Visitar URL original
Server:支持 String 类型的 visitorId · Vadin/APIJSON@4993aa4 · GitHub
Skip to content

Commit 4993aa4

Browse files
TommyLemonTommyLemon
committed
Server:支持 String 类型的 visitorId
1 parent de1f1af commit 4993aa4

9 files changed

Lines changed: 81 additions & 65 deletions

File tree

‎APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/DemoObjectParser.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public DemoObjectParser setMethod(RequestMethod method) {
5757
}
5858

5959
@Override
60-
public DemoObjectParser setParser(Parser parser) {
60+
public DemoObjectParser setParser(Parser<?> parser) {
6161
super.setParser(parser);
6262
return this;
6363
}

‎APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/DemoParser.java‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,12 @@
2222
import zuo.biao.apijson.server.AbstractParser;
2323
import zuo.biao.apijson.server.JSONRequest;
2424
import zuo.biao.apijson.server.SQLConfig;
25-
import zuo.biao.apijson.server.SQLExecutor;
26-
import zuo.biao.apijson.server.Verifier;
2725

2826

2927
/**请求解析器
3028
* @author Lemon
3129
*/
32-
public class DemoParser extends AbstractParser {
30+
public class DemoParser extends AbstractParser<Long> {
3331

3432

3533
public DemoParser() {
@@ -46,23 +44,23 @@ public DemoParser(RequestMethod method, boolean noVerify) {
4644
public HttpSession getSession() {
4745
return session;
4846
}
49-
public AbstractParser setSession(HttpSession session) {
47+
public DemoParser setSession(HttpSession session) {
5048
this.session = session;
5149
setVisitor(DemoVerifier.getVisitor(session));
5250
return this;
5351
}
5452

5553

5654
@Override
57-
public Verifier createVerifier() {
55+
public DemoVerifier createVerifier() {
5856
return new DemoVerifier();
5957
}
6058
@Override
61-
public SQLConfig createSQLConfig() {
59+
public DemoSQLConfig createSQLConfig() {
6260
return new DemoSQLConfig();
6361
}
6462
@Override
65-
public SQLExecutor createSQLExecutor() {
63+
public DemoSQLExecutor createSQLExecutor() {
6664
return new DemoSQLExecutor();
6765
}
6866

‎APIJSON-Java-Server/APIJSONDemo/src/main/java/apijson/demo/server/model/User.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
POST = {UNKNOWN, ADMIN},
3030
DELETE = {ADMIN}
3131
)
32-
public class User extends BaseModel implements Visitor {
32+
public class User extends BaseModel implements Visitor<Long> {
3333
private static final long serialVersionUID = 1L;
3434

3535
public static final int SEX_MAIL = 0;

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractObjectParser.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ public abstract class AbstractObjectParser implements ObjectParser {
5252
private static final String TAG = "ObjectParser";
5353

5454
@NotNull
55-
protected Parser parser;
56-
public AbstractObjectParser setParser(Parser parser) {
55+
protected Parser<?> parser;
56+
public AbstractObjectParser setParser(Parser<?> parser) {
5757
this.parser = parser;
5858
return this;
5959
}

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractParser.java‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
/**parser for parsing request to JSONObject
4848
* @author Lemon
4949
*/
50-
public abstract class AbstractParser implements Parser, SQLCreator {
50+
public abstract class AbstractParser<T> implements Parser<T>, SQLCreator {
5151
protected static final String TAG = "AbstractParser";
5252

5353

@@ -76,28 +76,28 @@ public AbstractParser(RequestMethod method, boolean noVerify) {
7676
}
7777

7878
@NotNull
79-
protected Visitor visitor;
79+
protected Visitor<T> visitor;
8080
@NotNull
8181
@Override
82-
public Visitor getVisitor() {
82+
public Visitor<T> getVisitor() {
8383
if (visitor == null) {
84-
visitor = new Visitor() {
84+
visitor = new Visitor<T>() {
8585

