Public/cf_imes_server
6
0
Fork 0
mirror of http://192.168.1.205:9980/cf_devdept2/cf_imes_server.git synced 2026-08-12 21:02:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

新增组织失效/过期校验：1、登录校验；2、已登录用户checkToken和机构校验过滤器校验；

Browse Source
This commit is contained in:
gaoqr
2024-08-02 11:24:03 +08:00
parent 355332b23d
commit a6ce630a8c
4 changed files with 39 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cf-framework/cf-spring-boot-starter-biz-organ/src/main/java/com/cf/imes/framework/organ/core/security/OrganSecurityWebFilter.java
+23
View File
@@ -1,6 +1,7 @@
package com.cf.imes.framework.organ.core.security;
import cn.hutool.core.collection.CollUtil;
import com.cf.imes.framework.common.exception.ServiceException;
import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
import com.cf.imes.framework.common.pojo.CommonResult;
import com.cf.imes.framework.common.util.servlet.ServletUtils;
@@ -13,6 +14,7 @@ import com.cf.imes.framework.web.config.WebProperties;
import com.cf.imes.framework.web.core.filter.ApiRequestFilter;
import com.cf.imes.framework.web.core.handler.GlobalExceptionHandler;
import com.cf.imes.framework.web.core.util.WebFrameworkUtils;
import com.cf.imes.module.system.enums.ErrorCodeConstants;
import lombok.extern.slf4j.Slf4j;
import org.springframework.util.AntPathMatcher;
@@ -90,6 +92,10 @@ public class OrganSecurityWebFilter extends ApiRequestFilter {
organFrameworkService.validOrgan(organId);
} catch (Throwable ex) {
CommonResult<?> result = globalExceptionHandler.allExceptionHandler(request, ex);
// 组织失效返回401踢出系统
if (needUnauthorizedWhenOrgExpired(ex)) {
result.setCode(GlobalErrorCodeConstants.UNAUTHORIZED.getCode());
}
ServletUtils.writeJSON(response, result);
return;
}
@@ -117,4 +123,21 @@ public class OrganSecurityWebFilter extends ApiRequestFilter {
return false;
}
/**
* 是否组织失效设置未登录回调
*
* @param ex
* @return
*/
private boolean needUnauthorizedWhenOrgExpired(Throwable ex) {
if (ex instanceof ServiceException) {
ServiceException serviceException = (ServiceException) ex;
if (Objects.equals(serviceException.getCode(), ErrorCodeConstants.ORGAN_EXPIRE.getCode())
|| Objects.equals(serviceException.getCode(), ErrorCodeConstants.ORGAN_DISABLE.getCode())
|| Objects.equals(serviceException.getCode(), ErrorCodeConstants.ORGAN_NOT_EXISTS.getCode())) {
return true;
}
}
return false;
}
}
cf-framework/cf-spring-boot-starter-biz-organ/src/main/java/com/cf/imes/framework/organ/core/service/OrganFrameworkServiceImpl.java
+2 -17
View File
@@ -1,6 +1,5 @@
package com.cf.imes.framework.organ.core.service;
import com.cf.imes.framework.common.pojo.CommonResult;
import com.cf.imes.framework.common.util.cache.CacheUtils;
import com.cf.imes.module.system.api.organ.OrganApi;
import com.google.common.cache.CacheLoader;
@@ -26,7 +25,7 @@ public class OrganFrameworkServiceImpl implements OrganFrameworkService {
*/
private final LoadingCache<Object, List<Long>> getOrganIdsCache = CacheUtils.buildAsyncReloadingCache(
Duration.ofMinutes(1L), // 过期时间 1 分钟
new CacheLoader<Object, List<Long>>() {
new CacheLoader<>() {
@Override
public List<Long> load(Object key) {
@@ -35,20 +34,6 @@ public class OrganFrameworkServiceImpl implements OrganFrameworkService {
});
/**
* 针对 {@link #validOrgan(Long)} 的缓存
*/
private final LoadingCache<Long, CommonResult<Boolean>> validOrganCache = CacheUtils.buildAsyncReloadingCache(
Duration.ofMinutes(1L), // 过期时间 1 分钟
new CacheLoader<Long, CommonResult<Boolean>>() {
@Override
public CommonResult<Boolean> load(Long id) {
