回退了登录加密功能

zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java

@@ -89,7 +89,11 @@ public class AppEnfLoginController extends LoginController {
         }
 
         // 5. MD5加盐校验密码（使用loginName作为加盐因子）
-        if (!verifyPasswordWithHsm(user.getUserId(), loginName, decryptedPassword, user.getSalt(), user.getPassword())) {
+//        if (!verifyPasswordWithHsm(user.getUserId(), loginName, decryptedPassword, user.getSalt(), user.getPassword())) {
+//            return R.fail("用户名或密码错误");
+//        }
+
+        if (!verifyPassword(loginName, decryptedPassword, user.getSalt(), user.getPassword())) {
             return R.fail("用户名或密码错误");
         }
 

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/CryptoSensitiveController.java

@@ -54,4 +54,37 @@ public class CryptoSensitiveController extends BaseController {
         cryptoSensitiveHsmService.syncIntegrityHashModifiedOperLogs();
         return R.ok();
     }
+
+    /**
+     * 测试 HSM 解密逻辑：解密 crypto_sensitive_data 中指定记录的密文字段
+     *
+     * @param tableName 业务表名，为空默认 sys_user
+     * @param bizId     业务记录主键（sys_user 时为用户ID），必填
+     * @param fieldCode 字段编码，为空默认 phonenumber（可选 phonenumber / certificateNumber 等）
+     */
+    @PostMapping("/testDecrypt")
+    public R<String> testDecrypt(String tableName, String bizId, String fieldCode) {
+        if (bizId == null || bizId.isBlank()) {
+            return R.fail("bizId 不能为空");
+        }
+        if (tableName == null || tableName.isBlank()) {
+            tableName = "sys_user";
+        }
+        if (fieldCode == null || fieldCode.isBlank()) {
+            fieldCode = "phonenumber";
+        }
+        long start = System.currentTimeMillis();
+        String plain = cryptoSensitiveHsmService.decryptField(tableName, bizId, fieldCode);
+        long cost = System.currentTimeMillis() - start;
+        // 按规范：HSM 解密失败返回 null（禁止返回空串）
+        if (plain == null) {
+            log.warn("测试解密失败: tableName={}, bizId={}, fieldCode={}, cost={}ms",
+                tableName, bizId, fieldCode, cost);
+            return R.fail("解密失败或密文记录不存在(HSM返回null)，tableName=%s, bizId=%s, fieldCode=%s"
+                .formatted(tableName, bizId, fieldCode));
+        }
+        log.info("测试解密成功: tableName={}, bizId={}, fieldCode={}, cost={}ms",
+            tableName, bizId, fieldCode, cost);
+        return R.ok("解密成功，耗时" + cost + "ms", plain);
+    }
 }

zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java

@@ -48,7 +48,7 @@ public class PasswordAuthStrategy implements IAuthStrategy {
     private final SysLoginService loginService;
     private final SysUserMapper userMapper;
     private final PasswordService passwordService;
-    private final ICryptoSensitiveHsmService ICryptoSensitiveHsmService;
+    private final ICryptoSensitiveHsmService iCryptoSensitiveHsmService;
 
     @Override
     public LoginVo login(String body, SysClientVo client) {
@@ -68,14 +68,14 @@ public class PasswordAuthStrategy implements IAuthStrategy {
             SysUser user = loadUserByUsername(username);
             loginService.checkLogin(LoginType.PASSWORD, tenantId, username, () -> {
                 String bizId = String.valueOf(user.getUserId());
-                try {
-                    return !ICryptoSensitiveHsmService.verifyPassword("sys_user", bizId, password);
-                } catch (Exception e) {
+//                try {
+//                    return !ICryptoSensitiveHsmService.verifyPassword("sys_user", bizId, password);
+//                } catch (Exception e) {
                     log.warn("HSM密码校验失败, userId={}, 降级使用MD5校验", user.getUserId());
                     String salt = user.getSalt();
                     String encodedPassword = user.getPassword();
                     return !passwordService.matches(password, encodedPassword, username, salt);
-                }
+//                }
             });
             return loginService.buildLoginUser(user);
         });