Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

完善权限补充

Browse Source
This commit is contained in:
waner 2026-04-28 10:15:29 +08:00
parent 392428d2f0
commit 1d2524718f
11 changed files with 59 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java
View File

@ -47,7 +47,7 @@ public class AuthAdminController {
@GetMapping("/users")
@Operation(summary = "查询用户管理列表", description = "按角色类型和状态分页查询角色席位账号列表。")
// @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
@RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<AuthUserListResponse> listUsers(
@RequestParam(value = "roleCode", required = false) String roleCode,
@RequestParam(value = "status", required = false) String status,

1
src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java
View File

@ -44,6 +44,7 @@ public class AuthController {
}
@PostMapping("/captcha")
@Deprecated
@Operation(summary = "生成验证码", description = "为口令登录流程生成一次性验证码。")
public ApiResponse<CaptchaResponse> issueCaptcha() {
return ApiResponse.success(authService.issueCaptcha());

6
src/main/java/com/cisd/tms/modules/device/controller/DeviceController.java
View File

@ -1,6 +1,9 @@
package com.cisd.tms.modules.device.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.device.dto.DeviceActionResponse;
import com.cisd.tms.modules.device.dto.DeviceInfoResponse;
import com.cisd.tms.modules.device.dto.DeviceProfileResponse;
@ -46,12 +49,14 @@ public class DeviceController {
@GetMapping("/profile")
@Operation(summary = "查询设备画像", description = "返回设备静态信息，包括设备信息、硬件信息和按初始化方案裁剪后的软件版本信息。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<DeviceProfileResponse> profile() {
return ApiResponse.success(deviceProfileService.profile());
}
@GetMapping("/runtime-status")
@Operation(summary = "查询设备运行状态", description = "返回硬件实时资源使用情况、加密卡状态，以及按初始化配置裁剪后的软件运行状态。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<DeviceRuntimeStatusResponse> runtimeStatus() {
return ApiResponse.success(deviceRuntimeStatusService.loadRuntimeStatus());
}
@ -60,6 +65,7 @@ public class DeviceController {
@Operation(summary = "重启设备服务", description = "受理设备重启请求，并记录触发操作的内部用户。")
@ReplayProtected
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.RESTART, summary = "重启设备服务")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<DeviceActionResponse> restart(HttpServletRequest request) {
String operator = (String) request.getAttribute(InternalApiAuthInterceptor.ATTR_ROLE_CODE);
return ApiResponse.success(deviceService.restart(operator));

7
src/main/java/com/cisd/tms/modules/device/controller/IpWhitelistController.java
View File

@ -2,6 +2,9 @@ package com.cisd.tms.modules.device.controller;
import com.baomidou.mybatisplus.core.metadata.IPage;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.device.dto.network.IpWhitelistRequest;
import com.cisd.tms.modules.device.dto.network.IpWhitelistResponse;
import com.cisd.tms.modules.device.service.IpWhitelistService;
@ -29,6 +32,7 @@ public class IpWhitelistController {
@Operation(summary = "添加IP白名单", description = "新增一条IP白名单记录")
@ReplayProtected
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.CREATE, summary = "添加IP白名单")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> addWhitelist(@RequestBody IpWhitelistRequest req) {
ipWhitelistService.addWhitelist(req);
return ApiResponse.success();
@ -39,6 +43,7 @@ public class IpWhitelistController {
@Operation(summary = "更新IP白名单", description = "根据ID更新IP白名单信息")
@ReplayProtected
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "更新IP白名单")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> updateWhitelist(@RequestBody IpWhitelistRequest req) {
ipWhitelistService.updateWhitelist(req);
return ApiResponse.success();
@ -48,6 +53,7 @@ public class IpWhitelistController {
@Operation(summary = "删除IP白名单", description = "根据ID删除指定IP白名单")
@ReplayProtected
@AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.DELETE, summary = "删除IP白名单")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> deleteWhitelist(@PathVariable Long id) {
ipWhitelistService.deleteWhitelist(id);
return ApiResponse.success();
@ -56,6 +62,7 @@ public class IpWhitelistController {
@GetMapping("/page")
@Operation(summary = "分页查询IP白名单", description = "支持分页查询IP白名单列表")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<IPage<IpWhitelistResponse>> getWhitelistPage(@RequestParam int pageNum,
@RequestParam int pageSize,
@Parameter(

