update

liujie

2026-09-15 ad491191ab50a259da548863d805c57d8a95d083

 backend/src/main/java/com/tourguide/security/JwtAuthenticationFilter.java

@@ -10,6 +10,7 @@
import com.tourguide.modules.user.service.AdminUserService;
import com.tourguide.modules.user.service.GuideUserService;
import com.tourguide.modules.user.service.MiniUserService;
import com.tourguide.modules.system.service.AdminPermissionService;
import org.springframework.http.MediaType;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
@@ -29,16 +30,19 @@
    private final JwtTokenService jwtTokenService;
    private final TokenSessionService tokenSessionService;
    private final AdminUserService adminUserService;
    private final AdminPermissionService adminPermissionService;
    private final MiniUserService miniUserService;
    private final GuideUserService guideUserService;
    private final ObjectMapper objectMapper;

    public JwtAuthenticationFilter(JwtTokenService jwtTokenService, TokenSessionService tokenSessionService,
                                   AdminUserService adminUserService, MiniUserService miniUserService,
                                   AdminUserService adminUserService, AdminPermissionService adminPermissionService,
                                   MiniUserService miniUserService,
                                   GuideUserService guideUserService, ObjectMapper objectMapper) {
        this.jwtTokenService = jwtTokenService;
        this.tokenSessionService = tokenSessionService;
        this.adminUserService = adminUserService;
        this.adminPermissionService = adminPermissionService;
        this.miniUserService = miniUserService;
        this.guideUserService = guideUserService;
        this.objectMapper = objectMapper;
@@ -78,11 +82,19 @@
        }
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        String uri = request.getRequestURI();
        return uri.startsWith("/base/dougong/") || uri.startsWith("/api/base/dougong/")
                || "/base/dougong".equals(uri) || "/api/base/dougong".equals(uri);
    }

    /** 根据 Token 端类型读取对应用户表，任何端都不会回退查询其他用户表。 */
    private AppUserPrincipal loadPrincipal(TokenPayload payload, String requestUri) {
        if (payload.getClientType() == ClientType.ADMIN) {
            AdminUser user = adminUserService.findEnabledById(payload.getUserId());
            return new AppUserPrincipal(user.getId(), user.getUsername(), user.getRoleCode(), ClientType.ADMIN);
            return new AppUserPrincipal(user.getId(), user.getUsername(), user.getRoleCode(), ClientType.ADMIN,
                    adminPermissionService.getMenuCodes(user.getRoleCode()));
        }
        if (payload.getClientType() == ClientType.MINI) {
            MiniUser user = miniUserService.findEnabledById(payload.getUserId());
@@ -97,6 +109,7 @@
    private boolean allowsDisabledGuide(String requestUri) {
        return requestUri.startsWith("/api/guide/workbench")
                || requestUri.startsWith("/api/guide/notifications")
                || requestUri.startsWith("/api/guide/push-device")
                || requestUri.equals("/api/guide/auth/logout");
    }