交易市场平台（供应商）

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/controller/ScreenLoginController.java

@@ -0,0 +1,58 @@
+package com.ruoyi.web.modules.screen.controller;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import com.ruoyi.common.annotation.Anonymous;
+import com.ruoyi.common.constant.Constants;
+import com.ruoyi.common.core.domain.AjaxResult;
+import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.web.modules.screen.domain.dto.ScreenLoginBody;
+import com.ruoyi.web.modules.screen.support.ScreenLoginService;
+
+/**
+ * 大屏免密登录（RSA 加密 UUID 换若依 Token，供 ruoyi-screen 自动登录）
+ */
+@Anonymous
+@RestController
+@RequestMapping("/bigScreen")
+public class ScreenLoginController
+{
+    public static final String HEADER_SCREEN_TOKEN = "X-Screen-Token";
+
+    @Autowired
+    private ScreenLoginService screenLoginService;
+
+    /**
+     * 获取 RSA 公钥，前端生成 UUID 后使用 JSEncrypt 加密再调用 {@link #login}。
+     */
+    @GetMapping("/publicKey")
+    public AjaxResult rsaPublicKey()
+    {
+        return AjaxResult.success(screenLoginService.getRsaPublicKey());
+    }
+
+    /**
+     * 免密登录：优先读取请求头 {@value #HEADER_SCREEN_TOKEN}，其次 Body.token。
+     * 成功响应与 {@code POST /login} 一致，含 {@code token} 字段。
+     */
+    @PostMapping("/login")
+    public AjaxResult login(
+            @RequestHeader(value = HEADER_SCREEN_TOKEN, required = false) String headerToken,
+            @RequestBody(required = false) ScreenLoginBody body)
+    {
+        String encryptedToken = headerToken;
+        if (StringUtils.isEmpty(encryptedToken) && body != null)
+        {
+            encryptedToken = body.getToken();
+        }
+        String token = screenLoginService.login(encryptedToken);
+        AjaxResult ajax = AjaxResult.success();
+        ajax.put(Constants.TOKEN, token);
+        return ajax;
+    }
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/domain/dto/ScreenLoginBody.java

@@ -0,0 +1,20 @@
+package com.ruoyi.web.modules.screen.domain.dto;
+
+/**
+ * 大屏免密登录请求体（加密 Token 亦可走请求头 X-Screen-Token）
+ */
+public class ScreenLoginBody
+{
+    /** RSA 加密后的 UUID（Base64） */
+    private String token;
+
+    public String getToken()
+    {
+        return token;
+    }
+
+    public void setToken(String token)
+    {
+        this.token = token;
+    }
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/domain/vo/ScreenLoginRsaPublicKeyVo.java

@@ -0,0 +1,28 @@
+package com.ruoyi.web.modules.screen.domain.vo;
+
+/**
+ * 大屏免密登录 RSA 公钥（供前端 JSEncrypt 加密 UUID）
+ */
+public class ScreenLoginRsaPublicKeyVo
+{
+    private String publicKey;
+
+    public ScreenLoginRsaPublicKeyVo()
+    {
+    }
+
+    public ScreenLoginRsaPublicKeyVo(String publicKey)
+    {
+        this.publicKey = publicKey;
+    }
+
+    public String getPublicKey()
+    {
+        return publicKey;
+    }
+
+    public void setPublicKey(String publicKey)
+    {
+        this.publicKey = publicKey;
+    }
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/support/ScreenLoginConfig.java

@@ -0,0 +1,10 @@
+package com.ruoyi.web.modules.screen.support;
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@EnableConfigurationProperties(ScreenLoginProperties.class)
+public class ScreenLoginConfig
+{
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/support/ScreenLoginProperties.java

