ruoyi-auth/src/main/java/com/ruoyi/auth/controller/TokenController.java
@@ -60,6 +60,8 @@ } map.put("roleName",roles.get(0).getRoleName()); // 登录响应脱敏，禁止返回密码哈希 userInfo.getSysUser().setPassword(null); map.put("info", userInfo); if(userInfo.getSysUser().getRoleType() == 2){ Partner partner = partnerClient.getPartnerById(userInfo.getSysUser().getObjectId()).getData(); ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/constant/TokenConstants.java
@@ -20,8 +20,8 @@ /** * 令牌秘钥 */ public final static String SECRET = "abcdefghijklmnopqrstuvwxyz"; public final static String SECRET = "51prlNL3P/IxFOYpLG0yQBh31M+gYuQANCEEBMkXUv96K3T77ux0fEEmWeqKYuDQVAMMfdtmzjoBwVqbKkYCpA=="; /** * 参数签名 */ ruoyi-common/ruoyi-common-security/src/main/java/com/ruoyi/common/security/auth/AuthLogic.java
@@ -168,7 +168,7 @@ { Set<String> permissionList = getPermiList(); if(null == permissionList || permissionList.size() == 0){ return; throw new NotPermissionException(StringUtils.join(permissions, ",")); } for (String permission : permissions) { ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/AuthFilter.java
@@ -38,6 +38,9 @@ @Component public class AuthFilter implements GlobalFilter, Ordered { private static final Logger log = LoggerFactory.getLogger(AuthFilter.class); /** 小程序token可访问的管理后台路径前缀白名单 */ private static final String[] APPLET_SYSTEM_WHITELIST = { "/system/faq/" }; // 排除过滤的 uri 地址，nacos自行添加 @Autowired @@ -81,6 +84,11 @@ String userid = JwtUtils.getUserId(claims); String username = JwtUtils.getUserName(claims); String userType = JwtUtils.getUserType(claims); // 小程序token禁止访问管理后台 /system/** 接口（白名单除外） if ("applet".equals(userType) && !isAppletAllowed(url)) { return unauthorizedResponse(exchange, "无权限访问该接口"); } // 设置用户信息到请求 addHeader(mutate, SecurityConstants.USER_KEY, userkey); @@ -91,6 +99,23 @@ removeHeader(mutate, SecurityConstants.FROM_SOURCE); return chain.filter(exchange.mutate().request(mutate.build()).build()); } /** * 小程序token是否允许访问该路径 * @param url 请求路径 * @return true=允许 */ private boolean isAppletAllowed(String url) { if (!url.startsWith("/system/")) { return true; } for (String whitelist : APPLET_SYSTEM_WHITELIST) { if (url.startsWith(whitelist)) { return true; } } return false; } private void addHeader(ServerHttpRequest.Builder mutate, String name, Object value) { if (value == null) { ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -100,10 +100,15 @@ /** * 获取用户选择列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/accountingStrategy/select", "/accountingStrategy", "/roleManagement/info"}, logical = Logical.OR) @PostMapping("/getChangeUserList") @ApiOperation(value = "获取用户选择列表", tags = {"管理后台-获取用户选择列表"}) public AjaxResult<PageInfo<SysUser>> getChangeUserList(@RequestBody ChangeUserQuery query) { return AjaxResult.success(userService.getChangeUserList(query)); PageInfo<SysUser> pageInfo = userService.getChangeUserList(query); if (pageInfo != null && pageInfo.getRecords() != null) { pageInfo.getRecords().forEach(u -> u.setPassword(null)); } return AjaxResult.success(pageInfo); } /** @@ -179,6 +184,7 @@ /** * 根据用户编号获取详细信息 */ @RequiresPermissions(value = {"/systemUserManagement/update"}, logical = Logical.OR) @ApiOperation(value = "获取用户详情", tags = {"管理后台-系统用户管理"}) @GetMapping("/getInfo/{userId}") public AjaxResult getInfo(@PathVariable Long userId) { @@ -194,6 +200,7 @@ List<Site> data = siteClient.getSiteByIds(siteIds).getData(); List<String> siteNames = data.stream().map(Site::getName).collect(Collectors.toList()); sysUser.setSiteNames(siteNames); sysUser.setPassword(null); ajax.put(AjaxResult.DATA_TAG, sysUser); ajax.put("postIds", postService.selectPostListByUserId(userId)); ajax.put("roleIds", sysUser.getRoles().stream().map(SysRole::getRoleId).collect(Collectors.toList())); @@ -310,12 +317,14 @@ } @InnerAuth @PostMapping("/getUserList") public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) { List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds)); return R.ok(list); } @InnerAuth @PostMapping("/getSysUserFromCompanyId") public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) { LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>(); @@ -363,6 +372,7 @@ } return R.ok(companyUserListVos); } @InnerAuth @PostMapping("/isAdmin") public R<Integer> isAdmin(@RequestBody