diff --git a/boot-service/src/main/java/com/xwbing/demo/Ademo.java b/boot-service/src/main/java/com/xwbing/demo/Ademo.java index aecda90..447727b 100644 --- a/boot-service/src/main/java/com/xwbing/demo/Ademo.java +++ b/boot-service/src/main/java/com/xwbing/demo/Ademo.java @@ -1,5 +1,11 @@ package com.xwbing.demo; +import org.apache.commons.lang3.StringUtils; + +import java.util.ArrayList; +import java.util.List; +import java.util.stream.Collectors; + /** * 项目名称: boot-module-demo * 创建时间: 2018/1/23 14:45 @@ -8,6 +14,8 @@ package com.xwbing.demo; */ public class Ademo { public static void main(String[] args) { + List list=new ArrayList<>(); + List collect = list.stream().filter(s -> StringUtils.isNotEmpty(s)).collect(Collectors.toList()); String[] s={"a","b"}; } } diff --git a/boot-web/src/main/java/com/xwbing/configuration/DispatcherServletConfig.java b/boot-web/src/main/java/com/xwbing/configuration/DispatcherServletConfig.java index 7cef64b..7f31fcf 100644 --- a/boot-web/src/main/java/com/xwbing/configuration/DispatcherServletConfig.java +++ b/boot-web/src/main/java/com/xwbing/configuration/DispatcherServletConfig.java @@ -4,6 +4,7 @@ import com.alibaba.fastjson.serializer.SerializerFeature; import com.alibaba.fastjson.support.config.FastJsonConfig; import com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter; import com.xwbing.handler.LoginInterceptor; +import com.xwbing.handler.UrlPermissionsInterceptor; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.core.Ordered; @@ -28,14 +29,23 @@ public class DispatcherServletConfig extends WebMvcConfigurerAdapter { */ @Override public void addInterceptors(InterceptorRegistry registry) { - //拦截器1:登录判断 - registry.addInterceptor(new LoginInterceptor()).addPathPatterns("/**"); -// registry.addInterceptor(new LoginInterceptor()) -// .addPathPatterns("/**").excludePathPatterns("/user/login", "/servlet/captchaCode", "/swagger-ui.html"); - //拦截器2... + //登录拦截器 + registry.addInterceptor(new LoginInterceptor()).addPathPatterns("/**").excludePathPatterns("/user/login"); + //权限拦截器 + registry.addInterceptor(urlPermissionsInterceptor()).addPathPatterns("/**").excludePathPatterns("/user/login"); super.addInterceptors(registry); } + /** + * 权限拦截器 + * + * @return + */ + @Bean + public UrlPermissionsInterceptor urlPermissionsInterceptor() { + return new UrlPermissionsInterceptor(); + } + /** * 配置静态访问资源 * 访问时不需要前缀 @@ -68,7 +78,6 @@ public class DispatcherServletConfig extends WebMvcConfigurerAdapter { @Override public void addViewControllers(ViewControllerRegistry registry) { //路由配置 - registry.addViewController("/").setViewName("login.html"); registry.addViewController("druid").setViewName("druid/index.html"); //重定向 registry.addRedirectViewController("doc", "swagger-ui.html"); diff --git a/boot-web/src/main/java/com/xwbing/handler/LoginInterceptor.java b/boot-web/src/main/java/com/xwbing/handler/LoginInterceptor.java index 981109c..9b67067 100644 --- a/boot-web/src/main/java/com/xwbing/handler/LoginInterceptor.java +++ b/boot-web/src/main/java/com/xwbing/handler/LoginInterceptor.java @@ -29,8 +29,6 @@ public class LoginInterceptor extends HandlerInterceptorAdapter { private static final Set SET = new HashSet<>();//拦截器白名单 static { - //映射到登录页面，不拦截 - SET.add("/"); //映射swagger文档 SET.add("/doc"); //验证码 @@ -47,7 +45,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) { String servletPath = request.getServletPath(); - if (!SET.contains(servletPath) && !servletPath.contains("login") && !servletPath.contains("test")) { + if (!SET.contains(servletPath) && !servletPath.contains("test")) { HttpSession session = request.getSession(false); String token = request.getHeader("token"); if (session == null) { diff --git a/boot-web/src/main/java/com/xwbing/handler/UrlPermissionsInterceptor.java b/boot-web/src/main/java/com/xwbing/handler/UrlPermissionsInterceptor.java new file mode 100644 index 0000000..3ae8af5 --- /dev/null +++ b/boot-web/src/main/java/com/xwbing/handler/UrlPermissionsInterceptor.java @@ -0,0 +1,118 @@ +package com.xwbing.handler; + +import com.alibaba.fastjson.JSON; +import com.xwbing.configuration.DispatcherServletConfig; +import com.xwbing.constant.CommonConstant; +import com.xwbing.constant.CommonEnum; +import com.xwbing.domain.entity.sys.SysAuthority; +import com.xwbing.domain.entity.sys.SysUser; +import com.xwbing.service.sys.SysAuthorityService; +import com.xwbing.service.sys.SysUserService; +import com.xwbing.util.CommonDataUtil; +import com.xwbing.util.RestMessage; +import org.apache.commons.collections.CollectionUtils; +import org.apache.commons.lang3.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; + +import javax.annotation.Resource; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.io.OutputStream; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.stream.Collectors; + +public class UrlPermissionsInterceptor extends HandlerInterceptorAdapter { + @Resource + private SysAuthorityService sysAuthorityService; + @Resource + private SysUserService sysUserService; + private final Logger logger = LoggerFactory.getLogger(DispatcherServletConfig.class); + private static final Set SET = new HashSet<>();//拦截器白名单 + + static { + //映射swagger文档 + SET.add("doc"); + //验证码 + SET.add("captcha"); + //swagger + SET.add("v2/api-docs"); + SET.add("swagger-resources"); + SET.add("configuration/ui"); + SET.add("configuration/security"); + //德鲁伊监控 + SET.add("druid"); + } + + @Override + public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) { + String servletPath = request.getServletPath().substring(1); + if (!SET.contains(servletPath) && !servletPath.contains("test")) { + if (checkUrlExit(servletPath)) { + List permissionList = permissionList(request); + if (CollectionUtils.isNotEmpty(permissionList) && permissionList.contains(servletPath)) { + return true; + } else { + try { + logger.error("没有权限"); + OutputStream outputStream = response.getOutputStream(); + RestMessage restMessage = new RestMessage(); + restMessage.setMessage("没有权限"); + outputStream.write(JSON.toJSONString(restMessage).getBytes("utf-8")); + outputStream.close(); + } catch (IOException e) { + e.printStackTrace(); + } + return false; + } + } + } + return true; + } + + /** + * 获取用户权限列表 + * + * @return + */ + private List permissionList(HttpServletRequest request) { + String token = request.getHeader("token"); + String userName = (String) CommonDataUtil.getData(token); + SysUser user = sysUserService.getByUserName(userName); + List sysAuthorities; + if (CommonConstant.IS_ENABLE.equalsIgnoreCase(user.getAdmin())) { + sysAuthorities = sysAuthorityService.listByEnable(CommonEnum.YesOrNoEnum.YES.getCode()); + } else { + sysAuthorities = sysUserService.listAuthorityByIdAndEnable(user.getId(), "Y"); + } + return sysAuthorities.stream().map(SysAuthority::getUrl).filter(StringUtils::isNotEmpty).collect(Collectors.toList()); + } + + /** + * 如果是返回true,表示需要认证。如果是返回false表示权限列表里没有,可以不需要认证 + * + * @param perms + * @return + */ + private boolean checkUrlExit(String perms) { + boolean exitTag = false; + List list = sysAuthorityService.listByEnable(""); + if (CollectionUtils.isNotEmpty(list)) { + for (SysAuthority sysAuthority : list) { + String validateUrl = sysAuthority.getUrl(); + if (StringUtils.isEmpty(validateUrl)) { + continue; + } + if (validateUrl.equalsIgnoreCase(perms)) { + exitTag = true; + break; + } + } + } + return exitTag; + } +}