fix(security): 修复登录拦截器中的权限验证问题

@@ -3,4 +3,4 @@ org.gradle.parallel=true
 org.gradle.caching=true
 org.gradle.jvmargs=-Xmx3096m -XX:MaxPermSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8
 org.gradle.configureondemand=true
-org.gradle.java.home=/usr/lib/jvm/java-11-openjdk-amd64
\ No newline at end of file
+#org.gradle.java.home=/usr/lib/jvm/java-11-openjdk-amd64
\ No newline at end of file

@@ -7,7 +7,6 @@ import com.infoloop.tianting.intercepter.LoginInterceptor;
 import com.infoloop.tianting.intercepter.RequestMonitor;
 import com.infoloop.tianting.intercepter.ResourceInjector;
 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient;
-import com.infoloop.tianting.service.client.MeiZhongYiHeServiceClient;
 import com.infoloop.tianting.service.client.OperatorServiceRpcClient;
 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient;
 import com.infoloop.tianting.tracing.HttpTracingInterceptor;
@@ -37,13 +36,12 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         final ResourceInjector resourceInjector,
                         final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient,
                         final OperatorServiceRpcClient operatorServiceRpcClient,
-                        final WOperatorServiceRpcClient wOperatorServiceRpcClient,
-                        final MeiZhongYiHeServiceClient meiZhongYiHeServiceClient) {
+                        final WOperatorServiceRpcClient wOperatorServiceRpcClient) {
         this.httpInterceptors = new ArrayList<>();
         this.httpInterceptors.add(new HttpTracingInterceptor(tracing));
         this.httpInterceptors.add(new RequestMonitor());
         this.httpInterceptors.add(new ApiSignInterceptor());
-        this.httpInterceptors.add(new LoginInterceptor(clientCustomerServiceRpcClient, meiZhongYiHeServiceClient, operatorServiceRpcClient, wOperatorServiceRpcClient));
+        this.httpInterceptors.add(new LoginInterceptor(clientCustomerServiceRpcClient, operatorServiceRpcClient, wOperatorServiceRpcClient));
         this.httpInterceptors.add(resourceInjector);
 
     }

 package com.infoloop.tianting.controller;
 
 import com.github.xiaoymin.knife4j.annotations.ApiSupport;
-import com.infoloop.tianting.model.dto.ClientLabelDTO;
-import com.infoloop.tianting.model.dto.ClientLabelDTO.LabelDto;
 import com.infoloop.tianting.model.dto.KdsDTO;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsMealDetailDto;
 import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderLocationDto;
@@ -10,8 +8,6 @@ import com.infoloop.tianting.model.dto.KdsDTO.KdsOrderSkuDto;
 import com.infoloop.tianting.service.KdsService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
-import java.util.List;
-import javax.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -22,6 +18,9 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 
+import javax.validation.Valid;
+import java.util.List;
+
 @Api(tags = "KDS")
 @ApiSupport(order = -1)
 @Slf4j

@@ -53,7 +53,6 @@ public class PayController {
         return payServiceClient.callback(paymentCallbackDTO);
     }
 
-    @SaIgnore
     @ApiOperation(value = "支付撤销")
     @PostMapping(value = "/pay/cancel")
     @ResponseStatus(HttpStatus.OK)

@@ -34,7 +34,9 @@ public enum ErrorCodeEnum implements BaseEnum {
 
     SKUS_STOCK_NO_ENOUGH_TODAY(406000008, "下单菜品： {0} 库存不足"),
 
-    ORDER_CANCEL(406000009, "订单已自动取消")
+    ORDER_CANCEL(406000009, "订单已自动取消"),
+
+    ORDER_PAY_CANCEL_FAILED(406000010, "支付撤销失败")
     ;
     private final int code;
 

@@ -6,15 +6,13 @@ import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.hutool.core.convert.Convert;
-import com.infoloop.rpc.meizhongyiheservice.HospitalStatus;
-import com.infoloop.tianting.clientcustomerservice.ClientCustomerHospitalRecordHospitalStatusEnum;
 import com.infoloop.tianting.constant.CommonConstants;
 import com.infoloop.tianting.context.LoginContextHolder;
 import com.infoloop.tianting.enums.LoginSourceEnum;
+import com.infoloop.tianting.exception.ClientEndExceptions;
 import com.infoloop.tianting.exception.ErrorCodeEnum;
 import com.infoloop.tianting.model.common.ResponseResult;
 import com.infoloop.tianting.service.client.ClientCustomerServiceRpcClient;
-import com.infoloop.tianting.service.client.MeiZhongYiHeServiceClient;
 import com.infoloop.tianting.service.client.OperatorServiceRpcClient;
 import com.infoloop.tianting.service.client.WOperatorServiceRpcClient;
 import com.infoloop.tianting.utils.ResponseUtil;
@@ -36,7 +34,6 @@ import java.io.IOException;
 public class LoginInterceptor extends HandlerInterceptorAdapter {
 
     private final ClientCustomerServiceRpcClient clientCustomerServiceRpcClient;
-    private final MeiZhongYiHeServiceClient meiZhongYiHeServiceClient;
     private final OperatorServiceRpcClient operatorServiceRpcClient;
     private final WOperatorServiceRpcClient wOperatorServiceRpcClient;
 
