添加全局过滤器，访问接口前验证id和密钥
haoran
parent
caa163ed6b
commit
064babee99
|
|
@ -4,7 +4,7 @@
|
|||
<parent>
|
||||
<groupId>cn.iocoder.cloud</groupId>
|
||||
<artifactId>sk-module-data</artifactId>
|
||||
<version>2.4.1-jdk8-SNAPSHOT</version>
|
||||
<version>${revision}</version>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<artifactId>sk-module-data-api</artifactId>
|
||||
|
|
|
|||
|
|
@ -181,7 +181,7 @@
|
|||
<addClasspath>true</addClasspath>
|
||||
<classpathPrefix>lib/</classpathPrefix>
|
||||
<useUniqueVersions>false</useUniqueVersions>
|
||||
<mainClass>cn.iocoder.yudao.module.system.SystemServerApplication</mainClass>
|
||||
<mainClass>org.sk.module.data.SkModuleDataBizApplication</mainClass>
|
||||
</manifest>
|
||||
<manifestEntries>
|
||||
<Class-Path>./resources/</Class-Path>
|
||||
|
|
@ -217,7 +217,7 @@
|
|||
</execution>
|
||||
</executions>
|
||||
</plugin>
|
||||
<!--<plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-dependency-plugin</artifactId>
|
||||
<executions>
|
||||
|
|
@ -235,7 +235,7 @@
|
|||
</configuration>
|
||||
</execution>
|
||||
</executions>
|
||||
</plugin>-->
|
||||
</plugin>
|
||||
|
||||
</plugins>
|
||||
</build>
|
||||
|
|
|
|||
|
|
@ -32,6 +32,7 @@ public class SecurityConfiguration {
|
|||
.requestMatchers("/actuator/**").permitAll();
|
||||
// RPC 服务的安全配置
|
||||
registry.requestMatchers(ApiConstants.PREFIX + "/**").permitAll();
|
||||
registry.requestMatchers( "/finance/**").permitAll();
|
||||
}
|
||||
|
||||
};
|
||||
|
|
|
|||
|
|
@ -4,6 +4,8 @@ package org.sk.module.data.controller.finance;
|
|||
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
|
||||
import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
|
||||
import cn.iocoder.yudao.framework.common.util.object.ObjectUtils;
|
||||
import io.swagger.v3.oas.annotations.Operation;
|
||||
import io.swagger.v3.oas.annotations.tags.Tag;
|
||||
import org.sk.module.data.dal.bo.finance.FinanceBO;
|
||||
import org.sk.module.data.dal.param.finance.FinanceParam;
|
||||
import org.sk.module.data.dal.param.finance.IncomeAndTaxParam;
|
||||
|
|
@ -11,15 +13,12 @@ import org.sk.module.data.dal.vo.FinanceVO;
|
|||
import org.sk.module.data.service.finance.FinanceService;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.access.prepost.PreAuthorize;
|
||||
import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.bind.annotation.RequestBody;
|
||||
import org.springframework.web.bind.annotation.RequestMapping;
|
||||
import org.springframework.web.bind.annotation.RestController;
|
||||
import org.springframework.web.bind.annotation.*;
|
||||
|
||||
import javax.annotation.security.PermitAll;
|
||||
import javax.validation.Valid;
|
||||
import java.util.List;
|
||||
|
||||
@Tag(name = "对外接口 - 财务数据")
|
||||
@RestController
|
||||
@RequestMapping("/finance")
|
||||
public class FinanceController {
|
||||
|
|
@ -34,6 +33,7 @@ public class FinanceController {
|
|||
return "hello wzc";
|
||||
}
|
||||
|
||||
@Operation(summary = "获取财务信息")
|
||||
@GetMapping("/getFinanceInfo")
|
||||
public CommonResult<FinanceVO> getFinanceInfo(@Valid @RequestBody FinanceParam financeParam) {
|
||||
|
||||
|
|
@ -48,8 +48,8 @@ public class FinanceController {
|
|||
* @param param
|
||||
* @return
|
||||
*/
|
||||
// @PermitAll
|
||||
@GetMapping("/getIncomeAndTax")
|
||||
@Operation(summary = "根据拼接的统一社会信用编码以及年份获取数据")
|
||||
@PostMapping("/getIncomeAndTax")
|
||||