@@ -0,0 +1,62 @@
+package com.ruoyi.web.modules.screen.support;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+/**
+ * 大屏免密登录配置 {@code bigscreen.login.*}
+ */
+@ConfigurationProperties(prefix = "bigscreen.login")
+public class ScreenLoginProperties
+{
+    /** 是否启用大屏免密登录 */
+    private boolean enabled = false;
+
+    /** RSA 公钥（Base64，与 JSEncrypt 兼容） */
+    private String rsaPublicKey = "";
+
+    /** RSA 私钥（Base64，服务端解密用，勿暴露给前端） */
+    private String rsaPrivateKey = "";
+
+    /** 专用大屏账号（须预置 sys_user，建议仅 bigScreen:* 查询权限） */
+    private String username = "screen_viewer";
+
+    public boolean isEnabled()
+    {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled)
+    {
+        this.enabled = enabled;
+    }
+
+    public String getRsaPublicKey()
+    {
+        return rsaPublicKey;
+    }
+
+    public void setRsaPublicKey(String rsaPublicKey)
+    {
+        this.rsaPublicKey = rsaPublicKey;
+    }
+
+    public String getRsaPrivateKey()
+    {
+        return rsaPrivateKey;
+    }
+
+    public void setRsaPrivateKey(String rsaPrivateKey)
+    {
+        this.rsaPrivateKey = rsaPrivateKey;
+    }
+
+    public String getUsername()
+    {
+        return username;
+    }
+
+    public void setUsername(String username)
+    {
+        this.username = username;
+    }
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/support/ScreenLoginRsaSupport.java

@@ -0,0 +1,96 @@
+package com.ruoyi.web.modules.screen.support;
+
+import java.nio.charset.StandardCharsets;
+import java.security.KeyFactory;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
+import java.util.UUID;
+import javax.crypto.Cipher;
+import com.ruoyi.common.utils.StringUtils;
+
+/**
+ * 大屏免密登录 RSA（PKCS#1）：前端 JSEncrypt 公钥加密 UUID，服务端私钥解密校验。
+ */
+public final class ScreenLoginRsaSupport
+{
+    private static final String RSA_TRANSFORMATION = "RSA/ECB/PKCS1Padding";
+
+    private ScreenLoginRsaSupport()
+    {
+    }
+
+    public static String encrypt(String plainText, String publicKeyBase64)
+    {
+        if (StringUtils.isEmpty(plainText) || StringUtils.isEmpty(publicKeyBase64))
+        {
+            throw new IllegalArgumentException("plain/publicKey required");
+        }
+        try
+        {
+            Cipher cipher = Cipher.getInstance(RSA_TRANSFORMATION);
+            cipher.init(Cipher.ENCRYPT_MODE, loadPublicKey(publicKeyBase64));
+            byte[] cipherBytes = cipher.doFinal(plainText.getBytes(StandardCharsets.UTF_8));
+            return Base64.getEncoder().encodeToString(cipherBytes);
+        }
+        catch (Exception ex)
+        {
+            throw new IllegalStateException("RSA 加密失败", ex);
+        }
+    }
+
+    public static String decrypt(String cipherTextBase64, String privateKeyBase64)
+    {
+        if (StringUtils.isEmpty(cipherTextBase64) || StringUtils.isEmpty(privateKeyBase64))
+        {
+            return null;
+        }
+        try
+        {
+            Cipher cipher = Cipher.getInstance(RSA_TRANSFORMATION);
+            cipher.init(Cipher.DECRYPT_MODE, loadPrivateKey(privateKeyBase64));
+            byte[] plainBytes = cipher.doFinal(Base64.getDecoder().decode(cipherTextBase64.trim()));
+            return new String(plainBytes, StandardCharsets.UTF_8);
+        }
+        catch (Exception ex)
+        {
+            return null;
+        }
+    }
+
+    static boolean isValidUuid(String text)
+    {
+        if (StringUtils.isEmpty(text))
+        {
+            return false;
+        }
+        try
+        {
+            UUID.fromString(text.trim());
+            return true;
+        }
+        catch (IllegalArgumentException ex)
+        {
+            return false;
+        }
+    }
+
+    static PublicKey loadPublicKey(String publicKeyBase64) throws Exception
+    {
+        byte[] keyBytes = Base64.getDecoder().decode(normalizeBase64(publicKeyBase64));
+        return KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(keyBytes));
+    }
+
+    static PrivateKey loadPrivateKey(String privateKeyBase64) throws Exception
+    {
+        byte[] keyBytes = Base64.getDecoder().decode(normalizeBase64(privateKeyBase64));
+        return KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(keyBytes));
+    }
+
+    private static String normalizeBase64(String key)
+    {
+        return key.replaceAll("\\s+", "");
+    }
+}

baqing-admin/src/main/java/com/ruoyi/web/modules/screen/support/ScreenLoginService.java

