|
@@ -1,16 +1,5 @@
|
|
|
package cn.com.qmth.examcloud.exchange.config;
|
|
|
|
|
|
-import javax.servlet.http.HttpServletRequest;
|
|
|
-import javax.servlet.http.HttpServletResponse;
|
|
|
-
|
|
|
-import org.apache.commons.lang3.StringUtils;
|
|
|
-import org.apache.logging.log4j.ThreadContext;
|
|
|
-import org.slf4j.Logger;
|
|
|
-import org.slf4j.LoggerFactory;
|
|
|
-import org.springframework.http.HttpStatus;
|
|
|
-import org.springframework.web.servlet.HandlerInterceptor;
|
|
|
-import org.springframework.web.servlet.ModelAndView;
|
|
|
-
|
|
|
import cn.com.qmth.examcloud.api.commons.EnterpriseService;
|
|
|
import cn.com.qmth.examcloud.commons.util.ByteUtil;
|
|
|
import cn.com.qmth.examcloud.commons.util.SHA256;
|
|
@@ -21,6 +10,16 @@ import cn.com.qmth.examcloud.web.enums.HttpServletRequestAttribute;
|
|
|
import cn.com.qmth.examcloud.web.support.ApiInfo;
|
|
|
import cn.com.qmth.examcloud.web.support.ServletUtil;
|
|
|
import cn.com.qmth.examcloud.web.support.StatusResponse;
|
|
|
+import org.apache.commons.lang3.StringUtils;
|
|
|
+import org.apache.logging.log4j.ThreadContext;
|
|
|
+import org.slf4j.Logger;
|
|
|
+import org.slf4j.LoggerFactory;
|
|
|
+import org.springframework.http.HttpStatus;
|
|
|
+import org.springframework.web.servlet.HandlerInterceptor;
|
|
|
+import org.springframework.web.servlet.ModelAndView;
|
|
|
+
|
|
|
+import javax.servlet.http.HttpServletRequest;
|
|
|
+import javax.servlet.http.HttpServletResponse;
|
|
|
|
|
|
/**
|
|
|
* 第三方企业接入
|
|
@@ -31,142 +30,138 @@ import cn.com.qmth.examcloud.web.support.StatusResponse;
|
|
|
*/
|
|
|
public final class EnterpriseAccessInterceptor implements HandlerInterceptor {
|
|
|
|
|
|
- private static final Logger LOG = LoggerFactory.getLogger(EnterpriseAccessInterceptor.class);
|
|
|
-
|
|
|
- @Override
|
|
|
- public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
|
|
|
- Object handler) throws Exception {
|
|
|
- LOG.debug("preHandle... ...");
|
|
|
-
|
|
|
- ApiInfo apiInfo = (ApiInfo) request
|
|
|
- .getAttribute(HttpServletRequestAttribute.$_API_INFO.name());
|
|
|
-
|
|
|
- if (null != apiInfo) {
|
|
|
- Class<?> ctrClass = apiInfo.getBeanType();
|
|
|
- if (!EnterpriseService.class.isAssignableFrom(ctrClass)) {
|
|
|
- return true;
|
|
|
- }
|
|
|
- } else {
|
|
|
- return true;
|
|
|
- }
|
|
|
-
|
|
|
- String appId = request.getHeader("App-Id");
|
|
|
- if (null == appId) {
|
|
|
- appId = request.getHeader("appId");
|
|
|
- }
|
|
|
- if (StringUtils.isBlank(appId)) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "'App-Id'('appId') is blank"),
|
|
|
- response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- String rootOrgId = request.getHeader("Root-Org-Id");
|
|
|
- if (null == rootOrgId) {
|
|
|
- rootOrgId = request.getHeader("rootOrgId");
|
|
|
- }
|
|
|
- if (StringUtils.isBlank(rootOrgId)) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "'Root-Org-Id'('rootOrgId') is blank"),
|
|
|
- response);
|
|
|
- return false;
|
|
|
- }
|
|
|
- Long rootOrgIdLong = null;
|
|
|
- try {
|
|
|
- rootOrgIdLong = Long.parseLong(rootOrgId);
|
|
|
- } catch (Exception e) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(
|
|
|
- new StatusResponse("403", "'Root-Org-Id'('rootOrgId') must be a long"),
|
|
|
- response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- String accessToken = request.getHeader("Access-Token");
|
|
|
- if (null == accessToken) {
|
|
