|
|
# PEVC Local Account Initialization Implementation Plan
|
|
|
|
|
|
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
|
|
|
|
|
**Goal:** 按 PEVC 的模式内置学生 `tzs001`，本地只保存其 BCrypt 密码哈希；SSO 只投影身份和角色，不再读取主平台密码。
|
|
|
|
|
|
**Architecture:** Flyway 迁移一次性插入用户 ID `487`、学生快照和 `STUDENT` 角色关联，密码列仅存 BCrypt 哈希。平台 SSO/CAS 继续验证并投影身份；新投影用户使用随机 BCrypt 密码，和 PEVC 的 SSO 自动建号保持一致。移除当前分支中为镜像主平台密码新增的凭据查询与初始化器。
|
|
|
|
|
|
**Tech Stack:** Java 17, Spring Boot, Spring Security `PasswordEncoder`, Flyway, MyBatis-Plus, JUnit 5.
|
|
|
|
|
|
## Global Constraints
|
|
|
|
|
|
- 不修改 `E:\javawork\tianze-pro` 主平台工程。
|
|
|
- 不读取、记录、返回或提交主平台密码明文。
|
|
|
- 仅保留 `TEACHER`、`STUDENT` 两个角色，用户/角色无 CRUD 接口。
|
|
|
- `tzs001` 固定使用平台用户 ID `487` 和 `STUDENT` 角色。
|
|
|
|
|
|
---
|
|
|
|
|
|
### Task 1: 移除密码镜像防腐接口
|
|
|
|
|
|
**Files:**
|
|
|
- Delete: `src/main/java/com/yau/digitalrmb/platformintegration/application/PlatformCredentialRepository.java`
|
|
|
- Delete: `src/main/java/com/yau/digitalrmb/platformintegration/domain/PlatformCredential.java`
|
|
|
- Delete: `src/main/java/com/yau/digitalrmb/identity/application/PlatformCredentialInitializer.java`
|
|
|
- Modify: `src/main/java/com/yau/digitalrmb/platformintegration/infrastructure/JdbcPlatformIdentityRepository.java`
|
|
|
- Modify: `src/main/java/com/yau/digitalrmb/identity/application/PlatformIdentityProjectionService.java`
|
|
|
- Modify: `src/main/java/com/yau/digitalrmb/platformintegration/interfaces/PlatformSsoController.java`
|
|
|
- Modify: `src/main/java/com/yau/digitalrmb/platformintegration/interfaces/CasAuthenticationController.java`
|
|
|
- Test: `src/test/java/com/yau/digitalrmb/identity/PlatformIdentityProjectionServiceTest.java`
|
|
|
|
|
|
**Interfaces:**
|
|
|
- Consumes: `PlatformIdentityProjectionService.project(PlatformActor)`.
|
|
|
- Produces: 所有 SSO/CAS 流程仅投影 `PlatformActor`，不包含密码对象或主平台密码查询。
|
|
|
|
|
|
- [ ] **Step 1: 写出失败测试，证明新投影用户拥有 BCrypt 格式的随机密码**
|
|
|
|
|
|
```java
|
|
|
projectionService.project(actor);
|
|
|
UserEntity user = userMapper.selectById(actor.platformUserId());
|
|
|
assertThat(user.getPasswordHash()).startsWith("$2");
|
|
|
assertThat(passwordEncoder.matches("unknown", user.getPasswordHash())).isFalse();
|
|
|
```
|
|
|
|
|
|
- [ ] **Step 2: 运行测试确认失败**
|
|
|
|
|
|
Run: `mvn -Dtest=PlatformIdentityProjectionServiceTest test -DforkCount=0 -B`
|
|
|
|
|
|
Expected: 旧实现写入 `{noop}EXTERNAL_SSO_ONLY`，断言失败。
|
|
|
|
|
|
- [ ] **Step 3: 最小化实现**
|
|
|
|
|
|
```java
|
|
|
private void projectUser(PlatformActor actor) {
|
|
|
UserEntity user = userMapper.selectById(actor.platformUserId());
|
|
|
if (user == null) {
|
|
|
user = new UserEntity();
|
|
|
user.setId(actor.platformUserId());
|
|
|
user.setUsername(actor.account());
|
|
|
user.setPasswordHash(passwordEncoder.encode(UUID.randomUUID().toString()));
|
|
|
user.setEnabled(true);
|
|
|
userMapper.insert(user);
|
|
|
return;
|
|
|
}
|
|
|
user.setUsername(actor.account());
|
|
|
user.setEnabled(true);
|
|
|
userMapper.updateById(user);
|
|
|
}
|
|
|
```
|
|
|
|
|
|
删除凭据类型、仓储、初始化器和所有 `findCredential` 调用；`JdbcPlatformIdentityRepository` 仅保留身份查询。
|
|
|
|
|
|
- [ ] **Step 4: 运行针对性测试**
|
|
|
|
|
|
Run: `mvn -Dtest=PlatformIdentityProjectionServiceTest,PlatformSsoControllerTest test -DforkCount=0 -B`
|
|
|
|
|
|
Expected: PASS.
