用户的新增与修改需要满足存储安全性与完整性

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java

@@ -83,6 +83,31 @@ public class SysProfileController extends BaseController {
         }
         int rows = DataPermissionHelper.ignore(() -> userService.updateUserProfile(user));
         if (rows > 0) {
+            if (StringUtils.isNotEmpty(user.getPhonenumber())) {
+                try {
+                    String bizId = String.valueOf(user.getUserId());
+                    String phoneCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "phonenumber", user.getPhonenumber());
+                    if (StringUtils.isNotBlank(phoneCipher)) {
+                        SysUserBo phoneBo = new SysUserBo();
+                        phoneBo.setUserId(user.getUserId());
+                        phoneBo.setPhonenumber(phoneCipher);
+                        DataPermissionHelper.ignore(() -> userService.updateUserProfile(phoneBo));
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密手机号失败, userId={}", user.getUserId(), e);
+                }
+            }
+            try {
+                String bizId = String.valueOf(user.getUserId());
+                SysUserVo updatedUser = userService.selectUserById(user.getUserId());
+                ICryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
+                    "password,phonenumber,certificateNumber",
+                    updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
+                    updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
+                    updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
+            } catch (Exception e) {
+                log.warn("HSM完整性摘要更新失败, userId={}", user.getUserId(), e);
+            }
             return R.ok();
         }
         return R.fail("修改个人信息异常，请联系管理员");
@@ -124,7 +149,10 @@ public class SysProfileController extends BaseController {
         int rows = DataPermissionHelper.ignore(() -> userService.resetUserPwd(user.getUserId(), newEncrypted));
         if (rows > 0) {
             try {
-                ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", newEncrypted);
+                String passwordCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", newEncrypted);
+                if (StringUtils.isNotBlank(passwordCipher)) {
+                    DataPermissionHelper.ignore(() -> userService.resetUserPwd(user.getUserId(), passwordCipher));
+                }
             } catch (Exception e) {
                 log.warn("HSM加密新密码失败, userId={}", user.getUserId(), e);
             }
@@ -132,7 +160,7 @@ public class SysProfileController extends BaseController {
                 SysUserVo updatedUser = userService.selectUserById(user.getUserId());
                 ICryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
                     "password,phonenumber,certificateNumber",
-                    newEncrypted,
+                    updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
                     updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
                     updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
             } catch (Exception e) {

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysUserController.java

@@ -183,7 +183,52 @@ public class SysUserController extends BaseController {
         user.randomSalt();
         String loginAccount = StringUtils.isNotBlank(user.getLoginName()) ? user.getLoginName() : user.getUserName();
         user.setPassword(DigestUtil.md5Hex(loginAccount + user.getPassword() + user.getSalt()));
-        return toAjax(userService.insertUser(user));
+        int rows = userService.insertUser(user);
+        if (rows > 0) {
+            String bizId = String.valueOf(user.getUserId());
+            try {
+                String passwordCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", user.getPassword());
+                if (StringUtils.isNotBlank(passwordCipher)) {
+                    userService.resetUserPwd(user.getUserId(), passwordCipher);
+                }
+            } catch (Exception e) {
+                log.warn("HSM加密密码失败, userId={}", user.getUserId(), e);
+            }
+            if (StringUtils.isNotEmpty(user.getPhonenumber())) {
+                try {
+                    String phoneCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "phonenumber", user.getPhonenumber());
+                    if (StringUtils.isNotBlank(phoneCipher)) {
+                        userService.updateUserProfile(new SysUserBo() {{ setUserId(user.getUserId()); setPhonenumber(phoneCipher); }});
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密手机号失败, userId={}", user.getUserId(), e);
+                }
+            }
+            if (StringUtils.isNotEmpty(user.getCertificateNumber())) {
+                try {
+                    String certCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "certificateNumber", user.getCertificateNumber());
+                    if (StringUtils.isNotBlank(certCipher)) {
+                        org.dromara.system.domain.bo.SysUserBo certBo = new org.dromara.system.domain.bo.SysUserBo();
+                        certBo.setUserId(user.getUserId());
+                        certBo.setCertificateNumber(certCipher);
+                        userService.updateUserById(certBo);
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密证件号失败, userId={}", user.getUserId(), e);
+                }
+            }
+            try {
+                SysUserVo updatedUser = userService.selectUserById(user.getUserId());
+                ICryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
+                    "password,phonenumber,certificateNumber",
+                    updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
+                    updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
+                    updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
+            } catch (Exception e) {
+                log.warn("HSM完整性摘要更新失败, userId={}", user.getUserId(), e);
+            }
+        }
+        return toAjax(rows);
     }
 
     /**
@@ -204,7 +249,47 @@ public class SysUserController extends BaseController {
         } else if (StringUtils.isNotEmpty(user.getEmail()) && !userService.checkEmailUnique(user)) {
             return R.fail("修改用户'" + user.getUserName() + "'失败，邮箱账号已存在");
         }
-        return toAjax(userService.updateUser(user));
+        int rows = userService.updateUser(user);
+        if (rows > 0) {
+            String bizId = String.valueOf(user.getUserId());
+            if (StringUtils.isNotBlank(user.getPhonenumber())) {
+                try {
+                    String phoneCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "phonenumber", user.getPhonenumber());
+                    if (StringUtils.isNotBlank(phoneCipher)) {
+                        SysUserBo phoneBo = new SysUserBo();
+                        phoneBo.setUserId(user.getUserId());
+                        phoneBo.setPhonenumber(phoneCipher);
+                        userService.updateUserProfile(phoneBo);
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密手机号失败, userId={}", user.getUserId(), e);
+                }
+            }
+            if (StringUtils.isNotBlank(user.getCertificateNumber())) {
+                try {
+                    String certCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "certificateNumber", user.getCertificateNumber());
+                    if (StringUtils.isNotBlank(certCipher)) {
+                        SysUserBo certBo = new SysUserBo();
+                        certBo.setUserId(user.getUserId());
+                        certBo.setCertificateNumber(certCipher);
+                        userService.updateUserById(certBo);
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密证件号失败, userId={}", user.getUserId(), e);
+                }
+            }
+            try {
+                SysUserVo updatedUser = userService.selectUserById(user.getUserId());
+                ICryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
+                    "password,phonenumber,certificateNumber",
+                    updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
+                    updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
+                    updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
+            } catch (Exception e) {
+                log.warn("HSM完整性摘要更新失败, userId={}", user.getUserId(), e);
+            }
+        }
+        return toAjax(rows);
     }
 
     /**
@@ -254,7 +339,10 @@ public class SysUserController extends BaseController {
         if (rows > 0) {
             try {
                 String bizId = String.valueOf(user.getUserId());
-                ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", md5Password);
+                String passwordCipher = ICryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", md5Password);
+                if (StringUtils.isNotBlank(passwordCipher)) {
+                    userService.resetUserPwd(user.getUserId(), passwordCipher);
+                }
             } catch (Exception e) {
                 log.warn("HSM加密重置密码失败, userId={}", user.getUserId(), e);
             }
@@ -263,7 +351,7 @@ public class SysUserController extends BaseController {
                 SysUserVo updatedUser = userService.selectUserById(user.getUserId());
                 ICryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
                     "password,phonenumber,certificateNumber",
-                    md5Password,
+                    updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
                     updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
                     updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
             } catch (Exception e) {

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/listener/SysUserImportListener.java

@@ -20,6 +20,7 @@ import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.system.domain.bo.SysUserBo;
 import org.dromara.system.domain.vo.SysUserImportVo;
 import org.dromara.system.domain.vo.SysUserVo;
+import org.dromara.system.service.ICryptoSensitiveHsmService;
 import org.dromara.system.service.ISysConfigService;
 import org.dromara.system.service.ISysUserService;
 import lombok.extern.slf4j.Slf4j;
@@ -59,7 +60,7 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
     public void invoke(SysUserImportVo userVo, AnalysisContext context) {
         SysUserVo sysUser = this.userService.selectUserByUserName(userVo.getUserName());
         try {
-            // 验证是否存在这个用户
+            ICryptoSensitiveHsmService hsmService = SpringUtils.getBean(ICryptoSensitiveHsmService.class);
             if (ObjectUtil.isNull(sysUser)) {
                 SysUserBo user = BeanUtil.toBean(userVo, SysUserBo.class);
                 ValidatorUtils.validate(user);
@@ -68,6 +69,27 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
                 user.setPassword(DigestUtil.md5Hex(loginAccount + initPassword + user.getSalt()));
                 user.setCreateBy(operUserId);
                 userService.insertUser(user);
+
+                String bizId = String.valueOf(user.getUserId());
+                try {
+                    String passwordCipher = hsmService.encryptAndSave("sys_user", bizId, "password", user.getPassword());
+                    if (StringUtils.isNotBlank(passwordCipher)) {
+                        userService.resetUserPwd(user.getUserId(), passwordCipher);
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密导入用户密码失败, userId={}", user.getUserId(), e);
+                }
+                try {
+                    SysUserVo updatedUser = userService.selectUserById(user.getUserId());
+                    hsmService.saveIntegrityHash("sys_user", bizId,
+                        "password,phonenumber,certificateNumber",
+                        updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
+                        updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
+                        updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
+                } catch (Exception e) {
+                    log.warn("HSM完整性摘要更新失败, userId={}", user.getUserId(), e);
+                }
+
                 successNum++;
                 successMsg.append("<br/>").append(successNum).append("、账号 ").append(user.getUserName()).append(" 导入成功");
             } else if (isUpdateSupport) {
@@ -79,6 +101,41 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
                 userService.checkUserDataScope(user.getUserId());
                 user.setUpdateBy(operUserId);
                 userService.updateUser(user);
+
+                String bizId = String.valueOf(userId);
+                try {
+                    if (StringUtils.isNotBlank(user.getPhonenumber())) {
+                        String phoneCipher = hsmService.encryptAndSave("sys_user", bizId, "phonenumber", user.getPhonenumber());
+                        if (StringUtils.isNotBlank(phoneCipher)) {
+                            SysUserBo phoneBo = new SysUserBo();
+                            phoneBo.setUserId(userId);
+                            phoneBo.setPhonenumber(phoneCipher);
+                            userService.updateUserProfile(phoneBo);
+                        }
+                    }
+                    if (StringUtils.isNotBlank(user.getCertificateNumber())) {
+                        String certCipher = hsmService.encryptAndSave("sys_user", bizId, "certificateNumber", user.getCertificateNumber());
+                        if (StringUtils.isNotBlank(certCipher)) {
+                            SysUserBo certBo = new SysUserBo();
+                            certBo.setUserId(userId);
+                            certBo.setCertificateNumber(certCipher);
+                            userService.updateUserById(certBo);
+                        }
+                    }
+                } catch (Exception e) {
+                    log.warn("HSM加密导入用户敏感字段失败, userId={}", userId, e);
+                }
+                try {
+                    SysUserVo updatedUser = userService.selectUserById(userId);
+                    hsmService.saveIntegrityHash("sys_user", bizId,
+                        "password,phonenumber,certificateNumber",
+                        updatedUser.getPassword() != null ? updatedUser.getPassword() : "",
+                        updatedUser.getPhonenumber() != null ? updatedUser.getPhonenumber() : "",
+                        updatedUser.getCertificateNumber() != null ? updatedUser.getCertificateNumber() : "");
+                } catch (Exception e) {
+                    log.warn("HSM完整性摘要更新失败, userId={}", userId, e);
+                }
+
                 successNum++;
                 successMsg.append("<br/>").append(successNum).append("、账号 ").append(user.getUserName()).append(" 更新成功");
             } else {

zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/SysTenantServiceImpl.java

@@ -29,6 +29,7 @@ import org.dromara.system.domain.*;
 import org.dromara.system.domain.bo.SysTenantBo;
 import org.dromara.system.domain.vo.SysTenantVo;
 import org.dromara.system.mapper.*;
+import org.dromara.system.service.ICryptoSensitiveHsmService;
 import org.dromara.system.service.ISysTenantService;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Cacheable;
@@ -37,6 +38,8 @@ import org.springframework.transaction.annotation.Transactional;
 
 import java.util.*;
 
+import static software.amazon.awssdk.http.nio.netty.internal.ProxyTunnelInitHandler.log;
+
 /**
  * 租户Service业务层处理
  *
@@ -165,6 +168,22 @@ public class SysTenantServiceImpl implements ISysTenantService {
         sd.setDeptId(deptId);
         deptMapper.updateById(sd);
 
+        try {
+            String bizId = String.valueOf(user.getUserId());
+            String passwordCipher = SpringUtils.getBean(ICryptoSensitiveHsmService.class)
+                .encryptAndSave("sys_user", bizId, "password", user.getPassword());
+            if (StringUtils.isNotBlank(passwordCipher)) {
+                userMapper.update(null, new com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper<SysUser>()
+                    .eq(SysUser::getUserId, user.getUserId())
+                    .set(SysUser::getPassword, passwordCipher));
+            }
+            SpringUtils.getBean(ICryptoSensitiveHsmService.class)
+                .saveIntegrityHash("sys_user", bizId, "password,phonenumber,certificateNumber",
+                    passwordCipher != null ? passwordCipher : user.getPassword(), "", "");
+        } catch (Exception e) {
+
+        }
+
         // 用户和角色关联表
         SysUserRole userRole = new SysUserRole();
         userRole.setUserId(user.getUserId());

zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/SysRegisterService.java

@@ -3,6 +3,7 @@ package org.dromara.web.service;
 import cn.hutool.crypto.digest.BCrypt;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.constant.Constants;
 import org.dromara.common.core.constant.GlobalConstants;
 import org.dromara.common.core.domain.model.RegisterBody;
@@ -21,6 +22,7 @@ import org.dromara.common.web.config.properties.CaptchaProperties;
 import org.dromara.system.domain.SysUser;
 import org.dromara.system.domain.bo.SysUserBo;
 import org.dromara.system.mapper.SysUserMapper;
+import org.dromara.system.service.ICryptoSensitiveHsmService;
 import org.dromara.system.service.ISysUserService;
 import org.springframework.stereotype.Service;
 
@@ -29,6 +31,7 @@ import org.springframework.stereotype.Service;
  *
  * @author Lion Li
  */
+@Slf4j
 @RequiredArgsConstructor
 @Service
 public class SysRegisterService {
@@ -36,6 +39,7 @@ public class SysRegisterService {
     private final ISysUserService userService;
     private final SysUserMapper userMapper;
     private final CaptchaProperties captchaProperties;
+    private final ICryptoSensitiveHsmService cryptoSensitiveHsmService;
 
     /**
      * 注册
@@ -69,6 +73,19 @@ public class SysRegisterService {
         if (!regFlag) {
             throw new UserException("user.register.error");
         }
+        try {
+            String bizId = String.valueOf(sysUser.getUserId());
+            String passwordCipher = cryptoSensitiveHsmService.encryptAndSave("sys_user", bizId, "password", sysUser.getPassword());
+            if (StringUtils.isNotBlank(passwordCipher)) {
+                userService.resetUserPwd(sysUser.getUserId(), passwordCipher);
+            }
+            cryptoSensitiveHsmService.saveIntegrityHash("sys_user", bizId,
+                "password,phonenumber,certificateNumber",
+                passwordCipher != null ? passwordCipher : (sysUser.getPassword() != null ? sysUser.getPassword() : ""),
+                "", "");
+        } catch (Exception e) {
+            log.error("HSM加密用户密码失败, userId={}", sysUser.getUserId(), e);
+        }
         recordLogininfor(tenantId, username, Constants.REGISTER, MessageUtils.message("user.register.success"));
     }