refactor: 适配 ContiNew Starter 加密模块（安全模块）

continew-org · Feb 8, 2024 · 6435175 · 6435175
1 parent 2109789
commit 6435175
Show file tree

Hide file tree

Showing 10 changed files with 89 additions and 27 deletions.
diff --git a/continew-admin-common/pom.xml b/continew-admin-common/pom.xml
@@ -96,6 +96,12 @@
  <artifactId>continew-starter-file-excel</artifactId>
  </dependency>
 
+ <!-- ContiNew Starter 安全模块 - 加密 -->
+ <dependency>
+ <groupId>top.charles7c.continew</groupId>
+ <artifactId>continew-starter-security-crypto</artifactId>
+ </dependency>
+
  <!-- ContiNew Starter 安全模块 - 脱敏 -->
  <dependency>
  <groupId>top.charles7c.continew</groupId>

diff --git a/...mon/src/main/java/top/charles7c/continew/admin/common/config/mybatis/BCryptEncryptor.java b/...mon/src/main/java/top/charles7c/continew/admin/common/config/mybatis/BCryptEncryptor.java
@@ -0,0 +1,29 @@
+package top.charles7c.continew.admin.common.config.mybatis;
+
+import org.springframework.security.crypto.password.PasswordEncoder;
+import top.charles7c.continew.starter.security.crypto.encryptor.IEncryptor;
+
+/**
+ * BCrypt 加/解密处理器（不可逆）
+ *
+ * @author Charles7c
+ * @since 2024/2/8 22:29
+ */
+public class BCryptEncryptor implements IEncryptor {
+
+ private final PasswordEncoder passwordEncoder;
+
+ public BCryptEncryptor(PasswordEncoder passwordEncoder) {
+ this.passwordEncoder = passwordEncoder;
+ }
+
+ @Override
+ public String encrypt(String plaintext, String password, String publicKey) throws Exception {
+ return passwordEncoder.encode(plaintext);
+ }
+
+ @Override
+ public String decrypt(String ciphertext, String password, String privateKey) throws Exception {
+ return ciphertext;
+ }
+}
diff --git a/...ain/java/top/charles7c/continew/admin/common/config/mybatis/MybatisPlusConfiguration.java b/...ain/java/top/charles7c/continew/admin/common/config/mybatis/MybatisPlusConfiguration.java
@@ -21,6 +21,7 @@
 
 import com.baomidou.mybatisplus.core.handlers.MetaObjectHandler;
 
+import org.springframework.security.crypto.password.PasswordEncoder;
 import top.charles7c.continew.starter.data.mybatis.plus.datapermission.DataPermissionFilter;
 
 /**
@@ -47,4 +48,12 @@ public MetaObjectHandler metaObjectHandler() {
  public DataPermissionFilter dataPermissionFilter() {
  return new DataPermissionFilterImpl();
  }
+
+ /**
+ * BCrypt 加/解密处理器
+ */
+ @Bean
+ public BCryptEncryptor bCryptEncryptor(PasswordEncoder passwordEncoder) {
+ return new BCryptEncryptor(passwordEncoder);
+ }
 }
diff --git a/...on/src/main/java/top/charles7c/continew/admin/common/config/properties/RsaProperties.java b/...on/src/main/java/top/charles7c/continew/admin/common/config/properties/RsaProperties.java
@@ -31,7 +31,7 @@ public class RsaProperties {
  public static final String PRIVATE_KEY;
 
  static {
- PRIVATE_KEY = SpringUtil.getProperty("rsa.privateKey");
+ PRIVATE_KEY = SpringUtil.getProperty("continew-starter.security.crypto.private-key");
  }
 
  private RsaProperties() {

diff --git a/...w-admin-system/src/main/java/top/charles7c/continew/admin/system/model/entity/UserDO.java b/...w-admin-system/src/main/java/top/charles7c/continew/admin/system/model/entity/UserDO.java
@@ -16,16 +16,17 @@
 
 package top.charles7c.continew.admin.system.model.entity;
 
