✨ Introducing new features. #1631 【讨论帖】重构目前整体架构核心，不调用认证中心 ，资源服务器自行校验 token <=>

23d705cfbb

✨ Introducing new features. #1631 【讨论帖】重构目前整体架构核心，不调用认证中心 ，资源服务器自行校验 token   <=>
23d705cfbb

pigx-auth/pom.xml

@@ -43,11 +43,6 @@
 			<groupId>com.alibaba.cloud</groupId>
 			<artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
 		</dependency>
-		<!--upms api、model 模块-->
-		<dependency>
-			<groupId>com.pig4cloud</groupId>
-			<artifactId>pigx-upms-api</artifactId>
-		</dependency>
 		<!--log-->
 		<dependency>
 			<groupId>com.pig4cloud</groupId>

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxLocalResourceServerTokenServices.java

@@ -1,11 +1,17 @@
 package com.pig4cloud.pigx.common.security.component;
 
+import com.pig4cloud.pigx.common.security.service.PigxUser;
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Primary;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.common.OAuth2AccessToken;
 import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.oauth2.provider.OAuth2Request;
 import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices;
 import org.springframework.security.oauth2.provider.token.TokenStore;
 import org.springframework.stereotype.Service;
@@ -21,10 +27,26 @@ public class PigxLocalResourceServerTokenServices implements ResourceServerToken
 
 	private final TokenStore tokenStore;
 
+	private final UserDetailsService userDetailsService;
+
 	@Override
 	public OAuth2Authentication loadAuthentication(String accessToken)
 			throws AuthenticationException, InvalidTokenException {
-		return tokenStore.readAuthentication(accessToken);
+		OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(accessToken);
+		OAuth2Request oAuth2Request = oAuth2Authentication.getOAuth2Request();
+
+		if (!(oAuth2Authentication.getPrincipal() instanceof PigxUser)) {
+			return oAuth2Authentication;
+		}
+
+		// 根据 username 查询 spring cache 最新的值 并返回
+		PigxUser pigxUser = (PigxUser) oAuth2Authentication.getPrincipal();
+		UserDetails userDetails = userDetailsService.loadUserByUsername(pigxUser.getUsername());
+		Authentication userAuthentication = new UsernamePasswordAuthenticationToken(userDetails, "N/A",
+				userDetails.getAuthorities());
+		OAuth2Authentication authentication = new OAuth2Authentication(oAuth2Request, userAuthentication);
+		authentication.setAuthenticated(true);
+		return authentication;
 	}
 
 	@Override

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/service/PigxUserDetailsServiceImpl.java

@@ -15,7 +15,7 @@
  * Author: lengleng (wangiegie@gmail.com)
  */
 
-package com.pig4cloud.pigx.auth.service;
+package com.pig4cloud.pigx.common.security.service;
 
 import cn.hutool.core.util.ArrayUtil;
 import cn.hutool.core.util.StrUtil;
@@ -26,9 +26,7 @@ import com.pig4cloud.pigx.common.core.constant.CacheConstants;
 import com.pig4cloud.pigx.common.core.constant.CommonConstants;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
 import com.pig4cloud.pigx.common.core.util.R;
-import com.pig4cloud.pigx.common.security.service.PigxUser;
-import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService;
-import lombok.AllArgsConstructor;
+import lombok.RequiredArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.cache.Cache;
@@ -37,7 +35,6 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
-import org.springframework.stereotype.Service;
 
 import java.util.Arrays;
 import java.util.Collection;
@@ -50,8 +47,7 @@ import java.util.Set;
  * @author lengleng
  */
 @Slf4j
-@Service
-@AllArgsConstructor
+@RequiredArgsConstructor
 public class PigxUserDetailsServiceImpl implements PigxUserDetailsService {
 
 	private final RemoteUserService remoteUserService;

pigx-common/pigx-common-security/src/main/resources/META-INF/spring.factories

@@ -1,6 +1,7 @@
 org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
   com.pig4cloud.pigx.common.security.component.PigxTokenEnhancer,\
   com.pig4cloud.pigx.common.security.component.PigxSecurityInnerAspect,\
+  com.pig4cloud.pigx.common.security.service.PigxUserDetailsServiceImpl,\
   com.pig4cloud.pigx.common.security.serializer.PigxTokenStoreAutoConfiguration,\
   com.pig4cloud.pigx.common.security.listener.AuthenticationFailureEventListener,\
   com.pig4cloud.pigx.common.security.listener.AuthenticationSuccessEventListener

pigx-common/pigx-common-sentinel/src/main/java/com/pig4cloud/pigx/common/sentinel/handle/GlobalBizExceptionHandler.java

@@ -23,7 +23,6 @@ import lombok.extern.slf4j.Slf4j;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.validation.FieldError;
 import org.springframework.web.bind.MethodArgumentNotValidException;
 import org.springframework.web.bind.annotation.*;
@@ -67,10 +66,8 @@ public class GlobalBizExceptionHandler {
 	@ExceptionHandler(AccessDeniedException.class)
 	@ResponseStatus(HttpStatus.FORBIDDEN)
 	public R handleAccessDeniedException(AccessDeniedException e) {
-		String msg = SpringSecurityMessageSource.getAccessor().getMessage("AbstractAccessDecisionManager.accessDenied",
-				e.getMessage());
-		log.error("拒绝授权异常信息 ex={}", msg, e);
-		return R.failed(e.getLocalizedMessage());
+		log.error("拒绝授权异常信息 ex={}", e.getMessage());
+		return R.failed("权限不足，不允许访问");
 	}
 
 	/**
@@ -93,7 +90,7 @@ public class GlobalBizExceptionHandler {
 	@DeleteMapping("/error")
 	@ResponseStatus(HttpStatus.NOT_FOUND)
 	public R noHandlerFoundException() {
-		return R.failed();
+		return R.failed(HttpStatus.NOT_FOUND.getReasonPhrase());
 	}
 
 }