Merge branch 'lyy_fix_springSecurityWithJwt' of WengPuHong/seecoder-devcloud into master

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -51,6 +51,12 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers("/**/*api-docs*/**").permitAll()
                 .antMatchers("/**/hook").permitAll()
                 .antMatchers("/**/query/**").permitAll()
+
+                .and()
+                .authorizeRequests()
+                //跨域的Options请求进行放行
+                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
+                .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                 // API Test Controller
                 .antMatchers(HttpMethod.GET, "/api/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 .antMatchers(HttpMethod.GET, "/api/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
@@ -105,12 +111,6 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers(HttpMethod.POST, "/api/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
                 .antMatchers(HttpMethod.PUT, "/api/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
                 .antMatchers(HttpMethod.PUT, "/api/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-
-                .and()
-                .authorizeRequests()
-                //跨域的Options请求进行放行
-                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
-                .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                 //其他所有接口都要在登陆认证状态下请求
                 .anyRequest().authenticated();