@@ -0,0 +1,116 @@
+package com.ruoyi.web.modules.screen.support;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import com.ruoyi.common.constant.Constants;
+import com.ruoyi.common.core.domain.entity.SysUser;
+import com.ruoyi.common.core.domain.model.LoginUser;
+import com.ruoyi.common.enums.UserStatus;
+import com.ruoyi.common.exception.ServiceException;
+import com.ruoyi.common.utils.DateUtils;
+import com.ruoyi.common.utils.MessageUtils;
+import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.common.utils.ip.IpUtils;
+import com.ruoyi.framework.manager.AsyncManager;
+import com.ruoyi.framework.manager.factory.AsyncFactory;
+import com.ruoyi.framework.web.service.TokenService;
+import com.ruoyi.framework.web.service.UserDetailsServiceImpl;
+import com.ruoyi.system.service.ISysUserService;
+import com.ruoyi.web.modules.screen.domain.vo.ScreenLoginRsaPublicKeyVo;
+
+/**
+ * 大屏免密登录：校验 RSA 加密 UUID 后为专用账号签发若依 JWT。
+ */
+@Service
+public class ScreenLoginService
+{
+    private static final String AUTH_FAIL_MSG = "大屏登录认证失败";
+
+    @Autowired
+    private ScreenLoginProperties properties;
+
+    @Autowired
+    private ISysUserService userService;
+
+    @Autowired
+    private UserDetailsServiceImpl userDetailsService;
+
+    @Autowired
+    private TokenService tokenService;
+
+    public ScreenLoginRsaPublicKeyVo getRsaPublicKey()
+    {
+        assertLoginReady();
+        return new ScreenLoginRsaPublicKeyVo(properties.getRsaPublicKey());
+    }
+
+    public String login(String encryptedToken)
+    {
+        assertLoginReady();
+        validateEncryptedToken(encryptedToken);
+        SysUser user = loadScreenUser();
+        LoginUser loginUser = (LoginUser) userDetailsService.createLoginUser(user);
+        userService.updateLoginInfo(user.getUserId(), IpUtils.getIpAddr(), DateUtils.getNowDate());
+        AsyncManager.me().execute(AsyncFactory.recordLogininfor(user.getUserName(), Constants.LOGIN_SUCCESS,
+                MessageUtils.message("user.login.success")));
+        return tokenService.createToken(loginUser);
+    }
+
+    private void assertLoginReady()
+    {
+        if (!properties.isEnabled())
+        {
+            throw new ServiceException("大屏免密登录未启用");
+        }
+        if (StringUtils.isEmpty(properties.getRsaPublicKey()) || StringUtils.isEmpty(properties.getRsaPrivateKey()))
+        {
+            throw new ServiceException("大屏免密登录未配置 RSA 密钥");
+        }
+    }
+
+    private void validateEncryptedToken(String encryptedToken)
+    {
+        if (StringUtils.isEmpty(encryptedToken))
+        {
+            recordAuthFail();
+            throw new ServiceException(AUTH_FAIL_MSG);
+        }
+        String plain = ScreenLoginRsaSupport.decrypt(encryptedToken, properties.getRsaPrivateKey());
+        if (!ScreenLoginRsaSupport.isValidUuid(plain))
+        {
+            recordAuthFail();
+            throw new ServiceException(AUTH_FAIL_MSG);
+        }
+    }
+
+    private void recordAuthFail()
+    {
+        AsyncManager.me().execute(AsyncFactory.recordLogininfor(properties.getUsername(), Constants.LOGIN_FAIL,
+                AUTH_FAIL_MSG));
+    }
+
+    private SysUser loadScreenUser()
+    {
+        String username = properties.getUsername();
+        if (StringUtils.isEmpty(username))
+        {
+            throw new ServiceException("大屏免密登录未配置专用账号");
+        }
+        SysUser user = userService.selectUserByUserName(username.trim());
+        if (StringUtils.isNull(user))
+        {
+            AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL,
+                    MessageUtils.message("user.not.exists")));
+            throw new ServiceException("大屏专用账号不存在");
+        }
+        if (UserStatus.DELETED.getCode().equals(user.getDelFlag()))
+        {
+            throw new ServiceException(MessageUtils.message("user.password.delete"));
+        }
+        if (UserStatus.DISABLE.getCode().equals(user.getStatus()))
+        {
+            throw new ServiceException(MessageUtils.message("user.blocked"));
+        }
+        return user;
+    }
+}

baqing-admin/src/main/resources/application.yml

@@ -34,6 +34,12 @@ ruoyi:
 
