Client                              Server
      |                                    |
      | appid, params, sign, timestamp, nonce |
      | -----------------------------------> |
      |                                    | 1. 從數(shù)據(jù)庫(kù)加載密鑰配置
      |                                    | 2. 驗(yàn)證 timestamp 是否在有效期內(nèi)
      |                                    | 3. 驗(yàn)證 nonce 是否重復(fù)
      |                                    | 4. 計(jì)算簽名并比對(duì)
      |                                    | 5. Redis 緩存配置（12小時(shí)）
      | <----------------------------------|
      |           Response                 |

<!-- Sa-Token Starter -->
<dependency>
    <groupId>cn.dev33</groupId>
    <artifactId>sa-token-spring-boot3-starter</artifactId>
    <version>1.44.0</version>
</dependency>

<!-- API 參數(shù)簽名 -->
<dependency>
    <groupId>cn.dev33</groupId>
    <artifactId>sa-token-sign</artifactId>
    <version>1.44.0</version>
</dependency>

<!-- Sa-Token 與 Redis 集成（用于緩存簽名配置） -->
<dependency>
    <groupId>cn.dev33</groupId>
    <artifactId>sa-token-redis-template</artifactId>
    <version>1.44.0</version>
</dependency>

create table t_app_sign_config
(
    id                  bigint auto_increment comment '主鍵ID' primary key,
    app_id              varchar(64)  not null comment '應(yīng)用ID',
    secret_key          varchar(128) not null comment '密鑰',
    digest_algo         varchar(32)  default 'md5' not null comment '簽名算法: md5 / sha256 / sha512',
    timestamp_disparity bigint       default 900000 null comment '時(shí)間戳允許誤差(毫秒) 默認(rèn)15分鐘',
    create_by           varchar(50)  null comment '創(chuàng)建人',
    create_time         datetime     default CURRENT_TIMESTAMP null comment '創(chuàng)建時(shí)間',
    update_by           varchar(50)  null comment '更新人',
    update_time         datetime     default CURRENT_TIMESTAMP null on update CURRENT_TIMESTAMP comment '更新時(shí)間',
    constraint uk_app_id unique (app_id)
) comment '應(yīng)用簽名配置表';

INSERT INTO t_app_sign_config (app_id, secret_key, digest_algo, timestamp_disparity, create_by)
VALUES ('AppId1', '601b8ddd3037c782476e4be8102f6a07', 'md5', 900000, 'admin');

INSERT INTO t_app_sign_config (app_id, secret_key, digest_algo, timestamp_disparity, create_by)
VALUES ('AppId2', '954911e93f7e14fe1e09a713bf96b0da', 'md5', 900000, 'admin');

@Data
@EqualsAndHashCode(callSuper = true)
@TableName("t_app_sign_config")
public class AppSignConfig extends BaseEntity {

    /**
     * 應(yīng)用ID
     */
    private String appId;

    /**
     * 密鑰
     */
    private String secretKey;

    /**
     * md5 / sha256 / sha512
     */
    private String digestAlgo;

    /**
     * 時(shí)間戳誤差(秒)
     */
    private Long timestampDisparity;
}

public interface IAppSignConfigService extends IService<AppSignConfig> {
    AppSignConfig getByAppId(String appId);
}
@Service
public class AppSignConfigServiceImpl extends ServiceImpl<AppSignConfigRepository, AppSignConfig>
        implements IAppSignConfigService {

    private static final String CACHE_PREFIX = "rbom-sync:api:signconfig:";

    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    @Override
    public AppSignConfig getByAppId(String appId) {
        String cacheKey = CACHE_PREFIX + appId;
        String cache = redisTemplate.opsForValue().get(cacheKey);
        if (cache != null) {
            return JsonUtils.fromJson(cache, AppSignConfig.class);
        }
        AppSignConfig appSignConfig = lambdaQuery()
                .eq(AppSignConfig::getAppId, appId)
                .one();
        // 緩存配置（12小時(shí)）
        redisTemplate.opsForValue()
                .set(cacheKey, JsonUtils.toJson(appSignConfig), Duration.ofHours(12));
        return appSignConfig;
    }
}

@Component
public class MySignConfigLoader {

    private static final Logger logger = LoggerFactory.getLogger(MySignConfigLoader.class);

    @Autowired
    private IAppSignConfigService appSignConfigService;

    @PostConstruct
    public void init() {
        logger.info("初始化自定義簽名配置加載器...");
        // 覆蓋 SaSignMany 的查找邏輯
        SaSignMany.findSaSignConfigMethod = (appid) -> {
            try {
                logger.debug("查找應(yīng)用簽名配置，appid: {}", appid);
                AppSignConfig appSignConfig = appSignConfigService.getByAppId(appid);

                if (appSignConfig == null) {
                    logger.warn("未找到應(yīng)用簽名配置，appid: {}", appid);
                    throw new RuntimeException("appid 不存在: " + appid);
                }
                SaSignConfig config = new SaSignConfig();
                config.setSecretKey(appSignConfig.getSecretKey());
                config.setDigestAlgo(appSignConfig.getDigestAlgo());
                config.setTimestampDisparity(appSignConfig.getTimestampDisparity());
                logger.debug("成功加載應(yīng)用簽名配置，appid: {}, algorithm: {}",
                        appid, appSignConfig.getDigestAlgo());
                return config;
            } catch (Exception e) {
                logger.error("加載應(yīng)用簽名配置失敗，appid: {}, error: {}", appid, e.getMessage(), e);
                throw new BusinessException("加載應(yīng)用簽名配置失敗: " + e.getMessage(), e);
            }
        };
        logger.info("自定義簽名配置加載器初始化完成");
    }
}

@Configuration
public class SaTokenConfigure implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        // 開啟 Sa-Token 注解攔截
        registry.addInterceptor(new SaInterceptor()).addPathPatterns("/**");
    }
}

@RestController
@RequestMapping("/sync")
public class SyncController {

    @Autowired
    private IModelService modelService;

    // 從請(qǐng)求參數(shù)中動(dòng)態(tài)獲取 appid
    @SaCheckSign(appid = "#{appid}")
    @GetMapping("/model")
    public ResponseEntity<Res> model() {
        List<Model> models = modelService.list();
        return ResponseEntity.ok(Res.success(models));
    }
}

# Sa-Token 配置
sa-token.token-name=***-sync:satoken

OkHttpClient client = new OkHttpClient().newBuilder().build();

String appid = "AppId1";
String nonce = UUID.randomUUID().toString();
long timestamp = System.currentTimeMillis();

// 拼接簽名字符串
String raw = "appid=" + appid + "&nonce=" + nonce + "&timestamp=" + timestamp
             + "&key=601b8ddd3037c782476e4be8102f6a07";
// 生成 MD5 簽名
String sign = DigestUtils.md5DigestAsHex(raw.getBytes(StandardCharsets.UTF_8));

// 發(fā)送請(qǐng)求
Request request = new Request.Builder()
        .url("http://***:8080/sync/model"
             + "?appid=" + appid
             + "&sign=" + sign
             + "&nonce=" + nonce
             + "&timestamp=" + timestamp)
        .get()
        .build();

Response response = client.newCall(request).execute();
System.out.println(response.body().string());

curl "http://***:8080/sync/model?appid=MDM&sign=***&nonce=***&timestamp=***"