Merge remote-tracking branch 'origin/satoken' into dev

# Conflicts: # pom.xml # ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java # ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java # ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/RepeatSubmitAspect.java # ruoyi-framework/src/main/java/com/ruoyi/framework/config/AsyncConfig.java # ruoyi-framework/src/main/java/com/ruoyi/framework/config/SwaggerConfig.java # ruoyi-framework/src/main/java/com/ruoyi/framework/handler/CreateAndUpdateMetaObjectHandler.java # ruoyi-framework/src/main/java/com/ruoyi/framework/security/handle/LogoutSuccessHandlerImpl.java # ruoyi-system/src/main/java/com/ruoyi/system/service/SysLoginService.java # ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserOnlineServiceImpl.java # ruoyi-system/src/main/java/com/ruoyi/system/service/impl/TokenServiceImpl.java # ruoyi-system/src/main/java/com/ruoyi/system/service/impl/UserDetailsServiceImpl.java # ruoyi-system/src/main/resources/mapper/system/SysUserMapper.xml
2025-09-24 07:19:46 +08:00 · 2022-01-13 11:14:33 +08:00
parent ff4a429136 29f0ded88b
commit 6ca8535166
63 changed files with 1174 additions and 1451 deletions
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/CacheController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/CacheController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.monitor;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.utils.StringUtils;
 import io.swagger.annotations.Api;
@ -9,7 +10,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.redis.connection.RedisServerCommands;
 import org.springframework.data.redis.core.RedisCallback;
 import org.springframework.data.redis.core.RedisTemplate;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@ -30,7 +30,7 @@ public class CacheController {
    private final RedisTemplate<String, String> redisTemplate;

    @ApiOperation("获取缓存监控详细信息")
-    @PreAuthorize("@ss.hasPermi('monitor:cache:list')")
+    @SaCheckPermission("monitor:cache:list")
    @GetMapping()
    public AjaxResult<Map<String, Object>> getInfo() throws Exception {
        Properties info = (Properties) redisTemplate.execute((RedisCallback<Object>) RedisServerCommands::info);
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysLogininforController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysLogininforController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.monitor;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
@ -13,7 +14,6 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -35,7 +35,7 @@ public class SysLogininforController extends BaseController {
    private final ISysLogininforService logininforService;

    @ApiOperation("查询系统访问记录列表")
-    @PreAuthorize("@ss.hasPermi('monitor:logininfor:list')")
+    @SaCheckPermission("monitor:logininfor:list")
    @GetMapping("/list")
    public TableDataInfo<SysLogininfor> list(SysLogininfor logininfor, PageQuery pageQuery) {
        return logininforService.selectPageLogininforList(logininfor, pageQuery);
@ -43,7 +43,7 @@ public class SysLogininforController extends BaseController {

    @ApiOperation("导出系统访问记录列表")
    @Log(title = "登录日志", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('monitor:logininfor:export')")
+    @SaCheckPermission("monitor:logininfor:export")
    @PostMapping("/export")
    public void export(SysLogininfor logininfor, HttpServletResponse response) {
        List<SysLogininfor> list = logininforService.selectLogininforList(logininfor);
@ -51,7 +51,7 @@ public class SysLogininforController extends BaseController {
    }

    @ApiOperation("删除系统访问记录")
-    @PreAuthorize("@ss.hasPermi('monitor:logininfor:remove')")
+    @SaCheckPermission("monitor:logininfor:remove")
    @Log(title = "登录日志", businessType = BusinessType.DELETE)
    @DeleteMapping("/{infoIds}")
    public AjaxResult<Void> remove(@PathVariable Long[] infoIds) {
@ -59,7 +59,7 @@ public class SysLogininforController extends BaseController {
    }

    @ApiOperation("清空系统访问记录")
-    @PreAuthorize("@ss.hasPermi('monitor:logininfor:remove')")
+    @SaCheckPermission("monitor:logininfor:remove")
    @Log(title = "登录日志", businessType = BusinessType.CLEAN)
    @DeleteMapping("/clean")
    public AjaxResult<Void> clean() {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysOperlogController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysOperlogController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.monitor;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
@ -13,7 +14,6 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -35,7 +35,7 @@ public class SysOperlogController extends BaseController {
    private final ISysOperLogService operLogService;

    @ApiOperation("查询操作日志记录列表")
-    @PreAuthorize("@ss.hasPermi('monitor:operlog:list')")
+    @SaCheckPermission("monitor:operlog:list")
    @GetMapping("/list")
    public TableDataInfo<SysOperLog> list(SysOperLog operLog, PageQuery pageQuery) {
        return operLogService.selectPageOperLogList(operLog, pageQuery);
@ -43,7 +43,7 @@ public class SysOperlogController extends BaseController {

    @ApiOperation("导出操作日志记录列表")
    @Log(title = "操作日志", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('monitor:operlog:export')")
+    @SaCheckPermission("monitor:operlog:export")
    @PostMapping("/export")
    public void export(SysOperLog operLog, HttpServletResponse response) {
        List<SysOperLog> list = operLogService.selectOperLogList(operLog);
@ -52,7 +52,7 @@ public class SysOperlogController extends BaseController {

    @ApiOperation("删除操作日志记录")
    @Log(title = "操作日志", businessType = BusinessType.DELETE)
-    @PreAuthorize("@ss.hasPermi('monitor:operlog:remove')")
+    @SaCheckPermission("monitor:operlog:remove")
    @DeleteMapping("/{operIds}")
    public AjaxResult<Void> remove(@PathVariable Long[] operIds) {
        return toAjax(operLogService.deleteOperLogByIds(operIds));
@ -60,7 +60,7 @@ public class SysOperlogController extends BaseController {

    @ApiOperation("清空操作日志记录")
    @Log(title = "操作日志", businessType = BusinessType.CLEAN)
-    @PreAuthorize("@ss.hasPermi('monitor:operlog:remove')")
+    @SaCheckPermission("monitor:operlog:remove")
    @DeleteMapping("/clean")
    public AjaxResult<Void> clean() {
        operLogService.cleanOperLog();
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysUserOnlineController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/monitor/SysUserOnlineController.java
@ -1,27 +1,30 @@
 package com.ruoyi.web.controller.monitor;

+import cn.dev33.satoken.annotation.SaCheckPermission;
+import cn.dev33.satoken.exception.NotLoginException;
+import cn.dev33.satoken.stp.StpLogic;
+import cn.dev33.satoken.stp.StpUtil;
+import cn.hutool.core.bean.BeanUtil;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.Constants;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
-import com.ruoyi.common.core.domain.model.LoginUser;
+import com.ruoyi.common.core.domain.dto.UserOnlineDTO;
 import com.ruoyi.common.core.page.TableDataInfo;
 import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.common.utils.redis.RedisUtils;
 import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.system.domain.SysUserOnline;
-import com.ruoyi.system.service.ISysUserOnlineService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;

 import java.util.ArrayList;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+import java.util.stream.Collectors;

 /**
 * 在线用户监控
@ -34,34 +37,38 @@ import java.util.List;
@RequestMapping("/monitor/online")
 public class SysUserOnlineController extends BaseController {

