From 9cafe7179f1b6d6ac641674b73102f565dca2ecb Mon Sep 17 00:00:00 2001 From: wyl <959814898@qq.com> Date: Thu, 1 Dec 2022 22:33:51 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E5=A2=9E=E5=8A=A0url=E9=89=B4=E6=9D=83?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../auth/controller/ResourceController.java | 6 ---- .../aos/auth/controller/RoleController.java | 7 ----- .../src/main/resources/application.properties | 3 +- aos-auth-service-impl/pom.xml | 5 +++ .../security/AosSecurityMetadataSource.java | 6 +++- .../auth/service/impl/security/AosTEst.java | 31 ------------------- .../impl/security/conf/IgnoreConfig.java | 29 +++++++++++++++++ ...rityConfig.java => WebSecurityConfig.java} | 26 +++++++++++----- .../service/impl/security/filter/test2.java | 18 ----------- 9 files changed, 59 insertions(+), 72 deletions(-) delete mode 100644 aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosTEst.java create mode 100644 aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/IgnoreConfig.java rename aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/{WebSercurityConfig.java => WebSecurityConfig.java} (85%) delete mode 100644 aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/filter/test2.java diff --git a/aos-auth-controller/src/main/java/com/aos/auth/controller/ResourceController.java b/aos-auth-controller/src/main/java/com/aos/auth/controller/ResourceController.java index 9045258..1de3c14 100644 --- a/aos-auth-controller/src/main/java/com/aos/auth/controller/ResourceController.java +++ b/aos-auth-controller/src/main/java/com/aos/auth/controller/ResourceController.java @@ -32,28 +32,24 @@ public class ResourceController { @PostMapping(PathConstant.ADD) @ApiOperation("添加资源") -// @PreAuthorize("hasAuthority('sys:resource:add')") public void add(@Valid @RequestBody ResourceReq req) { aosAuthResourcesService.addResource(req); } @PutMapping(PathConstant.UPDATE) @ApiOperation("更新资源") -// @PreAuthorize("hasAuthority('sys:resource:update')") public void update(@Valid @RequestBody ResourceReq req) { aosAuthResourcesService.updateResource(req); } @DeleteMapping(PathConstant.DELETE) @ApiOperation("删除资源") -// @PreAuthorize("hasAuthority('sys:resource:delete')") public void delete(@RequestBody List ids) { aosAuthResourcesService.deleteResource(ids); } @GetMapping(PathConstant.TREE) @ApiOperation("获取资源树,不包含按钮") -// @PreAuthorize("hasAuthority('sys:resource:tree')") public List> tree() { List> treeList = aosAuthResourcesService.treeList(); return treeList; @@ -61,7 +57,6 @@ public class ResourceController { @PostMapping(PathConstant.PREM) @ApiOperation("获取指定节点下的资源信息") -// @PreAuthorize("hasAuthority('sys:resource:prem')") public Page prem(@RequestBody ResourcePageReq req) { Page resourceVoPage = aosAuthResourcesService.getResourceNode(req); return resourceVoPage; @@ -69,7 +64,6 @@ public class ResourceController { @GetMapping(PathConstant.DETAILS) @ApiOperation("资源详情") -// @PreAuthorize("hasAuthority('sys:resource:details')") public ResourceVo details(@RequestParam(value = "resourceId") Long resourceId) { ResourceVo resourceVo = aosAuthResourcesService.getDetails(resourceId); return resourceVo; diff --git a/aos-auth-controller/src/main/java/com/aos/auth/controller/RoleController.java b/aos-auth-controller/src/main/java/com/aos/auth/controller/RoleController.java index 2aededf..cd8ff76 100644 --- a/aos-auth-controller/src/main/java/com/aos/auth/controller/RoleController.java +++ b/aos-auth-controller/src/main/java/com/aos/auth/controller/RoleController.java @@ -36,7 +36,6 @@ public class RoleController { @PostMapping(PathConstant.ADD) @ApiOperation("添加角色") - @PreAuthorize("hasAuthority('sys:role:add')") public void add(@RequestBody RoleReq req) { aosAuthRolesService.addRole(req); } @@ -49,14 +48,12 @@ public class RoleController { */ @PutMapping(PathConstant.UPDATE) @ApiOperation("更新角色") -// @PreAuthorize("hasAuthority('sys:role:update')") public void update(@RequestBody RoleReq req) { aosAuthRolesService.updateRole(req); } @DeleteMapping(PathConstant.DELETE) @ApiOperation("删除角色") -// @PreAuthorize("hasAuthority('sys:role:delete')") public void delete(@RequestBody List ids) { aosAuthRolesService.deleteRole(ids); } @@ -70,7 +67,6 @@ public class RoleController { */ @PostMapping(PathConstant.LIST) @ApiOperation("获取角色列表") -// @PreAuthorize("hasAuthority('sys:role:list')") public Page list(@RequestBody RolePageReq req) { Page roleVoPage = aosAuthRolesService.pageList(req); return roleVoPage; @@ -78,7 +74,6 @@ public class RoleController { @GetMapping(PathConstant.PREM) @ApiOperation("获取角色权限id") -// @PreAuthorize("hasAuthority('sys:role:prem')") public List prem(@RequestParam(value = "roleId") Long roleId) { List premList = aosAuthRolesService.getPremList(roleId); return premList; @@ -87,7 +82,6 @@ public class RoleController { @GetMapping(PathConstant.DETAILS) @ApiOperation("获取角色详情") -// @PreAuthorize("hasAuthority('sys:role:details')") public RoleVo details(@RequestParam(value = "roleId") Long roleId) { RoleVo roleVo = aosAuthRolesService.getDetails(roleId); return roleVo; @@ -96,7 +90,6 @@ public class RoleController { @GetMapping(PathConstant.ROLE_INFO_LIST) @ApiOperation("获取角色id-name列表") -// @PreAuthorize("hasAuthority('sys:role:details')") public List roleIdInfoVos() { List roleIdInfoVos = aosAuthRolesService.getRoleIdInfoVos(); return roleIdInfoVos; diff --git a/aos-auth-launcher/src/main/resources/application.properties b/aos-auth-launcher/src/main/resources/application.properties index 897cd23..046340a 100644 --- a/aos-auth-launcher/src/main/resources/application.properties +++ b/aos-auth-launcher/src/main/resources/application.properties @@ -5,4 +5,5 @@ spring.datasource.url=jdbc:mysql://wylgyx.top:6003/aos_auth?useUnicode=true&serv spring.datasource.username=root spring.datasource.password=Wyl.0629 spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver -logging.level.com.aos.auth.mapper=debug \ No newline at end of file +logging.level.com.aos.auth.mapper=debug +aos.auth.ignore.ignore-url[0]=/** \ No newline at end of file diff --git a/aos-auth-service-impl/pom.xml b/aos-auth-service-impl/pom.xml index 461fbc6..6f8fe58 100644 --- a/aos-auth-service-impl/pom.xml +++ b/aos-auth-service-impl/pom.xml @@ -27,6 +27,11 @@ org.springframework spring-webmvc + + org.springframework.boot + spring-boot-configuration-processor + true + com.aos aos-log diff --git a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosSecurityMetadataSource.java b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosSecurityMetadataSource.java index 267cf7b..24cf036 100644 --- a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosSecurityMetadataSource.java +++ b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosSecurityMetadataSource.java @@ -4,6 +4,7 @@ import com.aos.auth.service.AosAuthResourcesService; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.SecurityConfig; import org.springframework.security.web.FilterInvocation; @@ -24,6 +25,8 @@ import java.util.stream.Collectors; public class AosSecurityMetadataSource implements FilterInvocationSecurityMetadataSource { final private AosAuthResourcesService aosAuthResourcesService; + @Value("${server.servlet.context-path:''}") + String contextPath; /** * 获取访问路径对应的权限标记 @@ -36,7 +39,8 @@ public class AosSecurityMetadataSource implements FilterInvocationSecurityMetada public Collection getAttributes(Object o) throws IllegalArgumentException { Collection configAttributes = new ArrayList<>(); String url = ((FilterInvocation) o).getRequestUrl(); - Set premSet = aosAuthResourcesService.getResourceByPath(Arrays.asList(url)); + String AllUrl = contextPath + url; + Set premSet = aosAuthResourcesService.getResourceByPath(Arrays.asList(url, AllUrl)); List collect = premSet.stream().map(prem -> new SecurityConfig(prem)).collect(Collectors.toList()); configAttributes.addAll(collect); return configAttributes; diff --git a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosTEst.java b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosTEst.java deleted file mode 100644 index c12ef3b..0000000 --- a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/AosTEst.java +++ /dev/null @@ -1,31 +0,0 @@ -package com.aos.auth.service.impl.security; - -import org.springframework.security.access.ConfigAttribute; -import org.springframework.security.access.method.AbstractMethodSecurityMetadataSource; -import org.springframework.stereotype.Component; - -import java.lang.reflect.Method; -import java.util.Collection; - -@Component -public class AosTEst extends AbstractMethodSecurityMetadataSource { - @Override - public Collection getAttributes(Method method, Class targetClass) { - System.out.println(111); - return null; - } - - /** - * If available, returns all of the {@code ConfigAttribute}s defined by the - * implementing class. - *

