b2894lxlx/tuanwei-java
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge: spec58/integration（带进 #59 schema 与已合并的集成顶部）

Browse Source
This commit is contained in:
weicw
2026-11-03 22:29:27 +08:00
parent 11f0f90f7a 58b09b029a
commit 02b2e4b56b
12 changed files with 1120 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/gxwebsoft/common/core/security/FileAccessRules.java
+157
View File
@@ -0,0 +1,157 @@
package com.gxwebsoft.common.core.security;
import cn.hutool.core.util.StrUtil;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import org.springframework.util.AntPathMatcher;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
/**
* 文件访问规则：{@code /api/file/**} 下哪些路径可以匿名读取。
*
* <p>改造前整段 {@code GET /api/file/**} 都是 {@code permitAll}，盖章证明材料
* 这类私人文件可以被未登录者按 URL 直接取走。现在按三类动作分开：
* <ul>
* <li>下载 {@code /api/file/download/**}：一律需要登录——"取走原件"不再是匿名动作；</li>
* <li>内联预览 {@code /api/file/{dir}/{name}} 与缩略图 {@code /api/file/thumbnail/**}：
* 默认公开（{@code file.public-preview=true}），否则现有公开页面的配图会整片变成需要 token；</li>
* <li>其余文件接口：默认需要登录；命中 {@code file.public-dirs} 的目录额外公开。</li>
* </ul>
*
* <p>规则以字符串模式产出，交给 {@link SecurityConfig} 注册；类本身不碰请求，
* 因此可以在单元测试里直接验证。
*
* @author Codex
* @since 2026-11-03
*/
@Component
public class FileAccessRules {
/**
* 文件接口统一前缀
*/
public static final String FILE_PATH_PREFIX = "/api/file";
/**
* 下载接口模式：永远需要登录
*/
private static final String DOWNLOAD_PATTERN = FILE_PATH_PREFIX + "/download/**";
/**
* 内联预览模式：{@code /api/file/{dir}/{name}}，正好两段，不会匹配 download/thumbnail（三段）
*/
private static final String PREVIEW_PATTERN = FILE_PATH_PREFIX + "/*/*";
/**
* 缩略图模式
*/
private static final String THUMBNAIL_PATTERN = FILE_PATH_PREFIX + "/thumbnail/**";
private final AntPathMatcher pathMatcher = new AntPathMatcher();
/**
* 允许匿名读取的目录（相对 {@code /api/file}），已去空白与首尾斜杠
*/
private final List<String> publicDirs;
/**
* 内联资源（预览 + 缩略图）是否默认公开
*/
private final boolean publicPreview;
public FileAccessRules(@Value("${file.public-dirs:}") String publicDirs,
@Value("${file.public-preview:true}") boolean publicPreview) {
this.publicDirs = normalize(publicDirs);
this.publicPreview = publicPreview;
}
/**
* 匿名放行的文件路径模式。
*
* <p>内联公开时是预览 + 缩略图；否则是 {@code file.public-dirs} 里的目录（原图与缩略图）。
*
* @return antMatchers 模式，没有任何公开项时返回空列表
*/
public List<String> permitAllPatterns() {
if (publicPreview) {
List<String> patterns = new ArrayList<>(2 + publicDirs.size() * 2);
patterns.add(PREVIEW_PATTERN);
patterns.add(THUMBNAIL_PATTERN);
patterns.addAll(publicDirPatterns());
return patterns;
}
return publicDirPatterns();
}
/**
* 需要登录才能访问的文件路径模式（兜底规则，注册时必须排在 {@code GET /**} 之前）。
*
* @return antMatchers 模式
*/
public List<String> authenticatedPatterns() {
return Collections.singletonList(FILE_PATH_PREFIX + "/**");
}
/**
* 下载接口的路径模式：必须在公开模式之前注册，保证下载永远要登录。
*
* @return antMatchers 模式
*/
public List<String> downloadPatterns() {
return Collections.singletonList(DOWNLOAD_PATTERN);
}
/**
* 这条文件请求是否按公开资源处理（匿名可读）。
*
* @param path 请求路径，可带查询串
* @return true 表示命中公开规则；下载、未命中目录、非文件路径一律 false
*/
public boolean isPublicFileRequest(String path) {
if (StrUtil.isBlank(path)) {
return false;
}
String clean = StrUtil.subBefore(path, "?", false);