-    private final ISysUserOnlineService userOnlineService;
-
    @ApiOperation("在线用户列表")
-    @PreAuthorize("@ss.hasPermi('monitor:online:list')")
+    @SaCheckPermission("monitor:online:list")
    @GetMapping("/list")
    public TableDataInfo<SysUserOnline> list(String ipaddr, String userName) {
-        Collection<String> keys = RedisUtils.keys(Constants.LOGIN_TOKEN_KEY + "*");
-        List<SysUserOnline> userOnlineList = new ArrayList<SysUserOnline>();
+        // 获取所有未过期的 token
+        List<String> keys = StpUtil.searchTokenValue("", -1, 0);
+        List<UserOnlineDTO> userOnlineDTOList = new ArrayList<>();
        for (String key : keys) {
-            LoginUser user = RedisUtils.getCacheObject(key);
-            if (StringUtils.isNotEmpty(ipaddr) && StringUtils.isNotEmpty(userName)) {
-                if (StringUtils.equals(ipaddr, user.getIpaddr()) && StringUtils.equals(userName, user.getUsername())) {
-                    userOnlineList.add(userOnlineService.selectOnlineByInfo(ipaddr, userName, user));
-                }
-            } else if (StringUtils.isNotEmpty(ipaddr)) {
-                if (StringUtils.equals(ipaddr, user.getIpaddr())) {
-                    userOnlineList.add(userOnlineService.selectOnlineByIpaddr(ipaddr, user));
-                }
-            } else if (StringUtils.isNotEmpty(userName)) {
-                if (StringUtils.equals(userName, user.getUsername())) {
-                    userOnlineList.add(userOnlineService.selectOnlineByUserName(userName, user));
-                }
-            } else {
-                userOnlineList.add(userOnlineService.loginUserToUserOnline(user));
+            String token = key.replace(Constants.LOGIN_TOKEN_KEY, "");
+            // 如果已经过期则踢下线
+            if (StpUtil.stpLogic.getTokenActivityTimeoutByToken(token) < 0) {
+                continue;
            }
+            userOnlineDTOList.add(RedisUtils.getCacheObject(Constants.ONLINE_TOKEN_KEY + token));
        }
-        Collections.reverse(userOnlineList);
-        userOnlineList.removeAll(Collections.singleton(null));
+        if (StringUtils.isNotEmpty(ipaddr) && StringUtils.isNotEmpty(userName)) {
+            userOnlineDTOList = userOnlineDTOList.stream().filter(userOnline ->
+                StringUtils.equals(ipaddr, userOnline.getIpaddr()) &&
+                    StringUtils.equals(userName, userOnline.getUserName())
+            ).collect(Collectors.toList());
+        } else if (StringUtils.isNotEmpty(ipaddr)) {
+            userOnlineDTOList = userOnlineDTOList.stream().filter(userOnline ->
+                StringUtils.equals(ipaddr, userOnline.getIpaddr()))
+                .collect(Collectors.toList());
+        } else if (StringUtils.isNotEmpty(userName)) {
+            userOnlineDTOList = userOnlineDTOList.stream().filter(userOnline ->
+                StringUtils.equals(userName, userOnline.getUserName())
+            ).collect(Collectors.toList());
+        }
+        Collections.reverse(userOnlineDTOList);
+        userOnlineDTOList.removeAll(Collections.singleton(null));
+        List<SysUserOnline> userOnlineList = BeanUtil.copyToList(userOnlineDTOList, SysUserOnline.class);
        return TableDataInfo.build(userOnlineList);
    }

@ -69,11 +76,14 @@ public class SysUserOnlineController extends BaseController {
     * 强退用户
     */
    @ApiOperation("强退用户")
-    @PreAuthorize("@ss.hasPermi('monitor:online:forceLogout')")
+    @SaCheckPermission("monitor:online:forceLogout")
    @Log(title = "在线用户", businessType = BusinessType.FORCE)
    @DeleteMapping("/{tokenId}")
    public AjaxResult<Void> forceLogout(@PathVariable String tokenId) {
-        RedisUtils.deleteObject(Constants.LOGIN_TOKEN_KEY + tokenId);
+        try {
+            StpUtil.kickoutByTokenValue(tokenId);
+        } catch (NotLoginException e) {
+        }
        return AjaxResult.success();
    }
 }
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysConfigController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysConfigController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.core.controller.BaseController;
@ -15,7 +16,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -40,7 +40,7 @@ public class SysConfigController extends BaseController {
     * 获取参数配置列表
     */
    @ApiOperation("获取参数配置列表")
-    @PreAuthorize("@ss.hasPermi('system:config:list')")
+    @SaCheckPermission("system:config:list")
    @GetMapping("/list")
    public TableDataInfo<SysConfig> list(SysConfig config, PageQuery pageQuery) {
        return configService.selectPageConfigList(config, pageQuery);
@ -48,7 +48,7 @@ public class SysConfigController extends BaseController {

