Merge remote-tracking branch 'origin/master'

mec-auth/mec-auth-api/src/main/java/com/ym/mec/auth/api/entity/LoginEntity.java

@@ -0,0 +1,63 @@
+package com.ym.mec.auth.api.entity;
+
+public class LoginEntity {
+    private String smsCode;
+
+    private String isLessee;
+
+    private String clientId;
+
+    private String clientSecret;
+
+    private String isRegister;
+
+    private String phone;
+
+    public String getIsRegister() {
+        return isRegister;
+    }
+
+    public void setIsRegister(String isRegister) {
+        this.isRegister = isRegister;
+    }
+
+    public String getSmsCode() {
+        return smsCode;
+    }
+
+    public void setSmsCode(String smsCode) {
+        this.smsCode = smsCode;
+    }
+
+    public String getIsLessee() {
+        return isLessee;
+    }
+
+    public void setIsLessee(String isLessee) {
+        this.isLessee = isLessee;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getClientSecret() {
+        return clientSecret;
+    }
+
+    public void setClientSecret(String clientSecret) {
+        this.clientSecret = clientSecret;
+    }
+
+    public String getPhone() {
+        return phone;
+    }
+
+    public void setPhone(String phone) {
+        this.phone = phone;
+    }
+}

mec-auth/mec-auth-server/src/main/java/com/ym/mec/auth/config/WebSecurityConfig.java

@@ -48,7 +48,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 		auth.authenticationProvider(daoAuthenticationProvider());
 		
 		PhoneAuthenticationProvider provider = phoneAuthenticationProvider();
-		provider.setSmsCodeService(smsCodeService);
+		provider.setSysUserService(sysUserService);
 		auth.authenticationProvider(provider);
 	}
 
@@ -100,7 +100,8 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     	PhoneAuthenticationProvider provider = new PhoneAuthenticationProvider();
         // 设置userDetailsService
         provider.setUserDetailsService(defaultUserDetailsService);
-        //provider.setSmsCodeService(smsCodeService);
+        provider.setSmsCodeService(smsCodeService);
+        provider.setSysUserService(sysUserService);
 		// 禁止隐藏用户未找到异常
 		provider.setHideUserNotFoundExceptions(false);
 		
@@ -124,7 +125,6 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 		filter.setAuthenticationSuccessHandler(successEventHandler);
 		filter.setAuthenticationFailureHandler(failureEvenHandler);
 		filter.setSysUserService(sysUserService);
-		filter.setSmsCodeService(smsCodeService);
 		return filter;
 	}
 

mec-auth/mec-auth-server/src/main/java/com/ym/mec/auth/core/filter/PhoneLoginAuthenticationFilter.java

@@ -1,25 +1,26 @@
 package com.ym.mec.auth.core.filter;
 
-import com.ym.mec.auth.api.dto.SysUserInfo;
-import com.ym.mec.auth.config.token.PhoneAuthenticationToken;
-import com.ym.mec.auth.service.SysUserService;
-import com.ym.mec.common.security.SecurityConstants;
-import com.ym.mec.common.service.IdGeneratorService;
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
+import com.ym.mec.auth.api.dto.SysUserInfo;
+import com.ym.mec.auth.api.entity.LoginEntity;
+import com.ym.mec.auth.config.token.PhoneAuthenticationToken;
+import com.ym.mec.auth.service.SysUserService;
+import com.ym.mec.common.security.SecurityConstants;
 
 public class PhoneLoginAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
 
@@ -31,9 +32,8 @@ public class PhoneLoginAuthenticationFilter extends AbstractAuthenticationProces
 
 	private static final String SPRING_SECURITY_RESTFUL_LOGIN_URL = "/smsLogin";
 	private boolean postOnly = true;
-	
+
 	private SysUserService sysUserService;
-	private IdGeneratorService smsCodeService;
 
 	public PhoneLoginAuthenticationFilter() {
 		super(new AntPathRequestMatcher(SPRING_SECURITY_RESTFUL_LOGIN_URL, "POST"));
@@ -50,29 +50,32 @@ public class PhoneLoginAuthenticationFilter extends AbstractAuthenticationProces
 		String principal = obtainParameter(request, SPRING_SECURITY_RESTFUL_PHONE_KEY);
 		String credentials = obtainParameter(request, SPRING_SECURITY_RESTFUL_VERIFY_CODE_KEY);
 		String isRegister = obtainParameter(request, IS_REGISTER_PARAMETER);
-		//是否是租户
+		// 是否是租户
 		String isLessee = obtainParameter(request, IS_LESSEE);
-		// 验证码验证
-		boolean b = smsCodeService.verifyValidCode(StringUtils.substringAfter(principal, SecurityConstants.PHONE_PRINCIPAL_PREFIX), credentials);
-		if(!b) throw new BadCredentialsException("验证码校验失败");
-
-		SysUserInfo userInfo = sysUserService.queryUserInfoByPhone(principal);
 