 # 大屏交易销售（产地行情默认市场）
 bigscreen:
+  # 大屏免密登录（GET /bigScreen/publicKey + POST /bigScreen/login；默认关闭）
+  login:
+    enabled: true
+    rsa-public-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdHnzkXSOVOZbFu/TJhZ7rFAN+eaGkl3C4buccQd/EjEsj9ir7ijT7h96MCAwEAAQ==
+    rsa-private-key: MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAqhHyZfSsYourNxaY7Nt+PrgrxkiA50efORdI5U5lsW79MmFnusUA355oaSXcLhu5xxB38SMSyP2KvuKNPuH3owIDAQABAkAfoiLyL+Z4lf4Myxk6xUDgLaWGximj20CUf+5BKKnlrK+Ed8gAkM0HqoTt2UZwA5E2MzS4EI2gjfQhz5X28uqxAiEA3wNFxfrCZlSZHb0gn2zDpWowcSxQAgiCstxGUoOqlW8CIQDDOerGKH5OmCJ4Z21v+F25WaHYPxCFMvwxpcw99EcvDQIgIdhDTIqD2jfYjPTY8Jj3EDGPbH2HHuffvflECt3Ek60CIQCFRlCkHpi7hthhYhovyloRYsM+IS9h/0BzlEAuO0ktMQIgSPT3aFAgJYwKpqRYKlLDVcflZFCKY7u3UP8iWi1Qw0Y=
+    username: screenviewer
   trade-sales:
     default-market-name: 巴青牦牛交易市场
   mall-stats:

baqing-admin/src/test/java/com/ruoyi/web/modules/screen/controller/ScreenLoginControllerApiTest.java

@@ -0,0 +1,74 @@
+package com.ruoyi.web.modules.screen.controller;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import com.ruoyi.web.modules.screen.domain.vo.ScreenLoginRsaPublicKeyVo;
+import com.ruoyi.web.modules.screen.support.ScreenLoginService;
+
+@ExtendWith(MockitoExtension.class)
+@DisplayName("ScreenLoginController")
+class ScreenLoginControllerApiTest
+{
+
+    @InjectMocks
+    private ScreenLoginController controller;
+
+    @Mock
+    private ScreenLoginService screenLoginService;
+
+    @Test
+    @DisplayName("获取 RSA 公钥")
+    void rsaPublicKey() throws Exception
+    {
+        when(screenLoginService.getRsaPublicKey())
+                .thenReturn(new ScreenLoginRsaPublicKeyVo("pub-key-1"));
+        MockMvc mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
+
+        mockMvc.perform(get("/bigScreen/publicKey"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(200))
+                .andExpect(jsonPath("$.data.publicKey").value("pub-key-1"));
+    }
+
+    @Test
+    @DisplayName("请求头 Token 登录")
+    void loginByHeader() throws Exception
+    {
+        when(screenLoginService.login(eq("cipher-1"))).thenReturn("jwt-abc");
+        MockMvc mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
+
+        mockMvc.perform(post("/bigScreen/login")
+                .header(ScreenLoginController.HEADER_SCREEN_TOKEN, "cipher-1"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(200))
+                .andExpect(jsonPath("$.token").value("jwt-abc"));
+    }
+
+    @Test
+    @DisplayName("Body Token 登录")
+    void loginByBody() throws Exception
+    {
+        when(screenLoginService.login(eq("cipher-2"))).thenReturn("jwt-def");
+        MockMvc mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
+
+        mockMvc.perform(post("/bigScreen/login")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"cipher-2\"}"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.token").value("jwt-def"));
+    }
+}

baqing-admin/src/test/java/com/ruoyi/web/modules/screen/support/ScreenLoginRsaSupportTest.java