8686
@Override
87-
public Long getId() {
88-
return 0L;
87+
public T getId() {
88+
return null;
8989
}
9090

9191
@Override
92-
public List<Long> getContactIdList() {
92+
public List<T> getContactIdList() {
9393
return null;
9494
}
9595
};
9696
}
9797
return visitor;
9898
}
9999
@Override
100-
public AbstractParser setVisitor(@NotNull Visitor visitor) {
100+
public AbstractParser<T> setVisitor(@NotNull Visitor<T> visitor) {
101101
this.visitor = visitor;
102102
return this;
103103
}
@@ -110,7 +110,7 @@ public RequestMethod getMethod() {
110110
}
111111
@NotNull
112112
@Override
113-
public AbstractParser setMethod(RequestMethod method) {
113+
public AbstractParser<T> setMethod(RequestMethod method) {
114114
this.requestMethod = method == null ? GET : method;
115115
return this;
116116
}
@@ -121,25 +121,25 @@ public JSONObject getRequest() {
121121
return requestObject;
122122
}
123123
@Override
124-
public AbstractParser setRequest(JSONObject request) {
124+
public AbstractParser<T> setRequest(JSONObject request) {
125125
this.requestObject = request;
126126
return this;
127127
}
128128

129129

130-
protected Verifier verifier;
130+
protected Verifier<T> verifier;
131131
protected RequestRole globleRole;
132-
public AbstractParser setGlobleRole(RequestRole globleRole) {
132+
public AbstractParser<T> setGlobleRole(RequestRole globleRole) {
133133
this.globleRole = globleRole;
134134
return this;
135135
}
136136
protected String globleDatabase;
137-
public AbstractParser setGlobleDatabase(String globleDatabase) {
137+
public AbstractParser<T> setGlobleDatabase(String globleDatabase) {
138138
this.globleDatabase = globleDatabase;
139139
return this;
140140
}
141141
protected boolean globleFormat;
142-
public AbstractParser setGlobleFormat(Boolean globleFormat) {
142+
public AbstractParser<T> setGlobleFormat(Boolean globleFormat) {
143143
this.globleFormat = globleFormat;
144144
return this;
145145
}
@@ -149,7 +149,7 @@ public boolean isNoVerify() {
149149
return noVerifyLogin && noVerifyRole && noVerifyContent;
150150
}
151151
@Override
152-
public AbstractParser setNoVerify(boolean noVerify) {
152+
public AbstractParser<T> setNoVerify(boolean noVerify) {
153153
setNoVerifyLogin(noVerify);
154154
setNoVerifyRole(noVerify);
155155
setNoVerifyContent(noVerify);
@@ -162,7 +162,7 @@ public boolean isNoVerifyLogin() {
162162
return noVerifyLogin;
163163
}
164164
@Override
165-
public AbstractParser setNoVerifyLogin(boolean noVerifyLogin) {
165+
public AbstractParser<T> setNoVerifyLogin(boolean noVerifyLogin) {
166166
this.noVerifyLogin = noVerifyLogin;
167167
return this;
168168
}
@@ -172,7 +172,7 @@ public boolean isNoVerifyRole() {
172172
return noVerifyRole;
173173
}
174174
@Override
175-
public AbstractParser setNoVerifyRole(boolean noVerifyRole) {
175+
public AbstractParser<T> setNoVerifyRole(boolean noVerifyRole) {
176176
this.noVerifyRole = noVerifyRole;
177177
return this;
178178
}
@@ -182,7 +182,7 @@ public boolean isNoVerifyContent() {
182182
return noVerifyContent;
183183
}
184184
@Override
185-
public AbstractParser setNoVerifyContent(boolean noVerifyContent) {
185+
public AbstractParser<T> setNoVerifyContent(boolean noVerifyContent) {
186186
this.noVerifyContent = noVerifyContent;
187187
return this;
188188
}
@@ -1123,7 +1123,7 @@ public synchronized JSONObject executeSQL(SQLConfig config) throws Exception {
11231123
if (globleRole != null) {
11241124
config.setRole(globleRole);
11251125
} else {
1126-
config.setRole(getVisitor().getId() <= 0 ? RequestRole.UNKNOWN : RequestRole.LOGIN);
1126+
config.setRole(getVisitor().getId() == null ? RequestRole.UNKNOWN : RequestRole.LOGIN);
11271127
}
11281128
}
11291129
verifier.verify(config);