Long userId){ SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); @@ -370,6 +380,7 @@ return R.ok(id.intValue()); } @InnerAuth @PostMapping("/getSysUser") public R<SysUser> getSysUser(@RequestParam("userId") Long userId) { try { @@ -381,6 +392,7 @@ } } @InnerAuth @PostMapping("/updateSysUser") @Transactional(rollbackFor = Exception.class) public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) { @@ -403,6 +415,7 @@ } @InnerAuth @PostMapping("/companySaveSysUser") public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) { List<CompanyUserListVo> list = dto.getList(); @@ -452,6 +465,7 @@ } @InnerAuth @PostMapping("/addTRepairSysUser") public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) { List<TRepairShopAdd> list = dto.getList(); @@ -532,6 +546,7 @@ Set<String> roles = permissionService.getRolePermission(user); // 权限集合 Set<String> permissions = permissionService.getMenuPermission(user); user.setPassword(null); AjaxResult ajax = AjaxResult.success(); ajax.put("user", user); ajax.put("roles", roles); @@ -558,6 +573,7 @@ /** * 状态修改 */ @RequiresPermissions(value = {"/systemUserManagement/forbidden"}, logical = Logical.OR) @Log(title = "用户管理", businessType = BusinessType.UPDATE) @PutMapping("/changeStatus") public AjaxResult changeStatus(@RequestBody SysUser user) { @@ -570,11 +586,14 @@ /** * 根据用户编号获取授权角色 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/authRole/{userId}") public AjaxResult authRole(@PathVariable("userId") Long userId) { userService.checkUserDataScope(userId); AjaxResult ajax = AjaxResult.success(); SysUser user = userService.selectUserById(userId); List<SysRole> roles = roleService.selectRolesByUserId(userId); user.setPassword(null); ajax.put("user", user); ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList())); return ajax; @@ -583,6 +602,7 @@ /** * 用户授权角色 */ @RequiresPermissions(value = {"/systemUserManagement/update", "/roleManagement/info"}, logical = Logical.OR) @Log(title = "用户管理", businessType = BusinessType.GRANT) @PutMapping("/authRole") public AjaxResult insertAuthRole(Long userId, Long[] roleIds) { @@ -594,11 +614,13 @@ /** * 获取部门树列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/deptTree") public AjaxResult deptTree(SysDept dept) { return success(deptService.selectDeptTreeList(dept)); } @InnerAuth @PostMapping("/updateUser") public R<Boolean> updateUser(@RequestBody SysUser sysUser){ return R.ok(userService.updateById(sysUser)); @@ -609,6 +631,7 @@ * @param userId * @return */ @InnerAuth @PostMapping("/queryRoleByUserId/{userId}") public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){ SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class) @@ -625,6 +648,7 @@ } @InnerAuth @PostMapping("/queryRoleByRoleId/{roleId}") public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){ return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class) @@ -637,6 +661,7 @@ * @param phoneList * @return */ @InnerAuth @PostMapping("/queryUserByPhoneList") public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){ List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class) @@ -650,6 +675,7 @@ * @param dtoList * @return */ @InnerAuth @PostMapping("/addUserRole") public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){ List<SysUserRole> userRoles = new ArrayList<>(); @@ -667,6 +693,7 @@ * @param phone * @return */ @InnerAuth @PostMapping("/queryUserByPhone") public R<SysUser> queryUserByPhone(@RequestBody String phone){ SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class) @@ -682,6 +709,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping("/queryUserByUserName") public R<SysUser> queryUserByUserName(@RequestBody String userName){ SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class) @@ -696,6 +724,7 @@ * @param user */ @ResponseBody @InnerAuth @PostMapping("/addSysUser") @Transactional(rollbackFor = Exception.class) public R<Long> addSysUser(@RequestBody SysUser user) { @@ -727,6 +756,7 @@ @ResponseBody @InnerAuth @PostMapping("/resetPassword") public R resetPassword(@RequestBody SysUser user) { user.setPassword(SecurityUtils.encryptPassword(user.getPassword())); @@ -737,6 +767,7 @@ @ResponseBody @InnerAuth @PostMapping("/getSysUserById") public SysUser getSysUserById(@RequestParam("userId") Long userId){ return userService.getById(userId); ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
