From 522108aaa85564e9e6020342638a70dbe2207dab Mon Sep 17 00:00:00 2001 From: yangsb Date: Fri, 26 Apr 2024 15:25:03 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E8=8E=B7=E5=8F=96=E6=98=AF?= =?UTF-8?q?=E5=90=A6=E7=AE=A1=E7=90=86=E5=91=98=E8=87=AA=E5=8A=A8=E7=9A=84?= =?UTF-8?q?=E6=96=B9=E5=BC=8F=EF=BC=8C=E5=8E=BB=E9=99=A4=E7=99=BB=E5=87=BA?= =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E7=BB=84=E7=BB=87id=E4=BE=9D=E8=B5=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../core/filter/TokenAuthenticationFilter.java | 8 ++++---- .../core/service/SecurityFrameworkService.java | 10 ++++++++++ .../core/service/SecurityFrameworkServiceImpl.java | 6 ++++++ .../com/cf/imes/gateway/filter/security/LoginUser.java | 4 ++++ .../filter/security/TokenAuthenticationFilter.java | 3 ++- .../core/service/JmReportTokenServiceImpl.java | 4 +++- .../api/oauth2/dto/OAuth2AccessTokenCheckRespDTO.java | 2 ++ .../dal/dataobject/oauth2/OAuth2AccessTokenDO.java | 5 +++++ .../dal/dataobject/oauth2/OAuth2RefreshTokenDO.java | 4 ++++ .../system/service/oauth2/OAuth2TokenServiceImpl.java | 8 +++++++- .../src/main/resources/application.yaml | 1 + 11 files changed, 48 insertions(+), 7 deletions(-) diff --git a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/filter/TokenAuthenticationFilter.java b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/filter/TokenAuthenticationFilter.java index 17967b07f..e11ef1707 100644 --- a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/filter/TokenAuthenticationFilter.java +++ b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/filter/TokenAuthenticationFilter.java @@ -94,10 +94,10 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter { && ObjectUtil.notEqual(accessToken.getUserType(), userType)) { throw new AccessDeniedException("错误的用户类型"); } - CommonResult superAdmin = permissionApi.hasAnyRoles(accessToken.getUserId(), "super_admin"); + //CommonResult superAdmin = permissionApi.hasAnyRoles(accessToken.getUserId(), "super_admin"); // 构建登录用户 return new LoginUser().setId(accessToken.getUserId()).setUserType(accessToken.getUserType()) - .setOrganId(accessToken.getOrganId()).setScopes(accessToken.getScopes()).setIsSupAdmin(superAdmin.getCheckedData()) + .setOrganId(accessToken.getOrganId()).setScopes(accessToken.getScopes()).setIsSupAdmin(accessToken.getIsSupAdmin()) .setLarge(accessToken.getLarge()).setDbNo(accessToken.getDbNo()).setTableNo(accessToken.getTableNo()); } catch (ServiceException serviceException) { // 校验 Token 不通过时，考虑到一些接口是无需登录的，所以直接返回 null 即可 @@ -133,8 +133,8 @@ public class TokenAuthenticationFilter extends OncePerRequestFilter { String loginUserStr = request.getHeader(SecurityFrameworkUtils.LOGIN_USER_HEADER); if(StrUtil.isNotEmpty(loginUserStr)) { LoginUser loginUser = JsonUtils.parseObject(loginUserStr, LoginUser.class); - CommonResult superAdmin = permissionApi.hasAnyRoles(loginUser.getId(), "super_admin"); - loginUser.setIsSupAdmin(superAdmin.getCheckedData()); + //CommonResult superAdmin = permissionApi.hasAnyRoles(loginUser.getId(), "super_admin"); + //loginUser.setIsSupAdmin(superAdmin.getCheckedData()); loginUser.setNickname(URLDecoder.decode(loginUser.getNickname(),StandardCharsets.UTF_8)); return loginUser; } diff --git a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkService.java b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkService.java index 6f499a6d8..7072b583b 100644 --- a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkService.java +++ b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkService.java @@ -41,6 +41,16 @@ public interface SecurityFrameworkService { */ boolean hasAnyRoles(String... roles); + + /** + * 判断是否有角色，任一一个即可 + * + * @param userId 用户id + * @param roles 角色数组 + * @return 是否 + */ + boolean hasAnyRoles(Long userId, String... roles); + /** * 判断是否有授权 * diff --git a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkServiceImpl.java b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkServiceImpl.java index fb73e6d31..c438c9efe 100644 --- a/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkServiceImpl.java +++ b/cf-framework/cf-spring-boot-starter-security/src/main/java/com/cf/imes/framework/security/core/service/SecurityFrameworkServiceImpl.java @@ -76,6 +76,12 @@ public class SecurityFrameworkServiceImpl implements SecurityFrameworkService { return hasAnyRolesCache.get(new KeyValue<>(SecurityFrameworkUtils.getLoginUserId(), Arrays.asList(roles))); } + @Override + @SneakyThrows + public boolean hasAnyRoles(Long userId, String... roles) { + return hasAnyRolesCache.get(new KeyValue<>(userId, Arrays.asList(roles))); + } + @Override public boolean hasScope(String scope) { return hasAnyScopes(scope); diff --git a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/LoginUser.java b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/LoginUser.java index 697095ed4..277deab48 100644 --- a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/LoginUser.java +++ b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/LoginUser.java @@ -50,5 +50,9 @@ public class LoginUser { * 用户nic */ private String nickname; + /** + * 是否超级管理员 + */ + private Boolean isSupAdmin; } diff --git a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java index 5e2691eea..65fe68b7a 100644 --- a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java +++ b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java @@ -174,7 +174,8 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered { return new LoginUser().setId(tokenInfo.getUserId()).setUserType(tokenInfo.getUserType()) .setOrganId(tokenInfo.getOrganId()).setScopes(tokenInfo.getScopes()) .setLarge(tokenInfo.getLarge()).setDbNo(tokenInfo.getDbNo()).setTableNo(tokenInfo.getTableNo()) - .setDataCode(tokenInfo.getDataCode()).setNickname(URLEncoder.encode(tokenInfo.getNickname(), StandardCharsets.UTF_8)); + .setDataCode(tokenInfo.getDataCode()).setIsSupAdmin(tokenInfo.getIsSupAdmin()) + .setNickname(URLEncoder.encode(tokenInfo.getNickname(), StandardCharsets.UTF_8)); } @Override diff --git a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/jmreport/core/service/JmReportTokenServiceImpl.java b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/jmreport/core/service/JmReportTokenServiceImpl.java index 7167281bf..b1ab771ca 100644 --- a/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/jmreport/core/service/JmReportTokenServiceImpl.java +++ b/cf-module-report/cf-module-report-biz/src/main/java/com/cf/imes/module/report/framework/jmreport/core/service/JmReportTokenServiceImpl.java @@ -112,7 +112,9 @@ public class JmReportTokenServiceImpl implements JmReportTokenServiceI { return null; } user = new LoginUser().setId(accessToken.getUserId()).setUserType(accessToken.getUserType()) - .setOrganId(accessToken.getOrganId()).setScopes(accessToken.getScopes()); + .setOrganId(accessToken.getOrganId()).setScopes(accessToken.getScopes()) + .setDataCode(accessToken.getDataCode()).setLarge(accessToken.getLarge()) + .setNickname(accessToken.getNickname()); } catch (ServiceException ignored) { // do nothing：如果报错，说明认证失败，则返回 false 即可 } diff --git a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/dto/OAuth2AccessTokenCheckRespDTO.java b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/dto/OAuth2AccessTokenCheckRespDTO.java index b63badf7f..883d69f16 100644 --- a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/dto/OAuth2AccessTokenCheckRespDTO.java +++ b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/dto/OAuth2AccessTokenCheckRespDTO.java @@ -32,5 +32,7 @@ public class OAuth2AccessTokenCheckRespDTO implements Serializable { private String dataCode; @Schema(description = "用户昵称") private String nickname; + @Schema(description = "是否超级管理员") + private Boolean isSupAdmin; } diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2AccessTokenDO.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2AccessTokenDO.java index 4de2d2966..ed247c027 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2AccessTokenDO.