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/AbstractVerifier.java‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,9 @@
5555

5656
/**权限验证
5757
* @author Lemon
58+
* @param <T> id 与 userId 的类型，一般为 Long
5859
*/
59-
public abstract class AbstractVerifier implements Verifier {
60+
public abstract class AbstractVerifier<T> implements Verifier<T> {
6061
private static final String TAG = "AbstractVerifier";
6162

6263

@@ -101,17 +102,23 @@ public static HashMap<RequestMethod, RequestRole[]> getAccessMap(MethodAccess ac
101102

102103

103104
@NotNull
104-
protected Visitor visitor;
105-
protected long visitorId;
105+
protected Visitor<T> visitor;
106+
protected Object visitorId;
106107
@NotNull
107108
@Override
108-
public Visitor getVisitor() {
109+
public Visitor<T> getVisitor() {
109110
return visitor;
110111
}
111112
@Override
112-
public AbstractVerifier setVisitor(Visitor visitor) {
113+
public AbstractVerifier<T> setVisitor(Visitor<T> visitor) {
113114
this.visitor = visitor;
114-
this.visitorId = visitor == null ? 0 : value(visitor.getId());
115+
this.visitorId = visitor == null ? null : visitor.getId();
116+
117+
//导致内部调用且放行校验(noVerifyLogin, noVerifyRole)也抛异常
118+
// if (visitorId == null) {
119+
// throw new NullPointerException(TAG + ".setVisitor visitorId == null !!! 可能导致权限校验失效，引发安全问题！");
120+
// }
121+
115122
return this;
116123
}
117124

@@ -132,21 +139,20 @@ public boolean verify(SQLConfig config) throws Exception {
132139
role = RequestRole.UNKNOWN;
133140
}
134141

135-
//TODO 暂时去掉，方便测试
136142
if (role != RequestRole.UNKNOWN) {//未登录的角色
137143
verifyLogin();
138144
}
139145

140146
RequestMethod method = config.getMethod();
141-
//验证允许的角色
142-
verifyRole(table, method, role);
147+
148+
verifyRole(table, method, role);//验证允许的角色
143149

144150

145151
//验证角色，假定真实强制匹配<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
146152

147153
String visitorIdkey = getVisitorIdKey(config.getTable());
148154

149-
Number requestId;
155+
Object requestId;
150156
switch (role) {
151157
case LOGIN://verifyRole通过就行
152158
break;
@@ -224,16 +230,16 @@ public boolean verify(SQLConfig config) throws Exception {
224230
}
225231
}
226232
else {
227-
requestId = (Number) config.getWhere(visitorIdkey, true);//JSON里数值不能保证是Long，可能是Integer
228-
if (requestId != null && requestId.longValue() != visitorId) {
233+
requestId = config.getWhere(visitorIdkey, true);//JSON里数值不能保证是Long，可能是Integer
234+
if (requestId != null && StringUtil.getString(requestId).equals(StringUtil.getString(visitorId)) == false) {
229235
throw new IllegalAccessException(visitorIdkey + " = " + requestId + " 的 " + table
230236
+ " 不允许 " + role.name() + " 用户的 " + method.name() + " 请求！");
231237
}
232238

