网络请求通过 Retrofit 返回 Single，由基类 CompositeDisposable 托管，
+ * 页面销毁自动取消订阅。
+ */
+public class LoginViewModel extends BaseViewModel {
+
+ private final AuthRepository repository = new AuthRepository();
+
+ private final MutableLiveData 所有网络请求均走 Retrofit + RxJava3，由基类 CompositeDisposable 托管，
+ * Activity 销毁时自动取消，替代原先的 {@code new Thread} + {@code runOnUiThread} 写法。
+ */
public class MainViewModel extends BaseViewModel {
+
+ private final AuthRepository repository = new AuthRepository();
+
+ /** 刷新单飞标记，避免并发重复刷新令牌。 */
+ private final AtomicBoolean refreshInFlight = new AtomicBoolean(false);
+
+ /** 可用的 accessToken，用于建立 WebSocket。 */
+ private final MutableLiveData 校验本地令牌：已登录直接进入 {@link MainActivity}，否则进入 {@link LoginActivity}。
+ */
+public class SplashActivity extends BaseMvvmActivity 登录与刷新接口本身不需要（也不能）携带旧令牌，因此在此跳过。
+ */
+public class AuthInterceptor implements Interceptor {
+
+ @NonNull
+ @Override
+ public Response intercept(@NonNull Chain chain) throws IOException {
+ Request original = chain.request();
+ String path = original.url().encodedPath();
+
+ if (path.contains("/api/auth/login") || path.contains("/api/auth/refresh")) {
+ return chain.proceed(original);
+ }
+
+ String token = TokenStore.get().getAccessToken();
+ if (token == null || token.isEmpty()) {
+ return chain.proceed(original);
+ }
+
+ Request authorized = original.newBuilder()
+ .header("Authorization", "Bearer " + token)
+ .build();
+ return chain.proceed(authorized);
+ }
+}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/network/AuthRepository.java b/WebRTCController/app/src/main/java/com/ttstd/controller/network/AuthRepository.java
new file mode 100644
index 0000000..e1af40d
--- /dev/null
+++ b/WebRTCController/app/src/main/java/com/ttstd/controller/network/AuthRepository.java
@@ -0,0 +1,84 @@
+package com.ttstd.controller.network;
+
+import com.ttstd.controller.network.model.BindingsResponse;
+import com.ttstd.controller.network.model.LoginRequest;
+import com.ttstd.controller.network.model.RefreshRequest;
+import com.ttstd.controller.network.model.TokenResponse;
+import com.ttstd.controller.network.model.VerifyResponse;
+import com.ttstd.controller.utils.TokenStore;
+
+import io.reactivex.rxjava3.core.Single;
+import io.reactivex.rxjava3.schedulers.Schedulers;
+
+/**
+ * 用户端认证 / 会话仓库。
+ *
+ * 对外统一返回 {@code Single} 冷流并已切到 IO 线程，由 ViewModel 的
+ * CompositeDisposable 订阅，随生命周期自动取消。
+ */
+public class AuthRepository {
+
+ private final AuthApi authApi;
+ private final ClientApi clientApi;
+
+ public AuthRepository() {
+ this.authApi = RetrofitClient.authApi();
+ this.clientApi = RetrofitClient.clientApi();
+ }
+
+ /**
+ * 用户名密码登录，成功后自动持久化令牌。
+ */
+ public Single 令牌由 {@link AuthInterceptor} 统一注入 Authorization 头，此处无需声明。
+ */
+public interface ClientApi {
+
+ /** 校验当前令牌是否有效，用于启动页判断登录态。 */
+ @GET("api/client/verify")
+ Single 统一注入 {@link AuthInterceptor} 携带 Bearer 令牌，并通过 RxJava3 适配器
+ * 返回 {@code Single} 冷流，便于在 ViewModel 中配合 CompositeDisposable 管理生命周期。
+ */
+public final class RetrofitClient {
+ /** 网络超时（秒）。 */
+ public static final long TIMEOUT_SECONDS = 15L;
+
+ private static volatile Retrofit retrofit;
+ private static volatile AuthApi authApi;
+ private static volatile ClientApi clientApi;
+
+ private RetrofitClient() {
+ }
+
+ private static Retrofit retrofit() {
+ if (retrofit == null) {
+ synchronized (RetrofitClient.class) {
+ if (retrofit == null) {
+ retrofit = build();
+ }
+ }
+ }
+ return retrofit;
+ }
+
+ private static Retrofit build() {
+ HttpLoggingInterceptor logging = new HttpLoggingInterceptor();
+ logging.setLevel(HttpLoggingInterceptor.Level.BODY);
+
+ OkHttpClient okHttpClient = new OkHttpClient.Builder()
+ .connectTimeout(TIMEOUT_SECONDS, TimeUnit.SECONDS)
+ .readTimeout(TIMEOUT_SECONDS, TimeUnit.SECONDS)
+ .writeTimeout(TIMEOUT_SECONDS, TimeUnit.SECONDS)
+ .retryOnConnectionFailure(true)
+ .addInterceptor(new AuthInterceptor())
+ .addInterceptor(logging)
+ .build();
+
+ return new Retrofit.Builder()
+ .baseUrl(BuildConfig.API_BASE)
+ .client(okHttpClient)
+ .addConverterFactory(GsonConverterFactory.create())
+ .addCallAdapterFactory(RxJava3CallAdapterFactory.create())
+ .build();
+ }
+
+ public static AuthApi authApi() {
+ if (authApi == null) {
+ synchronized (RetrofitClient.class) {
+ if (authApi == null) {
+ authApi = retrofit().create(AuthApi.class);
+ }
+ }
+ }
+ return authApi;
+ }
+
+ public static ClientApi clientApi() {
+ if (clientApi == null) {
+ synchronized (RetrofitClient.class) {
+ if (clientApi == null) {
+ clientApi = retrofit().create(ClientApi.class);
+ }
+ }
+ }
