又又更新

shinnosuke

2026-08-19 2b20145159c4c4eefc73fd449093e639812a64df

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
package com.talentcard.server.business.admin.auth;
 
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.HttpHeaders;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.server.ResponseStatusException;
import org.springframework.http.HttpStatus;
 
@Component
public class AdminAuthInterceptor implements HandlerInterceptor {
    public static final String OPERATOR_ID_ATTRIBUTE = "authenticatedAdminOperatorId";
    public static final String OPERATOR_NAME_ATTRIBUTE = "authenticatedAdminOperatorName";
 
    private final AdminAuthService service;
 
    public AdminAuthInterceptor(AdminAuthService service) {
        this.service = service;
    }
 
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        Long operatorId = service.authenticate(request.getHeader(HttpHeaders.AUTHORIZATION));
        request.setAttribute(OPERATOR_ID_ATTRIBUTE, operatorId);
        request.setAttribute(OPERATOR_NAME_ATTRIBUTE, service.operatorName(operatorId));
        String permission = permission(request.getMethod(), request.getRequestURI());
        if (!permission.isBlank() && !service.hasPermission(operatorId, permission)) {
            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "当前账号没有该操作权限");
        }
        return true;
    }
 
    private String permission(String method, String uri) {
        if (uri.startsWith("/api/admin/management/roles")) {
            return managementPermission(method, uri, "roles");
        }
        if (uri.startsWith("/api/admin/management/staff")) {
            return managementPermission(method, uri, "staff");
        }
        String page = page(uri);
        if (page.isBlank()) return "";
        String action = "GET".equalsIgnoreCase(method) ? "view" : "edit";
        if ("POST".equalsIgnoreCase(method)) action = "create";
        if ("DELETE".equalsIgnoreCase(method)) action = "delete";
        if ("PATCH".equalsIgnoreCase(method)) {
            action = uri.endsWith("/audit") || uri.endsWith("/status") ? (uri.endsWith("/audit") ? "audit" : "disable") : "edit";
        }
        return "admin." + page + "." + action;
    }
 
    private String page(String uri) {
        if (uri.startsWith("/api/admin/business/merchants")) return "merchants";
        if (uri.startsWith("/api/admin/business/products")) return "products";
        if (uri.startsWith("/api/admin/business/news")) return "news";
        if (uri.startsWith("/api/admin/business/policies")) return "policies";
        if (uri.startsWith("/api/admin/business/coupons")) return "benefit-coupons";
        if (uri.startsWith("/api/admin/dependent-card-applies")) return "family-card-applications";
        if (uri.startsWith("/api/admin/cards/child-applications")) return "child-cards";
        if (uri.startsWith("/api/admin/service-appointment-applications")) return "appointment-management";
        if (uri.startsWith("/api/admin/medical-reservations")) return "medical-reservations";
        if (uri.startsWith("/api/admin/parking-plate-submissions")) return "parking-plates";
        if (uri.startsWith("/api/admin/car-wash-benefits") || uri.startsWith("/api/admin/car-wash-merchant-jump-configs")) return "car-wash-benefits";
        if (uri.startsWith("/api/admin/fuel-services")) return "fuel-services";
        if (uri.startsWith("/api/admin/spouse-employment")) return "spouse-employment";
        if (uri.startsWith("/api/admin/hotel-reservations")) return "hotel-reservations";
        if (uri.startsWith("/api/admin/merchant-settlement")) return "merchant-settlement";
        if (uri.startsWith("/api/admin/ticket-packages")) return "movie-tickets";
        if (uri.startsWith("/api/admin/display-services")) return "display-services";
        if (uri.startsWith("/api/admin/equity-images")) return "equity-images";
        return "";
    }
 
    private String managementPermission(String method, String uri, String page) {
        String action;
        if ("GET".equalsIgnoreCase(method)) action = "view";
        else if ("POST".equalsIgnoreCase(method)) action = "create";
        else if ("DELETE".equalsIgnoreCase(method)) action = "delete";
        else if ("PUT".equalsIgnoreCase(method)) action = "edit";
        else if ("PATCH".equalsIgnoreCase(method)) action = uri.endsWith("/status") ? "disable" : "reset";
        else return "";
        return "admin." + page + "." + action;
    }
}