fix(security): 修复登录拦截器中的权限验证问题

@@ -3,4 +3,4 @@ org.gradle.parallel=true
 org.gradle.caching=true
 org.gradle.jvmargs=-Xmx3096m -XX:MaxPermSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8
 org.gradle.configureondemand=true
-org.gradle.java.home=/usr/lib/jvm/java-11-openjdk-amd64
\ No newline at end of file
+#org.gradle.java.home=/usr/lib/jvm/java-11-openjdk-amd64
\ No newline at end of file

@@ -7,7 +7,6 @@ import com.infoloop.tianting.intercepter.LoginInterceptor;
 import com.infoloop.tianting.intercepter.RequestMonitor;
 import com.infoloop.tianting.intercepter.ResourceInjector;
 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient;
-import com.infoloop.tianting.service.client.MeiZhongYiHeServiceClient;
 import com.infoloop.tianting.service.client.OperatorServiceRpcClient;
 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient;
 import com.infoloop.tianting.tracing.HttpTracingInterceptor;
@@ -37,13 +36,12 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         final ResourceInjector resourceInjector,
                         final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient,
                         final OperatorServiceRpcClient operatorServiceRpcClient,
-                        final WOperatorServiceRpcClient wOperatorServiceRpcClient,
-                        final MeiZhongYiHeServiceClient meiZhongYiHeServiceClient) {
+                        final WOperatorServiceRpcClient wOperatorServiceRpcClient) {
         this.httpInterceptors = new ArrayList<>();
         this.httpInterceptors.add(new HttpTracingInterceptor(tracing));
         this.httpInterceptors.add(new RequestMonitor());
         this.httpInterceptors.add(new ApiSignInterceptor());
-        this.httpInterceptors.add(new LoginInterceptor(clientCustomerServiceRpcClient, meiZhongYiHeServiceClient, operatorServiceRpcClient, wOperatorServiceRpcClient));
+        this.httpInterceptors.add(new LoginInterceptor(clientCustomerServiceRpcClient, operatorServiceRpcClient, wOperatorServiceRpcClient));
         this.httpInterceptors.add(resourceInjector);
 
     }

 package com.infoloop.tianting.controller;
 
 import com.github.xiaoymin.knife4j.annotations.ApiSupport;
-import com.infoloop.tianting.model.dto.ClientLabelDTO;
-import com.infoloop.tianting.model.dto.ClientLabelDTO.LabelDto;
 import com.infoloop.tianting.model.dto.KdsDTO;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsMealDetailDto;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderLocationDto;
@@ -10,8 +8,6 @@ import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderSkuDto;
 import com.infoloop.tianting.service.KdsService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
-import java.util.List;
-import javax.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -22,6 +18,9 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 
+import javax.validation.Valid;
+import java.util.List;
+
 @Api(tags = "KDS")
 @ApiSupport(order = -1)
 @Slf4j

@@ -53,7 +53,6 @@ public class PayController {
         return payServiceClient.callback(paymentCallbackDTO);
     }
 
-    @SaIgnore
     @ApiOperation(value = "支付撤销")
     @PostMapping(value = "/pay/cancel")
     @ResponseStatus(HttpStatus.OK)

@@ -34,7 +34,9 @@ public enum ErrorCodeEnum implements BaseEnum {
 
     SKUS_STOCK_NO_ENOUGH_TODAY(406000008, "下单菜品： {0} 库存不足"),
 
-    ORDER_CANCEL(406000009, "订单已自动取消")
+    ORDER_CANCEL(406000009, "订单已自动取消"),
+
+    ORDER_PAY_CANCEL_FAILED(406000010, "支付撤销失败")
     ;
     private final int code;
 

