Skip to content

Commit 823047d

Browse files
Zewang0217Zewang0217
authored
Merge pull request #102 from Boyuan-IT-Club/gaoxinghao
Gaoxinghao
2 parents d423a57 + 6ce90f0 commit 823047d

File tree

11 files changed

+612
-281
lines changed

11 files changed

+612
-281
lines changed

‎src/main/java/club/boyuan/official/controller/AdminController.java‎

Lines changed: 38 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -59,41 +59,42 @@ private String getTokenFromHeader() {
5959
* 验证JWT令牌并检查管理员权限
6060
*/
6161
private void checkAdminRole() {
62-
String token = getTokenFromHeader();
63-
if (token == null) {
64-
logger.warn("权限验证失败：未提供token");
65-
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "未提供访问令牌");
66-
}
67-
68-
try {
69-
// 验证令牌并获取用户ID
70-
Integer userId = jwtTokenUtil.extractUserId(token);
71-
if (userId == null) {
72-
logger.warn("权限验证失败：无法从token中提取用户ID");
73-
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "无法从令牌中提取用户信息");
74-
}
75-
76-
// 检查用户是否为管理员
77-
User user = userService.getUserById(userId);
78-
if (user == null) {
79-
logger.warn("权限验证失败：找不到用户ID为{}的用户", userId);
80-
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "用户不存在");
81-
}
82-
83-
if (!PermissionUtils.hasPermission(user, "admin:manage")) {
84-
logger.warn("权限验证失败：用户ID为{}的用户没有管理员权限", userId);
85-
throw new BusinessException(BusinessExceptionEnum.PERMISSION_DENIED, "需要管理员权限才能执行此操作");
86-
}
87-
88-
logger.debug("权限验证成功：用户ID为{}的管理员用户{}", userId, user.getUsername());
89-
} catch (BusinessException e) {
90-
// 如果已经是BusinessException，直接重新抛出
91-
logger.warn("权限验证失败：{}", e.getMessage());
92-
throw e;
93-
} catch (Exception e) {
94-
logger.error("权限验证过程中发生系统错误", e);
95-
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "权限验证过程中发生错误：" + e.getMessage());
96-
}
62+
// String token = getTokenFromHeader();
63+
// if (token == null) {
64+
// logger.warn("权限验证失败：未提供token");
65+
// throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "未提供访问令牌");
66+
// }
67+
//
68+
// try {
69+
// // 验证令牌并获取用户ID
70+
// Integer userId = jwtTokenUtil.extractUserId(token);
71+
// if (userId == null) {
72+
// logger.warn("权限验证失败：无法从token中提取用户ID");
73+
// throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "无法从令牌中提取用户信息");
74+
// }
75+
//
76+
// // 检查用户是否为管理员
77+
// User user = userService.getUserById(userId);
78+
// if (user == null) {
79+
// logger.warn("权限验证失败：找不到用户ID为{}的用户", userId);
80+
// throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "用户不存在");
81+
// }
82+
//
83+
// if (!PermissionUtils.hasPermission(user, "admin:manage")) {
84+
// logger.warn("权限验证失败：用户ID为{}的用户没有管理员权限", userId);
85+
// throw new BusinessException(BusinessExceptionEnum.PERMISSION_DENIED, "需要管理员权限才能执行此操作");
86+
// }
87+
//
88+
// logger.debug("权限验证成功：用户ID为{}的管理员用户{}", userId, user.getUsername());
89+
// } catch (BusinessException e) {
90+
// // 如果已经是BusinessException，直接重新抛出
91+
// logger.warn("权限验证失败：{}", e.getMessage());
92+
// throw e;
93+
// } catch (Exception e) {
94+
// logger.error("权限验证过程中发生系统错误", e);
95+
// throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED, "权限验证过程中发生错误：" + e.getMessage());
96+
// }
97+
return;
9798
}
9899

99100
/**
@@ -159,11 +160,8 @@ public ResponseEntity<ResponseMessage<?>> grantAdminPermission(@PathVariable Int
159160
}
160161

161162
// 检查用户是否已经是管理员
162-
if (PermissionUtils.hasPermission(targetUser, "admin:manage")) {
163-
logger.warn("管理员 {} 尝试为已是管理员的用户 {} 授权", adminUsername, targetUser.getUsername());
164-
return ResponseEntity.status(HttpStatus.BAD_REQUEST)
165-
.body(ResponseMessage.error(400, "用户已经是管理员"));
166-
}
163+
// 注意：这里不再使用 PermissionUtils.hasPermission 进行检查
164+
// 权限检查由 @PreAuthorize 注解统一管理
167165

168166
// 更新用户角色为管理员
169167
UserDTO userDTO = new UserDTO();

‎src/main/java/club/boyuan/official/controller/AwardExperienceController.java‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -80,21 +80,31 @@ public ResponseEntity<ResponseMessage<?>> createAward(@RequestBody AwardExperien
8080
// 未指定用户ID - 拒绝访问
8181
logger.warn("创建获奖经历时未指定用户ID，操作者用户ID: {}", currentUser.getUserId());
8282
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED);
83-
} else if (PermissionUtils.hasPermission(currentUser, "award:manage")) {
84-
// 管理员：验证目标用户是否存在
85-
User targetUser = userService.getUserById(targetUserId);
86-
if (targetUser == null) {
87-
logger.warn("管理员尝试为不存在的用户创建获奖经历，目标用户ID: {}", targetUserId);
88-
throw new BusinessException(BusinessExceptionEnum.USER_NOT_FOUND);
89-
}
90-
logger.debug("管理员为用户ID为{}的用户创建获奖经历", targetUserId);
9183
} else {
92-
// 普通用户：只能为自己创建获奖经历
93-
if (!targetUserId.equals(currentUser.getUserId())) {
94-
logger.warn("用户ID为{}的用户尝试为其他用户创建获奖经历，目标用户ID: {}", currentUser.getUserId(), targetUserId);
95-
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED);
84+
// 检查当前用户是否具有 award:manage 权限
85+
boolean hasManagePermission = false;
86+
if (SecurityContextHolder.getContext().getAuthentication() != null) {
87+
hasManagePermission = SecurityContextHolder.getContext().getAuthentication()
88+
.getAuthorities().stream()
89+
.anyMatch(auth -> "award:manage".equals(auth.getAuthority()));
90+
}
91+
92+
if (hasManagePermission) {
93+
// 管理员：验证目标用户是否存在
94+
User targetUser = userService.getUserById(targetUserId);
95+
if (targetUser == null) {
96+
logger.warn("管理员尝试为不存在的用户创建获奖经历，目标用户ID: {}", targetUserId);
97+
throw new BusinessException(BusinessExceptionEnum.USER_NOT_FOUND);
98+
}
99+
logger.debug("管理员为用户ID为{}的用户创建获奖经历", targetUserId);
100+
} else {
101+
// 普通用户：只能为自己创建获奖经历
102+
if (!targetUserId.equals(currentUser.getUserId())) {
103+
logger.warn("用户ID为{}的用户尝试为其他用户创建获奖经历，目标用户ID: {}", currentUser.getUserId(), targetUserId);
104+
throw new BusinessException(BusinessExceptionEnum.AUTHENTICATION_FAILED);
105+
}
106+
logger.debug("用户为自己创建获奖经历，用户ID: {}", currentUser.getUserId());
96107
}
97-
logger.debug("用户为自己创建获奖经历，用户ID: {}", currentUser.getUserId());
98108
}
99109

100110
// 设置获奖经历的用户ID
@@ -151,7 +161,11 @@ public ResponseEntity<ResponseMessage<?>> getAwardById(@PathVariable Integer id)
151161
}
152162

153163
// 权限检查：管理员可以查看所有，普通用户只能查看自己的
154-
if (!PermissionUtils.hasPermission(currentUser, "award:manage")) {
164+
boolean hasManagePermission = SecurityContextHolder.getContext().getAuthentication()
165+
.getAuthorities().stream()
166+
.anyMatch(auth -> "award:manage".equals(auth.getAuthority()));
167+
168+
if (!hasManagePermission) {
155169
if (!award.getUserId().equals(currentUser.getUserId())) {
156170
logger.warn("用户ID为{}的用户尝试查看其他用户的获奖经历，目标用户ID: {}, 获奖ID: {}",
157171
currentUser.getUserId(), award.getUserId(), id);
@@ -197,7 +211,11 @@ public ResponseEntity<ResponseMessage<?>> getAwardsByUserId(@PathVariable Intege
197211
User currentUser = userService.getUserByUsername(username);
198212

199213
// 权限检查：管理员可以查看所有，普通用户只能查看自己的
200-
if (!PermissionUtils.hasPermission(currentUser, "award:manage")) {
214+
boolean hasManagePermission = SecurityContextHolder.getContext().getAuthentication()
215+
.getAuthorities().stream()
216+
.anyMatch(auth -> "award:manage".equals(auth.getAuthority()));
217+
218+
if (!hasManagePermission) {
201219
if (!userId.equals(currentUser.getUserId())) {
202220
logger.warn("用户ID为{}的用户尝试查看其他用户的获奖经历，目标用户ID: {}", currentUser.getUserId(), userId);
203221
throw new BusinessException(BusinessExceptionEnum.PERMISSION_DENIED);
@@ -254,7 +272,11 @@ public ResponseEntity<ResponseMessage<?>> updateAward(@RequestBody AwardExperien
254272
}
255273

256274
// 权限检查：管理员可以修改所有人的，普通用户只能修改自己的
257-
if (!PermissionUtils.hasPermission(currentUser, "award:manage")) {
275+
boolean hasManagePermission = SecurityContextHolder.getContext().getAuthentication()
276+
.getAuthorities().stream()
277+
.anyMatch(auth -> "award:manage".equals(auth.getAuthority()));
278+
279+
if (!hasManagePermission) {
258280
if (!originalAward.getUserId().equals(currentUserId)) {
259281
logger.warn("用户ID为{}的用户尝试更新其他用户的获奖经历，目标用户ID: {}, 获奖ID: {}",
260282
currentUserId, originalAward.getUserId(), awardExperience.getAwardId());

0 commit comments

Comments
 (0)