feat 新增白名单消费token 功能

server/application/common/server/ConsumeTokenService.php

@@ -80,8 +80,49 @@ class ConsumeTokenService
 
     private static function isExcluded($request)
     {
-        return strtolower($request->controller()) === 'account'
-            && strtolower($request->action()) === 'consumetoken';
+        $paths = config('consume_token.exclude_paths');
+        if (!is_array($paths)) {
+            $paths = [];
+        }
+        $paths[] = '/api/account/consumeToken';
+
+        $candidates = [];
+        if (method_exists($request, 'path')) {
+            $candidates[] = self::normalizePath($request->path());
+        }
+        $candidates[] = self::normalizePath('/api/' . $request->controller() . '/' . $request->action());
+
+        foreach ($paths as $pattern) {
+            foreach ($candidates as $path) {
+                if ($path !== '' && self::pathMatches($pattern, $path)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    private static function normalizePath($path)
+    {
+        $path = '/' . trim(strtolower((string) $path), '/');
+        return $path === '/' ? '' : $path;
+    }
+
+    private static function pathMatches($pattern, $path)
+    {
+        $pattern = self::normalizePath($pattern);
+        if ($pattern === '' || $path === '') {
+            return false;
+        }
+        if ($pattern === $path) {
+            return true;
+        }
+
+        $regex = preg_quote($pattern, '#');
+        $regex = str_replace('\*\*', '.*', $regex);
+        $regex = str_replace('\*', '[^/]*', $regex);
+        return preg_match('#^' . $regex . '$#', $path) === 1;
     }
 
     private static function create()

server/config/consume_token.php

@@ -14,4 +14,23 @@ return [
     'enabled' => (bool) $enabled,
     // Keep the ticket short-lived even if a deployment sets an unsafe value.
     'ttl' => min(max($ttl, 1), 600),
+    // Paths that still require login/token when applicable, but do not require X-Consume-Token.
+    // Synced with the Java front/admin consume-token exclude list and mapped to this ThinkPHP API.
+    'exclude_paths' => [
+        '/api/account/consumeToken',
+        '/api/account/passwordKey',
+        '/api/account/updateUser',
+        '/api/payment/notifyMnp',
+        '/api/payment/notifyOa',
+        '/api/payment/notifyApp',
+        '/api/payment/aliNotify',
+        '/api/pay/wx/notify/**',
+        '/api/pay/ali/notify/**',
+        '/api/channel/oa/callback',
+        '/api/consumeToken',
+        '/api/system/consumeToken',
+        '/api/system/passwordKey',
+        '/api/login/passwordKey',
+        '/api/user/updateUser',
+    ],
 ];