if (!clean.startsWith(FILE_PATH_PREFIX + "/")) {
return false;
}
if (pathMatcher.match(DOWNLOAD_PATTERN, clean)) {
return false;
}
for (String pattern : permitAllPatterns()) {
if (pathMatcher.match(pattern, clean)) {
return true;
}
}
return false;
}
private List<String> publicDirPatterns() {
if (publicDirs.isEmpty()) {
return Collections.emptyList();
}
List<String> patterns = new ArrayList<>(publicDirs.size() * 2);
for (String dir : publicDirs) {
patterns.add(FILE_PATH_PREFIX + "/" + dir + "/**");
patterns.add(FILE_PATH_PREFIX + "/thumbnail/" + dir + "/**");
}
return patterns;
}
private static List<String> normalize(String raw) {
if (StrUtil.isBlank(raw)) {
return Collections.emptyList();
}
List<String> dirs = new ArrayList<>();
for (String item : StrUtil.split(raw, ',')) {
String dir = StrUtil.strip(StrUtil.trim(item), "/");
if (StrUtil.isNotBlank(dir) && !dirs.contains(dir)) {
dirs.add(dir);
}
}
return dirs;
}
}
src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java
+27 -7
View File
@@ -7,11 +7,13 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import javax.annotation.Resource;
import java.util.List;
/**
* Spring Security配置
@@ -29,13 +31,32 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Resource
private JwtAuthenticationFilter jwtAuthenticationFilter;
@Resource
private FileAccessRules fileAccessRules;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**")
.permitAll()
.antMatchers(HttpMethod.GET, "/api/file/**","/**", "/api/captcha", "/")
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry urlRegistry =
http.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**")
.permitAll();
// 文件访问分三段，顺序不能换（antMatchers 先匹配先命中）：
// 1. 下载恒需登录——必须排在公开模式之前，因为 /api/file/*/* 也会命中两段的 download 路径；
// 2. 内联预览/缩略图与 file.public-dirs 目录按规则公开；
// 3. 其余 /api/file/** 需登录。整段仍要排在 GET /** 之前，否则等于没配。
List<String> downloadPatterns = fileAccessRules.downloadPatterns();
if (!downloadPatterns.isEmpty()) {
urlRegistry.antMatchers(HttpMethod.GET, downloadPatterns.toArray(new String[0]))
.authenticated();
}
List<String> publicFilePatterns = fileAccessRules.permitAllPatterns();
if (!publicFilePatterns.isEmpty()) {
urlRegistry.antMatchers(HttpMethod.GET, publicFilePatterns.toArray(new String[0]))
.permitAll();
}
urlRegistry.antMatchers(HttpMethod.GET, fileAccessRules.authenticatedPatterns().toArray(new String[0]))
.authenticated()
.antMatchers(HttpMethod.GET, "/**", "/api/captcha", "/")
.permitAll()
.antMatchers(
"/api/login",
@@ -84,9 +105,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
)
.permitAll()
.anyRequest()
.authenticated()
.and()
.sessionManagement()
.authenticated();
http.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.csrf()
src/main/java/com/gxwebsoft/gxmu/controller/ReviewFlowController.java
+139
View File
@@ -1,6 +1,7 @@
package com.gxwebsoft.gxmu.controller;
import com.gxwebsoft.common.core.web.BaseController;
import com.gxwebsoft.gxmu.service.ReviewFlowLevelValidator;
import com.gxwebsoft.gxmu.service.ReviewFlowService;
import com.gxwebsoft.gxmu.entity.ReviewFlow;
import com.gxwebsoft.gxmu.param.ReviewFlowParam;
