add:获取用户信息、修改密码 (#394)

Manager api user

main/manager-api/src/main/java/xiaozhi/common/aspect/DataFilterAspect.java

@@ -1,99 +0,0 @@
-package xiaozhi.common.aspect;
-
-import cn.hutool.core.collection.CollUtil;
-import xiaozhi.common.annotation.DataFilter;
-import xiaozhi.common.constant.Constant;
-import xiaozhi.common.exception.ErrorCode;
-import xiaozhi.common.exception.RenException;
-import xiaozhi.common.interceptor.DataScope;
-import xiaozhi.common.user.UserDetail;
-import xiaozhi.modules.security.user.SecurityUser;
-import xiaozhi.modules.sys.enums.SuperAdminEnum;
-import org.apache.commons.lang3.StringUtils;
-import org.aspectj.lang.JoinPoint;
-import org.aspectj.lang.annotation.Aspect;
-import org.aspectj.lang.annotation.Before;
-import org.aspectj.lang.annotation.Pointcut;
-import org.aspectj.lang.reflect.MethodSignature;
-import org.springframework.stereotype.Component;
-
-import java.lang.reflect.Method;
-import java.util.List;
-import java.util.Map;
-
-/**
- * 数据过滤，切面处理类
- * Copyright (c) 人人开源 All rights reserved.
- * Website: https://www.renren.io
- */
-@Aspect
-@Component
-public class DataFilterAspect {
-
-    @Pointcut("@annotation(xiaozhi.common.annotation.DataFilter)")
-    public void dataFilterCut() {
-
-    }
-
-    @Before("dataFilterCut()")
-    public void dataFilter(JoinPoint point) {
-        Object params = point.getArgs()[0];
-        if (params != null && params instanceof Map) {
-            UserDetail user = SecurityUser.getUser();
-
-            //如果是超级管理员，则不进行数据过滤
-            if (user.getSuperAdmin() == SuperAdminEnum.YES.value()) {
-                return;
-            }
-
-            try {
-                //否则进行数据过滤
-                Map map = (Map) params;
-                String sqlFilter = getSqlFilter(user, point);
-                map.put(Constant.SQL_FILTER, new DataScope(sqlFilter));
-            } catch (Exception e) {
-
-            }
-
-            return;
-        }
-
-        throw new RenException(ErrorCode.DATA_SCOPE_PARAMS_ERROR);
-    }
-
-    /**
-     * 获取数据过滤的SQL
-     */
-    private String getSqlFilter(UserDetail user, JoinPoint point) throws Exception {
-        MethodSignature signature = (MethodSignature) point.getSignature();
-        Method method = point.getTarget().getClass().getDeclaredMethod(signature.getName(), signature.getParameterTypes());
-        DataFilter dataFilter = method.getAnnotation(DataFilter.class);
-
-        //获取表的别名
-        String tableAlias = dataFilter.tableAlias();
-        if (StringUtils.isNotBlank(tableAlias)) {
-            tableAlias += ".";
-        }
-
-        StringBuilder sqlFilter = new StringBuilder();
-        sqlFilter.append(" (");
-
-        //部门ID列表
-        List<Long> deptIdList = user.getDeptIdList();
-        if (CollUtil.isNotEmpty(deptIdList)) {
-            sqlFilter.append(tableAlias).append(dataFilter.deptId());
-
-            sqlFilter.append(" in(").append(StringUtils.join(deptIdList, ",")).append(")");
-        }
-
-        //查询本人数据
-        if (CollUtil.isNotEmpty(deptIdList)) {
-            sqlFilter.append(" or ");
-        }
-        sqlFilter.append(tableAlias).append(dataFilter.userId()).append("=").append(user.getId());
-
-        sqlFilter.append(")");
-
-        return sqlFilter.toString();
-    }
-}

main/manager-api/src/main/java/xiaozhi/common/constant/Constant.java

@@ -73,10 +73,6 @@ public interface Constant {
      * 排序方式
      */
     String ORDER = "order";
-    /**
-     * token header
-     */
-    String TOKEN_HEADER = "token";
 