-import java.io.Serial;
-import java.time.LocalDateTime;
-
-import lombok.Data;
-
 import com.baomidou.mybatisplus.annotation.TableName;
-
+import lombok.Data;
+import top.charles7c.continew.admin.common.config.mybatis.BCryptEncryptor;
 import top.charles7c.continew.admin.common.enums.DisEnableStatusEnum;
 import top.charles7c.continew.admin.common.enums.GenderEnum;
 import top.charles7c.continew.starter.extension.crud.model.entity.BaseDO;
+import top.charles7c.continew.starter.security.crypto.annotation.FieldEncrypt;
+import top.charles7c.continew.starter.security.crypto.enums.Algorithm;
+
+import java.io.Serial;
+import java.time.LocalDateTime;
 
 /**
  * 用户实体
@@ -53,6 +54,7 @@ public class UserDO extends BaseDO {
  /**
  * 密码
  */
+ @FieldEncrypt(encryptor = BCryptEncryptor.class)
  private String password;
 
  /**
@@ -63,11 +65,13 @@ public class UserDO extends BaseDO {
  /**
  * 邮箱
  */
+ @FieldEncrypt(Algorithm.AES)
  private String email;
 
  /**
  * 手机号码
  */
+ @FieldEncrypt(Algorithm.AES)
  private String phone;
 
  /**

diff --git a/...ystem/src/main/java/top/charles7c/continew/admin/system/service/impl/UserServiceImpl.java b/...ystem/src/main/java/top/charles7c/continew/admin/system/service/impl/UserServiceImpl.java
@@ -93,7 +93,6 @@ protected void beforeAdd(UserReq req) {
  String phone = req.getPhone();
  CheckUtils.throwIf(StrUtil.isNotBlank(phone) && this.isPhoneExists(phone, null), errorMsgTemplate, phone);
  req.setStatus(DisEnableStatusEnum.ENABLE);
- req.setPassword(passwordEncoder.encode(req.getPassword()));
  }
 
  @Override
@@ -201,12 +200,9 @@ public void updatePassword(String oldPassword, String newPassword, Long id) {
  CheckUtils.throwIf(!passwordEncoder.matches(oldPassword, password), "当前密码错误");
  }
  // 更新密码和密码重置时间
- LocalDateTime now = LocalDateTime.now();
- baseMapper.lambdaUpdate()
- .set(UserDO::getPassword, passwordEncoder.encode(newPassword))
- .set(UserDO::getPwdResetTime, now)
- .eq(UserDO::getId, id)
- .update();
+ user.setPassword(newPassword);
+ user.setPwdResetTime(LocalDateTime.now());
+ baseMapper.updateById(user);
  }
 
  @Override
@@ -234,7 +230,7 @@ public void updateEmail(String newEmail, String currentPassword, Long id) {
  @Override
  public void resetPassword(UserPasswordResetReq req, Long id) {
  UserDO user = super.getById(id);
- user.setPassword(passwordEncoder.encode(req.getNewPassword()));
+ user.setPassword(req.getNewPassword());
  user.setPwdResetTime(LocalDateTime.now());
  baseMapper.updateById(user);
  }

diff --git a/continew-admin-webapi/src/main/resources/config/application-dev.yml b/continew-admin-webapi/src/main/resources/config/application-dev.yml
@@ -236,18 +236,23 @@ sa-token.extension:
  # 本地存储资源
  - /file/**
 
