权限优化

This commit is contained in:
暮光:城中城
2019-06-01 09:36:55 +08:00
parent 7f4f3fd432
commit 48f81dc547
22 changed files with 228 additions and 38 deletions

View File

@@ -15,6 +15,10 @@ public class DocUserUtil {
DocUserUtil.ACCESS_TOKEN.set(accessToken);
}
public static boolean havePageAuth(String authName, Long pageId) {
return haveAuth(authName + pageId);
}
public static boolean haveAuth(String... authNames) {
DocUserDetails currentUser = getCurrentUser();
if (currentUser == null) {

View File

@@ -1,18 +1,17 @@
package com.zyplayer.doc.data.repository.manage.entity;
import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import java.io.Serializable;
import java.util.Date;
import com.baomidou.mybatisplus.annotation.TableId;
import java.io.Serializable;
/**
* <p>
*
* 用户权限表
* </p>
*
* @author 暮光:城中城
* @since 2018-12-05
* @since 2019-05-31
*/
public class UserAuth implements Serializable {
@@ -59,6 +58,11 @@ public class UserAuth implements Serializable {
*/
private Date updateTime;
/**
* 自定义权限结尾
*/
private String authCustomSuffix;
public Long getId() {
return id;
}
@@ -115,6 +119,13 @@ public class UserAuth implements Serializable {
public void setUpdateTime(Date updateTime) {
this.updateTime = updateTime;
}
public String getAuthCustomSuffix() {
return authCustomSuffix;
}
public void setAuthCustomSuffix(String authCustomSuffix) {
this.authCustomSuffix = authCustomSuffix;
}
@Override
public String toString() {
@@ -127,6 +138,7 @@ public class UserAuth implements Serializable {
", delFlag=" + delFlag +
", creationTime=" + creationTime +
", updateTime=" + updateTime +
", authCustomSuffix=" + authCustomSuffix +
"}";
}
}

View File

@@ -1,15 +1,15 @@
package com.zyplayer.doc.data.repository.manage.mapper;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.zyplayer.doc.data.repository.manage.entity.UserAuth;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
/**
* <p>
* Mapper 接口
* 用户权限表 Mapper 接口
* </p>
*
* @author 暮光:城中城
* @since 2018-12-03
* @since 2019-05-31
*/
public interface UserAuthMapper extends BaseMapper<UserAuth> {

View File

@@ -19,7 +19,7 @@ public class CodeGenerator {
final String moduleName = "manage";
// final String[] tableName = { "zyplayer_storage", "auth_info", "user_auth", "user_info" };
// final String[] tableName = { "wiki_space", "wiki_page", "wiki_page_content", "wiki_page_file", "wiki_page_comment", "wiki_page_zan" };
final String[] tableName = { "wiki_space" };
final String[] tableName = { "user_auth" };
// 代码生成器
AutoGenerator mpg = new AutoGenerator();

View File

@@ -1,15 +1,15 @@
package com.zyplayer.doc.data.service.manage;
import com.baomidou.mybatisplus.extension.service.IService;
import com.zyplayer.doc.data.repository.manage.entity.UserAuth;
import com.baomidou.mybatisplus.extension.service.IService;
/**
* <p>
* 服务类
* 用户权限表 服务类
* </p>
*
* @author 暮光:城中城
* @since 2018-12-03
* @since 2019-05-31
*/
public interface UserAuthService extends IService<UserAuth> {

View File

@@ -1,18 +1,18 @@
package com.zyplayer.doc.data.service.manage.impl;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import com.zyplayer.doc.data.repository.manage.entity.UserAuth;
import com.zyplayer.doc.data.repository.manage.mapper.UserAuthMapper;
import com.zyplayer.doc.data.service.manage.UserAuthService;
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
import org.springframework.stereotype.Service;
/**
* <p>
* 服务实现类
* 用户权限表 服务实现类
* </p>
*
* @author 暮光:城中城
* @since 2018-12-03
* @since 2019-05-31
*/
@Service
public class UserAuthServiceImpl extends ServiceImpl<UserAuthMapper, UserAuth> implements UserAuthService {

