msb-public-java
/
RuoYi-Cloud
mirror of https://gitee.com/y_project/RuoYi-Cloud.git
1
0
Code Issues Projects Releases Wiki Activity

格式化代码，修改'{'对齐方式

Browse Source
pull/291/head
天天向上 3 years ago
parent e36b3642da
commit a5d5787735
2 changed files with 54 additions and 29 deletions
Show Stats Download Patch File Download Diff File

47
ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/config/PathPermissionMappingConfig.java
Unescape View File

@ -19,16 +19,17 @@ import java.util.*;
/**
* =====================================网关鉴权使用说明=======================================
* 场景：
* 微服务部署在内网，确定安全，无需在每个微服务都实现鉴权的逻辑，可以在网关层面实现统一鉴权
* 微服务部署在内网，确定安全，无需在每个微服务都实现鉴权的逻辑，可以在网关层面实现统一鉴权
* 使用方式：
* 1、在每个微服务的配置文件中添加参数：security.annotation.enabled: false 关闭系统默认的通过注解方式鉴权，默认开启
* 2、在每个微服务的配置文件中添加参数：pathPrefix: 值为网关中微服务匹配的路由地址前缀，例如: /auth
* 3、在网关配置文件中添加参数：security.gateway.enabled: true 启用网关统一鉴权，默认关闭
*
* 1、在每个微服务的配置文件中添加参数：security.annotation.enabled: false 关闭系统默认的通过注解方式鉴权，默认开启
* 2、在每个微服务的配置文件中添加参数：pathPrefix: 值为网关中微服务匹配的路由地址前缀，例如: /auth
* 3、在网关配置文件中添加参数：security.gateway.enabled: true 启用网关统一鉴权，默认关闭
* <p>
* 通过反射扫描所有控制器，缓存所有控制器的映射路径以及对应的权限注解，缓存到redis，方便网关鉴权
*/
@ConditionalOnProperty(prefix = "security.annotation", name = "enabled", havingValue = "false")
public class PathPermissionMappingConfig {
public class PathPermissionMappingConfig
{
/**
* 微服务在网关配置中predicates中的Path前缀，例如： /system
*/
@ -36,7 +37,8 @@ public class PathPermissionMappingConfig {
private String pathPrefix;
@PostConstruct
public PathPermissionMappingConfig execute() {
public PathPermissionMappingConfig execute()
{
RedisService redisService = SpringUtils.getBean(RedisService.class);
RequestMappingHandlerMapping bean = SpringUtils.getBean("requestMappingHandlerMapping");
Map<RequestMappingInfo, HandlerMethod> handlerMethods = bean.getHandlerMethods();
@ -45,7 +47,8 @@ public class PathPermissionMappingConfig {
*/
Map<String, String> pathPermsMap = new TreeMap<>();
handlerMethods.forEach((k, v) -> {
handlerMethods.forEach((k, v) ->
{
RequiresRoles requiresRoles = v.getMethodAnnotation(RequiresRoles.class);
RequiresPermissions requiresPermissions = v.getMethodAnnotation(RequiresPermissions.class);
@ -54,21 +57,27 @@ public class PathPermissionMappingConfig {
/**
* @RequestMapping注解
*/
if(methods.isEmpty()) {
if (methods.isEmpty())
{
methods = new HashSet<>();
methods.addAll(Arrays.asList(RequestMethod.GET, RequestMethod.POST));
}
if(requiresPermissions == null && requiresRoles == null) {
if (requiresPermissions == null && requiresRoles == null)
{
addPathPermsMap(SecurityConstants.ROLE_ANON, pathPermsMap, methods, patternValues);
}
if(requiresPermissions != null) {
for (String perms : requiresPermissions.value()) {
if (requiresPermissions != null)
{
for (String perms : requiresPermissions.value())
{
addPathPermsMap(perms, pathPermsMap, methods, patternValues);
}
}
if(requiresRoles != null) {
for (String role : requiresRoles.value()) {
if (requiresRoles != null)
{
for (String role : requiresRoles.value())
{
addPathPermsMap(SecurityConstants.ROLE_PREFIX + role, pathPermsMap, methods, patternValues);
}
}
@ -80,14 +89,18 @@ public class PathPermissionMappingConfig {
/**
* 一个path对应多个perms
*
* @param perms
* @param pathPermsMap
* @param methods
* @param patternValues
*/
private void addPathPermsMap(String perms, Map<String, String> pathPermsMap, Set<RequestMethod> methods, Set<String> patternValues) {
for (RequestMethod method : methods) {
for (String patternValue : patternValues) {
private void addPathPermsMap(String perms, Map<String, String> pathPermsMap, Set<RequestMethod> methods, Set<String> patternValues)
{
for (RequestMethod method : methods)
{
for (String patternValue : patternValues)
{
String key = pathPrefix + patternValue + "_" + method.name();
pathPermsMap.put(key, perms);
}

