feat: Add password protection for backdoor login and user retrieval endpoints with corresponding tests

ruoyi-admin/src/main/java/com/ruoyi/web/config/BackDoorLoginProperties.java

@@ -1,5 +1,9 @@
 package com.ruoyi.web.config;
 
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.stereotype.Component;
 
@@ -16,6 +20,10 @@ public class BackDoorLoginProperties
     private boolean enabled;
     private int maxUsers = DEFAULT_MAX_USERS;
     private String portalBasePath = "/shihezi";
+    /**
+     * 测试授权口令。未配置时，小程序测试授权接口应拒绝所有请求。
+     */
+    private String password;
 
     public boolean isEnabled()
     {
@@ -47,6 +55,31 @@ public class BackDoorLoginProperties
         this.portalBasePath = portalBasePath;
     }
 
+    public String getPassword()
+    {
+        return password;
+    }
+
+    public void setPassword(String password)
+    {
+        this.password = password;
+    }
+
+    /**
+     * 验证小程序测试授权口令。
+     *
+     * 未设置口令时必须拒绝访问，避免某个测试 profile 误开启后门后暴露用户列表。
+     */
+    public boolean matchesPassword(String candidate)
+    {
+        if (StringUtils.isBlank(password) || candidate == null)
+        {
+            return false;
+        }
+        return MessageDigest.isEqual(password.getBytes(StandardCharsets.UTF_8),
+                candidate.trim().getBytes(StandardCharsets.UTF_8));
+    }
+
     private String normalizeBasePath(String value, String defaultValue)
     {
         if (value == null || value.trim().isEmpty())

ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/BackDoorLoginController.java

@@ -100,12 +100,16 @@ public class BackDoorLoginController
      * 与 /backDoor 一样仅在 backdoor.login.enabled=true 时存在，且只返回已关联
      * AppUser 的最小化展示字段。
      */
-    @GetMapping("/app/backDoor/users")
-    public AjaxResult appBackDoorUsers(
-            @RequestParam(value = "keyword", required = false) String keyword)
+    @PostMapping("/app/backDoor/users")
+    public AjaxResult appBackDoorUsers(@RequestBody(required = false) JSONObject body)
     {
+        if (!matchesAppBackDoorPassword(body))
+        {
+            return AjaxResult.error("测试授权密码错误");
+        }
         try
         {
+            String keyword = body == null ? null : body.getString("keyword");
             return AjaxResult.success(backDoorLoginService.listAvailableAppUsers(keyword, properties.getMaxUsers()));
         }
         catch (Exception e)
@@ -121,6 +125,10 @@ public class BackDoorLoginController
     @PostMapping("/app/backDoor/login")
     public AjaxResult appBackDoorLogin(@RequestBody(required = false) JSONObject body)
     {
+        if (!matchesAppBackDoorPassword(body))
+        {
+            return AjaxResult.error("测试授权密码错误");
+        }
         Long userId = body == null ? null : body.getLong("userId");
         try
         {
@@ -142,6 +150,11 @@ public class BackDoorLoginController
         }
     }
 
+    private boolean matchesAppBackDoorPassword(JSONObject body)
+    {
+        return properties.matchesPassword(body == null ? null : body.getString("password"));
+    }
+
     private ResponseEntity<String> renderUserList(String keyword, int page)
     {
         try

ruoyi-admin/src/main/resources/application-test.yml

@@ -151,3 +151,4 @@ backdoor:
     enabled: true
     max-users: 100
     portal-base-path: /shihezi
+    password: zkr2024