AuthorityFilter

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.fasterxml.jackson.annotation.JsonInclude.Include;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.common.collect.Lists;
import com.huawei.it.gts.ls.cache.CacheManagerHelper;
import com.huawei.it.gts.ls.common.domain.LSResponse;
import com.huawei.it.gts.ls.constants.GlobalConstants;
import com.huawei.it.gts.ls.constants.GlobalErrorCode;
import com.huawei.it.gts.ls.security.autoconfig.SdkConfig;
import com.huawei.it.gts.ls.security.drools.DataScopeRuleEngine;
import com.huawei.it.gts.ls.security.drools.DataScopeRuleEngineImpl;
import com.huawei.it.gts.ls.session.Authority;
import com.huawei.it.gts.ls.session.Realm;
import com.huawei.it.gts.ls.session.Role;
import com.huawei.it.gts.ls.session.SessionManagerHolder;
import com.huawei.it.gts.ls.session.SessionUserPrincipal;
import lombok.Data;
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.util.MultiValueMap;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.nio.charset.Charset;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Collectors;


@Data
@Component
@ConditionalOnProperty(prefix = "security.config.authority.filter", name = "enabled", havingValue = "true")
public class AuthorityFilter implements GlobalFilter, Ordered {

   private static final Logger LOGGER = LoggerFactory.getLogger(AuthorityFilter.class);
   private final String prefix = "[/\w]+/v[0-9]+[\.0-9]+";// URL验证正则表达式前缀部分,如:/api_gateway/uams_msa/v0.1
   private final String replaceRegex = "\{\w+\}";// 权限资源URL正则匹配模式,如:将"{id}",替换掉java正则表达式
   private final String replacement = "[\\w-%.]+";// java正则表达式

   private final String WEBSOCKET_PROTOCOL = "Sec-WebSocket-Protocol"; //5gstart协议头

   @Autowired
   private SdkConfig sdkConfig;

   /**
    * @param exchange
    * @param chain
    * @return
    */
   @SuppressWarnings("unchecked")
   @Override
   public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {

      LOGGER.debug("------------Spring Cloud Gateway AuthorityFilter init()----------");
      ServerHttpRequest request = exchange.getRequest();
      ServerHttpResponse response = exchange.getResponse();
      String uri = request.getPath().toString();
      LOGGER.info("Request URI:{}", uri);

      String requestMethod = request.getMethod().toString();
      HttpHeaders headers = request.getHeaders();
      String sessionId = headers.getFirst(GlobalConstants.SESSION_ID);
      if (StringUtils.isBlank(sessionId)){// sessionId为空说明是访客角色，非访客角色不可能为空
         LOGGER.info("GuestAuthorityCacheKey: {}", sdkConfig.getGuestAuthorityCacheKey());
         List<String> guestAuthorityList;
         try {
            if (CacheManagerHelper.getCacheManager().hasKey(sdkConfig.getGuestAuthorityCacheKey())) {
               // 查询缓存中guest角色对应的权限url
               guestAuthorityList = (List<String>) CacheManagerHelper.getCacheManager().get(sdkConfig.getGuestAuthorityCacheKey());
               //如果缓存中的白名单数据为空，则从配置文件中获取
               if (CollectionUtils.isEmpty(guestAuthorityList)){
                  LOGGER.info("从缓存中获取的白名单资源为空{}，开始从配置文件中获取！",guestAuthorityList);
                  guestAuthorityList = getGuestUrlFromConfig();
               }
            }else {
               LOGGER.info("从缓存中获取的白名单资源key不存在{}，开始从配置文件中获取！",sdkConfig.getGuestAuthorityCacheKey());
               guestAuthorityList = getGuestUrlFromConfig();
            }
         }catch (Exception e){
            LOGGER.error("获取白名单资源异常，开始从配置文件中获取：",e);
            //当读取缓存出现异常时，从配置文件中获取白名单接口资源
            guestAuthorityList = getGuestUrlFromConfig();
         }
         if (CollectionUtils.isNotEmpty(guestAuthorityList)) {
            for (String guestUrl : guestAuthorityList) {
               String[] splitUrls = guestUrl.split(":");// 将http
               // request请求方法和URL分割;如:GET:/apps/v0.1/action
               String newUrl = splitUrls[1].replaceAll(replaceRegex, replacement) + "$";
               if (!StringUtils.startsWith(newUrl, "/")) {
                  newUrl = "/" + newUrl;
               }
               String regex = prefix + newUrl;// 将正则前缀部分+后续部分拼接成完整的URI校验正则表达式
               Matcher matcher = Pattern.compile(regex).matcher(uri);
               if (matcher.matches()) {
                  if (StringUtils.equalsIgnoreCase(splitUrls[0],requestMethod)){
                     return chain.filter(exchange.mutate().request(exchange.getRequest()).build());
                  }
               }
            }
         }
      }

