>() {
+ });
+ } catch (Exception e) {
+ return Map.of();
+ }
+ }
+}
diff --git a/backend-java/src/main/java/com/juzi/mvp/api/TaobaoEnvelope.java b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoEnvelope.java
new file mode 100644
index 0000000..2e7725a
--- /dev/null
+++ b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoEnvelope.java
@@ -0,0 +1,33 @@
+package com.juzi.mvp.api;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * 淘宝小程序客户端读取的 data 结构约定。
+ *
+ * 客户端（taobao/utils/api.js:13-16）只认 data.ok 和 data.http_status：
+ * HTTP 状态码永远是 200，逻辑状态（202/400/401/404/409/413/429）放在 data.http_status 里。
+ * 失败时 message 就是 toast 文案，status 401 还会触发客户端自动登出。
+ * 这与参考实现 h5/lib/taobao-routes.js:8 保持一致。
+ */
+public final class TaobaoEnvelope {
+
+ private TaobaoEnvelope() {
+ }
+
+ public static Map ok(int httpStatus) {
+ Map data = new LinkedHashMap<>();
+ data.put("ok", true);
+ data.put("http_status", httpStatus);
+ return data;
+ }
+
+ public static Map fail(int httpStatus, String message) {
+ Map data = new LinkedHashMap<>();
+ data.put("ok", false);
+ data.put("http_status", httpStatus);
+ data.put("message", message);
+ return data;
+ }
+}
diff --git a/backend-java/src/main/java/com/juzi/mvp/api/TaobaoForwardController.java b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoForwardController.java
new file mode 100644
index 0000000..f36d3c6
--- /dev/null
+++ b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoForwardController.java
@@ -0,0 +1,117 @@
+package com.juzi.mvp.api;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+
+/**
+ * taobao.mode=forward 时启用：把 /api/taobao/* 业务接口字节级转发给外层 H5 后端（Node）。
+ *
+ * 为什么必须字节级透传：对端用「原始 query string + 原始 body」验淘宝签名
+ * （h5/lib/taobao-auth.js:16-29）。Java 一旦重新序列化 JSON 或重排 query，
+ * 签名字节就变了，session 会直接 401。所以这里不读 body 语义、不动 JSON。
+ *
+ *
/ping、/whoami、/echo 仍然由 {@link MvpController} 自己处理（更具体的映射优先）。
+ */
+@RestController
+@ConditionalOnProperty(name = "taobao.mode", havingValue = "forward")
+public class TaobaoForwardController {
+
+ private static final Duration CONNECT_TIMEOUT = Duration.ofSeconds(3);
+
+ /** 云网关单请求 10 秒上限，留出余量。 */
+ private static final Duration REQUEST_TIMEOUT = Duration.ofSeconds(9);
+
+ private final HttpClient client = HttpClient.newBuilder()
+ .connectTimeout(CONNECT_TIMEOUT)
+ .followRedirects(HttpClient.Redirect.NEVER)
+ .build();
+
+ private final String forwardBase;
+
+ public TaobaoForwardController(@Value("${taobao.forward-base}") String forwardBase) {
+ this.forwardBase = forwardBase.endsWith("/")
+ ? forwardBase.substring(0, forwardBase.length() - 1)
+ : forwardBase;
+ }
+
+ @RequestMapping("/api/taobao/{*path}")
+ public ResponseEntity forward(HttpServletRequest request) {
+ byte[] body = readBody(request);
+ String target = forwardBase + request.getRequestURI()
+ + (request.getQueryString() == null ? "" : "?" + request.getQueryString());
+
+ HttpRequest.Builder builder = HttpRequest.newBuilder(URI.create(target))
+ .timeout(REQUEST_TIMEOUT)
+ .method(request.getMethod(), body.length == 0
+ ? HttpRequest.BodyPublishers.noBody()
+ : HttpRequest.BodyPublishers.ofByteArray(body));
+ copyHeader(request, builder, "Content-Type");
+ copyHeader(request, builder, "Authorization");
+
+ HttpResponse response;
+ try {
+ response = client.send(builder.build(), HttpResponse.BodyHandlers.ofByteArray());
+ } catch (IOException e) {
