody.get("client_id") : null);
@@ -79,8 +80,18 @@ public class OAuth2TokenController {
return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
}
// 校验 IP 白名单
String clientIp = com.iot.gateway.common.IpUtils.getClientIp(request);
if (!com.iot.gateway.common.IpUtils.isAllowed(clientIp, client.getIpWhitelist())) {
log.warn("OAuth 2.0 客户端 IP 白名单拦截: clientId={}, clientIp={}, whitelist={}",
clientId, clientIp, client.getIpWhitelist());
error.put("error", "unauthorized_client");
error.put("error_description", "客户端来源 IP [" + clientIp + "] 不在允许的白名单范围内");
return ResponseEntity.status(HttpStatus.FORBIDDEN).body(error);
}
String accessToken = jwtTokenProvider.generateToken(client);
log.info("OAuth 2.0 成功颁发令牌: clientId={}, tenantId={}", clientId, client.getTenantId());
log.info("OAuth 2.0 成功颁发令牌: clientId={}, clientIp={}, tenantId={}", clientId, clientIp, client.getTenantId());
Map<String, Object> response = new HashMap<>();
response.put("access_token", accessToken);