server/sino-mci
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): replace JWT with Sa-Token, add auth context and interceptor

Browse Source
This commit is contained in:
王宇航
2026-07-07 14:52:18 +08:00
parent 14c2c3095b
commit f50a3fd0c9
6 changed files with 154 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

195
docs/superpowers/plans/2026-07-07-admin-auth-flow-testing-plan.md
View File

@@ -112,133 +112,59 @@
---
## Task 1: 后端 JWT 与鉴权基础设施
## Task 1: 后端 Sa-Token 与鉴权基础设施
**Files:**
- Modify: `backend/mci-server/pom.xml`
- Create: `backend/mci-server/src/main/java/com/sino/mci/admin/security/JwtTokenProvider.java`
- Create: `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthContext.java`
- Create: `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthInterceptor.java`
- Create: `backend/mci-server/src/main/java/com/sino/mci/config/WebConfig.java`
- Modify: `backend/mci-server/src/main/resources/application.yml`
- [ ] **Step 1: 添加 jjwt 依赖**
- [ ] **Step 1: 添加 Sa-Token 依赖**
修改 `backend/mci-server/pom.xml` 的 `<dependencies>` 节点，添加：
```xml
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.12.6</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
<groupId>cn.dev33</groupId>
<artifactId>sa-token-spring-boot3-starter</artifactId>
<version>1.39.0</version>
</dependency>
```
- [ ] **Step 2: 创建 JwtTokenProvider**
- [ ] **Step 2: 创建 AuthContext**
创建 `backend/mci-server/src/main/java/com/sino/mci/admin/security/JwtTokenProvider.java`：
```java
package com.sino.mci.admin.security;
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.List;
@Component
public class JwtTokenProvider {
@Value("${mci.jwt.secret:sino-mci-default-secret-key-at-least-32-bytes}")
private String secret;
@Value("${mci.jwt.expiration-ms:86400000}")
private long expirationMs;
private SecretKey getKey() {
return Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8));
}
public String generateToken(String tenantCode, Long userId, String username, List<String> roleCodes) {
Date now = new Date();
Date expiry = new Date(now.getTime() + expirationMs);
return Jwts.builder()
.subject(String.valueOf(userId))
.claim("tenantCode", tenantCode)
.claim("username", username)
.claim("roleCodes", roleCodes)
.issuedAt(now)
.expiration(expiry)
.signWith(getKey())
.compact();
}
public Claims parseToken(String token) {
return Jwts.parser()
.verifyWith(getKey())
.build()
.parseSignedClaims(token)
.getPayload();
}
public boolean validateToken(String token) {
try {
parseToken(token);
return true;
} catch (JwtException | IllegalArgumentException e) {
return false;
}
}
}
```
- [ ] **Step 3: 创建 AuthContext**
创建 `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthContext.java`：
基于 Sa-Token `StpUtil` 创建 `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthContext.java`：
```java
package com.sino.mci.admin.security;
import cn.dev33.satoken.stp.StpUtil;
import lombok.Data;
public class AuthContext {
import java.util.List;
private static final ThreadLocal<AuthUser> CURRENT = new ThreadLocal<>();
public class AuthContext {
@Data
public static class AuthUser {
private Long userId;
private String tenantCode;
private String username;
private java.util.List<String> roleCodes;
}
public static void set(AuthUser user) {
CURRENT.set(user);
private List<String> roleCodes;
}
public static AuthUser get() {
return CURRENT.get();
}
public static void clear() {
CURRENT.remove();
if (!StpUtil.isLogin()) {
return null;
}
AuthUser user = new AuthUser();
user.setUserId(StpUtil.getLoginIdAsLong());
user.setTenantCode((String) StpUtil.getSession().get("tenantCode"));
user.setUsername((String) StpUtil.getSession().get("username"));
user.setRoleCodes((List<String>) StpUtil.getSession().get("roleCodes"));
return user;
}
public static String currentTenantCode() {
@@ -248,65 +174,42 @@ public class AuthContext {
}
```
- [ ] **Step 4: 创建 AuthInterceptor**
- [ ] **Step 3: 创建 AuthInterceptor**
创建 `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthInterceptor.java`：
