From 61d8c6317ea46039d580c4c266aad30307c7ae88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=B5=B5=E5=BF=A0=E6=9E=97?= <170083662@qq.com>
Date: Thu, 23 Jul 2026 16:39:58 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20=E5=85=81=E8=AE=B8=20sendSmsCa?=
 =?UTF-8?q?ptchaByAdmin=20=E6=8E=A5=E5=8F=A3=E5=85=8D=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E8=AE=BF=E9=97=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 在 SecurityConfig 的 permitAll 白名单中添加 `/api/sendSmsCaptchaByAdmin`
- 解决该接口因未登录被拦截导致返回 401 的问题
- 确保管理员手机号校验逻辑不受影响，接口可正常发送验证码
- 方便通过代理路径 `/api/_server/sendSmsCaptchaByAdmin` 访问接口
- 修复线上调用失败问题，保证服务正常可用
---
 .workbuddy/memory/2026-07-23.md                     | 13 +++++++++++++
 .../common/core/security/SecurityConfig.java        |  1 +
 2 files changed, 14 insertions(+)
 create mode 100644 .workbuddy/memory/2026-07-23.md

diff --git a/.workbuddy/memory/2026-07-23.md b/.workbuddy/memory/2026-07-23.md
new file mode 100644
index 0000000..e1ab47e
--- /dev/null
+++ b/.workbuddy/memory/2026-07-23.md
@@ -0,0 +1,13 @@
+# 2026-07-23 工作记录
+
+## 短信验证码接口 sendSmsCaptchaByAdmin 发送失败排查
+- 现象：线上 `https://site.websoft.top/api/_server/sendSmsCaptchaByAdmin` 调用手机 15678895934 失败，返回 `401 请先登录`。
+- 根因：`com/gxwebsoft/common/core/security/SecurityConfig.java` 的 `permitAll` 白名单里只有 `/api/sendSmsCaptcha`、`/api/sendEmailCaptcha`，没有 `/api/sendSmsCaptchaByAdmin`。该接口被 Spring Security 拦截，未登录请求直接 401，控制器逻辑未执行，验证码未发出。
+- 已修复：在 SecurityConfig 的 permitAll antMatchers 中加入 `/api/sendSmsCaptchaByAdmin`（位于 `/api/sendSmsCaptcha` 之后）。
+- 说明：接口内部已有 `getByPhoneAndAdmin` 管理员手机号校验，开放 permitAll 安全；线上代理前缀为 `/api/_server/**`，转发到后端 `/api/**`。
+- 验证方式：用 curl 直接打 `/api/_server/sendSmsCaptchaByAdmin` 复现 401；同前缀的 `/api/sendSmsCaptcha` 因在白名单可正常进入（需确认部署后 ByAdmin 不再 401）。
+
+## 关键文件
+- SecurityConfig.java：`com/gxwebsoft/common/core/security/SecurityConfig.java`
+- MainController.sendSmsCaptchaByAdmin：`com/gxwebsoft/common/system/controller/MainController.java:656`
+- 管理员校验 SQL：`UserMapper.xml selectAdminByPhoneCrossTenant`（sys_user.deleted=0 AND phone=? AND (is_super_admin=1 OR is_admin=1)）
diff --git a/src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java b/src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java
index fdc9d43..f28a1ed 100644
--- a/src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java
+++ b/src/main/java/com/gxwebsoft/common/core/security/SecurityConfig.java
@@ -54,6 +54,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
                         "/webjars/**",
                         "/hxz/v1/**",
                         "/api/sendSmsCaptcha",
+                        "/api/sendSmsCaptchaByAdmin",
                         "/api/sendEmailCaptcha",
                         "/api/loginBySms",
                         "/api/loginBySuperAdminSms",