From c24aa02947b0faf7d08971f83287d23c0af0715e Mon Sep 17 00:00:00 2001
From: Tang Cheng <cheng.tang@supwisdom.com>
Date: Wed, 3 Jul 2019 13:26:34 +0800
Subject: [PATCH] =?utf8?q?=E5=B0=86=20/api/common/version=20=E5=BC=80?=
 =?utf8?q?=E6=94=BE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

---
 src/main/kotlin/com/supwisdom/dlpay/security.kt | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/main/kotlin/com/supwisdom/dlpay/security.kt b/src/main/kotlin/com/supwisdom/dlpay/security.kt
index 5aad561c..a2488e07 100644
--- a/src/main/kotlin/com/supwisdom/dlpay/security.kt
+++ b/src/main/kotlin/com/supwisdom/dlpay/security.kt
@@ -81,7 +81,7 @@ class ApiJwtAuthenticationFilter : OncePerRequestFilter() {
             url = url.replace(context, "")
         }
         logger.info(url)
-        if(!url.startsWith("/api/")&&!url.startsWith("/mobileapi/v1/")){
+        if (!url.startsWith("/api/") && !url.startsWith("/mobileapi/v1/")) {
             filterChain.doFilter(request, response)
             return
         }
@@ -98,7 +98,7 @@ class ApiJwtAuthenticationFilter : OncePerRequestFilter() {
                     return
                 }
                 val claims = getUtil().verifyToken(jwt)
-                if(url.equals("/mobileapi/v1/logout")){
+                if (url.equals("/mobileapi/v1/logout")) {
                     SecurityContextHolder.clearContext()
                     apiJwtRepository.deleteById(claims[ReservedClaimNames.JWT_ID].toString())
                     throw JoseException("JWT has not been register")
@@ -115,11 +115,11 @@ class ApiJwtAuthenticationFilter : OncePerRequestFilter() {
                 }
                 val tenantId = request.getHeader(Constants.HEADER_TETANTID)
                 if (tenantId == null) {
-                    response.status=HttpStatus.UNAUTHORIZED.value()
+                    response.status = HttpStatus.UNAUTHORIZED.value()
                     return
                 }
                 if (claims[Constants.JWT_CLAIM_TENANTID] != tenantId) {
-                    response.status=HttpStatus.UNAUTHORIZED.value()
+                    response.status = HttpStatus.UNAUTHORIZED.value()
                     return
                 }
                 val auth = UsernamePasswordAuthenticationToken(claims[Constants.JWT_CLAIM_UID], null,
@@ -132,12 +132,12 @@ class ApiJwtAuthenticationFilter : OncePerRequestFilter() {
                     // jwt 过期后返回 401
                     apiJwtRepository.deleteById(e.jwtContext.jwtClaims.jwtId)
                 }
-                response.status=HttpStatus.UNAUTHORIZED.value()
+                response.status = HttpStatus.UNAUTHORIZED.value()
                 return
             } catch (e: JoseException) {
                 SecurityContextHolder.clearContext()
                 // jwt 失效后返回 401
-                response.status=HttpStatus.UNAUTHORIZED.value()
+                response.status = HttpStatus.UNAUTHORIZED.value()
                 response.contentType = "application/json;charset=UTF-8"
                 return
             }
@@ -168,6 +168,7 @@ class WebSecurityConfig {
                         .authorizeRequests()
                         .antMatchers("/api/auth/**").permitAll()
                         .antMatchers("/api/notify/**").permitAll()
+                        .antMatchers("/api/common/version").permitAll()
                         .antMatchers("/api/userinfor").hasAnyRole("ADMIN", "THIRD_ADMIN")
                         .antMatchers("/api/common/**").hasAnyRole("THIRD_COMMON", "THIRD_ADMIN")
                         .antMatchers("/api/consume/**").hasRole("THIRD_CONSUME")
@@ -184,6 +185,7 @@ class WebSecurityConfig {
                 return super.authenticationManagerBean()
             }
         }
+
         @Configuration
         @Order(2)
         class MobileApiSecurityConfigurationAdapter : WebSecurityConfigurerAdapter() {
@@ -203,6 +205,7 @@ class WebSecurityConfig {
             override fun configure(auth: AuthenticationManagerBuilder) {
                 auth.authenticationProvider(userProvider())
             }
+
             @Bean
             fun userProvider(): DaoAuthenticationProvider {
                 return DaoAuthenticationProvider().apply {
@@ -288,7 +291,7 @@ class WebSecurityConfig {
                 http.apply(validateCodeSecurityConfig)
                         .and()
                         .authorizeRequests()
-                        .antMatchers("/login", "/login/form","/mobileapi/**").permitAll()
+                        .antMatchers("/login", "/login/form", "/mobileapi/**").permitAll()
                         .antMatchers("/static/**").permitAll()
                         .antMatchers("/code/image").permitAll()
                         .antMatchers("/**").hasAnyRole("USER", "ADMIN")
-- 
2.17.1