open api 商户查询范围鉴权

device-api-service/src/main/java/com/xy/open/DeviceOpenApiService.java

@@ -5,11 +5,17 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.xy.annotate.RestMappingController;
 import com.xy.annotation.Open;
+import com.xy.bean.OpenContext;
+import com.xy.bean.ServiceContext;
+import com.xy.dto.OpenPlatformConfigDto;
 import com.xy.entity.DeviceInfo;
+import com.xy.exception.ServiceException;
 import com.xy.open.dto.DeviceOpenApiDTO;
 import com.xy.open.vo.DeviceOpenApiVO;
 import com.xy.service.DeviceInfoServiceImpl;
+import com.xy.service.OpenPlatformConfigService;
 import com.xy.utils.PageBean;
+import com.xy.utils.R;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
@@ -36,11 +42,20 @@ import static com.xy.utils.PlusBeans.toPageBean;
 public class DeviceOpenApiService {
 
     private final DeviceInfoServiceImpl deviceInfoService;
+    private final OpenPlatformConfigService openPlatformConfigService;
 
     @ApiOperation(value = "获取商户设备列表", notes = "获取商户设备列表")
     @Open(value = "device.page.get", version = "1.0", permission = true)
     @PostMapping("/device/page/get")
     public PageBean<DeviceOpenApiVO.DeviceList> devicePageGet(@RequestBody @Valid DeviceOpenApiDTO.DeviceListGet dto, HttpServletRequest request) {
+        OpenContext oct = ServiceContext.getCurrentContext().getOpenContext();
+        String appId = oct.getAppId();
+        String appAuthToken = oct.getAppAuthToken();
+        log.info("DeviceOpenApiService#devicePageGet appId={}, appAuthToken={}", appId, appAuthToken);
+        boolean b = R.feignCheckData(openPlatformConfigService.checkAuthByMercCode(new OpenPlatformConfigDto.CheckAuth().setAppId(appId).setMercCodes(dto.getMercCodes())));
+        if (!b) {
+            throw new ServiceException("您传入的商户编码中包含非法编码！");
+        }
         PageBean pageBean = dto.getPage();
         LambdaQueryWrapper<DeviceInfo> lqw = Wrappers.<DeviceInfo>lambdaQuery()
                 .in(DeviceInfo::getMercCode, dto.getMercCodes()