@@ -6,15 +6,13 @@ import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.hutool.core.convert.Convert;
-import com.infoloop.rpc.meizhongyiheservice.HospitalStatus;
-import com.infoloop.tianting.clientcustomerservice.ClientCustomerHospitalRecordHospitalStatusEnum;
 import com.infoloop.tianting.constant.CommonConstants;
 import com.infoloop.tianting.context.LoginContextHolder;
 import com.infoloop.tianting.enums.LoginSourceEnum;
+import com.infoloop.tianting.exception.ClientEndExceptions;
 import com.infoloop.tianting.exception.ErrorCodeEnum;
 import com.infoloop.tianting.model.common.ResponseResult;
 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient;
-import com.infoloop.tianting.service.client.MeiZhongYiHeServiceClient;
 import com.infoloop.tianting.service.client.OperatorServiceRpcClient;
 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient;
 import com.infoloop.tianting.utils.ResponseUtil;
@@ -36,7 +34,6 @@ import java.io.IOException;
 public class LoginInterceptor extends HandlerInterceptorAdapter {
 
     private final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient;
-    private final MeiZhongYiHeServiceClient meiZhongYiHeServiceClient;
     private final OperatorServiceRpcClient operatorServiceRpcClient;
     private final WOperatorServiceRpcClient wOperatorServiceRpcClient;
 
@@ -76,20 +73,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var customer = clientCustomerServiceRpcClient.getClientCustomerById(enterpriseId, loginId);
             if (customer == null) {
                 response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
-            }
-            var record = clientCustomerServiceRpcClient.getClientCustomerHospitalRecordsByCustomerId(customer.getResponse().getEnterpriseId(), customer.getResponse().getId());
-            if (!record.hasResponse() || record.getResponse().getHospitalStatus() != ClientCustomerHospitalRecordHospitalStatusEnum.CURRENT) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
-            }
-            //还需要去读取HIS系统最新用户住院信息
-            final var hisCustomerHospitalRecord = meiZhongYiHeServiceClient.getCustomerDetailById(customer.getResponse().getHISCustomerId(), record.getResponse().getContractNo()).getCustomerHospitalRecord();
-            if (hisCustomerHospitalRecord.getHospitalStatus() != HospitalStatus.CURRENT) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
+                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED));
                 return false;
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(customer.getResponse().getName()).openId(openId).loginSource(LoginSourceEnum.CUSTOMER);
@@ -99,7 +83,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var opeartor = operatorServiceRpcClient.getCOperatorById(loginId);
             if (opeartor == null) {
                 response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
+                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED));
                 return false;
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(opeartor.getName()).loginSource(LoginSourceEnum.OPERATOR);
@@ -108,9 +92,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var loginId = StpUtil.getLoginIdAsInt();
             final var operator = wOperatorServiceRpcClient.getWOperatorById(loginId).getResponse();
             if (operator.getId() == 0) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
+                throw ClientEndExceptions.AuthenticationFailure.build(ErrorCodeEnum.UNAUTHORIZED.name());
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(operator.getName()).loginSource(LoginSourceEnum.KDS);
             return true;

@@ -4,12 +4,13 @@ import com.infoloop.tianting.clientcustomerservice.ClientCustomerHospitalRecordH
 import com.infoloop.tianting.clientcustomerservice.ClientCustomerSexEnum;
 import com.infoloop.tianting.model.dto.MenuDbDTO.MenuDto;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "ClientCustomerDTO")
 public class ClientCustomerDbDTO {

@@ -5,12 +5,12 @@ import com.infoloop.tianting.clientcustomerorderservice.OrderSourceEnum;
 import com.infoloop.tianting.deliveryruleservice.ClientDishLabelStatusEnum;
 import com.infoloop.tianting.deliveryruleservice.ClientLabelTypeEnum;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "标签DTO")
 public class ClientLabelDTO {

@@ -3,11 +3,11 @@ package com.infoloop.tianting.model.dto;
 import com.infoloop.tianting.clientinventoryservice.ClientType;
 import com.infoloop.tianting.clientinventoryservice.CustomerSource;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "院区DTO")
 public class InventoryDbDTO {

@@ -6,13 +6,13 @@ import com.infoloop.tianting.model.dto.InventoryDbDTO.ClientDto;
 import com.infoloop.tianting.model.dto.OrderDbDTO.CustomerDetailDto;
 import com.infoloop.tianting.model.dto.OrderDbDTO.CustomerNotice;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "kds DTO")
 public class KdsDTO {

@@ -2,11 +2,12 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.setmealscheduleservice.MealStatus;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "餐别相关DTO")
 public class MealDbDTO {

@@ -2,14 +2,13 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.clientcustomerorderservice.OrderOperationType;
 import com.infoloop.tianting.clientcustomerorderservice.OrderSourceEnum;
-import com.infoloop.tianting.model.dto.MenuDbDTO.DishRuleJson;
-import com.infoloop.tianting.model.dto.MenuDbDTO.OrderRuleJson;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "操作记录DTO")
 public class OperationDTO {

