fix: 如果 Project 为 Public 可见性，获取其信息时不查验拥有关系

web/src/main/java/cn/seecoder/web/infrastructure/config/AuthTools.java

@@ -16,24 +16,22 @@ import cn.seecoder.web.model.po.pipeline.PipelinePO;
 import cn.seecoder.web.model.po.pipeline.PipelineRecordPO;
 import cn.seecoder.web.model.po.tree.TreeNodePO;
 import cn.seecoder.web.model.po.user.UserPO;
-import cn.seecoder.web.model.vo.bug_list.BugListUpdateBasicVO;
-import cn.seecoder.web.model.vo.pipeline.PipelineUpdateConfigVO;
-import cn.seecoder.web.model.vo.tree.TreeNodeUpdateBasicVO;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nju.edu.gitlab.SeecoderGitlabApi;
 import com.nju.edu.gitlab.SeecoderGitlabException;
 import com.nju.edu.gitlab.vo.ProjectVO;
+import com.nju.edu.gitlab.vo.VisibilityVO;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang.StringUtils;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
 
 import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.util.List;
-import java.util.stream.Collectors;
+import java.util.Objects;
 
+@RequiredArgsConstructor
 @Component
 @Slf4j
 public class AuthTools {
@@ -44,23 +42,7 @@ public class AuthTools {
     private final BugListMapper bugListMapper;
     private final PipelineMapper pipelineMapper;
     private final PipelineRecordMapper pipelineRecordMapper;
-
-    @Autowired
-    public AuthTools(APITestMapper apiTestMapper,
-                     FuncTestCaseMapper funcTestCaseMapper,
-                     FuncTestStepMapper funcTestStepMapper,
-                     TreeNodeMapper treeNodeMapper,
-                     BugListMapper bugListMapper,
-                     PipelineMapper pipelineMapper,
-                     PipelineRecordMapper pipelineRecordMapper) {
-        this.apiTestMapper = apiTestMapper;
-        this.funcTestCaseMapper = funcTestCaseMapper;
-        this.funcTestStepMapper = funcTestStepMapper;
-        this.treeNodeMapper = treeNodeMapper;
-        this.bugListMapper = bugListMapper;
-        this.pipelineMapper = pipelineMapper;
-        this.pipelineRecordMapper = pipelineRecordMapper;
-    }
+    private final SeecoderGitlabApi gitlabApi;
 
     private UserPO getCurrentUser() {
         return (UserPO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
@@ -94,6 +76,20 @@ public class AuthTools {
         return true;
     }
 
+    public boolean getProjectValidator(Integer projectId) {
+        try {
+            VisibilityVO visibility = gitlabApi.getProjectVisibility(projectId);
+            if (Objects.equals(visibility, "PUBLIC")) {
+                return true;
+            } else {
+                return checkProjOwnership(projectId);
+            }
+        } catch (SeecoderGitlabException e) {
+            log.error("AuthTool getting visibility of " + projectId + " failed.");
+            return false;
+        }
+    }
+
     public boolean checkTestOwnershipParam(HttpServletRequest request) {
         String testIdStr = request.getParameter("testId");
         log.info("checkTestOwnershipParam verifying testId: " + testIdStr);

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -126,7 +126,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 // Project Controller
                 .antMatchers(GET, "/project/listByUser").authenticated()
                 .antMatchers(GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(GET, "/project/{projectId}").access("@authTools.getProjectValidator(#projectId)")
                 .antMatchers(POST, "/project/create").authenticated()
                 .antMatchers(POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
                 .antMatchers(POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")