Merge branch 'lyy_fix_springSecurityWithJwt' of WengPuHong/seecoder-devcloud into master

web/src/main/java/cn/seecoder/web/infrastructure/config/AuthTools.java

@@ -16,6 +16,7 @@ import cn.seecoder.web.model.po.pipeline.PipelinePO;
 import cn.seecoder.web.model.po.pipeline.PipelineRecordPO;
 import cn.seecoder.web.model.po.tree.TreeNodePO;
 import cn.seecoder.web.model.po.user.UserPO;
+import cn.seecoder.web.model.vo.bug_list.BugListUpdateBasicVO;
 import cn.seecoder.web.model.vo.pipeline.PipelineUpdateConfigVO;
 import cn.seecoder.web.model.vo.tree.TreeNodeUpdateBasicVO;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -92,6 +93,7 @@ public class AuthTools {
             log.error("checkProjOwnership " + e.getMessage());
             e.printStackTrace();
         }
+        log.info("Verified ProjectId " + projectId);
         return true;
     }
 
@@ -180,6 +182,14 @@ public class AuthTools {
         return checkProjOwnership(projectId);
     }
 
+    public boolean checkBugOwnershipBody (HttpServletRequest request) throws IOException {
+        ObjectMapper mapper = new ObjectMapper();
+        String requestBody = request.getReader().lines().collect(Collectors.joining(System.lineSeparator()));
+        BugListUpdateBasicVO bugListUpdateBasicVO = mapper.readValue(requestBody, BugListUpdateBasicVO.class);
+        log.info("checkBugOwnershipBody verifying bugId: " + bugListUpdateBasicVO.getId());
+        return checkBugOwnership(bugListUpdateBasicVO.getId());
+    }
+
     public boolean checkBugOwnershipParam (HttpServletRequest request) {
         String bugIdStr = request.getParameter("bugId");
         log.info("checkBugOwnershipParam verifying bugId: " + bugIdStr);

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -68,54 +68,64 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers(HttpMethod.GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
                 .antMatchers(HttpMethod.GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
                 .antMatchers(HttpMethod.GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(HttpMethod.POST, "/test/create").authenticated()
                 // Auto Test Controller
-                .antMatchers("/auto_test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/auto_test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 // Bug List Controller
-                .antMatchers("/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/bug_list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/bug_list").authenticated()
+                .antMatchers(HttpMethod.PUT, "/bug_list").access("@authTools.checkBugOwnershipBody(request)")
                 // Func Test Controller
                 .antMatchers(HttpMethod.GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                 .antMatchers(HttpMethod.GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
                 .antMatchers(HttpMethod.POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                 .antMatchers(HttpMethod.PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
                 .antMatchers(HttpMethod.PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
                 .antMatchers(HttpMethod.PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
                 .antMatchers(HttpMethod.PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
                 .antMatchers(HttpMethod.PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                 // Commit Controller
                 .antMatchers("/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
                 .antMatchers("/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
                 // Deployment Controller
                 .antMatchers(HttpMethod.GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
                 .antMatchers(HttpMethod.POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
                 .antMatchers(HttpMethod.DELETE, "/deployments").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
                 // Pipeline Controller
                 .antMatchers(HttpMethod.GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
                 .antMatchers(HttpMethod.GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines/templates").authenticated()
                 .antMatchers(HttpMethod.GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
                 .antMatchers(HttpMethod.GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
                 .antMatchers(HttpMethod.GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.POST, "/pipelines").authenticated()
                 .antMatchers(HttpMethod.PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
+                .antMatchers(HttpMethod.DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                // Stage Controller
+                .antMatchers(HttpMethod.GET, "/stages").authenticated()
                 // Project Controller
-                .antMatchers(HttpMethod.GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/project/listByUser").authenticated()
                 .antMatchers(HttpMethod.GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.POST, "/project/create").authenticated()
                 .antMatchers(HttpMethod.POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
                 .antMatchers(HttpMethod.POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
                 .antMatchers(HttpMethod.POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
                 // SQL Controller
                 .antMatchers(HttpMethod.GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/sql/exec").authenticated()
                 // Tree Nodes Controller
                 .antMatchers(HttpMethod.GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
+                .antMatchers(HttpMethod.POST, "/tree/node").authenticated()
                 .antMatchers(HttpMethod.POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
                 .antMatchers(HttpMethod.PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
                 .antMatchers(HttpMethod.PUT, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
                 // Swagger
                 .antMatchers("/**/*swagger*/**").anonymous()
                 .antMatchers("/**/*api-docs*/**").anonymous()