refactor(resource): 接口放行
parent
477d1c0dea
commit
ecc03229bd
|
|
@ -85,7 +85,7 @@ public class ModelCommentController {
|
|||
* 获取模型评论
|
||||
*/
|
||||
@ApiOperation(value = "获取模型评论")
|
||||
@GetMapping("/comment")
|
||||
@GetMapping("/getComment")
|
||||
@Valid
|
||||
public R<List<ModelCommentVo>> getComment(@Valid
|
||||
@NotNull(message = "模型id不能为空")
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ public class ModelImageCommentController {
|
|||
* 获取图片评论
|
||||
*/
|
||||
@ApiOperation(value = "获取图片评论")
|
||||
@GetMapping("/comment")
|
||||
@GetMapping("/getComment")
|
||||
@Valid
|
||||
public R<List<ModelImageCommentVo>> getComment(@Valid
|
||||
@NotNull(message = "图片id不能为空")
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ public class WorkFlowCommentController {
|
|||
* 获取工作流评论
|
||||
*/
|
||||
@ApiOperation(value = "获取工作流评论")
|
||||
@GetMapping("/comment")
|
||||
@GetMapping("/getComment")
|
||||
public R<List<WorkFlowCommentVo>> getComment(@Valid
|
||||
@NotNull(message = "模型id不能为空")
|
||||
@ApiParam(value = "模型id", required = true)
|
||||
|
|
|
|||
|
|
@ -30,8 +30,7 @@ import org.springframework.web.filter.CorsFilter;
|
|||
*/
|
||||
@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
|
||||
@Configuration
|
||||
public class SecurityConfig
|
||||
{
|
||||
public class SecurityConfig {
|
||||
/**
|
||||
* 自定义用户认证逻辑
|
||||
*/
|
||||
|
|
@ -79,8 +78,7 @@ public class SecurityConfig
|
|||
* 身份验证实现
|
||||
*/
|
||||
@Bean
|
||||
public AuthenticationManager authenticationManager()
|
||||
{
|
||||
public AuthenticationManager authenticationManager() {
|
||||
DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
|
||||
daoAuthenticationProvider.setUserDetailsService(userDetailsService);
|
||||
daoAuthenticationProvider.setPasswordEncoder(bCryptPasswordEncoder());
|
||||
|
|
@ -112,48 +110,67 @@ public class SecurityConfig
|
|||
* authenticated | 用户登录后可访问
|
||||
*/
|
||||
@Bean
|
||||
protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception
|
||||
{
|
||||
protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
|
||||
return httpSecurity
|
||||
// CSRF禁用，因为不使用session
|
||||
.csrf(csrf -> csrf.disable())
|
||||
// 禁用HTTP响应标头
|
||||
.headers((headersCustomizer) -> {
|
||||
headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin());
|
||||
})
|
||||
// 认证失败处理类
|
||||
.exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
|
||||
// 基于token，所以不需要session
|
||||
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
|
||||
// 注解标记允许匿名访问的url
|
||||
.authorizeHttpRequests((requests) -> {
|
||||
permitAllUrl.getUrls().forEach(url -> requests.antMatchers(url).permitAll());
|
||||
// 对于登录login 注册register 验证码captchaImage 允许匿名访问
|
||||
requests.antMatchers("/login", "/register", "/captchaImage","/ali/pay/doPay","/ali/pay/notify",
|
||||
"/ali/pay/callback","/file/**","/model/modelSquare","/image/imageList","/WorkFlow/workFlowList",
|
||||
"/system/dict/data/type/**").permitAll()
|
||||
// 静态资源，可匿名访问
|
||||
.antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll()
|
||||
.antMatchers("/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**").permitAll()
|
||||
// 除上面外的所有请求全部需要鉴权认证
|
||||
.anyRequest().authenticated();
|
||||
})
|
||||
// 添加Logout filter
|
||||
.logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
|
||||
// 添加JWT filter
|
||||
.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
|
||||
// 添加CORS filter
|
||||
.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
|
||||
.addFilterBefore(corsFilter, LogoutFilter.class)
|
||||
.build();
|
||||
// CSRF禁用，因为不使用session
|
||||
.csrf(csrf -> csrf.disable())
|
||||
// 禁用HTTP响应标头
|
||||
.headers((headersCustomizer) -> {
|
||||
headersCustomizer.cacheControl(cache -> cache.disable()).frameOptions(options -> options.sameOrigin());
|
||||
})
|
||||
// 认证失败处理类