3
src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java
View File

@ -3,6 +3,9 @@ package com.cisd.tms.modules.device.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.device.dto.TimeConfigRequest;
import com.cisd.tms.modules.device.service.TimeConfigService;
import com.cisd.tms.security.internal.ReplayProtected;

8
src/main/java/com/cisd/tms/modules/init/controller/InitController.java
View File

@ -1,6 +1,9 @@
package com.cisd.tms.modules.init.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.init.dto.*;
import com.cisd.tms.modules.init.service.InitService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
@ -122,6 +125,7 @@ public class InitController {
@Operation(summary = "创建重置任务", description = "自动读取当前设备有效初始化快照生成重置任务和步骤记录，任务初始状态为 PENDING。")
@ReplayProtected
@AuditedOperation(module = ModuleCode.INIT, action = ActionType.CREATE, summary = "创建重置任务")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<ResetCreateTaskResponse> createResetTask() {
return ApiResponse.success(initService.createResetTask());
}
@ -130,6 +134,7 @@ public class InitController {
@Operation(summary = "执行重置任务", description = "异步受理重置任务执行请求，立即返回当前任务快照，实际步骤在后台继续运行。")
@ReplayProtected
@AuditedOperation(module = ModuleCode.INIT, action = ActionType.EXECUTE, summary = "执行重置任务")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<InitTaskExecuteResponse> executeResetTask(
@Parameter(description = "重置任务唯一标识")
@PathVariable String taskId
@ -139,6 +144,7 @@ public class InitController {
@GetMapping("/reset/tasks/{taskId}")
@Operation(summary = "查询重置任务详情", description = "返回重置任务的主状态、产品类型和原始计划快照。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<InitTaskDetailResponse> resetTaskDetail(
@Parameter(description = "重置任务唯一标识")
@PathVariable String taskId
@ -148,6 +154,7 @@ public class InitController {
@GetMapping("/reset/tasks/{taskId}/steps")
@Operation(summary = "查询重置任务步骤", description = "返回重置任务下全部步骤的执行状态和命令信息。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<List<InitTaskStepResponse>> resetTaskSteps(
@Parameter(description = "重置任务唯一标识")
@PathVariable String taskId
@ -157,6 +164,7 @@ public class InitController {
@GetMapping("/reset/tasks/{taskId}/steps/{stepNo}/log")
@Operation(summary = "查询重置步骤日志", description = "返回指定重置任务步骤的日志路径和日志内容，用于定位失败原因。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<InitTaskStepLogResponse> resetTaskStepLog(
@Parameter(description = "重置任务唯一标识")
@PathVariable String taskId,

5
src/main/java/com/cisd/tms/modules/log/controller/BackupConfigController.java
View File

@ -1,6 +1,9 @@
package com.cisd.tms.modules.log.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.dto.BackupConfigRequest;
import com.cisd.tms.modules.log.dto.BackupConfigResponse;
import com.cisd.tms.modules.log.service.BackupConfigService;
@ -21,6 +24,7 @@ public class BackupConfigController {
@Operation(summary = "查询全局备份配置", description = "获取系统当前的审计日志备份策略，如果未配置过则返回 null")
@GetMapping
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<BackupConfigResponse> getConfig() {
BackupConfigResponse config = backupConfigService.getConfig();
return ApiResponse.success(config);
@ -31,6 +35,7 @@ public class BackupConfigController {
*/
@Operation(summary = "保存或更新备份配置", description = "创建新的备份配置或覆盖更新已有的全局备份配置")
@PostMapping
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> saveOrUpdateConfig(@Validated @RequestBody BackupConfigRequest req) {
backupConfigService.saveOrUpdateConfig(req);
return ApiResponse.success();

6
src/main/java/com/cisd/tms/modules/log/controller/BackupController.java
View File

