diff --git a/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/advice/ExceptionHandlerAdvice.java b/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/advice/ExceptionHandlerAdvice.java index 45165de..3d65664 100644 --- a/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/advice/ExceptionHandlerAdvice.java +++ b/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/advice/ExceptionHandlerAdvice.java @@ -25,29 +25,24 @@ public class ExceptionHandlerAdvice { @ExceptionHandler(UnauthorizedException.class) @ResponseStatus(HttpStatus.UNAUTHORIZED) public ResponseMap handleUnauthorizedException(Exception e) { - // log.error(ExceptionUtils.getStackTrace(e)); - // log.error(e.getMessage(), e); return ResponseMap.of(HttpStatus.UNAUTHORIZED.value(), e.getMessage()); } @ExceptionHandler(BadRequestException.class) @ResponseStatus(HttpStatus.BAD_REQUEST) public ResponseMap handleBadRequestException(BadRequestException e) { - // log.error(e.getMessage(), e); return ResponseMap.of(HttpStatus.BAD_REQUEST.value(), e.getMessage()); } @ExceptionHandler(ForbiddenException.class) @ResponseStatus(HttpStatus.FORBIDDEN) public ResponseMap handleForbiddenException(ForbiddenException e) { -// log.error(e.getMessage(), e); return ResponseMap.of(HttpStatus.FORBIDDEN.value(), e.getMessage()); } @ExceptionHandler(BindException.class) @ResponseStatus(HttpStatus.BAD_REQUEST) public ResponseMap handleBindException(BindException e) { -// log.error(e.getMessage(), e); return ResponseMap.of(HttpStatus.BAD_REQUEST.value(), e.getAllErrors().stream() .map(DefaultMessageSourceResolvable::getDefaultMessage) @@ -58,7 +53,6 @@ public class ExceptionHandlerAdvice { @ExceptionHandler(TooManyRequestException.class) @ResponseStatus(HttpStatus.TOO_MANY_REQUESTS) public ResponseMap handleTooManyRequestException(TooManyRequestException e) { -// log.error(e.getMessage(), e); return ResponseMap.of(HttpStatus.TOO_MANY_REQUESTS.value(), e.getMessage()); } } diff --git a/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/aop/ProjectAuthorizeAOP.java b/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/aop/ProjectAuthorizeAOP.java index ad76574..ae071d6 100644 --- a/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/aop/ProjectAuthorizeAOP.java +++ b/src/main/java/cn/edu/hfut/rmdjzz/projectmanagement/aop/ProjectAuthorizeAOP.java @@ -48,15 +48,17 @@ public class ProjectAuthorizeAOP { Integer projectAccessLevel = null; if (expression.contains("a")) { // 如果涉及到项目权限 Integer staffId = HttpUtils.getAttribute(attributes, TokenUtils.STAFF_ID); + // 获取路径参数中的projectId Map pathVariables = ((Map) (attributes .getAttribute(HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE, RequestAttributes.SCOPE_REQUEST))); assert pathVariables != null; Integer projectId = Integer.parseInt(pathVariables.get("projectId")); + // 获取项目权限,并将项目权限和项目记录本身放入RequestAttribute中 projectAccessLevel = projectGroupService.getProjectAccessLevel(staffId, globalAccessLevel, projectId); attributes.setAttribute(TokenUtils.PROJECT_ACCESS_LEVEL, projectAccessLevel, RequestAttributes.SCOPE_REQUEST); attributes.setAttribute(TokenUtils.TARGET_PROJECT, projectService.getById(projectId), RequestAttributes.SCOPE_REQUEST); } - // 解析SpEL表达式 + // 解析SpEL表达式,进行鉴权 ExpressionParser parser = new SpelExpressionParser(); Boolean result = parser.parseExpression(expression) .getValue(new ValidateObject(globalAccessLevel, projectAccessLevel), Boolean.class);