seecoder-devcloud/web/src/main/java/cn/seecoder/web/infrastructure/config/WebSecurityConfig.java

package cn.seecoder.web.infrastructure.config;

import cn.seecoder.web.infrastructure.security.JwtAuthenticationTokenFilter;
import cn.seecoder.web.infrastructure.security.WebSecurityConstants;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.CorsUtils;

import static cn.seecoder.web.infrastructure.security.WebSecurityConstants.SEEC_AUTHORITY;
import static cn.seecoder.web.infrastructure.security.WebSecurityConstants.SEEC_ROLE;
import static org.springframework.http.HttpMethod.*;

/**
 * @author PuHong Weng
 * @date 2021/3/5
 * @description:
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)  //  启用方法级别的权限认证
//@DependsOn("userServiceImpl")
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private final JwtAuthenticationTokenFilter filter;
    private final AuthTools authTools;

    @Autowired
    public WebSecurityConfig(JwtAuthenticationTokenFilter filter, AuthTools authTools) {
        super();
        this.filter = filter;
        this.authTools = authTools;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //访问控制
        http
                .cors()

                .and()
                .csrf().disable()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)

                .and()
                .addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)

                .authorizeRequests()
                // Devmanage Controller
                .antMatchers(GET, "/devmanage/**").hasAnyRole(SEEC_ROLE)
                // API Test Controller
                .antMatchers(GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                .antMatchers(GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
                .antMatchers(GET, "/test/execute/{testId}").access("@authTools.checkTestOwnership(#testId)")
                .antMatchers(GET, "/test/result/{testId}").access("@authTools.checkTestOwnership(#testId)")
                .antMatchers(GET, "/test/latest/{testId}").access("@authTools.checkTestOwnership(#testId)")
                .antMatchers(POST, "/test/create").authenticated()
                // Interface Test Controller
                .antMatchers(POST, "/interfaces/create").permitAll()
                .antMatchers(GET, "/interfaces/list/{projectId}").permitAll()
                .antMatchers(GET, "/interfaces/delete/{id}").permitAll()
                .antMatchers(GET, "/interfaces/execute/{id}/{username}/{type}").permitAll()
                .antMatchers(GET, "/interfaces/results/{id}").permitAll()
                .antMatchers(GET, "/interfaces/results/auto/{id}").permitAll()
                // Auto Test Controller
                .antMatchers(GET, "/auto_test/list").access("@authTools.checkProjOwnershipParam(request)")
                // Bug List Controller
                .antMatchers(GET, "/bug_list/list").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(POST, "/bug_list").authenticated()
                .antMatchers(PUT, "/bug_list").access("@authTools.checkBugOwnershipBody(request)")
                // Func Test Controller
                .antMatchers(GET, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/func_test/taskList").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
                .antMatchers(POST, "/func_test").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(POST, "/func_test/steps").access("@authTools.checkTestCaseOwnershipParam(request)")
                .antMatchers(PUT, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                .antMatchers(PUT, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
                .antMatchers(PUT, "/func_test/finish").access("@authTools.checkTestCaseOwnershipParam(request)")
                .antMatchers(PUT, "/func_test/reopen").access("@authTools.checkTestCaseOwnershipParam(request)")
                .antMatchers(PUT, "/func_test/steps/state").access("@authTools.checkTestStepOwnershipParam(request)")
                .antMatchers(PUT, "/func_test/record/latest").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(DELETE, "/func_test/steps").access("@authTools.checkTestStepOwnershipParam(request)")
                .antMatchers(DELETE, "/func_test").access("@authTools.checkTestCaseOwnershipParam(request)")
                // Commit Controller
                .antMatchers(GET, "/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
                .antMatchers(GET, "/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
                .antMatchers(GET, "/commits/list").access("@authTools.checkProjOwnershipParam(request)")
                // Deployment Controller
                .antMatchers(GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
                .antMatchers(POST, "/deployments").access("@authTools.checkProjPipelineParam(request)")
                .antMatchers(DELETE, "/deployments").permitAll()
                // Pipeline Controller
                .antMatchers(GET, "/pipelines/list").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
                .antMatchers(GET, "/pipelines/templates").authenticated()
                .antMatchers(GET, "/pipelines/record/list").access("@authTools.checkProjPipelineParam(request)")
                .antMatchers(GET, "/pipelines/record").access("@authTools.checkPipelineRecordOwnershipParam(request)")
                .antMatchers(GET, "/pipelines/record/details").access("@authTools.checkPipelineRecordOwnershipParam(request)")
                .antMatchers(POST, "/pipelines").authenticated()
                .antMatchers(PUT, "/pipelines/config").access("@authTools.checkProjPipelineBody(request)")
                .antMatchers(DELETE, "/pipelines").access("@authTools.checkProjPipelineParam(request)")
                // Stage Controller
                .antMatchers(GET, "/stages").authenticated()
                // Project Controller
                .antMatchers(GET, "/project/listByUser").authenticated()
                .antMatchers(GET, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/project/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                .antMatchers(POST, "/project/create").authenticated()
                .antMatchers(POST, "/project/members").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(POST, "/project/relate/code").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(POST, "/project/relate").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(GET, "/project/relate/{projectId}").authenticated()
                // SQL Controller
                .antMatchers(GET, "/sql/instances").access("@authTools.checkProjOwnershipParam(request)")
                .antMatchers(POST, "/sql/exec").authenticated()
                // Tree Nodes Controller
                .antMatchers(GET, "/tree/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                .antMatchers(GET, "/tree/node/type/task/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
                .antMatchers(POST, "/tree/node").authenticated()
                .antMatchers(POST, "/tree/subNode/{fatherId}").access("@authTools.checkTreeNodeOwnership(#fatherId)")
                .antMatchers(PUT, "/tree/node").access("@authTools.checkTreeNodeOwnershipBody(request)")
                .antMatchers(DELETE, "/tree/node/{nodeId}").access("@authTools.checkTreeNodeOwnership(#nodeId)")
                // User Controller
                .antMatchers(GET, "/users/self").authenticated()
                .antMatchers(POST, "/users/gitlab").authenticated()
                // Swagger
                .antMatchers("/**/*swagger*/**").permitAll()
                .antMatchers("/**/*api-docs*/**").permitAll()
                .antMatchers("/**/hook").permitAll()
                .antMatchers("/**/query/**").permitAll()
                // 跨域的 Options 请求进行放行
                .requestMatchers(CorsUtils::isPreFlightRequest).permitAll()
//                .antMathcers("/**").hasAnyRole(WebSecurityConstants.STUDENT_ROLE, WebSecurityConstants.ADMIN_ROLE, WebSecurityConstants.TEACHER_ROLE)
                // 拒绝其他请求
                .anyRequest().denyAll();
    }

    /**
     * 本地测试时的跨域设置
     */
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        return httpServletRequest -> {
            CorsConfiguration cfg = new CorsConfiguration();
            cfg.addAllowedHeader("*");
            cfg.addAllowedMethod("*");
            cfg.addAllowedOrigin("*");
            cfg.setAllowCredentials(true);
            cfg.checkOrigin("*");
            return cfg;
        };
    }

}