@ -4,6 +4,9 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.dto.BackupRecordPageRequest;
import com.cisd.tms.modules.log.dto.BackupRecordResponse;
import com.cisd.tms.modules.log.entity.BackupRecordEntity;
@ -34,6 +37,7 @@ public class BackupController {
@PostMapping()
@Operation(summary = "触发手动备份", description = "执行一次审计日志的备份任务，生成 ZIP 备份包")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> backup() {
auditBackupService.manualBackup();
return ApiResponse.success();
@ -41,6 +45,7 @@ public class BackupController {
@PostMapping("/record/page")
@Operation(summary = "分页查询备份记录", description = "根据条件（例如：备份类型、操作日期）分页获取历史备份记录列表")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<IPage<BackupRecordResponse>> queryPage(@RequestBody BackupRecordPageRequest req) {
IPage<BackupRecordResponse> pageResult = backupRecordService.queryPage(req);
return ApiResponse.success(pageResult);
@ -49,6 +54,7 @@ public class BackupController {
@GetMapping("/record/download/{recordId}")
@Operation(summary = "下载备份文件", description = "根据记录的唯一编码 (recordId) 下载对应的 ZIP 备份压缩包文件")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ResponseEntity<Resource> downloadBackupFile(@PathVariable("recordId") String recordId) {
BackupRecordEntity record = backupRecordRepository.findByRecordId(recordId).orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "备份记录不存在"));

6
src/main/java/com/cisd/tms/modules/log/controller/OperationAuditController.java
View File

@ -4,6 +4,9 @@ import com.baomidou.mybatisplus.core.metadata.IPage;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.log.dto.AuditLogReviewRequest;
import com.cisd.tms.modules.log.dto.OperationAuditLogPageRequest;
import com.cisd.tms.modules.log.dto.OperationAuditLogPageResponse;
@ -28,6 +31,7 @@ public class OperationAuditController {
@Operation(summary = "分页查询审计日志", description = "根据筛选条件分页获取系统的操作审计日志列表")
@PostMapping("/page")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<IPage<OperationAuditLogPageResponse>> queryPage(@RequestBody OperationAuditLogPageRequest req) {
IPage<OperationAuditLogPageResponse> pageResult = auditService.queryPage(req);
return ApiResponse.success(pageResult);
@ -35,6 +39,7 @@ public class OperationAuditController {
@Operation(summary = "获取审计日志详情", description = "根据日志的唯一标识 LogId 获取单条日志的完整信息")
@GetMapping("/{logId}")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<OperationAuditLogResponse> getDetail(@PathVariable String logId) {
OperationAuditLogResponse detail = auditService.getDetail(logId);
return ApiResponse.success(detail);
@ -42,6 +47,7 @@ public class OperationAuditController {
@Operation(summary = "审核审计日志", description = "审计管理员对特定的审计日志进行审核操作及意见批注")
@PostMapping("/{logId}/review")
@RequireInternalAuth(role = RoleCode.AUDIT_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> reviewLog(@PathVariable String logId, @RequestBody AuditLogReviewRequest req) {
String auditorUser = ""; // 默认

13
src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java
View File

@ -3,6 +3,9 @@ package com.cisd.tms.modules.mk.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.common.enums.ErrorCode;
import com.cisd.tms.common.exception.BizException;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.mk.dto.MasterKeyBackupPacket;
import com.cisd.tms.modules.mk.dto.MasterKeyRecoverRequest;
import com.cisd.tms.modules.mk.dto.MasterKeyRecoverPacketsRequest;
@ -42,6 +45,7 @@ public class LmkController {
@PostMapping("/masterKey/destroy")
@Operation(summary = "销毁主密钥", description = "销毁当前密码卡中的主密钥，失败直接抛出异常。")
@ReplayProtected
@RequireInternalAuth(role = RoleCode.KEY_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<Void> destroyMasterKey() {
//销毁主密钥、内部密钥、用户密钥
lmkService.destroyMasterKey();
@ -68,15 +72,6 @@ public class LmkController {
return ApiResponse.success();
}
@GetMapping("/masterKey/sign")
@Operation(summary = "签名测试", description = "")
public ApiResponse<Void> signIk(@RequestParam String data) {
String signData = lmkService.signIk(data);
log.info("signData:{}", signData);
lmkService.verifyIk(data, signData);
return ApiResponse.success();
}
private void validatePacketIndexes(List<MasterKeyBackupPacket> packets) {
if (packets == null || packets.size() != 2) {
throw new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "packets size must be 2");

15
src/main/java/com/cisd/tms/modules/upgrade/controller/UpgradeController.java
View File

@ -1,6 +1,9 @@
package com.cisd.tms.modules.upgrade.controller;
import com.cisd.tms.common.api.ApiResponse;
import com.cisd.tms.modules.auth.enums.AuthLevel;
import com.cisd.tms.modules.auth.enums.RoleCode;
import com.cisd.tms.modules.auth.security.RequireInternalAuth;
import com.cisd.tms.modules.file.dto.FileUploadResponse;
import com.cisd.tms.modules.file.service.FileService;
import com.cisd.tms.modules.log.annotation.AuditedOperation;
@ -20,6 +23,7 @@ import org.springframework.web.multipart.MultipartFile;
@RestController
@RequestMapping("/api/v1")
@RequiredArgsConstructor
@ReplayProtected
@Tag(name = "离线升级管理", description = "离线升级包上传、预检、任务创建、执行和升级记录查询接口")
public class UpgradeController {
@ -29,6 +33,7 @@ public class UpgradeController {
@PostMapping("/upgrade-packages")
@Operation(summary = "上传离线升级包", description = "上传离线升级包，返回 fileId 供升级预检和任务创建使用。")
// @ReplayProtected
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<FileUploadResponse> uploadPackage(
@Parameter(description = "待上传的离线升级包")
@RequestParam("file") MultipartFile file
@ -38,21 +43,22 @@ public class UpgradeController {
@PostMapping("/upgrades/previews")
@Operation(summary = "预检离线升级包", description = "根据 fileId 解析升级包，校验摘要和签名，并返回版本变化和是否允许升级。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<UpgradePreviewResponse> preview(@Valid @RequestBody UpgradePreviewRequest request) {
return ApiResponse.success(upgradeService.preview(request));
}
@PostMapping("/upgrades")
@Operation(summary = "创建离线升级任务", description = "根据 fileId 创建离线升级任务，状态初始为 PENDING_CONFIRM。")
// @ReplayProtected
@AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.CREATE, summary = "创建离线升级任务")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
public ApiResponse<UpgradeCreateTaskResponse> create(@Valid @RequestBody UpgradeCreateTaskRequest request) {
return ApiResponse.success(upgradeService.createTask(request));
}
@PostMapping("/upgrades/{taskId}/execute")
@Operation(summary = "执行离线升级任务", description = "异步受理升级执行请求，立即返回任务当前快照。")
// @ReplayProtected
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
@AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.EXECUTE, summary = "执行离线升级任务")
public ApiResponse<UpgradeTaskResponse> execute(
@Parameter(description = "升级任务号")
@ -63,7 +69,7 @@ public class UpgradeController {
@PostMapping("/upgrades/{taskId}/rollback")
@Operation(summary = "回滚离线升级任务", description = "异步受理升级回滚请求，立即返回任务当前快照。")
// @ReplayProtected
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL)
@AuditedOperation(module = ModuleCode.UPGRADE, action = ActionType.ROLLBACK, summary = "回滚离线升级任务")
public ApiResponse<UpgradeTaskResponse> rollback(
@Parameter(description = "升级任务号")
@ -74,6 +80,7 @@ public class UpgradeController {
@GetMapping("/upgrades")
@Operation(summary = "查询升级记录列表", description = "分页查询升级任务列表，支持按升级对象、状态和升级日期筛选。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<UpgradeTaskPageResponse> list(
@RequestParam(defaultValue = "1") int page,
@RequestParam(defaultValue = "10") int pageSize,
@ -87,6 +94,7 @@ public class UpgradeController {
@GetMapping("/upgrades/{taskId}")
@Operation(summary = "查询升级任务详情", description = "返回单个升级任务的状态、版本变化和日志路径等信息。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<UpgradeTaskResponse> detail(
@Parameter(description = "升级任务号")
@PathVariable String taskId
@ -96,6 +104,7 @@ public class UpgradeController {
@GetMapping("/upgrades/{taskId}/log")
@Operation(summary = "查询升级任务日志", description = "读取升级任务的日志文件内容，返回升级执行日志。")
@RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.LIMITED)
public ApiResponse<UpgradeLogResponse> log(
@Parameter(description = "升级任务号")
@PathVariable String taskId