     String AUTHORIZATION = "Authorization";
 

main/manager-api/src/main/java/xiaozhi/common/handler/FieldMetaObjectHandler.java

@@ -34,9 +34,6 @@ public class FieldMetaObjectHandler implements MetaObjectHandler {
         //创建时间
         strictInsertFill(metaObject, CREATE_DATE, Date.class, date);
 
-        //创建者所属部门
-        strictInsertFill(metaObject, DEPT_ID, Long.class, user.getDeptId());
-
         //更新者
         strictInsertFill(metaObject, UPDATER, Long.class, user.getId());
         //更新时间

main/manager-api/src/main/java/xiaozhi/common/user/UserDetail.java

@@ -3,7 +3,6 @@ package xiaozhi.common.user;
 import lombok.Data;
 
 import java.io.Serializable;
-import java.util.List;
 
 /**
  * 登录用户信息
@@ -14,19 +13,7 @@ import java.util.List;
 public class UserDetail implements Serializable {
     private Long id;
     private String username;
-    private String realName;
-    private String headUrl;
-    private Integer gender;
-    private String email;
-    private String mobile;
-    private Long deptId;
-    private String password;
-    private Integer status;
     private Integer superAdmin;
     private String token;
-    /**
-     * 部门数据权限
-     */
-    private List<Long> deptIdList;
-
+    private Integer status;
 }

main/manager-api/src/main/java/xiaozhi/common/utils/HttpContextUtils.java

@@ -1,6 +1,5 @@
 package xiaozhi.common.utils;
 
-import xiaozhi.common.constant.Constant;
 import jakarta.servlet.http.HttpServletRequest;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.HttpHeaders;
@@ -8,6 +7,8 @@ import org.springframework.util.DigestUtils;
 import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
+import xiaozhi.common.exception.ErrorCode;
+import xiaozhi.common.exception.RenException;
 
 import java.util.Date;
 import java.util.Enumeration;
@@ -30,13 +31,14 @@ public class HttpContextUtils {
         return ((ServletRequestAttributes) requestAttributes).getRequest();
     }
 
-    public static String getToken() {
-        HttpServletRequest httpRequest = getHttpServletRequest();
-        String token = httpRequest.getHeader(Constant.TOKEN_HEADER);
-
-        //如果header中不存在token，则从参数中获取token
+    public static String getToken(String authorization) {
+        String token;
+        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+        token = authorization.replace("Bearer ", "");
         if (StringUtils.isBlank(token)) {
-            token = httpRequest.getParameter(Constant.TOKEN_HEADER);
+            throw new RenException(ErrorCode.TOKEN_NOT_EMPTY);
         }
         return token;
     }

main/manager-api/src/main/java/xiaozhi/common/utils/Result.java

@@ -1,16 +1,10 @@
 package xiaozhi.common.utils;
 
-import xiaozhi.common.exception.ErrorCode;
-import xiaozhi.common.page.PageData;
-import xiaozhi.modules.security.user.SecurityUser;
 import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
-import org.apache.commons.lang3.StringUtils;
+import xiaozhi.common.exception.ErrorCode;
 
 import java.io.Serializable;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
 
 /**
  * 响应数据
@@ -42,9 +36,6 @@ public class Result<T> implements Serializable {
         return this;
     }
 
-    public boolean success() {
-        return code == 0;
-    }
 
     public Result<T> error() {
         this.code = ErrorCode.INTERNAL_SERVER_ERROR;

main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java

@@ -25,11 +25,10 @@ import xiaozhi.modules.security.user.SecurityUser;
 import java.util.List;
 import java.util.Map;
 
