AppName 限制不可重复；JobGoup本地缓存；

doc/XXL-JOB官方文档.md

@@ -2905,7 +2905,7 @@ alter table xxl_job_log
 - 1、【新增】GLUE模式开关：新增GLUE模式开关（xxl.job.executor.glueenabled），支持执行器维度设置是否启用GLUE模式；
 - 2、【TODO】执行器AccessToken：执行器维度AccessToken，线上化动态管理；执行器间AccessToken隔离，提升安全性；
   - 执行器：ExecutorBiz 服务处理、AdminBiz请求发起，统一附加 appname + accessToken；
-  - 调度中心：AppName 限制不可重复；JobGoup本地缓存；
+  - 调度中心：AppName 限制不可重复 + accessToken 必填；JobGoup本地缓存；AdminBiz 服务处理 校验参数；
 - 3、【TODO】调度中心OpenAPI增强：提供任务管理能力；封装Agent Skill并推送ClawHub；
 - 4、【TODO】配置线上化：发送邮箱配置线上管理、线程池配置调整；
 - 5、【TODO】任务告警：拆分“告警类型、告警配置”属性，支持Webhook、邮箱多种方式；

xxl-job-admin/src/main/java/com/xxl/job/admin/business/model/XxlJobGroup.java

@@ -17,13 +17,15 @@ public class XxlJobGroup {
     private String title;
     private int addressType;        // 执行器地址类型：0=自动注册、1=手动录入
     private String addressList;     // 执行器地址列表，多地址逗号分隔(手动录入)
+    private String accessToken;
     private Date updateTime;
 
     // registry list
     private List<String> registryList;  // 执行器地址列表(系统注册)
     public List<String> getRegistryList() {
+
         if (StringTool.isNotBlank(addressList)) {
-            registryList = new ArrayList<>(Arrays.asList(addressList.split(",")));
+            registryList = StringTool.split(addressList, ",");
         }
         return registryList;
     }
@@ -64,6 +66,18 @@ public class XxlJobGroup {
         return addressList;
     }
 
+    public void setAddressList(String addressList) {
+        this.addressList = addressList;
+    }
+
+    public String getAccessToken() {
+        return accessToken;
+    }
+
+    public void setAccessToken(String accessToken) {
+        this.accessToken = accessToken;
+    }
+
     public Date getUpdateTime() {
         return updateTime;
     }
@@ -72,10 +86,6 @@ public class XxlJobGroup {
         this.updateTime = updateTime;
     }
 
-    public void setAddressList(String addressList) {
-        this.addressList = addressList;
-    }
-
     @Override
     public String toString() {
         return "XxlJobGroup{" +
@@ -84,8 +94,8 @@ public class XxlJobGroup {
                 ", title='" + title + '\'' +
                 ", addressType=" + addressType +
                 ", addressList='" + addressList + '\'' +
+                ", accessToken='" + accessToken + '\'' +
                 ", updateTime=" + updateTime +
-                ", registryList=" + registryList +
                 '}';
     }
 

xxl-job-admin/src/main/java/com/xxl/job/admin/business/scheduler/openapi/OpenApiController.java

@@ -1,5 +1,6 @@
 package com.xxl.job.admin.business.scheduler.openapi;
 
+import com.xxl.job.admin.business.model.XxlJobGroup;
 import com.xxl.job.admin.business.scheduler.config.XxlJobAdminBootstrap;
 import com.xxl.job.core.constant.Const;
 import com.xxl.job.core.openapi.admin.AdminBiz;
@@ -30,9 +31,10 @@ public class OpenApiController {
     @ResponseBody
     @XxlSso(login = false)
     public Object api(HttpServletRequest request,
-                               @PathVariable("uri") String uri,
-                               @RequestHeader(value = Const.XXL_JOB_ACCESS_TOKEN, required = false) String accesstoken,
-                               @RequestBody(required = false) String requestBody) {
+                      @PathVariable("uri") String uri,
+                      @RequestHeader(value = Const.XXL_JOB_ACCESS_TOKEN, required = false) String accessToken,
+                      @RequestHeader(value = Const.XXL_JOB_APPNAME, required = false) String appname,
+                      @RequestBody(required = false) String requestBody) {
 
         // valid
         if (!"POST".equalsIgnoreCase(request.getMethod())) {
@@ -45,10 +47,13 @@ public class OpenApiController {
             return Response.ofFail("invalid request, requestBody empty.");
         }
 
-        // valid token
-        if (StringTool.isNotBlank(XxlJobAdminBootstrap.getInstance().getAccessToken())
-                && !XxlJobAdminBootstrap.getInstance().getAccessToken().equals(accesstoken)) {
-            return Response.ofFail("The access token is wrong.");
+        // valid: appname + accessToken
+        if (StringTool.isBlank(accessToken) || StringTool.isBlank(appname)) {
+            return Response.ofFail("invalid request, accessToken or appname is empty.");
+        }
+        XxlJobGroup xxlJobGroup = XxlJobAdminBootstrap.getInstance().getJobRegistryHelper().loadByAppName(appname);
+        if (!(xxlJobGroup!=null && accessToken.equals(xxlJobGroup.getAccessToken()))) {
+            return Response.ofFail("invalid request, accessToken or appname invalid.");
         }
 
         // dispatch request

xxl-job-admin/src/test/java/com/xxl/job/openapi/AdminBizTest.java

@@ -13,7 +13,6 @@ import org.junit.jupiter.api.Test;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.util.Arrays;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -28,6 +27,7 @@ public class AdminBizTest {
 
     private static String addressUrl = "http://127.0.0.1:8080";
     private static String accessToken = "default_token";
+    private static String appname = "xxl-job-executor-sample";
 
     private AdminBiz buildClient(){
         String finalUrl = addressUrl + "/api";
@@ -36,6 +36,7 @@ public class AdminBizTest {
                 .url(finalUrl)
                 .timeout(3 * 1000)
                 .header(Const.XXL_JOB_ACCESS_TOKEN, accessToken)
+                .header(Const.XXL_JOB_APPNAME, appname)
                 .proxy(AdminBiz.class);
     }
 

xxl-job-core/src/main/java/com/xxl/job/core/executor/XxlJobExecutor.java

@@ -242,6 +242,7 @@ public class XxlJobExecutor  {
                     .url(finalAddress)
                     .timeout(finalTimeout * 1000)
                     .header(Const.XXL_JOB_ACCESS_TOKEN, accessToken)
+                    .header(Const.XXL_JOB_APPNAME, appname)
                     .proxy(AdminBiz.class);
 
             // registry