@@ -17,6 +17,8 @@ import com.ruoyi.common.log.annotation.Log; import com.ruoyi.common.log.enums.BusinessType; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.core.web.controller.BaseController; import com.ruoyi.common.core.web.domain.AjaxResult; import com.ruoyi.common.core.utils.poi.ExcelUtil; @@ -37,6 +39,7 @@ /** * 查询用户和角色关联列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping("/list") public TableDataInfo list(SysUserRole sysUserRole) { startPage(); @@ -47,6 +50,7 @@ /** * 导出用户和角色关联列表 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.EXPORT) @PostMapping("/export") public void export(HttpServletResponse response, SysUserRole sysUserRole) { @@ -58,6 +62,7 @@ /** * 获取用户和角色关联详细信息 */ @RequiresPermissions(value = {"/systemUserManagement", "/roleManagement/info"}, logical = Logical.OR) @GetMapping(value = "/{userId}") public AjaxResult getInfo(@PathVariable("userId") Long userId) { return success(sysUserRoleService.selectSysUserRoleByUserId(userId)); @@ -66,6 +71,7 @@ /** * 新增用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/add", "/systemUserManagement/update"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.INSERT) @PostMapping public AjaxResult add(@RequestBody SysUserRole sysUserRole) { @@ -75,6 +81,7 @@ /** * 修改用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/update", "/systemUserManagement/del"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.UPDATE) @PutMapping public AjaxResult edit(@RequestBody SysUserRole sysUserRole) { @@ -84,6 +91,7 @@ /** * 删除用户和角色关联 */ @RequiresPermissions(value = {"/systemUserManagement/del"}, logical = Logical.OR) @Log(title = "用户和角色关联", businessType = BusinessType.DELETE) @DeleteMapping("/{userIds}") public AjaxResult remove(@PathVariable Long[] userIds) { @@ -96,6 +104,7 @@ * @param userId * @return */ @InnerAuth @PostMapping("/getRoleByUserId") public R<List<SysUserRoleVo>> getRoleByUserId(@RequestParam("userId") Long userId){ List<SysUserRole> list = sysUserRoleService.list(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
@@ -32,6 +32,7 @@ import com.ruoyi.common.redis.service.RedisService; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.auth.AuthUtil; import com.ruoyi.common.security.service.TokenService; import com.ruoyi.common.security.utils.SecurityUtils; @@ -261,6 +262,7 @@ * 远程调用 积分兑换订单 退款回退积分 * @return */ @InnerAuth @PostMapping(value = "/refundPoints/{param}") public R refundPoints(@PathVariable("param")String param) { String[] split = param.split("-"); @@ -287,6 +289,7 @@ } @ApiOperation(value = "管理后台-根据手机号查询用户ids", tags = {"管理后台-活动费用统计"}) @RequiresPermissions(value = {"/appUser/select", "/appUser/list"}, logical = Logical.OR) @PostMapping(value = "/user/getUserIdsByPhone") public R<List<Long>> getUserIdsByPhone(@RequestParam("phone") String phone) { return R.ok(appUserService.list(new QueryWrapper<TAppUser>().like("phone",phone)).stream().map(TAppUser::getId).collect(Collectors.toList())); @@ -692,9 +695,8 @@ @ApiOperation(value = "用户详情积分明细", tags = {"小程序-个人中心"}) @PostMapping(value = "/user/points/page1") public R<Page<TAppUserIntegralChange>> pointsDetail1(@RequestBody PointsQueryDto pointsQueryDto) { if (pointsQueryDto.getUserId()==null){ pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); } // 强制绑定当前登录用户，防止越权查询他人积分明细 pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); List<Integer> types = new ArrayList<>(); if (pointsQueryDto.getType()==null){ types.add(1); @@ -749,9 +751,8 @@ @ApiOperation(value = "余额明细", tags = {"小程序-个人中心"}) @PostMapping(value = "/user/balance/page1") public R<Page<TExchangeCodeUseRecord>> balanceDetail(@RequestBody ExchangeCodeUseRecordQuery queryDto) { if (queryDto.getUserId() == null) { queryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); } // 强制绑定当前登录用户，防止越权查询他人余额明细 queryDto.setUserId(tokenService.getLoginUserApplet().getUserId()); return otherClient.exchangeCodeUseRecordPage(queryDto); } @@ -1024,6 +1025,7 @@ @RequiresPermissions(value = {"/appUser/giftVip", "/appUser/gift_vip"}, logical = Logical.OR) @PostMapping(value = "/user/give/vip1") public R giveVip1(@RequestBody GiveVipDto giveVipDto) { String[] split = giveVipDto.getUserIds().split(","); ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