return organApi.validOrgan(id);
}
});
@Override
@SneakyThrows
public List<Long> getOrganIds() {
@@ -58,7 +43,7 @@ public class OrganFrameworkServiceImpl implements OrganFrameworkService {
@Override
@SneakyThrows
public void validOrgan(Long id) {
validOrganCache.get(id).checkError();
organApi.validOrgan(id).checkError();
}
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/auth/AdminAuthServiceImpl.java
+7 -11
View File
@@ -1,15 +1,12 @@
package com.cf.imes.module.system.service.auth;
import cn.hutool.core.util.ObjectUtil;
import cn.hutool.core.util.StrUtil;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.enums.UserTypeEnum;
import com.cf.imes.framework.common.exception.ServerException;
import com.cf.imes.framework.common.exception.util.ServiceExceptionUtil;
import com.cf.imes.framework.common.util.monitor.TracerUtils;
import com.cf.imes.framework.common.util.servlet.ServletUtils;
import com.cf.imes.framework.common.util.validation.ValidationUtils;
import com.cf.imes.framework.organ.core.context.OrganContextHolder;
import com.cf.imes.module.system.api.logger.dto.LoginLogCreateReqDTO;
import com.cf.imes.module.system.api.sms.SmsCodeApi;
import com.cf.imes.module.system.api.social.dto.SocialUserBindReqDTO;
@@ -39,6 +36,7 @@ import com.xingyuv.captcha.model.common.ResponseModel;
import com.xingyuv.captcha.model.vo.CaptchaVO;
import com.xingyuv.captcha.service.CaptchaService;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
@@ -124,9 +122,12 @@ public class AdminAuthServiceImpl implements AdminAuthService {
reqVO.getSocialType(), reqVO.getSocialCode(), reqVO.getSocialState()));
}
Long organId = user.getOrganId();
// 校验机构有效性
organService.validOrgan(organId);
OrganizationDO organ = organService.getOrgan(organId);
String dataSourceCode = organ.getDataSourceCode();
if(StrUtil.isBlank(dataSourceCode)) {
// 校验机构数据源
if (StringUtils.isBlank(dataSourceCode)) {
throw exception(ORGAN_DATA_CODE_NOT_EXISTS);
}
// 创建 Token 令牌，记录登录日志
@@ -156,7 +157,7 @@ public class AdminAuthServiceImpl implements AdminAuthService {
Long organId = user.getOrganId();
OrganizationDO organ = organService.getOrgan(organId);
String dataSourceCode = organ.getDataSourceCode();
if(StrUtil.isBlank(dataSourceCode)) {
if(StringUtils.isBlank(dataSourceCode)) {
throw exception(ORGAN_DATA_CODE_NOT_EXISTS);
}
@@ -201,7 +202,7 @@ public class AdminAuthServiceImpl implements AdminAuthService {
Long organId = user.getOrganId();
OrganizationDO organ = organService.getOrgan(organId);
String dataSourceCode = organ.getDataSourceCode();
if(StrUtil.isBlank(dataSourceCode)) {
if(StringUtils.isBlank(dataSourceCode)) {
throw exception(ORGAN_DATA_CODE_NOT_EXISTS);
}
@@ -231,11 +232,6 @@ public class AdminAuthServiceImpl implements AdminAuthService {
private AuthLoginRespVO createTokenAfterLoginSuccess(Long userId, String username, LoginLogTypeEnum logType, Boolean large, String dataCode, Long organId, String nickname) {
// 插入登陆日志
createLoginLog(userId, username, logType, LoginResultEnum.SUCCESS);
/*Long organId = OrganContextHolder.getOrganId();
OrganizationDO organ = organService.getOrgan(organId);
if(Objects.isNull(organ)) {
throw new ServerException(10023,"组织不存在");
}*/
// 创建访问令牌
OAuth2AccessTokenDO accessTokenDO = oauth2TokenService.createAccessToken(userId, getUserType().getValue(),
OAuth2ClientConstants.CLIENT_ID_DEFAULT, null, large, null, null, dataCode, organId, nickname);
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/oauth2/OAuth2TokenServiceImpl.java
+7 -21
View File