    @ApiOperation("导出参数配置列表")
    @Log(title = "参数管理", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:config:export')")
+    @SaCheckPermission("system:config:export")
    @PostMapping("/export")
    public void export(SysConfig config, HttpServletResponse response) {
        List<SysConfig> list = configService.selectConfigList(config);
@ -59,7 +59,7 @@ public class SysConfigController extends BaseController {
     * 根据参数编号获取详细信息
     */
    @ApiOperation("根据参数编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:config:query')")
+    @SaCheckPermission("system:config:query")
    @GetMapping(value = "/{configId}")
    public AjaxResult<SysConfig> getInfo(@ApiParam("参数ID") @PathVariable Long configId) {
        return AjaxResult.success(configService.selectConfigById(configId));
@ -78,7 +78,7 @@ public class SysConfigController extends BaseController {
     * 新增参数配置
     */
    @ApiOperation("新增参数配置")
-    @PreAuthorize("@ss.hasPermi('system:config:add')")
+    @SaCheckPermission("system:config:add")
    @Log(title = "参数管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysConfig config) {
@ -92,7 +92,7 @@ public class SysConfigController extends BaseController {
     * 修改参数配置
     */
    @ApiOperation("修改参数配置")
-    @PreAuthorize("@ss.hasPermi('system:config:edit')")
+    @SaCheckPermission("system:config:edit")
    @Log(title = "参数管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysConfig config) {
@ -106,7 +106,7 @@ public class SysConfigController extends BaseController {
     * 删除参数配置
     */
    @ApiOperation("删除参数配置")
-    @PreAuthorize("@ss.hasPermi('system:config:remove')")
+    @SaCheckPermission("system:config:remove")
    @Log(title = "参数管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{configIds}")
    public AjaxResult<Void> remove(@ApiParam("参数ID串") @PathVariable Long[] configIds) {
@ -118,7 +118,7 @@ public class SysConfigController extends BaseController {
     * 刷新参数缓存
     */
    @ApiOperation("刷新参数缓存")
-    @PreAuthorize("@ss.hasPermi('system:config:remove')")
+    @SaCheckPermission("system:config:remove")
    @Log(title = "参数管理", businessType = BusinessType.CLEAN)
    @DeleteMapping("/refreshCache")
    public AjaxResult<Void> refreshCache() {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDeptController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDeptController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.lang.tree.Tree;
 import cn.hutool.core.util.ArrayUtil;
 import com.ruoyi.common.annotation.Log;
@ -15,7 +16,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -41,7 +41,7 @@ public class SysDeptController extends BaseController {
     * 获取部门列表
     */
    @ApiOperation("获取部门列表")
-    @PreAuthorize("@ss.hasPermi('system:dept:list')")
+    @SaCheckPermission("system:dept:list")
    @GetMapping("/list")
    public AjaxResult<List<SysDept>> list(SysDept dept) {
        List<SysDept> depts = deptService.selectDeptList(dept);
@ -52,7 +52,7 @@ public class SysDeptController extends BaseController {
     * 查询部门列表（排除节点）
     */
    @ApiOperation("查询部门列表（排除节点）")
-    @PreAuthorize("@ss.hasPermi('system:dept:list')")
+    @SaCheckPermission("system:dept:list")
    @GetMapping("/list/exclude/{deptId}")
    public AjaxResult<List<SysDept>> excludeChild(@ApiParam("部门ID") @PathVariable(value = "deptId", required = false) Long deptId) {
        List<SysDept> depts = deptService.selectDeptList(new SysDept());
@ -65,7 +65,7 @@ public class SysDeptController extends BaseController {
     * 根据部门编号获取详细信息
     */
    @ApiOperation("根据部门编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:dept:query')")
+    @SaCheckPermission("system:dept:query")
    @GetMapping(value = "/{deptId}")
    public AjaxResult<SysDept> getInfo(@ApiParam("部门ID") @PathVariable Long deptId) {
        deptService.checkDeptDataScope(deptId);
@ -99,7 +99,7 @@ public class SysDeptController extends BaseController {
     * 新增部门
     */
    @ApiOperation("新增部门")
-    @PreAuthorize("@ss.hasPermi('system:dept:add')")
+    @SaCheckPermission("system:dept:add")
    @Log(title = "部门管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysDept dept) {
@ -113,7 +113,7 @@ public class SysDeptController extends BaseController {
     * 修改部门
     */
    @ApiOperation("修改部门")
-    @PreAuthorize("@ss.hasPermi('system:dept:edit')")
+    @SaCheckPermission("system:dept:edit")
    @Log(title = "部门管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysDept dept) {
@ -132,7 +132,7 @@ public class SysDeptController extends BaseController {
     * 删除部门
     */
    @ApiOperation("删除部门")
-    @PreAuthorize("@ss.hasPermi('system:dept:remove')")
+    @SaCheckPermission("system:dept:remove")
    @Log(title = "部门管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{deptId}")
    public AjaxResult<Void> remove(@ApiParam("部门ID串") @PathVariable Long deptId) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDictDataController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDictDataController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
@ -16,7 +17,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -40,7 +40,7 @@ public class SysDictDataController extends BaseController {
    private final ISysDictTypeService dictTypeService;

    @ApiOperation("查询字典数据列表")
-    @PreAuthorize("@ss.hasPermi('system:dict:list')")
+    @SaCheckPermission("system:dict:list")
    @GetMapping("/list")
    public TableDataInfo<SysDictData> list(SysDictData dictData, PageQuery pageQuery) {
        return dictDataService.selectPageDictDataList(dictData, pageQuery);
@ -48,7 +48,7 @@ public class SysDictDataController extends BaseController {

    @ApiOperation("导出字典数据列表")
    @Log(title = "字典数据", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:dict:export')")
+    @SaCheckPermission("system:dict:export")
    @PostMapping("/export")
    public void export(SysDictData dictData, HttpServletResponse response) {
        List<SysDictData> list = dictDataService.selectDictDataList(dictData);
@ -59,7 +59,7 @@ public class SysDictDataController extends BaseController {
     * 查询字典数据详细
     */
    @ApiOperation("查询字典数据详细")
-    @PreAuthorize("@ss.hasPermi('system:dict:query')")
+    @SaCheckPermission("system:dict:query")
    @GetMapping(value = "/{dictCode}")
    public AjaxResult<SysDictData> getInfo(@ApiParam("字典code") @PathVariable Long dictCode) {
        return AjaxResult.success(dictDataService.selectDictDataById(dictCode));
@ -82,7 +82,7 @@ public class SysDictDataController extends BaseController {
     * 新增字典类型
     */
    @ApiOperation("新增字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:add')")
+    @SaCheckPermission("system:dict:add")
    @Log(title = "字典数据", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysDictData dict) {
@ -93,7 +93,7 @@ public class SysDictDataController extends BaseController {
     * 修改保存字典类型
     */
    @ApiOperation("修改保存字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:edit')")
+    @SaCheckPermission("system:dict:edit")
    @Log(title = "字典数据", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysDictData dict) {
@ -104,7 +104,7 @@ public class SysDictDataController extends BaseController {
     * 删除字典类型
     */
    @ApiOperation("删除字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:remove')")
+    @SaCheckPermission("system:dict:remove")
    @Log(title = "字典类型", businessType = BusinessType.DELETE)
    @DeleteMapping("/{dictCodes}")
    public AjaxResult<Void> remove(@ApiParam("字典code串") @PathVariable Long[] dictCodes) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDictTypeController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysDictTypeController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.core.controller.BaseController;
@ -15,7 +16,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -37,7 +37,7 @@ public class SysDictTypeController extends BaseController {
    private final ISysDictTypeService dictTypeService;

    @ApiOperation("查询字典类型列表")
-    @PreAuthorize("@ss.hasPermi('system:dict:list')")
+    @SaCheckPermission("system:dict:list")
    @GetMapping("/list")
    public TableDataInfo<SysDictType> list(SysDictType dictType, PageQuery pageQuery) {
        return dictTypeService.selectPageDictTypeList(dictType, pageQuery);
@ -45,7 +45,7 @@ public class SysDictTypeController extends BaseController {

