123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360 |
- package com.persagy.account.controller;
- import java.io.IOException;
- import java.io.UnsupportedEncodingException;
- import java.net.URLEncoder;
- import java.nio.charset.StandardCharsets;
- import java.util.Date;
- import java.util.HashMap;
- import java.util.List;
- import java.util.Map;
- import java.util.concurrent.TimeUnit;
- import javax.servlet.http.HttpServletRequest;
- import javax.servlet.http.HttpServletResponse;
- import org.springframework.beans.factory.annotation.Autowired;
- import org.springframework.data.redis.core.RedisTemplate;
- import org.springframework.validation.annotation.Validated;
- import org.springframework.web.bind.annotation.RequestBody;
- import org.springframework.web.bind.annotation.RequestMapping;
- import org.springframework.web.bind.annotation.RequestMethod;
- import org.springframework.web.bind.annotation.RestController;
- import com.alibaba.fastjson.JSONObject;
- import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
- import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
- import com.persagy.account.config.ApplicationProperties;
- import com.persagy.account.manage.SaasAuthHandler;
- import com.persagy.account.manage.SaasRoleMenuHandler;
- import com.persagy.account.pojo.dto.SaasAccount;
- import com.persagy.account.pojo.dto.SaasGroup;
- import com.persagy.account.pojo.dto.SaasMenu;
- import com.persagy.account.pojo.vo.account.SaasAccountLoginVO;
- import com.persagy.account.pojo.vo.account.SaasAccountQueryVO;
- import com.persagy.account.pojo.vo.menu.SaasMenuQueryVO;
- import com.persagy.account.service.ISaasAccountService;
- import com.persagy.account.service.ISaasGroupService;
- import com.persagy.common.constant.SaasCommonConstant;
- import com.persagy.common.enums.ResponseCode;
- import com.persagy.common.exception.BusinessException;
- import com.persagy.common.utils.ResponseResult;
- import com.persagy.common.utils.ResponseResultUtil;
- import com.persagy.common.utils.StringUtil;
- import com.persagy.log.core.util.RequestUtil;
- import com.persagy.security.constant.CipherConstants;
- import com.persagy.security.util.BouncycastleCipher;
- import com.persagy.security.util.SecureAES;
- import cn.hutool.core.collection.CollectionUtil;
- import cn.hutool.crypto.digest.DigestAlgorithm;
- import cn.hutool.http.HttpUtil;
- import io.swagger.annotations.Api;
- import io.swagger.annotations.ApiOperation;
- import lombok.extern.slf4j.Slf4j;
- /**
- * 登录
- *
- * @version 1.0.0
- * @company persagy
- * @author zhangqiankun
- * @date 2021-03-13 15:29:50
- */
- @Slf4j
- @Api(tags = "账号信息")
- @RestController
- public class SaasLoginController {
- private static final String HTTP_PREFIX = "http://";
- private static final String HTTPS_PREFIX = "https://";
-
- @Autowired
- private SaasAuthHandler saasAuthHandler;
-
- @Autowired
- private ApplicationProperties properties;
-
- @Autowired
- private ISaasGroupService saasGroupService;
-
- @Autowired
- private BouncycastleCipher bouncycastleCipher;
-
- @Autowired
- private ISaasAccountService saasAccountService;
-
- @Autowired
- private SaasRoleMenuHandler saasRoleMenuHandler;
-
- @Autowired
- private RedisTemplate<String, Object> redisTemplate;
-
- /**
- * 运维系统账号登录
- *
- * @throws NumberFormatException
- * @throws IOException
- */
- @ApiOperation(value = "运维系统账号登录")
