SpringCloudGateway+Nacos+OAuth2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
/**
 * 拦截所有请求（包括非网关请求）
 *
 * @author youthred.github.io
 */
@Configuration
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.REACTIVE)
// 必须加上组件扫描（Feign客户端）才不会报错"feign.codec.DecodeException: No qualifying bean of type 'org.springframework.boot.autoconfigure.http.HttpMessageConverters' available: expected at least 1 bean which qualifies as autowire candidate. Dependency annotations: {@org.springframework.beans.factory.annotation.Autowired(required=true)}"
@ComponentScan(basePackages = "io.gitghub.youthred.goc.authenticator.client")
@RequiredArgsConstructor
public class ReactiveFilter implements WebFilter, Ordered {

    private final AuthProvider authProvider;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String roles = request.getHeaders().getFirst(CommonConstant.Header.ROLES);
        ServerHttpRequest.Builder mutate = request.mutate();
        mutate.header(CommonConstant.Header.ROLES, roles);
        // roles 不能未空或空字符串
        // （这里也可以使用feign.RequestInterceptor实现全局header自动填写，但WebFlux的请求上下文暂时没搞明白，用它推荐的Context也无法在非控制层获取到Request，在后面的段落会详细说明）
        // R: 响应封装实体，这里省略说明
        // 为了简单说明，这里直接判断请求路径是否有相关角色
        R<Boolean> permit = authProvider.permit(roles, request.getURI().getPath(), request.getMethodValue());
        if (permit.getCode() == HttpStatus.OK.getCode()) {
            return permit.getData()
                    ? chain
                        // 写入header
                        .filter(exchange.mutate().request(mutate.build()).build())
                        // 写入Context上下文
                        .subscriberContext(ctx -> ctx.put(ReactiveRequestContextHolder.CONTEXT_KEY, request))
                    : ServerWebExchangeUtil.forbidden(exchange);
        }
        return ServerWebExchangeUtil.custom(exchange, permit);
    }

    @Override
    public int getOrder() {
        return 0;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
/**
 * Reactive请求上下文
 *
 * @author youthred.github.io
 */
public class ReactiveRequestContextHolder {

    static final Class<ServerHttpRequest> CONTEXT_KEY = ServerHttpRequest.class;

    public static Mono<Context> getContext() {
        return Mono.subscriberContext();
    }

    public static Mono<ServerHttpRequest> getRequest() {
        return Mono.subscriberContext()
                .map(ctx -> ctx.get(CONTEXT_KEY));
    }

    public static Mono<String> getHeader(String headerName) {
        return getRequest().map(request -> request.getHeaders().getFirst(headerName));
    }

    public static Function<Context, Context> clear() {
        return (context) -> context.delete(CONTEXT_KEY);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/**
 * @author youthred.github.io
 */
public class ServerWebExchangeUtil {

    /**
     * forbidden
     *
     * @param exchange ServerWebExchange
     * @return Mono<Void>
     */
    public static Mono<Void> forbidden(ServerWebExchange exchange) {
        ServerHttpResponse response = exchange.getResponse();
        DataBuffer buffer = response.bufferFactory().wrap(JSONUtil.toJsonStr(R.forbidden()).getBytes(StandardCharsets.UTF_8));
        response.setStatusCode(HttpStatus.FORBIDDEN);
        response.getHeaders().add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON);
        return exchange.getResponse().writeWith(Mono.just(buffer));
    }

    /**
     * forbidden
     *
     * @param exchange ServerWebExchange
     * @param r        R
     * @return Mono<Void>
     */
    public static Mono<Void> custom(ServerWebExchange exchange, R r) {
        ServerHttpResponse response = exchange.getResponse();
        DataBuffer buffer = response.bufferFactory().wrap(JSONUtil.toJsonStr(r).getBytes(StandardCharsets.UTF_8));
        response.setStatusCode(HttpStatus.valueOf(r.getCode()));
        response.getHeaders().add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON);
        return exchange.getResponse().writeWith(Mono.just(buffer));
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
@RestController
@RequestMapping("/auth")
@RequiredArgsConstructor
public class AuthenticatorRest {

    private final Authenticator authenticator;