@@ -0,0 +1,52 @@
+package com.ruoyi.web.modules.screen.support;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.UUID;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+@DisplayName("ScreenLoginRsaSupport")
+class ScreenLoginRsaSupportTest
+{
+    private static final String PUBLIC_KEY = "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdH"
+            + "nzkXSOVOZbFu/TJhZ7rFAN+eaGkl3C4buccQd/EjEsj9ir7ijT7h96MCAwEAAQ==";
+    private static final String PRIVATE_KEY = "MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAqhHyZfSsYourNxaY"
+            + "7Nt+PrgrxkiA50efORdI5U5lsW79MmFnusUA355oaSXcLhu5xxB38SMSyP2KvuKN"
+            + "PuH3owIDAQABAkAfoiLyL+Z4lf4Myxk6xUDgLaWGximj20CUf+5BKKnlrK+Ed8gA"
+            + "kM0HqoTt2UZwA5E2MzS4EI2gjfQhz5X28uqxAiEA3wNFxfrCZlSZHb0gn2zDpWow"
+            + "cSxQAgiCstxGUoOqlW8CIQDDOerGKH5OmCJ4Z21v+F25WaHYPxCFMvwxpcw99Ecv"
+            + "DQIgIdhDTIqD2jfYjPTY8Jj3EDGPbH2HHuffvflECt3Ek60CIQCFRlCkHpi7hthh"
+            + "YhovyloRYsM+IS9h/0BzlEAuO0ktMQIgSPT3aFAgJYwKpqRYKlLDVcflZFCKY7u3"
+            + "UP8iWi1Qw0Y=";
+
+    @Test
+    @DisplayName("加解密往返")
+    void encryptDecrypt_roundTrip()
+    {
+        String uuid = UUID.randomUUID().toString();
+        String cipher = ScreenLoginRsaSupport.encrypt(uuid, PUBLIC_KEY);
+        assertNotNull(cipher);
+        assertEquals(uuid, ScreenLoginRsaSupport.decrypt(cipher, PRIVATE_KEY));
+    }
+
+    @Test
+    @DisplayName("UUID 格式校验")
+    void isValidUuid()
+    {
+        assertTrue(ScreenLoginRsaSupport.isValidUuid("550e8400-e29b-41d4-a716-446655440000"));
+        assertFalse(ScreenLoginRsaSupport.isValidUuid("not-a-uuid"));
+        assertFalse(ScreenLoginRsaSupport.isValidUuid(null));
+    }
+
+    @Test
+    @DisplayName("解密后非 UUID")
+    void decrypt_notUuid()
+    {
+        String cipher = ScreenLoginRsaSupport.encrypt("hello", PUBLIC_KEY);
+        assertFalse(ScreenLoginRsaSupport.isValidUuid(ScreenLoginRsaSupport.decrypt(cipher, PRIVATE_KEY)));
+    }
+}

baqing-admin/src/test/java/com/ruoyi/web/modules/screen/support/ScreenLoginServiceTest.java

@@ -0,0 +1,47 @@
+package com.ruoyi.web.modules.screen.support;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import com.ruoyi.common.exception.ServiceException;
+import com.ruoyi.web.modules.screen.domain.vo.ScreenLoginRsaPublicKeyVo;
+
+@ExtendWith(MockitoExtension.class)
+@DisplayName("ScreenLoginService")
+class ScreenLoginServiceTest
+{
+    private static final String PUBLIC_KEY = "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdH"
+            + "nzkXSOVOZbFu/TJhZ7rFAN+eaGkl3C4buccQd/EjEsj9ir7ijT7h96MCAwEAAQ==";
+
+    @InjectMocks
+    private ScreenLoginService screenLoginService;
+
+    @Mock
+    private ScreenLoginProperties properties;
+
+    @Test
+    @DisplayName("未启用")
+    void disabled()
+    {
+        when(properties.isEnabled()).thenReturn(false);
+        assertThrows(ServiceException.class, () -> screenLoginService.login("any"));
+    }
+
+    @Test
+    @DisplayName("获取 RSA 公钥")
+    void getRsaPublicKey()
+    {
+        when(properties.isEnabled()).thenReturn(true);
+        when(properties.getRsaPublicKey()).thenReturn(PUBLIC_KEY);
+        when(properties.getRsaPrivateKey()).thenReturn("private-key");
+        ScreenLoginRsaPublicKeyVo vo = screenLoginService.getRsaPublicKey();
+        assertEquals(PUBLIC_KEY, vo.getPublicKey());
+    }
+}