|
||||
.exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
|
||||
// 基于token，所以不需要session
|
||||
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
|
||||
// 注解标记允许匿名访问的url
|
||||
.authorizeHttpRequests((requests) -> {
|
||||
permitAllUrl.getUrls().forEach(url -> requests.antMatchers(url).permitAll());
|
||||
// 对于登录login 注册register 验证码captchaImage 允许匿名访问
|
||||
requests.antMatchers("/login",
|
||||
"/register",
|
||||
"/captchaImage",
|
||||
"/ali/pay/doPay",
|
||||
"/ali/pay/notify",
|
||||
"/ali/pay/callback",
|
||||
"/file/**",
|
||||
"/model/modelSquare",
|
||||
"/model/selectModelById",
|
||||
"/model/finbyid",
|
||||
"/ModelVersion/finbyid",
|
||||
"/ModelComment/getComment",
|
||||
"/ModelComment/commentCount",
|
||||
"/WorkFlow/workFlowList",
|
||||
"/WorkFlow/selectWorkFlowById",
|
||||
"/WorkFlowComment/getComment",
|
||||
"/image/imageList",
|
||||
"/image/detail",
|
||||
"/imageComment/getComment",
|
||||
"/system/user/selectUserById",
|
||||
"/system/dict/data/type/**",
|
||||
"/attention/selectAttention",
|
||||
"/attention/selectUserInfo"
|
||||
).permitAll()
|
||||
// 静态资源，可匿名访问
|
||||
.antMatchers(HttpMethod.GET, "/", "/*.html", "/**/*.html", "/**/*.css", "/**/*.js", "/profile/**").permitAll()
|
||||
.antMatchers("/swagger-ui.html", "/swagger-resources/**", "/webjars/**", "/*/api-docs", "/druid/**").permitAll()
|
||||
// 除上面外的所有请求全部需要鉴权认证
|
||||
.anyRequest().authenticated();
|
||||
})
|
||||
// 添加Logout filter
|
||||
.logout(logout -> logout.logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler))
|
||||
// 添加JWT filter
|
||||
.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
|
||||
// 添加CORS filter
|
||||
.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class)
|
||||
.addFilterBefore(corsFilter, LogoutFilter.class)
|
||||
.build();
|
||||
}
|
||||
|
||||
/**
|
||||
* 强散列哈希加密实现
|
||||
*/
|
||||
@Bean
|
||||
public BCryptPasswordEncoder bCryptPasswordEncoder()
|
||||
{
|
||||
public BCryptPasswordEncoder bCryptPasswordEncoder() {
|
||||
return new BCryptPasswordEncoder();
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -146,7 +146,7 @@ public class ModelCommentServiceImpl extends ServiceImpl<ModelCommentMapper, Mod
|
|||
List<Long> allCommentIds = collectAllCommentIds(parentComments, childComments);
|
||||
|
||||
// 5. 批量查询点赞状态（仅当用户已登录）
|
||||
Map<Long, Integer> likeStatusMap = SecurityUtils.getUserIdMax() != null ?
|
||||
Map<Long, Integer> likeStatusMap = SecurityUtils.getUserIdMax() != 0 ?
|
||||
batchGetLikeStatus(allCommentIds, SecurityUtils.getUserIdMax()) :
|
||||
new HashMap<>();
|
||||
|
||||
|
|
|
|||
|
|
@ -172,7 +172,7 @@ public class ModelImageLikeServiceImpl extends ServiceImpl<ModelImageLikeMapper,
|
|||
List<Long> modelImageLikeIds = new ArrayList<>();
|
||||
|
||||
List<ModelImageLike> modelImageLikes = baseMapper.selectList(new LambdaQueryWrapper<ModelImageLike>()
|
||||
.eq(ModelImageLike::getUserId, SecurityUtils.getUserId()));
|
||||
.eq(ModelImageLike::getUserId, SecurityUtils.getUserIdMax()));
|
||||
for (ModelImageLike modelImageLike : modelImageLikes) {
|
||||
modelImageLikeIds.add(modelImageLike.getModelImageId());
|
||||
}
|
||||
|
|
|
|||
|
|
@ -142,8 +142,8 @@ public class WorkFlowCommentServiceImpl extends ServiceImpl<WorkFlowCommentMappe
|
|||
List<Long> allCommentIds = collectAllCommentIds(parentComments, childComments);
|
||||
|
||||
// 5. 批量查询点赞状态（仅当用户已登录）
|
||||
Map<Long, Integer> likeStatusMap = SecurityUtils.getUserId() != null ?
|
||||
batchGetLikeStatus(allCommentIds, SecurityUtils.getUserId()) :
|
||||
Map<Long, Integer> likeStatusMap = SecurityUtils.getUserIdMax() != 0 ?
|
||||
batchGetLikeStatus(allCommentIds, SecurityUtils.getUserIdMax()) :
|
||||
new HashMap<>();
|
||||
|
||||
// 6. 构建评论树结构（传递点赞状态）
|
||||
|
|
|
|||
Loading…
Reference in New Issue