+ return clientApi;
+ }
+}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingItem.java b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingItem.java
new file mode 100644
index 0000000..6e423b8
--- /dev/null
+++ b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingItem.java
@@ -0,0 +1,60 @@
+package com.ttstd.controller.network.model;
+
+import com.google.gson.annotations.SerializedName;
+
+/** 绑定关系条目，对应服务端 {@code ClientController#bindingView}。 */
+public class BindingItem {
+
+ @SerializedName("bindingId")
+ private String bindingId;
+
+ /** 被控端设备唯一标识，即连接时的目标设备 ID。 */
+ @SerializedName("deviceUid")
+ private String deviceUid;
+
+ @SerializedName("userId")
+ private String userId;
+
+ /** OWNER / MEMBER。 */
+ @SerializedName("role")
+ private String role;
+
+ @SerializedName("alias")
+ private String alias;
+
+ /** ACTIVE / REVOKED。 */
+ @SerializedName("status")
+ private String status;
+
+ public String getBindingId() {
+ return bindingId;
+ }
+
+ public String getDeviceUid() {
+ return deviceUid;
+ }
+
+ public String getUserId() {
+ return userId;
+ }
+
+ public String getRole() {
+ return role;
+ }
+
+ public String getAlias() {
+ return alias;
+ }
+
+ public String getStatus() {
+ return status;
+ }
+
+ /** 下拉展示文案：有别名时优先展示别名。 */
+ public String displayName() {
+ if (alias != null && !alias.trim().isEmpty()) {
+ return alias + " (" + deviceUid + ")";
+ }
+ return deviceUid;
+ }
+}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingsResponse.java b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingsResponse.java
new file mode 100644
index 0000000..64464fd
--- /dev/null
+++ b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/BindingsResponse.java
@@ -0,0 +1,17 @@
+package com.ttstd.controller.network.model;
+
+import com.google.gson.annotations.SerializedName;
+
+import java.util.Collections;
+import java.util.List;
+
+/** 已绑定设备列表响应，对应 {@code GET /api/client/bindings}。 */
+public class BindingsResponse {
+
+ @SerializedName("bindings")
+ private List 设备令牌场景 refreshToken 为 null；主控端（用户令牌）两者均会下发。
+ */
+public class TokenResponse {
+
+ @SerializedName("accessToken")
+ private String accessToken;
+
+ @SerializedName("refreshToken")
+ private String refreshToken;
+
+ /** access 令牌有效期（秒）。 */
+ @SerializedName("expiresIn")
+ private long expiresIn;
+
+ @SerializedName("sessionId")
+ private String sessionId;
+
+ /** 用户 ID。 */
+ @SerializedName("principalId")
+ private String principalId;
+
+ /** 展示名（一般为用户名）。 */
+ @SerializedName("displayName")
+ private String displayName;
+
+ public String getAccessToken() {
+ return accessToken;
+ }
+
+ public String getRefreshToken() {
+ return refreshToken;
+ }
+
+ public long getExpiresIn() {
+ return expiresIn;
+ }
+
+ public String getSessionId() {
+ return sessionId;
+ }
+
+ public String getPrincipalId() {
+ return principalId;
+ }
+
+ public String getDisplayName() {
+ return displayName;
+ }
+}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/VerifyResponse.java b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/VerifyResponse.java
new file mode 100644
index 0000000..9e4239f
--- /dev/null
+++ b/WebRTCController/app/src/main/java/com/ttstd/controller/network/model/VerifyResponse.java
@@ -0,0 +1,59 @@
+package com.ttstd.controller.network.model;
+
+import com.google.gson.annotations.SerializedName;
+
+/** 令牌校验响应，对应服务端 {@code GET /api/client/verify}。 */
+public class VerifyResponse {
+
+ @SerializedName("valid")
+ private boolean valid;
+
+ /** USER / DEVICE。 */
+ @SerializedName("principalType")
+ private String principalType;
+
+ @SerializedName("principalId")
+ private String principalId;
+
+ @SerializedName("displayName")
+ private String displayName;
+
+ /** 过期时间（秒级时间戳）。 */
+ @SerializedName("expiresAt")
+ private long expiresAt;
+
+ /** 剩余有效秒数。 */
+ @SerializedName("remainingSeconds")
+ private long remainingSeconds;
+
+ @SerializedName("message")
+ private String message;
+
+ public boolean isValid() {
+ return valid;
+ }
+
+ public String getPrincipalType() {
+ return principalType;
+ }
+
+ public String getPrincipalId() {
+ return principalId;
+ }
+
+ public String getDisplayName() {
+ return displayName;
+ }
+
+ public long getExpiresAt() {
+ return expiresAt;
+ }
+
+ public long getRemainingSeconds() {
+ return remainingSeconds;
+ }
+
+ public String getMessage() {
+ return message;
+ }
+}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/signaling/ApiClient.java b/WebRTCController/app/src/main/java/com/ttstd/controller/signaling/ApiClient.java
deleted file mode 100644
index da6aba2..0000000
--- a/WebRTCController/app/src/main/java/com/ttstd/controller/signaling/ApiClient.java
+++ /dev/null
@@ -1,117 +0,0 @@
-package com.ttstd.controller.signaling;
-
-import android.util.Log;
-
-import com.google.gson.Gson;
-import com.google.gson.JsonObject;
-import com.ttstd.controller.BuildConfig;
-
-import java.util.concurrent.TimeUnit;
-
-import okhttp3.MediaType;
-import okhttp3.OkHttpClient;
-import okhttp3.Request;
-import okhttp3.RequestBody;
-import okhttp3.Response;
-import okhttp3.ResponseBody;
-
-/**
- * 主控端 HTTP 客户端：对接安全信令服务器的账号体系与自助接口。
- *
- * - login(username,password) → accessToken + refreshToken（一次性，ses_ 前缀）；
- * - refresh(refreshToken) → 新 accessToken（服务端可能轮换 refreshToken）；
- * - verify() → 校验 accessToken 是否仍有效；
- * - bindings() → 本机可连接的被控端列表（仅已绑定设备）；
- * - turnCredentials() → TURN 短期凭证（服务端开启时返回 iceServers）。
- *
- * 刷新单飞锁由调用方（MainActivity）保证并发只触发一次。
- */
-public final class ApiClient {
-
- private static final String TAG = "ControllerApiClient";
- private static final MediaType JSON = MediaType.get("application/json; charset=utf-8");
-
- private final OkHttpClient http;
- private final Gson gson = new Gson();
-
- public ApiClient() {
- this.http = new OkHttpClient.Builder()
- .connectTimeout(15, TimeUnit.SECONDS)
- .readTimeout(15, TimeUnit.SECONDS)
- .build();
- }
-
- public static String apiBase() {
- return BuildConfig.API_BASE;
- }
-
- public JsonObject login(String username, String password) {
- JsonObject body = new JsonObject();
- body.addProperty("username", username);
- body.addProperty("password", password);
- return post("/api/auth/login", body, false, null);
- }
-
- public JsonObject register(String username, String password) {
- JsonObject body = new JsonObject();
- body.addProperty("username", username);
- body.addProperty("password", password);
- return post("/api/auth/register", body, false, null);
- }
-
- /** 刷新令牌。需带 refreshToken（作为 body）。 */
- public JsonObject refresh(String refreshToken) {
- JsonObject body = new JsonObject();
- body.addProperty("refreshToken", refreshToken);
- return post("/api/auth/refresh", body, false, null);
- }
-
- public JsonObject verify(String accessToken) {
- return get("/api/client/verify", accessToken);
- }
-
- public JsonObject bindings(String accessToken) {
- return get("/api/client/bindings", accessToken);
- }
-
- public JsonObject turnCredentials(String accessToken) {
- return get("/api/client/turn-credentials", accessToken);
- }
-
- private JsonObject post(String path, JsonObject body, boolean auth, String token) {
- Request.Builder b = new Request.Builder().url(apiBase() + path)
- .post(RequestBody.create(body.toString(), JSON));
- if (auth && token != null) b.addHeader("Authorization", "Bearer " + token);
- return call(b.build(), path);
- }
-
- private JsonObject get(String path, String token) {
- Request.Builder b = new Request.Builder().url(apiBase() + path).get();
- if (token != null) b.addHeader("Authorization", "Bearer " + token);
- return call(b.build(), path);
- }
-
- private JsonObject call(Request request, String step) {
- try (Response resp = http.newCall(request).execute()) {
- ResponseBody body = resp.body();
- String text = body != null ? body.string() : "";
- if (!resp.isSuccessful()) {
- throw new ApiException("HTTP " + resp.code() + " " + text, resp.code());
- }
- return gson.fromJson(text, JsonObject.class);
- } catch (Exception e) {
- Log.e(TAG, step + " 请求失败", e);
- if (e instanceof ApiException) throw (ApiException) e;
- throw new ApiException(e.getMessage(), -1);
- }
- }
-
- /** API 调用异常，携带 HTTP 状态码（401 表示令牌失效）。 */
- public static class ApiException extends RuntimeException {
- public final int httpCode;
- public ApiException(String msg, int code) {
- super(msg);
- this.httpCode = code;
- }
- }
-}
diff --git a/WebRTCController/app/src/main/java/com/ttstd/controller/utils/TokenStore.java b/WebRTCController/app/src/main/java/com/ttstd/controller/utils/TokenStore.java
index 422fae6..4fb5240 100644
--- a/WebRTCController/app/src/main/java/com/ttstd/controller/utils/TokenStore.java
+++ b/WebRTCController/app/src/main/java/com/ttstd/controller/utils/TokenStore.java
@@ -24,12 +24,34 @@ public final class TokenStore {
private static final String KEY_REFRESH = "refresh_token";
private static final String KEY_USERNAME = "username";
+ private static volatile TokenStore instance;
+
private final SharedPreferences sp;
public TokenStore(Context context) {
this.sp = create(context);
}
+ /**
+ * 在 {@code BaseApplication#onCreate} 中初始化一次，供拦截器与仓库层全局访问。
+ */
+ public static void init(Context context) {
+ if (instance == null) {
+ synchronized (TokenStore.class) {
+ if (instance == null) {
+ instance = new TokenStore(context.getApplicationContext());
+ }
+ }
+ }
+ }
+
+ public static TokenStore get() {
+ if (instance == null) {
+ throw new IllegalStateException("TokenStore 未初始化，请先在 Application 中调用 TokenStore.init()");
+ }
+ return instance;
+ }
+
private static SharedPreferences create(Context context) {
try {
MasterKey masterKey = new MasterKey.Builder(context)
diff --git a/WebRTCController/app/src/main/res/layout/activity_login.xml b/WebRTCController/app/src/main/res/layout/activity_login.xml
new file mode 100644
index 0000000..f155cf5
--- /dev/null
+++ b/WebRTCController/app/src/main/res/layout/activity_login.xml
@@ -0,0 +1,99 @@
+
+ 支持两种凭据，满足其一即可通过：
- * 过滤器顺序在 {@link BearerAuthFilter} 之后，以便读取其解析出的主体。
+ * 与主控端用户体系完全独立，使用 {@link AdminService} 专用令牌（前缀 admt_）。
+ * 仅对 {@code /api/admin/**} 生效；免鉴权路径（如登录、健康检查）统一由
+ * {@link PublicEndpoints} 管理。
*/
@Component
@Order(2)
public class AdminAuthFilter extends OncePerRequestFilter {
- @Value("${admin.token:webrtc-admin-token}")
- private String adminToken;
+ private final AdminService adminService;
+
+ public AdminAuthFilter(AdminService adminService) {
+ this.adminService = adminService;
+ }
+
+ private static final String PREFIX = "/api/admin/";
+
+ @Override
+ protected boolean shouldNotFilter(HttpServletRequest request) {
+ String path = request.getServletPath();
+ if (path == null || !path.startsWith(PREFIX)) {
+ return true;
+ }
+ // 免鉴权路径（由 PublicEndpoints 统一管理，例如登录接口）放行
+ return PublicEndpoints.isPublic(request);
+ }
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
- String uri = request.getRequestURI();
- if (!uri.startsWith("/api/admin")) {
- filterChain.doFilter(request, response);
+ String header = request.getHeader(HttpHeaders.AUTHORIZATION);
+ if (header == null || !header.startsWith("Bearer ")) {
+ writeUnauthorized(response, "缺少管理员令牌");
return;
}
- if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
- filterChain.doFilter(request, response);
- return;
- }
-
- if (hasValidAdminToken(request) || hasAdminPrincipal(request)) {
- filterChain.doFilter(request, response);
+ String token = header.substring("Bearer ".length()).trim();
+ if (token.isEmpty()) {
+ writeUnauthorized(response, "管理员令牌为空");
return;
}
+ try {
+ Map 所有免登录/免令牌的公开接口集中在此登记，避免各过滤器各自硬编码放行规则
+ * 导致遗漏或冲突（例如登录接口被误拦截返回 401）。
+ *
+ * 匹配规则：
+ * 旧版本曾存在独立的 {@code password_history} 表（含外键
+ * {@code fk_pwdhist_user} 指向 {@code app_user.user_id}）。当前代码已将其合并为
+ * {@code app_user.password_history} 字段，不再使用该表，但其外键会阻止 Hibernate
+ * 在 {@code ddl-auto: update} 下对 {@code app_user.user_id} 列做必要迁移，导致启动失败。
+ *
+ * 本组件在 JPA 执行 DDL 之前（仅依赖 DataSource，不依赖任何 JPA 组件）幂等删除该废弃表。
+ * 可通过 {@code security.schema.cleanup-enabled=false} 关闭。
+ */
+@Component
+@Order(0)
+@ConditionalOnProperty(name = "security.schema.cleanup-enabled", havingValue = "true", matchIfMissing = true)
+public class SchemaCleanup {
+
+ private static final Logger logger = LoggerFactory.getLogger(SchemaCleanup.class);
+
+ private final DataSource dataSource;
+
+ public SchemaCleanup(DataSource dataSource) {
+ this.dataSource = dataSource;
+ }
+
+ @PostConstruct
+ public void cleanup() {
+ try (Connection conn = dataSource.getConnection();
+ Statement stmt = conn.createStatement()) {
+ // 仅清理确已废弃、且代码无任何实体/Repository 引用的遗留表
+ stmt.execute("DROP TABLE IF EXISTS password_history");
+ logger.info("已清理废弃表 password_history（若存在）");
+ } catch (Exception e) {
+ // 清理失败不应阻断启动；记录告警，留给人工处理
+ logger.warn("清理废弃表 password_history 失败（可忽略，手动 DROP 亦可）: {}", e.toString());
+ }
+ }
+}
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/config/SecurityBeansConfig.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/config/SecurityBeansConfig.java
index 9958de7..817efee 100644
--- a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/config/SecurityBeansConfig.java
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/config/SecurityBeansConfig.java
@@ -2,8 +2,11 @@ package com.ttstd.signaling.config;
import com.ttstd.signaling.security.SecurityProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
/**
* 启用安全相关配置属性绑定与定时任务。
@@ -12,4 +15,13 @@ import org.springframework.scheduling.annotation.EnableScheduling;
@EnableConfigurationProperties(SecurityProperties.class)
@EnableScheduling
public class SecurityBeansConfig {
+
+ /**
+ * 全局密码编码器 Bean。供 AdminService（后台管理员）注入使用，
+ * 与 AccountService 内部使用的 BCrypt(strength=12) 保持一致。
+ */
+ @Bean
+ public PasswordEncoder passwordEncoder() {
+ return new BCryptPasswordEncoder(12);
+ }
