From 2c92b9e6411519e0aec68142f65371bff51cea52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=A7=A6=E9=B8=BF=E5=B1=95?= <18031053041@163.com>
Date: Fri, 8 May 2026 11:38:38 +0800
Subject: [PATCH] =?UTF-8?q?BIToken=E8=AE=A4=E8=AF=81=E4=BF=AE=E6=94=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
.../com/mhd/bi/config/BiAccessProperties.java | 18 ++++++
.../config/BiReportAccessConfiguration.java | 25 ++++++++
.../bi/config/BiReportAccessTokenFilter.java | 60 +++++++++++++++++++
.../biReport/support/BiSnapshotDelFlag.java | 18 ++++++
.../facadeApi/biReport/BiReportApi.java | 2 +-
mhd-bi/src/main/resources/bootstrap.yml | 6 ++
6 files changed, 128 insertions(+), 1 deletion(-)
create mode 100644 mhd-bi/src/main/java/com/mhd/bi/config/BiAccessProperties.java
create mode 100644 mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessConfiguration.java
create mode 100644 mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessTokenFilter.java
create mode 100644 mhd-bi/src/main/java/com/mhd/bi/domain/biReport/support/BiSnapshotDelFlag.java
diff --git a/mhd-bi/src/main/java/com/mhd/bi/config/BiAccessProperties.java b/mhd-bi/src/main/java/com/mhd/bi/config/BiAccessProperties.java
new file mode 100644
index 000000000..e038e9aa5
--- /dev/null
+++ b/mhd-bi/src/main/java/com/mhd/bi/config/BiAccessProperties.java
@@ -0,0 +1,18 @@
+package com.mhd.bi.config;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+/**
+ * BI 开放接口访问控制（请求头 {@code X-BI-Access-Token}）。
+ * 配置了 {@code accessToken} 时必须与请求头完全一致；未配置时仅校验请求头非空。
+ */
+@Data
+@ConfigurationProperties(prefix = "mhd.bi")
+public class BiAccessProperties {
+
+ /**
+ * 与 X-BI-Access-Token 比对的密钥；为空则只要请求头非空即可
+ */
+ private String accessToken = "";
+}
diff --git a/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessConfiguration.java b/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessConfiguration.java
new file mode 100644
index 000000000..5f5cfb19d
--- /dev/null
+++ b/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessConfiguration.java
@@ -0,0 +1,25 @@
+package com.mhd.bi.config;
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+
+/**
+ * 注册 /biReport 路径的访问令牌校验
+ */
+@Configuration
+@EnableConfigurationProperties(BiAccessProperties.class)
+public class BiReportAccessConfiguration {
+
+ @Bean
+ public FilterRegistrationBean biReportAccessTokenFilter(BiAccessProperties properties) {
+ FilterRegistrationBean registration = new FilterRegistrationBean<>();
+ registration.setFilter(new BiReportAccessTokenFilter(properties));
+ registration.addUrlPatterns("/biReport/*");
+ registration.setOrder(Ordered.HIGHEST_PRECEDENCE + 100);
+ registration.setName("biReportAccessTokenFilter");
+ return registration;
+ }
+}
diff --git a/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessTokenFilter.java b/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessTokenFilter.java
new file mode 100644
index 000000000..de9cc6675
--- /dev/null
+++ b/mhd-bi/src/main/java/com/mhd/bi/config/BiReportAccessTokenFilter.java
@@ -0,0 +1,60 @@
+package com.mhd.bi.config;
+
+import org.springframework.lang.NonNull;
+import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+/**
+ * 限制 /biReport 下接口必须携带 {@code X-BI-Access-Token}，否则 401。
+ */
+public class BiReportAccessTokenFilter extends OncePerRequestFilter {