|
- accessToken = request.getHeader("access_token");
|
|
|
- }
|
|
|
- if (StringUtils.isBlank(accessToken)) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(
|
|
|
- new StatusResponse("403", "'Access-Token'('access_token') is blank"), response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- String timestamp = request.getHeader("timestamp");
|
|
|
- if (StringUtils.isBlank(timestamp)) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "'timestamp' is blank"), response);
|
|
|
- return false;
|
|
|
- }
|
|
|
- Long timestampLong = null;
|
|
|
- try {
|
|
|
- timestampLong = Long.parseLong(timestamp);
|
|
|
- } catch (Exception e) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "'timestamp' must be a long"),
|
|
|
- response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- request.setAttribute(HttpServletRequestAttribute.$_ENTERPRISE_ROOT_ORG_ID.name(),
|
|
|
- rootOrgIdLong);
|
|
|
-
|
|
|
- ThirdPartyAccessCacheBean thirdPartyAccessCacheBean = CacheHelper
|
|
|
- .getThirdPartyAccess(rootOrgIdLong, appId);
|
|
|
-
|
|
|
- if (!thirdPartyAccessCacheBean.getHasValue()) {
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "rootOrgId & appId are not supported"),
|
|
|
- response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- if (null != thirdPartyAccessCacheBean.getTimeRange()) {
|
|
|
- long currentTimeMillis = System.currentTimeMillis();
|
|
|
- if (Math.abs(currentTimeMillis - timestampLong) > thirdPartyAccessCacheBean
|
|
|
- .getTimeRange()) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(new StatusResponse("403", "timestamp is out"), response);
|
|
|
- return false;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- String secretKey = thirdPartyAccessCacheBean.getSecretKey();
|
|
|
- String joinStr = StringUtil.join(rootOrgId, appId, timestamp, secretKey);
|
|
|
- byte[] bytes = SHA256.encode(joinStr);
|
|
|
- String hexAscii = ByteUtil.toHexAscii(bytes);
|
|
|
-
|
|
|
- if (!hexAscii.equalsIgnoreCase(accessToken)) {
|
|
|
- // 403
|
|
|
- response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
- ServletUtil.returnJson(
|
|
|
- new StatusResponse("403", "'Access-Token'('access_token') is wrong"), response);
|
|
|
- return false;
|
|
|
- }
|
|
|
-
|
|
|
- ThreadContext.put("CALLER", "ACCESS:" + rootOrgIdLong);
|
|
|
-
|
|
|
- return true;
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
|
|
|
- ModelAndView modelAndView) throws Exception {
|
|
|
- LOG.debug("postHandle... ...");
|
|
|
- }
|
|
|
-
|
|
|
- @Override
|
|
|
- public void afterCompletion(HttpServletRequest request, HttpServletResponse response,
|
|
|
- Object handler, Exception ex) throws Exception {
|
|
|
- LOG.debug("afterCompletion... ...");
|
|
|
- }
|
|
|
+ private static final Logger LOG = LoggerFactory.getLogger(EnterpriseAccessInterceptor.class);
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
|
|
|
+ Object handler) throws Exception {
|
|
|
+
|
|
|
+ ApiInfo apiInfo = (ApiInfo) request
|
|
|
+ .getAttribute(HttpServletRequestAttribute.$_API_INFO.name());
|
|
|
+
|
|
|
+ if (null != apiInfo) {
|
|
|
+ Class<?> ctrClass = apiInfo.getBeanType();
|
|
|
+ if (!EnterpriseService.class.isAssignableFrom(ctrClass)) {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+
|
|
|
+ String appId = request.getHeader("App-Id");
|
|
|
+ if (null == appId) {
|
|
|
+ appId = request.getHeader("appId");
|
|
|
+ }
|
|
|
