✨ Introducing new features. #1771 I18N 统一服务端认证授权信息

2020-09-04 12:46:26 +08:00
1 parent 964bf540a8
commit e56e9dd503
@@ -17,12 +17,12 @@

 package com.pig4cloud.pigx.common.security.component;

+import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.authentication.AccountExpiredException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.LockedException;
-import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsChecker;

@@ -33,7 +33,7 @@ import org.springframework.security.core.userdetails.UserDetailsChecker;
@Slf4j
 public class PigxPreAuthenticationChecks implements UserDetailsChecker {

-	private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
+	private MessageSourceAccessor messages = PigxSecurityMessageSourceUtil.getAccessor();

 	@Override
 	public void check(UserDetails user) {
@@ -28,6 +28,7 @@ import org.springframework.security.oauth2.provider.authentication.TokenExtracto
 import org.springframework.security.oauth2.provider.token.DefaultAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.RemoteTokenServices;
 import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
+import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.web.client.RestTemplate;

 /**
@@ -40,7 +41,7 @@ import org.springframework.web.client.RestTemplate;
 public class PigxResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {

 	@Autowired
-	protected ResourceAuthExceptionEntryPoint resourceAuthExceptionEntryPoint;
+	protected AuthenticationEntryPoint resourceAuthExceptionEntryPoint;

 	@Autowired
 	protected RemoteTokenServices remoteTokenServices;
@@ -20,6 +20,7 @@ package com.pig4cloud.pigx.common.security.component;
 import cn.hutool.core.util.StrUtil;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil;
 import lombok.AllArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
@@ -48,8 +49,9 @@ public class PigxSecurityInnerAspect {
 	public Object around(ProceedingJoinPoint point, Inner inner) {
 		String header = request.getHeader(SecurityConstants.FROM);
 		if (inner.value() && !StrUtil.equals(SecurityConstants.FROM_IN, header)) {
-			log.warn("访问接口 {} 没有权限", point.getSignature().getName());
-			throw new AccessDeniedException("Access is denied");
+			log.warn("访问接口 {} 没有权限", inner.value());
+			throw new AccessDeniedException(PigxSecurityMessageSourceUtil.getAccessor().getMessage(
+					"AbstractAccessDecisionManager.accessDenied", new Object[] { inner.value() }, "access denied"));
 		}
 		return point.proceed();
 	}
@@ -23,11 +23,11 @@ import com.pig4cloud.pigx.common.core.constant.CommonConstants;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
 import com.pig4cloud.pigx.common.security.exception.PigxAuth2Exception;
 import com.pig4cloud.pigx.common.security.service.PigxUser;
+import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
 import org.springframework.util.StringUtils;
@@ -110,8 +110,9 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver
 		if (StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)) {
 			log.warn("请求头中的租户ID({})和用户的租户ID({})不一致", headerValue, userValue);
 			// TODO: 不要提示租户ID不对，可能被穷举
-			throw new PigxAuth2Exception(SpringSecurityMessageSource.getAccessor()
-					.getMessage("AbstractUserDetailsAuthenticationProvider.badTenantId", "Bad tenant ID"));
+			throw new PigxAuth2Exception(PigxSecurityMessageSourceUtil.getAccessor().getMessage(
+					"AbstractUserDetailsAuthenticationProvider.badTenantId", new Object[] { headerValue },
+					"Bad tenant ID"));
 		}
 	}

@@ -18,13 +18,13 @@
 package com.pig4cloud.pigx.common.security.component;

 import com.pig4cloud.pigx.common.security.exception.*;
+import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.oauth2.common.DefaultThrowableAnalyzer;
 import org.springframework.security.oauth2.common.OAuth2AccessToken;
 import org.springframework.security.oauth2.common.exceptions.ClientAuthenticationException;
@@ -67,7 +67,7 @@ public class PigxWebResponseExceptionTranslator implements WebResponseExceptionT
 		ase = (InvalidGrantException) throwableAnalyzer.getFirstThrowableOfType(InvalidGrantException.class,
 				causeChain);
 		if (ase != null) {
-			String msg = SpringSecurityMessageSource.getAccessor().getMessage(
+			String msg = PigxSecurityMessageSourceUtil.getAccessor().getMessage(
 					"AbstractUserDetailsAuthenticationProvider.badCredentials", ase.getMessage(), Locale.CHINA);
 			return handleOAuth2Exception(new InvalidException(msg, ase));
 		}
@@ -19,6 +19,7 @@ package com.pig4cloud.pigx.common.security.mobile;

 import com.pig4cloud.pigx.common.security.component.PigxPreAuthenticationChecks;
 import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService;
+import com.pig4cloud.pigx.common.security.util.PigxSecurityMessageSourceUtil;
 import lombok.Getter;
 import lombok.Setter;
 import lombok.SneakyThrows;
@@ -27,7 +28,6 @@ import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsChecker;

