添加接口权限校验

src/main/java/com/gw/test/config/OpenApiConfig.java

@@ -1,7 +1,6 @@
 package com.gw.test.config;
 
 import io.swagger.v3.oas.models.Components;
-import io.swagger.v3.oas.models.info.License;
 import io.swagger.v3.oas.models.security.SecurityRequirement;
 import io.swagger.v3.oas.models.security.SecurityScheme;
 import org.springframework.context.annotation.Bean;
@@ -18,6 +17,6 @@ public class OpenApiConfig {
 		return new OpenAPI().info(new Info().title("Test").version("v1.0.0").description( "接口测试"))
 				.addSecurityItem(new SecurityRequirement().addList(HttpHeaders.AUTHORIZATION))
 				.components(new Components().addSecuritySchemes(HttpHeaders.AUTHORIZATION,new SecurityScheme()
-						.name(HttpHeaders.AUTHORIZATION).type(SecurityScheme.Type.HTTP).scheme("Bearer")));
+						.name(HttpHeaders.AUTHORIZATION).type(SecurityScheme.Type.HTTP).scheme("Bearer ")));
 	}
 }

src/main/java/com/gw/test/config/SecurityBeanConfig.java

@@ -4,10 +4,8 @@ import com.gw.test.filters.*;
 import com.gw.test.utils.JWTUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Lazy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
@@ -27,7 +25,6 @@ public class SecurityBeanConfig {
 
     @Bean
     public JWTUtil jWTUtil() {
-        log.error("jwtUtil");
         return new JWTUtil();
     }
 
@@ -46,25 +43,26 @@ public class SecurityBeanConfig {
         return new JwtAuthenticationTokenFilter(userDetailsService,jwtTokenUtil);
     }
 
-    @ConditionalOnBean(name = "dynamicSecurityService")
+//    @ConditionalOnBean(name = "dynamicSecurityService")
     @Bean
     @Autowired
     public DynamicAccessDecisionManager dynamicAccessDecisionManager() {
         return new DynamicAccessDecisionManager();
     }
 
-    @ConditionalOnBean(name = "dynamicSecurityService")
+//    @ConditionalOnBean(name = "dynamicSecurityService")
     @Bean
-    @Autowired
+//    @Lazy
     public DynamicSecurityMetadataSource dynamicSecurityMetadataSource(DynamicSecurityService dynamicSecurityService) {
+//        log.error("=============={}",dynamicSecurityService.loadDataSource());
         return new DynamicSecurityMetadataSource(dynamicSecurityService);
     }
 
-    @ConditionalOnBean(name = "dynamicSecurityService")
+//    @ConditionalOnBean(name = "dynamicSecurityService")
     @Bean
-    @Lazy(value = false)
+//    @Lazy
     public DynamicSecurityFilter dynamicSecurityFilter(DynamicSecurityMetadataSource dynamicSecurityMetadataSource,IgnoreUrlsConfig ignoreUrlsConfig){
-        log.error("动态权限注解支持启动");
+//        log.error("======动态权限注解支持启动========{}",dynamicSecurityMetadataSource);
         return new DynamicSecurityFilter(dynamicSecurityMetadataSource,ignoreUrlsConfig);
     }
 }

src/main/java/com/gw/test/config/SecurityConfig.java

@@ -2,12 +2,10 @@ package com.gw.test.config;
 
 import com.gw.test.filters.*;
 import com.gw.test.utils.JWTUtil;
-import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -15,10 +13,7 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
 import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
@@ -27,7 +22,7 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
 @EnableWebSecurity
 @RequiredArgsConstructor
 public class SecurityConfig {
-    private final JWTUtil jwtUtil;
+//    private final JWTUtil jwtUtil;
 
     private final IgnoreUrlsConfig ignoreUrlsConfig;
 
@@ -45,32 +40,6 @@ public class SecurityConfig {
 
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception{
-//        ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = httpSecurity.authorizeRequests();
-//        //不需要保护的资源路径允许访问
-//        for (String url : ignoreUrlsConfig.getUrls()) {
-//            log.error("[{}] [{}]", "白名单路径", url);
-//            registry.requestMatchers(url).permitAll();
-//        }
-//        //允许跨域请求的OPTIONS请求
-//        registry.requestMatchers(HttpMethod.OPTIONS)
-//                .permitAll();
-//        // 任何请求需要身份认证
-//        registry.and()
-//                .authorizeRequests()
-//                .anyRequest()
-//                .authenticated()
-//                // 关闭跨站请求防护及不使用session
-//                .and()
-//                .csrf(AbstractHttpConfigurer::disable)
-//                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-//                .exceptionHandling(exception -> exception
-//                        .accessDeniedHandler(restfulAccessDeniedHandler)
-//                        .authenticationEntryPoint(restAuthenticationEntryPoint))
-//                // 自定义JWT认证过滤器
-//                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-//                // 添加动态权限校验过滤器
-////                .addFilterBefore(dynamicSecurityFilter, FilterSecurityInterceptor.class);
-//        return httpSecurity.build();
 
         ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = httpSecurity
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
@@ -94,31 +63,8 @@ public class SecurityConfig {
                         .accessDeniedHandler(restfulAccessDeniedHandler)
                         .authenticationEntryPoint(restAuthenticationEntryPoint))
                 // 自定义JWT认证过滤器
-                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
+                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class)
-        // 添加动态权限校验过滤器
+                .addFilterBefore(dynamicSecurityFilter, FilterSecurityInterceptor.class);
-//        if (dynamicSecurityService != null)
-//            registry.and().addFilterBefore(dynamicSecurityFilter, FilterSecurityInterceptor.class);
-//                .addFilterBefore(dynamicSecurityFilter, FilterSecurityInterceptor.class);
         return httpSecurity.build();
     }
-//
-//    @Bean
-//    public PasswordEncoder passwordEncoder() {
-//        // 密码加密方式
-//        return new BCryptPasswordEncoder();
-//    }
-
-//    @Bean
-//    public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
-//                .exceptionHandling()
-//                .accessDeniedHandler(restfulAccessDeniedHandler)
-//                .authenticationEntryPoint(restAuthenticationEntryPoint)
-//                // 自定义权限拦截器JWT过滤器
-//                .and()
-//                .addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
-        //有动态权限配置时添加动态权限校验过滤器
-//        if(dynamicSecurityService != null){
-//            registry.and().addFilterBefore(dynamicSecurityFilter, FilterSecurityInterceptor.class);
-//        }
-//    }
 }

src/main/java/com/gw/test/config/UserSecurityConfig.java

@@ -3,21 +3,21 @@ package com.gw.test.config;
 import com.gw.test.filters.DynamicSecurityService;
 import com.gw.test.service.IGuoWeiService;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.core.userdetails.UserDetailsService;
 
-import java.util.ArrayList;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * 后台用户安全配置
  */
+@Slf4j
 @RequiredArgsConstructor
 @Configuration
 public class UserSecurityConfig {
@@ -34,15 +34,17 @@ public class UserSecurityConfig {
 
     @Bean
     public DynamicSecurityService dynamicSecurityService() {
+        log.error("========动态权限配置加载========");
         return () -> {
             Map<String, ConfigAttribute> map = new ConcurrentHashMap<>();
             Map<String,String> apis = new HashMap<>();
-            apis.put("查询用户","ROLE_USER");
+            apis.put("/guowei/list","查询所有");
-            apis.put("新增用户","ROLE_ADMIN");
+            apis.put("/guowei/update","修改");
-            apis.put("删除用户","ROLE_ADMIN");
+            apis.put("/guowei/delete","删除");
-            apis.put("修改用户","ROLE_ADMIN");
+            apis.put("/guowei/add","添加");
             for (String api : apis.keySet()) {
-                map.put(api,new SecurityConfig(apis.get(api)));
+//                map.put(api,new SecurityConfig(apis.get(api)));
+                map.put(api,new SecurityConfig(api));
             }
             return map;
         };

src/main/java/com/gw/test/entity/GuoWei.java

@@ -2,7 +2,7 @@ package com.gw.test.entity;
 
 import com.baomidou.mybatisplus.annotation.*;
 
-import java.time.LocalDateTime;
+import java.io.Serial;
 import java.io.Serializable;
 
 import io.swagger.v3.oas.annotations.media.Schema;
@@ -25,6 +25,7 @@ import lombok.experimental.Accessors;
 @Schema($schema = "GuoWei对象",description = "")
 public class GuoWei implements Serializable {
 
+    @Serial
     private static final long serialVersionUID = 1L;
 
     @Schema($schema = "主键")
@@ -44,5 +45,8 @@ public class GuoWei implements Serializable {
     @Schema($schema = "手机号")
     private String phoneNumber;
 
+    @Schema($schema = "权限")
+    private String permissions;
+
 
 }

src/main/java/com/gw/test/entity/User.java

@@ -3,21 +3,23 @@ package com.gw.test.entity;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 
 import java.util.Collection;
 import java.util.List;
+import java.util.stream.Collectors;
 