      String tenantId = headers.getFirst(GlobalConstants.TENANT_ID);
      // 尝试获取WebSocket请求头Protocol
      String wsheaders = headers.getFirst(WEBSOCKET_PROTOCOL);
      if (wsheaders != null) {
         tenantId = wsheaders.split(",")[0];
      }
      // 判断租户ID
      if (StringUtils.isBlank(tenantId)) {
         LOGGER.error("-----请求参数[tenantId]缺失！");
         return outResponse(response, GlobalErrorCode.E1001_002);
      }

      SessionUserPrincipal principal = (SessionUserPrincipal) SessionManagerHolder.getPrincipal(sessionId);
      String uId = principal.getUid();
      // 判断Session是否过期
      if (StringUtils.isBlank(uId)) {
         LOGGER.error("-----用户会话已过期！");
         return outResponse(response, GlobalErrorCode.E1001_012);
      }
      Map<String, Object> objectMap = new HashMap<>();
      objectMap.put("userIdCache", uId);
      LOGGER.info("userIdCache = {}", uId);

      String principalTenantId = principal.getTenantId();
      if (!StringUtils.equalsIgnoreCase(tenantId,principalTenantId)) {
         LOGGER.error("-----用户[{}]关联的租户信息异常，请求头中租户信息[{}]，缓存中租户信息[{}]！",
               principal.getUid(),tenantId,principalTenantId);
         return outResponse(response, GlobalErrorCode.E1001_002);
      }

      final String realmId = headers.getFirst(GlobalConstants.REALM_ID);
      MultiValueMap<String, String> queryParams = request.getQueryParams();
      Set<String> paramsSet = queryParams.keySet();
      for (String param : paramsSet) {
         objectMap.put(param + "Param", request.getQueryParams().getFirst(param));
      }
      String contentType = headers.getFirst("Content-Type");
      // 只考虑contentType是json格式的
      if (contentType!=null && contentType.contains("application/json")) {
         Object cachedRequestBodyObject = exchange.getAttribute("cachedRequestBodyObject");
         if (null != cachedRequestBodyObject) {
            String body = cachedRequestBodyObject.toString();
            if (body.startsWith("[")) {
               List<Map<String, Object>> mapList = (List<Map<String, Object>>) cachedRequestBodyObject;
               String jsonStr = JSON.toJSONString(mapList);
               JSONArray jsonArray = JSONArray.parseArray(jsonStr);
               objectMap.put("jsonArray", jsonArray);
            } else {
               Map<String, Object> requestBodylist = (Map<String, Object>) cachedRequestBodyObject;
               objectMap.putAll(requestBodylist);
            }
         }
      }
      Map<String,Object> respMap = verifyURI(tenantId, realmId,sessionId, uri, requestMethod, objectMap);
//    boolean matches = verifyURI(tenantId, realmId,sessionId, uri, requestMethod, objectMap);
      boolean matches = (boolean) respMap.get("flag");
      if (!matches) {
         LOGGER.info("-----来自租户[{}]下的用户[{}]没有分配相关权限！", tenantId, principal.getUid());
         // exchange.mutate().response(getRespDec(response,
         // GlobalErrorCode.E1001_001)).build();
         return outResponse(response, (String) respMap.get("status"));
      } else {
         LOGGER.info("租户信息为[{}],请求的uri是[{}],请求方法是[{}],请求的参数是[{}]。", tenantId, uri, requestMethod, objectMap);
         // exchange.mutate().request(exchange.getRequest()).build();
         return chain.filter(exchange);
      }
   }


