Merge branch 'dev/20211117_2.1.4' into test

doc/037.20211117_2.1.4/qc_initv2.1.4.sql

@@ -99,8 +99,9 @@ med_qcresult_cases表新增评分结果主表id字段
 ALTER TABLE `med_qcresult_cases` ADD COLUMN qcresult_info_id BIGINT (20) DEFAULT NULL COMMENT '评分结果id' AFTER `behospital_code`;
 
 -- 全院
-INSERT INTO `sys_menu` ( `is_deleted`, `gmt_create`, `gmt_modified`, `creator`, `modifier`, `name`, `parent_id`, `code`, `show_status`, `maintain_status`, `order_no`, `remark`) VALUES ( 'N', '1970-01-01 12:00:00', '1970-01-01 12:00:00', '0', '0', '数据分析', '-1', 'YH-SJFX', '1', '1', '12', '用户-数据分析');
-SET @id =@@identity;
+SET @id =69;
+INSERT INTO `sys_menu` ( `id`,`is_deleted`, `gmt_create`, `gmt_modified`, `creator`, `modifier`, `name`, `parent_id`, `code`, `show_status`, `maintain_status`, `order_no`, `remark`) VALUES (@id,'N', '1970-01-01 12:00:00', '1970-01-01 12:00:00', '0', '0', '数据分析', '-1', 'YH-SJFX', '1', '1', '12', '用户-数据分析');
+
 
 INSERT INTO `sys_menu` ( `is_deleted`, `gmt_create`, `gmt_modified`, `creator`, `modifier`, `name`, `parent_id`, `code`, `show_status`, `maintain_status`, `order_no`, `remark`) VALUES ( 'N', '1970-01-01 12:00:00', '1970-01-01 12:00:00', '0', '0', '临床质控使用统计', @id , 'YH-ZKK-LCZKSYTJ', '1', '1', '1', '用户-质控科-临床质控使用统计');
 SET @idSec =@@identity;

