package cn.stylefeng.rest.core.security.base;
|
|
import cn.hutool.core.util.StrUtil;
|
import cn.stylefeng.roses.kernel.auth.api.AuthServiceApi;
|
import cn.stylefeng.roses.kernel.auth.api.SessionManagerApi;
|
import cn.stylefeng.roses.kernel.auth.api.constants.AuthConstants;
|
import cn.stylefeng.roses.kernel.auth.api.context.LoginContext;
|
import cn.stylefeng.roses.kernel.auth.api.exception.AuthException;
|
import cn.stylefeng.roses.kernel.auth.api.exception.enums.AuthExceptionEnum;
|
import cn.stylefeng.roses.kernel.auth.api.expander.AuthConfigExpander;
|
import cn.stylefeng.roses.kernel.jwt.api.pojo.payload.DefaultJwtPayload;
|
import cn.stylefeng.roses.kernel.rule.util.AntPathMatcherUtil;
|
import cn.stylefeng.roses.kernel.scanner.api.pojo.resource.ResourceDefinition;
|
import cn.stylefeng.roses.kernel.system.api.ResourceServiceApi;
|
import lombok.extern.slf4j.Slf4j;
|
import org.springframework.web.servlet.HandlerInterceptor;
|
|
import javax.annotation.Resource;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
|
/**
|
* 基础的Filter，一般用在权限过滤
|
*
|
* @author fengshuonan
|
* @since 2020/12/15 22:50
|
*/
|
@Slf4j
|
public abstract class BaseSecurityInterceptor implements HandlerInterceptor {
|
|
@Resource
|
private ResourceServiceApi resourceServiceApi;
|
|
@Resource
|
private AuthServiceApi authServiceApi;
|
|
@Resource
|
private SessionManagerApi sessionManagerApi;
|
|
@Override
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
|
|
// 1. 获取当前请求的路径
|
String requestURI = request.getRequestURI();
|
requestURI = requestURI.replaceAll("/+", "/");
|
|
// 2. 不需要权限过滤的资源，直接放行
|
Boolean noneSecurityFlag = AntPathMatcherUtil.getAntMatchFLag(requestURI, request.getContextPath(), AuthConfigExpander.getNoneSecurityConfig());
|
if (noneSecurityFlag) {
|
return true;
|
}
|
|
// 3. 获取当前用户的token，可能为null
|
String token = request.getHeader(AuthConstants.DEFAULT_AUTH_HEADER_NAME);
|
try {
|
token = LoginContext.me().getToken();
|
} catch (Exception e) {
|
// 不做处理，因为本接口可能是不需要鉴权
|
}
|
|
// 4. 如果token不为空，则先判断是否登录过期了，过期了就直接打回，不过期不做处理
|
if (StrUtil.isNotBlank(token)) {
|
DefaultJwtPayload defaultJwtPayload = null;
|
try {
|
defaultJwtPayload = authServiceApi.validateToken(token);
|
} catch (AuthException authException) {
|
if (AuthExceptionEnum.AUTH_EXPIRED_ERROR.getErrorCode().equals(authException.getErrorCode())) {
|
sessionManagerApi.destroySessionCookie();
|
throw authException;
|
}
|
}
|
|
// 5. 刷新用户的session的过期时间
|
sessionManagerApi.refreshSession(token);
|
|
// 5.1 token没过期，但是session过期了，则从新进行会话创建操作，因为只有开启remember的用户才有这种情况
|
if (defaultJwtPayload != null && !sessionManagerApi.haveSession(token)) {
|
authServiceApi.createNewLoginInfo(token, defaultJwtPayload);
|
}
|
}
|
|
// 6. 获取ResourceDefinition，可能为null
|
// ResourceUrlParam resourceUrlParam = new ResourceUrlParam();
|
// resourceUrlParam.setUrl(requestURI);
|
ResourceDefinition resourceDefinition = new ResourceDefinition();
|
resourceDefinition.setUrl(requestURI);
|
resourceDefinition.setRequiredLoginFlag(true);
|
resourceDefinition.setRequiredPermissionFlag(false);
|
// ResourceDefinition resourceDefinition = resourceServiceApi.getResourceByUrl(resourceUrlParam);
|
//
|
// // 7. 资源找不到，则当前url不被权限控制，直接打回
|
// if (resourceDefinition == null) {
|
// throw new AuthException(AuthExceptionEnum.CANT_REQUEST_UN_OPEN_API, requestURI);
|
// }
|
|
// 8.执行真正过滤器业务，如果拦截器执行不成功会抛出异常
|
this.filterAction(request, response, resourceDefinition, token);
|
|
return true;
|
}
|
|
/**
|
* 过滤器的具体业务执行逻辑
|
*
|
* @author fengshuonan
|
* @since 2020/12/15 22:52
|
*/
|
public abstract void filterAction(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, ResourceDefinition resourceDefinition, String token);
|
|
}
|