@@ -23,6 +23,7 @@ import com.ruoyi.common.log.enums.OperatorType; import com.ruoyi.common.security.annotation.Logical; import com.ruoyi.common.security.annotation.RequiresPermissions; import com.ruoyi.common.security.annotation.InnerAuth; import com.ruoyi.common.security.service.TokenService; import com.ruoyi.common.security.utils.SecurityUtils; import com.ruoyi.order.api.feignClient.ChargingOrderClient; @@ -71,6 +72,7 @@ * 新增临时枪 * @return */ @InnerAuth @PostMapping("/addGunTemp") @ResponseBody R<Integer> addGunTemp(@RequestBody TChargingGun gun){ @@ -80,6 +82,7 @@ /** * 查询所有枪 */ @InnerAuth @PostMapping(value = "/getAllGun") @ResponseBody public R<List<TChargingGun>> getAllGun() { @@ -88,6 +91,7 @@ /** * 查询所有桩 */ @InnerAuth @PostMapping(value = "/getAllPile") public R<List<TChargingPile>> getAllPile() { return R.ok(chargingPileService.list()); @@ -250,6 +254,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getAllName/{id}") public R<String> getAllName(@PathVariable Integer id){ TChargingGun chargingGun = chargingGunService.getById(id); @@ -264,6 +269,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getChargingGunById/{id}") public R<TChargingGun> getChargingGunById(@PathVariable Integer id){ TChargingGun chargingGun = chargingGunService.getById(id); @@ -275,6 +281,7 @@ * @return */ @ResponseBody @InnerAuth @PostMapping(value = "/getAllInfoById/{id}") public R<SiteNameVO> getAllInfoById(@PathVariable Integer id){ SiteNameVO siteNameVO = new SiteNameVO(); @@ -293,6 +300,7 @@ * @param code * @return */ @InnerAuth @PostMapping("/getChargingGunByCode") public R<TChargingGun> getChargingGunByCode(@RequestBody GetChargingGunByCode code){ TChargingPile chargingPile = chargingPileService.getOne(new LambdaQueryWrapper<TChargingPile>() @@ -313,6 +321,7 @@ * @param chargingGun * @return */ @InnerAuth @PostMapping("/updateChargingGunById") public R<String> updateChargingGunById(@RequestBody TChargingGun chargingGun){ chargingGunService.updateById(chargingGun); @@ -326,6 +335,7 @@ * @param chargingPileId * @return */ @InnerAuth @PostMapping("/getChargingGunByChargingPileId") public R<List<TChargingGun>> getChargingGunByChargingPileId(@RequestParam("chargingPileId") Integer chargingPileId){ List<TChargingGun> list = chargingGunService.list(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getChargingPileId, chargingPileId) @@ -338,6 +348,7 @@ * 根据充电桩ids获取枪 * @return */ @InnerAuth @PostMapping("/getChargingGunByChargingPileIds") public R<List<TChargingGun>> getChargingGunByChargingPileIds(@RequestBody GetChargingGunByChargingPileIdsVo vo){ if(vo.getChargingPileIds().isEmpty()){ @@ -353,6 +364,7 @@ * 根据枪唯一码查询信息 * @return */ @InnerAuth @PostMapping("/getChargingGunByFullNumber") public R<TChargingGun> getChargingGunByFullNumber(@RequestParam("fullNumber") String fullNumber){ TChargingGun chargingGun = chargingGunService.getOne(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getDelFlag, 0).eq(TChargingGun::getFullNumber, fullNumber)); ruoyi-service/ruoyi-order/src/main/java/com/ruoyi/order/controller/TChargingOrderController.java
@@ -243,6 +243,7 @@ @ResponseBody @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR) @PostMapping(value = "/pay/order/refund") @ApiOperation(value = "退款", tags = {"管理后台-支付订单-订单信息"}) public R refund(@RequestBody PayOrderRefundDto payOrderQueryDto) { @@ -319,6 +320,7 @@ @ResponseBody @RequiresPermissions(value = {"/paymentOrder/refund", "/paymentOrder/refund/select"}, logical = Logical.OR) @GetMapping(value = "/pay/order/refund/detail") @ApiOperation(value = "退款信息", tags = {"管理后台-支付订单-订单信息"}) public R refundDetail(Long orderId, Integer type) { @@ -339,6 +341,7 @@ } @ResponseBody @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR) @GetMapping(value = "/pay/order/charging") @ApiOperation(value = "充电信息", tags = {"管理后台-支付订单-订单信息"}) public R<PayOrderChargingInfo> refundDetail(Long orderId) { @@ -370,6 +373,7 @@ } @ResponseBody @RequiresPermissions(value = {"/paymentOrder/order"}, logical = Logical.OR) @GetMapping(value = "/pay/order/charging/details") @ApiOperation(value = "充电明细", tags = {"管理后台-支付订单-订单信息"}) public R<List<TChargingOrderAccountingStrategy>> chargingDetail(Long orderId) {