}
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/controller/AdminController.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/controller/AdminController.java
index 39e309b..fab086c 100644
--- a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/controller/AdminController.java
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/controller/AdminController.java
@@ -4,15 +4,19 @@ import com.ttstd.signaling.manager.ConnectionRequestManager;
import com.ttstd.signaling.manager.SessionManager;
import com.ttstd.signaling.manager.SignalMetrics;
import com.ttstd.signaling.model.AbuseReport;
+import com.ttstd.signaling.model.AdminAccount;
import com.ttstd.signaling.model.DeviceAccount;
import com.ttstd.signaling.model.DeviceBinding;
import com.ttstd.signaling.model.DeviceInfo;
import com.ttstd.signaling.model.UserAccount;
import com.ttstd.signaling.service.AbuseReportService;
import com.ttstd.signaling.service.AccountService;
+import com.ttstd.signaling.service.AdminService;
import com.ttstd.signaling.service.AuditService;
import com.ttstd.signaling.service.BindingService;
import com.ttstd.signaling.service.DeviceIdentityService;
+import org.springframework.data.domain.Page;
+import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
@@ -30,7 +34,7 @@ import java.util.stream.Collectors;
/**
* 后台管理 REST 接口：为 WebRTCSignalServerWeb 提供服务器运行态查询。
- * 所有接口均以 {@code /api/admin} 为前缀，并由 {@link AdminAuthFilter} 统一鉴权。
+ * 所有接口均以 {@code /api/admin} 为前缀，并由 {@link AdminAuthFilter} 校验管理员令牌。
*/
@RestController
@RequestMapping("/api/admin")
@@ -44,6 +48,7 @@ public class AdminController {
private final AuditService auditService;
private final BindingService bindingService;
private final AbuseReportService abuseReportService;
+ private final AdminService adminService;
private final long startTime = System.currentTimeMillis();
public AdminController(SessionManager sessionManager,
@@ -53,7 +58,8 @@ public class AdminController {
DeviceIdentityService deviceIdentityService,
AuditService auditService,
BindingService bindingService,
- AbuseReportService abuseReportService) {
+ AbuseReportService abuseReportService,
+ AdminService adminService) {
this.sessionManager = sessionManager;
this.connectionRequestManager = connectionRequestManager;
this.metrics = metrics;
@@ -62,6 +68,7 @@ public class AdminController {
this.auditService = auditService;
this.bindingService = bindingService;
this.abuseReportService = abuseReportService;
+ this.adminService = adminService;
}
/** 仪表盘汇总数据：设备在线情况、待确认连接、流量指标与运行时长。 */
@@ -129,12 +136,158 @@ public class AdminController {
return data;
}
+ // ==================== 管理员登录 ====================
+
+ /**
+ * 后台管理员登录，签发独立的管理员令牌（前缀 admt_）。
+ * 该接口免鉴权；请求体：{@code {"username": "admin", "password": "***"}}。
+ */
+ @PostMapping("/login")
+ public Map 请求体：{@code {"username": "alice", "password": "***"}}
+ *
+ * 此处创建的是普通用户（app_user），与管理员（admin_account）完全隔离。
+ * 若需创建后台管理员，请调用 {@code POST /api/admin/admins}。
+ */
+ @PostMapping("/users")
+ public Map 记录登录、激活、封禁、踢线等安全敏感操作，用于事后追溯。
+ */
+@Entity
+@Table(name = "audit_log", indexes = {
+ @Index(name = "idx_audit_actor", columnList = "actor_id"),
+ @Index(name = "idx_audit_action", columnList = "action"),
+ @Index(name = "idx_audit_created", columnList = "created_at")
+})
+public class AuditLog {
+
+ @Id
+ @GeneratedValue(strategy = GenerationType.IDENTITY)
+ @Column(name = "id")
+ private Long id;
+
+ /** 主体类型：USER / DEVICE / ADMIN */
+ @Column(name = "actor_type", length = 16)
+ private String actorType;
+
+ @Column(name = "actor_id", length = 64)
+ private String actorId;
+
+ @Column(name = "action", length = 48, nullable = false)
+ private String action;
+
+ @Column(name = "target_id", length = 64)
+ private String targetId;
+
+ /** SUCCESS / FAILURE */
+ @Column(name = "result", length = 16)
+ private String result;
+
+ @Column(name = "ip", length = 64)
+ private String ip;
+
+ @Column(name = "detail", length = 512)
+ private String detail;
+
+ @Column(name = "created_at", nullable = false)
+ private Instant createdAt;
+
+ protected AuditLog() {
+ this.createdAt = Instant.now();
+ }
+
+ public AuditLog(String actorType, String actorId, String action,
+ String targetId, String result, String ip, String detail) {
+ this.actorType = actorType;
+ this.actorId = actorId;
+ this.action = action;
+ this.targetId = targetId;
+ this.result = result;
+ this.ip = ip;
+ this.detail = detail;
+ this.createdAt = Instant.now();
+ }
+
+ public Long getId() { return id; }
+ public String getActorType() { return actorType; }
