权限

boman-gateway/src/main/java/com/boman/gateway/filter/AuthFilter.java

@@ -1,6 +1,7 @@
 package com.boman.gateway.filter;
 
 import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONArray;
 import com.alibaba.fastjson.JSONObject;
 import com.boman.common.core.utils.ServletUtils;
 import com.boman.common.core.utils.StringUtils;
@@ -40,6 +41,10 @@ public class AuthFilter implements GlobalFilter, Ordered {
     private static final Logger log = LoggerFactory.getLogger(AuthFilter.class);
 
     private final static long EXPIRE_TIME = Constants.TOKEN_EXPIRE * 60;
+    private final static String URL_JMREPORT = "/jmreport/";
+    private final static String URL_REPORT = "/report/";
+    /*** 角色表中 role_key ****/
+    private final static String REPORT_ROLE_KEY = "report_manager";
 
     // 排除过滤的 uri 地址，nacos自行添加
     @Autowired
@@ -53,13 +58,14 @@ public class AuthFilter implements GlobalFilter, Ordered {
 
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
-        String url = exchange.getRequest().getURI().getPath();
+        ServerHttpRequest request = exchange.getRequest();
+        String url = request.getURI().getPath();
         // 跳过不需要验证的路径
         if (StringUtils.matches(url, ignoreWhite.getWhites())) {
             return chain.filter(exchange);
         }
 
-        String token = getToken(exchange.getRequest());
+        String token = getToken(request);
         if (StringUtils.isBlank(token)) {
             return setUnauthorizedResponse(exchange, "令牌不能为空");
         }
@@ -77,6 +83,14 @@ public class AuthFilter implements GlobalFilter, Ordered {
             return setUnauthorizedResponse(exchange, "令牌验证失败");
         }
 
+        // 报表的接口重新过滤定义
+        if (url.contains(URL_JMREPORT) || url.contains(URL_REPORT)) {
+            JSONArray roles = obj.getJSONArray("roles");
+            if (!roles.contains(REPORT_ROLE_KEY)) {
+                return setUnauthorizedResponse(exchange, "您无权限，请联系管理员");
+            }
+        }
+
         // 设置过期时间
         redisService.expire(getTokenKey(token), EXPIRE_TIME);
         // 设置用户信息到请求