处理权限异常

cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java

@@ -23,6 +23,7 @@ import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 
 import java.time.Duration;
+import java.util.List;
 import java.util.Objects;
 import java.util.function.Function;
 
@@ -70,6 +71,14 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
 
             });
 
+    private final LoadingCache<String, Long> organIdCache = CacheUtils.buildAsyncReloadingCache(Duration.ofMinutes(1L), // 过期时间 1 分钟
+            new CacheLoader<>() {
+                @Override
+                public Long load(String token) {
+                    return getOrganIdByToken(token).block();
+                }
+            });
+
     public TokenAuthenticationFilter(ReactorLoadBalancerExchangeFilterFunction lbFunction) {
         // Q：为什么不使用 OAuth2TokenApi 进行调用？
         // A1：Spring Cloud OpenFeign 官方未内置 Reactive 的支持 https://docs.spring.io/spring-cloud-openfeign/docs/current/reference/html/#reactive-support
@@ -101,12 +110,15 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
             SecurityFrameworkUtils.setLoginUser(exchange, user);
             // 2.2 将 user 并设置到 login-user 的请求头，使用 json 存储值
             ServerWebExchange newExchange = exchange.mutate()
-                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user)).build();
+                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user))
+                    .request(builder -> SecurityFrameworkUtils.setOrganHeader(builder, user))
+                    .build();
             return chain.filter(newExchange);
         });
     }
 
     private Mono<LoginUser> getLoginUser(ServerWebExchange exchange, String token) {
+        //Long organId = organIdCache.getIfPresent(token);
         // 从缓存中，获取 LoginUser
         Long organId = WebFrameworkUtils.getOrganId(exchange);
         KeyValue<Long, String> cacheKey = new KeyValue<Long, String>().setKey(organId).setValue(token);
@@ -130,10 +142,17 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
     private Mono<String> checkAccessToken(Long organId, String token) {
         return webClient.get()
                 .uri(OAuth2TokenApi.URL_CHECK, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
-                .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
+      //          .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
                 .retrieve().bodyToMono(String.class);
     }
 
+    private Mono<Long> getOrganIdByToken(String token) {
+        return webClient.get()
+                .uri(OAuth2TokenApi.URL_ORGAN, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
+                .retrieve()
+                .bodyToMono(Long.class);
+    }
+
     private LoginUser buildUser(String body) {
         // 处理结果，结果不正确
         CommonResult<OAuth2AccessTokenCheckRespDTO> result = JsonUtils.parseObject(body, CHECK_RESULT_TYPE_REFERENCE);

cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java

@@ -25,6 +25,7 @@ public class SecurityFrameworkUtils {
     private static final String LOGIN_USER_ID_ATTR = "login-user-id";
     private static final String LOGIN_USER_TYPE_ATTR = "login-user-type";
     private static final String DATA_CODE = "data-code";
+    private static final String ORGAN_ID = "organ-id";
 
     private SecurityFrameworkUtils() {}
 
@@ -105,4 +106,8 @@ public class SecurityFrameworkUtils {
         builder.header(DATA_CODE, user.getDataCode());
     }
 
+    public static void setOrganHeader(ServerHttpRequest.Builder builder, LoginUser user) {
+        builder.header(ORGAN_ID, user.getOrganId().toString());
+    }
+
 }