feat: 增加url鉴权

aos-auth-controller/src/main/java/com/aos/auth/controller/ResourceController.java

@@ -32,28 +32,24 @@ public class ResourceController {
 
     @PostMapping(PathConstant.ADD)
     @ApiOperation("添加资源")
-//    @PreAuthorize("hasAuthority('sys:resource:add')")
     public void add(@Valid @RequestBody ResourceReq req) {
         aosAuthResourcesService.addResource(req);
     }
 
     @PutMapping(PathConstant.UPDATE)
     @ApiOperation("更新资源")
-//    @PreAuthorize("hasAuthority('sys:resource:update')")
     public void update(@Valid @RequestBody ResourceReq req) {
         aosAuthResourcesService.updateResource(req);
     }
 
     @DeleteMapping(PathConstant.DELETE)
     @ApiOperation("删除资源")
-//    @PreAuthorize("hasAuthority('sys:resource:delete')")
     public void delete(@RequestBody List<Long> ids) {
         aosAuthResourcesService.deleteResource(ids);
     }
 
     @GetMapping(PathConstant.TREE)
     @ApiOperation("获取资源树,不包含按钮")
-//    @PreAuthorize("hasAuthority('sys:resource:tree')")
     public List<Tree<Long>> tree() {
         List<Tree<Long>> treeList = aosAuthResourcesService.treeList();
         return treeList;
@@ -61,7 +57,6 @@ public class ResourceController {
 
     @PostMapping(PathConstant.PREM)
     @ApiOperation("获取指定节点下的资源信息")
-//    @PreAuthorize("hasAuthority('sys:resource:prem')")
     public Page<ResourceVo> prem(@RequestBody ResourcePageReq req) {
         Page<ResourceVo> resourceVoPage = aosAuthResourcesService.getResourceNode(req);
         return resourceVoPage;
@@ -69,7 +64,6 @@ public class ResourceController {
 
     @GetMapping(PathConstant.DETAILS)
     @ApiOperation("资源详情")
-//    @PreAuthorize("hasAuthority('sys:resource:details')")
     public ResourceVo details(@RequestParam(value = "resourceId") Long resourceId) {
         ResourceVo resourceVo = aosAuthResourcesService.getDetails(resourceId);
         return resourceVo;

aos-auth-controller/src/main/java/com/aos/auth/controller/RoleController.java

@@ -36,7 +36,6 @@ public class RoleController {
 
     @PostMapping(PathConstant.ADD)
     @ApiOperation("添加角色")
-    @PreAuthorize("hasAuthority('sys:role:add')")
     public void add(@RequestBody RoleReq req) {
         aosAuthRolesService.addRole(req);
     }
@@ -49,14 +48,12 @@ public class RoleController {
      */
     @PutMapping(PathConstant.UPDATE)
     @ApiOperation("更新角色")
-//    @PreAuthorize("hasAuthority('sys:role:update')")
     public void update(@RequestBody RoleReq req) {
         aosAuthRolesService.updateRole(req);
     }
 
     @DeleteMapping(PathConstant.DELETE)
     @ApiOperation("删除角色")
-//    @PreAuthorize("hasAuthority('sys:role:delete')")
     public void delete(@RequestBody List<Long> ids) {
         aosAuthRolesService.deleteRole(ids);
     }
@@ -70,7 +67,6 @@ public class RoleController {
      */
     @PostMapping(PathConstant.LIST)
     @ApiOperation("获取角色列表")
-//    @PreAuthorize("hasAuthority('sys:role:list')")
     public Page<RoleVo> list(@RequestBody RolePageReq req) {
         Page<RoleVo> roleVoPage = aosAuthRolesService.pageList(req);
         return roleVoPage;
@@ -78,7 +74,6 @@ public class RoleController {
 
     @GetMapping(PathConstant.PREM)
     @ApiOperation("获取角色权限id")
-//    @PreAuthorize("hasAuthority('sys:role:prem')")
     public List<Long> prem(@RequestParam(value = "roleId") Long roleId) {
         List<Long> premList = aosAuthRolesService.getPremList(roleId);
         return premList;
@@ -87,7 +82,6 @@ public class RoleController {
 
     @GetMapping(PathConstant.DETAILS)
     @ApiOperation("获取角色详情")
-//    @PreAuthorize("hasAuthority('sys:role:details')")
     public RoleVo details(@RequestParam(value = "roleId") Long roleId) {
         RoleVo roleVo = aosAuthRolesService.getDetails(roleId);
         return roleVo;
@@ -96,7 +90,6 @@ public class RoleController {
 
     @GetMapping(PathConstant.ROLE_INFO_LIST)
     @ApiOperation("获取角色id-name列表")
-//    @PreAuthorize("hasAuthority('sys:role:details')")
     public List<RoleIdInfoVo> roleIdInfoVos() {
         List<RoleIdInfoVo> roleIdInfoVos = aosAuthRolesService.getRoleIdInfoVos();
         return roleIdInfoVos;

aos-auth-launcher/src/main/resources/application.properties

@@ -5,4 +5,5 @@ spring.datasource.url=jdbc:mysql://wylgyx.top:6003/aos_auth?useUnicode=true&serv
 spring.datasource.username=root
 spring.datasource.password=Wyl.0629
 spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver
-logging.level.com.aos.auth.mapper=debug
+logging.level.com.aos.auth.mapper=debug
+aos.auth.ignore.ignore-url[0]=/**

aos-auth-service-impl/pom.xml

@@ -27,6 +27,11 @@
             <groupId>org.springframework</groupId>
             <artifactId>spring-webmvc</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-configuration-processor</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>com.aos</groupId>
             <artifactId>aos-log</artifactId>

aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosSecurityMetadataSource.java

