fix: 尝试修复授权不生效的问题。

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -43,6 +43,13 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
         //访问控制
         http
+                .cors()
+                .and()
+                .csrf().disable()
+                .sessionManagement()
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                .and()
+                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
                 //访问swagger
 //                .anonymous()
 //                .authorities("ROLE_ANONYMOUS").and()
@@ -56,59 +63,59 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 //                .and()
 //                .authorizeRequests()
                 // API Test Controller
-                .antMatchers(HttpMethod.GET, "/api/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/api/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/api/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/api/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/api/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(HttpMethod.GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(HttpMethod.GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(HttpMethod.GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
+                .antMatchers(HttpMethod.GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
                 // Auto Test Controller
-                .antMatchers("/api/auto_test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers("/auto_test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 // Bug List Controller
-                .antMatchers("/api/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/bug_list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers("/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/bug_list").access("@authTools.checkProjOwnershipParam(request)")
                 // Func Test Controller
-                .antMatchers(HttpMethod.GET, "/api/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/api/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/api/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
+                .antMatchers(HttpMethod.PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
                 // Commit Controller
-                .antMatchers("/api/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
-                .antMatchers("/api/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
+                .antMatchers("/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
+                .antMatchers("/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
                 // Deployment Controller
-                .antMatchers(HttpMethod.GET, "/api/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/deployments").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/api/deployments").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/deployments/log").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/deployments").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
                 // Pipeline Controller
-                .antMatchers(HttpMethod.GET, "/api/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/pipelines").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/api/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/api/pipelines").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.PUT, "/api/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .antMatchers(HttpMethod.DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .antMatchers(HttpMethod.PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
                 // Project Controller
-                .antMatchers(HttpMethod.GET, "/api/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/api/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/api/project/relate").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
                 // SQL Controller
-                .antMatchers(HttpMethod.GET, "/api/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
+                .antMatchers(HttpMethod.GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
                 // Tree Nodes Controller
-                .antMatchers(HttpMethod.GET, "/api/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.DELETE, "/api/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
-                .antMatchers(HttpMethod.POST, "/api/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
-                .antMatchers(HttpMethod.PUT, "/api/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
-                .antMatchers(HttpMethod.PUT, "/api/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
+                .antMatchers(HttpMethod.POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
+                .antMatchers(HttpMethod.PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
+                .antMatchers(HttpMethod.PUT, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 // Swagger
                 .antMatchers("/**/*swagger*/**").anonymous()
                 .antMatchers("/**/*api-docs*/**").anonymous()
@@ -121,14 +128,14 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .anyRequest().authenticated();
 
         //开启跨域
-        http.cors();
+//        http.cors();
 
         //改用jwt无状态认证方式,将原来基于session的认证方式关闭
-        http.csrf().disable();
-        http.sessionManagement()
-                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-                .and()
-                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
+//        http.csrf().disable();
+//        http.sessionManagement()
+//                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+//                .and()
+//                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
     }
 
     @Bean