java 通过 token + filter 自动设置操作人信息

由于项目使用 spring cloud + oauth2 +reids 来认证，每次微服务中需要自己手动代码获取登录用户信息比较麻烦，所以想到统一通过 filter 来实现

步骤如下：

1.定义操作人基本信息接口

IBaseOperator.java

import java.util.Date;

/**
 * 基础操作人信息
 */
public interface IBaseOperator {
    void setOperatedByUserName(String operatedByUserName);
    String getOperatedByUserName();
    void setOperatedOn(Date operatedOn);
    Date getOperatedOn();
}

　　

IOperator.java

package com.dimpt.common.interfaces;

/**
 * 操作人信息
 */
public interface IOperator extends IBaseOperator {
    void setOperatedByUserId(String operatedByUserId);
    String getOperatedByUserId();

    void setOperatedByRealName(String operatedByRealName);
    String getOperatedByRealName();
}

　　2.拦截器

OperaterFilter.java 

import java.io.IOException;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import com.dimpt.common.http.BodyRequestWrapper;
import com.dimpt.common.http.ParameterRequestWrapper;
import com.dimpt.common.interfaces.IOperator;
import com.dimpt.common.security.CustomerUser;
import com.dimpt.common.util.JsonUtils;
import com.dimpt.common.util.components.UserUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;

/**
 * @RequestBody 注解参数中新增 {@link IOperator} 数据
 */
@Component
public class OperaterFilter implements Filter {

    private static final Logger logger = LoggerFactory.getLogger(OperaterFilter.class);

    @Autowired
    UserUtils userUtils;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }


    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {

        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;

        CustomerUser customerUser = userUtils.getCustomerUser();
        if (customerUser != null) {

            CustomerUser.User user = customerUser.getUserDetails();

            //region 设置 ServletRequest 的登录用户参数
            HashMap m = new HashMap(httpServletRequest.getParameterMap());
            m.put("operatedByUserId",user.getUserId());
            m.put("operatedByUserName",user.getUserName());
            m.put("operatedByRealName",user.getName());
            m.put("operatedOn",new Date());
            ParameterRequestWrapper parameterRequestWrapper = new ParameterRequestWrapper(httpServletRequest, m);
            httpServletRequest = parameterRequestWrapper;
            //endregion

            //设置 @RequestBody 的登录用户数据
            BodyRequestWrapper bodyReaderHttpServletRequestWrapper = new BodyRequestWrapper(httpServletRequest);
            String bodyString = bodyReaderHttpServletRequestWrapper.getBodyString();
            if(!StringUtils.isEmpty(bodyString))
            {
                Map bodyMap = JsonUtils.toMap(bodyString);
                bodyMap.put("operatedByUserId",user.getUserId());
                bodyMap.put("operatedByUserName",user.getUserName());
                bodyMap.put("operatedByRealName",user.getName());
                bodyMap.put("operatedOn",new Date());
                String newBodyString = JsonUtils.toString(bodyMap);
                bodyReaderHttpServletRequestWrapper.setBodyString(newBodyString);
                httpServletRequest = bodyReaderHttpServletRequestWrapper;
            }
        }

        filterChain.doFilter(httpServletRequest, servletResponse);
    }


    @Override
    public void destroy() {
    }
}

　　

BodyRequestWrapper.java

import java.io.*;
import java.nio.charset.Charset;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
 * @RequestBody 参数的 HttpServletRequestWrapper
 */
@SuppressWarnings("unchecked")
public class BodyRequestWrapper extends HttpServletRequestWrapper{
    private byte[] body;
    private String bodyString;

    public byte[] getBody() {
        return body;
    }

    public String getBodyString() {
        return bodyString;
    }

    public BodyRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        bodyString = getBodyString(request);
        body = bodyString.getBytes(Charset.forName("UTF-8"));
    }

    /**
     * 获取请求Body
     *
     * @param request
     * @return
     */
    public String getBodyString(final ServletRequest request) {
        StringBuilder sb = new StringBuilder();
        InputStream inputStream = null;
        BufferedReader reader = null;
        try {
            inputStream = cloneInputStream(request.getInputStream());//将获取到的请求参数重新塞入request里面去
            reader = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
            String line = "";
            while ((line = reader.readLine()) != null) {
                sb.append(line);
            }
        }
        catch (IOException e) {
            e.printStackTrace();
        }
        finally {
            if (inputStream != null) {
                try {
                    inputStream.close();
                }
                catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (reader != null) {
                try {
                    reader.close();
                }
                catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        return sb.toString();
    }

    public void setBodyString(String bodyString) throws UnsupportedEncodingException {
        bodyString=bodyString;
        this.body = bodyString.getBytes("UTF-8");
    }