@@ -16,8 +17,13 @@ import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Objects;
import java.util.Set;
/**
* 审核流控制器
@@ -63,6 +69,7 @@ public class ReviewFlowController extends BaseController {
@ApiOperation("添加审核流")
@PostMapping()
public ApiResult<?> save(@RequestBody ReviewFlow reviewFlow) {
validateLevels(reviewFlow == null ? null : java.util.Collections.singletonList(reviewFlow));
// 记录当前登录用户id
// ReviewFlow checkByName = reviewFlowService.getByTitle(reviewFlow.getTitle());
// if (checkByName != null) {
@@ -77,6 +84,7 @@ public class ReviewFlowController extends BaseController {
@ApiOperation("修改审核流")
@PutMapping()
public ApiResult<?> update(@RequestBody ReviewFlow reviewFlow) {
validateUpdate(reviewFlow);
// ReviewFlow checkByName = reviewFlowService.getByTitle(reviewFlow.getTitle());
// if (checkByName != null && !Objects.equals(checkByName.getId(), reviewFlow.getId())) {
// return fail("该名称已存在");
@@ -99,6 +107,7 @@ public class ReviewFlowController extends BaseController {
@ApiOperation("批量添加审核流")
@PostMapping("/batch")
public ApiResult<?> saveBatch(@RequestBody List<ReviewFlow> list) {
validateLevels(list);
if (reviewFlowService.saveBatch(list)) {
return success("添加成功");
}
@@ -108,12 +117,142 @@ public class ReviewFlowController extends BaseController {
@ApiOperation("批量修改审核流")
@PutMapping("/batch")
public ApiResult<?> updateBatch(@RequestBody BatchParam<ReviewFlow> batchParam) {
validateBatchUpdate(batchParam);
if (batchParam.update(reviewFlowService, "id")) {
return success("修改成功");
}
return fail("修改失败");
}
/**
* 校验"保存后这条审批链的层级从 1 连续升序"（spec #58 行为约定）。
*
* <p>管理端是"先删旧节点、再逐级新增"，因此单条保存时必须把库里同 title 的已有节点一起看，
* 否则逐级保存会被误判为缺级。
*/
private void validateLevels(List<ReviewFlow> incoming) {
if (incoming == null || incoming.isEmpty()) {
return;
}
List<ReviewFlow> proposed = new ArrayList<>();
Set<String> titles = new LinkedHashSet<>();
Set<Integer> replacedIds = new LinkedHashSet<>();
for (ReviewFlow flow : incoming) {
if (flow == null) {
continue;
}
proposed.add(flow);
if (flow.getId() != null) {
replacedIds.add(flow.getId());
}
if (flow.getTitle() != null) {
titles.add(flow.getTitle().trim());
}
}
for (String title : titles) {
List<ReviewFlow> existing = reviewFlowService.listByTitle(title);
if (existing == null) {
continue;
}
for (ReviewFlow flow : existing) {
if (flow != null && flow.getId() != null && !replacedIds.contains(flow.getId())) {
proposed.add(flow);
}
}
}
ReviewFlowLevelValidator.validate(proposed);
}
/**
* 修改单条节点：未传的字段沿用库里原值（MyBatis-Plus 同样忽略 null），再校验受影响链的连续性。
*/
private void validateUpdate(ReviewFlow reviewFlow) {
if (reviewFlow == null) {
return;
}
ReviewFlow existing = reviewFlow.getId() == null ? null : reviewFlowService.getById(reviewFlow.getId());
ReviewFlow merged = merge(existing, reviewFlow);
validateLevels(java.util.Collections.singletonList(merged));
if (existing != null && !sameTitle(existing.getTitle(), merged.getTitle())) {
validateRemaining(existing.getTitle(), java.util.Collections.singletonList(reviewFlow.getId()));
}
}
/**
* 批量修改：BatchParam 只带一个 data，id 集合里每行都按同样字段更新。
*/
private void validateBatchUpdate(BatchParam<ReviewFlow> batchParam) {
if (batchParam == null || batchParam.getData() == null
|| batchParam.getIds() == null || batchParam.getIds().isEmpty()) {
return;
}
List<Integer> ids = new ArrayList<>();
for (Serializable id : batchParam.getIds()) {
if (id instanceof Number) {
ids.add(((Number) id).intValue());
}
}
if (ids.isEmpty()) {
return;
}
List<ReviewFlow> existingRows = reviewFlowService.listByIds(ids);
if (existingRows == null || existingRows.isEmpty()) {
return;
}
List<ReviewFlow> mergedRows = new ArrayList<>();
List<String> oldTitles = new ArrayList<>();
for (ReviewFlow existing : existingRows) {
if (existing == null) {
continue;
}
mergedRows.add(merge(existing, batchParam.getData()));
oldTitles.add(existing.getTitle());
}
validateLevels(mergedRows);
Set<String> newTitles = new LinkedHashSet<>();
for (ReviewFlow row : mergedRows) {
newTitles.add(row.getTitle() == null ? "" : row.getTitle().trim());
}
for (String oldTitle : oldTitles) {
if (!newTitles.contains(oldTitle == null ? "" : oldTitle.trim())) {
validateRemaining(oldTitle, ids);
}
}
}
/**
* 校验改名/移走后原审批链剩下的节点仍连续。
*/
private void validateRemaining(String title, Collection<Integer> excludedIds) {
List<ReviewFlow> remaining = new ArrayList<>();
List<ReviewFlow> existing = title == null ? null : reviewFlowService.listByTitle(title);
if (existing != null) {
for (ReviewFlow flow : existing) {
if (flow != null && !excludedIds.contains(flow.getId())) {
remaining.add(flow);
}
}
}
ReviewFlowLevelValidator.validate(remaining);
}
private ReviewFlow merge(ReviewFlow existing, ReviewFlow incoming) {
if (existing == null) {
return incoming;
}
if (incoming.getTitle() != null) {
existing.setTitle(incoming.getTitle());
}
if (incoming.getLevel() != null) {
existing.setLevel(incoming.getLevel());
}
return existing;
}
private boolean sameTitle(String left, String right) {
return Objects.equals(left == null ? null : left.trim(), right == null ? null : right.trim());
}
@ApiOperation("批量删除审核流")
@DeleteMapping("/batch")
public ApiResult<?> removeBatch(@RequestBody List<Integer> ids) {
src/main/java/com/gxwebsoft/gxmu/controller/ReviewListController.java
+70 -1
View File
@@ -1,5 +1,7 @@
package com.gxwebsoft.gxmu.controller;
import cn.hutool.core.util.StrUtil;
import com.gxwebsoft.common.core.Constants;
import com.gxwebsoft.common.core.web.BaseController;
import com.gxwebsoft.gxmu.entity.ReviewFlow;
import com.gxwebsoft.gxmu.entity.ReviewFlowConfig;
@@ -98,9 +100,18 @@ public class ReviewListController extends BaseController {
@ApiOperation("修改审核列表")
@PutMapping()
public ApiResult<?> update(@RequestBody ReviewList reviewList) {
// 审批动作（通过/驳回/撤销）只能由待办的责任人本人执行
ApiResult<?> denied = denyIfNotAssignee(reviewList.getId());
if (denied != null) {
return denied;
}
denied = denyIfRejectWithoutContent(reviewList);
if (denied != null) {
return denied;
}
if (reviewListService.updateById(reviewList)) {
// 通过进入下一个
if (reviewList.getStatus().equals(1)) {
if (Integer.valueOf(1).equals(reviewList.getStatus())) {
ReviewFlowConfig reviewFlowConfig = reviewFlowConfigService.getByModule(reviewList.getModule());
if (reviewFlowConfig != null) {
ReviewFlow reviewFlow = reviewFlowService.getById(reviewFlowConfig.getFlowId());
