fix: 修复了一个轻微 bug，并且稍微修改了鉴权策略，同时使得安全配置类变得间接。

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -22,8 +22,8 @@ import cn.seecoder.web.infrastructure.security.WebSecurityConstants;
  * @date 2021/3/5
  * @description:
  */
-    @Configuration
-    @EnableWebSecurity
+@Configuration
+@EnableWebSecurity
 @EnableGlobalMethodSecurity(prePostEnabled = true)  //  启用方法级别的权限认证
 //@DependsOn("userServiceImpl")
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@@ -40,28 +40,19 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
     protected void configure(HttpSecurity http) throws Exception {
-
         //访问控制
         http
                 .cors()
+
                 .and()
                 .csrf().disable()
                 .sessionManagement()
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+
                 .and()
                 .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
-                //访问swagger
-//                .anonymous()
-//                .authorities("ROLE_ANONYMOUS").and()
-                .authorizeRequests()
-//                .antMatchers("/**/*swagger*/**").permitAll()
-//                .antMatchers("/**/*api-docs*/**").permitAll()
-//                .antMatchers("/**/hook").permitAll()
-//                .antMatchers("/**/query/**").permitAll()
 
-//
-//                .and()
-//                .authorizeRequests()
+                .authorizeRequests()
                 // API Test Controller
                 .antMatchers(HttpMethod.GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 .antMatchers(HttpMethod.GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
@@ -123,36 +114,21 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers(HttpMethod.POST, "/sql/exec").authenticated()
                 // Tree Nodes Controller
                 .antMatchers(HttpMethod.GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 .antMatchers(HttpMethod.POST, "/tree/node").authenticated()
                 .antMatchers(HttpMethod.POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
                 .antMatchers(HttpMethod.PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
-                .antMatchers(HttpMethod.PUT, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
                 // Swagger
-                .antMatchers("/**/*swagger*/**").anonymous()
-                .antMatchers("/**/*api-docs*/**").anonymous()
-                .antMatchers("/**/hook").anonymous()
-                .antMatchers("/**/query/**").anonymous()
-                //跨域的Options请求进行放行
+                .antMatchers("/**/*swagger*/**").permitAll()
+                .antMatchers("/**/*api-docs*/**").permitAll()
+                .antMatchers("/**/hook").permitAll()
+                .antMatchers("/**/query/**").permitAll()
+                // 跨域的 Options 请求进行放行
                 .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
                 .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
-                //其他所有接口都要在登陆认证状态下请求
-                .anyRequest().authenticated();
-
-        //开启跨域
-//        http.cors();
-
-        //改用jwt无状态认证方式,将原来基于session的认证方式关闭
-//        http.csrf().disable();
-//        http.sessionManagement()
-//                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-//                .and()
-//                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
-    }
-
-    @Bean
-    public AuthenticationManager authenticationManager() throws Exception {
-        return super.authenticationManagerBean();
+                // 拒绝其他请求
+                .anyRequest().denyAll();
     }
 
     /**