    @ApiOperation("导出字典类型列表")
    @Log(title = "字典类型", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:dict:export')")
+    @SaCheckPermission("system:dict:export")
    @PostMapping("/export")
    public void export(SysDictType dictType, HttpServletResponse response) {
        List<SysDictType> list = dictTypeService.selectDictTypeList(dictType);
@ -56,7 +56,7 @@ public class SysDictTypeController extends BaseController {
     * 查询字典类型详细
     */
    @ApiOperation("查询字典类型详细")
-    @PreAuthorize("@ss.hasPermi('system:dict:query')")
+    @SaCheckPermission("system:dict:query")
    @GetMapping(value = "/{dictId}")
    public AjaxResult<SysDictType> getInfo(@ApiParam("字典ID") @PathVariable Long dictId) {
        return AjaxResult.success(dictTypeService.selectDictTypeById(dictId));
@ -66,7 +66,7 @@ public class SysDictTypeController extends BaseController {
     * 新增字典类型
     */
    @ApiOperation("新增字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:add')")
+    @SaCheckPermission("system:dict:add")
    @Log(title = "字典类型", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysDictType dict) {
@ -80,7 +80,7 @@ public class SysDictTypeController extends BaseController {
     * 修改字典类型
     */
    @ApiOperation("修改字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:edit')")
+    @SaCheckPermission("system:dict:edit")
    @Log(title = "字典类型", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysDictType dict) {
@ -94,7 +94,7 @@ public class SysDictTypeController extends BaseController {
     * 删除字典类型
     */
    @ApiOperation("删除字典类型")
-    @PreAuthorize("@ss.hasPermi('system:dict:remove')")
+    @SaCheckPermission("system:dict:remove")
    @Log(title = "字典类型", businessType = BusinessType.DELETE)
    @DeleteMapping("/{dictIds}")
    public AjaxResult<Void> remove(@ApiParam("字典ID串") @PathVariable Long[] dictIds) {
@ -106,7 +106,7 @@ public class SysDictTypeController extends BaseController {
     * 刷新字典缓存
     */
    @ApiOperation("刷新字典缓存")
-    @PreAuthorize("@ss.hasPermi('system:dict:remove')")
+    @SaCheckPermission("system:dict:remove")
    @Log(title = "字典类型", businessType = BusinessType.CLEAN)
    @DeleteMapping("/refreshCache")
    public AjaxResult<Void> refreshCache() {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysLoginController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysLoginController.java
@ -1,14 +1,17 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.exception.NotLoginException;
+import cn.dev33.satoken.stp.StpUtil;
 import com.ruoyi.common.constant.Constants;
 import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.core.domain.entity.SysMenu;
 import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.common.core.domain.model.LoginBody;
-import com.ruoyi.common.utils.SecurityUtils;
+import com.ruoyi.common.core.service.UserService;
+import com.ruoyi.common.utils.LoginUtils;
+import com.ruoyi.common.utils.spring.SpringUtils;
 import com.ruoyi.system.domain.vo.RouterVo;
 import com.ruoyi.system.service.ISysMenuService;
-import com.ruoyi.system.service.ISysUserService;
 import com.ruoyi.system.service.SysLoginService;
 import com.ruoyi.system.service.SysPermissionService;
 import io.swagger.annotations.Api;
@ -39,7 +42,6 @@ public class SysLoginController {

    private final SysLoginService loginService;
    private final ISysMenuService menuService;
-    private final ISysUserService userService;
    private final SysPermissionService permissionService;

    /**
@ -59,6 +61,16 @@ public class SysLoginController {
        return AjaxResult.success(ajax);
    }

+    @ApiOperation("登出方法")
+    @PostMapping("/logout")
+    public AjaxResult<Void> logout(){
+        try {
+            StpUtil.logout();
+        } catch (NotLoginException e) {
+        }
+        return AjaxResult.success("退出成功");
+    }
+
    /**
     * 获取用户信息
     *
@ -67,7 +79,7 @@ public class SysLoginController {
    @ApiOperation("获取用户信息")
    @GetMapping("getInfo")
    public AjaxResult<Map<String, Object>> getInfo() {
-        SysUser user = userService.selectUserById(SecurityUtils.getUserId());
+        SysUser user = SpringUtils.getBean(UserService.class).selectUserById(LoginUtils.getUserId());
        // 角色集合
        Set<String> roles = permissionService.getRolePermission(user);
        // 权限集合
@ -87,7 +99,7 @@ public class SysLoginController {
    @ApiOperation("获取路由信息")
    @GetMapping("getRouters")
    public AjaxResult<List<RouterVo>> getRouters() {
-        Long userId = SecurityUtils.getUserId();
+        Long userId = LoginUtils.getUserId();
        List<SysMenu> menus = menuService.selectMenuTreeByUserId(userId);
        return AjaxResult.success(menuService.buildMenus(menus));
    }
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysMenuController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysMenuController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.lang.tree.Tree;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.UserConstants;
@ -14,7 +15,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -40,7 +40,7 @@ public class SysMenuController extends BaseController {
     * 获取菜单列表
     */
    @ApiOperation("获取菜单列表")
-    @PreAuthorize("@ss.hasPermi('system:menu:list')")
+    @SaCheckPermission("system:menu:list")
    @GetMapping("/list")
    public AjaxResult<List<SysMenu>> list(SysMenu menu) {
        List<SysMenu> menus = menuService.selectMenuList(menu, getUserId());
@ -51,7 +51,7 @@ public class SysMenuController extends BaseController {
     * 根据菜单编号获取详细信息
     */
    @ApiOperation("根据菜单编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:menu:query')")
+    @SaCheckPermission("system:menu:query")
    @GetMapping(value = "/{menuId}")
    public AjaxResult<SysMenu> getInfo(@ApiParam("菜单ID") @PathVariable Long menuId) {
        return AjaxResult.success(menuService.selectMenuById(menuId));
@ -84,7 +84,7 @@ public class SysMenuController extends BaseController {
     * 新增菜单
     */
    @ApiOperation("新增菜单")
-    @PreAuthorize("@ss.hasPermi('system:menu:add')")
+    @SaCheckPermission("system:menu:add")
    @Log(title = "菜单管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysMenu menu) {
@ -100,7 +100,7 @@ public class SysMenuController extends BaseController {
     * 修改菜单
     */
    @ApiOperation("修改菜单")
-    @PreAuthorize("@ss.hasPermi('system:menu:edit')")
+    @SaCheckPermission("system:menu:edit")
    @Log(title = "菜单管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysMenu menu) {
@ -118,7 +118,7 @@ public class SysMenuController extends BaseController {
     * 删除菜单
     */
    @ApiOperation("删除菜单")
-    @PreAuthorize("@ss.hasPermi('system:menu:remove')")
+    @SaCheckPermission("system:menu:remove")
    @Log(title = "菜单管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{menuId}")
    public AjaxResult<Void> remove(@ApiParam("菜单ID") @PathVariable("menuId") Long menuId) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysNoticeController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysNoticeController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
@ -8,14 +9,13 @@ import com.ruoyi.common.core.page.TableDataInfo;
 import com.ruoyi.common.enums.BusinessType;
 import com.ruoyi.system.domain.SysNotice;
 import com.ruoyi.system.service.ISysNoticeService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.*;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.validation.annotation.Validated;
-import org.springframework.web.bind.annotation.*;

