|
@@ -1,186 +1,186 @@
|
|
|
package com.txz.backstage.filter;
|
|
|
|
|
|
-import cn.hutool.core.util.StrUtil;
|
|
|
-import com.alibaba.fastjson.JSON;
|
|
|
-import com.netflix.zuul.ZuulFilter;
|
|
|
-import com.netflix.zuul.context.RequestContext;
|
|
|
-import com.txz.backstage.configurer.Parameters;
|
|
|
-import com.txz.backstage.model.Permission;
|
|
|
-import com.txz.backstage.model.User;
|
|
|
-import com.txz.backstage.service.PermissionService;
|
|
|
-import com.txz.backstage.util.UserUtil;
|
|
|
-import org.apache.commons.lang3.StringUtils;
|
|
|
-import org.slf4j.Logger;
|
|
|
-import org.slf4j.LoggerFactory;
|
|
|
-import org.springframework.stereotype.Component;
|
|
|
-
|
|
|
-import javax.annotation.Resource;
|
|
|
-import javax.servlet.http.HttpServletRequest;
|
|
|
-import java.util.List;
|
|
|
-
|
|
|
-@Component
|
|
|
-public class AccessFilter extends ZuulFilter {
|
|
|
-
|
|
|
- private static Logger log = LoggerFactory.getLogger(AccessFilter.class);
|
|
|
-
|
|
|
- @Resource
|
|
|
- private Parameters parameters;
|
|
|
-
|
|
|
- @Resource
|
|
|
- private PermissionService permissionService;
|
|
|
-
|
|
|
- @Resource
|
|
|
- private UserUtil userUtil;
|
|
|
-
|
|
|
- @Override
|
|
|
- public String filterType() {
|
|
|
- return "pre";
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public int filterOrder() {
|
|
|
- return 0;
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public boolean shouldFilter() {
|
|
|
- return true;
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public Object run() {
|
|
|
- RequestContext ctx = RequestContext.getCurrentContext();
|
|
|
- HttpServletRequest request = ctx.getRequest();
|
|
|
- String servicePath = request.getRequestURI();
|
|
|
- log.info(String.format("%s request to %s", request.getMethod(), request.getRequestURL().toString()));
|
|
|
- // 过滤白名单
|
|
|
- if (StrUtil.isNotBlank(parameters.getWebWhiteList())){
|
|
|
- String[] whiteUrls = parameters.getWebWhiteList().split(",");
|
|
|
- for (String url:whiteUrls) {
|
|
|
- if (StrUtil.equals(url,servicePath)){
|
|
|
- return null;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- if (StrUtil.endWith(servicePath,"/v2/api-docs")){
|
|
|
- return null;
|
|
|
- }
|
|
|
- Object accessToken = request.getHeader("accessToken");
|
|
|
- if(accessToken == null) {
|
|
|
- log.warn("access token is empty");
|
|
|
- ctx.setSendZuulResponse(false);
|
|
|
- ctx.setResponseStatusCode(200);
|
|
|
- ctx.setResponseBody("{\"code\":\"595\",\"message\":\"backstage Access Filter - token is empty\"}");
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- if (StrUtil.equals(parameters.getLoginCheck(),"true")){
|
|
|
- // 登录拦截
|
|
|
- boolean pass = validateLogin(request);
|
|
|
- if (!pass) {
|
|
|
- log.warn("登录认证失败,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
- getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
- // responseResult(response, result);
|
|
|
- ctx.setSendZuulResponse(false);
|
|
|
- ctx.setResponseStatusCode(200);
|
|
|
- ctx.setResponseBody("{\"code\":\"598\",\"message\":\"登录失败,请重新登录\"}");
|
|
|
- return false;
|
|
|
- }
|
|
|
- User user = userUtil.getTokenUser(request);
|
|
|
- if (StrUtil.isNotBlank(user.getCompanyId())){
|
|
|
- ctx.addZuulRequestHeader("companyId", user.getCompanyId());
|
|
|
- }
|
|
|