 		String clientId = request.getParameter(clientIdParameter).toUpperCase();
-		if (userInfo == null) {
-			userInfo = sysUserService.initUser(principal,clientId,isRegister,isLessee);
-		}else if(StringUtils.isNotEmpty(isLessee)){
+
+		SysUserInfo userInfo = sysUserService.queryUserInfoByPhone(principal);
+		if (userInfo != null && StringUtils.isNotEmpty(isLessee)) {
 			throw new LockedException("用户已存在");
 		}
-		if("EDUCATION".equals(clientId)){
+		if ("EDUCATION".equals(clientId)) {
 			clientId = "SYSTEM";
 		}
-		if (!userInfo.getSysUser().getUserType().contains(clientId)) {
+		if (userInfo != null && !userInfo.getSysUser().getUserType().contains(clientId)) {
 			throw new LockedException("用户不存在,请联系教务老师");
 		}
 
 		principal = principal.trim();
-		authRequest = new PhoneAuthenticationToken(SecurityConstants.PHONE_PRINCIPAL_PREFIX + principal, credentials);
+
+		LoginEntity loginEntity = new LoginEntity();
+		loginEntity.setClientId(clientId);
+		loginEntity.setIsLessee(isLessee);
+		loginEntity.setPhone(principal);
+		loginEntity.setSmsCode(credentials);
+		loginEntity.setIsRegister(isRegister);
+
+		authRequest = new PhoneAuthenticationToken(SecurityConstants.PHONE_PRINCIPAL_PREFIX + principal, loginEntity);
 
 		// Allow subclasses to set the "details" property
 		setDetails(request, authRequest);
@@ -83,7 +86,7 @@ public class PhoneLoginAuthenticationFilter extends AbstractAuthenticationProces
 	protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult)
 			throws IOException, ServletException {
 		super.successfulAuthentication(request, response, chain, authResult);
-		//chain.doFilter(request, response);
+		// chain.doFilter(request, response);
 	}
 
 	private void setDetails(HttpServletRequest request, AbstractAuthenticationToken authRequest) {
@@ -99,7 +102,4 @@ public class PhoneLoginAuthenticationFilter extends AbstractAuthenticationProces
 		this.sysUserService = sysUserService;
 	}
 
-	public void setSmsCodeService(IdGeneratorService smsCodeService) {
-		this.smsCodeService = smsCodeService;
-	}
 }

mec-auth/mec-auth-server/src/main/java/com/ym/mec/auth/core/provider/PhoneAuthenticationProvider.java

@@ -1,8 +1,5 @@
 package com.ym.mec.auth.core.provider;
 
-import com.ym.mec.auth.config.token.PhoneAuthenticationToken;
-import com.ym.mec.common.security.SecurityConstants;
-import com.ym.mec.common.service.IdGeneratorService;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.InternalAuthenticationServiceException;
@@ -11,29 +8,53 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.transaction.annotation.Transactional;
+
+import com.ym.mec.auth.api.dto.SysUserInfo;
+import com.ym.mec.auth.api.entity.LoginEntity;
+import com.ym.mec.auth.config.token.PhoneAuthenticationToken;
+import com.ym.mec.auth.service.SysUserService;
+import com.ym.mec.common.security.SecurityConstants;
+import com.ym.mec.common.service.IdGeneratorService;
 
 public class PhoneAuthenticationProvider extends AbstractAuthenticationProvider {
 
 	private UserDetailsService userDetailsService;
 
 	private IdGeneratorService smsCodeService;
+
+	private SysUserService sysUserService;
+
 	@Override
 	protected void additionalAuthenticationChecks(UserDetails userDetails, Authentication authentication) throws AuthenticationException {
+
 		if (authentication.getCredentials() == null) {
 			throw new BadCredentialsException(this.messages.getMessage("PhoneAuthenticationProvider.badCredentials", "Bad credentials"));
-		} else {
-//			String smsCode = authentication.getCredentials().toString();
-
-//			String phone = authentication.getPrincipal().toString();
-
-//			 验证码验证
-//			boolean b = smsCodeService.verifyValidCode(StringUtils.substringAfter(phone, SecurityConstants.PHONE_PRINCIPAL_PREFIX), smsCode);
-//			if(!b) throw new BadCredentialsException("验证码校验失败");
 		}
 	}
 