 /**
 * 公告 信息操作处理
@ -35,7 +35,7 @@ public class SysNoticeController extends BaseController {
     * 获取通知公告列表
     */
    @ApiOperation("获取通知公告列表")
-    @PreAuthorize("@ss.hasPermi('system:notice:list')")
+    @SaCheckPermission("system:notice:list")
    @GetMapping("/list")
    public TableDataInfo<SysNotice> list(SysNotice notice, PageQuery pageQuery) {
        return noticeService.selectPageNoticeList(notice, pageQuery);
@ -45,7 +45,7 @@ public class SysNoticeController extends BaseController {
     * 根据通知公告编号获取详细信息
     */
    @ApiOperation("根据通知公告编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:notice:query')")
+    @SaCheckPermission("system:notice:query")
    @GetMapping(value = "/{noticeId}")
    public AjaxResult<SysNotice> getInfo(@ApiParam("公告ID") @PathVariable Long noticeId) {
        return AjaxResult.success(noticeService.selectNoticeById(noticeId));
@ -55,7 +55,7 @@ public class SysNoticeController extends BaseController {
     * 新增通知公告
     */
    @ApiOperation("新增通知公告")
-    @PreAuthorize("@ss.hasPermi('system:notice:add')")
+    @SaCheckPermission("system:notice:add")
    @Log(title = "通知公告", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysNotice notice) {
@ -66,7 +66,7 @@ public class SysNoticeController extends BaseController {
     * 修改通知公告
     */
    @ApiOperation("修改通知公告")
-    @PreAuthorize("@ss.hasPermi('system:notice:edit')")
+    @SaCheckPermission("system:notice:edit")
    @Log(title = "通知公告", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysNotice notice) {
@ -77,7 +77,7 @@ public class SysNoticeController extends BaseController {
     * 删除通知公告
     */
    @ApiOperation("删除通知公告")
-    @PreAuthorize("@ss.hasPermi('system:notice:remove')")
+    @SaCheckPermission("system:notice:remove")
    @Log(title = "通知公告", businessType = BusinessType.DELETE)
    @DeleteMapping("/{noticeIds}")
    public AjaxResult<Void> remove(@ApiParam("公告ID串") @PathVariable Long[] noticeIds) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysOssConfigController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysOssConfigController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.annotation.RepeatSubmit;
 import com.ruoyi.common.core.controller.BaseController;
@ -18,7 +19,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -46,7 +46,7 @@ public class SysOssConfigController extends BaseController {
     * 查询对象存储配置列表
     */
    @ApiOperation("查询对象存储配置列表")
-    @PreAuthorize("@ss.hasPermi('system:oss:list')")
+    @SaCheckPermission("system:oss:list")
    @GetMapping("/list")
    public TableDataInfo<SysOssConfigVo> list(@Validated(QueryGroup.class) SysOssConfigBo bo, PageQuery pageQuery) {
        return iSysOssConfigService.queryPageList(bo, pageQuery);
@ -56,7 +56,7 @@ public class SysOssConfigController extends BaseController {
     * 获取对象存储配置详细信息
     */
    @ApiOperation("获取对象存储配置详细信息")
-    @PreAuthorize("@ss.hasPermi('system:oss:query')")
+    @SaCheckPermission("system:oss:query")
    @GetMapping("/{ossConfigId}")
    public AjaxResult<SysOssConfigVo> getInfo(@ApiParam("OSS配置ID")
                                              @NotNull(message = "主键不能为空")
@ -68,7 +68,7 @@ public class SysOssConfigController extends BaseController {
     * 新增对象存储配置
     */
    @ApiOperation("新增对象存储配置")
-    @PreAuthorize("@ss.hasPermi('system:oss:add')")
+    @SaCheckPermission("system:oss:add")
    @Log(title = "对象存储配置", businessType = BusinessType.INSERT)
    @RepeatSubmit()
    @PostMapping()
@ -80,7 +80,7 @@ public class SysOssConfigController extends BaseController {
     * 修改对象存储配置
     */
    @ApiOperation("修改对象存储配置")
-    @PreAuthorize("@ss.hasPermi('system:oss:edit')")
+    @SaCheckPermission("system:oss:edit")
    @Log(title = "对象存储配置", businessType = BusinessType.UPDATE)
    @RepeatSubmit()
    @PutMapping()
@ -92,7 +92,7 @@ public class SysOssConfigController extends BaseController {
     * 删除对象存储配置
     */
    @ApiOperation("删除对象存储配置")
-    @PreAuthorize("@ss.hasPermi('system:oss:remove')")
+    @SaCheckPermission("system:oss:remove")
    @Log(title = "对象存储配置", businessType = BusinessType.DELETE)
    @DeleteMapping("/{ossConfigIds}")
    public AjaxResult<Void> remove(@ApiParam("OSS配置ID串")
@ -105,7 +105,7 @@ public class SysOssConfigController extends BaseController {
     * 状态修改
     */
    @ApiOperation("状态修改")
-    @PreAuthorize("@ss.hasPermi('system:oss:edit')")
+    @SaCheckPermission("system:oss:edit")
    @Log(title = "对象存储状态修改", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult<Void> changeStatus(@RequestBody SysOssConfigBo bo) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysOssController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysOssController.java
@ -1,6 +1,7 @@
 package com.ruoyi.web.controller.system;


+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.convert.Convert;
 import cn.hutool.core.util.ObjectUtil;
 import cn.hutool.http.HttpException;
@ -27,7 +28,6 @@ import io.swagger.annotations.*;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
@ -59,7 +59,7 @@ public class SysOssController extends BaseController {
     * 查询OSS对象存储列表
     */
    @ApiOperation("查询OSS对象存储列表")
-    @PreAuthorize("@ss.hasPermi('system:oss:list')")
+    @SaCheckPermission("system:oss:list")
    @GetMapping("/list")
    public TableDataInfo<SysOssVo> list(@Validated(QueryGroup.class) SysOssBo bo, PageQuery pageQuery) {
        return iSysOssService.queryPageList(bo, pageQuery);
@ -72,7 +72,7 @@ public class SysOssController extends BaseController {
    @ApiImplicitParams({
        @ApiImplicitParam(name = "file", value = "文件", dataTypeClass = File.class, required = true),
    })
-    @PreAuthorize("@ss.hasPermi('system:oss:upload')")
+    @SaCheckPermission("system:oss:upload")
    @Log(title = "OSS对象存储", businessType = BusinessType.INSERT)
    @RepeatSubmit
    @PostMapping("/upload")
@ -88,7 +88,7 @@ public class SysOssController extends BaseController {
    }

    @ApiOperation("下载OSS对象存储")
-    @PreAuthorize("@ss.hasPermi('system:oss:download')")
+    @SaCheckPermission("system:oss:download")
    @GetMapping("/download/{ossId}")
    public void download(@ApiParam("OSS对象ID") @PathVariable Long ossId, HttpServletResponse response) throws IOException {
        SysOss sysOss = iSysOssService.getById(ossId);
@ -115,7 +115,7 @@ public class SysOssController extends BaseController {
     * 删除OSS对象存储
     */
    @ApiOperation("删除OSS对象存储")
-    @PreAuthorize("@ss.hasPermi('system:oss:remove')")
+    @SaCheckPermission("system:oss:remove")
    @Log(title = "OSS对象存储", businessType = BusinessType.DELETE)
    @DeleteMapping("/{ossIds}")
    public AjaxResult<Void> remove(@ApiParam("OSS对象ID串")
@ -128,7 +128,7 @@ public class SysOssController extends BaseController {
     * 变更图片列表预览状态
     */
    @ApiOperation("变更图片列表预览状态")
-    @PreAuthorize("@ss.hasPermi('system:oss:edit')")
+    @SaCheckPermission("system:oss:edit")
    @Log(title = "OSS对象存储", businessType = BusinessType.UPDATE)
    @PutMapping("/changePreviewListResource")
    public AjaxResult<Void> changePreviewListResource(@RequestBody String body) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysPostController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysPostController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.core.controller.BaseController;
@ -15,7 +16,6 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -40,7 +40,7 @@ public class SysPostController extends BaseController {
     * 获取岗位列表
     */
    @ApiOperation("获取岗位列表")
-    @PreAuthorize("@ss.hasPermi('system:post:list')")
+    @SaCheckPermission("system:post:list")
    @GetMapping("/list")
    public TableDataInfo<SysPost> list(SysPost post, PageQuery pageQuery) {
        return postService.selectPagePostList(post, pageQuery);
@ -48,7 +48,7 @@ public class SysPostController extends BaseController {

