优化登录 token 校验：

1、后端新增 /api/v1/user/info 接口，优化 Oauth2Filter.getRequestToken 逻辑；
2、前端 /api/v1/user/login 登录成功后，保存 token 至浏览器本地；
3、前端请求添加本地 token。

main/manager-api/src/main/java/xiaozhi/common/constant/Constant.java

@@ -78,6 +78,8 @@ public interface Constant {
      */
     String TOKEN_HEADER = "token";
 
+    String AUTHORIZATION = "Authorization";
+
     /**
      * 路径分割符
      */

main/manager-api/src/main/java/xiaozhi/modules/security/config/ShiroConfig.java

@@ -58,6 +58,12 @@ public class ShiroConfig {
         filters.put("oauth2", new Oauth2Filter());
         shiroFilter.setFilters(filters);
 
+        //添加Shiro的内置过滤器
+        /*anon：无需认证就可以访问
+        authc：必须认证了才能让问
+        user：必须拥有，记住我功能，才能访问
+        perms：拥有对某个资源的权限才能访问
+        role：拥有某个角色权限才能访问*/
         Map<String, String> filterMap = new LinkedHashMap<>();
         filterMap.put("/webjars/**", "anon");
         filterMap.put("/druid/**", "anon");

main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java

@@ -4,11 +4,16 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.AllArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.exception.RenException;
+import xiaozhi.common.page.TokenDTO;
 import xiaozhi.common.utils.Result;
 import xiaozhi.common.validator.AssertUtils;
+import xiaozhi.modules.security.dao.SysUserTokenDao;
 import xiaozhi.modules.security.dto.LoginDTO;
 import xiaozhi.modules.security.password.PasswordUtils;
 import xiaozhi.modules.security.service.CaptchaService;
@@ -31,6 +36,7 @@ public class LoginController {
     private final SysUserTokenService sysUserTokenService;
     private final CaptchaService captchaService;
 
+    private static final Logger logger = LoggerFactory.getLogger(LoginController.class);
 
     @GetMapping("/captcha")
     @Operation(summary = "验证码")
@@ -44,7 +50,7 @@ public class LoginController {
 
     @PostMapping("/login")
     @Operation(summary = "登录")
-    public Result login( @RequestBody LoginDTO login) {
+    public Result<TokenDTO> login(@RequestBody LoginDTO login) {
         // 验证是否正确输入验证码
         boolean validate = captchaService.validate(login.getCaptchaId(), login.getCaptcha());
         if (!validate) {
@@ -84,4 +90,21 @@ public class LoginController {
 
     }
 
+    @GetMapping("/info")
+    @Operation(summary = "用户信息获取")
+    public Result<SysUserDTO> info(@RequestHeader("Authorization")String authorization) {
+        logger.info("the authorization:{}", authorization);
+
+        String token;
+        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+        token = authorization.replace("Bearer ", "");
+        if (StringUtils.isBlank(token)) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+        SysUserDTO sysUserDTO = sysUserTokenService.getUserByToken(token);
+        Result result = new Result<SysUserDTO>();
+        return result.ok(sysUserDTO);
+    }
 }

main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Filter.java

@@ -11,6 +11,7 @@ import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
 import org.springframework.web.bind.annotation.RequestMethod;
 import xiaozhi.common.constant.Constant;
 import xiaozhi.common.exception.ErrorCode;
+import xiaozhi.common.exception.RenException;
 import xiaozhi.common.utils.HttpContextUtils;
 import xiaozhi.common.utils.JsonUtils;
 import xiaozhi.common.utils.Result;
@@ -89,12 +90,22 @@ public class Oauth2Filter extends AuthenticatingFilter {
      * 获取请求的token
      */
     private String getRequestToken(HttpServletRequest httpRequest) {
+        String token;
         //从header中获取token
-        String token = httpRequest.getHeader(Constant.TOKEN_HEADER);
+        String authorization = httpRequest.getHeader(Constant.AUTHORIZATION);
+        if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+        token = authorization.replace("Bearer ", "");
 
         //如果header中不存在token，则从参数中获取token
         if (StringUtils.isBlank(token)) {
-            token = httpRequest.getParameter(Constant.TOKEN_HEADER);
+            authorization = httpRequest.getParameter(Constant.AUTHORIZATION);
+
+            if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
+                throw new RenException(ErrorCode.UNAUTHORIZED);
+            }
+            token = authorization.replace("Bearer ", "");
         }
         return token;
     }

main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Realm.java

@@ -6,12 +6,15 @@ import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.stereotype.Component;
 import xiaozhi.common.exception.ErrorCode;
 import xiaozhi.common.user.UserDetail;
 import xiaozhi.common.utils.ConvertUtils;
 import xiaozhi.common.utils.MessageUtils;
+import xiaozhi.modules.security.controller.LoginController;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
 import xiaozhi.modules.security.service.ShiroService;
 import xiaozhi.modules.sys.entity.SysUserEntity;
@@ -30,6 +33,8 @@ public class Oauth2Realm extends AuthorizingRealm {
     @Resource
     private ShiroService shiroService;
 
