fix(认证): 优先使用响应式上下文认证 (#365)

* fix(认证): 优先使用响应式上下文认证

* refactor(认证): 简化上下文认证读取

hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/ReactiveAuthenticationHolder.java

@@ -56,6 +56,11 @@ public final class ReactiveAuthenticationHolder {
     }
 
     /**
+     * 获取当前登录的用户权限信息。
+     *
+     * <p>调用链显式写入的认证快照优先于 Supplier，供网关或上游过滤器在不改写全局
+     * Supplier 的情况下收敛本次请求的授权范围。</p>
+     *
      * @return 当前登录的用户权限信息
      */
     public static Mono<Authentication> get() {
@@ -64,6 +69,10 @@ public final class ReactiveAuthenticationHolder {
             if (Boolean.TRUE.equals(ctx.getOrDefault(IGNORE_AUTH_KEY, false))) {
                 return Mono.empty();
             }
+            Authentication authentication = ctx.getOrDefault(Authentication.class, null);
+            if (authentication != null) {
+                return Mono.just(authentication);
+            }
             return get(ReactiveAuthenticationSupplier::get);
         });
     }

hsweb-authorization/hsweb-authorization-api/src/test/java/org/hswebframework/web/authorization/AuthenticationTests.java

@@ -143,4 +143,18 @@ public class AuthenticationTests {
 
 
     }
-}
+
+    @Test
+    public void shouldPreferAuthenticationFromReactiveContext() {
+        Authentication authentication = builder
+            .user("{\"id\":\"scoped-user\",\"username\":\"scoped-user\"}")
+            .build();
+
+        Authentication
+            .currentReactive()
+            .contextWrite(Context.of(Authentication.class, authentication))
+            .as(StepVerifier::create)
+            .assertNext(actual -> assertSame(authentication, actual))
+            .verifyComplete();
+    }
+}