jiujian / client-customer-order-api

Go to a project
Toggle navigation Toggle navigation pinning
zhuyifan
07222dd9 1 parent 4d28714b

fix(security): 修复登录拦截器中的权限验证问题

Inline Side-by-side
Showing 1 changed file with 22 additions and 4 deletions
...@@ -6,13 +6,15 @@ import cn.dev33.satoken.exception.SaTokenException; ...@@ -6,13 +6,15 @@ import cn.dev33.satoken.exception.SaTokenException;
6 import cn.dev33.satoken.stp.StpUtil; 6 import cn.dev33.satoken.stp.StpUtil;
7 import cn.dev33.satoken.strategy.SaStrategy; 7 import cn.dev33.satoken.strategy.SaStrategy;
8 import cn.hutool.core.convert.Convert; 8 import cn.hutool.core.convert.Convert;
9 +import com.infoloop.rpc.meizhongyiheservice.HospitalStatus;
10 +import com.infoloop.tianting.clientcustomerservice.ClientCustomerHospitalRecordHospitalStatusEnum;
9 import com.infoloop.tianting.constant.CommonConstants; 11 import com.infoloop.tianting.constant.CommonConstants;
10 import com.infoloop.tianting.context.LoginContextHolder; 12 import com.infoloop.tianting.context.LoginContextHolder;
11 import com.infoloop.tianting.enums.LoginSourceEnum; 13 import com.infoloop.tianting.enums.LoginSourceEnum;
12 -import com.infoloop.tianting.exception.ClientEndExceptions;
13 import com.infoloop.tianting.exception.ErrorCodeEnum; 14 import com.infoloop.tianting.exception.ErrorCodeEnum;
14 import com.infoloop.tianting.model.common.ResponseResult; 15 import com.infoloop.tianting.model.common.ResponseResult;
15 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient; 16 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient;
17 +import com.infoloop.tianting.service.client.MeiZhongYiHeServiceClient;
16 import com.infoloop.tianting.service.client.OperatorServiceRpcClient; 18 import com.infoloop.tianting.service.client.OperatorServiceRpcClient;
17 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient; 19 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient;
18 import com.infoloop.tianting.utils.ResponseUtil; 20 import com.infoloop.tianting.utils.ResponseUtil;
...@@ -34,6 +36,7 @@ import java.io.IOException; ...@@ -34,6 +36,7 @@ import java.io.IOException;
34 public class LoginInterceptor extends HandlerInterceptorAdapter { 36 public class LoginInterceptor extends HandlerInterceptorAdapter {
35 37
36 private final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient; 38 private final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient;
39 + private final MeiZhongYiHeServiceClient meiZhongYiHeServiceClient;
37 private final OperatorServiceRpcClient operatorServiceRpcClient; 40 private final OperatorServiceRpcClient operatorServiceRpcClient;
38 private final WOperatorServiceRpcClient wOperatorServiceRpcClient; 41 private final WOperatorServiceRpcClient wOperatorServiceRpcClient;
39 42
...@@ -73,7 +76,20 @@ public class LoginInterceptor extends HandlerInterceptorAdapter { ...@@ -73,7 +76,20 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
73 final var customer = clientCustomerServiceRpcClient.getClientCustomerById(enterpriseId, loginId); 76 final var customer = clientCustomerServiceRpcClient.getClientCustomerById(enterpriseId, loginId);
74 if (customer == null) { 77 if (customer == null) {
75 response.setStatus(HttpStatus.FORBIDDEN.value()); 78 response.setStatus(HttpStatus.FORBIDDEN.value());
76 - ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED)); 79 + ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
80 + return false;
81 + }
82 + var record = clientCustomerServiceRpcClient.getClientCustomerHospitalRecordsByCustomerId(customer.getResponse().getEnterpriseId(), customer.getResponse().getId());
83 + if (!record.hasResponse() || record.getResponse().getHospitalStatus() != ClientCustomerHospitalRecordHospitalStatusEnum.CURRENT) {
84 + response.setStatus(HttpStatus.FORBIDDEN.value());
85 + ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
86 + return false;
87 + }
88 + //还需要去读取HIS系统最新用户住院信息
89 + final var hisCustomerHospitalRecord = meiZhongYiHeServiceClient.getCustomerDetailById(customer.getResponse().getHISCustomerId(), record.getResponse().getContractNo()).getCustomerHospitalRecord();
90 + if (hisCustomerHospitalRecord.getHospitalStatus() != HospitalStatus.CURRENT) {
91 + response.setStatus(HttpStatus.FORBIDDEN.value());
92 + ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
77 return false; 93 return false;
78 } 94 }
79 builder.id(loginId).enterpriseId(enterpriseId).name(customer.getResponse().getName()).openId(openId).loginSource(LoginSourceEnum.CUSTOMER); 95 builder.id(loginId).enterpriseId(enterpriseId).name(customer.getResponse().getName()).openId(openId).loginSource(LoginSourceEnum.CUSTOMER);
...@@ -83,7 +99,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter { ...@@ -83,7 +99,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
83 final var opeartor = operatorServiceRpcClient.getCOperatorById(loginId); 99 final var opeartor = operatorServiceRpcClient.getCOperatorById(loginId);
84 if (opeartor == null) { 100 if (opeartor == null) {
85 response.setStatus(HttpStatus.FORBIDDEN.value()); 101 response.setStatus(HttpStatus.FORBIDDEN.value());
86 - ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED)); 102 + ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
87 return false; 103 return false;
88 } 104 }
89 builder.id(loginId).enterpriseId(enterpriseId).name(opeartor.getName()).loginSource(LoginSourceEnum.OPERATOR); 105 builder.id(loginId).enterpriseId(enterpriseId).name(opeartor.getName()).loginSource(LoginSourceEnum.OPERATOR);
...@@ -92,7 +108,9 @@ public class LoginInterceptor extends HandlerInterceptorAdapter { ...@@ -92,7 +108,9 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
92 final var loginId = StpUtil.getLoginIdAsInt(); 108 final var loginId = StpUtil.getLoginIdAsInt();
93 final var operator = wOperatorServiceRpcClient.getWOperatorById(loginId).getResponse(); 109 final var operator = wOperatorServiceRpcClient.getWOperatorById(loginId).getResponse();
94 if (operator.getId() == 0) { 110 if (operator.getId() == 0) {
95 - throw ClientEndExceptions.AuthenticationFailure.build(ErrorCodeEnum.UNAUTHORIZED.name()); 111 + response.setStatus(HttpStatus.FORBIDDEN.value());
112 + ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
113 + return false;
96 } 114 }
97 builder.id(loginId).enterpriseId(enterpriseId).name(operator.getName()).loginSource(LoginSourceEnum.KDS); 115 builder.id(loginId).enterpriseId(enterpriseId).name(operator.getName()).loginSource(LoginSourceEnum.KDS);
98 return true; 116 return true;
......