 @Data
 @AllArgsConstructor
 public class User implements UserDetails {
     private GuoWei entity;
 
-    private List<GrantedAuthority> authorities;
+    private List<String> authorities;
 
     @Override
     public Collection<? extends GrantedAuthority> getAuthorities() {
-        return this.authorities;
+        return this.authorities.stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
     }
 
     @Override

src/main/java/com/gw/test/filters/DynamicAccessDecisionManager.java

@@ -1,6 +1,7 @@
 package com.gw.test.filters;
 
 
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.access.AccessDecisionManager;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.ConfigAttribute;
@@ -9,11 +10,11 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 
 import java.util.Collection;
-import java.util.Iterator;
 
 /**
  * 判断用户是否有访问权限
  */
+@Slf4j
 public class DynamicAccessDecisionManager implements AccessDecisionManager {
 
     @Override
@@ -30,6 +31,7 @@ public class DynamicAccessDecisionManager implements AccessDecisionManager {
             //将访问所需资源或用户拥有资源进行比对
             String needAuthority = configAttribute.getAttribute();
             for (GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
+                log.error("needAuthority:{},grantedAuthority:{}", needAuthority, grantedAuthority.getAuthority());
                 if (needAuthority.trim().equals(grantedAuthority.getAuthority())) {
                     return;
                 }

src/main/java/com/gw/test/filters/DynamicSecurityFilter.java

@@ -1,7 +1,5 @@
 package com.gw.test.filters;
 
-//import com.gw.security.config.IgnoreUrlsConfig;
-//import jakarta.servlet.Filter;
 import com.gw.test.config.IgnoreUrlsConfig;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
@@ -43,7 +41,7 @@ public class DynamicSecurityFilter extends AbstractSecurityInterceptor implement
 
     @Override
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
-        log.error("进入动态权限过滤器");
+//        log.error("进入动态权限过滤器");
         HttpServletRequest request = (HttpServletRequest) servletRequest;
         FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain);
         //OPTIONS请求直接放行
@@ -54,8 +52,9 @@ public class DynamicSecurityFilter extends AbstractSecurityInterceptor implement
         //白名单请求直接放行
         PathMatcher pathMatcher = new AntPathMatcher();
         for (String path : ignoreUrlsConfig.getUrls()) {
-            log.error("=============>ignor:{},{}",path,request.getRequestURI());
+//            log.error("=============>ignor:{},{}",path,request.getRequestURI());
             if(pathMatcher.match(path,request.getRequestURI())){
+                log.error("=============>白名单请求直接放行{},{}",request.getRequestURI(),path);
                 fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
                 return;
             }

src/main/java/com/gw/test/filters/DynamicSecurityMetadataSource.java

@@ -2,10 +2,8 @@ package com.gw.test.filters;
 
 import cn.hutool.core.util.URLUtil;
 import jakarta.annotation.PostConstruct;
-import lombok.Data;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
@@ -42,7 +40,7 @@ public class DynamicSecurityMetadataSource implements FilterInvocationSecurityMe
         //获取当前访问的路径
         String url = ((FilterInvocation) o).getRequestUrl();
         String path = URLUtil.getPath(url);
-        log.error("------DynamicSecurityMetadataSource：请求url:{}",url);
+//        log.error("------DynamicSecurityMetadataSource：请求url:{}",url);
         PathMatcher pathMatcher = new AntPathMatcher();
         //获取访问该路径所需资源
         for (String pattern : configAttributeMap.keySet()) {

src/main/java/com/gw/test/service/impl/GuoWeiServiceImpl.java

@@ -15,6 +15,7 @@ import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 
+import java.util.Arrays;
 import java.util.List;
 
 /**
@@ -38,8 +39,8 @@ public class GuoWeiServiceImpl extends ServiceImpl<GuoWeiMapper, GuoWei> impleme
         wrapper.eq("username", s);
         List<GuoWei> list = list(wrapper);
         if (list.isEmpty()) return null;
-        GuoWei guoWei = list.get(0);
+        GuoWei guoWei = list.getFirst();
-        return new User(guoWei, null);
+        return new User(guoWei, Arrays.stream(guoWei.getPermissions().split(",")).toList());
     }
 
     @Override

src/main/resources/mapper/GuoWeiMapper.xml

@@ -9,6 +9,7 @@
         <result column="password" property="password" />
         <result column="create_time" property="createTime" />
         <result column="phone_number" property="phoneNumber" />
+        <result column="permissions" property="permissions" />
     </resultMap>
 
 </mapper>