+@Tag(name = "设备管理")
 @AllArgsConstructor
 @RestController
 @RequestMapping("/device")
-@Tag(name = "设备管理")
-
 public class DeviceController {
     private final DeviceService deviceService;
     private final RedisUtils redisUtils;

main/manager-api/src/main/java/xiaozhi/modules/security/config/ShiroConfig.java

@@ -70,7 +70,9 @@ public class ShiroConfig {
         filterMap.put("/v3/api-docs/**", "anon");
         filterMap.put("/doc.html", "anon");
         filterMap.put("/favicon.ico", "anon");
-        filterMap.put("/user/**", "anon");
+        filterMap.put("/user/captcha", "anon");
+        filterMap.put("/user/login", "anon");
+        filterMap.put("/user/register", "anon");
         filterMap.put("/**", "oauth2");
         shiroFilter.setFilterChainDefinitionMap(filterMap);
 

main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java

@@ -4,20 +4,21 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.AllArgsConstructor;
-import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.exception.RenException;
 import xiaozhi.common.page.TokenDTO;
+import xiaozhi.common.user.UserDetail;
 import xiaozhi.common.utils.Result;
 import xiaozhi.common.validator.AssertUtils;
-import xiaozhi.modules.security.dao.SysUserTokenDao;
 import xiaozhi.modules.security.dto.LoginDTO;
 import xiaozhi.modules.security.password.PasswordUtils;
 import xiaozhi.modules.security.service.CaptchaService;
 import xiaozhi.modules.security.service.SysUserTokenService;
+import xiaozhi.modules.security.user.SecurityUser;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.service.SysUserService;
 
@@ -26,7 +27,6 @@ import java.io.IOException;
 /**
  * 登录控制层
  */
-@Tag(name = "登录管理")
 @AllArgsConstructor
 @RestController
 @RequestMapping("/user")
@@ -36,7 +36,6 @@ public class LoginController {
     private final SysUserTokenService sysUserTokenService;
     private final CaptchaService captchaService;
 
-    private static final Logger logger = LoggerFactory.getLogger(LoginController.class);
 
     @GetMapping("/captcha")
     @Operation(summary = "验证码")
@@ -79,32 +78,31 @@ public class LoginController {
         }
         // 按照用户名获取用户
         SysUserDTO userDTO = sysUserService.getByUsername(login.getUsername());
-        if (userDTO != null){
+        if (userDTO != null) {
             throw new RenException("此手机号码已经注册过");
         }
         userDTO = new SysUserDTO();
         userDTO.setUsername(login.getUsername());
         userDTO.setPassword(login.getPassword());
         sysUserService.save(userDTO);
-        return new Result<Void>();
+        return new Result<>();
 
     }
 
     @GetMapping("/info")
     @Operation(summary = "用户信息获取")
-    public Result<SysUserDTO> info(@RequestHeader("Authorization")String authorization) {
-        logger.info("the authorization:{}", authorization);
+    public Result<UserDetail> info() {
+        UserDetail user = SecurityUser.getUser();
+        Result<UserDetail> result = new Result<>();
+        result.setData(user);
+        return result;
+    }
 
-        String token;
-        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
-            throw new RenException(ErrorCode.UNAUTHORIZED);
-        }
-        token = authorization.replace("Bearer ", "");
-        if (StringUtils.isBlank(token)) {
-            throw new RenException(ErrorCode.UNAUTHORIZED);
-        }
-        SysUserDTO sysUserDTO = sysUserTokenService.getUserByToken(token);
-        Result result = new Result<SysUserDTO>();
-        return result.ok(sysUserDTO);
+    @PutMapping("/change-password")
+    @Operation(summary = "修改用户密码")
+    public Result<?> changePassword(@RequestBody PasswordDTO passwordDTO) {
+        Long userId = SecurityUser.getUserId();
+        sysUserTokenService.changePassword(userId, passwordDTO);
+        return new Result<>();
     }
 }