36
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
Unescape View File

@ -31,7 +31,7 @@ import java.util.stream.Collectors;
/**
* 网关鉴权
*
*
* @author ruoyi
*/
@Component
@ -92,14 +92,17 @@ public class AuthFilter implements GlobalFilter, Ordered
// 内部请求来源参数清除
removeHeader(mutate, SecurityConstants.FROM_SOURCE);
// 通过网关鉴权
if(gatewayAuth) {
if (gatewayAuth)
{
// admin不需要鉴权
if(isAdmin(userid)) {
if (isAdmin(userid))
{
return chain.filter(exchange.mutate().request(mutate.build()).build());
}
// 网关验证权限
String api = url + "_" + request.getMethod().name();
if(!hasPermission(api, userkey)) {
if (!hasPermission(api, userkey))
{
log.warn("无权访问：{}", api);
return ServletUtils.webFluxResponseWriter(exchange.getResponse(), "无权访问", HttpStatus.FORBIDDEN);
}
@ -107,11 +110,13 @@ public class AuthFilter implements GlobalFilter, Ordered
return chain.filter(exchange.mutate().request(mutate.build()).build());
}
private boolean isAdmin(String userid) {
private boolean isAdmin(String userid)
{
return "1".equals(userid);
}
private boolean hasPermission(String api, String token) {
private boolean hasPermission(String api, String token)
{
// 使用JSONObject接收，避免导入依赖
JSONObject loginUser = redisService.getCacheObject(CacheConstants.LOGIN_TOKEN_KEY + token);
// 获取登录用户的资源列表
@ -125,28 +130,33 @@ public class AuthFilter implements GlobalFilter, Ordered
.filter(entry -> match(entry.getKey(), api))
.map(entry -> entry.getValue())
.collect(Collectors.toSet());
if(!matchedPerms.isEmpty()) {
if (!matchedPerms.isEmpty())
{
// 所有角色权限
Set<String> rolePerms = matchedPerms.stream().filter(item -> item.startsWith("ROLE_")).collect(Collectors.toSet());
// 所有资源权限
matchedPerms.removeAll(rolePerms);
if(!rolePerms.isEmpty()) {
if(rolePerms.contains(SecurityConstants.ROLE_ANON)) {
if (!rolePerms.isEmpty())
{
if (rolePerms.contains(SecurityConstants.ROLE_ANON))
{
log.debug("允许访问公共权限:{}，{}", api, rolePerms);
return true;
}
rolePerms = rolePerms.stream().map(item -> item.substring(SecurityConstants.ROLE_PREFIX.length())).collect(Collectors.toSet());
// 求交集
rolePerms.retainAll(roles);
if(!rolePerms.isEmpty()) {
if (!rolePerms.isEmpty())
{
log.debug("允许访问角色权限:{}， {}", api, rolePerms);
return true;
}
}
// 求交集
matchedPerms.retainAll(permissions);
if(!matchedPerms.isEmpty()) {
if (!matchedPerms.isEmpty())
{
log.debug("允许访问资源权限:{}，{}", api, matchedPerms);
return true;
}
@ -155,9 +165,11 @@ public class AuthFilter implements GlobalFilter, Ordered
return false;
}
private boolean match(String pattern, String api) {
private boolean match(String pattern, String api)
{
return antPathMatcher.match(pattern, api);
}
private void addHeader(ServerHttpRequest.Builder mutate, String name, Object value)
{
if (value == null)

Write Preview
Loading…
Cancel
Save