1

ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java

@@ -122,6 +122,8 @@ public class SecurityConfig
                     .antMatchers("/kdocs-callback").permitAll()
                     // 旧 WPS 回调路径：重定向到新路径，便于后台仍登记旧 URL 时可用
                     .antMatchers("/wps365-callback").permitAll()
+                    // 企微消息经 wxSend 转发的桥接（依赖请求头共享密钥）
+                    .antMatchers("/jarvis/wecom/inbound").permitAll()
                     // 静态资源，可匿名访问
                     .antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll()
                     .antMatchers("/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**").permitAll()