- @RequestMapping(value = "saas/login", method = RequestMethod.POST)
- public ResponseResult saasAccountLogin(@RequestBody @Validated SaasAccountLoginVO loginVO, HttpServletRequest request, HttpServletResponse response) throws NumberFormatException, IOException {
- String redirectUrl = this.validSaasSSO(loginVO);
-
- LambdaQueryWrapper<SaasAccount> queryWrapper = new SaasAccount.Builder().createQueryWrapper().usernameEq(loginVO.getUsername()).passwordEq(loginVO.getPassword()).builderQueryWrapper();
- List<SaasAccount> accounts = this.saasAccountService.list(queryWrapper);
- if (CollectionUtil.isEmpty(accounts) || accounts.size() > 1) {
- return ResponseResultUtil.errorResult(ResponseCode.A0220.getCode(), "用户名/密码错误");
- }
- SaasAccount account = accounts.get(0);
- // 验证此账号是否可用
- if (SaasCommonConstant.STATUS_1 != account.getValid()) {
- return ResponseResultUtil.errorResult(ResponseCode.A0220.getCode(), "此账号已停用");
- }
- /*if (!account.getTerminal().contains(loginVO.getAppId())) {
- return ResponseResultUtil.errorResult(ResponseCode.A0220.getCode(), "此账号不允许在此端登录");
- }*/
- // 验证是否在有效期内
- if (SaasCommonConstant.STR_STATUS_0.equals(account.getValidLast())) {
- Date date = new Date();
- Date validEndTime = account.getValidEndTime();
- if (date.after(validEndTime)) {
- return ResponseResultUtil.errorResult(ResponseCode.A0220.getCode(), "此账号已停用");
- }
- }
- // 如果是业务系统账号,集团编码必须存在
- if (SaasCommonConstant.STR_STATUS_1.equals(account.getAccountBelong()) && StringUtil.isBlank(account.getGroupCode())) {
- return ResponseResultUtil.errorResult(ResponseCode.C0341.getCode(), "业务系统账号,集团编码不可为空");
- }
- // 获取集团名称
- if (StringUtil.isNotBlank(account.getGroupCode())) {
- SaasGroup saasGroup = this.saasGroupService.getOne(account.getGroupCode());
- account.setGroupName(saasGroup == null ? null : saasGroup.getGroupName());
- }
- // 更新账号登录时间,及IP
- String address = RequestUtil.getIpAddress(request);
- LambdaUpdateWrapper<SaasAccount> updateWrapper = new SaasAccount.Builder().createUpdateWrapper()
- .idEq(account.getId()).groupCodeEq(account.getGroupCode())
- .validEq(SaasCommonConstant.STATUS_1).builderUpdateWrapper();
- updateWrapper.set(SaasAccount::getLastLoginTime, new Date());
- updateWrapper.set(SaasAccount::getLastLoginIp, address);
- boolean result = this.saasAccountService.update(updateWrapper);
- if (!result) {
- return ResponseResultUtil.errorResult("登录信息更新失败");
- }
- account.setPassword(null);
- // 判断是否需要获取菜单权限树
- if (loginVO.isAuths()) {
- List<SaasMenu> menuTree = this.querySaasMenuTree(account, loginVO.getAppId());
- account.setAuths(menuTree);
- }
- account.setAppId(loginVO.getAppId());
- String token = this.setRedisToken(account, loginVO.getAppId(), loginVO.isRemember(), false);
- // 判断是否需要重定向
- if (StringUtil.isNotBlank(redirectUrl)) {
- String code = this.saasAuthHandler.getCode(loginVO.getClientId(), loginVO.getRedirectUrl(), account.getId(), account.getGroupCode(), loginVO.getAppId());
- redirectUrl = redirectUrl + "&code=" + code;
- Map<String, String> temp = new HashMap<String, String>();
- temp.put("redirectUrl", redirectUrl);
- return ResponseResultUtil.successResult(temp);
- }
- response.setHeader(CipherConstants.TOKEN_HEADER, token);
- return ResponseResultUtil.successResult(account);
- }
-
- /**
- * 能够进来,说明已经经过token验证,且通过,查询出账号信息,并返回即可
- *
- * @param queryVO
- * @return
- * @throws NumberFormatException
- * @throws UnsupportedEncodingException
- */