src/main/java/com/diagbot/config/MyJwtTokenStore.java

@@ -0,0 +1,223 @@
+package com.diagbot.config;
+
+import com.diagbot.util.DateUtil;
+import com.diagbot.util.RedisUtils;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.jwt.Jwt;
+import org.springframework.security.jwt.JwtHelper;
+import org.springframework.security.jwt.crypto.sign.RsaVerifier;
+import org.springframework.security.jwt.crypto.sign.SignatureVerifier;
+import org.springframework.security.oauth2.common.DefaultExpiringOAuth2RefreshToken;
+import org.springframework.security.oauth2.common.DefaultOAuth2AccessToken;
+import org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken;
+import org.springframework.security.oauth2.common.OAuth2AccessToken;
+import org.springframework.security.oauth2.common.OAuth2RefreshToken;
+import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
+import org.springframework.security.oauth2.common.util.JsonParser;
+import org.springframework.security.oauth2.common.util.JsonParserFactory;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.oauth2.provider.approval.Approval;
+import org.springframework.security.oauth2.provider.approval.ApprovalStore;
+import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
+import org.springframework.security.oauth2.provider.token.store.JwtClaimsSetVerifier;
+import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
+import org.springframework.security.oauth2.provider.approval.Approval.ApprovalStatus;
+import org.springframework.util.FileCopyUtils;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Map;
+
+/**
+ * @Description:token续签
+ * @Author songxl
+ * @Date 2021/12/17
+ */
+public class MyJwtTokenStore extends JwtTokenStore {
+    private JwtAccessTokenConverter jwtTokenEnhancer;
+    private ApprovalStore approvalStore;
+    private JsonParser objectMapper = JsonParserFactory.create();
+    private JwtClaimsSetVerifier jwtClaimsSetVerifier = new NoOpJwtClaimsSetVerifier();
+    private SignatureVerifier verifier;
+    private RedisUtils redisUtils;
+    public MyJwtTokenStore(JwtAccessTokenConverter jwtTokenEnhancer,RedisUtils redisUtils) {
+        super(jwtTokenEnhancer);
+        verifier = createVerifier();
+        this.jwtTokenEnhancer = jwtTokenEnhancer;
+        this.redisUtils = redisUtils;
+    }
+
+    private SignatureVerifier createVerifier() {
+        Resource resource = new ClassPathResource("public.cert");
+        String publicKey;
+        try {
+            publicKey = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+        return new RsaVerifier(publicKey);
+    }
+
+    public void setApprovalStore(ApprovalStore approvalStore) {
+        this.approvalStore = approvalStore;
+    }
+
+    public OAuth2Authentication readAuthentication(OAuth2AccessToken token) {
+        return this.readAuthentication(token.getValue());
+    }
+
+
+    public void storeAccessToken(OAuth2AccessToken token, OAuth2Authentication authentication) {
+    }
+
+    public OAuth2AccessToken readAccessToken(String tokenValue) {
+        DefaultOAuth2AccessToken accessToken = (DefaultOAuth2AccessToken) this.convertAccessToken(tokenValue);
+        OAuth2AccessToken newAccessToken = updateTokenOutTime(accessToken);
+        if (this.jwtTokenEnhancer.isRefreshToken(accessToken)) {
+            throw new InvalidTokenException("Encoded token is a refresh token");
+        } else {
+            return newAccessToken;
+        }
+    }
+
+    private OAuth2AccessToken updateTokenOutTime(DefaultOAuth2AccessToken accessToken) {
+        if(accessToken.getAdditionalInformation()!=null&&accessToken.getAdditionalInformation().containsKey("user_id")){
+            //通过用户id获取redis存储的token过期时间
+            Object userIdObj = accessToken.getAdditionalInformation().get("user_id");
+            Integer value =(Integer) redisUtils.get("user:refreshToken:outTime_" + userIdObj);
+            if (value!=null){
+                //更新token过期时间为明天
+                accessToken.setExpiration(DateUtil.addDay(new Date(),1));
+                //将这个时间重新存到redis
+                redisUtils.set("user:refreshToken:outTime_" + userIdObj, value, value);
+            }
+        }
+        return accessToken;
+    }
+
+    private OAuth2AccessToken convertAccessToken(String tokenValue) {
+        return this.jwtTokenEnhancer.extractAccessToken(tokenValue, decode(tokenValue));
+    }
+
+    public void removeAccessToken(OAuth2AccessToken token) {
+    }
+
+    public void storeRefreshToken(OAuth2RefreshToken refreshToken, OAuth2Authentication authentication) {
+    }
+
+    public OAuth2RefreshToken readRefreshToken(String tokenValue) {
+        OAuth2AccessToken encodedRefreshToken = this.convertAccessToken(tokenValue);
+        OAuth2RefreshToken refreshToken = this.createRefreshToken(encodedRefreshToken);
+        if (this.approvalStore != null) {
+            OAuth2Authentication authentication = this.readAuthentication(tokenValue);
+            if (authentication.getUserAuthentication() != null) {
+                String userId = authentication.getUserAuthentication().getName();
+                String clientId = authentication.getOAuth2Request().getClientId();
+                Collection<Approval> approvals = this.approvalStore.getApprovals(userId, clientId);
+                Collection<String> approvedScopes = new HashSet();
+                Iterator var9 = approvals.iterator();
+
+                while(var9.hasNext()) {
+                    Approval approval = (Approval)var9.next();
+                    if (approval.isApproved()) {
+                        approvedScopes.add(approval.getScope());
+                    }
+                }
+
+                if (!approvedScopes.containsAll(authentication.getOAuth2Request().getScope())) {
+                    return null;
+                }
+            }
+        }
+
+        return refreshToken;
+    }
+
+    private OAuth2RefreshToken createRefreshToken(OAuth2AccessToken encodedRefreshToken) {
+        if (!this.jwtTokenEnhancer.isRefreshToken(encodedRefreshToken)) {
+            throw new InvalidTokenException("Encoded token is not a refresh token");
+        } else {
+            return (OAuth2RefreshToken)(encodedRefreshToken.getExpiration() != null ? new DefaultExpiringOAuth2RefreshToken(encodedRefreshToken.getValue(), encodedRefreshToken.getExpiration()) : new DefaultOAuth2RefreshToken(encodedRefreshToken.getValue()));
+        }
+    }
+
+    public OAuth2Authentication readAuthenticationForRefreshToken(OAuth2RefreshToken token) {
+        return this.readAuthentication(token.getValue());
+    }
+
+    public void removeRefreshToken(OAuth2RefreshToken token) {
+        this.remove(token.getValue());
+    }
+
+    public void removeAccessTokenUsingRefreshToken(OAuth2RefreshToken refreshToken) {
+    }
+
+    public OAuth2AccessToken getAccessToken(OAuth2Authentication authentication) {
+        return null;
+    }
+
+    public Collection<OAuth2AccessToken> findTokensByClientIdAndUserName(String clientId, String userName) {
+        return Collections.emptySet();
+    }
+
+    public Collection<OAuth2AccessToken> findTokensByClientId(String clientId) {
+        return Collections.emptySet();
+    }
+
+    public void setTokenEnhancer(JwtAccessTokenConverter tokenEnhancer) {
+        this.jwtTokenEnhancer = tokenEnhancer;
+    }
+
+    private void remove(String token) {
+        if (this.approvalStore != null) {
+            OAuth2Authentication auth = this.readAuthentication(token);
+            String clientId = auth.getOAuth2Request().getClientId();
+            Authentication user = auth.getUserAuthentication();
+            if (user != null) {
+                Collection<Approval> approvals = new ArrayList();
+                Iterator var6 = auth.getOAuth2Request().getScope().iterator();
+
+                while(var6.hasNext()) {
+                    String scope = (String)var6.next();
+                    approvals.add(new Approval(user.getName(), clientId, scope, new Date(), ApprovalStatus.APPROVED));
+                }
+
+                this.approvalStore.revokeApprovals(approvals);
+            }
+        }
+
+    }
+
+    protected Map<String, Object> decode(String token) {
+        try {
+            Jwt jwt = JwtHelper.decodeAndVerify(token,verifier);
+            String claimsStr = jwt.getClaims();
+            Map<String, Object> claims = this.objectMapper.parseMap(claimsStr);
+            if (claims.containsKey("exp") && claims.get("exp") instanceof Integer) {
+                Integer intValue = (Integer)claims.get("exp");
+                claims.put("exp", new Long((long)intValue));
+            }
+
+            jwtClaimsSetVerifier.verify(claims);
+            return claims;
+        } catch (Exception var6) {
+            throw new InvalidTokenException("Cannot convert access token to JSON", var6);
+        }
+    }
+
+
+    private class NoOpJwtClaimsSetVerifier implements JwtClaimsSetVerifier {
+        private NoOpJwtClaimsSetVerifier() {
+        }
+
+        public void verify(Map<String, Object> claims) throws InvalidTokenException {
+        }
+    }
+}