@@ -2,13 +2,13 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.enums.SettlementDimensionEnum;
 import io.swagger.annotations.ApiModel;
-import java.util.ArrayList;
-import java.util.Map;
 import lombok.Builder;
 import lombok.Data;
 
 import java.time.LocalDateTime;
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 
 @Data
 @ApiModel(description = "统计DTO")

 package com.infoloop.tianting.model.dto;
 
 import io.swagger.annotations.ApiModel;
-import io.swagger.annotations.ApiModelProperty;
-import io.swagger.models.auth.In;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;

 package com.infoloop.tianting.service;
 
 import com.infoloop.tianting.model.dto.CategoryDbDTO.CategoryDto;
+
 import java.util.List;
 
 public interface CategoriesService {

 package com.infoloop.tianting.service;
 
-import com.infoloop.tianting.deliveryruleservice.ClientLabelTypeEnum;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.LabelDto;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.QueryLabelsDto;
+
 import java.util.List;
 
 public interface DeliveryRuleService {

 package com.infoloop.tianting.service;
 
-import com.infoloop.tianting.clientinventoryservice.QueryClientTableCodesByConditionRpcResponse;
 import com.infoloop.tianting.model.dto.InventoryDbDTO.ClientDto;
 import com.infoloop.tianting.model.dto.InventoryDbDTO.ClientTableCodeDto;
 import com.infoloop.tianting.model.dto.InventoryDbDTO.TableCodeQueryConditionDto;
+
 import java.util.List;
 
 public interface InventoryService {

@@ -5,6 +5,7 @@ import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderLocationDto;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderLocationQueryDto;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderSkuDto;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderSkuQueryDto;
+
 import java.util.List;
 
 public interface KdsService {

 package com.infoloop.tianting.service;
 
 import com.infoloop.tianting.model.dto.MealDbDTO.MealDto;
+
 import java.util.List;
 
 public interface MealService {

@@ -2,6 +2,7 @@ package com.infoloop.tianting.service;
 
 import com.infoloop.tianting.model.dto.ClientLabelDTO.HisAllergy;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.HisMedicalAdviceDto;
+
 import java.util.List;
 
 public interface MeiZhongYiHeService {

 package com.infoloop.tianting.service;
 
 import com.infoloop.tianting.model.dto.SettlementDTO.SettlementRequestDto;
+
 import java.io.ByteArrayOutputStream;
 
 public interface SettlementService {

 package com.infoloop.tianting.service;
 
-import com.infoloop.tianting.model.dto.SkuDbDTO.SkuDto;
 import com.infoloop.tianting.model.dto.WxUserDto.WxUserOpenIdDto;
 import com.infoloop.tianting.model.dto.WxUserDto.WxUserPhoneResponseDto;
-import java.util.List;
 
 public interface WxMiniProgramService {
   WxUserOpenIdDto getWxUserOpenIdByCode(String code);

@@ -37,8 +37,6 @@ import com.infoloop.tianting.server.session.UserTypeEnum;
 import com.infoloop.tianting.utils.DateUtil;
 import com.infoloop.tianting.utils.EncryptionUtil;
 import com.infoloop.tianting.utils.JsonUtil;
-import java.net.URLEncoder;
-import java.nio.charset.StandardCharsets;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import okhttp3.OkHttpClient;
@@ -57,6 +55,8 @@ import org.springframework.web.client.RestTemplate;
 
 import java.io.IOException;
 import java.math.BigDecimal;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.text.MessageFormat;
 import java.text.ParseException;
 import java.time.LocalDate;
@@ -373,15 +373,16 @@ public class PayServiceClient {
       //        RequestBody body = RequestBody.create(mediaType, jsonDataString);
 
