添加token参数校验方法及示例

README.md

@@ -12,12 +12,13 @@
 ### 签名串示例
 
 ```
-cFw0t9IuvL9jVo9qAzk0qMcw5BM%3D
+nJjWbI2YACOhHWcvVWBv6ia3z%2Fs%3D
 ```
 
-TOKEN生成工具类: com.qmai.openapi.sign.util.TokenUtil
+TOKEN工具类: com.qmai.openapi.sign.util.QmaiTokenUtil
 
-开放平台接口请求示例: com.qmai.openapi.sign.util.Example
+请求企迈开放平台接口生成Token示例: com.qmai.openapi.sign.example.GenerateTokenExample
+提供给企迈接口验签示例：com.qmai.openapi.sign.example.CheckTokenExample
 
 SDK MAVEN 依赖
 ```xml

src/main/java/com/qmai/openapi/sign/dto/BaseOuterOpenapiRequest.java

+package com.qmai.openapi.sign.dto;
+
+/**
+ * @author song
+ * @date 2021/5/10 20:38
+ */
+public class BaseOuterOpenapiRequest<T> extends ComSignParam {
+
+    protected T params;
+
+    public T getParams() {
+        return params;
+    }
+
+    public void setParams(T params) {
+        this.params = params;
+    }
+}

src/main/java/com/qmai/openapi/sign/dto/ComSignParam.java

+package com.qmai.openapi.sign.dto;
+
+/**
+ * @author Administrator
+ * 对外的接口需要进行验签,验签的基本参数
+ */
+public class ComSignParam {
+
+    private String openId;
+
+
+    private String grantCode;
+
+
+    private Long timestamp;
+
+
+    private Long nonce;
+
+
+    private String token;
+
+    public String getOpenId() {
+        return openId;
+    }
+
+    public void setOpenId(String openId) {
+        this.openId = openId;
+    }
+
+    public String getGrantCode() {
+        return grantCode;
+    }
+
+    public void setGrantCode(String grantCode) {
+        this.grantCode = grantCode;
+    }
+
+    public Long getTimestamp() {
+        return timestamp;
+    }
+
+    public void setTimestamp(Long timestamp) {
+        this.timestamp = timestamp;
+    }
+
+    public Long getNonce() {
+        return nonce;
+    }
+
+    public void setNonce(Long nonce) {
+        this.nonce = nonce;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public void setToken(String token) {
+        this.token = token;
+    }
+}

src/main/java/com/qmai/openapi/sign/example/CheckTokenExample.java

+package com.qmai.openapi.sign.example;
+
+import com.alibaba.fastjson.JSONObject;
+import com.qmai.openapi.sign.dto.BaseOuterOpenapiRequest;
+import com.qmai.openapi.sign.util.QmaiTokenUtil;
+
+/**
+ * 类描述: 校验企迈侧token是否通过
+ *
+ * @author Wang Jinglei
+ * @date 2023/4/7 13:43
+ * @modifier Wang Jinglei
+ * @date 2023/4/7 13:43
+ * @Version V1.0
+ */
+public class CheckTokenExample {
+
+
+    public static void main(String[] args) {
+
+
+        /** 假设企迈侧传过来的参数是
+         {
+         "openId": "8e0c6ae0dcd12c0573ad61f06a01c39c",
+         "grantCode": "191ec32456",
+         "params": {},
+         "nonce": 5550,
+         "timestamp": 1680145437,
+         "token": "nJjWbI2YACOhHWcvVWBv6ia3z%2Fs%3D"
+         }
+         */
+        BaseOuterOpenapiRequest<JSONObject> request = new BaseOuterOpenapiRequest<>();
+
+        // 验签参数
+        request.setToken("nJjWbI2YACOhHWcvVWBv6ia3z%2Fs%3D");
+        request.setGrantCode("191ec32456");
+        request.setOpenId("8e0c6ae0dcd12c0573ad61f06a01c39c");
+        request.setTimestamp(1680145437L);
+        request.setNonce(5550L);
+        // 业务参数
+        JSONObject params = new JSONObject();
+        request.setParams(params);
+
+        Boolean checkPass = checkToken(request);
+
+        System.out.println("checkPass = " + checkPass);
+
+    }
+
+    /**
+     * 接口提供方使用此方法对接口调用方传过来的token校验
+     *
+     * @param request
+     * @return
+     */
+    private static Boolean checkToken(BaseOuterOpenapiRequest<JSONObject> request) {
+        /**
+         * openKey 与openId配套，可在配置文件或配置表中读取
+         */
+        String openKey = "wEV7o3pDG8wnImyhfYwTAZIrTJJiv5mtBJbo3IF2D2jfLCclyb";
+
+        String token = request.getToken();
+        String grantCode = request.getGrantCode();
+        String openId = request.getOpenId();
+        Long timestamp = request.getTimestamp();
+        Long nonce = request.getNonce();
+
+        return QmaiTokenUtil.checkToken(token, openId, openKey, grantCode, nonce, timestamp);
+    }
+
+}

src/main/java/com/qmai/openapi/sign/util/Example.java → src/main/java/com/qmai/openapi/sign/example/GenerateTokenExample.java

-package com.qmai.openapi.sign.util;
+package com.qmai.openapi.sign.example;
 
 import com.alibaba.fastjson.JSONObject;
+import com.qmai.openapi.sign.dto.BaseOuterOpenapiRequest;