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2AccessTokenDO.java @@ -8,6 +8,7 @@ import com.baomidou.mybatisplus.annotation.TableField; import com.baomidou.mybatisplus.annotation.TableId; import com.baomidou.mybatisplus.annotation.TableName; import com.baomidou.mybatisplus.extension.handlers.JacksonTypeHandler; +import io.swagger.v3.oas.annotations.media.Schema; import lombok.Data; import lombok.EqualsAndHashCode; @@ -90,4 +91,8 @@ public class OAuth2AccessTokenDO extends BaseDO { * 用户昵称 */ private String nickname; + /** + * 是否超级管理员 + */ + private Boolean isSupAdmin; } diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2RefreshTokenDO.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2RefreshTokenDO.java index ae48a94cb..ec24a6a47 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2RefreshTokenDO.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/dataobject/oauth2/OAuth2RefreshTokenDO.java @@ -83,5 +83,9 @@ public class OAuth2RefreshTokenDO extends BaseDO { * 用户昵称 */ private String nickname; + /** + * 是否超级管理员 + */ + private Boolean isSupAdmin; } diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/oauth2/OAuth2TokenServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/oauth2/OAuth2TokenServiceImpl.java index 033ea67db..e2fa178e3 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/oauth2/OAuth2TokenServiceImpl.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/oauth2/OAuth2TokenServiceImpl.java @@ -7,6 +7,7 @@ import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants; import com.cf.imes.framework.common.pojo.PageResult; import com.cf.imes.framework.common.util.date.DateUtils; import com.cf.imes.framework.organ.core.context.OrganContextHolder; +import com.cf.imes.framework.security.core.service.SecurityFrameworkService; import com.cf.imes.module.system.controller.admin.oauth2.vo.token.OAuth2AccessTokenPageReqVO; import com.cf.imes.module.system.dal.dataobject.oauth2.OAuth2AccessTokenDO; import com.cf.imes.module.system.dal.dataobject.oauth2.OAuth2ClientDO; @@ -43,6 +44,9 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService { @Resource private OAuth2ClientService oauth2ClientService; + @Resource + private SecurityFrameworkService securityFrameworkService; + @Override @Transactional public OAuth2AccessTokenDO createAccessToken(Long userId, Integer userType, String clientId, List scopes,Boolean large, Integer dbNo, Integer tableNo, String dataCode, Long organId, String nickname) { @@ -140,7 +144,7 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService { .setExpiresTime(LocalDateTime.now().plusSeconds(clientDO.getAccessTokenValiditySeconds())) .setLarge(refreshTokenDO.getLarge()).setDbNo(refreshTokenDO.getDbNo()).setTableNo(refreshTokenDO.getTableNo()) .setDataCode(refreshTokenDO.getDataCode()).setOrganId(refreshTokenDO.getOrganId()) - .setNickname(refreshTokenDO.getNickname()) + .setNickname(refreshTokenDO.getNickname()).setIsSupAdmin(refreshTokenDO.getIsSupAdmin()) ; //accessTokenDO.setOrganId(OrganContextHolder.getOrganId()); // 手动设置组织编号，避免缓存到 Redis 的时候，无对应的组织编号 oauth2AccessTokenMapper.insert(accessTokenDO); @@ -157,6 +161,8 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService { .setLarge(large).setDbNo(dbNo).setTableNo(tableNo).setDataCode(dataCode) .setOrganId(organId).setNickname(nickname) ; + boolean b = securityFrameworkService.hasAnyRoles(userId,"super_admin"); + refreshToken.setIsSupAdmin(b); oauth2RefreshTokenMapper.insert(refreshToken); return refreshToken; } diff --git a/cf-module-system/cf-module-system-biz/src/main/resources/application.yaml b/cf-module-system/cf-module-system-biz/src/main/resources/application.yaml index 2fb27861c..0ac67136f 100644 --- a/cf-module-system/cf-module-system-biz/src/main/resources/application.yaml +++ b/cf-module-system/cf-module-system-biz/src/main/resources/application.yaml @@ -158,6 +158,7 @@ chenfeng: - /admin-api/system/machine-template/* - /admin-api/system/data-source/* - /admin-api/system/auth/login + - /admin-api/system/auth/logout - /rpc-api/** #- /admin-api/system/** #- /rpc-api/system/organ/valid # 防止递归。避免调用 /rpc-api/system/organ/valid 接口时，又去触发 /rpc-api/system/organ/valid 去校验