+    private static final Logger logger = LoggerFactory.getLogger(Oauth2Realm.class);
+
     @Override
     public boolean supports(AuthenticationToken token) {
         return token instanceof Oauth2Token;
@@ -82,6 +87,11 @@ public class Oauth2Realm extends AuthorizingRealm {
         userDetail.setToken(accessToken);
 
         //账号锁定
+        if (userDetail.getStatus() == null) {
+            logger.error("账号状态异常，status 不能为空");
+            throw new DisabledAccountException(MessageUtils.getMessage(ErrorCode.ACCOUNT_DISABLE));
+        }
+
         if (userDetail.getStatus() == 0) {
             throw new LockedAccountException(MessageUtils.getMessage(ErrorCode.ACCOUNT_LOCK));
         }

main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java

@@ -1,9 +1,11 @@
 package xiaozhi.modules.security.service;
 
 import xiaozhi.common.page.PageData;
+import xiaozhi.common.page.TokenDTO;
 import xiaozhi.common.service.BaseService;
 import xiaozhi.common.utils.Result;
 import xiaozhi.modules.security.entity.SysUserTokenEntity;
+import xiaozhi.modules.sys.dto.SysUserDTO;
 
 import java.util.Map;
 
@@ -19,7 +21,9 @@ public interface SysUserTokenService extends BaseService<SysUserTokenEntity> {
      *
      * @param userId 用户ID
      */
-    Result createToken(Long userId);
+    Result<TokenDTO> createToken(Long userId);
+
+    SysUserDTO getUserByToken(String token);
 
     /**
      * 退出

main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java

@@ -1,6 +1,9 @@
 package xiaozhi.modules.security.service.impl;
 
 import cn.hutool.core.date.DateUtil;
+import lombok.AllArgsConstructor;
+import xiaozhi.common.exception.ErrorCode;
+import xiaozhi.common.exception.RenException;
 import xiaozhi.common.page.TokenDTO;
 import xiaozhi.common.service.impl.BaseServiceImpl;
 import xiaozhi.common.utils.HttpContextUtils;
@@ -10,18 +13,23 @@ import xiaozhi.modules.security.entity.SysUserTokenEntity;
 import xiaozhi.modules.security.oauth2.TokenGenerator;
 import xiaozhi.modules.security.service.SysUserTokenService;
 import org.springframework.stereotype.Service;
+import xiaozhi.modules.sys.dto.SysUserDTO;
+import xiaozhi.modules.sys.service.SysUserService;
 
 import java.util.Date;
 
+@AllArgsConstructor
 @Service
 public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, SysUserTokenEntity> implements SysUserTokenService {
+
+    private final SysUserService sysUserService;
     /**
      * 12小时后过期
      */
     private final static int EXPIRE = 3600 * 12;
 
     @Override
-    public Result createToken(Long userId) {
+    public Result<TokenDTO> createToken(Long userId) {
         //用户token
         String token;
 
@@ -70,6 +78,20 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
         return new Result().ok(tokenDTO);
     }
 
+    @Override
+    public SysUserDTO getUserByToken(String token) {
+        SysUserTokenEntity userToken = baseDao.getByToken(token);
+
+        Date now = new Date();
+        if (userToken.getExpireDate().before(now)) {
+            throw new RenException(ErrorCode.UNAUTHORIZED);
+        }
+
+        SysUserDTO userDTO = sysUserService.getByUserId(userToken.getUserId());
+        userDTO.setPassword("");
+        return userDTO;
+    }
+
     @Override
     public void logout(Long userId) {
         Date expireDate = DateUtil.offsetMinute(new Date(), -1);

main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java

@@ -12,6 +12,8 @@ public interface SysUserService extends BaseService<SysUserEntity> {
 
     SysUserDTO getByUsername(String username);
 
+    SysUserDTO getByUserId(Long userId);
+
     void save(SysUserDTO dto);
 
     void delete(Long[] ids);

main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java

@@ -41,6 +41,13 @@ public class SysUserServiceImpl extends BaseServiceImpl<SysUserDao, SysUserEntit
         return ConvertUtils.sourceToTarget(entity, SysUserDTO.class);
     }
 
