ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java
@@ -60,6 +60,8 @@ } map.put("roleName",roles.get(0).getRoleName()); // 登录响应脱敏，禁止返回密码哈希 userInfo.getSysUser().setPassword(null); map.put("info", userInfo); if(userInfo.getSysUser().getRoleType() == 2){ Partner partner = partnerClient.getPartnerById(userInfo.getSysUser().getObjectId()).getData(); ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/TokenConstants.java
@@ -20,8 +20,8 @@ /** * 令牌秘钥 */ public final static String SECRET = "abcdefghijklmnopqrstuvwxyz"; public final static String SECRET = "51prlNL3P/IxFOYpLG0yQBh31M+gYuQANCEEBMkXUv96K3T77ux0fEEmWeqKYuDQVAMMfdtmzjoBwVqbKkYCpA=="; /** * 参数签名 */ ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/auth/AuthLogic.java
@@ -168,7 +168,7 @@ { Set<String> permissionList = getPermiList(); if(null == permissionList || permissionList.size() == 0){ return; throw new NotPermissionException(StringUtils.join(permissions, ",")); } for (String permission : permissions) { ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
@@ -38,6 +38,9 @@ @Component public class AuthFilter implements GlobalFilter, Ordered { private static final Logger log = LoggerFactory.getLogger(AuthFilter.class); /** 小程序token可访问的管理后台路径前缀白名单 */ private static final String[] APPLET_SYSTEM_WHITELIST = { "/system/faq/" }; // 排除过滤的 uri 地址，nacos自行添加 @Autowired @@ -81,6 +84,11 @@ String userid = JwtUtils.getUserId(claims); String username = JwtUtils.getUserName(claims); String userType = JwtUtils.getUserType(claims); // 小程序token禁止访问管理后台 /system/** 接口（白名单除外） if ("applet".equals(userType) && !isAppletAllowed(url)) { return unauthorizedResponse(exchange, "无权限访问该接口"); } // 设置用户信息到请求 addHeader(mutate, SecurityConstants.USER_KEY, userkey); @@ -91,6 +99,23 @@ removeHeader(mutate, SecurityConstants.FROM_SOURCE); return chain.filter(exchange.mutate().request(mutate.build()).build()); } /** * 小程序token是否允许访问该路径 * @param url 请求路径 * @return true=允许 */ private boolean isAppletAllowed(String url) { if (!url.startsWith("/system/")) { return true; } for (String whitelist : APPLET_SYSTEM_WHITELIST) { if (url.startsWith(whitelist)) { return true; } } return false; } private void addHeader(ServerHttpRequest.Builder mutate, String name, Object value) { if (value == null) { ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -114,10 +114,15 @@ /** * 获取用户选择列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR) @PostMapping("/getChangeUserList") @ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"}) public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) { return AjaxResult.success(userService.getChangeUserList(query)); PageInfo<SysUser> pageInfo = userService.getChangeUserList(query); if (pageInfo != null && pageInfo.getRecords() != null) { pageInfo.getRecords().forEach(u -> u.setPassword(null)); } return AjaxResult.success(pageInfo); } /** @@ -193,6 +198,7 @@ /** * 根据用户编号获取详细信息 */ @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR) @ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"}) @GetMapping("/getInfo/{userId}") public AjaxResult getInfo(@PathVariable Long userId) { @@ -208,6 +214,7 @@ List<Site> data = siteClient.getSiteByIds(siteIds).getData(); List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList()); sysUser.setSiteNames(siteNames); sysUser.setPassword(null); ajax.put(AjaxResult.DATA_TAG, sysUser); ajax.put("postIds", postService.selectPostListByUserId(userId)); ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList())); @@ -324,12 +331,14 @@ } @InnerAuth @PostMapping("/getUserList") public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) { List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds)); return R.ok(list); } @InnerAuth @PostMapping("/getSysUserFromCompanyId") public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) { LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>(); @@ -377,6 +386,7 @@ } return R.ok(companyUserListVos); } @InnerAuth @PostMapping("/isAdmin") public R<Integer> isAdmin(@RequestBody Long userId){ SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); @@ -384,6 +394,7 @@ return R.ok(id.intValue()); } @InnerAuth @PostMapping("/getSysUser") public R<SysUser> getSysUser(@RequestParam("userId") Long userId) { try { @@ -395,6 +406,7 @@ } } @InnerAuth @PostMapping("/updateSysUser") @Transactional(rollbackFor = Exception.class) public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) { @@ -417,6 +429,7 @@ } @InnerAuth @PostMapping("/companySaveSysUser") public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) { List<CompanyUserListVo> list = dto.getList(); @@ -466,6 +479,7 @@ } @InnerAuth @PostMapping("/addTRepairSysUser") public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) { List<TRepairShopAdd> list = dto.getList(); @@ -548,6 +562,7 @@ Set<String> roles = permissionService.getRolePermission(user); // 权限集合 Set<String> permissions = permissionService.getMenuPermission(user); user.setPassword(null); AjaxResult ajax = AjaxResult.success(); ajax.put("user", user); ajax.put("roles", roles); @@ -698,6 +713,7 @@ /** * 状态修改 */ @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR) @Log(title = "用户管理", businessType = BusinessType.UPDATE) @PutMapping("/changeStatus") public AjaxResult changeStatus(@RequestBody SysUser user) { @@ -710,11 +726,14 @@ /** * 根据用户编号获取授权角色 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/authRole/{userId}") public AjaxResult authRole(@PathVariable("userId") Long userId) { userService.checkUserDataScope(userId); AjaxResult ajax = AjaxResult.success(); SysUser user = userService.selectUserById(userId); List<SysRole> roles = roleService.selectRolesByUserId(userId); user.setPassword(null); ajax.put("user", user); ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList())); return ajax; @@ -723,6 +742,7 @@ /** * 用户授权角色 */ @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR) @Log(title = "用户管理", businessType = BusinessType.GRANT) @PutMapping("/authRole") public AjaxResult insertAuthRole(Long userId, Long[] roleIds) { @@ -734,11 +754,13 @@ /** * 获取部门树列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/deptTree") public AjaxResult deptTree(SysDept dept) { return success(deptService.selectDeptTreeList(dept)); } @InnerAuth @PostMapping("/updateUser") public R<Boolean> updateUser(@RequestBody SysUser sysUser){ return R.ok(userService.updateById(sysUser)); @@ -749,6 +771,7 @@ * @param userId * @return */ @InnerAuth @PostMapping("/queryRoleByUserId/{userId}") public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){ SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class) @@ -765,6 +788,7 @@ } @InnerAuth @PostMapping("/queryRoleByRoleId/{roleId}") public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){ return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class) @@ -777,6 +801,7 @@ * @param phoneList * @return */ @InnerAuth @PostMapping("/queryUserByPhoneList") public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){ List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class) @@ -790,6 +815,7 @@ * @param dtoList * @return */ @InnerAuth @PostMapping("/addUserRole") public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){ List<SysUserRole> userRoles = new ArrayList<>(); @@ -807,6 +833,7 @@ * @param phone * @return */ @InnerAuth @PostMapping("/queryUserByPhone") public R<SysUser> queryUserByPhone(@RequestBody String phone){ SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class) @@ -822,6 +849,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping("/queryUserByUserName") public R<SysUser> queryUserByUserName(@RequestBody String userName){ SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class) @@ -836,6 +864,7 @@ * @param user */ @ResponseBody @InnerAuth @PostMapping("/addSysUser") @Transactional(rollbackFor = Exception.class) public R<Long> addSysUser(@RequestBody SysUser user) { @@ -867,6 +896,7 @@ @ResponseBody @InnerAuth @PostMapping("/resetPassword") public R resetPassword(@RequestBody SysUser user) { user.setPassword(SecurityUtils.encryptPassword(user.getPassword())); @@ -877,6 +907,7 @@ @ResponseBody @InnerAuth @PostMapping("/getSysUserById") public SysUser getSysUserById(@RequestParam("userId") Long userId){ return userService.getById(userId); ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
