外贸独立站生态对接技术方案：基于轻易云数据集成平台的SSO集成实践

┌─────────────────────────────────────────────────────────────┐
│                    用户访问层 (PC/移动端)                      │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                  轻易云数据集成平台 (SSO中枢)                  │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐  │
│  │  统一认证层  │  │  页面嵌入层  │  │     数据同步层       │  │
│  │  CAS Server │  │  微前端架构  │  │   RESTful/OData API │  │
│  │  OAuth2/OIDC│  │  iframe嵌入 │  │   18类基础数据模型   │  │
│  └─────────────┘  └─────────────┘  └─────────────────────┘  │
└─────────────────────────────────────────────────────────────┘
                              │
            ┌─────────────────┼─────────────────┐
            ▼                 ▼                 ▼
   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
   │  独立站系统  │   │   ERP系统   │   │   OA系统    │
   │ WooCommerce │   │  金蝶/用友   │   │   泛微/钉钉  │
   │   Shopify   │   │   SAP/Odoo  │   │   企业微信   │
   └─────────────┘   └─────────────┘   └─────────────┘

┌────────────────────────────────────────┐
│           安全传输层 (TLS 1.3)          │
├────────────────────────────────────────┤
│         身份认证层 (CAS/OAuth2)         │
├────────────────────────────────────────┤
│         权限控制层 (RBAC模型)           │
├────────────────────────────────────────┤
│         数据加密层 (AES-256)            │
├────────────────────────────────────────┤
│         审计日志层 (全链路追踪)          │
└────────────────────────────────────────┘

// SSO插件示例（Java）
@Component
public class StoreSSOPlugin implements AuthenticationFilter {
    
    @Override
    public AuthenticationResult authenticate(SSORequest request) {
        // 1. 解密用户信息（AES-256）
        String encryptedUser = request.getParameter("oaLoginName");
        String userJson = AESUtil.decrypt(encryptedUser, secretKey);
        
        // 2. 验证用户身份
        UserInfo user = JSON.parseObject(userJson, UserInfo.class);
        boolean valid = validateUser(user);
        
        // 3. 建立本地会话
        if (valid) {
            String sessionToken = JWT.create()
                .withSubject(user.getUserId())
                .withExpiresAt(new Date(System.currentTimeMillis() + 3600000))
                .sign(Algorithm.HMAC256(jwtSecret));
            
            return AuthenticationResult.success(sessionToken, user);
        }
        
        return AuthenticationResult.failure("Invalid credentials");
    }
    
    @Override
    public void logout(String sessionToken) {
        // 清除本地会话并通知CAS服务器
        sessionCache.invalidate(sessionToken);
        casServer.notifyLogout(sessionToken);
    }
}

独立站下单 → 轻易云API网关 → 数据格式转换 → ERP订单创建
     ↑                                              ↓
   状态回传 ← 物流信息同步 ← 库存扣减确认 ← 订单处理完成

# 轻易云数据流配置示例
{
  "flowName": "独立站订单同步",
  "trigger": {
    "type": "webhook",
    "endpoint": "/woocommerce/order-created"
  },
  "transformers": [
    {
      "type": "fieldMapping",
      "rules": {
        "order_id": "billNo",
        "customer_email": "contactEmail",
        "line_items": "orderDetails"
      }
    },
    {
      "type": "dataValidation",
      "rules": {
        "required": ["billNo", "contactEmail", "orderDetails"],
        "format": {
          "contactEmail": "email",
          "orderDetails": "array"
        }
      }
    }
  ],
  "target": {
    "system": "Kingdee",
    "api": "/api/orders/create",
    "method": "POST"
  }
}

# cas-server-config.yml
cas:
  server:
    url: https://cas.qeasy.cloud
    port: 443
    ssl:
      enabled: true
      protocol: TLSv1.3
      
  ticket:
    tgt:
      timeout: 28800  # 8小时
    st:
      timeout: 300    # 5分钟
      
  authn:
    accept:
      users:
        - admin::password::admin-role
        - operator::password::operator-role
        
  services:
    - name: "WooCommerce独立站"
      serviceId: "https://store.example.com/.*"
      evaluationOrder: 1
      attributeReleasePolicy:
        allowedAttributes:
          - userId
          - username
          - department
          - email

// cas-sso-config.php
return [
    'cas_server' => 'https://cas.qeasy.cloud',
    'cas_port' => 443,
    'cas_uri' => '/cas',
    'service_url' => 'https://store.example.com/cas-callback',
    
    // 用户字段映射
    'attribute_mapping' => [
        'user_login' => 'username',
        'user_email' => 'email',
        'display_name' => 'username',
        'role' => 'department'
    ],
    
    // 登录后跳转配置
    'redirect_after_login' => '/wp-admin',
    'redirect_after_logout' => 'https://cas.qeasy.cloud/logout',
    
    // 安全设置
    'ssl_verify' => true,
    'ticket_validation' => 'ST-strict'
];

# 订单同步测试脚本
import requests
import json
import time

def test_order_sync():
    # 1. 在独立站创建测试订单
    order_payload = {
        "customer_id": 12345,
        "line_items": [
            {"product_id": 101, "quantity": 2, "price": 99.99}
        ],
        "shipping": {"address": "Test St 123", "city": "Shanghai"}
    }
    
    # 2. 调用独立站API创建订单
    wc_response = requests.post(
        "https://store.example.com/wp-json/wc/v3/orders",
        auth=(consumer_key, consumer_secret),
        json=order_payload
    )
    assert wc_response.status_code == 201
    order_id = wc_response.json()["id"]
    
    # 3. 等待同步（Webhook通常为实时）
    time.sleep(5)
    
    # 4. 查询ERP中是否存在该订单
    erp_response = requests.get(
        f"https://erp.company.com/api/orders?source_id={order_id}",
        headers={"Authorization": f"Bearer {erp_token}"}
    )
    
    assert erp_response.status_code == 200
    erp_orders = erp_response.json()["data"]
    assert len(erp_orders) > 0
    assert erp_orders[0]["billNo"] == str(order_id)
    
    print(f"✓ 订单 {order_id} 同步成功")

// 审计日志格式示例
{
  "timestamp": "2026-03-05T14:30:00+08:00",
  "eventType": "SSO_LOGIN",
  "userId": "10086",
  "username": "张三",
  "sourceIp": "192.168.1.100",
  "targetSystem": "WooCommerce",
  "authMethod": "CAS",
  "ticket": "ST-123456-abcdef",
  "result": "SUCCESS",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
}