       String url = businessConfig.getCancelPayUrl() + "?" + "appid=" + appId + "&paycontent=" + payContent + "&signinfo=" + signInfo;
+      log.info("cancel order pay url:" + url);
       Request request =
           new Request.Builder().url(url).get().build();
-
       Response payResponse = client.newCall(request).execute();
       if (payResponse.code() != 200) {
+        log.error("cancel order pay failed, resp http code:" + payResponse.code());
         return false;
       }
       String cancelPayJsonData = payResponse.body().string();
-      log.info("pay json:" + cancelPayJsonData);
+      log.info("cancel order pay resp:" + cancelPayJsonData);
       ObjectMapper objectMapper = new ObjectMapper();
       objectMapper.configure(Feature.ALLOW_MISSING_VALUES, true);
       objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
@@ -391,7 +392,8 @@ public class PayServiceClient {
           objectMapper.readValue(cancelPayJsonData, CancelPayResponseDto.class);
 
       if (payResponseDto.getCode() != 0) {
-        return false;
+        log.error("cancel order pay failed, resp code:" + payResponseDto.getCode());
+        throw ClientEndExceptions.BusinessException.build(ErrorCodeEnum.ORDER_PAY_CANCEL_FAILED);
       } else {
         // 更新订单撤销状态
         final var build =
@@ -404,8 +406,8 @@ public class PayServiceClient {
         return true;
       }
     } catch (Exception e) {
-      log.error(e.getStackTrace().toString());
-      return false;
+      log.error(e.getMessage());
+      throw ClientEndExceptions.BusinessException.build(ErrorCodeEnum.ORDER_PAY_CANCEL_FAILED);
     }
   }
 }

@@ -17,10 +17,8 @@ import com.infoloop.tianting.deliveryruleservice.SingleClientLabelRpcResponse;
 import com.infoloop.tianting.exception.ClientEndExceptions;
 import com.infoloop.tianting.exception.ErrorCodeEnum;
 import com.infoloop.tianting.menuservice.CloseTimeTypeEnum;
-import com.infoloop.tianting.menuservice.SingleClientCustomerMenuRefRpcResponse;
 import com.infoloop.tianting.menuservice.SingleMenuDetailRpcResponse;
 import com.infoloop.tianting.model.common.OrderPageResult;
-import com.infoloop.tianting.model.dto.ClientCustomerDbDTO.CurrentClientCustomerDto;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.HisAllergy;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.HisMedicalAdviceDto;
 import com.infoloop.tianting.model.dto.ClientLabelDTO.QueryLabelsDto;
@@ -54,13 +52,13 @@ import com.infoloop.tianting.service.client.OrderServiceRpcClient;
 import com.infoloop.tianting.service.client.SkuServiceRpcClient;
 import com.infoloop.tianting.utils.DateUtil;
 import com.infoloop.tianting.utils.PageUtil;
-import java.util.Arrays;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -462,8 +460,8 @@ public class OrderServiceImpl implements OrderService {
             final var result = Arrays.stream(keywords)
                 .filter(keyword -> r.getCustomerNoticeJson().getDoctorsList().stream().anyMatch(str -> str.contains(keyword)))
                 .findFirst();
-            if (result != null) {
-                orderNotice.add("医嘱包含" + result);
+            if (result.isPresent()) {
+                orderNotice.add("医嘱包含" + result.get());
             }
             return OrderDto.builder()
                 .id(r.getId())
@@ -541,8 +539,8 @@ public class OrderServiceImpl implements OrderService {
             final var result = Arrays.stream(keywords)
                 .filter(keyword -> r.getCustomerNoticeJson().getDoctorsList().stream().anyMatch(str -> str.contains(keyword)))
                 .findFirst();
-            if (result != null) {
-                orderNotice.add("医嘱包含" + result);
+            if (result.isPresent()) {
+                orderNotice.add("医嘱包含" + result.get());
             }
             return OrderDto.builder()
                 .id(r.getId())

@@ -65,7 +65,7 @@ public class SkuServiceImpl implements SkuService {
                         .efficacyList(sku.getEfficaciesList().stream().map(efficacy -> SkuDetailSingleResponseDto.builder().id(efficacy.getId()).name(efficacy.getName()).build()).collect(
                                 Collectors.toList()))
                         .doctorList(sku.getDoctorsList().stream().map(doctor -> SkuSpecialDetailSingleResponseDto
-                                .builder().id(doctor.getId()).name(doctor.getName()).build()).collect(
+                                .builder().id(doctor.getId()).code(doctor.getCode()).name(doctor.getName()).build()).collect(
                                 Collectors.toList()))
                         .avoidList(sku.getAvoidsList().stream().map(avoid -> SkuDetailSingleResponseDto.builder().id(avoid.getId()).name(avoid.getName()).build()).collect(
                                 Collectors.toList()))