main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Filter.java

@@ -11,7 +11,6 @@ import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
 import org.springframework.web.bind.annotation.RequestMethod;
 import xiaozhi.common.constant.Constant;
 import xiaozhi.common.exception.ErrorCode;
-import xiaozhi.common.exception.RenException;
 import xiaozhi.common.utils.HttpContextUtils;
 import xiaozhi.common.utils.JsonUtils;
 import xiaozhi.common.utils.Result;
@@ -90,21 +89,10 @@ public class Oauth2Filter extends AuthenticatingFilter {
      * 获取请求的token
      */
     private String getRequestToken(HttpServletRequest httpRequest) {
-        String token;
+        String token = null;
         //从header中获取token
         String authorization = httpRequest.getHeader(Constant.AUTHORIZATION);
-        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
-            throw new RenException(ErrorCode.UNAUTHORIZED);
-        }
-        token = authorization.replace("Bearer ", "");
-
-        //如果header中不存在token，则从参数中获取token
-        if (StringUtils.isBlank(token)) {
-            authorization = httpRequest.getParameter(Constant.AUTHORIZATION);
-
-            if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
-                throw new RenException(ErrorCode.UNAUTHORIZED);
-            }
+        if (StringUtils.isNotBlank(authorization) && authorization.startsWith("Bearer ")) {
             token = authorization.replace("Bearer ", "");
         }
         return token;

main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Realm.java

@@ -14,7 +14,6 @@ import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.user.UserDetail;
 import xiaozhi.common.utils.ConvertUtils;
 import xiaozhi.common.utils.MessageUtils;
-import xiaozhi.modules.security.controller.LoginController;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
 import xiaozhi.modules.security.service.ShiroService;
 import xiaozhi.modules.sys.entity.SysUserEntity;
@@ -82,8 +81,6 @@ public class Oauth2Realm extends AuthorizingRealm {
         //转换成UserDetail对象
         UserDetail userDetail = ConvertUtils.sourceToTarget(userEntity, UserDetail.class);
 
-        //获取用户对应的部门数据权限
-        userDetail.setDeptIdList(null);
         userDetail.setToken(accessToken);
 
         //账号锁定

main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java

@@ -1,14 +1,12 @@
 package xiaozhi.modules.security.service;
 
-import xiaozhi.common.page.PageData;
 import xiaozhi.common.page.TokenDTO;
 import xiaozhi.common.service.BaseService;
 import xiaozhi.common.utils.Result;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 
-import java.util.Map;
-
 /**
  * 用户Token
  * Copyright (c) 人人开源 All rights reserved.
@@ -32,4 +30,12 @@ public interface SysUserTokenService extends BaseService<SysUserTokenEntity> {
      */
     void logout(Long userId);
 
+    /**
+     * 修改密码
+     *
+     * @param userId
+     * @param passwordDTO
+     */
+    void changePassword(Long userId, PasswordDTO passwordDTO);
+
 }

main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java

@@ -2,6 +2,7 @@ package xiaozhi.modules.security.service.impl;
 
 import cn.hutool.core.date.DateUtil;
 import lombok.AllArgsConstructor;
+import org.springframework.stereotype.Service;
 import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.exception.RenException;
 import xiaozhi.common.page.TokenDTO;
@@ -12,7 +13,7 @@ import xiaozhi.modules.security.dao.SysUserTokenDao;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
 import xiaozhi.modules.security.oauth2.TokenGenerator;
 import xiaozhi.modules.security.service.SysUserTokenService;
-import org.springframework.stereotype.Service;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.service.SysUserService;
 
@@ -81,6 +82,9 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
     @Override
     public SysUserDTO getUserByToken(String token) {
         SysUserTokenEntity userToken = baseDao.getByToken(token);
+        if (null == userToken) {
+            throw new RenException(ErrorCode.TOKEN_INVALID);
+        }
 