- ctx.addZuulRequestHeader("userName", user.getName());
|
|
|
- ctx.addZuulRequestHeader("userId", user.getId()+"");
|
|
|
- }
|
|
|
- // 权限拦截
|
|
|
- if (StrUtil.equals("off",parameters.getPermissionSwitch())){
|
|
|
- log.warn("接口权限校验已关闭,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
- getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
- } else {
|
|
|
- boolean pass2 = validatePermission(request);
|
|
|
- if (!pass2) {
|
|
|
- log.warn("接口权限校验失败,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
- getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
- ctx.setSendZuulResponse(false);
|
|
|
- ctx.setResponseStatusCode(200);
|
|
|
- ctx.setResponseBody("{\"code\":\"597\",\"message\":\"接口:"+request.getRequestURI()+"权限验证失败,请联系管理员\"}");
|
|
|
- return false;
|
|
|
- }
|
|
|
- }
|
|
|
- log.info("access token ok");
|
|
|
- return null;
|
|
|
- }
|
|
|
-
|
|
|
- private boolean validatePermission(HttpServletRequest request) {
|
|
|
- String uri = request.getRequestURI();
|
|
|
- if (StrUtil.isBlank(uri)){
|
|
|
- return false;
|
|
|
- }
|
|
|
- User user = userUtil.getTokenUser(request);
|
|
|
- if (user == null){
|
|
|
- return false;
|
|
|
- }
|
|
|
- // 校验user是否拥有该权限
|
|
|
- List<Permission> q = permissionService.selectPermissionByUserId(user.getId() + "");
|
|
|
- for (Permission permission2 : q) {
|
|
|
- if (StringUtils.equals(uri, permission2.geteName())) {
|
|
|
- return true;
|
|
|
- }
|
|
|
- if (StringUtils.equals(uri, permission2.getUrl())) {
|
|
|
- return true;
|
|
|
- }
|
|
|
- if(StrUtil.isNotBlank(permission2.getUrl())){
|
|
|
- if (permission2.getUrl().contains("*")){
|
|
|
- if (uri.startsWith(permission2.getUrl().substring(0,permission2.getUrl().indexOf("*")))){
|
|
|
- return true;
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * 一个简单的登录认证
|
|
|
- */
|
|
|
- private boolean validateLogin(HttpServletRequest request) {
|
|
|
- String accessToken = request.getHeader("accessToken");
|
|
|
- if (StringUtils.isBlank(accessToken)) {
|
|
|
- return false;
|
|
|
- }
|
|
|
- User user = userUtil.getTokenUser(request);
|
|
|
- if (user != null) {
|
|
|
- return true;
|
|
|
- } else {
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- }
|
|
|
-
|
|
|
- private String getIpAddress(HttpServletRequest request) {
|
|
|
- String ip = request.getHeader("x-forwarded-for");
|
|
|
- if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
- ip = request.getHeader("Proxy-Client-IP");
|
|
|
- }
|
|
|
- if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
- ip = request.getHeader("WL-Proxy-Client-IP");
|
|
|
- }
|
|
|
- if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
- ip = request.getHeader("HTTP_CLIENT_IP");
|
|
|
- }
|
|
|
- if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
- ip = request.getHeader("HTTP_X_FORWARDED_FOR");
|
|
|
- }
|
|
|
- if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
- ip = request.getRemoteAddr();
|
|
|
- }
|
|
|
- // 如果是多级代理,那么取第一个ip为客户端ip
|
|
|
- if (ip != null && ip.indexOf(",") != -1) {
|
|
|
- ip = ip.substring(0, ip.indexOf(",")).trim();
|
|
|
- }
|
|
|
-
|
|
|
- return ip;
|
|
|
- }
|
|
|
-
|
|
|
-}
|
|
|
+// import cn.hutool.core.util.StrUtil;
|
|
|
+// import com.alibaba.fastjson.JSON;
|
|
|
+// import com.netflix.zuul.ZuulFilter;
|
|
|
+// import com.netflix.zuul.context.RequestContext;
|
|
|