public CommonResult<List<FinanceVO>> getIncomeAndTax(@Valid @RequestBody IncomeAndTaxParam param) {
|
||||
return CommonResult.success(financeService.getIncomeAndTax(param));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,19 @@
|
|||
package org.sk.module.data.dal.mapper.auth;
|
||||
|
||||
import com.baomidou.dynamic.datasource.annotation.DS;
|
||||
import org.apache.ibatis.annotations.Mapper;
|
||||
import org.apache.ibatis.annotations.Param;
|
||||
import org.sk.module.data.dal.bo.finance.FinanceBO;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author haoran
|
||||
*/
|
||||
@Mapper
|
||||
@DS("master")
|
||||
public interface AuthClientMapper {
|
||||
|
||||
int selectClientByIdAndSecret(@Param("id")String id, @Param("secret")String secret);
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
package org.sk.module.data.filter;
|
||||
|
||||
import org.sk.module.data.dal.mapper.auth.AuthClientMapper;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.beans.factory.annotation.Qualifier;
|
||||
import org.springframework.stereotype.Component;
|
||||
import org.springframework.web.method.HandlerMethod;
|
||||
import org.springframework.web.servlet.HandlerExecutionChain;
|
||||
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Method;
|
||||
|
||||
@Component
|
||||
public class AuthFilter implements Filter {
|
||||
|
||||
@Autowired
|
||||
@Qualifier("requestMappingHandlerMapping") // 或 "controllerEndpointHandlerMapping"
|
||||
private RequestMappingHandlerMapping handlerMapping;
|
||||
|
||||
@Autowired
|
||||
private AuthClientMapper authClientMapper;
|
||||
|
||||
public AuthFilter( RequestMappingHandlerMapping requestMappingHandlerMapping) {
|
||||
this.handlerMapping = requestMappingHandlerMapping;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
|
||||
throws IOException, ServletException {
|
||||
HttpServletRequest httpRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse httpResponse = (HttpServletResponse) response;
|
||||
|
||||
// 获取请求头中的密钥和 ID
|
||||
String id = httpRequest.getHeader("X-Id");
|
||||
String secretKey = httpRequest.getHeader("X-Secret-Key");
|
||||
|
||||
// 校验 ID 和密钥是否匹配
|
||||
if (isValid(id, secretKey)) {
|
||||
chain.doFilter(request, response);
|
||||
} else {
|
||||
httpResponse.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 Forbidden
|
||||
httpResponse.setContentType("application/json");
|
||||
httpResponse.getWriter().write("{\"error\": \"Invalid ID or Secret Key\"}");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* 校验 ID 和密钥是否匹配
|
||||
*/
|
||||
private boolean isValid(String id, String secretKey) {
|
||||
// 示例逻辑：从数据库中查询 ID 和密钥是否匹配
|
||||
return authClientMapper.selectClientByIdAndSecret(id,secretKey) == 1;
|
||||
}
|
||||
}
|
||||
|
|
@ -16,7 +16,7 @@ import java.util.Arrays;
|
|||
import java.util.List;
|
||||
|
||||
@Service
|
||||
@DS("master")
|
||||
@DS("slave1")
|
||||
public class FinanceServiceImpl implements FinanceService {
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,8 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
|
||||
<mapper namespace="org.sk.module.data.dal.mapper.auth.AuthClientMapper">
|
||||
|
||||
<select id="selectClientByIdAndSecret" resultType="java.lang.Integer">
|
||||
select count(0) from system_oauth2_client WHERE client_id =#{id} and secret = #{secret} and deleted = 0
|
||||
</select>
|
||||
</mapper>
|
||||
Loading…
Reference in New Issue