feat: 添加了针对管理端的API的安全设置

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -1,11 +1,10 @@
 package cn.seecoder.web.infrastructure.config;
 
 import cn.seecoder.web.infrastructure.security.JwtAuthenticationTokenFilter;
+import cn.seecoder.web.infrastructure.security.WebSecurityConstants;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.http.HttpMethod;
-import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -15,7 +14,10 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.CorsUtils;
-import cn.seecoder.web.infrastructure.security.WebSecurityConstants;
+
+import static cn.seecoder.web.infrastructure.security.WebSecurityConstants.SEEC_AUTHORITY;
+import static cn.seecoder.web.infrastructure.security.WebSecurityConstants.SEEC_ROLE;
+import static org.springframework.http.HttpMethod.*;
 
 /**
  * @author PuHong Weng
@@ -53,76 +55,78 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
 
                 .authorizeRequests()
+                // Devmanage Controller
+                .antMatchers(GET, "/devmanage/**").hasAnyRole(SEEC_ROLE)
                 // API Test Controller
-                .antMatchers(HttpMethod.GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.POST, "/test/create").authenticated()
+                .antMatchers(GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(POST, "/test/create").authenticated()
                 // Auto Test Controller
-                .antMatchers(HttpMethod.GET, "/auto_test/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/auto_test/list").access("@authTools.checkProjOwnershipParam(request)")
                 // Bug List Controller
-                .antMatchers(HttpMethod.GET, "/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/bug_list").authenticated()
-                .antMatchers(HttpMethod.PUT, "/bug_list").access("@authTools.checkBugOwnershipBody(request)")
+                .antMatchers(GET, "/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(POST, "/bug_list").authenticated()
+                .antMatchers(PUT, "/bug_list").access("@authTools.checkBugOwnershipBody(request)")
                 // Func Test Controller
-                .antMatchers(HttpMethod.GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/func_test/taskList").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/func_test/taskList").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                 // Commit Controller
-                .antMatchers(HttpMethod.GET, "/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/commits/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
+                .antMatchers(GET, "/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
+                .antMatchers(GET, "/commits/list").access("@authTools.checkProjOwnershipParam(request)")
                 // Deployment Controller
-                .antMatchers(HttpMethod.GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/deployments").permitAll()
+                .antMatchers(GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(DELETE, "/deployments").permitAll()
                 // Pipeline Controller
-                .antMatchers(HttpMethod.GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/templates").authenticated()
-                .antMatchers(HttpMethod.GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/pipelines").authenticated()
-                .antMatchers(HttpMethod.PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
-                .antMatchers(HttpMethod.DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(GET, "/pipelines/templates").authenticated()
+                .antMatchers(GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .antMatchers(GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .antMatchers(POST, "/pipelines").authenticated()
+                .antMatchers(PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
+                .antMatchers(DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
                 // Stage Controller
-                .antMatchers(HttpMethod.GET, "/stages").authenticated()
+                .antMatchers(GET, "/stages").authenticated()
                 // Project Controller
-                .antMatchers(HttpMethod.GET, "/project/listByUser").authenticated()
-                .antMatchers(HttpMethod.GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.POST, "/project/create").authenticated()
-                .antMatchers(HttpMethod.POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/project/relate/{projectId}").authenticated()
+                .antMatchers(GET, "/project/listByUser").authenticated()
+                .antMatchers(GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(POST, "/project/create").authenticated()
+                .antMatchers(POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(GET, "/project/relate/{projectId}").authenticated()
                 // SQL Controller
-                .antMatchers(HttpMethod.GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/sql/exec").authenticated()
+                .antMatchers(GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(POST, "/sql/exec").authenticated()
                 // Tree Nodes Controller
-                .antMatchers(HttpMethod.GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.POST, "/tree/node").authenticated()
-                .antMatchers(HttpMethod.POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
-                .antMatchers(HttpMethod.PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
-                .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
+                .antMatchers(GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(GET, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(POST, "/tree/node").authenticated()
+                .antMatchers(POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
+                .antMatchers(PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
+                .antMatchers(DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
                 // User Controller
-                .antMatchers(HttpMethod.GET, "/users/self").authenticated()
-                .antMatchers(HttpMethod.POST, "/users/gitlab").authenticated()
+                .antMatchers(GET, "/users/self").authenticated()
+                .antMatchers(POST, "/users/gitlab").authenticated()
                 // Swagger
                 .antMatchers("/**/*swagger*/**").permitAll()
                 .antMatchers("/**/*api-docs*/**").permitAll()