    /**
     * Description: 复制输入流</br>
     *
     * @param inputStream
     * @return</br>
     */
    public InputStream cloneInputStream(ServletInputStream inputStream) {
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        byte[] buffer = new byte[1024];
        int len;
        try {
            while ((len = inputStream.read(buffer)) > -1) {
                byteArrayOutputStream.write(buffer, 0, len);
            }
            byteArrayOutputStream.flush();
        }
        catch (IOException e) {
            e.printStackTrace();
        }
        InputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        return byteArrayInputStream;
    }
    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {

        final ByteArrayInputStream bais = new ByteArrayInputStream(body);

        return new ServletInputStream() {

            @Override
            public int read() throws IOException {
                return bais.read();
            }

            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {
            }
        };
    }
}

　　

ParameterRequestWrapper.java

import java.util.Enumeration;
import java.util.Map;
import java.util.Vector;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
 * HttpServletRequest 参数的 HttpServletRequestWrapper
 */
@SuppressWarnings("unchecked")
public class ParameterRequestWrapper extends HttpServletRequestWrapper
{

    private Map params;

    public ParameterRequestWrapper(HttpServletRequest request, Map newParams)
    {
        super(request);
        this.params = newParams;
    }

    public Map getParameterMap()
    {
        return params;
    }

    public Enumeration getParameterNames()
    {
        Vector l = new Vector(params.keySet());
        return l.elements();
    }

    public String[] getParameterValues(String name)
    {
        Object v = params.get(name);
        if (v == null)
        {
            return null;
        }
        else if (v instanceof String[])
        {
            return (String[])v;
        }
        else if (v instanceof String)
        {
            return new String[] {(String)v};
        }
        else
        {
            return new String[] {v.toString()};
        }
    }

    public String getParameter(String name)
    {
        Object v = params.get(name);
        if (v == null)
        {
            return null;
        }
        else if (v instanceof String[])
        {
            String[] strArr = (String[])v;
            if (strArr.length > 0)
            {
                return strArr[0];
            }
            else
            {
                return null;
            }
        }
        else if (v instanceof String)
        {
            return (String)v;
        }
        else
        {
            return v.toString();
        }
    }
}

　　

CustomerUser.java

import lombok.Getter;
import lombok.Setter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

public class CustomerUser extends User {

    private static final long serialVersionUID = -814031798199130344L;
    /**
     * 登录用户的基本信息
     */
    @Getter
    @Setter
    private User userDetails;

    public CustomerUser(String username, String password, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, authorities);
    }

    public CustomerUser(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    }

    public class User implements Serializable {
        private static final long serialVersionUID = 6253500539624699762L;
        public User(){}
        /**
         * 用户id
         */
        private String userId="";
        /**
         * 用户名，大写
         */
        private String userName="";
        /**
         * 邮箱，大写
         */
        private String email="";
        /**
         * 姓名
         */
        private String name="";
        /**
         * 手机
         */
        private String phone="";
        /**
         * 用户状态
         */
        private int userState;
        /*
         * 性别 0：女  1：男
         */
        private int sex;
        /**
         * 备注
         */
        private String remark;
        /**
         * 用户角色（角色码）
         */
        private List<String> roles = new ArrayList<>();
        /**
         * 用户权限（权限码）
         */
        private List<String> permissions = new ArrayList<>();
        /**
         * 有权访问的系统（系统id）
         */
        private List<String> storeIds = new ArrayList<>();

        public String getUserId() {
            return userId;
        }

        public void setUserId(String userId) {
            this.userId = userId;
        }

        public String getUserName() {
            return userName;
        }

        public void setUserName(String userName) {
            this.userName = userName;
        }

        public String getEmail() {
            return email;
        }

        public void setEmail(String email) {
            this.email = email;
        }

        public String getName() {
            return name;
        }

        public void setName(String name) {
            this.name = name;
        }

        public String getPhone() {
            return phone;
        }

        public void setPhone(String phone) {
            this.phone = phone;
        }

        public int getUserState() {
            return userState;
        }

        public void setUserState(int userState) {
            this.userState = userState;
        }

        public int getSex() {
            return sex;
        }

        public void setSex(int sex) {
            this.sex = sex;
        }

        public String getRemark() {
            return remark;
        }

        public void setRemark(String remark) {
            this.remark = remark;
        }

        public List<String> getRoles() {
            return roles;
        }

        public void setRoles(List<String> roles) {
            this.roles = roles;
        }

        public List<String> getPermissions() {
            return permissions;
        }

        public void setPermissions(List<String> permissions) {
            this.permissions = permissions;
        }

        public List<String> getStoreIds() {
            return storeIds;
        }

        public void setStoreIds(List<String> storeIds) {
            this.storeIds = storeIds;
        }
    }
}