@@ -17,6 +17,8 @@ import com.ruoyi.common.log.annotation.Log; import com.ruoyi.common.log.enums.BusinessType; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.core.web.controller.BaseController; import com.ruoyi.common.core.web.domain.AjaxResult; import com.ruoyi.common.core.utils.poi.ExcelUtil; @@ -37,6 +39,7 @@ /** * 查询用户和角色关联列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/list") public TableDataInfo list(SysUserRole sysUserRole) { startPage(); @@ -47,6 +50,7 @@ /** * 导出用户和角色关联列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.EXPORT) @PostMapping("/export") public void export(HttpServletResponse response, SysUserRole sysUserRole) { @@ -58,6 +62,7 @@ /** * 获取用户和角色关联详细信息 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping(value = "/{userId}") public AjaxResult getInfo(@PathVariable("userId") Long userId) { return success(sysUserRoleService.selectSysUserRoleByUserId(userId)); @@ -66,6 +71,7 @@ /** * 新增用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/add", "/systemUserManagement/update"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.INSERT) @PostMapping public AjaxResult add(@RequestBody SysUserRole sysUserRole) { @@ -75,6 +81,7 @@ /** * 修改用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/update", "/systemUserManagement/del"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.UPDATE) @PutMapping public AjaxResult edit(@RequestBody SysUserRole sysUserRole) { @@ -84,6 +91,7 @@ /** * 删除用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/del"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.DELETE) @DeleteMapping("/{userIds}") public AjaxResult remove(@PathVariable Long[] userIds) { @@ -96,6 +104,7 @@ * @param userId * @return */ @InnerAuth @PostMapping("/getRoleByUserId") public R<List<SysUserRoleVo>> getRoleByUserId(@RequestParam("userId") Long userId){ List<SysUserRole> list = sysUserRoleService.list(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
@@ -35,6 +35,7 @@ import com.ruoyi.common.redis.service.RedisService; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.auth.AuthUtil; import com.ruoyi.common.security.service.TokenService; import com.ruoyi.common.security.utils.SecurityUtils; @@ -270,6 +271,7 @@ * 远程调用 积分兑换订单 退款回退积分 * @return */ @InnerAuth @PostMapping(value = "/refundPoints/{param}") public R refundPoints(@PathVariable("param")String param) { String[] split = param.split("-"); @@ -296,6 +298,7 @@ } @ApiOperation(value = "管理后台-根据手机号查询用户ids", tags = {"管理后台-活动费用统计"}) @RequiresPermissions(value = {"/appUser/select", "/appUser/list"}, logical = Logical.OR) @PostMapping(value = "/user/getUserIdsByPhone") public R<List<Long>> getUserIdsByPhone(@RequestParam("phone") String phone) { return R.ok(appUserService.list(new QueryWrapper<TAppUser>().like("phone",phone)).stream().map(TAppUser::getId).collect(Collectors.toList())); @@ -838,9 +841,8 @@ @ApiOperation(value = "用户详情积分明细", tags = {"小程序-个人中心"}) @PostMapping(value = "/user/points/page1") public R<Page<TAppUserIntegralChange>> pointsDetail1(@RequestBody PointsQueryDto pointsQueryDto) { if (pointsQueryDto.getUserId()==null){ pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); } // 强制绑定当前登录用户，防止越权查询他人积分明细 pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); List<Integer> types = new ArrayList<>(); if (pointsQueryDto.getType()==null){ types.add(1); @@ -896,9 +898,8 @@ @ApiOperation(value = "余额明细", tags = {"小程序-个人中心"}) @PostMapping(value = "/user/balance/page1") public R<Page<TExchangeCodeUseRecord>> balanceDetail(@RequestBody ExchangeCodeUseRecordQuery queryDto) { if (queryDto.getUserId() == null) { queryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); } // 强制绑定当前登录用户，防止越权查询他人余额明细 queryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); return otherClient.exchangeCodeUseRecordPage(queryDto); } @@ -1222,6 +1223,7 @@ @RequiresPermissions(value = {"/appUser/giftVip", "/appUser/gift_vip"}, logical = Logical.OR) @PostMapping(value = "/user/give/vip1") public R giveVip1(@RequestBody GiveVipDto giveVipDto) { String[] split = giveVipDto.getUserIds().split(","); ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
