feat: auth模块初始化

dolphin-commons/dolphin-common-core/pom.xml

@@ -16,6 +16,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
+        <dependency>
+            <groupId>cn.hutool.v7</groupId>
+            <artifactId>hutool-all</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>

dolphin-commons/dolphin-common-core/src/main/java/day/gitlab/dolphin/common/core/exception/GlobalExceptionHandler.java

@@ -1,13 +1,11 @@
 package day.gitlab.dolphin.common.core.exception;
 
 import day.gitlab.dolphin.common.core.entity.Result;
-import org.springframework.stereotype.Component;
-import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
 
-@Component
-@ControllerAdvice
-public class GlobalExceptionAdvice {
+@RestControllerAdvice
+public class GlobalExceptionHandler {
 
     @ExceptionHandler(value = BusinessException.class)
     public Result handleBusinessException(BusinessException e) {

dolphin-commons/dolphin-common-security/src/main/java/day/gitlab/dolphin/common/security/AuthenticationFilter.java

@@ -40,6 +40,7 @@ public class AuthenticationFilter extends OncePerRequestFilter {
         // 在未启用或是忽略校验的地址时直接放行
         if (!securityConfig.isEnabled() || authorityIgnoreInitializer.isIgnoreUrl(request)) {
             filterChain.doFilter(request, response);
+            return;
         }
 
         try {
@@ -51,6 +52,11 @@ public class AuthenticationFilter extends OncePerRequestFilter {
             response.setContentType(MediaType.APPLICATION_JSON_VALUE);
             response.setCharacterEncoding("UTF-8");
             response.getWriter().write(new ObjectMapper().writeValueAsString(Result.failure(e)));
+        } catch (Exception e) {
+            response.setStatus(500);
+            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+            response.setCharacterEncoding("UTF-8");
+            response.getWriter().write(new ObjectMapper().writeValueAsString(Result.failure(e.getMessage())));
         } finally {
             SecurityContextHolder.clearAuthentication();
         }

dolphin-commons/dolphin-common-security/src/main/java/day/gitlab/dolphin/common/security/annotation/AuthorityIgnoreInitializer.java

@@ -2,6 +2,7 @@ package day.gitlab.dolphin.common.security.annotation;
 
 import day.gitlab.dolphin.common.security.config.SecurityConfig;
 import jakarta.servlet.http.HttpServletRequest;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
@@ -21,6 +22,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
 
+@Slf4j
 @Component
 public class AuthorityIgnoreInitializer implements ApplicationContextAware {
 
@@ -34,6 +36,8 @@ public class AuthorityIgnoreInitializer implements ApplicationContextAware {
         RequestMappingHandlerMapping requestMappingHandlerMapping = ctx.getBean(RequestMappingHandlerMapping.class);
         Map<RequestMappingInfo, HandlerMethod> handlerMethods = requestMappingHandlerMapping.getHandlerMethods();
 
+        log.info("authorityIgnoreInitialize begin, contextPath: {}", contextPath);
+
         if (StringUtils.hasText(securityConfig.getIgnoreUrls())) {
             Arrays.stream(securityConfig.getIgnoreUrls().split(","))
                     .filter(StringUtils::hasText)
@@ -45,6 +49,7 @@ public class AuthorityIgnoreInitializer implements ApplicationContextAware {
                     .map(IgnoreUrl::new)
                     .forEach(this.ignoreUrls::add);
         }
+        log.info("authorityIgnoreInitialize default urls: {}", this.ignoreUrls);
 
         for (RequestMappingInfo mappingInfo : handlerMethods.keySet()) {
             HandlerMethod handlerMethod = handlerMethods.get(mappingInfo);
@@ -75,11 +80,19 @@ public class AuthorityIgnoreInitializer implements ApplicationContextAware {
                 urlPrefix.add(prefixUrl);
             }
 
-            urlPrefix.stream()
+            List<IgnoreUrl> methodIgnoreUrls = urlPrefix.stream()
                     .flatMap(sub -> mappingInfo.getPatternValues().stream().filter(StringUtils::hasText).map(s -> sub + s))
                     .map(IgnoreUrl::new)
-                    .forEach(this.ignoreUrls::add);
+                    .toList();
+            log.info("authorityIgnoreInitialize class [{}] method [{}] urls: {}", beanClass.getCanonicalName(), handlerMethod.getMethod().getName(), methodIgnoreUrls);
+            if (!methodIgnoreUrls.isEmpty()) {
+                ignoreUrls.addAll(methodIgnoreUrls);
+            }
         }
+
+        log.info("authorityIgnoreInitialize current urls: {}", this.ignoreUrls);
+
+        log.info("authorityIgnoreInitialize end");
     }
 
     public boolean isIgnoreUrl(HttpServletRequest request) {

dolphin-commons/dolphin-common-security/src/main/java/day/gitlab/dolphin/common/security/jwt/Jwt.java

@@ -1,5 +1,6 @@
 package day.gitlab.dolphin.common.security.jwt;
 
+import cn.hutool.v7.crypto.digest.DigestUtil;
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.security.Keys;
@@ -64,7 +65,7 @@ public class Jwt {
     }
 
     private SecretKey getSigningKey() {
-        byte[] keyBytes = secret.getBytes(StandardCharsets.UTF_8);
+        byte[] keyBytes = DigestUtil.sha256(secret);
         return Keys.hmacShaKeyFor(keyBytes);
     }
 }