+--- ### 字段加/解密配置
+continew-starter.security:
+ crypto:
+ enabled: true
+ # 对称加密算法密钥
+ password: abcdefghijklmnop
+ # 非对称加密算法密钥（在线生成 RSA 密钥对：http:https://web.chacuo.net/netrsakeypair）
+ public-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAM51dgYtMyF+tTQt80sfFOpSV27a7t9uaUVeFrdGiVxscuizE7H8SMntYqfn9lp8a5GH5P1/GGehVjUD2gF/4kcCAwEAAQ==
+ private-key: MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAznV2Bi0zIX61NC3zSx8U6lJXbtru325pRV4Wt0aJXGxy6LMTsfxIye1ip+f2WnxrkYfk/X8YZ6FWNQPaAX/iRwIDAQABAkEAk/VcAusrpIqA5Ac2P5Tj0VX3cOuXmyouaVcXonr7f+6y2YTjLQuAnkcfKKocQI/juIRQBFQIqqW/m1nmz1wGeQIhAO8XaA/KxzOIgU0l/4lm0A2Wne6RokJ9HLs1YpOzIUmVAiEA3Q9DQrpAlIuiT1yWAGSxA9RxcjUM/1kdVLTkv0avXWsCIE0X8woEjK7lOSwzMG6RpEx9YHdopjViOj1zPVH61KTxAiBmv/dlhqkJ4rV46fIXELZur0pj6WC3N7a4brR8a+CLLQIhAMQyerWl2cPNVtE/8tkziHKbwW3ZUiBXU24wFxedT9iV
+
 --- ### 密码编码器配置
 continew-starter.security:
  password:
  enabled: true
  # BCryptPasswordEncoder
  encoding-id: bcrypt
 
---- ### 非对称加密配置（例如：密码加密传输，前端公钥加密，后端私钥解密；在线生成 RSA 密钥对：http:https://web.chacuo.net/netrsakeypair）
-rsa:
- # 私钥
- privateKey: MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAznV2Bi0zIX61NC3zSx8U6lJXbtru325pRV4Wt0aJXGxy6LMTsfxIye1ip+f2WnxrkYfk/X8YZ6FWNQPaAX/iRwIDAQABAkEAk/VcAusrpIqA5Ac2P5Tj0VX3cOuXmyouaVcXonr7f+6y2YTjLQuAnkcfKKocQI/juIRQBFQIqqW/m1nmz1wGeQIhAO8XaA/KxzOIgU0l/4lm0A2Wne6RokJ9HLs1YpOzIUmVAiEA3Q9DQrpAlIuiT1yWAGSxA9RxcjUM/1kdVLTkv0avXWsCIE0X8woEjK7lOSwzMG6RpEx9YHdopjViOj1zPVH61KTxAiBmv/dlhqkJ4rV46fIXELZur0pj6WC3N7a4brR8a+CLLQIhAMQyerWl2cPNVtE/8tkziHKbwW3ZUiBXU24wFxedT9iV
-
 --- ### 文件上传配置
 spring.servlet:
  multipart:

diff --git a/continew-admin-webapi/src/main/resources/config/application-prod.yml b/continew-admin-webapi/src/main/resources/config/application-prod.yml
@@ -235,18 +235,23 @@ sa-token.extension:
  # 本地存储资源
  - /file/**
 
+--- ### 字段加/解密配置
+continew-starter.security:
+ crypto:
+ enabled: true
+ # 对称加密算法密钥
+ password: abcdefghijklmnop
+ # 非对称加密算法密钥（在线生成 RSA 密钥对：http:https://web.chacuo.net/netrsakeypair）
+ public-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAM51dgYtMyF+tTQt80sfFOpSV27a7t9uaUVeFrdGiVxscuizE7H8SMntYqfn9lp8a5GH5P1/GGehVjUD2gF/4kcCAwEAAQ==
+ private-key: MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAznV2Bi0zIX61NC3zSx8U6lJXbtru325pRV4Wt0aJXGxy6LMTsfxIye1ip+f2WnxrkYfk/X8YZ6FWNQPaAX/iRwIDAQABAkEAk/VcAusrpIqA5Ac2P5Tj0VX3cOuXmyouaVcXonr7f+6y2YTjLQuAnkcfKKocQI/juIRQBFQIqqW/m1nmz1wGeQIhAO8XaA/KxzOIgU0l/4lm0A2Wne6RokJ9HLs1YpOzIUmVAiEA3Q9DQrpAlIuiT1yWAGSxA9RxcjUM/1kdVLTkv0avXWsCIE0X8woEjK7lOSwzMG6RpEx9YHdopjViOj1zPVH61KTxAiBmv/dlhqkJ4rV46fIXELZur0pj6WC3N7a4brR8a+CLLQIhAMQyerWl2cPNVtE/8tkziHKbwW3ZUiBXU24wFxedT9iV
+
 --- ### 密码编码器配置
 continew-starter.security:
  password:
  enabled: true
  # BCryptPasswordEncoder
  encoding-id: bcrypt
 