+// import com.txz.backstage.configurer.Parameters;
|
|
|
+// import com.txz.backstage.model.Permission;
|
|
|
+// import com.txz.backstage.model.User;
|
|
|
+// import com.txz.backstage.service.PermissionService;
|
|
|
+// import com.txz.backstage.util.UserUtil;
|
|
|
+// import org.apache.commons.lang3.StringUtils;
|
|
|
+// import org.slf4j.Logger;
|
|
|
+// import org.slf4j.LoggerFactory;
|
|
|
+// import org.springframework.stereotype.Component;
|
|
|
+//
|
|
|
+// import javax.annotation.Resource;
|
|
|
+// import javax.servlet.http.HttpServletRequest;
|
|
|
+// import java.util.List;
|
|
|
+//
|
|
|
+// @Component
|
|
|
+// public class AccessFilter extends ZuulFilter {
|
|
|
+//
|
|
|
+// private static Logger log = LoggerFactory.getLogger(AccessFilter.class);
|
|
|
+//
|
|
|
+// @Resource
|
|
|
+// private Parameters parameters;
|
|
|
+//
|
|
|
+// @Resource
|
|
|
+// private PermissionService permissionService;
|
|
|
+//
|
|
|
+// @Resource
|
|
|
+// private UserUtil userUtil;
|
|
|
+//
|
|
|
+// @Override
|
|
|
+// public String filterType() {
|
|
|
+// return "pre";
|
|
|
+// }
|
|
|
+//
|
|
|
+// @Override
|
|
|
+// public int filterOrder() {
|
|
|
+// return 0;
|
|
|
+// }
|
|
|
+//
|
|
|
+// @Override
|
|
|
+// public boolean shouldFilter() {
|
|
|
+// return true;
|
|
|
+// }
|
|
|
+//
|
|
|
+// @Override
|
|
|
+// public Object run() {
|
|
|
+// RequestContext ctx = RequestContext.getCurrentContext();
|
|
|
+// HttpServletRequest request = ctx.getRequest();
|
|
|
+// String servicePath = request.getRequestURI();
|
|
|
+// log.info(String.format("%s request to %s", request.getMethod(), request.getRequestURL().toString()));
|
|
|
+// // 过滤白名单
|
|
|
+// if (StrUtil.isNotBlank(parameters.getWebWhiteList())){
|
|
|
+// String[] whiteUrls = parameters.getWebWhiteList().split(",");
|
|
|
+// for (String url:whiteUrls) {
|
|
|
+// if (StrUtil.equals(url,servicePath)){
|
|
|
+// return null;
|
|
|
+// }
|
|
|
+// }
|
|
|
+// }
|
|
|
+// if (StrUtil.endWith(servicePath,"/v2/api-docs")){
|
|
|
+// return null;
|
|
|
+// }
|
|
|
+// Object accessToken = request.getHeader("accessToken");
|
|
|
+// if(accessToken == null) {
|
|
|
+// log.warn("access token is empty");
|
|
|
+// ctx.setSendZuulResponse(false);
|
|
|
+// ctx.setResponseStatusCode(200);
|
|
|
+// ctx.setResponseBody("{\"code\":\"595\",\"message\":\"backstage Access Filter - token is empty\"}");
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+//
|
|
|
+// if (StrUtil.equals(parameters.getLoginCheck(),"true")){
|
|
|
+// // 登录拦截
|
|
|
+// boolean pass = validateLogin(request);
|
|
|
+// if (!pass) {
|
|
|
+// log.warn("登录认证失败,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
+// getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
+// // responseResult(response, result);
|
|
|
+// ctx.setSendZuulResponse(false);
|
|
|
+// ctx.setResponseStatusCode(200);
|
|
|
+// ctx.setResponseBody("{\"code\":\"598\",\"message\":\"登录失败,请重新登录\"}");
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+// User user = userUtil.getTokenUser(request);
|
|
|
+// if (StrUtil.isNotBlank(user.getCompanyId())){
|
|
|
+// ctx.addZuulRequestHeader("companyId", user.getCompanyId());
|
|
|
+// }
|
|
|
+// ctx.addZuulRequestHeader("userName", user.getName());
|
|
|
+// ctx.addZuulRequestHeader("userId", user.getId()+"");
|
