feat: 登录信息加密传输

easyflow-commons/easyflow-common-captcha/src/main/java/tech/easyflow/common/captcha/tainai/CaptchaMvcConfig.java

@@ -1,6 +1,5 @@
 package tech.easyflow.common.captcha.tainai;
 
-import jakarta.annotation.Resource;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -8,14 +7,13 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @Configuration
 public class CaptchaMvcConfig implements WebMvcConfigurer {
 
-    @Resource
-    private CaptchaValidInterceptor interceptor;
-
+    /**
+     * 加密登录请求在控制器解密后校验验证码，避免明文 token 出现在请求体顶层。
+     *
+     * @param registry 拦截器注册器
+     */
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(interceptor)
-                .order(1)
-                .addPathPatterns("/api/v1/auth/login")
-                .addPathPatterns("/userCenter/auth/login");
+        // 保留扩展点，当前登录验证码校验由 AuthController / UcAuthController 在解密后完成。
     }
 }

easyflow-commons/easyflow-common-captcha/src/main/java/tech/easyflow/common/captcha/tainai/CaptchaValidInterceptor.java

@@ -1,14 +1,11 @@
 package tech.easyflow.common.captcha.tainai;
 
-import cloud.tianai.captcha.application.ImageCaptchaApplication;
-import cloud.tianai.captcha.spring.plugins.secondary.SecondaryVerificationApplication;
 import com.alibaba.fastjson.JSONObject;
 import jakarta.annotation.Resource;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Component;
 import org.springframework.web.servlet.HandlerInterceptor;
-import tech.easyflow.common.domain.Result;
 import tech.easyflow.common.util.RequestUtil;
 import tech.easyflow.common.util.ResponseUtil;
 
@@ -16,26 +13,20 @@ import tech.easyflow.common.util.ResponseUtil;
 public class CaptchaValidInterceptor implements HandlerInterceptor {
 
     @Resource
-    private ImageCaptchaApplication application;
+    private CaptchaVerificationService captchaVerificationService;
 
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
         JSONObject jsonObject = (JSONObject) RequestUtil.readJsonObjectOrArray(request);
         String validToken = jsonObject.getString("validToken");
-        if (validToken == null || validToken.isEmpty()) {
-            renderNotLogin(response);
-            return false;
-        }
-        boolean valid = ((SecondaryVerificationApplication) application).secondaryVerification(validToken);
-        if (!valid) {
+        if (!captchaVerificationService.verify(validToken)) {
             renderNotLogin(response);
             return false;
         }
         return true;
     }
 
-    private static void renderNotLogin(HttpServletResponse response) {
-        Result result = Result.fail(99, "验证失败，请重试！");
-        ResponseUtil.renderJson(response, result);
+    private void renderNotLogin(HttpServletResponse response) {
+        ResponseUtil.renderJson(response, captchaVerificationService.failureResult());
     }
 }

easyflow-commons/easyflow-common-captcha/src/main/java/tech/easyflow/common/captcha/tainai/CaptchaVerificationService.java

@@ -0,0 +1,54 @@
+package tech.easyflow.common.captcha.tainai;
+
+import cloud.tianai.captcha.application.ImageCaptchaApplication;
+import cloud.tianai.captcha.spring.plugins.secondary.SecondaryVerificationApplication;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+import tech.easyflow.common.domain.Result;
+
+/**
+ * 验证码二次校验服务。
+ */
+@Service
+public class CaptchaVerificationService {
+
+    /**
+     * 验证码失败业务码。
+     */
+    public static final int CAPTCHA_ERROR_CODE = 99;
+
+    /**
+     * 验证码失败提示。
+     */
+    public static final String CAPTCHA_ERROR_MESSAGE = "验证失败，请重试！";
+
+    @Resource
+    private ImageCaptchaApplication application;
+
+    /**
+     * 校验验证码二次验证令牌。
+     *
+     * @param validToken 二次验证令牌
+     * @return 是否校验通过
+     */
+    public boolean verify(String validToken) {
+        if (!StringUtils.hasText(validToken)) {
+            return false;
+        }
+        return ((SecondaryVerificationApplication) application).secondaryVerification(validToken);
+    }
+
+    /**
+     * 构造验证码失败响应。
+     *
+     * @param <T> 响应数据类型
+     * @return 统一失败响应
+     */
+    public <T> Result<T> failureResult() {
+        Result<T> result = new Result<>();
+        result.setErrorCode(CAPTCHA_ERROR_CODE);
+        result.setMessage(CAPTCHA_ERROR_MESSAGE);
+        return result;
+    }
+}