Repository navigation
Migrate ACL from Sa-Token to Spring Security - #4
Open
willzou2012 wants to merge 1 commit into
Open
willzou2012 wants to merge 1 commit into
willzou2012 wants to merge 1 commit into
Conversation
Summary: Replace Sa-Token authentication and authorization with Spring Security while preserving database tables, permission/role codes, API paths, and response formats. Login now issues opaque server-side tokens with the same expiry, active-timeout, single-session, and forced-logout semantics; @SaCheckPermission/@SaCheckRole become @PreAuthorize hasAuthority/hasRole; the former StpInterface logic moves to BlogUserDetailsService; SaResult, SaTokenDao, and SaFoxUtil are replaced by ServiceResult, ExpiringValueStore, and RandomStringUtil. Also renames two mis-cased permission service files so javac succeeds on Linux. Test Plan: mvn test (JDK 21): 40 tests run, 0 failures. Includes the pre-existing context test plus new unit and end-to-end coverage for token sessions, authority expansion, the filter chain, login/logout/password-change token invalidation, and the temp-token/code services.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate the ACL (authentication + authorization) from Sa-Token to Spring Security. Database tables, permission/role codes, API paths, and response formats are unchanged, so existing clients do not need changes.
What changed
sa-token-spring-boot3-starter→spring-boot-starter-security;sa-token.*properties →app.security.*(token-name,token-timeout, plus the existing active-timeout setting).@SaCheckPermission("x")→@PreAuthorize("hasAuthority('x')"),@SaCheckRole("SUPER_ADMIN")→@PreAuthorize("hasRole('SUPER_ADMIN')"). The 56 distinct permission/role values are identical before and after (verified by diffing the annotation sets).AuthTokenService+TokenAuthenticationFilter, preserving the previous semantics —token:header (Bearer also accepted), 30-day absolute expiry, 2-hour active timeout when "remember me" is off, single-session login, and forced logout on logout/password-change/disable/delete.StpInterfaceimplementation becomesBlogUserDetailsService(UserDetailsService); group + direct grants and parent-permission expansion are unchanged.SaResult→dto/ServiceResult(same code/msg/data semantics),SaTokenDao→ExpiringValueStore(TTL in-memory store for temp tokens/OAuth codes/verification codes),SaFoxUtil→RandomStringUtil,StpUtilcall sites →SecurityUtils, Sa-Token exceptions → SpringAuthenticationException/AccessDeniedExceptionwith the same unified 401/403 JSON bodies.Document/Spring_Security_Migration.mdwith the full mapping; updated the API docs that referenced Sa-Token.permissionService.java/permissionServiceImpl.javato match their public class names — required forjavacon case-sensitive filesystems (Linux), otherwise annotation processing aborts before Lombok runs.Behavior notes
AuthTokenService/ExpiringValueStoreare the seams to swap for Redis if multi-instance deployment is needed.未授权，请先登录(HTTP 401 and bodycodeunchanged).SELECT r.*role query does not populate thesuperAdminflag, so the permissions endpoint relies on group/direct grants as the seeded data does.Test Plan
mvn test(JDK 21): 40 tests run, 0 failures.MyblogDevApplicationTests— pre-existing context test still passes.SpringSecurityMigrationTest(13) — token single-session/expiry, authority expansion (groups, direct, parent, super-admin), filter auth,@PreAuthorizematching,ServiceResultsemantics.SecurityFilterChainTest(6) — unified 401, invalid token, public login/logout, CORS preflight, public endpoints not login-blocked.SecurityEndToEndTest(5, H2 + real tokens) — super-admin 200 on admin monitor, normal user 403, profile and permissions endpoints.AuthTokenGlueTest(6) — login/logout/password-change token issuance and invalidation, admin disable/delete force-logout.AuthTempServicesTest(5),GlobalExceptionHandlerSecurityTest(2),PublicCommentSecurityTest(2).Note: in the sandbox where this was developed,
org.wltea:ik-analyzer:2012_u6is not resolvable from Maven Central, so a local stub of that single class was installed into~/.m2to compile/test. That is an environment workaround only and is not part of this change.