zhangshun/mydreamjob-server/src/main/java/com/mydreamjob/deletion/AccountDeletionPhoneHasher.java

package com.mydreamjob.deletion;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.HexFormat;

/**
 * 账号注销手机号墓碑哈希器。
 *
 * <p>使用服务端密钥（app.deletion.phone-hash-secret）对原手机号做 HMAC-SHA256，
 * 仅保存摘要用于禁止原手机号重新注册；不保存明文手机号，不写入审计日志。
 * HMAC 结果不落明文、不可逆，同一手机号 + 同一密钥产生稳定摘要，可用于精确命中查询。
 */
@Component
public class AccountDeletionPhoneHasher {

    private static final String HMAC_ALGO = "HmacSHA256";

    private final String secret;

    public AccountDeletionPhoneHasher(
            @Value("${app.deletion.phone-hash-secret:}") String secret) {
        this.secret = secret;
    }

    /** 计算手机号的 HMAC-SHA256 十六进制摘要。 */
    public String hash(String value) {
        try {
            Mac mac = Mac.getInstance(HMAC_ALGO);
            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), HMAC_ALGO));
            byte[] out = mac.doFinal(value.getBytes(StandardCharsets.UTF_8));
            return HexFormat.of().formatHex(out);
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            throw new IllegalStateException("Failed to hash phone for deletion tombstone", e);
        }
    }
}