233239
config.putWhere(visitorIdkey, visitorId, true);
234240
}
235241
break;
236-
case ADMIN://这里不好做，在特定接口内部判断？ TODO /get/admin + 固定秘钥 Parser#noVerify，之后全局跳过验证
242+
case ADMIN://这里不好做，在特定接口内部判。 可以是 /get/admin + 固定秘钥 Parser#noVerify，之后全局跳过验证
237243
verifyAdmin();
238244
break;
239245
default://unknown，verifyRole通过就行
@@ -284,14 +290,29 @@ public void verifyRole(String table, RequestMethod method, RequestRole role) thr
284290
@Override
285291
public void verifyLogin() throws Exception {
286292
//未登录没有权限操作
287-
if (visitorId <= 0) {
293+
if (visitorId == null) {
288294
throw new NotLoggedInException("未登录，请登录后再操作！");
289295
}
296+
297+
if (visitorId instanceof Number) {
298+
if (((Number) visitorId).longValue() <= 0) {
299+
throw new NotLoggedInException("未登录，请登录后再操作！");
300+
}
301+
}
302+
else if (visitorId instanceof String) {
303+
if (StringUtil.isEmpty(visitorId, true)) {
304+
throw new NotLoggedInException("未登录，请登录后再操作！");
305+
}
306+
}
307+
else {
308+
throw new UnsupportedDataTypeException("visitorId 只能是 Long 或 String 类型！");
309+
}
310+
290311
}
291312

292313
@Override
293314
public void verifyAdmin() throws Exception {
294-
throw new UnsupportedOperationException("不支持 ADMIN 角色！");
315+
throw new UnsupportedOperationException("不支持 ADMIN 角色！如果要支持就在子类重写这个方法来校验 ADMIN 角色，不通过则 throw IllegalAccessException!");
295316
}
296317

297318

@@ -348,8 +369,5 @@ public JSONObject removeAccessInfo(JSONObject requestObject) {
348369
return requestObject;
349370
}
350371

351-
public static long value(Long v) {
352-
return v == null ? 0 : v;
353-
}
354372

355373
}

‎APIJSON-Java-Server/APIJSONLibrary/src/main/java/zuo/biao/apijson/server/Parser.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,38 +23,38 @@
2323
/**解析器
2424
* @author Lemon
2525
*/
26-
public interface Parser {
26+
public interface Parser<T> {
2727

2828
int MAX_QUERY_COUNT = 100;
2929
int MAX_UPDATE_COUNT = 10;
3030

3131

3232
@NotNull
33-
Visitor getVisitor();
34-
Parser setVisitor(@NotNull Visitor visitor);
33+
Visitor<T> getVisitor();
34+
Parser<T> setVisitor(@NotNull Visitor<T> visitor);
3535

3636
@NotNull
3737
RequestMethod getMethod();
38-
Parser setMethod(@NotNull RequestMethod method);
38+
Parser<T> setMethod(@NotNull RequestMethod method);
3939

4040
JSONObject getRequest();
41-
Parser setRequest(JSONObject request);
41+
Parser<T> setRequest(JSONObject request);
4242

4343
boolean isNoVerify();
44-
Parser setNoVerify(boolean noVerify);
44+
Parser<T> setNoVerify(boolean noVerify);
4545

4646
boolean isNoVerifyLogin();
47-
Parser setNoVerifyLogin(boolean noVerifyLogin);
47+
Parser<T> setNoVerifyLogin(boolean noVerifyLogin);
4848

4949
boolean isNoVerifyRole();
50-
Parser setNoVerifyRole(boolean noVerifyRole);
50+
Parser<T> setNoVerifyRole(boolean noVerifyRole);
5151

5252
boolean isNoVerifyContent();
53-
Parser setNoVerifyContent(boolean noVerifyContent);
53+
Parser<T> setNoVerifyContent(boolean noVerifyContent);
5454

5555

5656
@NotNull
57-
Verifier createVerifier();
57+
Verifier<T> createVerifier();
5858

5959
@NotNull
6060
SQLConfig createSQLConfig();

0 commit comments

Comments
 (0)