+
+ private static final String UNAUTHORIZED_MSG = "未认证，请提供有效的访问Token";
+
+ public static final String HEADER_X_BI_ACCESS_TOKEN = "X-BI-Access-Token";
+
+ private final BiAccessProperties accessProperties;
+
+ public BiReportAccessTokenFilter(BiAccessProperties accessProperties) {
+ this.accessProperties = accessProperties;
+ }
+
+ @Override
+ protected void doFilterInternal(@NonNull HttpServletRequest request,
+ @NonNull HttpServletResponse response,
+ @NonNull FilterChain filterChain) throws ServletException, IOException {
+ if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+ filterChain.doFilter(request, response);
+ return;
+ }
+
+ String presented = request.getHeader(HEADER_X_BI_ACCESS_TOKEN);
+ if (!StringUtils.hasText(presented)) {
+ writeUnauthorized(response);
+ return;
+ }
+
+ String expected = accessProperties.getAccessToken();
+ if (StringUtils.hasText(expected) && !expected.equals(presented)) {
+ writeUnauthorized(response);
+ return;
+ }
+
+ filterChain.doFilter(request, response);
+ }
+
+ private static void writeUnauthorized(HttpServletResponse response) throws IOException {
+ response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+ response.setCharacterEncoding(StandardCharsets.UTF_8.name());
+ response.setContentType("application/json;charset=UTF-8");
+ String body = "{\"code\":401,\"msg\":\"" + UNAUTHORIZED_MSG.replace("\"", "\\\"") + "\"}";
+ response.getOutputStream().write(body.getBytes(StandardCharsets.UTF_8));
+ }
+}
diff --git a/mhd-bi/src/main/java/com/mhd/bi/domain/biReport/support/BiSnapshotDelFlag.java b/mhd-bi/src/main/java/com/mhd/bi/domain/biReport/support/BiSnapshotDelFlag.java
new file mode 100644
index 000000000..2e6f83d1f
--- /dev/null
+++ b/mhd-bi/src/main/java/com/mhd/bi/domain/biReport/support/BiSnapshotDelFlag.java
@@ -0,0 +1,18 @@
+package com.mhd.bi.domain.biReport.support;
+
+/**
+ * BI 快照表 {@code DEL_FLAG} 取值（三张 *\_SNAPSHOT 表一致）。
+ * 查询接口仅返回 {@link #NORMAL}。
+ */
+public final class BiSnapshotDelFlag {
+
+ /** 无状态 */
+ public static final int NONE = 0;
+ /** 正常（接口查询可见） */
+ public static final int NORMAL = 1;
+ /** 已删除（逻辑删除，接口不返回） */
+ public static final int DELETED = 2;
+
+ private BiSnapshotDelFlag() {
+ }
+}
diff --git a/mhd-bi/src/main/java/com/mhd/bi/interfaces/facadeApi/biReport/BiReportApi.java b/mhd-bi/src/main/java/com/mhd/bi/interfaces/facadeApi/biReport/BiReportApi.java
index fafae14c3..753219b74 100644
--- a/mhd-bi/src/main/java/com/mhd/bi/interfaces/facadeApi/biReport/BiReportApi.java
+++ b/mhd-bi/src/main/java/com/mhd/bi/interfaces/facadeApi/biReport/BiReportApi.java
@@ -20,7 +20,7 @@ import org.springframework.web.bind.annotation.RestController;
/**
* BI 报表接口
*/
-@Api(tags = "BI报表")
+@Api(tags = "BI报表", description = "须在请求头携带 X-BI-Access-Token，与配置 mhd.bi.access-token 一致")
@Slf4j
@RestController
@RequestMapping("/biReport")
diff --git a/mhd-bi/src/main/resources/bootstrap.yml b/mhd-bi/src/main/resources/bootstrap.yml
index 83148b69b..0ae3bc43a 100644
--- a/mhd-bi/src/main/resources/bootstrap.yml
+++ b/mhd-bi/src/main/resources/bootstrap.yml
@@ -1,6 +1,12 @@
# Tomcat
server:
port: 8021
+
+# BI 报表开放接口（/biReport）：请求头 X-BI-Access-Token 须与 mhd.bi.access-token 一致
+mhd:
+ bi:
+ access-token: BI_TOKEN_8x7kL9mN2pQr5vWy3zA6cB
+
# Spring
spring:
application: