gxwebsoft/mp-java
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): 为CMS相关接口添加权限控制注解

Browse Source 
- 在CmsBannerController中新增@PreAuthorize注解，限制添加、修改、删除和状态更新接口权限
- 在CmsBannerGroupController中新增@PreAuthorize注解，控制轮播组及其项的增删改权限
- 在CmsCaseController中新增权限校验注解，保护客户案例的增删改及状态修改接口
- 在CmsPageController中为单页管理接口添加权限控制注解
- 在CmsProductController中增加@PreAuthorize注解，针对产品的添加、修改、删除和状态更新操作设置权限验证
- 统一引入org.springframework.security.access.prepost.PreAuthorize实现方法级安全控制
This commit is contained in:
赵忠林
2026-08-05 19:06:27 +08:00
parent 406d761260
commit 5f018be7bb
5 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java
View File

@@ -8,6 +8,7 @@ import com.gxwebsoft.common.core.web.BaseController;
import com.gxwebsoft.common.core.web.PageResult;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
@@ -46,6 +47,7 @@ public class CmsBannerController extends BaseController {
}
@Operation(summary = "添加轮播图")
@PreAuthorize("hasAuthority('cms:cmsBanner:save')")
@PostMapping()
public ApiResult<?> save(@RequestBody CmsBanner cmsBanner) {
if (cmsBannerService.save(cmsBanner)) {
@@ -55,6 +57,7 @@ public class CmsBannerController extends BaseController {
}
@Operation(summary = "修改轮播图")
@PreAuthorize("hasAuthority('cms:cmsBanner:update')")
@PutMapping()
public ApiResult<?> update(@RequestBody CmsBanner cmsBanner) {
if (cmsBannerService.updateById(cmsBanner)) {
@@ -64,6 +67,7 @@ public class CmsBannerController extends BaseController {
}
@Operation(summary = "删除轮播图")
@PreAuthorize("hasAuthority('cms:cmsBanner:remove')")
@DeleteMapping("/{id}")
public ApiResult<?> remove(@PathVariable("id") Integer id) {
if (cmsBannerService.removeById(id)) {
@@ -73,6 +77,7 @@ public class CmsBannerController extends BaseController {
}
@Operation(summary = "修改轮播图状态(启用/停用)")
@PreAuthorize("hasAuthority('cms:cmsBanner:update')")
@PutMapping("/status")
public ApiResult<?> updateStatus(@RequestBody CmsBanner cmsBanner) {
CmsBanner entity = new CmsBanner();

8
src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java
View File

@@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.BaseController;
import com.gxwebsoft.common.core.web.PageResult;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
@@ -55,6 +56,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "添加轮播组(可携带items一次性创建)")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')")
@PostMapping()
public ApiResult<?> save(@RequestBody CmsBannerGroup group) {
if (cmsBannerGroupService.saveGroup(group)) {
@@ -64,6 +66,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "修改轮播组(可携带items一次性全量替换)")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
@PutMapping()
public ApiResult<?> update(@RequestBody CmsBannerGroup group) {
if (group.getGroupId() == null) {
@@ -76,6 +79,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "删除轮播组(连带删除组内items)")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')")
@DeleteMapping("/{groupId}")
public ApiResult<?> remove(@PathVariable("groupId") Integer groupId) {
if (cmsBannerGroupService.removeGroup(groupId)) {
@@ -85,6 +89,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "修改轮播组状态(启用/停用)")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
@PutMapping("/status")
public ApiResult<?> updateStatus(@RequestBody CmsBannerGroup group) {
CmsBannerGroup entity = new CmsBannerGroup();
@@ -99,6 +104,7 @@ public class CmsBannerGroupController extends BaseController {
// ---------------- 单项 CRUD（可选，保存组时已全量提交items，以下接口用于单独维护） ----------------
@Operation(summary = "单独新增轮播项")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')")
@PostMapping("/{groupId}/item")
public ApiResult<?> addItem(@PathVariable("groupId") Integer groupId,
@RequestBody CmsBannerItem item) {
@@ -117,6 +123,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "单独修改轮播项")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
@PutMapping("/item")
public ApiResult<?> updateItem(@RequestBody CmsBannerItem item) {
if (item.getItemId() == null) {
@@ -129,6 +136,7 @@ public class CmsBannerGroupController extends BaseController {
}
@Operation(summary = "单独删除轮播项")
@PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')")
@DeleteMapping("/item/{itemId}")
public ApiResult<?> removeItem(@PathVariable("itemId") Integer itemId) {
if (bannerItemDelete(itemId)) {

5
src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java
View File

@@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.PageResult;
import com.gxwebsoft.common.system.entity.User;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
@@ -48,6 +49,7 @@ public class CmsCaseController extends BaseController {
}
@Operation(summary = "添加客户案例")
@PreAuthorize("hasAuthority('cms:cmsCase:save')")
@PostMapping()
public ApiResult<?> save(@RequestBody CmsCase cmsCase) {
if (cmsCaseService.save(cmsCase)) {
@@ -57,6 +59,7 @@ public class CmsCaseController extends BaseController {
}
@Operation(summary = "修改客户案例")
@PreAuthorize("hasAuthority('cms:cmsCase:update')")
@PutMapping()
public ApiResult<?> update(@RequestBody CmsCase cmsCase) {
if (cmsCaseService.updateById(cmsCase)) {
@@ -66,6 +69,7 @@ public class CmsCaseController extends BaseController {
}
@Operation(summary = "删除客户案例")
@PreAuthorize("hasAuthority('cms:cmsCase:remove')")
@DeleteMapping("/{id}")
public ApiResult<?> remove(@PathVariable("id") Integer id) {
if (cmsCaseService.removeById(id)) {
@@ -75,6 +79,7 @@ public class CmsCaseController extends BaseController {
}
@Operation(summary = "修改案例状态(发布/下线)")
@PreAuthorize("hasAuthority('cms:cmsCase:update')")
@PutMapping("/status")
public ApiResult<?> updateStatus(@RequestBody CmsCase cmsCase) {
CmsCase entity = new CmsCase();

5
src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java
View File

@@ -11,6 +11,7 @@ import com.gxwebsoft.common.core.web.ApiResult;
import com.gxwebsoft.common.core.web.PageResult;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
@@ -62,6 +63,7 @@ public class CmsPageController extends BaseController {
}
@Operation(summary = "添加单页")
@PreAuthorize("hasAuthority('cms:cmsPage:save')")
@PostMapping()
public ApiResult<?> save(@RequestBody CmsPage page) {
User loginUser = getLoginUser();
@@ -83,6 +85,7 @@ public class CmsPageController extends BaseController {
}
@Operation(summary = "修改单页")
@PreAuthorize("hasAuthority('cms:cmsPage:update')")
@PutMapping()
public ApiResult<?> update(@RequestBody CmsPage page) {
if (page.getPageId() == null) {
@@ -98,6 +101,7 @@ public class CmsPageController extends BaseController {
}
@Operation(summary = "删除单页")
@PreAuthorize("hasAuthority('cms:cmsPage:remove')")
@DeleteMapping("/{id}")
public ApiResult<?> remove(@PathVariable("id") Integer id) {
if (cmsPageService.removeById(id)) {
@@ -107,6 +111,7 @@ public class CmsPageController extends BaseController {
}
@Operation(summary = "修改单页状态(草稿/发布/下线)")
@PreAuthorize("hasAuthority('cms:cmsPage:update')")
@PutMapping("/status")
public ApiResult<?> updateStatus(@RequestBody Map<String, Object> body) {
Object idObj = body.get("pageId");

5
src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java
View File

@@ -9,6 +9,7 @@ import com.gxwebsoft.common.core.web.PageResult;
import com.gxwebsoft.common.system.entity.User;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.annotation.Resource;
@@ -47,6 +48,7 @@ public class CmsProductController extends BaseController {
}
@Operation(summary = "添加产品")
@PreAuthorize("hasAuthority('cms:cmsProduct:save')")
@PostMapping()
public ApiResult<?> save(@RequestBody CmsProduct cmsProduct) {
User loginUser = getLoginUser();
@@ -60,6 +62,7 @@ public class CmsProductController extends BaseController {
}
@Operation(summary = "修改产品")
@PreAuthorize("hasAuthority('cms:cmsProduct:update')")
@PutMapping()
public ApiResult<?> update(@RequestBody CmsProduct cmsProduct) {
if (cmsProductService.updateById(cmsProduct)) {
@@ -69,6 +72,7 @@ public class CmsProductController extends BaseController {
}
@Operation(summary = "删除产品")
@PreAuthorize("hasAuthority('cms:cmsProduct:remove')")
@DeleteMapping("/{id}")
public ApiResult<?> remove(@PathVariable("id") Integer id) {
if (cmsProductService.removeById(id)) {
@@ -78,6 +82,7 @@ public class CmsProductController extends BaseController {
}
@Operation(summary = "修改产品状态(在售/下架)")
@PreAuthorize("hasAuthority('cms:cmsProduct:update')")
@PutMapping("/status")
public ApiResult<?> updateStatus(@RequestBody CmsProduct cmsProduct) {
CmsProduct entity = new CmsProduct();