@@ -38,7 +38,7 @@ import org.springframework.security.core.userdetails.UserDetailsChecker;
@Slf4j
 public class MobileAuthenticationProvider implements AuthenticationProvider {

-	private MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
+	private MessageSourceAccessor messages = PigxSecurityMessageSourceUtil.getAccessor();

 	private UserDetailsChecker detailsChecker = new PigxPreAuthenticationChecks();

@@ -18,7 +18,7 @@
 package com.pig4cloud.pigx.common.security.mobile;

 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.pig4cloud.pigx.common.security.component.ResourceAuthExceptionEntryPoint;
+import com.pig4cloud.pigx.common.security.component.PigxCommenceAuthExceptionEntryPoint;
 import com.pig4cloud.pigx.common.security.service.PigxUserDetailsService;
 import lombok.Getter;
 import lombok.Setter;
@@ -57,7 +57,7 @@ public class MobileSecurityConfigurer extends SecurityConfigurerAdapter<DefaultS
 		mobileAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class));
 		mobileAuthenticationFilter.setAuthenticationSuccessHandler(mobileLoginSuccessHandler);
 		mobileAuthenticationFilter.setEventPublisher(defaultAuthenticationEventPublisher);
-		mobileAuthenticationFilter.setAuthenticationEntryPoint(new ResourceAuthExceptionEntryPoint(objectMapper));
+		mobileAuthenticationFilter.setAuthenticationEntryPoint(new PigxCommenceAuthExceptionEntryPoint(objectMapper));

 		MobileAuthenticationProvider mobileAuthenticationProvider = new MobileAuthenticationProvider();
 		mobileAuthenticationProvider.setUserDetailsService(userDetailsService);
@@ -0,0 +1,32 @@
+package com.pig4cloud.pigx.common.security.util;
+
+import org.springframework.context.support.MessageSourceAccessor;
+import org.springframework.context.support.ReloadableResourceBundleMessageSource;
+
+import java.util.Locale;
+
+/**
+ * @author lengleng
+ * @date 2020/9/4
+ * <p>
+ * @see org.springframework.security.core.SpringSecurityMessageSource pigx 框架自身异常处理，
+ * 建议所有异常都使用此工具类型 避免无法复写 SpringSecurityMessageSource
+ */
+public class PigxSecurityMessageSourceUtil extends ReloadableResourceBundleMessageSource {
+
+	// ~ Constructors
+	// ===================================================================================================
+
+	public PigxSecurityMessageSourceUtil() {
+		setBasename("classpath:messages/messages");
+		setDefaultLocale(Locale.CHINA);
+	}
+
+	// ~ Methods
+	// ========================================================================================================
+
+	public static MessageSourceAccessor getAccessor() {
+		return new MessageSourceAccessor(new PigxSecurityMessageSourceUtil());
+	}
+
+}
@@ -13,18 +13,21 @@
 # contributors may be used to endorse or promote products derived from
 # this software without specific prior written permission.
 # Author: lengleng (wangiegie@gmail.com)
+#  --------------------------------------
+#  PIGX \u4E2D\u7684\u5F02\u5E38\u4FE1\u606F\u4F7F\u7528\u6B64\u6587\u4EF6\u5B9A\u4E49
 #
-AbstractAccessDecisionManager.accessDenied=\u6743\u9650\u4E0D\u8DB3,\u4E0D\u5141\u8BB8\u8BBF\u95EE
+AbstractAccessDecisionManager.accessDenied=\u6743\u9650\u4E0D\u8DB3,\u4E0D\u5141\u8BB8\u8BBF\u95EE{0}
 AbstractLdapAuthenticationProvider.emptyPassword=\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A
 AbstractSecurityInterceptor.authenticationNotFound=\u672A\u5728SecurityContext\u4E2D\u67E5\u627E\u5230\u8BA4\u8BC1\u5BF9\u8C61
 AbstractUserDetailsAuthenticationProvider.badCredentials=\u7528\u6237\u540D\u4E0D\u5B58\u5728\u6216\u8005\u5BC6\u7801\u9519\u8BEF
+AbstractUserDetailsAuthenticationProvider.badClientCredentials=\u5BA2\u6237\u7AEF\u4FE1\u606F\u9519\u8BEF\uFF0CBasic\u8BA4\u8BC1\u5931\u8D25
 AbstractUserDetailsAuthenticationProvider.noopBindAccount=\u672A\u7ED1\u5B9A\u767B\u5F55\u8D26\u53F7\uFF0C\u8BF7\u4F7F\u7528\u5BC6\u7801\u767B\u5F55\u540E\u7ED1\u5B9A
 AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
 AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u672A\u6FC0\u6D3B
 AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
 AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
 AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
-AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684TenantId
+AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684\u79DF\u6237\u7F16\u53F7:{0}
 AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
 AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u672A\u6FC0\u6D3B
 AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F