创建 `backend/mci-server/src/main/java/com/sino/mci/admin/security/AuthInterceptor.java`，使用 Sa-Token 校验登录：
```java
package com.sino.mci.admin.security;
import io.jsonwebtoken.Claims;
import cn.dev33.satoken.exception.SaTokenException;
import cn.dev33.satoken.stp.StpUtil;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.RequiredArgsConstructor;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import java.util.List;
@Component
@RequiredArgsConstructor
public class AuthInterceptor implements HandlerInterceptor {
private final JwtTokenProvider jwtTokenProvider;
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
String path = request.getRequestURI();
if (path.contains("/api/v1/account/login") || path.contains("/api/v1/account/tenant")) {
if (path.contains("/api/v1/account/login")) {
return true;
}
String header = request.getHeader("Authorization");
if (header == null || !header.startsWith("Bearer ")) {
try {
StpUtil.checkLogin();
} catch (SaTokenException e) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
return false;
}
String token = header.substring(7);
if (!jwtTokenProvider.validateToken(token)) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
return false;
}
Claims claims = jwtTokenProvider.parseToken(token);
AuthContext.AuthUser user = new AuthContext.AuthUser();
user.setUserId(Long.valueOf(claims.getSubject()));
user.setTenantCode(claims.get("tenantCode", String.class));
user.setUsername(claims.get("username", String.class));
user.setRoleCodes(claims.get("roleCodes", List.class));
AuthContext.set(user);
return true;
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) {
AuthContext.clear();
}
}
```
- [ ] **Step 5: 注册拦截器**
- [ ] **Step 4: 注册拦截器并配置 Sa-Token**
创建 `backend/mci-server/src/main/java/com/sino/mci/config/WebConfig.java`：
@@ -334,7 +237,21 @@ public class WebConfig implements WebMvcConfigurer {
}
```
- [ ] **Step 6: 编译验证**
在 `backend/mci-server/src/main/resources/application.yml` 中添加 Sa-Token 基础配置：
```yaml
sa-token:
token-name: Authorization
token-prefix: Bearer
timeout: 86400
active-timeout: -1
is-concurrent: true
is-share: true
token-style: uuid
is-log: false
```
- [ ] **Step 5: 编译验证**
Run:
```bash
@@ -344,12 +261,12 @@ JAVA_HOME=/opt/homebrew/opt/openjdk@21 mvn -f mci-server/pom.xml compile -DskipT
Expected: BUILD SUCCESS
- [ ] **Step 7: Commit**
- [ ] **Step 6: Commit**
```bash
cd /Users/marsal/Projects/sino-project/sino-mci
git add backend/mci-server/pom.xml backend/mci-server/src/main/java/com/sino/mci/admin/security/ backend/mci-server/src/main/java/com/sino/mci/config/WebConfig.java
git commit -m "feat(auth): add JWT provider, auth context and interceptor"
git add backend/mci-server/pom.xml backend/mci-server/src/main/java/com/sino/mci/admin/security/ backend/mci-server/src/main/java/com/sino/mci/config/WebConfig.java backend/mci-server/src/main/resources/application.yml
git commit -m "feat(auth): add Sa-Token auth context and interceptor"
```
---
@@ -387,16 +304,12 @@ public class TokenResponse {
修改 `backend/mci-server/src/main/java/com/sino/mci/admin/service/AccountService.java`：
注入 `JwtTokenProvider`：
引入 Sa-Token：
```java
import com.sino.mci.admin.security.JwtTokenProvider;
private final JwtTokenProvider jwtTokenProvider;
import cn.dev33.satoken.stp.StpUtil;
```
构造器已使用 `@RequiredArgsConstructor`，无需改动构造器。
改造 `login` 方法：
```java
@@ -418,8 +331,12 @@ public TokenResponse login(String tenantCode, String username, String password)
userInfo.setPhone(user.getPhone());
userInfo.setRoleCodes(loadRoleCodes(user.getId()));
String token = jwtTokenProvider.generateToken(
user.getTenantCode(), user.getId(), user.getUsername(), userInfo.getRoleCodes());
StpUtil.login(user.getId());
StpUtil.getSession().set("tenantCode", user.getTenantCode());
StpUtil.getSession().set("username", user.getUsername());
StpUtil.getSession().set("roleCodes", userInfo.getRoleCodes());
String token = StpUtil.getTokenValue();
return new TokenResponse(token, userInfo);
}
```