View File

@@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.zyplayer.doc.manage.repository.manage.mapper.UserAuthMapper">
<mapper namespace="com.zyplayer.doc.data.repository.manage.mapper.UserAuthMapper">
</mapper>

View File

@@ -57,7 +57,11 @@ public class LoginController {
if (userAuthList != null && userAuthList.size() > 0) {
List<Long> authIdList = userAuthList.stream().map(UserAuth::getAuthId).collect(Collectors.toList());
Collection<AuthInfo> authInfoList = authInfoService.listByIds(authIdList);
userAuthSet = authInfoList.stream().map(AuthInfo::getAuthName).collect(Collectors.toSet());
Map<Long, String> authNameMap = authInfoList.stream().collect(Collectors.toMap(AuthInfo::getId, AuthInfo::getAuthName));
userAuthSet = userAuthList.stream().map(val -> {
String authName = Optional.ofNullable(authNameMap.get(val.getAuthId())).orElse("");
return authName + val.getAuthCustomSuffix();
}).collect(Collectors.toSet());
}
String accessToken = RandomUtil.simpleUUID();
DocUserDetails userDetails = new DocUserDetails(userInfo.getId(), userInfo.getUserName(), userInfo.getPassword(), true, userAuthSet);

View File

@@ -0,0 +1,8 @@
-- 从1.0.1版本升级:
-- 直接存权限名,不搞中间表了
ALTER TABLE `user_auth` ADD COLUMN `auth_custom_suffix` varchar(100) NULL COMMENT '自定义权限结尾';
-- 权限的库:

View File

@@ -4,8 +4,8 @@
<router-view></router-view>
</template>
<el-container v-else>
<el-aside width="200px">
<div style="padding: 10px;height: 100%;box-sizing: border-box;background: #fafafa;" v-show="leftCollapse">
<el-aside v-show="leftCollapse">
<div style="padding: 10px;height: 100%;box-sizing: border-box;background: #fafafa;">
<div style="margin-bottom: 10px;">
<el-select v-model="choiceSpace" @change="spaceChangeEvents" filterable placeholder="选择空间" style="width: 100%;">
<el-option-group label="">
@@ -362,7 +362,7 @@
userSettingDropdown(command) {
console.log("command:" + command);
if (command == 'userSignOut') {
// this.userSignOut();
this.userSignOut();
} else if (command == 'aboutDoc') {
app.aboutDialogVisible = true;
} else {

View File

@@ -14,6 +14,8 @@ var URL = {
updatePageComment: '/zyplayer-doc-wiki/page/comment/update',
pageZanList: '/zyplayer-doc-wiki/page/zan/list',
updatePageZan: '/zyplayer-doc-wiki/page/zan/update',
commonUpload: '/zyplayer-doc-wiki/common/upload',
};
var URL1 = {};

View File

@@ -23,7 +23,7 @@ export default {
global.vue.$message('请求错误:' + res.message);
} else if (res.data.errCode == 400) {
global.vue.$message('请先登录');
window.location = apimix.apilist1.HOST + "/static/manage/login.html";
// window.location = apimix.apilist1.HOST + "/static/manage/login.html";
} else if (res.data.errCode == 402) {
global.vue.$router.push("/common/noAuth");
} else if (res.data.errCode !== 200) {