+ public String getActorId() { return actorId; }
+ public String getAction() { return action; }
+ public String getTargetId() { return targetId; }
+ public String getResult() { return result; }
+ public String getIp() { return ip; }
+ public String getDetail() { return detail; }
+ public Instant getCreatedAt() { return createdAt; }
+}
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/AuthPrincipal.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/AuthPrincipal.java
index 81d80fc..2e37d73 100644
--- a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/AuthPrincipal.java
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/AuthPrincipal.java
@@ -9,7 +9,6 @@ package com.ttstd.signaling.model;
* @param deviceType 信令角色（CONTROLLER / CONTROLLED）
* @param sessionId 登录会话 ID，用于精准踢线
* @param displayName 展示名（用户名 / 设备型号），仅用于日志与管理后台
- * @param admin 是否为管理员账号
*/
public record AuthPrincipal(
PrincipalType principalType,
@@ -17,8 +16,7 @@ public record AuthPrincipal(
String deviceId,
DeviceType deviceType,
String sessionId,
- String displayName,
- boolean admin) {
+ String displayName) {
public boolean isUser() {
return principalType == PrincipalType.USER;
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/UserAccount.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/UserAccount.java
index 075f3a8..c697d6f 100644
--- a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/UserAccount.java
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/model/UserAccount.java
@@ -53,9 +53,6 @@ public class UserAccount {
@Column(name = "token_version", nullable = false)
private long tokenVersion = 1L;
- @Column(name = "is_admin", nullable = false)
- private boolean admin;
-
/** 连续登录失败次数与锁定截止时间，用于防爆破 */
@Column(name = "failed_attempts", nullable = false)
private int failedAttempts;
@@ -121,9 +118,6 @@ public class UserAccount {
public long getTokenVersion() { return tokenVersion; }
public void setTokenVersion(long tokenVersion) { this.tokenVersion = tokenVersion; }
- public boolean isAdmin() { return admin; }
- public void setAdmin(boolean admin) { this.admin = admin; }
-
public int getFailedAttempts() { return failedAttempts; }
public void setFailedAttempts(int failedAttempts) { this.failedAttempts = failedAttempts; }
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/repository/AdminAccountRepository.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/repository/AdminAccountRepository.java
new file mode 100644
index 0000000..92d3bd0
--- /dev/null
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/repository/AdminAccountRepository.java
@@ -0,0 +1,17 @@
+package com.ttstd.signaling.repository;
+
+import com.ttstd.signaling.model.AdminAccount;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import java.util.Optional;
+
+@Repository
+public interface AdminAccountRepository extends JpaRepository 注意：此处的账号是普通用户（写入 app_user），与管理员（写入 admin_account）完全隔离。
+ * 若需创建后台管理员，请使用 AdminService，而非此接口。
+ */
+ public UserAccount adminCreateUser(String username, String password) {
+ validateUsername(username);
+ validatePassword(password, username);
+ UserAccount account = createAccountInternal(username, password);
+ auditService.record("ADMIN", null, AuditService.ACTION_USER_CREATED, account.getUserId(),
+ AuditService.RESULT_SUCCESS, null,
+ "管理员创建账号: " + username);
+ return account;
+ }
+
+ /**
+ * 删除账号，同时吊销其全部会话。
+ */
+ public void deleteUser(String userId) {
+ UserAccount account = requireUser(userId);
+ revokeAllSessions(userId, "账号已被删除");
+ sessionStore.deleteByPrincipal(userId);
+ userStore.delete(userId);
+ logger.info("账号 {} ({}) 已被删除", account.getUsername(), userId);
+ auditService.record("ADMIN", null, AuditService.ACTION_USER_DELETED, userId,
+ AuditService.RESULT_SUCCESS, null, "删除账号: " + account.getUsername());
+ }
+
+ /**
+ * 管理员重置密码：无需原密码，成功后强制该账号全部会话下线。
+ */
+ public void adminResetPassword(String userId, String newPassword) {
+ UserAccount account = requireUser(userId);
+ validatePassword(newPassword, account.getUsername());
+ account.pushPasswordHistory(account.getPasswordHash());
+ account.setPasswordHash(passwordEncoder.encode(newPassword));
+ account.setPasswordChangedAt(Instant.now());
+ account.setFailedAttempts(0);
+ account.setLockedUntil(null);
+ userStore.save(account);
+ revokeAllSessions(userId, "密码已被管理员重置，请重新登录");
+ auditService.record("ADMIN", null, AuditService.ACTION_PASSWORD_CHANGED, userId,
+ AuditService.RESULT_SUCCESS, null, "管理员重置密码: " + account.getUsername());
+ }
+
// ==================== TOTP 双因子 ====================
/**