|
|
|
|
|
|
- [ ] **Step 5: 提交**
|
|
|
|
|
|
```powershell
|
|
|
git add src/main/java src/test/java
|
|
|
git commit -m "refactor: align sso with pevc local accounts"
|
|
|
```
|
|
|
|
|
|
### Task 2: 以 Flyway 内置 tzs001 学生账号
|
|
|
|
|
|
**Files:**
|
|
|
- Create: `src/main/resources/db/migration/V3__seed_tzs001_local_student.sql`
|
|
|
- Test: `src/test/java/com/yau/digitalrmb/security/AuthControllerTest.java`
|
|
|
|
|
|
**Interfaces:**
|
|
|
- Consumes: `sys_user(id, username, password_hash)`, `platform_user_snapshot`, `sys_user_role` 和现有角色 ID `1002`。
|
|
|
- Produces: 迁移后本地 `POST /api/v1/auth/login` 能用 `tzs001` 和指定初始密码签发 JWT；`GET /api/v1/auth/me` 返回 `STUDENT`。
|
|
|
|
|
|
- [ ] **Step 1: 写出失败集成测试**
|
|
|
|
|
|
```java
|
|
|
mvc.perform(post("/api/v1/auth/login")
|
|
|
.contentType(MediaType.APPLICATION_JSON)
|
|
|
.content("{\"username\":\"tzs001\",\"password\":\"123qwe\"}"))
|
|
|
.andExpect(status().isOk())
|
|
|
.andExpect(jsonPath("$.data.accessToken").isNotEmpty());
|
|
|
```
|
|
|
|
|
|
移除测试 `@BeforeEach` 中的凭据投影，使测试只依赖迁移。
|
|
|
|
|
|
- [ ] **Step 2: 运行测试确认失败**
|
|
|
|
|
|
Run: `mvn -Dtest=AuthControllerTest test -DforkCount=0 -B`
|
|
|
|
|
|
Expected: 登录返回 401，因为 V3 迁移尚不存在。
|
|
|
|
|
|
- [ ] **Step 3: 添加仅含 BCrypt 哈希的迁移**
|
|
|
|
|
|
```sql
|
|
|
INSERT INTO sys_user (id, username, password_hash, enabled, created_at, updated_at, created_by, updated_by, deleted)
|
|
|
VALUES (487, 'tzs001', '$2a$10$ufcw5KFHtOmLzxAsV4C.MuIDOErMlw0iw5J5hc8OMzaTx0u9QYxG6', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, 'SYSTEM', 'SYSTEM', FALSE);
|
|
|
INSERT INTO platform_user_snapshot (platform_user_id, account, display_name, role_key, source_updated_at, synced_at)
|
|
|
VALUES (487, 'tzs001', 'tzs001', 'STUDENT', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP);
|
|
|
INSERT INTO sys_user_role (user_id, role_id) VALUES (487, 1002);
|
|
|
```
|
|
|
|
|
|
最终 SQL 和日志均不得包含明文密码。
|
|
|
|
|
|
- [ ] **Step 4: 运行集成测试**
|
|
|
|
|
|
Run: `mvn -Dtest=AuthControllerTest test -DforkCount=0 -B`
|
|
|
|
|
|
Expected: PASS，且 `/me` 角色为 `STUDENT`。
|
|
|
|
|
|
- [ ] **Step 5: 提交**
|
|
|
|
|
|
```powershell
|
|
|
git add src/main/resources/db/migration/V3__seed_tzs001_local_student.sql src/test/java/com/yau/digitalrmb/security/AuthControllerTest.java
|
|
|
git commit -m "feat: seed tzs001 local student account"
|
|
|
```
|
|
|
|
|
|
### Task 3: 清理配置、文档与回归验证
|
|
|
|
|
|
**Files:**
|
|
|
- Modify: `src/main/java/com/yau/digitalrmb/platformintegration/config/PlatformIntegrationProperties.java`
|
|
|
- Modify: `README.md`
|
|
|
- Modify: `docs/superpowers/specs/2026-08-03-platform-sso-readonly-design.md`
|
|
|
- Delete: `src/test/java/com/yau/digitalrmb/identity/PlatformCredentialInitializerTest.java`
|
|
|
- Modify: `src/test/java/com/yau/digitalrmb/platformintegration/infrastructure/JdbcPlatformIdentityRepositoryTest.java`
|
|
|
|
|
|
**Interfaces:**
|
|
|
- Consumes: PEVC 对 SSO 与迁移账号的职责分离。
|
|
|
- Produces: 无 `local-login`、`PlatformCredential` 或主平台密码查询的可部署后端。
|
|
|
|
|
|
- [ ] **Step 1: 写出仓储回归测试**
|
|
|
|
|
|
```java
|
|
|
assertThat(repository.findByPlatformUserId(101L)).contains(actor);
|
|
|
```
|
|
|
|
|
|
删除依赖 `core_user.PASSWORD` 的断言。
|
|
|
|
|
|
- [ ] **Step 2: 移除过时配置与文档描述**
|
|
|
|
|
|
删除 `PlatformIntegrationProperties.LocalLogin`、密码镜像叙述及其测试；文档改为“SSO 身份投影 + Flyway 内置本地账号”。
|
|
|
|
|
|
- [ ] **Step 3: 运行全量验证**
|
|
|
|
|
|
Run: `mvn test -DforkCount=0 -B`
|
|
|
|
|
|
Expected: 全部测试 PASS，0 failures，0 errors。
|
|
|
|
|
|
- [ ] **Step 4: 构建可执行包**
|
|
|
|
|
|
Run: `mvn package -DskipTests -B`
|
|
|
|
|
|
Expected: `target/digital-rmb-backend-0.1.0-SNAPSHOT.jar` 生成成功。
|
|
|
|
|
|
- [ ] **Step 5: 提交**
|
|
|
|
|
|
```powershell
|
|
|
git add README.md docs/superpowers/specs src/main/java src/test/java
|
|
|
git commit -m "docs: document pevc-style local login"
|
|
|
```
|