View File

@@ -12,7 +12,8 @@
<div class="wiki-author">
<span>创建{{wikiPage.createUserName}} {{wikiPage.createTime}}  <span v-show="wikiPage.updateUserName">修改{{wikiPage.updateUserName}} {{wikiPage.updateTime}}</span></span>
<div style="float: right;">
<el-upload class="upload-page-file" action="zyplayer-doc-wiki/common/upload"
<el-upload class="upload-page-file" :action="apilist1.commonUpload"
:with-credentials="true"
:on-success="uploadFileSuccess" :on-error="uploadFileError"
name="files" show-file-list multiple :data="uploadFormData" :limit="999">
<el-button icon="el-icon-upload">上传附件</el-button>
@@ -120,6 +121,13 @@
recommentInfo: {},
};
},
beforeRouteUpdate(to, from, next){
var pageId = to.query.pageId;
if (!!pageId) {
this.loadPageDetail(pageId);
}
next();
},
mounted: function () {
app = this;
var pageId = this.$route.query.pageId;
@@ -226,10 +234,10 @@
toast.success("上传失败," + err);
},
uploadFileSuccess(response) {
if (this.common.validateResult(response)) {
this.common.validateResult({data: response}, function () {
app.pageFileList.push(response.data);
toast.success("上传成功!");
}
});
},
deletePageFile(row) {
this.$confirm('确定要删除此文件吗?', '提示', {

View File

@@ -0,0 +1,86 @@
package com.zyplayer.doc.wiki.controller;
import com.zyplayer.doc.core.json.DocResponseJson;
import com.zyplayer.doc.core.json.ResponseJson;
import com.zyplayer.doc.data.aspect.AuthMan;
import com.zyplayer.doc.data.config.security.DocUserDetails;
import com.zyplayer.doc.data.config.security.DocUserUtil;
import com.zyplayer.doc.data.repository.manage.entity.*;
import com.zyplayer.doc.data.service.manage.*;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import com.zyplayer.doc.wiki.framework.consts.WikiAuthType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import javax.annotation.Resource;
import java.util.Date;
import java.util.List;
import java.util.Objects;
/**
* 文档控制器
*
* @author 暮光:城中城
* @since 2019年2月17日
*/
@AuthMan
@RestController
@RequestMapping("/zyplayer-doc-wiki/page/auth")
public class WikiPageAuthController {
private static Logger logger = LoggerFactory.getLogger(WikiPageAuthController.class);
@Resource
WikiPageZanService wikiPageZanService;
@Resource
WikiSpaceService wikiSpaceService;
@Resource
WikiPageService wikiPageService;
@Resource
UserAuthService userAuthService;
@Resource
AuthInfoService authInfoService;
@PostMapping("/assign")
public ResponseJson<List<WikiPageZan>> assign(Long pageId, Long userId, Long authId) {
DocUserDetails currentUser = DocUserUtil.getCurrentUser();
WikiPage wikiPageSel = wikiPageService.getById(pageId);
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
if (SpaceType.isPrivate(wikiSpaceSel.getType())) {
return DocResponseJson.warn("");
}
if (SpaceType.isPublic(wikiSpaceSel.getType())) {
return DocResponseJson.warn("");
}
if (!SpaceType.isPersonal(wikiSpaceSel.getType())) {
return DocResponseJson.warn("");
}
if (!Objects.equals(currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
if (!DocUserUtil.havePageAuth(WikiAuthType.PAGE_AUTH_MANAGE.getName(), pageId)) {
return DocResponseJson.warn("");
}
}
AuthInfo authInfo = authInfoService.getById(authId);
if (authInfo == null) {
return DocResponseJson.warn("");
}
UserAuth userAuth = new UserAuth();
userAuth.setAuthId(authId);
userAuth.setCreateUid(currentUser.getUserId());
userAuth.setCreationTime(new Date());
userAuth.setDelFlag(0);
userAuth.setUserId(userId);
userAuth.setAuthCustomSuffix(String.valueOf(pageId));
userAuthService.save(userAuth);
return DocResponseJson.ok();
}
@PostMapping("/update")
public ResponseJson<Object> update(WikiPageZan wikiPageZan) {
DocUserDetails currentUser = DocUserUtil.getCurrentUser();
return DocResponseJson.ok();
}
}

