add 权限增加是否外网展示

db/23年8月23日变更.sql

@@ -0,0 +1,7 @@
+alter table sys_permission
+    add external_terminal_show tinyint null comment '是否外网展示';
+update sys_permission set external_terminal_show = 0 where id in (select t.id from (SELECT id FROM `sys_permission` WHERE `parent_id` = '1437320526513905666' AND `id` <> '1437597826593595394') t);
+update sys_permission set external_terminal_show = 0 where parent_id in (select t.id from (SELECT id FROM `sys_permission` WHERE `parent_id` = '1437320526513905666' AND `id` <> '1437597826593595394') t);
+update sys_permission set external_terminal_show = 0 where id = 'd7d6e2e4e2934f2c9385a623fd98c6f3';
+update sys_permission set external_terminal_show = 0 where parent_id in (select t.id from (SELECT id FROM `sys_permission` WHERE `parent_id` = 'd7d6e2e4e2934f2c9385a623fd98c6f3') t);
+update sys_permission set external_terminal_show = 0 where id in (select t.id from (SELECT * FROM `sys_permission` WHERE `parent_id` = 'f780d0d3083d849ccbdb1b1baee4911d' or `id` = 'f780d0d3083d849ccbdb1b1baee4911d') t);

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/api/CommonAPI.java

@@ -23,6 +23,8 @@ public interface CommonAPI {
      */
     Set<String> queryUserAuths(String username);
 
+    Set<String> queryUserAuthsExternal(String username);
+
     /**
      * 3根据 id 查询数据库中存储的 DynamicDataSourceModel
      *

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/constant/enums/LoginType.java

@@ -0,0 +1,25 @@
+package com.jero.common.constant.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+/**
+ * @author liJiaRao外部
+ * @date 2023-08-23 9:02
+ */
+@Getter
+@AllArgsConstructor
+public enum LoginType {
+    INSIDE("inside"), EXTERNAL("external");
+
+    private String type;
+
+    public static LoginType getEnum(String type){
+        for (LoginType value : values()) {
+            if (value.getType().equals(type)) {
+                return value;
+            }
+        }
+        return null;
+    }
+}

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/common/system/vo/LoginUser.java

@@ -2,6 +2,7 @@ package com.jero.common.system.vo;
 
 import java.util.Date;
 
+import com.jero.common.constant.enums.LoginType;
 import org.springframework.format.annotation.DateTimeFormat;
 
 import com.fasterxml.jackson.annotation.JsonFormat;
@@ -140,4 +141,6 @@ public class LoginUser {
 
 	private String companyId;
 
+	private LoginType loginType;
+
 }

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/JwtToken.java

@@ -1,5 +1,6 @@
 package com.jero.config.shiro;
  
+import com.jero.common.constant.enums.LoginType;
 import org.apache.shiro.authc.AuthenticationToken;
 
 /**
@@ -11,9 +12,15 @@ public class JwtToken implements AuthenticationToken {
 	
 	private static final long serialVersionUID = 1L;
 	private String token;
+    private LoginType loginType;
  
-    public JwtToken(String token) {
+    public JwtToken(String token,LoginType loginType) {
         this.token = token;
+        this.loginType = loginType;
+    }
+
+    public LoginType getLoginType() {
+        return loginType;
     }
 
     @Override

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/ShiroRealm.java

@@ -1,6 +1,6 @@
 package com.jero.config.shiro;
 
-import cn.hutool.crypto.SecureUtil;
+import com.jero.common.constant.enums.LoginType;
 import com.jero.common.constant.enums.LoginUserTypeEnum;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.shiro.authc.AuthenticationException;
@@ -12,7 +12,6 @@ import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
 import com.jero.common.api.CommonAPI;
-import com.jero.common.constant.CacheConstant;
 import com.jero.common.constant.CommonConstant;
 import com.jero.common.system.util.JwtUtil;
 import com.jero.common.system.vo.LoginUser;
@@ -41,13 +40,21 @@ public class ShiroRealm extends AuthorizingRealm {
     @Lazy
     @Resource
     private RedisUtil redisUtil;
-
+    @Override
+    public String getName() {
+        return LoginType.INSIDE.getType();
+    }
     /**
      * 必须重写此方法，不然Shiro会报错
      */
     @Override
     public boolean supports(AuthenticationToken token) {
         return token instanceof JwtToken;
+        //if (token instanceof JwtToken){
+        //    return  LoginType.INSIDE.getType().equals(((JwtToken) token).getLoginType());
+        //} else {
+        //    return false;
+        //}
     }
 
     /**
@@ -61,10 +68,8 @@ public class ShiroRealm extends AuthorizingRealm {
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
         log.info("===============Shiro权限认证开始============ [ roles、permissions]==========");
         String username = null;
-        if (principals != null) {
         LoginUser sysUser = (LoginUser) principals.getPrimaryPrincipal();
         username = sysUser.getUsername();
-        }
         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
 
         // 设置用户拥有的角色集合，比如“admin,test”
@@ -73,7 +78,13 @@ public class ShiroRealm extends AuthorizingRealm {
         info.setRoles(roleSet);
 
         // 设置用户拥有的权限集合，比如“sys:role:add,sys:user:add”
-        Set<String> permissionSet = commonAPI.queryUserAuths(username);
+        LoginType loginType = sysUser.getLoginType();
+        Set<String> permissionSet;
+        if (LoginType.INSIDE.equals(loginType)){
+            permissionSet = commonAPI.queryUserAuths(username);
+        }else {
+            permissionSet = commonAPI.queryUserAuthsExternal(username);
+        }
         info.addStringPermissions(permissionSet);
         System.out.println(permissionSet);
         log.info("===============Shiro权限认证成功==============");
@@ -98,6 +109,9 @@ public class ShiroRealm extends AuthorizingRealm {
         }
         // 校验token有效性
         LoginUser loginUser = this.checkUserTokenIsEffect(token);
+        JwtToken jwtToken = (JwtToken) auth;
+        LoginType loginType = jwtToken.getLoginType();
+        loginUser.setLoginType(loginType);
         return new SimpleAuthenticationInfo(loginUser, token, getName());
     }
 
@@ -161,14 +175,17 @@ public class ShiroRealm extends AuthorizingRealm {
             }
             return false;
         }else{
-            String cacheToken = String.valueOf(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN + token));
+            String cacheToken = String.valueOf(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN + userName));
             if (oConvertUtils.isNotEmpty(cacheToken)) {
+                if (!token.equals(cacheToken)){
+                    throw new AuthenticationException("已在其它设备登录，请重新登录!");
+                }
                 // 校验token有效性
                 if (!JwtUtil.verify(cacheToken, userName, passWord)) {
-                    //String newAuthorization = JwtUtil.sign(userName, passWord);
+                    String newAuthorization = JwtUtil.sign(userName, passWord);
                     // 设置超时时间
-                    //redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, newAuthorization);
+                    redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + userName, newAuthorization);
-                    redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, JwtUtil.EXPIRE_TIME *2 / 1000);
+                    redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + userName, JwtUtil.EXPIRE_TIME *2 / 1000);
                     log.debug("——————————用户在线操作，更新token保证不掉线—————————jwtTokenRefresh——————— "+ token);
                 }
                 return true;

jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/shiro/filters/JwtFilter.java

@@ -1,6 +1,7 @@
 package com.jero.config.shiro.filters;
 
 import cn.hutool.core.util.StrUtil;
+import com.jero.common.constant.enums.LoginType;
 import com.jero.common.util.AuthenticationUtils;
 import com.jero.common.util.SpringContextUtils;
 import lombok.extern.slf4j.Slf4j;
@@ -73,8 +74,9 @@ public class JwtFilter extends BasicHttpAuthenticationFilter {
             authenticationUtils.check(pushToken,publicKey);
         }else {
             // update-end--Author:lvdandan Date:20210105 for：JT-355 OA聊天添加token验证，获取token参数
-
+            String externalTerminalShow = httpServletRequest.getHeader("externalTerminalShow");
-            JwtToken jwtToken = new JwtToken(token);
+            LoginType loginType = LoginType.getEnum(externalTerminalShow);
+            JwtToken jwtToken = new JwtToken(token,loginType);
             // 提交给realm进行登入，如果错误他会抛出异常并被捕获
             getSubject(request, response).login(jwtToken);
             // 如果没有抛出异常则代表登入成功，返回true

jero-boot-incoming-payment/src/main/java/com/jero/statistics/controller/AllProjectMoneyStatisticsController.java

@@ -63,7 +63,7 @@ public class AllProjectMoneyStatisticsController {
      *
      * @param allProjectStatisticsSearch 全所收入统计搜索
      */
-    @RequiresPermissions("wholeInstituteStatistics:search")
+    @RequiresPermissions("wholePaymentsStatistics:search")
     @ApiOperation(value = "全所收入统计搜索-列表查询", notes = "全所收入统计搜索-详情列表查询")
     @GetMapping(value = "/list")
     public Result<?> list(AllProjectStatisticsSearch allProjectStatisticsSearch) {
@@ -98,7 +98,7 @@ public class AllProjectMoneyStatisticsController {
     /**
      * 所领导统计导出
      */
-    @RequiresPermissions("wholeInstituteStatistics:export")
+    @RequiresPermissions("wholePaymentsStatistics:export")
     @AutoLog(value = "全所收入统计导出-导出统计")
     @GetMapping(value = "/excel")
     @ApiOperation(value = "全所收入统计导出-导出统计", notes = "全所收入统计导出-导出统计")

jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java

@@ -210,7 +210,7 @@ public class LoginController {
             //update-end--Author:wangshuai  Date:20200714  for：登出日志没有记录人员
             log.info(" 账号:  " + sysUser.getRealname() + ",退出成功！ ");
             //清空用户登录Token缓存
-            redisUtil.del(CommonConstant.PREFIX_USER_TOKEN + token);
+            redisUtil.del(CommonConstant.PREFIX_USER_TOKEN + username);
             //清空用户登录Shiro权限缓存
             redisUtil.del(CommonConstant.PREFIX_USER_SHIRO_CACHE + sysUser.getId());
             //清空用户的缓存信息（包括部门信息），例如sys:cache:user::<username>

jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/SysPermissionMapper.java

@@ -31,6 +31,8 @@ public interface SysPermissionMapper extends BaseMapper<SysPermission> {
 	 */
 	public List<SysPermission> queryByUser(@Param("username") String username);
 
+	List<SysPermission> queryByUserExternal(@Param("username") String username);
+	
 	/**
 	 *   修改菜单状态字段： 是否子节点
 	 */

jero-boot-module-system/src/main/java/com/jero/modules/system/mapper/xml/SysPermissionMapper.xml

@@ -70,6 +70,42 @@
 		   ) h order by h.sort_no ASC
 	</select>
 
+	<select id="queryByUserExternal" resultMap="SysPermission">
+		SELECT * FROM (
+		SELECT p.*
+		FROM sys_permission p
+		WHERE (exists(
+					   select a.id
+					   from sys_role_permission a
+								join sys_role b on a.role_id = b.id
+								join sys_user_role c on c.role_id = b.id
+								join sys_user d on d.id = c.user_id
+					   where p.id = a.permission_id
+						 AND d.username = #{username,jdbcType=VARCHAR}
+				   )
+			or (p.url like '%:code' and p.url like '/online%' and p.hidden = 1)
+			or p.url = '/online')
+		  and p.del_flag = 0
+			and p.external_terminal_show = 1
+		<!--update begin Author:lvdandan  Date:20200213 for：加入部门权限 -->
+		UNION
+		SELECT p.*
+		FROM sys_permission p
+		WHERE exists(
+				select a.id
+				from sys_depart_role_permission a
+						 join sys_depart_role b on a.role_id = b.id
+						 join sys_depart_role_user c on c.drole_id = b.id
+						 join sys_user d on d.id = c.user_id
+				where p.id = a.permission_id
+				  AND d.username = #{username,jdbcType=VARCHAR}
+			)
+		  and p.del_flag = 0
+		and p.external_terminal_show = 1
+		<!--update end Author:lvdandan  Date:20200213 for：加入部门权限 -->
+		) h
+		order by h.sort_no ASC
+	</select>
 
 	<!-- 根据用户账号查询菜单权限 -->
 	<select id="queryCountByUsername" parameterType="Object" resultType="int">

jero-boot-module-system/src/main/java/com/jero/modules/system/service/impl/SysBaseApiImpl.java

@@ -849,6 +849,22 @@ public class SysBaseApiImpl implements ISysBaseAPI {
 		return permissionSet;
 	}
 
+	private Set<String> getUserPermissionSetExternal(String username) {
+		Set<String> permissionSet = new HashSet<>();
+		List<SysPermission> permissionList = sysPermissionMapper.queryByUserExternal(username);
+		for (SysPermission po : permissionList) {
+//			// TODO URL规则有问题？
+//			if (oConvertUtils.isNotEmpty(po.getUrl())) {
+//				permissionSet.add(po.getUrl());
+//			}
+			if (oConvertUtils.isNotEmpty(po.getPerms())) {
+				permissionSet.add(po.getPerms());
+			}
+		}
+		log.info("-------通过数据库读取用户拥有的权限Perms------username： "+ username+",Perms size: "+ (permissionSet==null?0:permissionSet.size()) );
+		return permissionSet;
+	}
+
 	/**
 	 * 判断online菜单是否有权限
 	 * @param onlineAuthDTO
@@ -904,6 +920,13 @@ public class SysBaseApiImpl implements ISysBaseAPI {
 		return getUserPermissionSet(username);
 	}
 
+	@Override
+	public Set<String> queryUserAuthsExternal(String username) {
+		return getUserPermissionSetExternal(username);
+	}
+
+
+
 	/**
 	 * 36根据多个用户账号(逗号分隔)，查询返回多个用户信息
 	 * @param usernames

jero-boot-module-system/src/main/java/com/jero/modules/system/service/impl/SysUserServiceImpl.java

@@ -730,8 +730,8 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
 		// 生成token
 		String token = JwtUtil.sign(username, syspassword);
 		// 设置token缓存有效时间
-		redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, token);
+		redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + username, token);
-		redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, JwtUtil.EXPIRE_TIME * 2 / 1000);
+		redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + username, JwtUtil.EXPIRE_TIME * 2 / 1000);
 
 		// 获取用户部门信息
 		JSONObject obj = new JSONObject();