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/service/AdminService.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/service/AdminService.java
new file mode 100644
index 0000000..7494047
--- /dev/null
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/service/AdminService.java
@@ -0,0 +1,255 @@
+package com.ttstd.signaling.service;
+
+import com.ttstd.signaling.model.AccountStatus;
+import com.ttstd.signaling.model.AdminAccount;
+import com.ttstd.signaling.security.AuthException;
+import com.ttstd.signaling.security.JwtService;
+import com.ttstd.signaling.security.SecurityProperties;
+import com.ttstd.signaling.security.TokenUtils;
+import com.ttstd.signaling.store.AdminStore;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+/**
+ * 后台管理员服务：与 {@link AccountService}（主控端用户）完全独立。
+ *
+ * 记录登录、激活、封禁、踢线等安全敏感操作，用于事后追溯。
- * 当前为内存环形缓冲实现（保留最近 N 条），同时写入 SLF4J 便于落盘采集；
- * 后续可替换为写入 {@code audit_log} 表。
+ * 记录持久化到 {@code audit_log} 表，同时写入 SLF4J 便于日志采集。
*
- * 写入前会对敏感信息做脱敏，避免日志泄露凭据。
+ * 写入前会对敏感信息做脱敏与长度截断，避免日志泄露凭据。
*/
@Service
public class AuditService {
private static final Logger auditLogger = LoggerFactory.getLogger("AUDIT");
- private static final int MAX_ENTRIES = 5000;
+ private static final Logger logger = LoggerFactory.getLogger(AuditService.class);
/** 审计动作常量 */
public static final String ACTION_LOGIN = "LOGIN";
@@ -41,14 +42,21 @@ public class AuditService {
public static final String ACTION_BAN = "BAN";
public static final String ACTION_UNBAN = "UNBAN";
public static final String ACTION_KICK = "KICK";
+ public static final String ACTION_USER_CREATED = "USER_CREATED";
+ public static final String ACTION_USER_DELETED = "USER_DELETED";
public static final String ACTION_PROVISION = "DEVICE_PROVISION";
public static final String ACTION_DEVICE_TOKEN = "DEVICE_TOKEN";
public static final String ACTION_DEVICE_DISABLED = "DEVICE_DISABLED";
public static final String ACTION_DEVICE_ENABLED = "DEVICE_ENABLED";
+ public static final String ACTION_DEVICE_CREATED = "DEVICE_CREATED";
+ public static final String ACTION_DEVICE_DELETED = "DEVICE_DELETED";
+ public static final String ACTION_DEVICE_KICK = "DEVICE_KICK";
public static final String ACTION_BIND = "DEVICE_BIND";
public static final String ACTION_UNBIND = "DEVICE_UNBIND";
public static final String ACTION_BLACKLIST_ADD = "DEVICE_BLACKLIST_ADD";
public static final String ACTION_BLACKLIST_REMOVE = "DEVICE_BLACKLIST_REMOVE";
+ public static final String ACTION_ALLOWLIST_ADD = "DEVICE_ALLOWLIST_ADD";
+ public static final String ACTION_ALLOWLIST_REMOVE = "DEVICE_ALLOWLIST_REMOVE";
public static final String ACTION_OFFER_BLOCKED = "OFFER_BLOCKED";
public static final String ACTION_PAIRING_GENERATED = "PAIRING_GENERATED";
public static final String ACTION_PAIRING_REDEEMED = "PAIRING_REDEEMED";
@@ -57,7 +65,7 @@ public class AuditService {
public static final String RESULT_FAILURE = "FAILURE";
/**
- * 单条审计记录。
+ * 单条审计记录的对外视图。
*/
public record AuditEntry(
long id,
@@ -69,27 +77,55 @@ public class AuditService {
String ip,
String detail,
long timestamp) {
+
+ static AuditEntry from(AuditLog log) {
+ return new AuditEntry(
+ log.getId() == null ? 0L : log.getId(),
+ log.getActorType(),
+ log.getActorId(),
+ log.getAction(),
+ log.getTargetId(),
+ log.getResult(),
+ log.getIp(),
+ log.getDetail(),
+ log.getCreatedAt().toEpochMilli());
+ }
}
- private final Deque 使用独立事务，确保调用方业务回滚时审计记录仍然保留；
+ * 审计写库失败不得影响主流程，因此异常仅记录日志。
+ */
+ @Transactional(propagation = Propagation.REQUIRES_NEW)
public void record(String actorType, String actorId, String action,
String targetId, String result, String ip, String detail) {
- AuditEntry entry = new AuditEntry(
- sequence.incrementAndGet(),
- actorType, actorId, action, targetId, result, ip,
- truncate(detail),
- Instant.now().toEpochMilli());
-
- entries.addFirst(entry);
- // 环形缓冲：超出上限时丢弃最旧记录
- while (entries.size() > MAX_ENTRIES) {
- entries.pollLast();
- }
-
+ String safeDetail = truncate(detail);
auditLogger.info("actor={}:{} action={} target={} result={} ip={} detail={}",
- actorType, actorId, action, targetId, result, ip, entry.detail());
+ actorType, actorId, action, targetId, result, ip, safeDetail);
+ try {
+ if (repository != null) {
+ repository.save(new AuditLog(actorType, actorId, action, targetId, result, ip, safeDetail));
+ }
+ } catch (RuntimeException e) {
+ logger.warn("审计日志写入失败: action={} actor={} 原因={}", action, actorId, e.toString());
+ }
}
public void recordUser(String userId, String action, String result, String ip, String detail) {
@@ -105,29 +141,39 @@ public class AuditService {
}
/** 查询最近的审计记录。 */