View File

@@ -13,6 +13,7 @@ import com.zyplayer.doc.data.service.manage.WikiPageCommentService;
import com.zyplayer.doc.data.service.manage.WikiPageService;
import com.zyplayer.doc.data.service.manage.WikiSpaceService;
import com.zyplayer.doc.wiki.controller.vo.WikiPageCommentVo;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import org.dozer.Mapper;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -24,7 +25,6 @@ import javax.annotation.Resource;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.stream.Collectors;
/**
@@ -54,7 +54,7 @@ public class WikiPageCommentController {
WikiPage wikiPageSel = wikiPageService.getById(pageComment.getPageId());
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有查看该空间的评论权!");
}
UpdateWrapper<WikiPageComment> wrapper = new UpdateWrapper<>();
@@ -87,7 +87,7 @@ public class WikiPageCommentController {
WikiPage wikiPageSel = wikiPageService.getById(pageId);
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有该空间的评论权!");
}
if (id != null && id > 0) {

View File

@@ -10,6 +10,7 @@ import com.zyplayer.doc.data.repository.manage.entity.*;
import com.zyplayer.doc.data.service.manage.*;
import com.zyplayer.doc.wiki.controller.vo.WikiPageContentVo;
import com.zyplayer.doc.wiki.controller.vo.WikiPageVo;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import org.apache.commons.lang3.StringUtils;
import org.dozer.Mapper;
import org.slf4j.Logger;
@@ -52,15 +53,15 @@ public class WikiPageController {
DocUserDetails currentUser = DocUserUtil.getCurrentUser();
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPage.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有查看该空间的文章列表!");
}
UpdateWrapper<WikiPage> wrapper = new UpdateWrapper<>();
wrapper.eq("del_flag", 0);
wrapper.eq("space_id", wikiPage.getSpaceId());
wrapper.eq(wikiPage.getParentId() != null, "parent_id", wikiPage.getParentId());
List<WikiPage> authList = wikiPageService.list(wrapper);
Map<Long, List<WikiPageVo>> listMap = authList.stream().map(val -> mapper.map(val, WikiPageVo.class)).collect(Collectors.groupingBy(WikiPageVo::getParentId));
List<WikiPage> wikiPageList = wikiPageService.list(wrapper);
Map<Long, List<WikiPageVo>> listMap = wikiPageList.stream().map(val -> mapper.map(val, WikiPageVo.class)).collect(Collectors.groupingBy(WikiPageVo::getParentId));
List<WikiPageVo> nodePageList;
if (wikiPage.getParentId() == null) {
nodePageList = listMap.get(0L);
@@ -77,7 +78,7 @@ public class WikiPageController {
WikiPage wikiPageSel = wikiPageService.getById(wikiPage.getId());
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有查看该空间的文章详情!");
}
UpdateWrapper<WikiPageContent> wrapper = new UpdateWrapper<>();
@@ -122,7 +123,7 @@ public class WikiPageController {
}
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间不允许调用接口获取文章
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有修改该空间的文章权限!");
}
wikiPage.setEditType(null);

View File

@@ -11,6 +11,7 @@ import com.zyplayer.doc.data.repository.manage.entity.WikiSpace;
import com.zyplayer.doc.data.service.manage.WikiPageFileService;
import com.zyplayer.doc.data.service.manage.WikiPageService;
import com.zyplayer.doc.data.service.manage.WikiSpaceService;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.PostMapping;
@@ -19,7 +20,6 @@ import org.springframework.web.bind.annotation.RestController;
import javax.annotation.Resource;
import java.util.Date;
import java.util.Objects;
/**
* 文档控制器
@@ -69,7 +69,7 @@ public class WikiPageFileController {
WikiPage wikiPageSel = wikiPageService.getById(pageId);
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有该空间的文件上传权限!");
}
if (id != null && id > 0) {

View File

@@ -12,6 +12,7 @@ import com.zyplayer.doc.data.repository.manage.entity.WikiSpace;
import com.zyplayer.doc.data.service.manage.WikiPageService;
import com.zyplayer.doc.data.service.manage.WikiPageZanService;
import com.zyplayer.doc.data.service.manage.WikiSpaceService;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.PostMapping;
@@ -20,7 +21,6 @@ import org.springframework.web.bind.annotation.RestController;
import javax.annotation.Resource;
import java.util.List;
import java.util.Objects;
/**
* 文档控制器
@@ -47,7 +47,7 @@ public class WikiPageZanController {
WikiPage wikiPageSel = wikiPageService.getById(wikiPageZan.getPageId());
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有获取该空间的点赞列表权限!");
}
UpdateWrapper<WikiPageZan> wrapper = new UpdateWrapper<>();
@@ -74,7 +74,7 @@ public class WikiPageZanController {
WikiPage wikiPageSel = wikiPageService.getById(pageId);
WikiSpace wikiSpaceSel = wikiSpaceService.getById(wikiPageSel.getSpaceId());
// 私人空间
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有该空间的点赞权限!");
}
wikiPageZanService.zanPage(wikiPageZan);

View File

@@ -9,6 +9,7 @@ import com.zyplayer.doc.data.config.security.DocUserDetails;
import com.zyplayer.doc.data.config.security.DocUserUtil;
import com.zyplayer.doc.data.repository.manage.entity.WikiSpace;
import com.zyplayer.doc.data.service.manage.WikiSpaceService;
import com.zyplayer.doc.wiki.framework.consts.SpaceType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.PostMapping;
@@ -55,7 +56,7 @@ public class WikiSpaceController {
if (Objects.equals(wikiSpaceSel.getEditType(), 1)) {
return DocResponseJson.warn("当前空间不允许编辑!");
}
if (Objects.equals(wikiSpaceSel.getType(), 3) && !currentUser.getUserId().equals(wikiSpaceSel.getCreateUserId())) {
if (SpaceType.isOthersPrivate(wikiSpaceSel.getType(), currentUser.getUserId(), wikiSpaceSel.getCreateUserId())) {
return DocResponseJson.warn("您没有该空间的编辑权!");
}
wikiSpace.setUuid(null);

View File

@@ -0,0 +1,29 @@
package com.zyplayer.doc.wiki.framework.consts;
import java.util.Objects;
public class SpaceType {
public static final Integer publicSpace = 1;
public static final Integer personalSpace = 2;
public static final Integer privateSpace = 3;
public static boolean isPublic(Integer type){
return Objects.equals(type, publicSpace);
}
public static boolean isPersonal(Integer type){
return Objects.equals(type, personalSpace);
}
public static boolean isPrivate(Integer type){
return Objects.equals(type, privateSpace);
}
public static boolean isSelfPrivate(Integer type, Long loginUserId, Long spaceUserId){
return Objects.equals(type, privateSpace) && Objects.equals(loginUserId, spaceUserId);
}
public static boolean isOthersPrivate(Integer type, Long loginUserId, Long spaceUserId){
return Objects.equals(type, privateSpace) && !Objects.equals(loginUserId, spaceUserId);
}
}

View File

@@ -0,0 +1,35 @@
package com.zyplayer.doc.wiki.framework.consts;
public enum WikiAuthType {
CREATE_PAGE(1, "CREATE_PAGE_"),
VIEW_PAGE(1, "VIEW_PAGE_"),
COMMENT_PAGE(1, "COMMENT_PAGE_"),
DELETE_PAGE(1, "DELETE_PAGE_"),
PAGE_FILE_UPLOAD(1, "PAGE_FILE_UPLOAD_"),
PAGE_FILE_DELETE(1, "PAGE_FILE_DELETE_"),
PAGE_AUTH_MANAGE(1, "PAGE_AUTH_MANAGE_"),
;
private Integer type;
private String name;
WikiAuthType(Integer type, String name) {
this.type = type;
this.name = name;
}
public Integer getType() {
return type;
}
public void setType(Integer type) {
this.type = type;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}