+    @Override
+    public SysUserDTO getByUserId(Long userId) {
+        SysUserEntity sysUserEntity = sysUserDao.selectById(userId);
+
+        return ConvertUtils.sourceToTarget(sysUserEntity, SysUserDTO.class);
+    }
+
     @Override
     @Transactional(rollbackFor = Exception.class)
     public void save(SysUserDTO dto) {

main/manager-web/src/apis/httpRequest.js

@@ -1,6 +1,7 @@
 import {goToPage, showDanger, showWarning} from '../utils/index'
 import Constant from '../utils/constant'
 import Fly from 'flyio/dist/npm/fly';
+import store from '../store/index'
 
 const fly = new Fly()
 // 设置超时
@@ -25,7 +26,7 @@ function sendRequest() {
         _url: '',
         _responseType: undefined, // 新增响应类型字段
         'send'() {
-            this._header.token = localStorage.getItem(Constant.STORAGE_KEY.TOKEN)
+            this._header.Authorization = 'Bearer ' + (JSON.parse(store.getters.getToken)).token
 
             // 打印请求信息
             fly.request(this._url, this._data, {
@@ -43,7 +44,7 @@ function sendRequest() {
                 }
             }).catch((res) => {
                 // 打印失败响应
-                console.log(res)
+                console.log('catch', res)
                 httpHandlerError(res, this._failCallback)
             })
             return this
@@ -97,6 +98,7 @@ function sendRequest() {
  */
 // 在错误处理函数中添加日志
 function httpHandlerError(info, callBack) {
+    console.log('httpHandlerError', info)
     
     /** 请求成功，退出该函数 可以根据项目需求来判断是否请求成功。这里判断的是status为200的时候是成功 */
     let networkError = false

main/manager-web/src/apis/module/user.js

@@ -32,7 +32,7 @@ export default {
     },
     // 获取设备信息
     getHomeList(callback) {
-        RequestService.sendRequest().url(`${getServiceUrl()}/api/v1/user/device/bind`).method('GET')
+        RequestService.sendRequest().url(`${getServiceUrl()}/api/v1/device/bind`).method('GET')
             .success((res) => {
                 RequestService.clearRequestTime()
                 callback(res)

main/manager-web/src/store/index.js

@@ -1,14 +1,26 @@
 import Vue from 'vue'
 import Vuex from 'vuex'
+import Constant from '../utils/constant'
 
 Vue.use(Vuex)
 
 export default new Vuex.Store({
   state: {
+    token: ''
   },
   getters: {
+    getToken(state) {
+      if (!state.token) {
+        state.token = localStorage.getItem('token')
+      }
+      return state.token
+    }
   },
   mutations: {
+    setToken(state, token) {
+      state.token = token
+      localStorage.token = token
+    }
   },
   actions: {
   },

main/manager-web/src/views/home.vue

@@ -27,7 +27,7 @@
             </div>
             <img src="@/assets/home/avatar.png" alt="" style="width: 21px;height: 21px;" />
             <div class="user-info">
-              {{ userInfo.mobile }}
+              {{ userInfo.username }}
             </div>
           </div>
         </div>
@@ -251,7 +251,7 @@ export default {
         label: '双皮奶'
       }],
       userInfo: {
-        mobile: '' // 初始化用户信息
+        username: '' // 初始化用户信息
       }
     };
   },
@@ -331,8 +331,8 @@ export default {
     }
   },
   mounted() {
-    this.fetchUserInfo(); // 组件加载时获取用户信息
+    // this.fetchUserInfo(); // 组件加载时获取用户信息
-    this.getList(); // 初始化设备列表
+    // this.getList(); // 初始化设备列表
   }
 }
 </script>

main/manager-web/src/views/login.vue

@@ -87,18 +87,22 @@ export default {
   },
   methods: {
     fetchCaptcha() {
-      this.captchaUuid = getUUID();
+      if (this.$store.getters.getToken) {
+        goToPage('/home')
+      } else {
+        this.captchaUuid = getUUID();
 
-      Api.user.getCaptcha(this.captchaUuid, (res) => {
+        Api.user.getCaptcha(this.captchaUuid, (res) => {
-        if (res.status === 200) {
+          if (res.status === 200) {
-          const blob = new Blob([res.data], {type: res.data.type});
+            const blob = new Blob([res.data], {type: res.data.type});
-          this.captchaUrl = URL.createObjectURL(blob);
+            this.captchaUrl = URL.createObjectURL(blob);
 
-        } else {
+          } else {
-          console.error('验证码加载异常:', error);
+            console.error('验证码加载异常:', error);
-          showDanger('验证码加载失败，点击刷新')
+            showDanger('验证码加载失败，点击刷新')
-        }
+          }
-      });
+        });
+      }
     },
 
     async login() {
@@ -119,8 +123,12 @@ export default {
       Api.user.login(this.form, ({data}) => {
         console.log(data)
         showSuccess('登陆成功！')
+        
+        this.$store.commit('setToken', JSON.stringify(data.data))
+
         goToPage('/home')
       })
+
       setTimeout(() => {
         this.fetchCaptcha()
       }, 1000)