doc/大屏/免密登录/大屏免密登录技术方案.md

@@ -0,0 +1,194 @@
+# 大屏 — 免密登录 — 技术方案
+
+> 供 `ruoyi-screen` 等大屏前端**自动登录**：无需账号密码与验证码，通过 RSA 加密 UUID 换取若依 JWT，再访问各 `bigScreen:*` 看板接口。
+
+---
+
+## 1. 技术架构
+
+| 项 | 说明 |
+| --- | --- |
+| **后端** | RuoYi **v3.9.2**（springboot2）：JDK 8、Spring MVC |
+| **代码包** | `com.ruoyi.web.modules.screen`（`ScreenLoginController` / `ScreenLoginService` / `ScreenLoginRsaSupport` / `ScreenLoginProperties`） |
+| **鉴权** | 登录接口 `@Anonymous` 免鉴权；登录成功后与普通若依接口一致，请求头 `Authorization: Bearer <token>` |
+| **专用账号** | `sys_user` 预置用户（默认 `screen_viewer`），建议仅授予 `bigScreen:*:query` |
+| **加密** | `RSA/ECB/PKCS1Padding`，与若依后台 `jsencrypt` 密钥格式兼容 |
+| **客户端 IP** | **不校验**白名单/黑名单；仅写入登录日志 |
+
+**流程**
+
+```mermaid
+sequenceDiagram
+    participant FE as ruoyi-screen
+    participant API as baqing-admin
+    FE->>API: GET /bigScreen/publicKey
+    API-->>FE: data.publicKey
+    FE->>FE: 生成 UUID，JSEncrypt 公钥加密
+    FE->>API: POST /bigScreen/login（X-Screen-Token 或 body.token）
+    API->>API: 私钥解密，校验 UUID 格式
+    API-->>FE: token（JWT）
+    FE->>API: GET /bigScreen/home/dashboard（Authorization）
+```
+
+---
+
+## 2. 配置
+
+### 2.1 `application.yml`
+
+```yaml
+bigscreen:
+  login:
+    enabled: false          # 生产按需 true
+    rsa-public-key: ""      # Base64 公钥（可含换行，服务端会去除空白）
+    rsa-private-key: ""     # Base64 私钥（仅服务端，勿下发前端）
+    username: screen_viewer # 专用 sys_user 登录名
+```
+
+| 项 | 说明 |
+| --- | --- |
+| `enabled` | `false` 时公钥接口与登录接口均返回「大屏免密登录未启用」 |
+| `rsa-public-key` / `rsa-private-key` | 须成对；开发环境可与 `ruoyi-ui/src/utils/jsencrypt.js` 中示例密钥一致 |
+| `username` | 不存在、已删除或停用时登录失败 |
+
+**密钥生成**：可使用 [在线 RSA 密钥对工具](http://web.chacuo.net/netrsakeypair)（JSEncrypt 格式）；生产建议 **2048 位**独立密钥对。
+
+---
+
+## 3. 接口
+
+**Base Path**：`/bigScreen`（含 `server.servlet.context-path`、网关前缀须补齐）。
+
+| 序号 | 说明 | 方法 | 路径 | 鉴权 |
+| --- | --- | --- | --- | --- |
+| 3.1 | 获取 RSA 公钥 | GET | `/bigScreen/publicKey` | 无（`@Anonymous`） |
+| 3.2 | 免密登录换 Token | POST | `/bigScreen/login` | 无（`@Anonymous`） |
+
+### 3.1 获取 RSA 公钥
+
+**请求**：无 Body。
+
+**成功响应**（`AjaxResult`）：
+
+```json
+{
+  "code": 200,
+  "msg": "操作成功",
+  "data": {
+    "publicKey": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdH..."
+  }
+}
+```
+
+| 字段 | 类型 | 说明 |
+| --- | --- | --- |
+| `data.publicKey` | string | Base64 RSA 公钥，供 JSEncrypt `setPublicKey` |
+
+**失败**：未启用或未配置密钥时 `ServiceException`，统一错误提示。
+
+### 3.2 免密登录
+
+**认证载荷**（二选一，优先请求头）：
+
+| 方式 | 说明 |
+| --- | --- |
+| 请求头 | `X-Screen-Token: <RSA 密文 Base64>` |
+| Body | `{ "token": "<RSA 密文 Base64>" }` |
+
+**前端步骤**：
+
+1. 调用 **§3.1** 获取 `publicKey`