@@ -155,6 +166,15 @@ public class ReviewListController extends BaseController {
@ApiOperation("批量修改审核列表")
@PutMapping("/batch")
public ApiResult<?> updateBatch(@RequestBody BatchParam<ReviewList> batchParam) {
// 批量审批逐行校验归属，只要有一行不是自己的就整体拒绝，避免部分落库
ApiResult<?> denied = denyIfBatchNotAssignee(batchParam);
if (denied != null) {
return denied;
}
denied = denyIfRejectWithoutContent(batchParam == null ? null : batchParam.getData());
if (denied != null) {
return denied;
}
if (batchParam.update(reviewListService, "id")) {
syncBatchReviewStatus(batchParam);
return success("修改成功");
@@ -162,6 +182,55 @@ public class ReviewListController extends BaseController {
return fail("修改失败");
}
/**
* 审批动作的归属校验：操作者必须是该待办行的 user_id（当前一级的审批人）。
*
* <p>待办不存在时也按无权限处理，不区分"不存在"与"不是你的"。
*
* @param id 待办行 id
* @return null 表示校验通过，否则返回 403 结果
*/
private ApiResult<?> denyIfNotAssignee(Integer id) {
ReviewList existing = id == null ? null : reviewListService.getById(id);
Integer loginUserId = getLoginUserId();
if (existing == null || loginUserId == null || !loginUserId.equals(existing.getUserId())) {
return new ApiResult<>(Constants.UNAUTHORIZED_CODE, Constants.UNAUTHORIZED_MSG);
}
return null;
}
/**
* 批量审批的归属校验：逐行确认都属于当前用户。
*
* @param batchParam 批量参数
* @return null 表示全部通过，否则返回 403 结果
*/
private ApiResult<?> denyIfBatchNotAssignee(BatchParam<ReviewList> batchParam) {
if (batchParam == null || batchParam.getIds() == null) {
return null;
}
for (java.io.Serializable id : batchParam.getIds()) {
ApiResult<?> denied = denyIfNotAssignee(id instanceof Number ? ((Number) id).intValue() : null);
if (denied != null) {
return denied;
}
}
return null;
}
/**
* 驳回必须携带意见，否则申报人不知道要改什么。
*
* @param data 提交的审批数据
* @return null 表示校验通过，否则返回可读的失败结果
*/
private ApiResult<?> denyIfRejectWithoutContent(ReviewList data) {
if (data != null && Integer.valueOf(2).equals(data.getStatus()) && StrUtil.isBlank(data.getContent())) {
return fail("驳回必须填写审核意见");
}
return null;
}
/** 批量审核后同样要回写申报记录状态，否则重复申报限制会读到旧状态 */
private void syncBatchReviewStatus(BatchParam<ReviewList> batchParam) {
if (batchParam == null || batchParam.getIds() == null) {
src/main/java/com/gxwebsoft/gxmu/service/ReviewFlowLevelValidator.java
+81
View File
@@ -0,0 +1,81 @@
package com.gxwebsoft.gxmu.service;
import com.gxwebsoft.common.core.exception.BusinessException;
import com.gxwebsoft.gxmu.entity.ReviewFlow;
import java.util.ArrayList;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
/**
* 审批链层级连续性校验（spec #58 行为约定：层级从 1 连续升序）。
*
* <p>一条审批链的层级必须恰好是 1..N，缺级会让申报卡在半路，重复级会让两个人拿到同一条待办。
* 按 title 分组校验，纯函数，不依赖数据库。
*
* @author Codex
* @since 2026-11-03
*/
public final class ReviewFlowLevelValidator {
private ReviewFlowLevelValidator() {
}
/**
* 校验一组审批流节点的层级；不合法时抛出 {@link BusinessException}。
*
* @param flows 同一轮保存涉及的节点，可包含多条审批链（按 title 分组）
*/
public static void validate(List<ReviewFlow> flows) {
if (flows == null || flows.isEmpty()) {
return;
}
Map<String, List<Integer>> levelsByTitle = new LinkedHashMap<>();
for (ReviewFlow flow : flows) {
if (flow == null) {
continue;
}
levelsByTitle.computeIfAbsent(titleOf(flow), key -> new ArrayList<>()).add(flow.getLevel());
}