    @ApiOperation("导出岗位列表")
    @Log(title = "岗位管理", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:post:export')")
+    @SaCheckPermission("system:post:export")
    @PostMapping("/export")
    public void export(SysPost post, HttpServletResponse response) {
        List<SysPost> list = postService.selectPostList(post);
@ -59,7 +59,7 @@ public class SysPostController extends BaseController {
     * 根据岗位编号获取详细信息
     */
    @ApiOperation("根据岗位编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:post:query')")
+    @SaCheckPermission("system:post:query")
    @GetMapping(value = "/{postId}")
    public AjaxResult<SysPost> getInfo(@ApiParam("岗位ID") @PathVariable Long postId) {
        return AjaxResult.success(postService.selectPostById(postId));
@ -69,7 +69,7 @@ public class SysPostController extends BaseController {
     * 新增岗位
     */
    @ApiOperation("新增岗位")
-    @PreAuthorize("@ss.hasPermi('system:post:add')")
+    @SaCheckPermission("system:post:add")
    @Log(title = "岗位管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysPost post) {
@ -85,7 +85,7 @@ public class SysPostController extends BaseController {
     * 修改岗位
     */
    @ApiOperation("修改岗位")
-    @PreAuthorize("@ss.hasPermi('system:post:edit')")
+    @SaCheckPermission("system:post:edit")
    @Log(title = "岗位管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysPost post) {
@ -101,7 +101,7 @@ public class SysPostController extends BaseController {
     * 删除岗位
     */
    @ApiOperation("删除岗位")
-    @PreAuthorize("@ss.hasPermi('system:post:remove')")
+    @SaCheckPermission("system:post:remove")
    @Log(title = "岗位管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{postIds}")
    public AjaxResult<Void> remove(@ApiParam("岗位ID串") @PathVariable Long[] postIds) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysProfileController.java
@ -5,10 +5,12 @@ import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.AjaxResult;
 import com.ruoyi.common.core.domain.entity.SysUser;
-import com.ruoyi.common.core.domain.model.LoginUser;
+import com.ruoyi.common.core.service.UserService;
 import com.ruoyi.common.enums.BusinessType;
+import com.ruoyi.common.utils.LoginUtils;
 import com.ruoyi.common.utils.SecurityUtils;
 import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.common.utils.spring.SpringUtils;
 import com.ruoyi.system.domain.SysOss;
 import com.ruoyi.system.service.ISysOssService;
 import com.ruoyi.system.service.ISysUserService;
@ -47,12 +49,11 @@ public class SysProfileController extends BaseController {
    @ApiOperation("个人信息")
    @GetMapping
    public AjaxResult<Map<String, Object>> profile() {
-        LoginUser loginUser = getLoginUser();
-        SysUser user = userService.selectUserById(loginUser.getUserId());
-        Map<String, Object> ajax = new HashMap<>();
-        ajax.put("user", user);
-        ajax.put("roleGroup", userService.selectUserRoleGroup(loginUser.getUsername()));
-        ajax.put("postGroup", userService.selectUserPostGroup(loginUser.getUsername()));
+        SysUser user = userService.getById(getUserId());
+		Map<String, Object> ajax = new HashMap<>();
+		ajax.put("user", user);
+        ajax.put("roleGroup", userService.selectUserRoleGroup(user.getUserName()));
+        ajax.put("postGroup", userService.selectUserPostGroup(user.getUserName()));
        return AjaxResult.success(ajax);
    }

@ -71,9 +72,7 @@ public class SysProfileController extends BaseController {
                && UserConstants.NOT_UNIQUE.equals(userService.checkEmailUnique(user))) {
            return AjaxResult.error("修改用户'" + user.getUserName() + "'失败，邮箱账号已存在");
        }
-        LoginUser loginUser = getLoginUser();
-        SysUser sysUser = userService.selectUserById(loginUser.getUserId());
-        user.setUserId(sysUser.getUserId());
+        user.setUserId(getUserId());
        user.setUserName(null);
        user.setPassword(null);
        if (userService.updateUserProfile(user) > 0) {
@ -93,7 +92,7 @@ public class SysProfileController extends BaseController {
    @Log(title = "个人信息", businessType = BusinessType.UPDATE)
    @PutMapping("/updatePwd")
    public AjaxResult<Void> updatePwd(String oldPassword, String newPassword) {
-        SysUser user = userService.selectUserById(SecurityUtils.getUserId());
+        SysUser user = SpringUtils.getBean(UserService.class).selectUserById(LoginUtils.getUserId());
        String userName = user.getUserName();
        String password = user.getPassword();
        if (!SecurityUtils.matchesPassword(oldPassword, password)) {
@ -118,12 +117,11 @@ public class SysProfileController extends BaseController {
    @Log(title = "用户头像", businessType = BusinessType.UPDATE)
    @PostMapping("/avatar")
    public AjaxResult<Map<String, Object>> avatar(@RequestPart("avatarfile") MultipartFile file) {
-        Map<String, Object> ajax = new HashMap<>();
+        Map<String,Object> ajax = new HashMap<>();
        if (!file.isEmpty()) {
-            LoginUser loginUser = getLoginUser();
-            SysOss oss = iSysOssService.upload(file);
-            String avatar = oss.getUrl();
-            if (userService.updateUserAvatar(loginUser.getUsername(), avatar)) {
+			SysOss oss = iSysOssService.upload(file);
+			String avatar = oss.getUrl();
+            if (userService.updateUserAvatar(getUsername(), avatar)) {
                ajax.put("imgUrl", avatar);
                return AjaxResult.success(ajax);
            }
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysRoleController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysRoleController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import com.ruoyi.common.annotation.Log;
 import com.ruoyi.common.constant.UserConstants;
 import com.ruoyi.common.core.controller.BaseController;
@ -9,8 +10,8 @@ import com.ruoyi.common.core.domain.entity.SysRole;
 import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.common.core.domain.model.LoginUser;
 import com.ruoyi.common.core.page.TableDataInfo;
-import com.ruoyi.common.core.service.TokenService;
 import com.ruoyi.common.enums.BusinessType;
+import com.ruoyi.common.utils.LoginUtils;
 import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.common.utils.poi.ExcelUtil;
 import com.ruoyi.system.domain.SysUserRole;
@ -20,7 +21,6 @@ import com.ruoyi.system.service.SysPermissionService;
 import io.swagger.annotations.*;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

@ -40,12 +40,11 @@ import java.util.List;
 public class SysRoleController extends BaseController {

    private final ISysRoleService roleService;
-    private final TokenService tokenService;
    private final ISysUserService userService;
    private final SysPermissionService permissionService;

    @ApiOperation("查询角色信息列表")
-    @PreAuthorize("@ss.hasPermi('system:role:list')")
+    @SaCheckPermission("system:role:list")
    @GetMapping("/list")
    public TableDataInfo<SysRole> list(SysRole role, PageQuery pageQuery) {
        return roleService.selectPageRoleList(role, pageQuery);
@ -53,7 +52,7 @@ public class SysRoleController extends BaseController {

    @ApiOperation("导出角色信息列表")
    @Log(title = "角色管理", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:role:export')")
+    @SaCheckPermission("system:role:export")
    @PostMapping("/export")
    public void export(SysRole role, HttpServletResponse response) {
        List<SysRole> list = roleService.selectRoleList(role);
@ -64,7 +63,7 @@ public class SysRoleController extends BaseController {
     * 根据角色编号获取详细信息
     */
    @ApiOperation("根据角色编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:role:query')")
+    @SaCheckPermission("system:role:query")
    @GetMapping(value = "/{roleId}")
    public AjaxResult<SysRole> getInfo(@ApiParam("角色ID") @PathVariable Long roleId) {
        roleService.checkRoleDataScope(roleId);
@ -75,7 +74,7 @@ public class SysRoleController extends BaseController {
     * 新增角色
     */
    @ApiOperation("新增角色")
-    @PreAuthorize("@ss.hasPermi('system:role:add')")
+    @SaCheckPermission("system:role:add")
    @Log(title = "角色管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysRole role) {
@ -92,7 +91,7 @@ public class SysRoleController extends BaseController {
     * 修改保存角色
     */
    @ApiOperation("修改保存角色")
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysRole role) {
@ -108,8 +107,8 @@ public class SysRoleController extends BaseController {
            LoginUser loginUser = getLoginUser();
            SysUser sysUser = userService.selectUserById(loginUser.getUserId());
            if (StringUtils.isNotNull(sysUser) && !sysUser.isAdmin()) {
-                loginUser.setMenuPermissions(permissionService.getMenuPermission(sysUser));
-                tokenService.setLoginUser(loginUser);
+                loginUser.setMenuPermission(permissionService.getMenuPermission(sysUser));
+                LoginUtils.setLoginUser(loginUser);
            }
            return AjaxResult.success();
        }
@ -120,7 +119,7 @@ public class SysRoleController extends BaseController {
     * 修改保存数据权限
     */
    @ApiOperation("修改保存数据权限")
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.UPDATE)
    @PutMapping("/dataScope")
    public AjaxResult<Void> dataScope(@RequestBody SysRole role) {
@ -132,7 +131,7 @@ public class SysRoleController extends BaseController {
     * 状态修改
     */
    @ApiOperation("状态修改")
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult<Void> changeStatus(@RequestBody SysRole role) {
@ -144,7 +143,7 @@ public class SysRoleController extends BaseController {
     * 删除角色
     */
    @ApiOperation("删除角色")
-    @PreAuthorize("@ss.hasPermi('system:role:remove')")
+    @SaCheckPermission("system:role:remove")
    @Log(title = "角色管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{roleIds}")
    public AjaxResult<Void> remove(@ApiParam("岗位ID串") @PathVariable Long[] roleIds) {
@ -155,7 +154,7 @@ public class SysRoleController extends BaseController {
     * 获取角色选择框列表
     */
    @ApiOperation("获取角色选择框列表")
-    @PreAuthorize("@ss.hasPermi('system:role:query')")
+    @SaCheckPermission("system:role:query")
    @GetMapping("/optionselect")
    public AjaxResult<List<SysRole>> optionselect() {
        return AjaxResult.success(roleService.selectRoleAll());
@ -165,7 +164,7 @@ public class SysRoleController extends BaseController {
     * 查询已分配用户角色列表
     */
    @ApiOperation("查询已分配用户角色列表")
-    @PreAuthorize("@ss.hasPermi('system:role:list')")
+    @SaCheckPermission("system:role:list")
    @GetMapping("/authUser/allocatedList")
    public TableDataInfo<SysUser> allocatedList(SysUser user, PageQuery pageQuery) {
        return userService.selectAllocatedList(user, pageQuery);
@ -175,7 +174,7 @@ public class SysRoleController extends BaseController {
     * 查询未分配用户角色列表
     */
    @ApiOperation("查询未分配用户角色列表")
-    @PreAuthorize("@ss.hasPermi('system:role:list')")
+    @SaCheckPermission("system:role:list")
    @GetMapping("/authUser/unallocatedList")
    public TableDataInfo<SysUser> unallocatedList(SysUser user, PageQuery pageQuery) {
        return userService.selectUnallocatedList(user, pageQuery);
@ -185,7 +184,7 @@ public class SysRoleController extends BaseController {
     * 取消授权用户
     */
    @ApiOperation("取消授权用户")
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.GRANT)
    @PutMapping("/authUser/cancel")
    public AjaxResult<Void> cancelAuthUser(@RequestBody SysUserRole userRole) {
@ -200,7 +199,7 @@ public class SysRoleController extends BaseController {
        @ApiImplicitParam(name = "roleId", value = "角色ID", paramType = "query", dataTypeClass = String.class),
        @ApiImplicitParam(name = "userIds", value = "用户ID串", paramType = "query", dataTypeClass = String.class)
    })
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.GRANT)
    @PutMapping("/authUser/cancelAll")
    public AjaxResult<Void> cancelAuthUserAll(Long roleId, Long[] userIds) {
@ -215,7 +214,7 @@ public class SysRoleController extends BaseController {
        @ApiImplicitParam(name = "roleId", value = "角色ID", paramType = "query", dataTypeClass = String.class),
        @ApiImplicitParam(name = "userIds", value = "用户ID串", paramType = "query", dataTypeClass = String.class)
    })
-    @PreAuthorize("@ss.hasPermi('system:role:edit')")
+    @SaCheckPermission("system:role:edit")
    @Log(title = "角色管理", businessType = BusinessType.GRANT)
    @PutMapping("/authUser/selectAll")
    public AjaxResult<Void> selectAuthUserAll(Long roleId, Long[] userIds) {
--- a/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
+++ b/ruoyi-admin/src/main/java/com/ruoyi/web/controller/system/SysUserController.java
@ -1,5 +1,6 @@
 package com.ruoyi.web.controller.system;

+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.util.ArrayUtil;
 import cn.hutool.core.util.ObjectUtil;
@ -26,7 +27,6 @@ import com.ruoyi.system.service.ISysUserService;
 import io.swagger.annotations.*;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
@ -58,7 +58,7 @@ public class SysUserController extends BaseController {
     * 获取用户列表
     */
    @ApiOperation("获取用户列表")
-    @PreAuthorize("@ss.hasPermi('system:user:list')")
+    @SaCheckPermission("system:user:list")
    @GetMapping("/list")
    public TableDataInfo<SysUser> list(SysUser user, PageQuery pageQuery) {
        return userService.selectPageUserList(user, pageQuery);
@ -66,7 +66,7 @@ public class SysUserController extends BaseController {

