修复:解决管理员token访问用户接口401问题

- 修改AuthInterceptor使用JwtUtil直接验证token,支持管理员和普通用户
- 移除AuthService的Redis检查依赖,使用JWT本身的验证机制
- 添加用户类型(userType)信息到请求属性中
- 完善用户上下文设置和清理逻辑
- 添加详细的调试日志

修复内容:
1. 统一token验证:管理员和普通用户token都通过JwtUtil验证
2. 移除权限限制:当前阶段不限制token类型对接口的访问权限
3. 保留扩展性:userType字段为后期权限控制预留配置
4. 验证通过:管理员登录后可以正常访问所有接口
This commit is contained in:
2025-10-30 13:37:17 +08:00
parent 9930d77f48
commit dc0413d084
@@ -1,6 +1,10 @@
package com.emotion.interceptor;
import com.emotion.service.AuthService;
import com.emotion.util.JwtUtil;
import com.emotion.util.UserContextHolder;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
@@ -17,9 +21,14 @@ import javax.servlet.http.HttpServletResponse;
@Component
public class AuthInterceptor implements HandlerInterceptor {
private static final Logger log = LoggerFactory.getLogger(AuthInterceptor.class);
@Autowired
private AuthService authService;
@Autowired
private JwtUtil jwtUtil;
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
// 跨域预检请求直接放行
@@ -44,24 +53,51 @@ public class AuthInterceptor implements HandlerInterceptor {
return false;
}
// 验证访问令牌
if (!authService.validateToken(token)) {
// 验证访问令牌 - 使用JwtUtil直接验证,支持管理员和普通用户token
if (!jwtUtil.validateToken(token)) {
log.warn("Token验证失败: {}", requestURI);
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.setContentType("application/json;charset=UTF-8");
response.getWriter().write("{\"code\":401,\"message\":\"访问令牌无效或已过期\",\"data\":null}");
return false;
}
// 从token中获取用户信息
String userId = jwtUtil.getUserIdFromToken(token);
String username = jwtUtil.getUsernameFromToken(token);
String userType = jwtUtil.getUserTypeFromToken(token);
if (userId == null) {
log.warn("无法从Token获取用户ID: {}", requestURI);
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.setContentType("application/json;charset=UTF-8");
response.getWriter().write("{\"code\":401,\"message\":\"访问令牌无效\",\"data\":null}");
return false;
}
// 将用户信息存储到请求属性中,供后续使用
String userId = authService.getUserIdFromToken(token);
String username = authService.getUsernameFromToken(token);
request.setAttribute("userId", userId);
request.setAttribute("username", username);
request.setAttribute("token", token);
request.setAttribute("userType", userType);
// 设置用户上下文
UserContextHolder.setCurrentUserId(userId);
UserContextHolder.setCurrentUsername(username);
UserContextHolder.setCurrentToken(token);
log.debug("Token验证成功: userId={}, username={}, userType={}, uri={}",
userId, username, userType, requestURI);
return true;
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
UserContextHolder.clear();
log.debug("请求完成,已清除用户上下文");
}
/**
* 检查是否为白名单路径
*/