@@ -4,6 +4,7 @@ import com.aos.auth.service.AosAuthResourcesService;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
@@ -24,6 +25,8 @@ import java.util.stream.Collectors;
 public class AosSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
 
     final private AosAuthResourcesService aosAuthResourcesService;
+    @Value("${server.servlet.context-path:''}")
+    String contextPath;
 
     /**
      * 获取访问路径对应的权限标记
@@ -36,7 +39,8 @@ public class AosSecurityMetadataSource implements FilterInvocationSecurityMetada
     public Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException {
         Collection<ConfigAttribute> configAttributes = new ArrayList<>();
         String url = ((FilterInvocation) o).getRequestUrl();
-        Set<String> premSet = aosAuthResourcesService.getResourceByPath(Arrays.asList(url));
+        String AllUrl = contextPath + url;
+        Set<String> premSet = aosAuthResourcesService.getResourceByPath(Arrays.asList(url, AllUrl));
         List<SecurityConfig> collect = premSet.stream().map(prem -> new SecurityConfig(prem)).collect(Collectors.toList());
         configAttributes.addAll(collect);
         return configAttributes;

aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosTEst.java

@@ -1,31 +0,0 @@
-package com.aos.auth.service.impl.security;
-
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.method.AbstractMethodSecurityMetadataSource;
-import org.springframework.stereotype.Component;
-
-import java.lang.reflect.Method;
-import java.util.Collection;
-
-@Component
-public class AosTEst extends AbstractMethodSecurityMetadataSource {
-    @Override
-    public Collection<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
-        System.out.println(111);
-        return null;
-    }
-
-    /**
-     * If available, returns all of the {@code ConfigAttribute}s defined by the
-     * implementing class.
-     * <p>
-     * This is used by the {@link AbstractSecurityInterceptor} to perform startup time
-     * validation of each {@code ConfigAttribute} configured against it.
-     *
-     * @return the {@code ConfigAttribute}s or {@code null} if unsupported
-     */
-    @Override
-    public Collection<ConfigAttribute> getAllConfigAttributes() {
-        return null;
-    }
-}

aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/IgnoreConfig.java

@@ -0,0 +1,29 @@
+package com.aos.auth.service.impl.security.conf;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author: wangyl
+ * @date: 2022/12/1
+ * @description: 忽略配置
+ */
+@Data
+@Configuration
+@ConfigurationProperties(prefix = "aos.auth.ignore")
+public class IgnoreConfig {
+    /**
+     * 忽略鉴权的url
+     */
+    private List<String> ignoreUrl = new ArrayList<>();
+
+    /**
+     * 匿名访问的url
+     */
+    private List<String> anonymousUrl = new ArrayList<>();
+
+}

aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSecurityConfig.java

@@ -12,7 +12,6 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.BeanIds;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@@ -21,6 +20,8 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
+import java.util.List;
+
 /**
  * @author wyl
  * @version V1.0
@@ -30,12 +31,10 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
  */
 @Configuration
 @EnableWebSecurity
-/**
- *开启注解功能
- */
-@EnableGlobalMethodSecurity(prePostEnabled = true)
-public class WebSercurityConfig extends WebSecurityConfigurerAdapter {
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
+    @Autowired
+    private IgnoreConfig ignoreConfig;
     /**
      * 用户登录验证器
      */
@@ -57,6 +56,9 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
     protected void configure(HttpSecurity httpSecurity) throws Exception {
+        List<String> ignoreUrl = ignoreConfig.getIgnoreUrl();
+        List<String> anonymousUrl = ignoreConfig.getAnonymousUrl();
+
         httpSecurity
                 // 由于使用的是JWT，我们这里不需要csrf
                 .csrf()
@@ -68,7 +70,7 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter {
                 // 过滤请求
                 .authorizeRequests()
                 // 对于登录login 图标 要允许匿名访问
-                .antMatchers("/aos/login/**")
+                .antMatchers("/**/login/**")
                 .permitAll()
                 .antMatchers("/*.html", "/**/*.html")
                 .permitAll()
@@ -78,8 +80,16 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter {
                 .permitAll()
                 .antMatchers("/swagger-resources/**", "/v2/api-docs")
                 .anonymous()
-                .antMatchers("/**")
+                /**
+                 * 配置无需权限
+                 */
+                .antMatchers(ignoreUrl.toArray(new String[ignoreUrl.size()]))
                 .permitAll()
+                /**
+                 * 配置无需登录
+                 */
+                .antMatchers(anonymousUrl.toArray(new String[anonymousUrl.size()]))
+                .anonymous()
                 // 除上面外的所有请求全部需要鉴权认证
                 .anyRequest()
                 .authenticated()

aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/filter/test2.java

@@ -1,18 +0,0 @@
-package com.aos.auth.service.impl.security.filter;
-
-import com.aos.auth.service.impl.security.AosTEst;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.method.MethodSecurityMetadataSource;
-import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
-import org.springframework.stereotype.Component;
-
-@Component
-public class test2 extends GlobalMethodSecurityConfiguration {
-    @Autowired
-    AosTEst aosTEst;
-
-    @Override
-    protected MethodSecurityMetadataSource customMethodSecurityMetadataSource() {
-        return aosTEst;
-    }
-}