数据开放平台架构设计（三）：鉴权与访问控制

@Component
public class AkSkAuthHandler {

    @Autowired
    private AppKeyService appKeyService;

    public AppInfo verify(HttpServletRequest request) {
        // 1. 提取请求头
        String ak = request.getHeader("X-Access-Key");
        String timestamp = request.getHeader("X-Timestamp");
        String nonce = request.getHeader("X-Nonce");
        String signature = request.getHeader("X-Signature");

        if (ak == null || timestamp == null || nonce == null || signature == null) {
            throw new AuthException("缺少认证参数");
        }

        // 2. 校验时间戳（5 分钟内有效，防重放）
        long reqTime = Long.parseLong(timestamp);
        if (Math.abs(System.currentTimeMillis() / 1000 - reqTime) > 300) {
            throw new AuthException("请求已过期");
        }

        // 3. 校验 Nonce（防重放，Redis 存 5 分钟）
        String nonceKey = "auth:nonce:" + ak + ":" + nonce;
        if (Boolean.TRUE.equals(redisTemplate.hasKey(nonceKey))) {
            throw new AuthException("重复请求");
        }
        redisTemplate.opsForValue().set(nonceKey, "1", 5, TimeUnit.MINUTES);

        // 4. 查 SK
        AppInfo app = appKeyService.getByAccessKey(ak);
        if (app == null) {
            throw new AuthException("无效的 Access Key");
        }

        // 5. 重新计算签名并比对
        String expected = computeSignature(request, app.getSecretKey());
        if (!expected.equals(signature)) {
            throw new AuthException("签名验证失败");
        }

        return app;
    }

    private String computeSignature(HttpServletRequest request, String sk) {
        String method = request.getMethod();
        String uri = request.getRequestURI();
        String queryString = buildSortedQueryString(request);
        String timestamp = request.getHeader("X-Timestamp");
        String nonce = request.getHeader("X-Nonce");

        String stringToSign = method + "\n" + uri + "\n"
            + queryString + "\n" + timestamp + "\n" + nonce;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(sk.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(hash);
    }
}

@Component
public class TenantIsolationHandler {

    public ParsedSql injectTenantCondition(ParsedSql parsed, String tenantId) {
        String sql = parsed.getSql();
        List<Object> args = new ArrayList<>(Arrays.asList(parsed.getArgs()));

        // 在 WHERE 后面自动加上 tenant_id 条件
        String tenantCondition = "tenant_id = ?";
        args.add(tenantId);

        // 找到 WHERE 位置插入条件
        int whereIdx = sql.toUpperCase().indexOf("WHERE");
        if (whereIdx >= 0) {
            sql = sql.substring(0, whereIdx + 5) + " " + tenantCondition + " AND "
                + sql.substring(whereIdx + 5);
        } else {
            // 没有 WHERE，加一个
            int orderByIdx = sql.toUpperCase().indexOf("ORDER BY");
            if (orderByIdx >= 0) {
                sql = sql.substring(0, orderByIdx) + "WHERE "
                    + tenantCondition + " " + sql.substring(orderByIdx);
            } else {
                sql += " WHERE " + tenantCondition;
            }
        }

        return new ParsedSql(sql, args.toArray());
    }
}

@Component
public class FlowControlService {

    // 每个 appKey 一个独立的限流器
    private final Map<String, RateLimiter> limiterMap = new ConcurrentHashMap<>();

    /**
     * 检查是否超限，超限直接拒绝
     */
    public void checkLimit(String appKey) {
        FlowConfig config = getFlowConfig(appKey);
        RateLimiter limiter = limiterMap.computeIfAbsent(appKey,
            k -> RateLimiter.create(config.getQps()));

        if (!limiter.tryAcquire()) {
            throw new FlowLimitException(
                String.format("调用频率超限，当前限制 %d QPS", config.getQps()));
        }
    }

    /**
     * 获取限流配置，支持动态调整
     */
    private FlowConfig getFlowConfig(String appKey) {
        // 优先读 Redis 缓存，支持运行时动态调整
        String cacheKey = "flow:config:" + appKey;
        FlowConfig config = redisTemplate.opsForValue().get(cacheKey);
        if (config == null) {
            config = flowConfigMapper.selectByAppKey(appKey);
            if (config == null) {
                config = FlowConfig.builder().qps(100).build(); // 默认 100 QPS
            }
            redisTemplate.opsForValue().set(cacheKey, config, 5, TimeUnit.MINUTES);
        }
        return config;
    }
}

@Component
public class QuotaService {

    public void checkQuota(String appKey, String apiId) {
        QuotaConfig config = getQuotaConfig(appKey, apiId);

        // 日配额
        String dailyKey = "quota:daily:" + appKey + ":" + apiId;
        Long dailyCount = redisTemplate.opsForValue().increment(dailyKey);
        if (dailyCount == 1) {
            // 设置过期时间到当天结束
            redisTemplate.expire(dailyKey, getSecondsUntilMidnight(), TimeUnit.SECONDS);
        }
        if (dailyCount > config.getDailyLimit()) {
            throw new QuotaException("今日调用次数已用完，每日限额 "
                + config.getDailyLimit() + " 次");
        }

        // 月配额
        String monthlyKey = "quota:monthly:" + appKey + ":" + apiId;
        Long monthlyCount = redisTemplate.opsForValue().increment(monthlyKey);
        if (monthlyCount == 1) {
            redisTemplate.expire(monthlyKey, getSecondsUntilMonthEnd(), TimeUnit.SECONDS);
        }
        if (monthlyCount > config.getMonthlyLimit()) {
            throw new QuotaException("本月调用次数已用完，每月限额 "
                + config.getMonthlyLimit() + " 次");
        }
    }
}