@@ -23,6 +23,8 @@ import com.ruoyi.common.log.enums.OperatorType; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.service.TokenService; import com.ruoyi.common.security.utils.SecurityUtils; import com.ruoyi.order.api.feignClient.ChargingOrderClient; import io.swagger.annotations.Api; @@ -72,6 +74,7 @@ * 新增临时枪 * @return */ @InnerAuth @PostMapping("/addGunTemp") @ResponseBody R<Integer> addGunTemp(@RequestBody TChargingGun gun){ @@ -81,6 +84,7 @@ /** * 查询所有枪 */ @InnerAuth @PostMapping(value = "/getAllGun") @ResponseBody public R<List<TChargingGun>> getAllGun() { @@ -89,6 +93,7 @@ /** * 查询所有桩 */ @InnerAuth @PostMapping(value = "/getAllPile") public R<List<TChargingPile>> getAllPile() { return R.ok(chargingPileService.list()); @@ -287,6 +292,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getAllName/{id}") public R<String> getAllName(@PathVariable Integer id){ TChargingGun chargingGun = chargingGunService.getById(id); @@ -301,6 +307,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getChargingGunById/{id}") public R<TChargingGun> getChargingGunById(@PathVariable Integer id){ TChargingGun chargingGun = chargingGunService.getById(id); @@ -320,6 +327,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getAllInfoById/{id}") public R<SiteNameVO> getAllInfoById(@PathVariable Integer id){ SiteNameVO siteNameVO = new SiteNameVO(); @@ -338,6 +346,7 @@ * @param code * @return */ @InnerAuth @PostMapping("/getChargingGunByCode") public R<TChargingGun> getChargingGunByCode(@RequestBody GetChargingGunByCode code){ TChargingPile chargingPile = chargingPileService.getOne(new LambdaQueryWrapper<TChargingPile>() @@ -358,6 +367,7 @@ * @param chargingGun * @return */ @InnerAuth @PostMapping("/updateChargingGunById") public R<String> updateChargingGunById(@RequestBody TChargingGun chargingGun){ chargingGunService.updateById(chargingGun); @@ -371,6 +381,7 @@ * @param chargingPileId * @return */ @InnerAuth @PostMapping("/getChargingGunByChargingPileId") public R<List<TChargingGun>> getChargingGunByChargingPileId(@RequestParam("chargingPileId") Integer chargingPileId){ List<TChargingGun> list = chargingGunService.list(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getChargingPileId, chargingPileId) @@ -383,6 +394,7 @@ * 根据充电桩ids获取枪 * @return */ @InnerAuth @PostMapping("/getChargingGunByChargingPileIds") public R<List<TChargingGun>> getChargingGunByChargingPileIds(@RequestBody GetChargingGunByChargingPileIdsVo vo){ if(vo.getChargingPileIds().isEmpty()){ @@ -398,6 +410,7 @@ * 根据枪唯一码查询信息 * @return */ @InnerAuth @PostMapping("/getChargingGunByFullNumber") public R<TChargingGun> getChargingGunByFullNumber(@RequestParam("fullNumber") String fullNumber){ TChargingGun chargingGun = chargingGunService.getOne(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getDelFlag, 0).eq(TChargingGun::getFullNumber, fullNumber)); ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
@@ -1179,6 +1179,7 @@ @ResponseBody @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR) @PostMapping(value = "/pay/order/refund") @ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"}) public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) { @@ -1275,6 +1276,7 @@ @ResponseBody @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR) @GetMapping(value = "/pay/order/refund/detail") @ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"}) public R refundDetail(Long orderId, Integer type) { @@ -1295,6 +1297,7 @@ } @ResponseBody @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR) @GetMapping(value = "/pay/order/charging") @ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"}) public R<PayOrderChargingInfo> refundDetail(Long orderId) { @@ -1326,6 +1329,7 @@ } @ResponseBody @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR) @GetMapping(value = "/pay/order/charging/details") @ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"}) public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {
