SaasAuthHandler.java 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222
  1. package com.persagy.account.manage;
  2. import java.util.HashMap;
  3. import java.util.List;
  4. import java.util.Map;
  5. import org.springframework.beans.factory.annotation.Autowired;
  6. import org.springframework.data.redis.core.RedisTemplate;
  7. import org.springframework.stereotype.Component;
  8. import com.alibaba.fastjson.JSONObject;
  9. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  10. import com.google.common.collect.Lists;
  11. import com.persagy.account.pojo.dto.SaasAccount;
  12. import com.persagy.account.pojo.dto.SaasArea;
  13. import com.persagy.account.pojo.dto.SaasGroup;
  14. import com.persagy.account.service.ISaasAccountService;
  15. import com.persagy.account.service.ISaasGroupService;
  16. import com.persagy.common.constant.SaasCommonConstant;
  17. import com.persagy.common.enums.ResponseCode;
  18. import com.persagy.common.exception.BusinessException;
  19. import com.persagy.common.utils.StringUtil;
  20. import cn.hutool.core.util.BooleanUtil;
  21. import cn.hutool.crypto.digest.MD5;
  22. /**
  23. * @version
  24. * @description
  25. * @company persagy
  26. * @author zhangqiankun
  27. * @since 2021年3月18日: 上午10:20:22
  28. */
  29. @Component
  30. public class SaasAuthHandler {
  31. private static MD5 md5 = MD5.create();
  32. @Autowired
  33. private ISaasGroupService saasGroupService;
  34. @Autowired
  35. private ISaasAccountService saasAccountService;
  36. @Autowired
  37. private SaasAreaProjectHandler saasAreaProjectHandler;
  38. @Autowired
  39. private RedisTemplate<String, Object> redisTemplate;
  40. /**
  41. * 验证此账号的集团权限
  42. *
  43. * @param accountId
  44. * @param groupCode
  45. * @return
  46. * 权限鉴定通过时:
  47. * 有accountbelong 账号所属字段
  48. * 若有返回集团编码,则此返回值必须作为代码向下执行的sql条件;
  49. * 若有返回accountType,需进行 SaasCommonConstant.STR_STATUS_2.equals(accountType) 账号类型的判断
  50. */
  51. public Map<String, String> validAccountAuth(String accountId, String groupCode) {
  52. // 获取此账号对应的集团权限
  53. SaasAccount account = this.saasAccountService.getOne(accountId, null, null);
  54. if (account == null) {
  55. throw new BusinessException("账号信息为空");
  56. }
  57. // 添加数据访问控制,账号类型,0-所有集团项目,1-单集团所有项目,2-其他
  58. String accountType = account.getAccountType();
  59. // 1时,判断是否有权限
  60. Map<String, String> result = new HashMap<String, String>(2);
  61. if (SaasCommonConstant.STR_STATUS_1.equals(accountType)) {
  62. String allowGroupCode = account.getGroupCode();
  63. if (StringUtil.isNotBlank(groupCode) && !groupCode.equals(allowGroupCode)) {
  64. throw new BusinessException("账号无该集团的访问权限");
  65. }
  66. groupCode = allowGroupCode;
  67. }
  68. result.put(SaasCommonConstant.GROUP_CODE, groupCode);
  69. result.put(SaasCommonConstant.ACCOUNT_TYPE, accountType);
  70. result.put(SaasCommonConstant.ACCOUNT_BELONG, account.getAccountBelong());
  71. return result;
  72. }
  73. /**
  74. * 返回允许此账号访问的集团信息
  75. *
  76. * @param accountId
  77. * @param groupCode
  78. * @return 允许此账号访问的集团信息
  79. */
  80. public List<SaasGroup> getAllowGroupList(String accountId, String groupCode) {
  81. // 获取此账号对应的集团权限
  82. Map<String, String> accountAuth = this.validAccountAuth(accountId, groupCode);
  83. groupCode = accountAuth.get(SaasCommonConstant.GROUP_CODE);
  84. String accountType = accountAuth.get(SaasCommonConstant.ACCOUNT_TYPE);
  85. return this.getAllowGroupList(accountId, groupCode, accountType);
  86. }
  87. /**
  88. * 返回允许此账号访问的集团信息
  89. *
  90. * @param accountId
  91. * @param groupCode
  92. * @param accountType
  93. * @return 允许此账号访问的集团信息
  94. */
  95. public List<SaasGroup> getAllowGroupList(String accountId, String groupCode, String accountType) {
  96. List<SaasGroup> groups = null;
  97. if (SaasCommonConstant.STR_STATUS_2.equals(accountType)) {
  98. SaasGroup saasGroup = new SaasGroup();
  99. saasGroup.setGroupCode(groupCode);
  100. saasGroup.setValid(SaasCommonConstant.STATUS_1);
  101. groups = this.saasGroupService.queryAllowGroupInfo(saasGroup, accountId);
  102. } else {
  103. LambdaQueryWrapper<SaasGroup> queryWrapper = new SaasGroup.Builder().createQueryWrapper().validEq(SaasCommonConstant.STATUS_1).builderQueryWrapper();
  104. groups = this.saasGroupService.list(queryWrapper);
  105. }
  106. return groups == null ? Lists.newArrayList() : groups;
  107. }
  108. /**
  109. * 返回被允许访问的区域树
  110. *
  111. * @param accountId
  112. * @param groupCode
  113. * @return 允许此账号访问的集团信息
  114. */
  115. public List<SaasArea> getAllowAreaList(String accountId, String groupCode) {
  116. // 获取此账号对应的集团权限
  117. Map<String, String> accountAuth = this.validAccountAuth(accountId, groupCode);
  118. groupCode = accountAuth.get(SaasCommonConstant.GROUP_CODE);
  119. String accountType = accountAuth.get(SaasCommonConstant.ACCOUNT_TYPE);
  120. return this.getAllowAreaList(accountId, groupCode, accountType);
  121. }
  122. /**
  123. * 返回被允许访问的区域树
  124. *
  125. * @param accountId
  126. * @param groupCode
  127. * @param accountType
  128. * @return
  129. */
  130. public List<SaasArea> getAllowAreaList(String accountId, String groupCode, String accountType) {
  131. List<SaasArea> topList = this.saasAreaProjectHandler.getTopAreaList(groupCode);
  132. if (SaasCommonConstant.STR_STATUS_2.equals(accountType)) {
  133. // 其他类型时,需要根据权限表数据,去匹配区域树
  134. this.saasAreaProjectHandler.queryAllowAreaTree(topList, accountId, groupCode);
  135. } else {
  136. this.saasAreaProjectHandler.querySaasAreaTree(topList, false);
  137. }
  138. return topList;
  139. }
  140. /**
  141. * 申请授权码,每次重新生成
  142. *
  143. * @param clientId
  144. * @param redirectUrl
  145. * @param accountId
  146. * @param groupCode
  147. * @param appId
  148. * @return
  149. */
  150. public String getCode(String clientId, String redirectUrl, String accountId, String groupCode, String appId) {
  151. // 验证客户端ID是否存在
  152. Boolean member = this.redisTemplate.opsForSet().isMember(SaasCommonConstant.SAAS_CLIENT_ID_REDIS_KEY, clientId);
  153. if (!BooleanUtil.isTrue(member)) {
  154. throw new BusinessException(ResponseCode.A0001.getCode(), "非法客户端");
  155. }
  156. // 如果redirectUrl存在,验证是否为可用值
  157. if (!this.validRedirectUrl(clientId, redirectUrl)) {
  158. throw new BusinessException(ResponseCode.A0001.getCode(), "非法客户端");
  159. }
  160. // 设置账号相关信息
  161. this.redisTemplate.opsForHash().put(clientId, SaasCommonConstant.APP_ID_REDIS_HASH_KEY, appId);
  162. this.redisTemplate.opsForHash().put(clientId, SaasCommonConstant.ACCOUNT_ID_REDIS_HASH_KEY, accountId);
  163. this.redisTemplate.opsForHash().put(clientId, SaasCommonConstant.GROUP_CODE_REDIS_HASH_KEY, groupCode);
  164. // 生成新的授权码,并验证授权码是否已存在
  165. JSONObject temp = new JSONObject();
  166. temp.put("time", System.currentTimeMillis());
  167. temp.put("redirectUrl", redirectUrl);
  168. temp.put("clientId", clientId);
  169. String code = md5.digestHex(temp.toJSONString());
  170. this.redisTemplate.opsForHash().put(clientId, SaasCommonConstant.CODE_REDIS_HASH_KEY, code);
  171. return code;
  172. }
  173. /**
  174. * 验证redirectUrl的有效性,此方法默认空的redirectUrl,校验为true
  175. *
  176. * @param clientId
  177. * @param redirectUrl
  178. * @return
  179. */
  180. public boolean validRedirectUrl(String clientId, String redirectUrl) {
  181. if (StringUtil.isBlank(redirectUrl)) {
  182. return true;
  183. }
  184. // 判断是否为内部客户端,内部不校验url
  185. Boolean inner = (Boolean)this.redisTemplate.opsForHash().get(clientId, SaasCommonConstant.INNER_CLIENT_REDIS_HASH_KEY);
  186. if (BooleanUtil.isTrue(inner)) {
  187. return true;
  188. }
  189. Object object = this.redisTemplate.opsForHash().get(clientId, SaasCommonConstant.REDIRECT_URL_REDIS_HASH_KEY);
  190. if(object == null) {
  191. return false;
  192. }
  193. String allowUrl = (String) object;
  194. if (StringUtil.isBlank(allowUrl)) {
  195. return false;
  196. }
  197. if (allowUrl.equals(allowUrl)) {
  198. return true;
  199. }
  200. return false;
  201. }
  202. }