    @GetMapping("/permit")
    public R<Boolean> permit(
            @RequestParam("path") String path,
            @RequestParam("method") String method
    ) {
        return R.ok(authenticator.permit(new RequestDto().setPath(path).setMethod(method)));
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
/**
 * 鉴权器
 *
 * @author youthred.github.io
 */
@Service
@RequiredArgsConstructor
public class Authenticator {

    private static final PathMatcher ANT_PATH_MATCHER = new AntPathMatcher();

    private final RedisService redisService;

    /**
     * 鉴权是否通过
     *
     * @param request ServerHttpRequest
     * @return boolean
     */
    public boolean permit(ServerHttpRequest request) {
        String rolesHeaderValue = request.getHeaders().getFirst(CommonConstant.Header.ROLES);
        return doPermit(rolesHeaderValue, request.getMethodValue(), request.getURI().getPath());
    }

    /**
     * 鉴权是否通过
     *
     * @param roles header roles's value
     * @param dto   RequestDto
     * @return boolean
     */
    public boolean permit(String roles, RequestDto dto) {
        return doPermit(roles, dto.getMethod(), dto.getPath());
    }

    /**
     * 鉴权是否通过
     *
     * @param dto RequestDto
     * @return boolean
     */
    public boolean permit(RequestDto dto) {
        // Servlet环境可以直接从默认Context获取请求
        return doPermit(HttpServletUtil.getHeader(CommonConstant.Header.ROLES), dto.getMethod(), dto.getPath());
    }

    private boolean doPermit(String rolesStr, String methodValue, String path) {
        if (StringUtils.isBlank(rolesStr)) {
            return false;
        }
        // cn.hutool.core.convert.Convert
        List<String> hasRoles = Convert.toList(String.class, rolesStr);
        Map<String, List<String>> permissionMapByMethod = redisService.getPermissionRoleTypesMapByMethod(methodValue);
        if (MapUtils.isNotEmpty(permissionMapByMethod)) {
            for (Map.Entry<String, List<String>> e : permissionMapByMethod.entrySet()) {
                if (ANT_PATH_MATCHER.match(e.getKey(), path)) {
                    List<String> needRoles = e.getValue();
                    return CollUtil.containsAny(hasRoles, needRoles);
                }
            }
        }
        // 404
        return false;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
/**
 * @author youthred.github.io
 */
public class HttpServletUtil {

    public static HttpServletRequest getRequestFromContextHolder() {
        RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
        if (Objects.nonNull(requestAttributes)) {
            return ((ServletRequestAttributes) requestAttributes).getRequest();
        }
        return null;
    }

    public static String getHeader(String headerName) {
        HttpServletRequest request = getRequestFromContextHolder();
        return Objects.nonNull(request)
                // cn.hutool.extra.servlet.ServletUtil
                ? ServletUtil.getHeader(getRequestFromContextHolder(), headerName, StandardCharsets.UTF_8)
                : null;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
/**
 * @author youthred.github.io
 */
@FeignClient(name = "goc-authenticator", path = "/auth", fallback = AuthProvider.AuthProviderFallback.class)
public interface AuthProvider {

    @GetMapping("/permit")
    R<Boolean> permit(
            // 这里放入请求头（鉴权服务上不需要这个参数，直接从请求头获取）
            @RequestHeader(CommonConstant.Header.ROLES) String roles,
            @RequestParam("path") String path,
            @RequestParam("method") String method
    );

    @Component
    class AuthProviderFallback implements AuthProvider {

        @Override
        public R<Boolean> permit(String roles, String path, String method) {
            return R.error(false, "Feign Request Timeout");
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
/**
 * 与WebFlux的请求上下文配合自动传递header
 *
 * @author youthred.github.io
 */
@Component
public class FeignInterceptor implements RequestInterceptor {

    @Override
    public void apply(RequestTemplate requestTemplate) {
        ReactiveRequestContextHolder.getHeader(CommonConstant.Header.ROLES)
                .subscribe(rolesStr ->
                    // 这一句不会执行
                    requestTemplate.header(CommonConstant.Header.ROLES, rolesStr)
                );
    }
}