+import com.qmai.openapi.sign.util.QmaiTokenUtil;
 import org.apache.http.HttpResponse;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.HttpPost;
@@ -24,19 +26,19 @@ import java.util.Map;
  * @date 2022/11/1 4:54 下午
  * @Version V1.0
  */
-public class Example {
+public class GenerateTokenExample {
 
-    private static String grantCode = "f7a23ee212";
+    private static String grantCode = "191ec32456";
 
-    private static String openId = "42206de20656a5d93a424e6279f636b6";
+    private static String openId = "8e0c6ae0dcd12c0573ad61f06a01c39c";
 
-    private static String openKey = "ojTjKomMbA5KpSpaHaV96wYGqtLno2AWVxCxDuNQGw7sopnzqN";
+    private static String openKey = "5DemzwWRGIXX3tWlAe3n6M6nBojELJqhRyiPTMlW3FgFihyIGq";
 
     // 随机正整数
-    private static Integer nonce = 166;
+    private static Long nonce = 5550L;
 
     // 当前时间戳
-    private static Long timestamp = 1667296049L;
+    private static Long timestamp = 1680145437L;
 
     public static void main(String[] args) {
 
@@ -44,6 +46,10 @@ public class Example {
 
         String token = QmaiTokenUtil.getToken(grantCode, openId, openKey, nonce, timestamp);
 
+        BaseOuterOpenapiRequest<JSONObject> request = new BaseOuterOpenapiRequest<>();
+        request.setNonce(nonce);
+        request.setToken(token);
+
         Map<String, Object> requestParam = new HashMap<>();
 
         requestParam.put("openId", openId);

src/main/java/com/qmai/openapi/sign/util/QmaiTokenUtil.java

 package com.qmai.openapi.sign.util;
 
 import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.codec.binary.StringUtils;
 
 import javax.crypto.Mac;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.security.GeneralSecurityException;
 import java.util.Arrays;
@@ -23,6 +25,16 @@ import java.util.Map;
  */
 public class QmaiTokenUtil {
 
+
+    public static Boolean checkToken(String token, String openId, String openKey, String grandCode, Long nonce, Long timestamp) {
+        if ( token == null || token.length() == 0) {
+            System.err.println("err: qmai token is empty");
+            return false;
+        }
+        String myToken = getToken(grandCode, openId, openKey, nonce, timestamp);
+        return token.equals(myToken);
+    }
+
     /**
      * 生成开放平台Token
      *
@@ -33,7 +45,10 @@ public class QmaiTokenUtil {
      * @param timestamp 当前时间戳
      * @return 正常情况返回token字符串，token获取失败时返回null
      */
-    public static String getToken(String grandCode, String openId, String openKey, Integer nonce, Long timestamp) {
+    public static String getToken(String grandCode, String openId, String openKey, Long nonce, Long timestamp) {
+        if (checkParam(grandCode, openId, openKey, nonce, timestamp)) {
+            return null;
+        }
         HashMap<String, Object> map = new HashMap<>(4);
 
         map.put("openId", openId);
@@ -42,7 +57,8 @@ public class QmaiTokenUtil {
         map.put("nonce", nonce);
 
         try {
-            String tokenNew = Sha1HexUtil.computeSignature(Sha1HexUtil.kSort(map), openKey);
+            String baseString = Sha1HexUtil.kSort(map);
+            String tokenNew = Sha1HexUtil.computeSignature(baseString, openKey);
             return URLEncoder.encode(tokenNew, "utf-8");
         } catch (UnsupportedEncodingException | GeneralSecurityException e) {
             e.printStackTrace();
@@ -50,6 +66,30 @@ public class QmaiTokenUtil {
         return null;
     }
 
+    private static boolean checkParam(String grandCode, String openId, String openKey, Long nonce, Long timestamp) {
+        if (grandCode == null || grandCode.length() == 0) {
+            System.err.println("err: grandCode is empty");
+            return false;
+        }
+        if (openId == null || openId.length() == 0) {
+            System.err.println("err: openId is empty");
+            return false;
+        }
+        if (openKey == null || openKey.length() == 0) {
+            System.err.println("err: openKey is empty");
+            return false;
+        }
+        if (nonce == null) {
+            System.err.println("err: nonce is null");
+            return false;
+        }
+        if (timestamp == null) {
+            System.err.println("err: timestamp is null");
+            return false;
+        }
+        return true;
+    }
+
 
     private static class Sha1HexUtil {