Merge branch 'lyy_fix_springSecurityWithJwt' of WengPuHong/seecoder-devcloud into master

web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

@@ -54,9 +54,6 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
                 .and()
                 .authorizeRequests()
-                //跨域的Options请求进行放行
-                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
-                .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                 // API Test Controller
                 .antMatchers(HttpMethod.GET, "/api/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                 .antMatchers(HttpMethod.GET, "/api/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
@@ -111,6 +108,9 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .antMatchers(HttpMethod.POST, "/api/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
                 .antMatchers(HttpMethod.PUT, "/api/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
                 .antMatchers(HttpMethod.PUT, "/api/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
+                //跨域的Options请求进行放行
+                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
+                .antMatchers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                 //其他所有接口都要在登陆认证状态下请求
                 .anyRequest().authenticated();