@@ -76,20 +73,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var customer = clientCustomerServiceRpcClient.getClientCustomerById(enterpriseId, loginId);
             if (customer == null) {
                 response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
-            }
-            var record = clientCustomerServiceRpcClient.getClientCustomerHospitalRecordsByCustomerId(customer.getResponse().getEnterpriseId(), customer.getResponse().getId());
-            if (!record.hasResponse() || record.getResponse().getHospitalStatus() != ClientCustomerHospitalRecordHospitalStatusEnum.CURRENT) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
-            }
-            //还需要去读取HIS系统最新用户住院信息
-            final var hisCustomerHospitalRecord = meiZhongYiHeServiceClient.getCustomerDetailById(customer.getResponse().getHISCustomerId(), record.getResponse().getContractNo()).getCustomerHospitalRecord();
-            if (hisCustomerHospitalRecord.getHospitalStatus() != HospitalStatus.CURRENT) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
+                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED));
                 return false;
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(customer.getResponse().getName()).openId(openId).loginSource(LoginSourceEnum.CUSTOMER);
@@ -99,7 +83,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var opeartor = operatorServiceRpcClient.getCOperatorById(loginId);
             if (opeartor == null) {
                 response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
+                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.VALIDATE_FAILED));
                 return false;
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(opeartor.getName()).loginSource(LoginSourceEnum.OPERATOR);
@@ -108,9 +92,7 @@ public class LoginInterceptor extends HandlerInterceptorAdapter {
             final var loginId = StpUtil.getLoginIdAsInt();
             final var operator = wOperatorServiceRpcClient.getWOperatorById(loginId).getResponse();
             if (operator.getId() == 0) {
-                response.setStatus(HttpStatus.FORBIDDEN.value());
-                ResponseUtil.write(response, ResponseResult.failed(ErrorCodeEnum.FORBIDDEN));
-                return false;
+                throw ClientEndExceptions.AuthenticationFailure.build(ErrorCodeEnum.UNAUTHORIZED.name());
             }
             builder.id(loginId).enterpriseId(enterpriseId).name(operator.getName()).loginSource(LoginSourceEnum.KDS);
             return true;

@@ -4,12 +4,13 @@ import com.infoloop.tianting.clientcustomerservice.ClientCustomerHospitalRecordH
 import com.infoloop.tianting.clientcustomerservice.ClientCustomerSexEnum;
 import com.infoloop.tianting.model.dto.MenuDbDTO.MenuDto;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "ClientCustomerDTO")
 public class ClientCustomerDbDTO {

@@ -5,12 +5,12 @@ import com.infoloop.tianting.clientcustomerorderservice.OrderSourceEnum;
 import com.infoloop.tianting.deliveryruleservice.ClientDishLabelStatusEnum;
 import com.infoloop.tianting.deliveryruleservice.ClientLabelTypeEnum;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "标签DTO")
 public class ClientLabelDTO {

@@ -3,11 +3,11 @@ package com.infoloop.tianting.model.dto;
 import com.infoloop.tianting.clientinventoryservice.ClientType;
 import com.infoloop.tianting.clientinventoryservice.CustomerSource;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "院区DTO")
 public class InventoryDbDTO {

@@ -6,13 +6,13 @@ import com.infoloop.tianting.model.dto.InventoryDbDTO.ClientDto;
 import com.infoloop.tianting.model.dto.OrderDbDTO.CustomerDetailDto;
 import com.infoloop.tianting.model.dto.OrderDbDTO.CustomerNotice;
 import io.swagger.annotations.ApiModel;
-import io.swagger.models.auth.In;
-import java.util.List;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "kds DTO")
 public class KdsDTO {

@@ -2,11 +2,12 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.setmealscheduleservice.MealStatus;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "餐别相关DTO")
 public class MealDbDTO {

@@ -2,14 +2,13 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.clientcustomerorderservice.OrderOperationType;
 import com.infoloop.tianting.clientcustomerorderservice.OrderSourceEnum;
-import com.infoloop.tianting.model.dto.MenuDbDTO.DishRuleJson;
-import com.infoloop.tianting.model.dto.MenuDbDTO.OrderRuleJson;
 import io.swagger.annotations.ApiModel;
-import java.util.List;
 import lombok.Builder;
 import lombok.Data;
 import lombok.ToString;
 
+import java.util.List;
+
 @Data
 @ApiModel(description = "操作记录DTO")
 public class OperationDTO {

@@ -2,13 +2,13 @@ package com.infoloop.tianting.model.dto;
 
 import com.infoloop.tianting.enums.SettlementDimensionEnum;
 import io.swagger.annotations.ApiModel;
-import java.util.ArrayList;
-import java.util.Map;
 import lombok.Builder;
 import lombok.Data;
 
 import java.time.LocalDateTime;
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 
 @Data
 @ApiModel(description = "统计DTO")

 package com.infoloop.tianting.model.dto;
 
 import io.swagger.annotations.ApiModel;
-import io.swagger.annotations.ApiModelProperty;
-import io.swagger.models.auth.In;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;