+ @Transactional(readOnly = true)
public List 与 {@link #disable} 的区别是不改变账号状态，设备可用新令牌重新上线。
+ */
+ public void kick(String deviceUid, String reason) {
+ DeviceAccount device = requireDevice(deviceUid);
+ device.setTokenVersion(device.getTokenVersion() + 1);
+ deviceStore.save(device);
+ notifyRevoked(deviceUid, reason == null ? "设备已被强制下线" : reason);
+ logger.info("设备 {} 已被强制下线：{}", deviceUid, reason);
+ }
+
+ /**
+ * 删除设备记录，并断开其在线连接。
+ */
+ public void delete(String deviceUid) {
+ DeviceAccount device = requireDevice(deviceUid);
+ deviceStore.delete(deviceUid);
+ notifyRevoked(deviceUid, "设备已被删除");
+ logger.info("设备 {} (sn={}) 已被删除", deviceUid, device.maskedSn());
+ }
+
public DeviceAccount requireDevice(String deviceUid) {
return deviceStore.findByDeviceUid(deviceUid)
.orElseThrow(() -> AuthException.badRequest("设备不存在"));
@@ -258,6 +281,20 @@ public class DeviceIdentityService {
return Set.copyOf(deviceStore.listAllowed().stream().map(DeviceAllowlist::getSn).toList());
}
+ /** 从 SN 白名单移除，返回是否实际删除。 */
+ public boolean removeFromAllowlist(String sn) {
+ if (sn == null || sn.isBlank()) {
+ throw AuthException.badRequest("SN 不能为空");
+ }
+ String trimmed = sn.trim();
+ if (!deviceStore.isSnAllowed(trimmed)) {
+ return false;
+ }
+ deviceStore.removeAllowedSn(trimmed);
+ logger.info("SN 已移出白名单: {}", DeviceAccount.maskSn(trimmed));
+ return true;
+ }
+
private void notifyRevoked(String deviceUid, String reason) {
AccountService.SessionRevocationListener listener = this.revocationListener;
if (listener != null) {
diff --git a/WebRTCSignalServer/src/main/java/com/ttstd/signaling/store/AdminStore.java b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/store/AdminStore.java
new file mode 100644
index 0000000..22dd7d9
--- /dev/null
+++ b/WebRTCSignalServer/src/main/java/com/ttstd/signaling/store/AdminStore.java
@@ -0,0 +1,28 @@
+package com.ttstd.signaling.store;
+
+import com.ttstd.signaling.model.AdminAccount;
+
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * 后台管理员存储抽象。与 {@code UserStore} 互不耦合，JPA 与内存两套实现可切换。
+ */
+public interface AdminStore {
+
+ AdminAccount save(AdminAccount admin);
+
+ Optional
- *
- *
- *
+ *
+ */
+public final class PublicEndpoints {
+
+ private PublicEndpoints() {
+ }
+
+ /** 精确免鉴权路径（不区分 HTTP 方法）。 */
+ public static final Set
+ *
+ */
+@Service
+public class AdminService {
+
+ private static final Logger logger = LoggerFactory.getLogger(AdminService.class);
+
+ /** 管理员令牌用途标识，与用户 access/refresh/device 令牌隔离。 */
+ public static final String TOKEN_PURPOSE = "admin";
+ /** 令牌前缀，便于前端区分与排查。 */
+ public static final String TOKEN_PREFIX = "admt_";
+
+ private static final Pattern ADMIN_USERNAME_PATTERN =
+ Pattern.compile("^[A-Za-z0-9_.\\-]{3,32}$");
+
+ private final AdminStore adminStore;
+ private final PasswordEncoder passwordEncoder;
+ private final JwtService jwtService;
+ private final SecurityProperties properties;
+
+ @Autowired
+ public AdminService(AdminStore adminStore,
+ PasswordEncoder passwordEncoder,
+ JwtService jwtService,
+ SecurityProperties properties) {
+ this.adminStore = adminStore;
+ this.passwordEncoder = passwordEncoder;
+ this.jwtService = jwtService;
+ this.properties = properties;
+ }
+
+ /**
+ * 启动引导：若管理员表为空，则依据 application.yml 的
+ * security.admin.bootstrap-username / bootstrap-password 创建初始管理员。
+ * 若未配置，则记录告警日志（不会抛异常，避免阻断启动）。
+ */
+ @jakarta.annotation.PostConstruct
+ void bootstrap() {
+ String username = properties.getAdmin() != null
+ ? properties.getAdmin().getBootstrapUsername() : null;
+ String password = properties.getAdmin() != null
+ ? properties.getAdmin().getBootstrapPassword() : null;
+ if (username == null || username.isBlank() || password == null || password.isBlank()) {
+ if (adminStore.count() == 0) {
+ logger.warn("后台管理员表为空，且未配置 security.admin.bootstrap-username / "
+ + "bootstrap-password。请通过管理接口或环境变量创建首个管理员，否则无法登录后台。");
+ }
+ return;
+ }
+ AdminAccount existing = adminStore.findByUsername(username).orElse(null);
+ if (existing != null) {
+ // 已存在同名管理员：保证其密码与配置的引导密码一致，
+ // 避免早期手动创建的账号与配置不一致导致网页端无法登录。
+ if (!passwordEncoder.matches(password, existing.getPasswordHash())) {
+ existing.setPasswordHash(passwordEncoder.encode(password));
+ existing.setUpdatedAt(java.time.Instant.now());
+ adminStore.save(existing);
+ logger.info("已将引导管理员 {} 的密码重置为 application.yml 配置值", username);
+ }
+ return;
+ }
+ if (adminStore.count() > 0) {
+ return;
+ }
+ createAdminInternal(username, password, username);
+ logger.info("已根据 application.yml 创建初始后台管理员: {}", username);
+ }
+
+ // ==================== 登录 ====================
+
+ public Map