UserUtils.java

import com.dimpt.common.security.CustomerUser;
import com.dimpt.common.util.TokenUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.DependsOn;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.context.request.RequestAttributes;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import javax.servlet.http.HttpServletRequest;

/**
 * @Description
 * @Author 胡俊敏
 * @Date 2019/10/25 15:45
 */
@Component
@DependsOn("tokenStore")
public class UserUtils {

    @Autowired
    private TokenStore tokenStore;

    private String getToken()
    {
        RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
        if(requestAttributes==null)
            return null;
        HttpServletRequest req = ((ServletRequestAttributes) requestAttributes).getRequest();
        return TokenUtils.getToken(req);
    }


    /**
     * 获取授权服务登录的用户信息
     * @return
     */
    public UserDetails getUserDetails()
    {
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(getToken());
        return getUserDetails(oAuth2Authentication);
    }

    /**
     * 获取授权服务登录的用户信息
     * @param token
     * @return
     */
    public UserDetails getUserDetails(OAuth2AccessToken token)
    {
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
        return getUserDetails(oAuth2Authentication);
    }

    /**
     * 获取授权服务登录的用户信息
     * @param token
     * @return
     */
    public UserDetails getUserDetails(String token)
    {
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
        return getUserDetails(oAuth2Authentication);
    }

    /**
     * 获取授权服务登录的用户信息
     * @return
     */
    public CustomerUser getCustomerUser()
    {
        String token = getToken();
        if(StringUtils.isEmpty(token))
            return null;
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
        return getCustomerUser(oAuth2Authentication);
    }

    /**
     * 获取授权服务登录的用户信息
     * @param token
     * @return
     */
    public CustomerUser getCustomerUser(OAuth2AccessToken token)
    {
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
        return getCustomerUser(oAuth2Authentication);
    }

    /**
     * 获取授权服务登录的用户信息
     * @param token
     * @return
     */
    public CustomerUser getCustomerUser(String token)
    {
        OAuth2Authentication oAuth2Authentication = tokenStore.readAuthentication(token);
        return getCustomerUser(oAuth2Authentication);
    }

    /**
     * 根据token获取用户名
     * @param token
     * @return
     */
    public String getUserName(String token)
    {
        UserDetails userDetails = getUserDetails(token);
        if(userDetails==null)
            return null;
        else
            return userDetails.getUsername();
    }

    /**
     * 根据token获取用户名
     * @param token
     * @return
     */
    public String getUserId(String token)
    {
        CustomerUser userDetails = getCustomerUser(token);
        if(userDetails==null)
            return null;
        else
            return userDetails.getUserDetails().getUserId();
    }
    /**
     * 根据token获取用户名
     * @return
     */
    public String getUserName()
    {
        UserDetails userDetails = getUserDetails();
        if(userDetails==null)
            return null;
        else
            return userDetails.getUsername();
    }

    /**
     * 根据token获取用户名
     * @return
     */
    public String getUserId()
    {
        CustomerUser userDetails = getCustomerUser();
        if(userDetails==null)
            return null;
        else
            return userDetails.getUserDetails().getUserId();
    }

    private UserDetails getUserDetails(OAuth2Authentication oAuth2Authentication)
    {
        if(oAuth2Authentication==null) return null;
        return (UserDetails) oAuth2Authentication.getPrincipal();
    }

    private CustomerUser getCustomerUser(OAuth2Authentication oAuth2Authentication)
    {
        if(oAuth2Authentication==null) return null;
        return (CustomerUser) oAuth2Authentication.getPrincipal();
    }
}

　　

UserServiceDetail.java

import com.dimpt.domain.entity.user.UserEntity;
import com.dimpt.domain.enums.UserState;
import com.dimpt.domain.mapper.service.user.UserService;
import com.dimpt.common.security.CustomerUser;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import java.util.*;

/**
 * @Description
 * @Author 胡俊敏
 * @Date 2019/10/24 11:09
 */
@Service
public class UserServiceDetail implements UserDetailsService {

    @Autowired
    private UserService userService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity user = userService.findByUserName(username);

        if (user == null) {
            throw new UsernameNotFoundException(username);
        }

        Set<GrantedAuthority> grantedAuthorities = new HashSet<>();

        
        //role 鉴权
        List<String> roleCodes = userService.findRoleCodes(user.getUserId());
        if(roleCodes!=null &&!roleCodes.isEmpty()) {
            for (String code : roleCodes) {
                //角色必须是ROLE开头
                if (!code.startsWith("{ROLE}")) {
                    code = "{ROLE}_" + code;
                }
                GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(code);
                grantedAuthorities.add(grantedAuthority);
            }
        }
     