- * This is used by the {@link AbstractSecurityInterceptor} to perform startup time - * validation of each {@code ConfigAttribute} configured against it. - * - * @return the {@code ConfigAttribute}s or {@code null} if unsupported - */ - @Override - public Collection getAllConfigAttributes() { - return null; - } -} diff --git a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/IgnoreConfig.java b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/IgnoreConfig.java new file mode 100644 index 0000000..91692bf --- /dev/null +++ b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/IgnoreConfig.java @@ -0,0 +1,29 @@ +package com.aos.auth.service.impl.security.conf; + +import lombok.Data; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.context.annotation.Configuration; + +import java.util.ArrayList; +import java.util.List; + +/** + * @author: wangyl + * @date: 2022/12/1 + * @description: 忽略配置 + */ +@Data +@Configuration +@ConfigurationProperties(prefix = "aos.auth.ignore") +public class IgnoreConfig { + /** + * 忽略鉴权的url + */ + private List ignoreUrl = new ArrayList<>(); + + /** + * 匿名访问的url + */ + private List anonymousUrl = new ArrayList<>(); + +} diff --git a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSercurityConfig.java b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSecurityConfig.java similarity index 85% rename from aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSercurityConfig.java rename to aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSecurityConfig.java index 5c346b0..c343a67 100644 --- a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSercurityConfig.java +++ b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/conf/WebSecurityConfig.java @@ -12,7 +12,6 @@ import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.BeanIds; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @@ -21,6 +20,8 @@ import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; +import java.util.List; + /** * @author wyl * @version V1.0 @@ -30,12 +31,10 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic */ @Configuration @EnableWebSecurity -/** - *开启注解功能 - */ -@EnableGlobalMethodSecurity(prePostEnabled = true) -public class WebSercurityConfig extends WebSecurityConfigurerAdapter { +public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + @Autowired + private IgnoreConfig ignoreConfig; /** * 用户登录验证器 */ @@ -57,6 +56,9 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity httpSecurity) throws Exception { + List ignoreUrl = ignoreConfig.getIgnoreUrl(); + List anonymousUrl = ignoreConfig.getAnonymousUrl(); + httpSecurity // 由于使用的是JWT，我们这里不需要csrf .csrf() @@ -68,7 +70,7 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter { // 过滤请求 .authorizeRequests() // 对于登录login 图标 要允许匿名访问 - .antMatchers("/aos/login/**") + .antMatchers("/**/login/**") .permitAll() .antMatchers("/*.html", "/**/*.html") .permitAll() @@ -78,8 +80,16 @@ public class WebSercurityConfig extends WebSecurityConfigurerAdapter { .permitAll() .antMatchers("/swagger-resources/**", "/v2/api-docs") .anonymous() - .antMatchers("/**") + /** + * 配置无需权限 + */ + .antMatchers(ignoreUrl.toArray(new String[ignoreUrl.size()])) .permitAll() + /** + * 配置无需登录 + */ + .antMatchers(anonymousUrl.toArray(new String[anonymousUrl.size()])) + .anonymous() // 除上面外的所有请求全部需要鉴权认证 .anyRequest() .authenticated() diff --git a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/filter/test2.java b/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/filter/test2.java deleted file mode 100644 index 567dac7..0000000 --- a/aos-auth-service-impl/src/main/java/com/aos/auth/service/impl/security/filter/test2.java +++ /dev/null @@ -1,18 +0,0 @@ -package com.aos.auth.service.impl.security.filter; - -import com.aos.auth.service.impl.security.AosTEst; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.security.access.method.MethodSecurityMetadataSource; -import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration; -import org.springframework.stereotype.Component; - -@Component -public class test2 extends GlobalMethodSecurityConfiguration { - @Autowired - AosTEst aosTEst; - - @Override - protected MethodSecurityMetadataSource customMethodSecurityMetadataSource() { - return aosTEst; - } -}