@@ -15,6 +15,7 @@ import com.cf.imes.module.system.dal.dataobject.oauth2.OAuth2RefreshTokenDO;
import com.cf.imes.module.system.dal.mysql.oauth2.OAuth2AccessTokenMapper;
import com.cf.imes.module.system.dal.mysql.oauth2.OAuth2RefreshTokenMapper;
import com.cf.imes.module.system.dal.redis.oauth2.OAuth2AccessTokenRedisDAO;
import com.cf.imes.module.system.service.organ.OrganService;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
@@ -36,6 +37,7 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
@Resource
private OAuth2AccessTokenMapper oauth2AccessTokenMapper;
@Resource
private OAuth2RefreshTokenMapper oauth2RefreshTokenMapper;
@@ -48,6 +50,9 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
@Resource
private SecurityFrameworkService securityFrameworkService;
@Resource
private OrganService organService;
@Override
@Transactional
public OAuth2AccessTokenDO createAccessToken(Long userId, Integer userType, String clientId, List<String> scopes,Boolean large, Integer dbNo, Integer tableNo, String dataCode, Long organId, String nickname) {
@@ -68,7 +73,6 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
}
// 校验 Client 匹配
OAuth2ClientDO clientDO = oauth2ClientService.validOAuthClientFromCache(clientId);
if (ObjectUtil.notEqual(clientId, refreshTokenDO.getClientId())) {
throw exception0(GlobalErrorCodeConstants.BAD_REQUEST.getCode(), "刷新令牌的客户端编号不正确");
}
@@ -86,31 +90,19 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
throw exception0(GlobalErrorCodeConstants.UNAUTHORIZED.getCode(), "刷新令牌已过期");
}
// // 创建访问令牌
// return createOAuth2AccessToken(refreshTokenDO, clientDO);
return null;
}
@Override
public OAuth2AccessTokenDO getAccessToken(String accessToken) {
// // 优先从 Redis 中获取
// OAuth2AccessTokenDO accessTokenDO = oauth2AccessTokenRedisDAO.get(accessToken);
// if (accessTokenDO != null) {
// return accessTokenDO;
// }
//
// // 获取不到，从 MySQL 中获取
// accessTokenDO = oauth2AccessTokenMapper.selectByAccessToken(accessToken);
// // 如果在 MySQL 存在，则往 Redis 中写入
// if (accessTokenDO != null && !DateUtils.isExpired(accessTokenDO.getExpiresTime())) {
// oauth2AccessTokenRedisDAO.set(accessTokenDO);
// }
// 因数据库不在存入缓存数据，所以直接从缓存中获取
// 数据库移除令牌存入，所以直接从缓存中获取
OAuth2AccessTokenDO accessTokenDO = oauth2AccessTokenRedisDAO.get(accessToken);
if(accessTokenDO != null){
// 校验组织的有效性
organService.validOrgan(accessTokenDO.getOrganId());
// 有令牌的校验，代表有接口访问，延长令牌的过期时间（30分钟）
oauth2AccessTokenRedisDAO.expire(accessToken, 1800, TimeUnit.SECONDS);
}
@@ -123,9 +115,6 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
if (accessTokenDO == null) {
throw exception0(GlobalErrorCodeConstants.UNAUTHORIZED.getCode(), "访问令牌不存在");
}
// if (DateUtils.isExpired(accessTokenDO.getExpiresTime())) {
// throw exception0(GlobalErrorCodeConstants.UNAUTHORIZED.getCode(), "访问令牌已过期");
return accessTokenDO;
}
@@ -162,7 +151,6 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
}
boolean b = securityFrameworkService.hasAnyRoles(userId,"super_admin");
refreshToken.setIsSupAdmin(b);
// oauth2RefreshTokenMapper.insert(refreshToken);
return refreshToken;
}
@@ -177,8 +165,6 @@ public class OAuth2TokenServiceImpl implements OAuth2TokenService {
.setDataCode(refreshTokenDO.getDataCode()).setOrganId(refreshTokenDO.getOrganId())
.setNickname(refreshTokenDO.getNickname()).setIsSupAdmin(refreshTokenDO.getIsSupAdmin())
;
//accessTokenDO.setOrganId(OrganContextHolder.getOrganId()); // 手动设置组织编号，避免缓存到 Redis 的时候，无对应的组织编号
// oauth2AccessTokenMapper.insert(accessTokenDO);
// 记录到 Redis 中
oauth2AccessTokenRedisDAO.set(accessTokenDO);
return accessTokenDO;