 	@Override
+	@Transactional(rollbackFor = Exception.class)
 	protected UserDetails retrieveUser(String phone, Authentication authentication) throws AuthenticationException {
+
+		LoginEntity loginEntity = (LoginEntity) authentication.getCredentials();
+		if (loginEntity == null) {
+			throw new BadCredentialsException("Bad credentials");
+		}
+
+		String smsCode = loginEntity.getSmsCode();
+
+		// 验证码验证
+		boolean b = smsCodeService.verifyValidCode(StringUtils.substringAfter(phone, SecurityConstants.PHONE_PRINCIPAL_PREFIX), smsCode);
+		if (!b) {
+			throw new BadCredentialsException("验证码校验失败");
+		}
+
+		SysUserInfo userInfo = sysUserService.queryUserInfoByPhone(loginEntity.getPhone());
+		if (userInfo == null && StringUtils.isNotEmpty(loginEntity.getIsLessee())) {
+			sysUserService.initUser(loginEntity.getPhone(), loginEntity.getClientId(), loginEntity.getIsRegister(), loginEntity.getIsLessee());
+		}
+
 		UserDetails loadedUser;
 		try {
 			loadedUser = userDetailsService.loadUserByUsername(phone);
@@ -66,8 +87,11 @@ public class PhoneAuthenticationProvider extends AbstractAuthenticationProvider
 		this.userDetailsService = userDetailsService;
 	}
 
+	public void setSysUserService(SysUserService sysUserService) {
+		this.sysUserService = sysUserService;
+	}
+
 	public void setSmsCodeService(IdGeneratorService smsCodeService) {
 		this.smsCodeService = smsCodeService;
 	}
-
 }

mec-auth/mec-auth-server/src/main/java/com/ym/mec/auth/service/SysUserService.java

@@ -4,6 +4,7 @@ import com.ym.mec.auth.api.dto.SysUserInfo;
 import com.ym.mec.auth.api.entity.SysUser;
 import com.ym.mec.common.entity.ImUserModel;
 import com.ym.mec.common.service.BaseService;
+import org.springframework.security.core.Authentication;
 
 public interface SysUserService extends BaseService<Integer, SysUser> {
 
@@ -86,8 +87,8 @@ public interface SysUserService extends BaseService<Integer, SysUser> {
 
 	/**
 	 * 获取老师的分部编号
-	 * @param userId
+	 * @param phone
 	 * @return
 	 */
-	Integer getTeacherOrganId(Integer userId);
+	void retrieveUser(String phone, Authentication authentication);
 }

mec-auth/mec-auth-server/src/main/java/com/ym/mec/auth/service/impl/SysUserServiceImpl.java

@@ -1,6 +1,7 @@
 package com.ym.mec.auth.service.impl;
 
 import com.ym.mec.auth.api.dto.SysUserInfo;
+import com.ym.mec.auth.api.entity.LoginEntity;
 import com.ym.mec.auth.api.entity.SysUser;
 import com.ym.mec.auth.api.enums.YesOrNoEnum;
 import com.ym.mec.auth.dal.dao.SysUserDao;
@@ -11,12 +12,16 @@ import com.ym.mec.common.dal.BaseDAO;
 import com.ym.mec.common.entity.ImResult;
 import com.ym.mec.common.entity.ImUserModel;
 import com.ym.mec.common.exception.BizException;
+import com.ym.mec.common.service.IdGeneratorService;
 import com.ym.mec.common.service.impl.BaseServiceImpl;
 import com.ym.mec.im.ImFeignService;
 import com.ym.mec.im.UserFeignService;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.LockedException;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -39,6 +44,10 @@ public class SysUserServiceImpl extends BaseServiceImpl<Integer, SysUser> implem
 	private ImFeignService imFeignService;
 	@Autowired
 	private UserFeignService userFeignService;
+	@Autowired
+	private SysUserService sysUserService;
+	@Autowired
+	private IdGeneratorService smsCodeService;
 