---- ### 非对称加密配置（例如：密码加密传输，前端公钥加密，后端私钥解密；在线生成 RSA 密钥对：http:https://web.chacuo.net/netrsakeypair）
-rsa:
- # 私钥
- privateKey: MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAznV2Bi0zIX61NC3zSx8U6lJXbtru325pRV4Wt0aJXGxy6LMTsfxIye1ip+f2WnxrkYfk/X8YZ6FWNQPaAX/iRwIDAQABAkEAk/VcAusrpIqA5Ac2P5Tj0VX3cOuXmyouaVcXonr7f+6y2YTjLQuAnkcfKKocQI/juIRQBFQIqqW/m1nmz1wGeQIhAO8XaA/KxzOIgU0l/4lm0A2Wne6RokJ9HLs1YpOzIUmVAiEA3Q9DQrpAlIuiT1yWAGSxA9RxcjUM/1kdVLTkv0avXWsCIE0X8woEjK7lOSwzMG6RpEx9YHdopjViOj1zPVH61KTxAiBmv/dlhqkJ4rV46fIXELZur0pj6WC3N7a4brR8a+CLLQIhAMQyerWl2cPNVtE/8tkziHKbwW3ZUiBXU24wFxedT9iV
-
 --- ### 文件上传配置
 spring.servlet:
  multipart:

diff --git a/continew-admin-webapi/src/main/resources/db/changelog/v2.4.0/continew-admin_column.sql b/continew-admin-webapi/src/main/resources/db/changelog/v2.4.0/continew-admin_column.sql
@@ -5,4 +5,8 @@ ALTER TABLE `sys_log` ADD COLUMN `trace_id` varchar(255) NULL COMMENT '链路ID'
 
 -- changeset Charles7c:2
 ALTER TABLE `sys_user`
- MODIFY COLUMN `password` varchar(255) DEFAULT NULL COMMENT '密码（加密）' AFTER `nickname`;
+ MODIFY COLUMN `password` varchar(255) DEFAULT NULL COMMENT '密码（加密）' AFTER `nickname`;
+
+-- changeset Charles7c:3
+ALTER TABLE `sys_user`
+ MODIFY COLUMN `phone` varchar(255) DEFAULT NULL COMMENT '手机号码' AFTER `email`;
diff --git a/continew-admin-webapi/src/main/resources/db/changelog/v2.4.0/continew-admin_data.sql b/continew-admin-webapi/src/main/resources/db/changelog/v2.4.0/continew-admin_data.sql
@@ -2,4 +2,8 @@
 
 -- changeset Charles7c:1
 UPDATE `sys_user` SET `password` = '{bcrypt}$2a$10$4jGwK2BMJ7FgVR.mgwGodey8.xR8FLoU1XSXpxJ9nZQt.pufhasSa' WHERE `username` = 'admin';
-UPDATE `sys_user` SET `password` = '{bcrypt}$2a$10$meMbyso06lupZjxT88fG8undZo6.DSNUmifRfnnre8r/s13ciq6M6' WHERE `username` = 'test';
+UPDATE `sys_user` SET `password` = '{bcrypt}$2a$10$meMbyso06lupZjxT88fG8undZo6.DSNUmifRfnnre8r/s13ciq6M6' WHERE `username` = 'test';
+
+-- changeset Charles7c:2
+UPDATE `sys_user` SET `email` = '42190c6c5639d2ca4edb4150a35e058559ccf8270361a23745a2fd285a273c28' WHERE `username` = 'admin';
+UPDATE `sys_user` SET `phone` = '5bda89a4609a65546422ea56bfe5eab4' WHERE `username` = 'admin';