        // 可用性 :true:可用 false:不可用
        boolean enabled = true;
        // 过期性 :true:没过期 false:过期
        boolean accountNonExpired = true;
        // 有效性 :true:凭证有效 false:凭证无效
        boolean credentialsNonExpired = true;
        // 锁定性 :true:未锁定 false:已锁定
        boolean accountNonLocked = user.getUserState()== UserState.Active;
        CustomerUser customerUser = new CustomerUser(user.getUserName(),user.getPassWord(),enabled,accountNonExpired,credentialsNonExpired,accountNonLocked,grantedAuthorities);
        //设置 SecurityUser
        CustomerUser.User securityUser = customerUser.new User();
        securityUser.setUserId(user.getUserId());
        securityUser.setUserName(user.getUserName());
        securityUser.setEmail(user.getEmail());
        securityUser.setName(user.getName());
        securityUser.setPhone(user.getPhone());
        securityUser.setSex(user.getSex());
        securityUser.setUserState(user.getUserState().getValue());
        //#TODO
        //设置用户角色
        securityUser.setRoles(Collections.EMPTY_LIST);
        //设置用户权限
        securityUser.setPermissions(Collections.EMPTY_LIST);
        //设置有权限访问的系统
        securityUser.setStoreIds(Collections.EMPTY_LIST);
        customerUser.setUserDetails(securityUser);
        return customerUser;
    }
}

　　

FilterConfig.java

import com.dimpt.common.filter.OperaterFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FilterConfig {
    @Autowired
    private OperaterFilter operatorFilter;

    @Bean
    public FilterRegistrationBean registerOperatorFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(operatorFilter);
        registration.addUrlPatterns("/*");
        registration.setName("operatorFilter");
        registration.setOrder(1);  //值越小，Filter越靠前。
        return registration;
    }
}

　　

BaseOperatorAwareCommand.java

import com.dimpt.common.interfaces.IOperator;
import io.swagger.annotations.ApiModelProperty;
import lombok.Getter;
import lombok.Setter;

import java.util.Date;

/**
 * 携带操作人信息的命令基类
 */
@Getter
@Setter
public abstract class BaseOperatorAwareCommand implements IOperator {

    /**
     * 操作人的用户Id。本字段应根据当前登录用户取值（不应理会前端传入的数据）
     */
    @ApiModelProperty(hidden = true)
    private String operatedByUserId;

    /**
     * 操作人真实姓名。本字段应根据当前登录用户取值（不应理会前端传入的数据）
     */
    @ApiModelProperty(hidden = true)
    private String operatedByRealName;

    /**
     * 操作人用户名。本字段应根据当前登录用户取值（不应理会前端传入的数据）
     */
    @ApiModelProperty(hidden = true)
    private String operatedByUserName;

    /**
     * 操作时间
     */
    @ApiModelProperty(hidden = true)
    private Date operatedOn;
}

　　

DeploymentByResourceCommand.java

import com.dimpt.domain.command.BaseOperatorAwareCommand;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import lombok.Getter;
import lombok.Setter;

@Getter
@Setter
@ApiModel(description= "发布流程")
public class DeploymentByResourceCommand extends BaseOperatorAwareCommand {
    @ApiModelProperty(value = "添加bpmn文件",notes = "必须是 Resource 能识别到的路径",required = true)
    private String bpmpResourcePath;

    @ApiModelProperty(value = "添加png文件",notes = "必须是 Resource 能识别到的路径")
    private String pngResourcePath;

    @ApiModelProperty(value = "流程名称",required = true)
    private String name;
}

　　

具体使用如下：

 @RequestMapping("/deploymentByResource")
    @ApiOperation(value = "发布流程",notes = "项目内部资源文件部署")
    public JsonResult deploymentByResource(@RequestBody DeploymentByResourceCommand command)
    {
        securityUtils.logInAs(command.getOperatedByUserName());

        DeploymentBuilder deploymentBuilder = repositoryService.createDeployment();

        //创建Deployment对象
        deploymentBuilder = deploymentBuilder.addClasspathResource(command.getBpmpResourcePath());

        //添加png文件
        if(!StringUtils.isEmpty(command.getPngResourcePath()))
            deploymentBuilder = deploymentBuilder.addClasspathResource(command.getPngResourcePath());

        //部署
        Deployment deployment = deploymentBuilder.name(command.getName()).deploy();
        return JsonResult.success(deployment);
    }

　　

command.getOperatedByUserName()

command.operatedByUserId()

command.operatedByRealName()

command.getOperatedOn()