Merge branch 'lyy_fix_springSecurityWithJwt' of WengPuHong/seecoder-devcloud into master

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -54,79 +54,82 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
                 .authorizeRequests()
                 // API Test Controller
-                .antMatchers(HttpMethod.GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
-                .antMatchers(HttpMethod.POST, "/test/create").authenticated()
+                .regexMatchers(HttpMethod.GET, "\\/test\\/list\\/{projectId}\\/?").access("@authTools.checkProjOwnership(#projectId)")
+                .regexMatchers(HttpMethod.GET, "\\/test\\/delete\\/{testId}\\/?").access("@authTools.checkTestOwnership(#testId)")
+                .regexMatchers(HttpMethod.GET, "\\/test\\/execute\\/{testId}\\/?").access("@authTools.checkTestOwnership(#testId)")
+                .regexMatchers(HttpMethod.GET, "\\/test\\/result\\/{testId}\\/?").access("@authTools.checkTestOwnership(#testId)")
+                .regexMatchers(HttpMethod.GET, "\\/test\\/latest\\/{testId}\\/?").access("@authTools.checkTestOwnership(#testId)")
+                .regexMatchers(HttpMethod.POST, "\\/test\\/create\\/?").authenticated()
                 // Auto Test Controller
-                .antMatchers(HttpMethod.GET, "/auto_test/list").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/auto_test\\/list\\/?").access("@authTools.checkProjOwnershipParam(request)")
                 // Bug List Controller
-                .antMatchers(HttpMethod.GET, "/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/bug_list").authenticated()
-                .antMatchers(HttpMethod.PUT, "/bug_list").access("@authTools.checkBugOwnershipBody(request)")
+                .regexMatchers(HttpMethod.GET, "\\/bug_list\\/list\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/bug_list\\/?").authenticated()
+                .regexMatchers(HttpMethod.PUT, "\\/bug_list\\/?").access("@authTools.checkBugOwnershipBody(request)")
                 // Func Test Controller
-                .antMatchers(HttpMethod.GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/func_test/taskList").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/func_test\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/func_test\\/taskList\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/func_test\\/steps\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/func_test\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/func_test\\/steps\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/steps\\/?").access("@authTools.checkTestStepOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/finish\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/reopen\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/steps\\/state\\/?").access("@authTools.checkTestStepOwnershipParam(request)")
+                .regexMatchers(HttpMethod.PUT, "\\/func_test\\/record\\/latest\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.DELETE, "\\/func_test\\/steps\\/?").access("@authTools.checkTestStepOwnershipParam(request)")
+                .regexMatchers(HttpMethod.DELETE, "\\/func_test\\/?").access("@authTools.checkTestCaseOwnershipParam(request)")
                 // Commit Controller
-                .antMatchers(HttpMethod.GET, "/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/commits/list").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/commits\\/tree\\/?").access("@authTools.checkTreeNodeOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/commits\\/bug_list\\/?").access("@authTools.checkBugOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/commits\\/list\\/?").access("@authTools.checkProjOwnershipParam(request)")
                 // Deployment Controller
-                .antMatchers(HttpMethod.GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.DELETE, "/deployments").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/deployments\\/list\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/deployments\\/log\\/?").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/deployments\\/?").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.DELETE, "\\/deployments\\/?").access("@authTools.checkProjPipelineParam(request)")
                 // Pipeline Controller
-                .antMatchers(HttpMethod.GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/templates").authenticated()
-                .antMatchers(HttpMethod.GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/pipelines").authenticated()
-                .antMatchers(HttpMethod.PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
-                .antMatchers(HttpMethod.DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/list\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/?").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/templates\\/?").authenticated()
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/record\\/list\\/?").access("@authTools.checkProjPipelineParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/record\\/?").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/pipelines\\/record\\/details\\/?").access("@authTools.checkPipelineRecordOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/pipelines\\/?").authenticated()
+                .regexMatchers(HttpMethod.PUT, "\\/pipelines\\/config\\/?").access("@authTools.checkProjPipelineBody(request)")
+                .regexMatchers(HttpMethod.DELETE, "\\/pipelines\\/?").access("@authTools.checkProjPipelineParam(request)")
                 // Stage Controller
-                .antMatchers(HttpMethod.GET, "/stages").authenticated()
+                .regexMatchers(HttpMethod.GET, "\\/stages\\/?").authenticated()
                 // Project Controller
-                .antMatchers(HttpMethod.GET, "/project/listByUser").authenticated()
-                .antMatchers(HttpMethod.GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.POST, "/project/create").authenticated()
-                .antMatchers(HttpMethod.POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/project\\/listByUser\\/?").authenticated()
+                .regexMatchers(HttpMethod.GET, "\\/project\\/members\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.GET, "\\/project\\/{projectId}\\/?").access("@authTools.checkProjOwnership(#projectId)")
+                .regexMatchers(HttpMethod.POST, "\\/project\\/create\\/?").authenticated()
+                .regexMatchers(HttpMethod.POST, "\\/project\\/members\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/project\\/relate\\/code\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/project\\/relate\\/?").access("@authTools.checkProjOwnershipParam(request)")
                 // SQL Controller
-                .antMatchers(HttpMethod.GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
-                .antMatchers(HttpMethod.POST, "/sql/exec").authenticated()
+                .regexMatchers(HttpMethod.GET, "\\/sql\\/instances\\/?").access("@authTools.checkProjOwnershipParam(request)")
+                .regexMatchers(HttpMethod.POST, "\\/sql\\/exec\\/?").authenticated()
                 // Tree Nodes Controller
-                .antMatchers(HttpMethod.GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.GET, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
-                .antMatchers(HttpMethod.POST, "/tree/node").authenticated()
-                .antMatchers(HttpMethod.POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
-                .antMatchers(HttpMethod.PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
-                .antMatchers(HttpMethod.DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
+                .regexMatchers(HttpMethod.GET, "\\/tree\\/{projectId}\\/?").access("@authTools.checkProjOwnership(#projectId)")
+                .regexMatchers(HttpMethod.GET, "\\/tree\\/node\\/type\\/task\\/{projectId}\\/?").access("@authTools.checkProjOwnership(#projectId)")
+                .regexMatchers(HttpMethod.POST, "\\/tree\\/node\\/?").authenticated()
+                .regexMatchers(HttpMethod.POST, "\\/tree\\/subNode\\/{fatherId}\\/?").access("@authTools.checkTreeNodeOwnership(#fatherId)")
+                .regexMatchers(HttpMethod.PUT, "\\/tree\\/node\\/?").access("@authTools.checkTreeNodeOwnershipBody(request)")
+                .regexMatchers(HttpMethod.DELETE, "\\/tree\\/node\\/{nodeId}\\/?").access("@authTools.checkTreeNodeOwnership(#nodeId)")
+                // User Controller
+                .regexMatchers(HttpMethod.GET, "\\/users\\/self\\/?").authenticated()
+                .regexMatchers(HttpMethod.POST, "\\/users\\/gitlab\\/?").authenticated()
                 // Swagger
                 .antMatchers("/**/*swagger*/**").permitAll()
                 .antMatchers("/**/*api-docs*/**").permitAll()
                 .antMatchers("/**/hook").permitAll()
                 .antMatchers("/**/query/**").permitAll()
                 // 跨域的 Options 请求进行放行
-//                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
-//                .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
+                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
+//                .antMathcers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                 // 拒绝其他请求
                 .anyRequest().denyAll();
     }