+2. 生成标准 UUID（如 `crypto.randomUUID()`）
+3. 使用 JSEncrypt 以公钥加密 UUID 字符串（明文 36 字符）
+4. 将 JSEncrypt 返回的 Base64 密文作为 `token` 提交
+
+**成功响应**（与 `POST /login` 一致）：
+
+```json
+{
+  "code": 200,
+  "msg": "操作成功",
+  "token": "eyJhbGciOiJIUzI1NiJ9..."
+}
+```
+
+后续看板请求：`Authorization: Bearer <token>`。
+
+**失败场景**
+
+| 场景 | 提示（示例） |
+| --- | --- |
+| 未启用 | 大屏免密登录未启用 |
+| 未配置密钥 | 大屏免密登录未配置 RSA 密钥 |
+| 密文为空 / 解密失败 / 明文非 UUID | 大屏登录认证失败 |
+| 专用账号不存在 | 大屏专用账号不存在 |
+| 账号删除 / 停用 | 若依标准 `user.password.delete` / `user.blocked` |
+
+---
+
+## 4. 实现要点
+
+| 类 | 职责 |
+| --- | --- |
+| `ScreenLoginController` | 路由、`X-Screen-Token` / Body 取值 |
+| `ScreenLoginService` | 启用与密钥校验、解密验 UUID、加载专用用户、签发 JWT |
+| `ScreenLoginRsaSupport` | RSA 加解密、`UUID.fromString` 格式校验 |
+| `ScreenLoginProperties` | 绑定 `bigscreen.login.*` |
+| `ScreenLoginConfig` | `@EnableConfigurationProperties` |
+
+**UUID 校验**：解密明文经 `UUID.fromString` 解析，须为标准 8-4-4-4-12 十六进制格式（大小写均可）。
+
+**安全说明**：
+
+- 每次登录应生成**新 UUID** 再加密，避免重放固定密文（服务端当前仅校验格式，不存 nonce）。
+- 私钥仅存服务端配置，禁止写入前端或版本库（生产用环境变量/密钥管理）。
+- 大屏看板接口仍依赖 JWT + `bigScreen:*:query` 权限，与免密登录入口分离。
+
+---
+
+## 5. 前端示例（JSEncrypt）
+
+```javascript
+import JSEncrypt from 'jsencrypt/bin/jsencrypt.min'
+
+async function screenAutoLogin(apiBase) {
+  const keyRes = await fetch(`${apiBase}/bigScreen/publicKey`).then(r => r.json())
+  const uuid = crypto.randomUUID()
+  const encryptor = new JSEncrypt()
+  encryptor.setPublicKey(keyRes.data.publicKey)
+  const cipher = encryptor.encrypt(uuid)
+  if (!cipher) throw new Error('RSA encrypt failed')
+
+  const loginRes = await fetch(`${apiBase}/bigScreen/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token: cipher })
+  }).then(r => r.json())
+
+  return loginRes.token
+}
+```
+
+---
+
+## 6. 交付清单
+
+- [x] `ScreenLoginController`：`GET /bigScreen/publicKey`、`POST /bigScreen/login`
+- [x] `ScreenLoginService` + `ScreenLoginRsaSupport` + `ScreenLoginProperties`
+- [x] `application.yml` → `bigscreen.login.*`
+- [x] 单元测试：`ScreenLoginRsaSupportTest`、`ScreenLoginServiceTest`、`ScreenLoginControllerApiTest`
+- [ ] `ruoyi-screen` 对接自动登录（按本方案调用公钥 + 登录接口）
+
+---
+
+## 7. 与各看板模块关系
+
+| 模块 | 看板 Base Path | 登录后权限示例 |
+| --- | --- | --- |
+| 首页 | `/bigScreen/home` | `bigScreen:home:query` |
+| 交易销售 | `/bigScreen/tradeSales` | `bigScreen:tradeSales:query` |
+| 疫病风险 | `/bigScreen/epidemicRisk` | `bigScreen:epidemicRisk:query` |
+| 畜牧资源 | `/bigScreen/livestockResource` | `bigScreen:livestockResource:query` |
+| 共同富裕 | `/bigScreen/commonProsperity` | `bigScreen:commonProsperity:query` |
+
+免密登录**不替代**上述权限校验；专用账号须在若依中配置对应菜单权限。