+ if (StringUtils.isBlank(appId)) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "App-Id is blank"),
|
|
|
+ response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ String rootOrgId = request.getHeader("Root-Org-Id");
|
|
|
+ if (null == rootOrgId) {
|
|
|
+ rootOrgId = request.getHeader("rootOrgId");
|
|
|
+ }
|
|
|
+ if (StringUtils.isBlank(rootOrgId)) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "Root-Org-Id is blank"),
|
|
|
+ response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+ Long rootOrgIdLong = null;
|
|
|
+ try {
|
|
|
+ rootOrgIdLong = Long.parseLong(rootOrgId);
|
|
|
+ } catch (Exception e) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(
|
|
|
+ new StatusResponse("403", "Root-Org-Id must be a number"),
|
|
|
+ response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ String accessToken = request.getHeader("Access-Token");
|
|
|
+ if (null == accessToken) {
|
|
|
+ accessToken = request.getHeader("access_token");
|
|
|
+ }
|
|
|
+ if (StringUtils.isBlank(accessToken)) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(
|
|
|
+ new StatusResponse("403", "Access-Token is blank"), response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ String timestamp = request.getHeader("timestamp");
|
|
|
+ if (StringUtils.isBlank(timestamp)) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "timestamp is blank"), response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+ Long timestampLong = null;
|
|
|
+ try {
|
|
|
+ timestampLong = Long.parseLong(timestamp);
|
|
|
+ } catch (Exception e) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "timestamp must be a number"),
|
|
|
+ response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ request.setAttribute(HttpServletRequestAttribute.$_ENTERPRISE_ROOT_ORG_ID.name(),
|
|
|
+ rootOrgIdLong);
|
|
|
+
|
|
|
+ ThirdPartyAccessCacheBean thirdPartyAccessCacheBean = CacheHelper
|
|
|
+ .getThirdPartyAccess(rootOrgIdLong, appId);
|
|
|
+
|
|
|
+ if (!thirdPartyAccessCacheBean.getHasValue()) {
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "appId not activation"),
|
|
|
+ response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ if (null != thirdPartyAccessCacheBean.getTimeRange()) {
|
|
|
+ long currentTimeMillis = System.currentTimeMillis();
|
|
|
+ if (Math.abs(currentTimeMillis - timestampLong) > thirdPartyAccessCacheBean
|
|
|
+ .getTimeRange()) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(new StatusResponse("403", "timestamp invalid"), response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ String secretKey = thirdPartyAccessCacheBean.getSecretKey();
|
|
|
+ String joinStr = StringUtil.join(rootOrgId, appId, timestamp, secretKey);
|
|
|
+ byte[] bytes = SHA256.encode(joinStr);
|
|
|
+ String hexAscii = ByteUtil.toHexAscii(bytes);
|
|
|
+
|
|
|
+ if (!hexAscii.equalsIgnoreCase(accessToken)) {
|
|
|
+ // 403
|
|
|
+ response.setStatus(HttpStatus.FORBIDDEN.value());
|
|
|
+ ServletUtil.returnJson(
|
|
|
+ new StatusResponse("403", "Access-Token is wrong"), response);
|
|
|
+ return false;
|
|
|
+ }
|
|
|
+
|
|
|
+ ThreadContext.put("CALLER", "ACCESS:" + rootOrgIdLong);
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
|
|
|
+ ModelAndView modelAndView) throws Exception {
|
|
|
+ }
|
|
|
+
|
|
|
+ @Override
|
|
|
+ public void afterCompletion(HttpServletRequest request, HttpServletResponse response,
|
|
|
+ Object handler, Exception ex) throws Exception {
|
|
|
+ }
|
|
|
|
|
|
}
|