feat:APP端验证码登录及联调

“mitao”

2026-04-07 4ba9020b7c67cc318448a8aeac741492b23b4189

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
package com.tcm.training.admin.config;
 
import com.tcm.training.admin.app.auth.support.StpAppUserUtil;
import cn.dev33.satoken.interceptor.SaInterceptor;
import cn.dev33.satoken.context.SaHolder;
import cn.dev33.satoken.stp.StpUtil;
import com.tcm.training.admin.common.xss.XssParamInterceptor;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
import java.io.File;
 
@Configuration
public class SaTokenWebConfig implements WebMvcConfigurer {
 
    private final XssParamInterceptor xssParamInterceptor;
 
    @Value("${app.upload.dir:uploads}")
    private String uploadDir;
 
    @Value("${app.upload.path-prefix:/uploads}")
    private String pathPrefix;
 
    public SaTokenWebConfig(XssParamInterceptor xssParamInterceptor) {
        this.xssParamInterceptor = xssParamInterceptor;
    }
 
    /**
     * 注册 Sa-Token 与 XSS 拦截器。
     */
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new SaInterceptor(handle -> handleAuth()))
                .addPathPatterns("/api/**", "/api/v1/**")
                .excludePathPatterns(
                        pathPrefix + "/**"
                );
 
        registry.addInterceptor(xssParamInterceptor)
                .addPathPatterns("/api/**", "/api/v1/**");
    }
 
    /**
     * 按请求路径切换管理员鉴权与 APP 鉴权。
     */
    private void handleAuth() {
        if ("OPTIONS".equalsIgnoreCase(SaHolder.getRequest().getMethod())) {
            return;
        }
        String requestPath = SaHolder.getRequest().getRequestPath();
        if (isAppApi(requestPath)) {
            if (isPublicAppApi(requestPath)) {
                return;
            }
            StpAppUserUtil.checkLogin();
            return;
        }
        if (isPublicAdminApi(requestPath)) {
            return;
        }
        StpUtil.checkLogin();
    }
 
    /**
     * 判断是否属于 APP 路由空间。
     */
    private boolean isAppApi(String requestPath) {
        return requestPath.startsWith("/api/app/") || requestPath.startsWith("/api/v1/app/");
    }
 
    /**
     * 判断当前 APP 路由是否允许匿名访问。
     */
    private boolean isPublicAppApi(String requestPath) {
        return requestPath.startsWith("/api/app/auth/")
                || requestPath.startsWith("/api/v1/app/auth/")
                || "/api/app/version/check".equals(requestPath)
                || "/api/v1/app/version/check".equals(requestPath);
    }
 
    /**
     * 判断当前后台路由是否允许匿名访问。
     */
    private boolean isPublicAdminApi(String requestPath) {
        return "/api/auth/login".equals(requestPath)
                || "/api/auth/captcha".equals(requestPath);
    }
 
    /**
     * 将本地上传目录映射为静态资源，可通过 /uploads/** 访问。
     */
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        // 转为绝对路径，确保 file: 协议正确。
        String absPath = new File(uploadDir).getAbsolutePath();
        registry.addResourceHandler(pathPrefix + "/**")
                .addResourceLocations("file:" + absPath + "/");
    }
}