🔒 Fixing security issues. 避免C端用户携带token 访问 B端接口

pigx-common/pigx-common-core/src/main/java/com/pig4cloud/pigx/common/core/constant/enums/YesNoEnum.java

@@ -0,0 +1,28 @@
+package com.pig4cloud.pigx.common.core.constant.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+/**
+ * yes and no enum
+ *
+ * @author lengleng
+ * @date 2023/10/25
+ */
+@Getter
+@AllArgsConstructor
+public enum YesNoEnum {
+
+    YES("1", "是"),
+    NO("0", "否");
+
+    /**
+     * 编码
+     */
+    private String code;
+
+    /**
+     * 描述
+     */
+    private String desc;
+}

pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/service/PigxDefaultUserDetailsServiceImpl.java

@@ -21,6 +21,7 @@ import com.pig4cloud.pigx.admin.api.dto.UserInfo;
 import com.pig4cloud.pigx.admin.api.feign.RemoteUserService;
 import com.pig4cloud.pigx.common.core.constant.CacheConstants;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
+import com.pig4cloud.pigx.common.core.constant.enums.UserTypeEnum;
 import com.pig4cloud.pigx.common.core.util.R;
 import lombok.RequiredArgsConstructor;
 import lombok.SneakyThrows;
@@ -41,33 +42,49 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException;
 @RequiredArgsConstructor
 public class PigxDefaultUserDetailsServiceImpl implements PigxUserDetailsService {
 
-	private final RemoteUserService remoteUserService;
+    private final RemoteUserService remoteUserService;
 
-	private final CacheManager cacheManager;
+    private final CacheManager cacheManager;
 
-	/**
-	 * 用户密码登录
-	 * @param username 用户名
-	 * @return
-	 * @throws UsernameNotFoundException
-	 */
-	@Override
-	@SneakyThrows
-	public UserDetails loadUserByUsername(String username) {
-		Cache cache = cacheManager.getCache(CacheConstants.USER_DETAILS);
-		if (cache != null && cache.get(username) != null) {
-			return cache.get(username, PigxUser.class);
-		}
+    /**
+     * 用户密码登录
+     *
+     * @param username 用户名
+     * @return
+     * @throws UsernameNotFoundException
+     */
+    @Override
+    @SneakyThrows
+    public UserDetails loadUserByUsername(String username) {
+        Cache cache = cacheManager.getCache(CacheConstants.USER_DETAILS);
+        if (cache != null && cache.get(username) != null) {
+            return cache.get(username, PigxUser.class);
+        }
 
-		R<UserInfo> result = remoteUserService.info(username, SecurityConstants.FROM_IN);
-		UserDetails userDetails = getUserDetails(result);
-		cache.put(username, userDetails);
-		return userDetails;
-	}
+        R<UserInfo> result = remoteUserService.info(username, SecurityConstants.FROM_IN);
+        UserDetails userDetails = getUserDetails(result);
+        cache.put(username, userDetails);
+        return userDetails;
+    }
 
-	@Override
-	public int getOrder() {
-		return Integer.MIN_VALUE;
-	}
+    /**
+     * 通过用户实体查询
+     *
+     * @param pigxUser user
+     * @return
+     */
+    @Override
+    public UserDetails loadUserByUser(PigxUser pigxUser) {
+        // 避免 C端用户通过接口调用B端接口的安全问题
+        if (UserTypeEnum.TOB.getStatus().equals(pigxUser.getUserType())) {
+            return loadUserByUsername(pigxUser.getUsername());
+        }
+        return null;
+    }
+
+    @Override
+    public int getOrder() {
+        return Integer.MIN_VALUE;
+    }
 
 }