src/main/java/com/diagbot/config/ResourceServerConfigurer.java

@@ -1,5 +1,6 @@
 package com.diagbot.config;
 
+import com.diagbot.util.RedisUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -34,6 +35,8 @@ public class ResourceServerConfigurer extends ResourceServerConfigurerAdapter {
     private AuthExceptionEntryPoint authExceptionEntryPoint;
     @Autowired
     private AccessDeniedExceptionPoint accessDeniedExceptionPoint;
+    @Autowired
+    private RedisUtils redisUtils;
 
     @Override
     public void configure(HttpSecurity http) throws Exception {
@@ -293,7 +296,7 @@ public class ResourceServerConfigurer extends ResourceServerConfigurerAdapter {
     @Override
     public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
         log.info("Configuring ResourceServerSecurityConfigurer");
-        resources.resourceId("user-service").tokenStore(new JwtTokenStore(jwtTokenEnhancerClient()));
+        resources.resourceId("user-service").tokenStore(new MyJwtTokenStore(jwtTokenEnhancerClient(),redisUtils));
         resources.authenticationEntryPoint(authExceptionEntryPoint);
         resources.accessDeniedHandler(accessDeniedExceptionPoint);
     }

src/main/java/com/diagbot/facade/SysDictionaryFacade.java

@@ -61,4 +61,13 @@ public class SysDictionaryFacade extends SysDictionaryInfoServiceImpl {
         return res;
     }
 
+    public long getAccessTokenOutTime() {
+        long accessToken = 24 * 3600*1l;
+        if (getDictionaryWithKey() != null
+                && getDictionaryWithKey().containsKey("31")
+                && getDictionaryWithKey().get("31").containsKey("accessToken")) {
+            accessToken = Long.parseLong(getDictionaryWithKey().get("31").get("accessToken"));
+        }
+        return accessToken;
+    }
 }

src/main/java/com/diagbot/facade/SysUserFacade.java

@@ -215,6 +215,10 @@ public class SysUserFacade extends SysUserServiceImpl {
         jwtStore.setAccessToken(jwt.getAccess_token());
         jwtStore.setRefreshToken(jwt.getRefresh_token());
         tokenFacade.createToken(jwtStore);
+
+        //每次登录在redis缓存该用户登录成功的token；缓存时间为token有效时间
+        long accessTokenTime = sysDictionaryFacade.getAccessTokenOutTime();
+        redisUtils.set("user:refreshToken:outTime_" + user.getId(), accessTokenTime, accessTokenTime);
         /***
          * 未经过MD5加密密码复杂度判断
          */