for (Map.Entry<String, List<Integer>> entry : levelsByTitle.entrySet()) {
validateOne(entry.getKey(), entry.getValue());
}
}
private static void validateOne(String title, List<Integer> levels) {
for (Integer level : levels) {
if (level == null) {
throw new BusinessException("审批链「" + displayTitle(title) + "」存在未填写层级的节点，层级必须从 1 连续升序");
}
}
List<Integer> sorted = new ArrayList<>(levels);
Collections.sort(sorted);
for (int index = 0; index < sorted.size(); index++) {
if (sorted.get(index) != index + 1) {
throw new BusinessException("审批链「" + displayTitle(title) + "」的层级必须从 1 连续升序，当前层级为 "
+ join(sorted) + "，请调整后再保存");
}
}
}
private static String titleOf(ReviewFlow flow) {
return flow.getTitle() == null ? "" : flow.getTitle().trim();
}
private static String displayTitle(String title) {
return title.isEmpty() ? "未命名" : title;
}
private static String join(List<Integer> levels) {
StringBuilder builder = new StringBuilder();
for (int index = 0; index < levels.size(); index++) {
if (index > 0) {
builder.append(", ");
}
builder.append(levels.get(index));
}
return builder.toString();
}
}
src/main/java/com/gxwebsoft/gxmu/service/impl/ReviewFlowStarterServiceImpl.java
+10
View File
@@ -1,5 +1,6 @@
package com.gxwebsoft.gxmu.service.impl;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.gxwebsoft.gxmu.entity.ReviewFlow;
import com.gxwebsoft.gxmu.entity.ReviewFlowConfig;
import com.gxwebsoft.gxmu.entity.ReviewList;
@@ -8,6 +9,7 @@ import com.gxwebsoft.gxmu.service.ReviewFlowService;
import com.gxwebsoft.gxmu.service.ReviewFlowStarterService;
import com.gxwebsoft.gxmu.service.ReviewListService;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import javax.annotation.Resource;
import java.time.LocalDateTime;
@@ -49,7 +51,12 @@ public class ReviewFlowStarterServiceImpl implements ReviewFlowStarterService {
saveFirstReviewNode(module, pk, firstOne);
}
/**
* 驳回后重走审批链：先清掉同一申报记录下的旧节点，再生成从第一级开始的新节点，
* 保证任一时刻只有一组活跃节点（spec #58 行为约定）。判定"上一条是驳回"必须在删除前完成。
*/
@Override
@Transactional(rollbackFor = Exception.class)
public void restartReviewWhenLastRejected(String module, Integer pk) {
if (module == null || pk == null) {
return;
@@ -75,6 +82,9 @@ public class ReviewFlowStarterServiceImpl implements ReviewFlowStarterService {
if (firstOne == null) {
return;
}
reviewListService.remove(new LambdaQueryWrapper<ReviewList>()
.eq(ReviewList::getModule, module)
.eq(ReviewList::getPk, pk));
saveFirstReviewNode(module, pk, firstOne);
}
src/main/resources/application.yml
+15
View File
@@ -89,6 +89,21 @@ config:
upload-path: /Users/liangxin/Project/JAVA/tower-java/
local-upload-path: /Users/gxwebsoft/Documents/uploads/
# 文件访问规则（spec #58）
# 下载接口 /api/file/download/** 永远需要登录，「取走原件」不再匿名。
#
# 确需公开的内联资源（预览 /api/file/<dir>/<name> 与缩略图 /api/file/thumbnail/**）：
# 默认 true，否则公开页面的配图会整片变成需要 token；置 false 则内联也需登录。
file:
public-preview: ${FILE_PUBLIC_PREVIEW:true}
# 额外公开目录（可选，逗号分隔，相对 /api/file）：命中这些目录的原图与缩略图即使
# public-preview=false 也允许匿名读取。留空表示没有额外目录。
#
# 注意：当前上传一律落在 /yyyyMMdd/ 日期目录（见 FileStorageService.store），
# 目录本身不区分公开/私有；写日期目录等于把这些日期的全部文件公开，慎用。
# 也不要图省事写成 /api/file/**。
public-dirs: ${FILE_PUBLIC_DIRS:}
wx:
miniapp:
configs: