diff --git a/CarbonSysBE1/.gitignore b/CarbonSysBE1/.gitignore
new file mode 100644
index 0000000..1db161b
--- /dev/null
+++ b/CarbonSysBE1/.gitignore
@@ -0,0 +1,33 @@
+HELP.md
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**
+!**/src/test/**
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+
+### VS Code ###
+.vscode/
+
+*.DS_Store
diff --git a/CarbonSysBE1/mvnw b/CarbonSysBE1/mvnw
new file mode 100644
index 0000000..a16b543
--- /dev/null
+++ b/CarbonSysBE1/mvnw
@@ -0,0 +1,310 @@
+#!/bin/sh
+# ----------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+# ----------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
+# Maven Start Up Batch script
+#
+# Required ENV vars:
+# ------------------
+# JAVA_HOME - location of a JDK home dir
+#
+# Optional ENV vars
+# -----------------
+# M2_HOME - location of maven2's installed home dir
+# MAVEN_OPTS - parameters passed to the Java VM when running Maven
+# e.g. to debug Maven itself, use
+# set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
+# MAVEN_SKIP_RC - flag to disable loading of mavenrc files
+# ----------------------------------------------------------------------------
+
+if [ -z "$MAVEN_SKIP_RC" ] ; then
+
+ if [ -f /etc/mavenrc ] ; then
+ . /etc/mavenrc
+ fi
+
+ if [ -f "$HOME/.mavenrc" ] ; then
+ . "$HOME/.mavenrc"
+ fi
+
+fi
+
+# OS specific support. $var _must_ be set to either true or false.
+cygwin=false;
+darwin=false;
+mingw=false
+case "`uname`" in
+ CYGWIN*) cygwin=true ;;
+ MINGW*) mingw=true;;
+ Darwin*) darwin=true
+ # Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home
+ # See https://developer.apple.com/library/mac/qa/qa1170/_index.html
+ if [ -z "$JAVA_HOME" ]; then
+ if [ -x "/usr/libexec/java_home" ]; then
+ export JAVA_HOME="`/usr/libexec/java_home`"
+ else
+ export JAVA_HOME="/Library/Java/Home"
+ fi
+ fi
+ ;;
+esac
+
+if [ -z "$JAVA_HOME" ] ; then
+ if [ -r /etc/gentoo-release ] ; then
+ JAVA_HOME=`java-config --jre-home`
+ fi
+fi
+
+if [ -z "$M2_HOME" ] ; then
+ ## resolve links - $0 may be a link to maven's home
+ PRG="$0"
+
+ # need this for relative symlinks
+ while [ -h "$PRG" ] ; do
+ ls=`ls -ld "$PRG"`
+ link=`expr "$ls" : '.*-> \(.*\)$'`
+ if expr "$link" : '/.*' > /dev/null; then
+ PRG="$link"
+ else
+ PRG="`dirname "$PRG"`/$link"
+ fi
+ done
+
+ saveddir=`pwd`
+
+ M2_HOME=`dirname "$PRG"`/..
+
+ # make it fully qualified
+ M2_HOME=`cd "$M2_HOME" && pwd`
+
+ cd "$saveddir"
+ # echo Using m2 at $M2_HOME
+fi
+
+# For Cygwin, ensure paths are in UNIX format before anything is touched
+if $cygwin ; then
+ [ -n "$M2_HOME" ] &&
+ M2_HOME=`cygpath --unix "$M2_HOME"`
+ [ -n "$JAVA_HOME" ] &&
+ JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
+ [ -n "$CLASSPATH" ] &&
+ CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
+fi
+
+# For Mingw, ensure paths are in UNIX format before anything is touched
+if $mingw ; then
+ [ -n "$M2_HOME" ] &&
+ M2_HOME="`(cd "$M2_HOME"; pwd)`"
+ [ -n "$JAVA_HOME" ] &&
+ JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`"
+fi
+
+if [ -z "$JAVA_HOME" ]; then
+ javaExecutable="`which javac`"
+ if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '\([^ ]*\)'`" = "no" ]; then
+ # readlink(1) is not available as standard on Solaris 10.
+ readLink=`which readlink`
+ if [ ! `expr "$readLink" : '\([^ ]*\)'` = "no" ]; then
+ if $darwin ; then
+ javaHome="`dirname \"$javaExecutable\"`"
+ javaExecutable="`cd \"$javaHome\" && pwd -P`/javac"
+ else
+ javaExecutable="`readlink -f \"$javaExecutable\"`"
+ fi
+ javaHome="`dirname \"$javaExecutable\"`"
+ javaHome=`expr "$javaHome" : '\(.*\)/bin'`
+ JAVA_HOME="$javaHome"
+ export JAVA_HOME
+ fi
+ fi
+fi
+
+if [ -z "$JAVACMD" ] ; then
+ if [ -n "$JAVA_HOME" ] ; then
+ if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+ # IBM's JDK on AIX uses strange locations for the executables
+ JAVACMD="$JAVA_HOME/jre/sh/java"
+ else
+ JAVACMD="$JAVA_HOME/bin/java"
+ fi
+ else
+ JAVACMD="`which java`"
+ fi
+fi
+
+if [ ! -x "$JAVACMD" ] ; then
+ echo "Error: JAVA_HOME is not defined correctly." >&2
+ echo " We cannot execute $JAVACMD" >&2
+ exit 1
+fi
+
+if [ -z "$JAVA_HOME" ] ; then
+ echo "Warning: JAVA_HOME environment variable is not set."
+fi
+
+CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher
+
+# traverses directory structure from process work directory to filesystem root
+# first directory with .mvn subdirectory is considered project base directory
+find_maven_basedir() {
+
+ if [ -z "$1" ]
+ then
+ echo "Path not specified to find_maven_basedir"
+ return 1
+ fi
+
+ basedir="$1"
+ wdir="$1"
+ while [ "$wdir" != '/' ] ; do
+ if [ -d "$wdir"/.mvn ] ; then
+ basedir=$wdir
+ break
+ fi
+ # workaround for JBEAP-8937 (on Solaris 10/Sparc)
+ if [ -d "${wdir}" ]; then
+ wdir=`cd "$wdir/.."; pwd`
+ fi
+ # end of workaround
+ done
+ echo "${basedir}"
+}
+
+# concatenates all lines of a file
+concat_lines() {
+ if [ -f "$1" ]; then
+ echo "$(tr -s '\n' ' ' < "$1")"
+ fi
+}
+
+BASE_DIR=`find_maven_basedir "$(pwd)"`
+if [ -z "$BASE_DIR" ]; then
+ exit 1;
+fi
+
+##########################################################################################
+# Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
+# This allows using the maven wrapper in projects that prohibit checking in binary data.
+##########################################################################################
+if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Found .mvn/wrapper/maven-wrapper.jar"
+ fi
+else
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..."
+ fi
+ if [ -n "$MVNW_REPOURL" ]; then
+ jarUrl="$MVNW_REPOURL/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar"
+ else
+ jarUrl="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar"
+ fi
+ while IFS="=" read key value; do
+ case "$key" in (wrapperUrl) jarUrl="$value"; break ;;
+ esac
+ done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties"
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Downloading from: $jarUrl"
+ fi
+ wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar"
+ if $cygwin; then
+ wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"`
+ fi
+
+ if command -v wget > /dev/null; then
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Found wget ... using wget"
+ fi
+ if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
+ wget "$jarUrl" -O "$wrapperJarPath"
+ else
+ wget --http-user=$MVNW_USERNAME --http-password=$MVNW_PASSWORD "$jarUrl" -O "$wrapperJarPath"
+ fi
+ elif command -v curl > /dev/null; then
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Found curl ... using curl"
+ fi
+ if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
+ curl -o "$wrapperJarPath" "$jarUrl" -f
+ else
+ curl --user $MVNW_USERNAME:$MVNW_PASSWORD -o "$wrapperJarPath" "$jarUrl" -f
+ fi
+
+ else
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo "Falling back to using Java to download"
+ fi
+ javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java"
+ # For Cygwin, switch paths to Windows format before running javac
+ if $cygwin; then
+ javaClass=`cygpath --path --windows "$javaClass"`
+ fi
+ if [ -e "$javaClass" ]; then
+ if [ ! -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo " - Compiling MavenWrapperDownloader.java ..."
+ fi
+ # Compiling the Java class
+ ("$JAVA_HOME/bin/javac" "$javaClass")
+ fi
+ if [ -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then
+ # Running the downloader
+ if [ "$MVNW_VERBOSE" = true ]; then
+ echo " - Running MavenWrapperDownloader.java ..."
+ fi
+ ("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR")
+ fi
+ fi
+ fi
+fi
+##########################################################################################
+# End of extension
+##########################################################################################
+
+export MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}
+if [ "$MVNW_VERBOSE" = true ]; then
+ echo $MAVEN_PROJECTBASEDIR
+fi
+MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS"
+
+# For Cygwin, switch paths to Windows format before running java
+if $cygwin; then
+ [ -n "$M2_HOME" ] &&
+ M2_HOME=`cygpath --path --windows "$M2_HOME"`
+ [ -n "$JAVA_HOME" ] &&
+ JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"`
+ [ -n "$CLASSPATH" ] &&
+ CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
+ [ -n "$MAVEN_PROJECTBASEDIR" ] &&
+ MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"`
+fi
+
+# Provide a "standardized" way to retrieve the CLI args that will
+# work with both Windows and non-Windows executions.
+MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@"
+export MAVEN_CMD_LINE_ARGS
+
+WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
+
+exec "$JAVACMD" \
+ $MAVEN_OPTS \
+ -classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \
+ "-Dmaven.home=${M2_HOME}" "-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \
+ ${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@"
diff --git a/CarbonSysBE1/mvnw.cmd b/CarbonSysBE1/mvnw.cmd
new file mode 100644
index 0000000..c8d4337
--- /dev/null
+++ b/CarbonSysBE1/mvnw.cmd
@@ -0,0 +1,182 @@
+@REM ----------------------------------------------------------------------------
+@REM Licensed to the Apache Software Foundation (ASF) under one
+@REM or more contributor license agreements. See the NOTICE file
+@REM distributed with this work for additional information
+@REM regarding copyright ownership. The ASF licenses this file
+@REM to you under the Apache License, Version 2.0 (the
+@REM "License"); you may not use this file except in compliance
+@REM with the License. You may obtain a copy of the License at
+@REM
+@REM https://www.apache.org/licenses/LICENSE-2.0
+@REM
+@REM Unless required by applicable law or agreed to in writing,
+@REM software distributed under the License is distributed on an
+@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+@REM KIND, either express or implied. See the License for the
+@REM specific language governing permissions and limitations
+@REM under the License.
+@REM ----------------------------------------------------------------------------
+
+@REM ----------------------------------------------------------------------------
+@REM Maven Start Up Batch script
+@REM
+@REM Required ENV vars:
+@REM JAVA_HOME - location of a JDK home dir
+@REM
+@REM Optional ENV vars
+@REM M2_HOME - location of maven2's installed home dir
+@REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands
+@REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending
+@REM MAVEN_OPTS - parameters passed to the Java VM when running Maven
+@REM e.g. to debug Maven itself, use
+@REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
+@REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files
+@REM ----------------------------------------------------------------------------
+
+@REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on'
+@echo off
+@REM set title of command window
+title %0
+@REM enable echoing by setting MAVEN_BATCH_ECHO to 'on'
+@if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO%
+
+@REM set %HOME% to equivalent of $HOME
+if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%")
+
+@REM Execute a user defined script before this one
+if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre
+@REM check for pre script, once with legacy .bat ending and once with .cmd ending
+if exist "%HOME%\mavenrc_pre.bat" call "%HOME%\mavenrc_pre.bat"
+if exist "%HOME%\mavenrc_pre.cmd" call "%HOME%\mavenrc_pre.cmd"
+:skipRcPre
+
+@setlocal
+
+set ERROR_CODE=0
+
+@REM To isolate internal variables from possible post scripts, we use another setlocal
+@setlocal
+
+@REM ==== START VALIDATION ====
+if not "%JAVA_HOME%" == "" goto OkJHome
+
+echo.
+echo Error: JAVA_HOME not found in your environment. >&2
+echo Please set the JAVA_HOME variable in your environment to match the >&2
+echo location of your Java installation. >&2
+echo.
+goto error
+
+:OkJHome
+if exist "%JAVA_HOME%\bin\java.exe" goto init
+
+echo.
+echo Error: JAVA_HOME is set to an invalid directory. >&2
+echo JAVA_HOME = "%JAVA_HOME%" >&2
+echo Please set the JAVA_HOME variable in your environment to match the >&2
+echo location of your Java installation. >&2
+echo.
+goto error
+
+@REM ==== END VALIDATION ====
+
+:init
+
+@REM Find the project base dir, i.e. the directory that contains the folder ".mvn".
+@REM Fallback to current working directory if not found.
+
+set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR%
+IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir
+
+set EXEC_DIR=%CD%
+set WDIR=%EXEC_DIR%
+:findBaseDir
+IF EXIST "%WDIR%"\.mvn goto baseDirFound
+cd ..
+IF "%WDIR%"=="%CD%" goto baseDirNotFound
+set WDIR=%CD%
+goto findBaseDir
+
+:baseDirFound
+set MAVEN_PROJECTBASEDIR=%WDIR%
+cd "%EXEC_DIR%"
+goto endDetectBaseDir
+
+:baseDirNotFound
+set MAVEN_PROJECTBASEDIR=%EXEC_DIR%
+cd "%EXEC_DIR%"
+
+:endDetectBaseDir
+
+IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig
+
+@setlocal EnableExtensions EnableDelayedExpansion
+for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a
+@endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS%
+
+:endReadAdditionalConfig
+
+SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
+set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
+set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
+
+set DOWNLOAD_URL="https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar"
+
+FOR /F "tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
+ IF "%%A"=="wrapperUrl" SET DOWNLOAD_URL=%%B
+)
+
+@REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
+@REM This allows using the maven wrapper in projects that prohibit checking in binary data.
+if exist %WRAPPER_JAR% (
+ if "%MVNW_VERBOSE%" == "true" (
+ echo Found %WRAPPER_JAR%
+ )
+) else (
+ if not "%MVNW_REPOURL%" == "" (
+ SET DOWNLOAD_URL="%MVNW_REPOURL%/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar"
+ )
+ if "%MVNW_VERBOSE%" == "true" (
+ echo Couldn't find %WRAPPER_JAR%, downloading it ...
+ echo Downloading from: %DOWNLOAD_URL%
+ )
+
+ powershell -Command "&{"^
+ "$webclient = new-object System.Net.WebClient;"^
+ "if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^
+ "$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^
+ "}"^
+ "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%DOWNLOAD_URL%', '%WRAPPER_JAR%')"^
+ "}"
+ if "%MVNW_VERBOSE%" == "true" (
+ echo Finished downloading %WRAPPER_JAR%
+ )
+)
+@REM End of extension
+
+@REM Provide a "standardized" way to retrieve the CLI args that will
+@REM work with both Windows and non-Windows executions.
+set MAVEN_CMD_LINE_ARGS=%*
+
+%MAVEN_JAVA_EXE% %JVM_CONFIG_MAVEN_PROPS% %MAVEN_OPTS% %MAVEN_DEBUG_OPTS% -classpath %WRAPPER_JAR% "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" %WRAPPER_LAUNCHER% %MAVEN_CONFIG% %*
+if ERRORLEVEL 1 goto error
+goto end
+
+:error
+set ERROR_CODE=1
+
+:end
+@endlocal & set ERROR_CODE=%ERROR_CODE%
+
+if not "%MAVEN_SKIP_RC%" == "" goto skipRcPost
+@REM check for post script, once with legacy .bat ending and once with .cmd ending
+if exist "%HOME%\mavenrc_post.bat" call "%HOME%\mavenrc_post.bat"
+if exist "%HOME%\mavenrc_post.cmd" call "%HOME%\mavenrc_post.cmd"
+:skipRcPost
+
+@REM pause the script if MAVEN_BATCH_PAUSE is set to 'on'
+if "%MAVEN_BATCH_PAUSE%" == "on" pause
+
+if "%MAVEN_TERMINATE_CMD%" == "on" exit %ERROR_CODE%
+
+exit /B %ERROR_CODE%
diff --git a/CarbonSysBE1/pom.xml b/CarbonSysBE1/pom.xml
new file mode 100644
index 0000000..cc14fd4
--- /dev/null
+++ b/CarbonSysBE1/pom.xml
@@ -0,0 +1,181 @@
+
+
+ 4.0.0
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.6.1
+
+
+ edu.ncst
+ carbon
+ 0.0.1-SNAPSHOT
+ carbon
+ carbon project for Spring Boot
+
+ 1.8
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+ org.mybatis.spring.boot
+ mybatis-spring-boot-starter
+ 2.2.0
+
+
+ org.springframework.boot
+ spring-boot-devtools
+ runtime
+ true
+
+
+ mysql
+ mysql-connector-java
+ runtime
+
+
+ org.projectlombok
+ lombok
+ true
+
+
+ org.springframework.boot
+ spring-boot-starter-test
+ test
+
+
+ com.alibaba
+ fastjson
+ 1.2.35
+
+
+
+ org.mybatis.spring.boot
+ mybatis-spring-boot-starter
+ 2.1.3
+
+
+
+ com.baomidou
+ mybatis-plus-boot-starter
+ 3.3.2
+
+
+ com.baomidou
+ mybatis-plus-generator
+ 3.3.2
+
+
+
+ javax.validation
+ validation-api
+ 2.0.1.Final
+
+
+ org.hibernate
+ hibernate-validator
+ 6.0.13.Final
+
+
+
+ io.jsonwebtoken
+ jjwt
+ 0.9.0
+
+
+
+ org.springframework.boot
+ spring-boot-starter-data-redis
+
+
+
+ org.springframework.boot
+ spring-boot-starter-aop
+
+
+ org.aspectj
+ aspectjweaver
+ 1.9.5
+
+
+
+ org.springframework
+ springloaded
+ 1.2.8.RELEASE
+
+
+ org.springframework.boot
+ spring-boot-devtools
+
+
+ org.springframework.boot
+ spring-boot-starter-security
+
+
+ org.bouncycastle
+ bcprov-jdk15on
+ 1.64
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ com.spring4all
+ swagger-spring-boot-starter
+ 1.9.1.RELEASE
+
+
+ com.google.guava
+ guava
+ 25.1-jre
+
+
+
+ org.springframework.boot
+ spring-boot-configuration-processor
+ true
+
+
+ org.assertj
+ assertj-core
+
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-maven-plugin
+
+
+
+ org.projectlombok
+ lombok
+
+
+
+
+
+
+
+
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/CarbonSysApplication.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/CarbonSysApplication.java
new file mode 100644
index 0000000..c5c6891
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/CarbonSysApplication.java
@@ -0,0 +1,33 @@
+package edu.ncst.carbon;
+
+import com.baomidou.mybatisplus.extension.plugins.PaginationInterceptor;
+import org.mybatis.spring.annotation.MapperScan;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import com.spring4all.swagger.EnableSwagger2Doc;
+import org.springframework.cache.annotation.EnableCaching;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.EnableAspectJAutoProxy;
+import org.springframework.transaction.annotation.EnableTransactionManagement;
+
+
+@EnableSwagger2Doc
+@SpringBootApplication
+@MapperScan(basePackages = {"edu.ncst.carbon.mapper"})
+@EnableTransactionManagement
+@EnableCaching
+@EnableAspectJAutoProxy(exposeProxy=true)
+public class CarbonSysApplication {
+ /**
+ * 分页插件
+ */
+ @Bean
+ public PaginationInterceptor paginationInterceptor() {
+ return new PaginationInterceptor();
+ }
+
+ public static void main(String[] args) {
+ SpringApplication.run(CarbonSysApplication.class, args);
+ }
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LogOperate.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LogOperate.java
new file mode 100644
index 0000000..606f29b
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LogOperate.java
@@ -0,0 +1,15 @@
+package edu.ncst.carbon.aspect;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 记录操作日志的注解
+ */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface LogOperate {
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LoginUserScope.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LoginUserScope.java
new file mode 100644
index 0000000..58798c4
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/aspect/LoginUserScope.java
@@ -0,0 +1,15 @@
+package edu.ncst.carbon.aspect;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 登录用户用户访问权限
+ */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface LoginUserScope {
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/CustomAccessDeniedHandler.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/CustomAccessDeniedHandler.java
new file mode 100644
index 0000000..2dfa430
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/CustomAccessDeniedHandler.java
@@ -0,0 +1,34 @@
+package edu.ncst.carbon.config;
+
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.stereotype.Service;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+@Service
+public class CustomAccessDeniedHandler implements AccessDeniedHandler {
+
+ @Autowired
+ private ObjectMapper objectMapper;
+
+ @Override
+ public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
+ response.setContentType("application/json;charset=UTF-8");
+ Map map = new HashMap();
+ map.put("code",403);
+ map.put("msg", "无访问权限");
+ map.put("data","");
+ response.setContentType("application/json");
+ response.setStatus(HttpServletResponse.SC_OK);
+ response.getWriter().write(objectMapper.writeValueAsString(map));
+ }
+}
\ No newline at end of file
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/JsonConfig.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/JsonConfig.java
new file mode 100644
index 0000000..ab8c192
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/JsonConfig.java
@@ -0,0 +1,47 @@
+
+package edu.ncst.carbon.config;
+
+import com.alibaba.fastjson.serializer.SerializerFeature;
+import com.alibaba.fastjson.support.config.FastJsonConfig;
+import com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.MediaType;
+import org.springframework.http.converter.HttpMessageConverter;
+
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.List;
+
+@Configuration
+public class JsonConfig {
+
+
+ @Bean
+ public HttpMessageConverter configureMessageConverters() {
+ FastJsonHttpMessageConverter converter = new FastJsonHttpMessageConverter();
+ FastJsonConfig config = new FastJsonConfig();
+ config.setSerializerFeatures(
+ // 保留map空的字段
+ SerializerFeature.WriteMapNullValue,
+ // 将String类型的null转成""
+ SerializerFeature.WriteNullStringAsEmpty,
+ // 将Number类型的null转成0
+ SerializerFeature.WriteNullNumberAsZero,
+ // 将List类型的null转成[]
+ SerializerFeature.WriteNullListAsEmpty,
+ // 将Boolean类型的null转成false
+ SerializerFeature.WriteNullBooleanAsFalse,
+ // 避免循环引用
+ SerializerFeature.DisableCircularReferenceDetect);
+
+ converter.setFastJsonConfig(config);
+ converter.setDefaultCharset(Charset.forName("UTF-8"));
+ List mediaTypeList = new ArrayList<>();
+ // 解决中文乱码问题,相当于在Controller上的@RequestMapping中加了个属性produces = "application/json"
+ mediaTypeList.add(MediaType.APPLICATION_JSON);
+ converter.setSupportedMediaTypes(mediaTypeList);
+ return converter;
+ }
+ }
+
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/RedisConfig.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/RedisConfig.java
new file mode 100644
index 0000000..958c480
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/RedisConfig.java
@@ -0,0 +1,59 @@
+package edu.ncst.carbon.config;
+
+import org.springframework.cache.annotation.CachingConfigurerSupport;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.redis.cache.RedisCacheConfiguration;
+import org.springframework.data.redis.cache.RedisCacheManager;
+import org.springframework.data.redis.cache.RedisCacheWriter;
+import org.springframework.data.redis.connection.RedisConnectionFactory;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.data.redis.serializer.GenericJackson2JsonRedisSerializer;
+import org.springframework.data.redis.serializer.RedisSerializationContext;
+import org.springframework.data.redis.serializer.StringRedisSerializer;
+
+import java.io.Serializable;
+import java.util.Objects;
+
+@Configuration
+public class RedisConfig extends CachingConfigurerSupport {
+
+ @Bean
+ public RedisTemplate redisTemplate(RedisConnectionFactory redisConnectionFactory) {
+ RedisTemplate redisTemplate = new RedisTemplate();
+ redisTemplate.setConnectionFactory(redisConnectionFactory);
+
+ // 解决 key 序列化方式
+ StringRedisSerializer stringRedisSerializer = new StringRedisSerializer();
+ redisTemplate.setKeySerializer(stringRedisSerializer);
+ redisTemplate.setHashKeySerializer(stringRedisSerializer);
+
+ // 解决 value 序列化
+ GenericJackson2JsonRedisSerializer genericJackson2JsonRedisSerializer = new GenericJackson2JsonRedisSerializer();
+ redisTemplate.setValueSerializer(genericJackson2JsonRedisSerializer);
+
+ return redisTemplate;
+ }
+
+ @Bean
+ public RedisTemplate redisCacheTemplate(RedisConnectionFactory connectionFactory) {
+ RedisTemplate template = new RedisTemplate<>();
+ template.setKeySerializer(new StringRedisSerializer());
+ template.setValueSerializer(new GenericJackson2JsonRedisSerializer());
+ template.setConnectionFactory(connectionFactory);
+ return template;
+ }
+
+ @Bean
+ public RedisCacheManager redisCacheManager(RedisTemplate redisTemplate) {
+ RedisCacheWriter redisCacheWriter = RedisCacheWriter.nonLockingRedisCacheWriter(Objects.requireNonNull(redisTemplate.getConnectionFactory()));
+
+ RedisCacheConfiguration redisCacheConfiguration = RedisCacheConfiguration.defaultCacheConfig()
+ .serializeValuesWith(
+ RedisSerializationContext.SerializationPair.fromSerializer(redisTemplate.getValueSerializer())
+ );
+
+ return new RedisCacheManager(redisCacheWriter, redisCacheConfiguration);
+ }
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/SecurityConfig.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/SecurityConfig.java
new file mode 100644
index 0000000..32478c1
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/SecurityConfig.java
@@ -0,0 +1,218 @@
+package edu.ncst.carbon.config;
+
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import edu.ncst.carbon.config.security.DataBaseUrlVoter;
+
+import edu.ncst.carbon.config.security.filter.AuthCheckFilter;
+import edu.ncst.carbon.config.security.filter.LoginFilter;
+import edu.ncst.carbon.config.security.provider.WechatIdLoginProvider;
+import edu.ncst.carbon.exception.CodeMsg;
+import edu.ncst.carbon.service.ILoginLogService;
+import edu.ncst.carbon.service.impl.system.UserServiceImpl;
+import edu.ncst.carbon.utils.ResultUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.security.access.AccessDecisionManager;
+import org.springframework.security.access.AccessDecisionVoter;
+import org.springframework.security.access.vote.AuthenticatedVoter;
+import org.springframework.security.access.vote.RoleVoter;
+import org.springframework.security.access.vote.UnanimousBased;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.access.expression.WebExpressionVoter;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+import java.io.PrintWriter;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * 安全配置
+ */
+@Configuration
+@EnableWebSecurity
+@EnableGlobalMethodSecurity(securedEnabled=true)
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+
+ @Autowired
+ private UserServiceImpl userService;
+ @Autowired
+ private ILoginLogService loginLogService;
+ @Autowired
+ private DataBaseUrlVoter dataBaseUrlVoter;
+ @Autowired
+ private RedisTemplate redisCacheTemplate;
+
+ @Autowired
+ private WechatIdLoginProvider wechatIdLoginProvider;
+ /**
+ * 认证失败处理类
+ */
+ @Autowired
+ CustomAccessDeniedHandler accessDeniedHandler;
+
+//org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126)
+ /**
+ * 解决 无法直接注入 AuthenticationManager
+ *
+ * @return
+ * @throws Exception
+ */
+ @Bean
+ @Override
+ public AuthenticationManager authenticationManagerBean() throws Exception
+ {
+ return super.authenticationManagerBean();
+ }
+
+ /**
+ * 权限白名单
+ * 注意:该名单下匹配的 URL 不会经过鉴权,因此也无法获取当前用户的信息
+ */
+ private final String[] WHITE_LIST = {
+ "/v2/api-docs",
+ "/configuration/ui",
+ "/swagger-resources/**",
+ "/configuration/**",
+ "/swagger-ui.html",
+ "/webjars/**",
+ "/api/captcha.jpg",
+ "/websocket/**",
+ "/api/image/get/**",
+ "/common/download/**",
+ "/test/**",
+ "/*.html",
+ "/**/*.html",
+ "/**/*.css",
+ "/**/*.js",
+ "/error*"
+ };
+
+ /**
+ * 密码加密器
+ */
+ @Bean
+ public PasswordEncoder passwordEncoderBean() {
+ return new BCryptPasswordEncoder();
+ }
+
+ /**
+ * 权限投票访问决策管理器
+ */
+ @Bean
+ public AccessDecisionManager accessDecisionManager() {
+ List> decisionVoters
+ = Arrays.asList(
+ new WebExpressionVoter(),
+ new RoleVoter(),//主要用来判断当前请求是否具备该接口所需要的角色
+ dataBaseUrlVoter,
+ new AuthenticatedVoter());
+ return new UnanimousBased(decisionVoters);//要求所有 AccessDecisionVoter 均返回肯定的结果时,才代表授予权限。
+ }
+
+ /**
+ * 此处给AuthenticationManager添加登陆验证的逻辑。
+ * 这里添加了两个AuthenticationProvider分别用于用户名密码登陆的验证以及token授权登陆两种方式。
+ * 在处理登陆信息的过滤器执行的时候会调用这两个provider进行登陆验证。
+ */
+ @Override
+ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+ auth.userDetailsService(userService);
+ auth.authenticationProvider(wechatIdLoginProvider);
+ }
+
+
+ /**
+ * anyRequest | 匹配所有请求路径
+ * access | SpringEl表达式结果为true时可以访问
+ * anonymous | 匿名可以访问
+ * denyAll | 用户不能访问
+ * fullyAuthenticated | 用户完全认证可以访问(非remember-me下自动登录)
+ * hasAnyAuthority | 如果有参数,参数表示权限,则其中任何一个权限可以访问
+ * hasAnyRole | 如果有参数,参数表示角色,则其中任何一个角色可以访问
+ * hasAuthority | 如果有参数,参数表示权限,则其权限可以访问
+ * hasIpAddress | 如果有参数,参数表示IP地址,如果用户IP和参数匹配,则可以访问
+ * hasRole | 如果有参数,参数表示角色,则其角色可以访问
+ * permitAll | 用户可以任意访问
+ * rememberMe | 允许通过remember-me登录的用户访问
+ * authenticated | 用户登录后可访问
+ */
+ //权限验证 基于资源配置
+ // HttpSecurity 及WebSecurity 作用是不一样的:
+ // WebSecurity 主要针对的全局的忽略规则,
+ // HttpSecurity主要是权限控制规则。
+ @Override
+ protected void configure(HttpSecurity http) throws Exception {
+
+ //允许跨域
+ http.cors().and().anonymous().and()
+ // CRSF禁用,因为不使用session
+ .csrf().disable()
+ .formLogin().disable().httpBasic().disable()
+ .authorizeRequests()
+ .accessDecisionManager(accessDecisionManager())//访问决策管理器
+ .antMatchers("/api/login").permitAll()
+ .antMatchers("/system/init").permitAll()
+ // 除上面外的所有请求全部需要鉴权认证
+ .anyRequest().authenticated()
+ // 授权异常处理,权限拦截器,提示用户没有当前权限
+ .and().exceptionHandling().accessDeniedHandler(accessDeniedHandler).and()
+ // 不需要session(不创建会话)
+ .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
+
+ // LoginFilter:统一登录接口
+ // AuthCheckFilter:用户凭证检查过滤器
+ http.addFilterBefore( new AuthCheckFilter(redisCacheTemplate), UsernamePasswordAuthenticationFilter.class )
+ .addFilterAt( new LoginFilter(authenticationManager(), loginLogService, redisCacheTemplate), UsernamePasswordAuthenticationFilter.class )
+ .exceptionHandling()//登录认证失败
+ .authenticationEntryPoint(((request, response, authException) -> {
+ response.setCharacterEncoding("utf-8");
+ response.setContentType("application/json;charset=utf-8");
+
+ PrintWriter out = response.getWriter();
+ out.write(new ObjectMapper().writeValueAsString(ResultUtils.error(CodeMsg.USER_NEED_LOGIN)));
+ out.flush();
+ out.close();
+ }));
+
+ // 退出登录
+ http.logout()
+ .logoutUrl("/logout")
+ .deleteCookies("JSESSIONID")
+ .logoutSuccessHandler(((request, response, authentication) -> {
+ PrintWriter out = response.getWriter();
+ response.setContentType("application/json");
+ out.write(new ObjectMapper().writeValueAsString(ResultUtils.success("注销成功")));
+ out.flush();
+ out.close();
+ }));
+ }
+
+
+// @Override
+// protected void configure(HttpSecurity httpSecurity) throws Exception{
+// //调试阶段
+// httpSecurity.csrf().disable().authorizeRequests();
+// httpSecurity.authorizeRequests().anyRequest()
+// .permitAll().and().logout().permitAll();
+// }
+
+ //用于配置全局的某些通用事物,例如静态资源等
+ @Override
+ public void configure(WebSecurity web) throws Exception {
+ web.ignoring().antMatchers(WHITE_LIST);
+ }
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/CodeBeenUsedException.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/CodeBeenUsedException.java
new file mode 100644
index 0000000..38da264
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/CodeBeenUsedException.java
@@ -0,0 +1,13 @@
+package edu.ncst.carbon.config.exception;
+
+import org.springframework.security.core.AuthenticationException;
+
+public class CodeBeenUsedException extends AuthenticationException {
+ public CodeBeenUsedException(String msg, Throwable t) {
+ super(msg, t);
+ }
+
+ public CodeBeenUsedException(String msg) {
+ super(msg);
+ }
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/NotBindUserException.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/NotBindUserException.java
new file mode 100644
index 0000000..2fcf310
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/exception/NotBindUserException.java
@@ -0,0 +1,15 @@
+package edu.ncst.carbon.config.exception;
+
+import org.springframework.security.core.AuthenticationException;
+
+public class NotBindUserException extends AuthenticationException {
+
+ public NotBindUserException(String msg, Throwable t) {
+ super(msg, t);
+ }
+
+ public NotBindUserException(String msg) {
+ super(msg);
+ }
+
+}
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/DataBaseUrlVoter.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/DataBaseUrlVoter.java
new file mode 100644
index 0000000..bafe656
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/DataBaseUrlVoter.java
@@ -0,0 +1,109 @@
+package edu.ncst.carbon.config.security;
+
+import edu.ncst.carbon.model.system.Role;
+import edu.ncst.carbon.service.IResourceService;
+import edu.ncst.carbon.utils.URLUtils;
+import edu.ncst.carbon.vo.user.UserInfoVO;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.AccessDecisionVoter;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.web.FilterInvocation;
+import org.springframework.stereotype.Component;
+import org.springframework.util.AntPathMatcher;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.stream.Collectors;
+
+/**
+ * URL 鉴权投票器
+ */
+@Component
+public class DataBaseUrlVoter implements AccessDecisionVoter {
+
+ @Autowired
+ private IResourceService resourceService;
+
+ @Override
+ public boolean supports(ConfigAttribute attribute) {
+ return true;
+ }
+
+ @Override
+ public boolean supports(Class> clazz) {
+ return true;
+ }
+
+ @Override
+ public int vote(Authentication authentication, FilterInvocation fi, Collection attributes) {
+ if (authentication == null) {
+ return ACCESS_DENIED; // 反对票
+ }
+
+ String url = fi.getRequestUrl(); // 当前请求的URL
+ String urlWithoutQueryString = URLUtils.removeQueryString(url);
+
+ // Current User Info
+ Object details = authentication.getDetails();
+
+ if (details instanceof UserInfoVO) {
+ UserInfoVO userInfoVO = (UserInfoVO) details;
+ AntPathMatcher antPathMatcher = new AntPathMatcher();
+
+ //获取不限用户角色的资源
+ List permitAllResourceURLs = resourceService.getPermitAllResourceURLs();
+ // Permit All Resource
+ for (String permitUrl : permitAllResourceURLs) {
+ boolean match = antPathMatcher.match(permitUrl, urlWithoutQueryString);
+ if (match) {
+ return ACCESS_GRANTED; // 赞同票
+ }
+ }
+
+ // 判断用户角色信息
+ // 反对票:1、没有角色信息 2、角色未绑定该资源
+ // 赞成票:用户是超级管理员
+
+ List roles = userInfoVO.getRoles();
+ if (roles == null || roles.isEmpty()) {
+ return ACCESS_DENIED; // 反对票
+ }
+
+ List roleNames = roles.stream().map(Role::getName).collect(Collectors.toList());
+
+ // Super Admin User Always Pass
+ if (roleNames.contains("SUPER_ADMIN")) {
+ return ACCESS_GRANTED; // 赞同票
+ }
+
+ List rolesResourceList = resourceService.getRolesResourceList(roleNames);//获取目标角色绑定的资源
+
+
+
+
+ // Role Resource
+ if (rolesResourceList == null) {
+ return ACCESS_DENIED; // 反对票
+ }
+
+ for (String allowUrl : rolesResourceList) {
+ boolean match = antPathMatcher.match(allowUrl, urlWithoutQueryString);
+ if (match) {
+ return ACCESS_GRANTED; // 赞同票
+ }
+ }
+ }
+
+ return ACCESS_DENIED;
+ }
+
+ Collection extends GrantedAuthority> extractAuthorities(
+ Authentication authentication) {
+ return authentication.getAuthorities();
+ }
+
+
+}
+
diff --git a/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/filter/AuthCheckFilter.java b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/filter/AuthCheckFilter.java
new file mode 100644
index 0000000..12435e3
--- /dev/null
+++ b/CarbonSysBE1/src/main/java/edu/ncst/carbon/config/security/filter/AuthCheckFilter.java
@@ -0,0 +1,121 @@
+package edu.ncst.carbon.config.security.filter;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import edu.ncst.carbon.config.security.token.JwtAuthenticationToken;
+import edu.ncst.carbon.exception.CodeMsg;
+import edu.ncst.carbon.model.system.Role;
+import edu.ncst.carbon.utils.ResponseUtils;
+import edu.ncst.carbon.utils.ResultUtils;
+import edu.ncst.carbon.vo.ResultVO;
+import edu.ncst.carbon.vo.user.UserInfoVO;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.ExpiredJwtException;
+import io.jsonwebtoken.Jws;
+import io.jsonwebtoken.Jwts;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * 用户凭证检查过滤器
+ * 并不是所有的container都像我们期望的只过滤一次,servlet版本不同,表现也不同
+ * OncePerRequestFilter可以保证一次请求只通过一次过滤器。推荐自定义的授权过滤器继承OncePerRequestFilter
+ */
+@Slf4j
+public class AuthCheckFilter extends OncePerRequestFilter {
+ private final RedisTemplate stringRedisTemplate;
+
+ public AuthCheckFilter(RedisTemplate stringRedisTemplate) {
+ super();
+ this.stringRedisTemplate = stringRedisTemplate;
+ }
+ @Override
+ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+ String jwtToken = null;
+
+ // 优先从 Cookie 中获取 TOKEN
+ Cookie[] cookies = request.getCookies();
+
+ boolean cookieHasToken = false;
+ if (cookies != null) {
+ for (Cookie cookie : cookies) {
+ if ("SYS_TOKEN".equals(cookie.getName())) {
+ jwtToken = cookie.getValue();
+ cookieHasToken = true;
+ }
+ }
+ }
+
+ // 如果 Cookie 中不存在 TOKEN,则尝试从 Header 中获取 TOKEN
+ if (!cookieHasToken) {
+ String authorization = request.getHeader("Authorization");
+ log.info("开始鉴权====header Authorization====" + authorization);
+ if (authorization != null && authorization.startsWith("Bearer ")) {
+ jwtToken = authorization.replace("Bearer ", "");
+ log.info("获取到token====header====");
+ } else {
+ log.info("header中无token,进入过滤器链");
+ filterChain.doFilter(request, response);
+ return;
+ }
+ }
+
+ if (jwtToken == null || "".equals(jwtToken)) {
+ log.error("鉴权TOKEN:未获取,用户需要登录");
+ ResultVO