         Date now = new Date();
         if (userToken.getExpireDate().before(now)) {
@@ -97,4 +101,14 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
         Date expireDate = DateUtil.offsetMinute(new Date(), -1);
         baseDao.logout(userId, expireDate);
     }
+
+    @Override
+    public void changePassword(Long userId, PasswordDTO passwordDTO) {
+        // 修改密码
+        sysUserService.changePassword(userId, passwordDTO);
+
+        // 使 token 失效，后需要重新登录
+        Date expireDate = DateUtil.offsetMinute(new Date(), -1);
+        baseDao.logout(userId, expireDate);
+    }
 }

main/manager-api/src/main/java/xiaozhi/modules/security/user/SecurityUser.java

@@ -46,11 +46,4 @@ public class SecurityUser {
     public static Long getUserId() {
         return getUser().getId();
     }
-
-    /**
-     * 获取部门ID
-     */
-    public static Long getDeptId() {
-        return getUser().getDeptId();
-    }
 }

main/manager-api/src/main/java/xiaozhi/modules/sys/entity/SysUserEntity.java

@@ -3,9 +3,9 @@ package xiaozhi.modules.sys.entity;
 import com.baomidou.mybatisplus.annotation.FieldFill;
 import com.baomidou.mybatisplus.annotation.TableField;
 import com.baomidou.mybatisplus.annotation.TableName;
-import xiaozhi.common.entity.BaseEntity;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
+import xiaozhi.common.entity.BaseEntity;
 
 import java.util.Date;
 
@@ -32,11 +32,6 @@ public class SysUserEntity extends BaseEntity {
      * 状态  0：停用   1：正常
      */
     private Integer status;
-    /**
-     * 更新者
-     */
-    @TableField(fill = FieldFill.INSERT)
-    private Date createDate;
     /**
      * 更新者
      */
@@ -47,10 +42,5 @@ public class SysUserEntity extends BaseEntity {
      */
     @TableField(fill = FieldFill.INSERT_UPDATE)
     private Date updateDate;
-    /**
-     * 部门名称
-     */
-    @TableField(exist = false)
-    private String deptName;
 
 }

main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java

@@ -1,6 +1,7 @@
 package xiaozhi.modules.sys.service;
 
 import xiaozhi.common.service.BaseService;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.entity.SysUserEntity;
 
@@ -18,4 +19,5 @@ public interface SysUserService extends BaseService<SysUserEntity> {
 
     void delete(Long[] ids);
 
+    void changePassword(Long userId, PasswordDTO passwordDTO);
 }

main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java

@@ -10,6 +10,7 @@ import xiaozhi.common.service.impl.BaseServiceImpl;
 import xiaozhi.common.utils.ConvertUtils;
 import xiaozhi.modules.security.password.PasswordUtils;
 import xiaozhi.modules.sys.dao.SysUserDao;
+import xiaozhi.modules.sys.dto.PasswordDTO;
 import xiaozhi.modules.sys.dto.SysUserDTO;
 import xiaozhi.modules.sys.entity.SysUserEntity;
 import xiaozhi.modules.sys.enums.SuperAdminEnum;
@@ -81,6 +82,31 @@ public class SysUserServiceImpl extends BaseServiceImpl<SysUserDao, SysUserEntit
         baseDao.deleteBatchIds(Arrays.asList(ids));
     }
 
+    @Override
+    public void changePassword(Long userId, PasswordDTO passwordDTO) {
+        SysUserEntity sysUserEntity = sysUserDao.selectById(userId);
+
+        if (null == sysUserEntity) {
+            throw new RenException(ErrorCode.TOKEN_INVALID);
+        }
+
+        // 判断旧密码是否正确
+        if (!PasswordUtils.matches(passwordDTO.getPassword(), sysUserEntity.getPassword())) {
+            throw new RenException("旧密码输入错误");
+        }
+
+        //新密码强度
+        if (!isStrongPassword(passwordDTO.getNewPassword())) {
+            throw new RenException(ErrorCode.PASSWORD_WEAK_ERROR);
+        }
+
+        //密码加密
+        String password = PasswordUtils.encode(passwordDTO.getNewPassword());
+        sysUserEntity.setPassword(password);
+
+        updateById(sysUserEntity);
+    }
+
     private Long getUserCount() {
         QueryWrapper<SysUserEntity> queryWrapper = new QueryWrapper<>();
         return baseDao.selectCount(queryWrapper);