- @ApiOperation(value = "记住登录")
- @RequestMapping(value = "saas/remember", method = RequestMethod.POST)
- public ResponseResult saasAccountLogin(@RequestBody @Validated SaasAccountQueryVO queryVO, HttpServletRequest request, HttpServletResponse response) throws NumberFormatException, UnsupportedEncodingException {
- SaasAccount account = this.saasAccountService.getOne(queryVO.getAccountId(), null, queryVO.getUsername());
- if (account == null) {
- return ResponseResultUtil.errorResult(ResponseCode.A0402.getCode(), "账号信息不存在");
- }
- // 获取集团名称
- if (StringUtil.isNotBlank(account.getGroupCode())) {
- SaasGroup saasGroup = this.saasGroupService.getOne(account.getGroupCode());
- account.setGroupName(saasGroup == null ? null : saasGroup.getGroupName());
- }
- String token = this.setRedisToken(account, queryVO.getAppId(), true, true);
- response.setHeader(CipherConstants.TOKEN_HEADER, token);
- return ResponseResultUtil.successResult(account);
- }
-
- /**
- * 退出登录,清空token,因为网关以确保token值必须于此账号,这里直接清空
- *
- * @param queryVO
- * @return
- * @throws NumberFormatException
- * @throws UnsupportedEncodingException
- */
- @ApiOperation(value = "退出登录")
- @RequestMapping(value = "account/logout", method = RequestMethod.POST)
- public ResponseResult accountLogout(@RequestBody @Validated SaasAccountQueryVO queryVO) throws NumberFormatException, UnsupportedEncodingException {
- if (StringUtil.isBlank(queryVO.getAccountId())) {
- return ResponseResultUtil.errorResult(ResponseCode.A0402.getCode(), "账号ID,不可为空");
- }
- // 从redis中清空此账号的sign信息
- boolean remove = this.bouncycastleCipher.remove(queryVO.getAccountId());
- return remove ? ResponseResultUtil.successResult("退出成功") : ResponseResultUtil.errorResult("退出失败");
- }
-
- /**
- * 外部账号登录验证
- * @return
- */
- public boolean validExternalAccount(String accountSource) {
- if ("201".equals(accountSource)) {
- // 获取code
- String url = "http://sso4dev.wanda-dev.cn/oauth2/Authorize?state=53f2495d7b435ac571&client_id=GRP999&response_type=code&scope=openid%20profile&redirect_uri=https://develop.persagy.com/saasframe3/login";
- Map<String, Object> params = new HashMap<String, Object>();
- params.put("code", "code");
- params.put("client_id", "client_id");
- params.put("client_secret", "client_secret");
- params.put("redirect_uri", "redirect_uri");
- params.put("grant_type", "authorization_code");
- String post = HttpUtil.post(url, params, 60000);
- log.info(post);
-
- // 获取token
- url = "http://sso4dev.wanda-dev.cn/oauth2/GetToken";
- params = new HashMap<String, Object>();
- params.put("code", "code");
- params.put("client_id", "client_id");
- params.put("client_secret", "client_secret");
- params.put("redirect_uri", "redirect_uri");
- params.put("grant_type", "authorization_code");
- post = HttpUtil.post(url, params, 60000);
- log.info(post);
-
- // 根据token获取用户信息
- url = "http://sso4dev.wanda-dev.cn/oauth2/GetUserInfo";
- post = HttpUtil.get(url, 60000);
- log.info(post);
- }
- return true;
- }
-
- /**
- * 验证是否需要重定向
- * @param loginVO
- * @return 为空时,说明不需要
- * @throws UnsupportedEncodingException
- */
- private String validSaasSSO(SaasAccountLoginVO loginVO) throws UnsupportedEncodingException {
- String state = loginVO.getState();
- String clientId = loginVO.getClientId();
- String redirectUrl = loginVO.getRedirectUrl();
- if (StringUtil.isAllBlank(state, clientId, redirectUrl)) {
- return null;
- }
- if (StringUtil.isBlank(clientId)) {
- throw new BusinessException(ResponseCode.A0402.getCode(), "客户端ID,不可为空");
- }
- if (StringUtil.isBlank(redirectUrl)) {
- throw new BusinessException(ResponseCode.A0402.getCode(), "重定向URL,不可为空");
- }
- // 验证clientId,是否存在
- // 验证redirectUrl的有效性
- if (redirectUrl.indexOf(HTTP_PREFIX) >= 0 || redirectUrl.indexOf(HTTPS_PREFIX) >= 0) {
- redirectUrl = URLEncoder.encode(redirectUrl, StandardCharsets.UTF_8.name());
- if (redirectUrl.indexOf("?") > 0) {
- redirectUrl = redirectUrl + "&clientId=" + clientId + "&state=" + state;
- } else {
- redirectUrl = redirectUrl + "?clientId=" + clientId + "&state=" + state;
- }
- return redirectUrl;
- }
- throw new BusinessException(ResponseCode.A0402.getCode(), "重定向URL,格式错误");
- }
-
- /**
- * 获取此账号的菜单权限树
- *
- * @param account
- * @param loginApp
- * @return
- */
- private List<SaasMenu> querySaasMenuTree(SaasAccount account, String loginApp) {
- SaasMenuQueryVO queryVO = new SaasMenuQueryVO();
- queryVO.setAccountId(account.getId());
- queryVO.setGroupCode(account.getGroupCode());
- queryVO.setAppId(loginApp);
- List<SaasMenu> menuTree = this.saasRoleMenuHandler.querySaasMenuTree(queryVO);
- return menuTree;
- }
-
- /**
- * 设置此账号的token,存入redis,如果redis中已存在,只追加有效期
- * @param account
- * @param loginApp
- * @param remember
- * @param isEqual 是否验证一致
- * @return
- * @throws UnsupportedEncodingException
- */
- private String setRedisToken(SaasAccount account, String loginApp, boolean remember, boolean isEqual) throws UnsupportedEncodingException {
- // 生成token,并验证之前登录是否为记住登录
- SecureAES aes = new SecureAES(properties.getAesKey(), properties.getAesIv());
- // 对称性加密用户信息
- String data = aes.encryptAccount(this.tokenAccountInfo(account, loginApp, remember));
- // token存在判断
- String sign = (String)this.redisTemplate.opsForValue().get(account.getId());
- if (sign != null) {
- if (isEqual) {
- // 判断是否与redis中一致,不一致,返回错误信息
- boolean result = this.bouncycastleCipher.isEqual(sign, account.getId());
- if (!result) {
- throw new BusinessException(ResponseCode.A0301.getCode(), ResponseCode.A0301.getDesc());
- }
- }
- this.redisTemplate.expire(account.getId(), Long.parseLong(this.properties.getTokenExpire()), TimeUnit.SECONDS);
- } else {
- // 加密串MD5加密转为sign,redis:key-账号ID,value-sign(data-MD5加密后)
- sign = this.bouncycastleCipher.encrypt(this.tokenInfo(data, loginApp), account.getId(), DigestAlgorithm.MD5, Long.parseLong(this.properties.getTokenExpire()), TimeUnit.SECONDS);
- }
- // token=data.sign
- String token = data + CipherConstants.POINT_JOIN_SYMBOL + sign;
- return token;
- }
-
- /**
- * 账号信息
- *
- * @param saasAccount
- * @param loginApp
- * @param remember
- * @return
- */
- private JSONObject tokenAccountInfo(SaasAccount saasAccount, String loginApp, boolean remember) {
- JSONObject object = new JSONObject();
- object.put(SaasCommonConstant.REMEMBER, remember);
- object.put(CipherConstants.APP_ID, loginApp);
- object.put(CipherConstants.GROUP_CODE, saasAccount.getGroupCode());
- object.put(CipherConstants.ACCOUNT_ID, saasAccount.getId());
- return object;
- }
-
- /**
- * 账号信息
- *
- * @param groupCode
- * @param loginApp
- * @return
- */
- private String tokenInfo(String content, String loginApp) {
- JSONObject object = new JSONObject();
- object.put(CipherConstants.APP_ID, loginApp);
- object.put("date", System.currentTimeMillis());
- object.put("content", content);
- return object.toJSONString();
- }
-
- }
|