|
|
+// }
|
|
|
+// // 权限拦截
|
|
|
+// if (StrUtil.equals("off",parameters.getPermissionSwitch())){
|
|
|
+// log.warn("接口权限校验已关闭,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
+// getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
+// } else {
|
|
|
+// boolean pass2 = validatePermission(request);
|
|
|
+// if (!pass2) {
|
|
|
+// log.warn("接口权限校验失败,请求接口:{},请求IP:{},请求参数:{}", request.getRequestURI(),
|
|
|
+// getIpAddress(request), JSON.toJSONString(request.getParameterMap()));
|
|
|
+// ctx.setSendZuulResponse(false);
|
|
|
+// ctx.setResponseStatusCode(200);
|
|
|
+// ctx.setResponseBody("{\"code\":\"597\",\"message\":\"接口:"+request.getRequestURI()+"权限验证失败,请联系管理员\"}");
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+// }
|
|
|
+// log.info("access token ok");
|
|
|
+// return null;
|
|
|
+// }
|
|
|
+//
|
|
|
+// private boolean validatePermission(HttpServletRequest request) {
|
|
|
+// String uri = request.getRequestURI();
|
|
|
+// if (StrUtil.isBlank(uri)){
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+// User user = userUtil.getTokenUser(request);
|
|
|
+// if (user == null){
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+// // 校验user是否拥有该权限
|
|
|
+// List<Permission> q = permissionService.selectPermissionByUserId(user.getId() + "");
|
|
|
+// for (Permission permission2 : q) {
|
|
|
+// if (StringUtils.equals(uri, permission2.geteName())) {
|
|
|
+// return true;
|
|
|
+// }
|
|
|
+// if (StringUtils.equals(uri, permission2.getUrl())) {
|
|
|
+// return true;
|
|
|
+// }
|
|
|
+// if(StrUtil.isNotBlank(permission2.getUrl())){
|
|
|
+// if (permission2.getUrl().contains("*")){
|
|
|
+// if (uri.startsWith(permission2.getUrl().substring(0,permission2.getUrl().indexOf("*")))){
|
|
|
+// return true;
|
|
|
+// }
|
|
|
+// }
|
|
|
+// }
|
|
|
+// }
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+//
|
|
|
+// /**
|
|
|
+// * 一个简单的登录认证
|
|
|
+// */
|
|
|
+// private boolean validateLogin(HttpServletRequest request) {
|
|
|
+// String accessToken = request.getHeader("accessToken");
|
|
|
+// if (StringUtils.isBlank(accessToken)) {
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+// User user = userUtil.getTokenUser(request);
|
|
|
+// if (user != null) {
|
|
|
+// return true;
|
|
|
+// } else {
|
|
|
+// return false;
|
|
|
+// }
|
|
|
+//
|
|
|
+// }
|
|
|
+//
|
|
|
+// private String getIpAddress(HttpServletRequest request) {
|
|
|
+// String ip = request.getHeader("x-forwarded-for");
|
|
|
+// if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
+// ip = request.getHeader("Proxy-Client-IP");
|
|
|
+// }
|
|
|
+// if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
+// ip = request.getHeader("WL-Proxy-Client-IP");
|
|
|
+// }
|
|
|
+// if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
+// ip = request.getHeader("HTTP_CLIENT_IP");
|
|
|
+// }
|
|
|
+// if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
+// ip = request.getHeader("HTTP_X_FORWARDED_FOR");
|
|
|
+// }
|
|
|
+// if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
|
|
|
+// ip = request.getRemoteAddr();
|
|
|
+// }
|
|
|
+// // 如果是多级代理,那么取第一个ip为客户端ip
|
|
|
+// if (ip != null && ip.indexOf(",") != -1) {
|
|
|
+// ip = ip.substring(0, ip.indexOf(",")).trim();
|
|
|
+// }
|
|
|
+//
|
|
|
+// return ip;
|
|
|
+// }
|
|
|
+//
|
|
|
+// }
|