+ return envelope(502, "测肤服务连接失败");
+ } catch (InterruptedException e) {
+ Thread.currentThread().interrupt();
+ return envelope(502, "测肤服务被中断");
+ }
+
+ // 对端正常返回时已经是客户端要的信封（h5/lib/taobao-routes.js:8），原样回传。
+ if (looksLikeEnvelope(response.body())) {
+ return ResponseEntity.status(response.statusCode())
+ .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=UTF-8")
+ .header(HttpHeaders.CACHE_CONTROL, "no-store")
+ .body(response.body());
+ }
+ // 对端没部署 / 返回 404 页面 / 网关错误：包成统一信封，避免小程序 JSON.parse 失败。
+ return envelope(502, "测肤服务暂不可用（上游 " + response.statusCode() + "）");
+ }
+
+ private void copyHeader(HttpServletRequest request, HttpRequest.Builder builder, String name) {
+ String value = request.getHeader(name);
+ if (value != null && !value.isBlank()) {
+ builder.header(name, value);
+ }
+ }
+
+ private static byte[] readBody(HttpServletRequest request) {
+ try {
+ return request.getInputStream().readAllBytes();
+ } catch (IOException e) {
+ return new byte[0];
+ }
+ }
+
+ private static boolean looksLikeEnvelope(byte[] body) {
+ if (body == null || body.length == 0) {
+ return false;
+ }
+ String text = new String(body, StandardCharsets.UTF_8).stripLeading();
+ return text.startsWith("{") && text.contains("\"success\"");
+ }
+
+ private static ResponseEntity envelope(int status, String message) {
+ String json = "{\"success\":true,\"data\":{\"ok\":false,\"http_status\":" + status
+ + ",\"message\":\"" + message + "\"}}";
+ return ResponseEntity.status(200)
+ .header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=UTF-8")
+ .header(HttpHeaders.CACHE_CONTROL, "no-store")
+ .body(json.getBytes(StandardCharsets.UTF_8));
+ }
+}
diff --git a/backend-java/src/main/java/com/juzi/mvp/api/TaobaoSessionService.java b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoSessionService.java
new file mode 100644
index 0000000..22d990f
--- /dev/null
+++ b/backend-java/src/main/java/com/juzi/mvp/api/TaobaoSessionService.java
@@ -0,0 +1,154 @@
+package com.juzi.mvp.api;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.time.Instant;
+import java.util.HexFormat;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * 淘宝小程序会话：一次性的 challenge + 30 天有效的 Bearer token。
+ *
+ * 参考实现 h5/lib/taobao-session.js 的取值：challenge 60 秒、单次消费、
+ * 每来源 30 次/分钟；token 32 字节随机十六进制、有效期 30 天。
+ *
+ *
注意：全部状态都在进程内存里，SAE 只能单副本运行；多副本/发布不丢会话
+ * 需要换 Redis 或 RDS。这一点和现有 Node 实现一致，不是新增的退化。
+ */
+@Component
+public class TaobaoSessionService {
+
+ private static final long CHALLENGE_TTL_SECONDS = 60;
+ private static final long TOKEN_TTL_SECONDS = 30L * 24 * 60 * 60;
+ private static final int MAX_OUTSTANDING_CHALLENGES = 1000;
+ private static final int RATE_LIMIT_PER_MINUTE = 30;
+
+ private final SecureRandom random = new SecureRandom();
+ private final Map challenges = new ConcurrentHashMap<>();
+ private final Map sessions = new ConcurrentHashMap<>();
+ private final Map rates = new ConcurrentHashMap<>();
+
+ @Value("${taobao.app-key:}")
+ private String appKey;
+
+ private record Rate(Instant window, int count) {
+ }
+
+ public record Session(String userId, String openId, Instant expires) {
+ }
+
+ public record Token(String value, long expiresInSeconds, String userId) {
+ }
+
+ /**
+ * 限流计数用的来源标识。
+ *
+ * 云网关后面所有请求的来源 IP 都是同一个代理 IP，按 IP 计数会变成全站共享
+ * 30 次/分钟，所以在有 open_id 时优先按用户计数。
+ */
+ public String rateKey(HttpServletRequest request) {
+ String openId = request.getParameter("open_id");
+ return openId != null && !openId.isBlank() ? "open:" + openId : "ip:" + request.getRemoteAddr();
+ }
+
+ /**
+ * 发放一次性 challenge；超出频率或存量上限时返回 null（调用方回 429）。
+ */
+ public String challenge(String rateKey) {
+ sweep();
+ Instant now = Instant.now();
+ Rate rate = rates.compute(rateKey, (key, current) ->
+ current == null || !current.window().plusSeconds(CHALLENGE_TTL_SECONDS).isAfter(now)
+ ? new Rate(now, 1)
+ : new Rate(current.window(), current.count() + 1));
+ if (rate.count() > RATE_LIMIT_PER_MINUTE || challenges.size() >= MAX_OUTSTANDING_CHALLENGES) {
+ return null;
+ }
+ String id = randomHex(24);
+ challenges.put(id, now.plusSeconds(CHALLENGE_TTL_SECONDS));
+ return id;
+ }
+
+ /**
+ * 消费 challenge；remove 返回非空即视为抢到，天然只成功一次。
+ */
+ public boolean consume(String challenge) {
+ if (challenge == null || challenge.isBlank()) {
+ return false;
+ }
+ Instant expires = challenges.remove(challenge);
+ return expires != null && expires.isAfter(Instant.now());
+ }
+
+ public Token issue(String openId) {
+ String userId = userId(openId);
+ String value = randomHex(32);
+ sessions.put(value, new Session(userId, openId, Instant.now().plusSeconds(TOKEN_TTL_SECONDS)));
+ return new Token(value, TOKEN_TTL_SECONDS, userId);
+ }
+
+ public Session find(String token) {
+ if (token == null || token.isBlank()) {
+ return null;
+ }
+ Session session = sessions.get(token);
+ if (session == null) {
+ return null;
+ }
+ if (!session.expires().isAfter(Instant.now())) {
+ sessions.remove(token);
+ return null;
+ }
+ return session;
+ }
+
+ public void revoke(String token) {
+ if (token != null) {
+ sessions.remove(token);
+ }
+ }
+
+ /**
+ * 稳定的用户 id：sha256(app_key + ':' + open_id)，与 Node 端 provider_key 口径一致。
+ */
+ public String userId(String openId) {
+ try {
+ MessageDigest digest = MessageDigest.getInstance("SHA-256");
+ String seed = (appKey == null ? "" : appKey) + ":" + openId;
+ return HexFormat.of().formatHex(digest.digest(seed.getBytes(StandardCharsets.UTF_8)));
+ } catch (Exception e) {
+ throw new IllegalStateException("SHA-256 unavailable", e);
+ }
+ }
+
+ /** 从 Authorization: Bearer xxx 里取 token。 */
+ public static String bearerToken(HttpServletRequest request) {
+ String header = request.getHeader("Authorization");
+ if (header == null) {
+ return null;
+ }
+ String prefix = "Bearer ";
+ return header.regionMatches(true, 0, prefix, 0, prefix.length())
+ ? header.substring(prefix.length()).trim()
+ : null;
+ }
+
+ private void sweep() {
+ Instant now = Instant.now();
+ challenges.entrySet().removeIf(entry -> !entry.getValue().isAfter(now));
+ sessions.entrySet().removeIf(entry -> !entry.getValue().expires().isAfter(now));
+ rates.entrySet().removeIf(entry -> !entry.getValue().window().plusSeconds(CHALLENGE_TTL_SECONDS).isAfter(now));
+ }
+
+ private String randomHex(int bytes) {
+ byte[] buffer = new byte[bytes];
+ random.nextBytes(buffer);
+ return HexFormat.of().formatHex(buffer);
+ }
+}
diff --git a/backend-java/src/main/java/com/juzi/mvp/gateway/TaobaoSignatureVerifier.java b/backend-java/src/main/java/com/juzi/mvp/gateway/TaobaoSignatureVerifier.java
index 662b0c5..01b6f3f 100644
--- a/backend-java/src/main/java/com/juzi/mvp/gateway/TaobaoSignatureVerifier.java
+++ b/backend-java/src/main/java/com/juzi/mvp/gateway/TaobaoSignatureVerifier.java
@@ -90,8 +90,11 @@ public class TaobaoSignatureVerifier {