doc/大屏/免密登录/大屏免密登录测试用例.md

@@ -0,0 +1,67 @@
+# 大屏 — 免密登录 — 测试用例
+
+> **接口 Base Path**：`/bigScreen`（含 `context-path`、网关前缀须补齐）。登录相关接口 **免鉴权**；登录成功后看板接口鉴权同若依 `Authorization` Token。
+
+---
+
+## 1. 测试范围
+
+| 类型 | 覆盖 |
+| --- | --- |
+| 单元测试 | RSA 加解密往返、UUID 格式校验、Service 启用/公钥、Controller 路由 |
+| 接口测试 | 公钥获取、Header/Body 登录、未启用、错误密文 |
+| UI 测试 | `ruoyi-screen` 自动登录（待前端对接） |
+
+**代码引用**：`ScreenLoginRsaSupportTest`、`ScreenLoginServiceTest`、`ScreenLoginControllerApiTest`。
+
+---
+
+## 2. 单元测试
+
+| 编号 | 模块 | 场景 | 工具 | 前置 | 步骤 | 预期 |
+| --- | --- | --- | --- | --- | --- | --- |
+| DP-ML-UT-001 | RSA | 加解密往返 | JUnit5 | 配置密钥对 | `encrypt(uuid)` → `decrypt` | 明文等于原 UUID |
+| DP-ML-UT-002 | RSA | UUID 合法 | JUnit5 | — | `isValidUuid(标准 UUID)` | true |
+| DP-ML-UT-003 | RSA | UUID 非法 | JUnit5 | — | `isValidUuid("hello")` / null | false |
+| DP-ML-UT-004 | RSA | 解密非 UUID 明文 | JUnit5 | 加密 `"hello"` | 解密后 `isValidUuid` | false |
+| DP-ML-UT-005 | Service | 未启用 | JUnit5 | `enabled=false` | `login(any)` | `ServiceException` |
+| DP-ML-UT-006 | Service | 获取公钥 | JUnit5 | `enabled=true` 且密钥已配 | `getRsaPublicKey()` | 返回配置公钥 |
+
+---
+
+## 3. 接口测试
+
+| 编号 | 场景 | 工具 | 前置 | 请求 | 预期 |
+| --- | --- | --- | --- | --- | --- |
+| DP-ML-API-001 | 获取公钥 | Postman/curl | `enabled=true` | `GET /bigScreen/publicKey` | `code=200`；`data.publicKey` 非空 |
+| DP-ML-API-002 | 未启用 | Postman | `enabled=false` | `GET /bigScreen/publicKey` | 失败；提示未启用 |
+| DP-ML-API-003 | Header 登录 | Postman | 已启用；有效密文 | `POST /bigScreen/login`，头 `X-Screen-Token` | `code=200`；含 `token` |
+| DP-ML-API-004 | Body 登录 | Postman | 已启用；有效密文 | `POST /bigScreen/login`，`{"token":"..."}` | `code=200`；含 `token` |
+| DP-ML-API-005 | 密文为空 | Postman | 已启用 | `POST /bigScreen/login` 无 token | 失败；大屏登录认证失败 |
+| DP-ML-API-006 | 密文非法 | Postman | 已启用 | `token=not-valid-cipher` | 失败；大屏登录认证失败 |
+| DP-ML-API-007 | 专用账号不存在 | Postman | `username` 指向不存在用户 | 有效密文登录 | 失败；大屏专用账号不存在 |
+| DP-ML-API-008 | 登录后访问看板 | Postman | 登录成功 | `GET /bigScreen/home/dashboard?statYear=2026`，带 `Authorization` | 有权限则 200；无权限 403 |
+
+**生成有效密文（联调）**：
+
+1. `GET /bigScreen/publicKey` 取 `publicKey`
+2. 前端 JSEncrypt 或脚本用公钥加密 `crypto.randomUUID()`
+3. 将密文填入 **DP-ML-API-003/004**
+
+---
+
+## 4. 安全与约束
+
+| 编号 | 场景 | 预期 |
+| --- | --- | --- |
+| DP-ML-SEC-001 | 私钥不出现在公钥接口响应 | `data` 仅含 `publicKey` |
+| DP-ML-SEC-002 | 登录接口不校验客户端 IP | 任意 IP 可调用（仍须有效密文） |
+| DP-ML-SEC-003 | 看板接口未带 JWT | `GET .../dashboard` 返回 401 |
+
+---
+
+## 5. 修订记录
+
+| 版本 | 说明 |
+| --- | --- |
+| 1.0 | 初版：RSA 公钥 + UUID 加密登录；路径 `GET /bigScreen/publicKey`、`POST /bigScreen/login` |

doc/大屏/共同富裕/大屏共同富裕技术方案.md

@@ -100,7 +100,7 @@
 
 **Base Path**：`/bigScreen/commonProsperity`
 
-> 大屏若部署为**免登录展示**，在 `SecurityConfig` 对白名单路径放行，**不在** Controller 使用 `@Anonymous` 写死；生产环境默认仍走若依 Token + 上表权限。
+> 大屏若部署为**免登录展示**，可调用 **《大屏免密登录技术方案》**（`doc/大屏/免密登录/大屏免密登录技术方案.md`）中 `POST /bigScreen/login` 换取 JWT；看板接口仍走 Token + 权限，**不在**各看板 Controller 使用 `@Anonymous` 写死。
 
 | # | 说明 | Method | URI | 权限 |
 | --- | --- | --- | --- | --- |