 	@Value("${message.autoRegister}")
 	private boolean autoRegister;
@@ -170,8 +179,24 @@ public class SysUserServiceImpl extends BaseServiceImpl<Integer, SysUser> implem
 	}
 
 	@Override
-	public Integer getTeacherOrganId(Integer userId) {
-		return sysUserDao.getTeacherOrganId(userId);
+	@Transactional(rollbackFor = Exception.class)
+	public void retrieveUser(String phone, Authentication authentication) {
+		LoginEntity loginEntity = (LoginEntity) authentication.getCredentials();
+		SysUserInfo userInfo = sysUserService.queryUserInfoByPhone(loginEntity.getPhone());
+		if (userInfo == null) {
+			userInfo = sysUserService.initUser(loginEntity.getPhone(),loginEntity.getClientId(),loginEntity.getIsRegister(),loginEntity.getIsLessee());
+		}else if(StringUtils.isNotEmpty(loginEntity.getIsLessee())){
+			throw new LockedException("用户已存在");
+		}
+		if("EDUCATION".equals(loginEntity.getClientId())){
+			loginEntity.setClientId("SYSTEM");
+		}
+		if (!userInfo.getSysUser().getUserType().contains(loginEntity.getClientId())) {
+			throw new LockedException("用户不存在,请联系教务老师");
+		}
+//			 验证码验证
+		boolean b = smsCodeService.verifyValidCode(loginEntity.getPhone(), loginEntity.getSmsCode());
+		if(!b) throw new BadCredentialsException("验证码校验失败");
 	}
 
 }

mec-common/common-core/src/main/java/com/ym/mec/common/service/impl/RedisIdGeneratorService.java

@@ -1,8 +1,8 @@
 package com.ym.mec.common.service.impl;
 
-import com.google.common.base.Strings;
-import com.ym.mec.common.redis.service.RedisCache;
-import com.ym.mec.common.service.IdGeneratorService;
+import java.util.Calendar;
+import java.util.Date;
+import java.util.concurrent.TimeUnit;
 
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
@@ -13,9 +13,9 @@ import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.data.redis.core.ValueOperations;
 import org.springframework.stereotype.Service;
 
-import java.util.Calendar;
-import java.util.Date;
-import java.util.concurrent.TimeUnit;
+import com.google.common.base.Strings;
+import com.ym.mec.common.redis.service.RedisCache;
+import com.ym.mec.common.service.IdGeneratorService;
 
 @Service
 public class RedisIdGeneratorService implements IdGeneratorService {
@@ -24,8 +24,11 @@ public class RedisIdGeneratorService implements IdGeneratorService {
 
 	private static final String keyPrefix = "smart";
 
+	private final String defaultPwd = "666666";
+
 	@Autowired
-	private RedisCache<String,Object> redisCache;
+	private RedisCache<String, Object> redisCache;
+
 	@Value("${message.debugMode}")
 	private boolean debugMode;
 
@@ -92,17 +95,20 @@ public class RedisIdGeneratorService implements IdGeneratorService {
 
 	@Override
 	public boolean verifyValidCode(String mobile, String authCode) {
-		if(debugMode){
-			return debugMode;
-		}
-		String key = "verificationCodeSMS_VERIFY_CODE_LOGIN" + mobile;
-		Object object = redisCache.get(key);
-		log.info("*********************mobile:{} smsCode:{} inutCode:{}******************", key, object, authCode);
-		String verifyCode = object == null ? null : object.toString();
-		if(StringUtils.isNoneEmpty(verifyCode) && StringUtils.equalsIgnoreCase(verifyCode,authCode)){
-			return true;
+		if (debugMode) {
+			if (defaultPwd.equals(authCode)) {
+				return true;
+			}
+		} else {
+			String key = "verificationCodeSMS_VERIFY_CODE_LOGIN" + mobile;
+			Object object = redisCache.get(key);
+			log.info("*********************mobile:{} smsCode:{} inutCode:{}******************", key, object, authCode);
+			String verifyCode = object == null ? null : object.toString();
+			if (StringUtils.isNoneEmpty(verifyCode) && StringUtils.equalsIgnoreCase(verifyCode, authCode)) {
+				return true;
+			}
 		}
 		return false;
 	}
-	
+
 }