    @ApiOperation("导出用户列表")
    @Log(title = "用户管理", businessType = BusinessType.EXPORT)
-    @PreAuthorize("@ss.hasPermi('system:user:export')")
+    @SaCheckPermission("system:user:export")
    @PostMapping("/export")
    public void export(SysUser user, HttpServletResponse response) {
        List<SysUser> list = userService.selectUserList(user);
@ -87,7 +87,7 @@ public class SysUserController extends BaseController {
            @ApiImplicitParam(name = "file", value = "导入文件", dataType = "java.io.File", required = true),
    })
    @Log(title = "用户管理", businessType = BusinessType.IMPORT)
-    @PreAuthorize("@ss.hasPermi('system:user:import')")
+    @SaCheckPermission("system:user:import")
    @PostMapping("/importData")
    public AjaxResult<Void> importData(@RequestPart("file") MultipartFile file, boolean updateSupport) throws Exception {
        ExcelResult<SysUserImportVo> result = ExcelUtil.importExcel(file.getInputStream(), SysUserImportVo.class, new SysUserImportListener(updateSupport));
@ -104,10 +104,10 @@ public class SysUserController extends BaseController {
     * 根据用户编号获取详细信息
     */
    @ApiOperation("根据用户编号获取详细信息")
-    @PreAuthorize("@ss.hasPermi('system:user:query')")
-    @GetMapping(value = {"/", "/{userId}"})
+    @SaCheckPermission("system:user:query")
+    @GetMapping(value = {"/", "/{userId}" })
    public AjaxResult<Map<String, Object>> getInfo(@ApiParam("用户ID") @PathVariable(value = "userId", required = false) Long userId) {
-        userService.checkUserDataScope(userId);
+		userService.checkUserDataScope(userId);
        Map<String, Object> ajax = new HashMap<>();
        List<SysRole> roles = roleService.selectRoleAll();
        ajax.put("roles", SysUser.isAdmin(userId) ? roles : roles.stream().filter(r -> !r.isAdmin()).collect(Collectors.toList()));
@ -125,7 +125,7 @@ public class SysUserController extends BaseController {
     * 新增用户
     */
    @ApiOperation("新增用户")
-    @PreAuthorize("@ss.hasPermi('system:user:add')")
+    @SaCheckPermission("system:user:add")
    @Log(title = "用户管理", businessType = BusinessType.INSERT)
    @PostMapping
    public AjaxResult<Void> add(@Validated @RequestBody SysUser user) {
@ -146,7 +146,7 @@ public class SysUserController extends BaseController {
     * 修改用户
     */
    @ApiOperation("修改用户")
-    @PreAuthorize("@ss.hasPermi('system:user:edit')")
+    @SaCheckPermission("system:user:edit")
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping
    public AjaxResult<Void> edit(@Validated @RequestBody SysUser user) {
@ -165,7 +165,7 @@ public class SysUserController extends BaseController {
     * 删除用户
     */
    @ApiOperation("删除用户")
-    @PreAuthorize("@ss.hasPermi('system:user:remove')")
+    @SaCheckPermission("system:user:remove")
    @Log(title = "用户管理", businessType = BusinessType.DELETE)
    @DeleteMapping("/{userIds}")
    public AjaxResult<Void> remove(@ApiParam("角色ID串") @PathVariable Long[] userIds) {
@ -179,7 +179,7 @@ public class SysUserController extends BaseController {
     * 重置密码
     */
    @ApiOperation("重置密码")
-    @PreAuthorize("@ss.hasPermi('system:user:resetPwd')")
+    @SaCheckPermission("system:user:resetPwd")
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/resetPwd")
    public AjaxResult<Void> resetPwd(@RequestBody SysUser user) {
@ -192,7 +192,7 @@ public class SysUserController extends BaseController {
     * 状态修改
     */
    @ApiOperation("状态修改")
-    @PreAuthorize("@ss.hasPermi('system:user:edit')")
+    @SaCheckPermission("system:user:edit")
    @Log(title = "用户管理", businessType = BusinessType.UPDATE)
    @PutMapping("/changeStatus")
    public AjaxResult<Void> changeStatus(@RequestBody SysUser user) {
@ -204,7 +204,7 @@ public class SysUserController extends BaseController {
     * 根据用户编号获取授权角色
     */
    @ApiOperation("根据用户编号获取授权角色")
-    @PreAuthorize("@ss.hasPermi('system:user:query')")
+    @SaCheckPermission("system:user:query")
    @GetMapping("/authRole/{userId}")
    public AjaxResult<Map<String, Object>> authRole(@ApiParam("用户ID") @PathVariable("userId") Long userId) {
        SysUser user = userService.selectUserById(userId);
@ -223,7 +223,7 @@ public class SysUserController extends BaseController {
        @ApiImplicitParam(name = "userId", value = "用户Id", paramType = "query", dataTypeClass = String.class),
        @ApiImplicitParam(name = "roleIds", value = "角色ID串", paramType = "query", dataTypeClass = String.class)
    })
-    @PreAuthorize("@ss.hasPermi('system:user:edit')")
+    @SaCheckPermission("system:user:edit")
    @Log(title = "用户管理", businessType = BusinessType.GRANT)
    @PutMapping("/authRole")
    public AjaxResult<Void> insertAuthRole(Long userId, Long[] roleIds) {
--- a/ruoyi-admin/src/main/resources/application.yml
+++ b/ruoyi-admin/src/main/resources/application.yml
@ -95,24 +95,46 @@ spring:
      # 允许对象忽略json中不存在的属性
      fail_on_unknown_properties: false

-# token配置
-token:
-  # 令牌自定义标识
-  header: Authorization
-  # 令牌密钥
-  secret: abcdefghijklmnopqrstuvwxyz
-  # 令牌有效期（默认30分钟）
-  expireTime: 30
+# Sa-Token配置
+sa-token:
+  # token名称 (同时也是cookie名称)
+  token-name: Authorization
+  # token有效期 设为一天 (必定过期) 单位: 秒
+  timeout: 86400
+  # token临时有效期 (指定时间无操作就过期) 单位: 秒
+  activity-timeout: 1800
+  # 是否允许同一账号并发登录 (为true时允许一起登录, 为false时新登录挤掉旧登录)
+  is-concurrent: true
+  # 在多人登录同一账号时，是否共用一个token (为true时所有登录共用一个token, 为false时每次登录新建一个token)
+  is-share: false
+  # 是否尝试从请求体里读取token
+  is-read-body: false
+  # 是否尝试从header里读取token
+  is-read-head: true
+  # 是否尝试从cookie里读取token
+  is-read-cookie: false
+  # token前缀
+  token-prefix: "Bearer"
+  # token风格
+  token-style: uuid
+  # jwt秘钥
+  jwt-secret-key: abcdefghijklmnopqrstuvwxyz
+  # 是否输出操作日志
+  is-log: true

 # security配置
 security:
-  # 登出路径
-  logout-url: /logout
-  # 匿名路径
-  anonymous:
+  # 排除路径
+  excludes:
    - /login
+    - /logout
    - /register
    - /captchaImage
+    # 静态资源
+    - /*.html
+    - /**/*.html
+    - /**/*.css
+    - /**/*.js
    # swagger 文档配置
    - /doc.html
    - /swagger-resources/**