处理权限异常

cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java

@@ -23,6 +23,7 @@ import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 
 import java.time.Duration;
+import java.util.List;
 import java.util.Objects;
 import java.util.function.Function;
 
@@ -70,6 +71,14 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
 
             });
 
+    private final LoadingCache<String, Long> organIdCache = CacheUtils.buildAsyncReloadingCache(Duration.ofMinutes(1L), // 过期时间 1 分钟
+            new CacheLoader<>() {
+                @Override
+                public Long load(String token) {
+                    return getOrganIdByToken(token).block();
+                }
+            });
+
     public TokenAuthenticationFilter(ReactorLoadBalancerExchangeFilterFunction lbFunction) {
         // Q：为什么不使用 OAuth2TokenApi 进行调用？
         // A1：Spring Cloud OpenFeign 官方未内置 Reactive 的支持 https://docs.spring.io/spring-cloud-openfeign/docs/current/reference/html/#reactive-support
@@ -101,12 +110,15 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
             SecurityFrameworkUtils.setLoginUser(exchange, user);
             // 2.2 将 user 并设置到 login-user 的请求头，使用 json 存储值
             ServerWebExchange newExchange = exchange.mutate()
-                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user)).build();
+                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user))
+                    .request(builder -> SecurityFrameworkUtils.setOrganHeader(builder, user))
+                    .build();
             return chain.filter(newExchange);
         });
     }
 
     private Mono<LoginUser> getLoginUser(ServerWebExchange exchange, String token) {
+        //Long organId = organIdCache.getIfPresent(token);
         // 从缓存中，获取 LoginUser
         Long organId = WebFrameworkUtils.getOrganId(exchange);
         KeyValue<Long, String> cacheKey = new KeyValue<Long, String>().setKey(organId).setValue(token);
@@ -130,10 +142,17 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
     private Mono<String> checkAccessToken(Long organId, String token) {
         return webClient.get()
                 .uri(OAuth2TokenApi.URL_CHECK, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
-                .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
+      //          .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
                 .retrieve().bodyToMono(String.class);
     }
 
+    private Mono<Long> getOrganIdByToken(String token) {
+        return webClient.get()
+                .uri(OAuth2TokenApi.URL_ORGAN, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
+                .retrieve()
+                .bodyToMono(Long.class);
+    }
+
     private LoginUser buildUser(String body) {
         // 处理结果，结果不正确
         CommonResult<OAuth2AccessTokenCheckRespDTO> result = JsonUtils.parseObject(body, CHECK_RESULT_TYPE_REFERENCE);

cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java

@@ -25,6 +25,7 @@ public class SecurityFrameworkUtils {
     private static final String LOGIN_USER_ID_ATTR = "login-user-id";
     private static final String LOGIN_USER_TYPE_ATTR = "login-user-type";
     private static final String DATA_CODE = "data-code";
+    private static final String ORGAN_ID = "organ-id";
 
     private SecurityFrameworkUtils() {}
 
@@ -105,4 +106,8 @@ public class SecurityFrameworkUtils {
         builder.header(DATA_CODE, user.getDataCode());
     }
 
+    public static void setOrganHeader(ServerHttpRequest.Builder builder, LoginUser user) {
+        builder.header(ORGAN_ID, user.getOrganId().toString());
+    }
+
 }

cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApi.java

@@ -26,6 +26,8 @@ public interface OAuth2TokenApi {
     @SuppressWarnings("HttpUrlsUsage")
     String URL_CHECK = "http://" + ApiConstants.NAME + PREFIX + "/check";
 
+    String URL_ORGAN = "http://" + ApiConstants.NAME + PREFIX + "/getOrganIdByToken";
+
     @PostMapping(PREFIX + "/create")
     @Operation(summary = "创建访问令牌")
     CommonResult<OAuth2AccessTokenRespDTO> createAccessToken(@Valid @RequestBody OAuth2AccessTokenCreateReqDTO reqDTO);
@@ -49,4 +51,10 @@ public interface OAuth2TokenApi {
     CommonResult<OAuth2AccessTokenRespDTO> refreshAccessToken(@RequestParam("refreshToken") String refreshToken,
                                                               @RequestParam("clientId") String clientId);
 
+
+    @GetMapping(PREFIX + "/getOrganIdByToken")
+    @Operation(summary = "通过访问令牌获取组织id")
+    @Parameter(name = "accessToken", description = "访问令牌", required = true, example = "tudou")
+    CommonResult<Long> getOrganIdByToken(@RequestParam("accessToken") String accessToken);
+
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java

@@ -63,4 +63,10 @@ public class OAuth2TokenApiImpl implements OAuth2TokenApi {
         return success(BeanUtils.toBean(accessTokenDO, OAuth2AccessTokenRespDTO.class));
     }
 
+    @Override
+    public CommonResult<Long> getOrganIdByToken(String accessToken) {
+        OAuth2AccessTokenDO accessTokenDO = oauth2TokenService.checkAccessToken(accessToken);
+        return success(accessTokenDO.getOrganId());
+    }
+
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java

@@ -251,7 +251,9 @@ public class PermissionServiceImpl implements PermissionService {
     @Cacheable(value = RedisKeyConstants.MENU_ROLE_ID_LIST, key = "#menuId")
     @OrganIgnore
     public Set<Long> getMenuRoleIdListByMenuIdFromCache1(Long menuId) {
-        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>().in(RoleMenuDO::getOrganId, 0l, OrganContextHolder.getOrganId())
+       //todo 这里应该过滤组织id为0的和自己的
+        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>()
+                //.in(RoleMenuDO::getOrganId, 0l, organId)
                 .eq(RoleMenuDO::getMenuId, menuId)
         );
         return convertSet(roleMenuDOS, RoleMenuDO::getRoleId);