}
public static String sign(Map params, String body, String secret) throws Exception {
- String method = params.getOrDefault("sign_method", "");
- if (!Set.of("", "md5", "hmac", "hmac_md5", "hmac_sha256").contains(method)) {
+ // 真实网关请求不带 sign_method，缺省等价于 md5：
+ // MD5(secret + content + secret)。2026-11-01 用抓包参数离线复算确认。
+ String rawMethod = params.getOrDefault("sign_method", "");
+ String method = rawMethod.isEmpty() ? "md5" : rawMethod;
+ if (!Set.of("md5", "hmac", "hmac_md5", "hmac_sha256").contains(method)) {
return null;
}
@@ -109,7 +112,7 @@ public class TaobaoSignatureVerifier {
mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), algorithm));
return hex(mac.doFinal(content.toString().getBytes(StandardCharsets.UTF_8)));
}
- String plain = ("md5".equals(method) ? secret : "") + content + secret;
+ String plain = secret + content + secret;
return hex(MessageDigest.getInstance("MD5").digest(plain.getBytes(StandardCharsets.UTF_8)));
}
diff --git a/backend-java/src/main/resources/application.yml b/backend-java/src/main/resources/application.yml
index e054611..5e34f69 100644
--- a/backend-java/src/main/resources/application.yml
+++ b/backend-java/src/main/resources/application.yml
@@ -4,6 +4,8 @@ server:
spring:
application:
name: taobao-mvp-backend
+ profiles:
+ active: local
jackson:
time-zone: Asia/Shanghai
default-property-inclusion: non_null
@@ -18,6 +20,10 @@ management:
show-details: always
taobao:
+ # forward: /api/taobao/* 业务接口字节级透传给外层 H5 后端（Node），Java 只做网关适配层
+ # native: Java 自己实现（challenge/session/me/logout）；测肤接口尚未实现
+ mode: ${TAOBAO_MODE:native}
+ forward-base: ${TAOBAO_FORWARD_BASE:https://1me.xajuzi.com/state}
# 云端部署时通过 SAE 环境变量注入；本地留空即可。
app-key: ${TAOBAO_APP_KEY:}
app-secret: ${TAOBAO_APP_SECRET:}
diff --git a/backend-java/src/test/java/com/juzi/mvp/TaobaoAuthFlowTests.java b/backend-java/src/test/java/com/juzi/mvp/TaobaoAuthFlowTests.java
new file mode 100644
index 0000000..2c7e41f
--- /dev/null
+++ b/backend-java/src/test/java/com/juzi/mvp/TaobaoAuthFlowTests.java
@@ -0,0 +1,139 @@
+package com.juzi.mvp;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * 登录链路（challenge → session → me → logout）的端到端契约测试。
+ *
+ * 本地/测试环境 verify-sign=false，所以用 ?open_id= 模拟云网关注入的身份；
+ * 打开 verify-sign 后，同样的请求需要带正确的 sign。
+ */
+@SpringBootTest(
+ webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+ // 部署用的 application-local.yml 里写的是 mode: forward（生产走透传）。
+ // 这个用例测的是 Java 自己实现登录的那条路，所以显式钉住 native。
+ properties = "taobao.mode=native")
+class TaobaoAuthFlowTests {
+
+ private static final String GATEWAY_QUERY =
+ "?app_key=35486228&open_id=AAG8-test-open-id&sign_method=hmac_sha256";
+
+ @LocalServerPort
+ private int port;
+
+ @Autowired
+ private TestRestTemplate rest;
+
+ private String url(String path) {
+ return "http://127.0.0.1:" + port + path;
+ }
+
+ private HttpEntity json(String body) {
+ HttpHeaders headers = new HttpHeaders();
+ headers.setContentType(MediaType.APPLICATION_JSON);
+ return new HttpEntity<>(body, headers);
+ }
+
+ private HttpEntity json(String body, String token) {
+ HttpHeaders headers = new HttpHeaders();
+ headers.setContentType(MediaType.APPLICATION_JSON);
+ if (token != null) {
+ headers.set("Authorization", "Bearer " + token);
+ }
+ return new HttpEntity<>(body, headers);
+ }
+
+ @SuppressWarnings("unchecked")
+ private Map data(ResponseEntity