   private synchronized Map<String,Object> verifyURI(String tenantId, String realmId,String sessionId,
                                         String requestURL, String method, Map<String, Object> objectMap) {
      Map<String,Object> respMap = new HashMap<>(4);
      Map<String, Object> resultMap = new HashMap<>(objectMap);
      String uri = requestURL;
      List<Role> roles = Lists.newArrayList();
      List<Authority> resources = Lists.newArrayList();
      if (StringUtils.isNotBlank(realmId)){
         List<Realm> realms = SessionManagerHolder.getRealm(sessionId);// 获取领域列表
         Realm realm = realms.stream().filter(s->s.getRealmId().equals(realmId)).findAny().orElse(null);
         if (null != realm){
            roles = realm.getRoles();
            resources = realm.getAuthorities();
         }else {
            LOGGER.info("-----该领域[{}]下没有分配任何角色-----", realmId);
         }
      }else {
         roles = SessionManagerHolder.getRole(sessionId);
         resources = SessionManagerHolder.getAuthority(sessionId);
      }
      // 该用户没有关联角色,则无权访问
      if (CollectionUtils.isEmpty(roles)) {
         LOGGER.info("-----错误码[{}],该租户[{}]没有分配相关角色权限！-----", GlobalErrorCode.E1001_003, tenantId);
         respMap.put("status",GlobalErrorCode.E1001_003);
         respMap.put("flag",false);
         return respMap;
      }
      List<String> roleIds = roles.stream().map(Role::getRoleId).collect(Collectors.toList());
      resultMap.put("roleIdsCache", roleIds);

      if (CollectionUtils.isEmpty(resources)) {
         LOGGER.info("-----错误码[{}],该租户[{}]没有分配相关权限资源！-----", GlobalErrorCode.E1001_004, tenantId);
         respMap.put("status",GlobalErrorCode.E1001_004);
         respMap.put("flag",false);
         return respMap;
//       return false;
      }

      // 将所有的权限资源URL取出
      List<String> urls = resources.stream().map(Authority::getResourceUrl).collect(Collectors.toList());
      for (String url : urls) {
         if (StringUtils.isBlank(url) || !StringUtils.startsWith(url, method.toUpperCase(Locale.US))) {
            // URL为空或者不以request method为前缀的URL都跳过,排除非API接口权限资源
            continue;
         }
         String[] splitUrls = url.split(":");// 将http
         // request请求方法和URL分割;如:GET:/apps/v0.1/action
         // 将权限资源URL进行替换成java正则的后缀部分
         String suffix = splitUrls[1].replaceAll(replaceRegex, replacement) + "$";
         if (!StringUtils.startsWith(suffix, "/")) {
            suffix = "/" + suffix;
         }
         String regex = prefix + suffix;// 将正则前缀部分+后续部分拼接成完整的URI校验正则表达式
         Matcher matcher = Pattern.compile(regex).matcher(uri);
         if (matcher.matches()) {
            LOGGER.debug("请求URL:{},匹配到正则表达式:{}", uri, regex);
            Map<String, Object> map = getUrlParam(url, uri);
            resultMap.putAll(map);
            List<Authority> authority = resources.stream()
                  .filter(o -> (StringUtils.isNotBlank(o.getResourceUrl()) && o.getResourceUrl().equals(url)))
                  .collect(Collectors.toList());
            List<String> scopeList = authority.stream().filter(o -> StringUtils.isNotBlank(o.getDataScope()))
                  .collect(Collectors.toList()).stream().map(Authority::getDataScope)
                  .collect(Collectors.toList());
            LOGGER.info("---本次校验的参数是[{}]---", resultMap);
            boolean flag = droolsHandle(scopeList, resultMap);
            // 没有匹配到数据范围，判定当前请求参数范围没有权限
            if (!flag) {
               LOGGER.info("-----错误码[{}],本次请求[{}]没有对应数据范围权限！-----", GlobalErrorCode.E1001_005, requestURL);
               respMap.put("status",GlobalErrorCode.E1001_005);
               respMap.put("flag",false);
               return respMap;
//             return false;
            }
            respMap.put("flag",true);
            return respMap;
//          return true;
         }
      }
      LOGGER.info("-----本次请求[{}]在租户[{}]下没有匹配相关权限资源！-----", requestURL, tenantId);
      respMap.put("flag",false);
      respMap.put("status",GlobalErrorCode.E1001_004);
      return respMap;
//    return false;
   }

   private Map<String, Object> getUrlParam(String url, String uri) {
      Map<String, Object> map = new HashMap<>();
      String[] splitResourceUrls = url.split("/");
      String[] splitUris = uri.split("/");
      for (int i = 0; i < splitResourceUrls.length; i++) {
         Matcher m1 = Pattern.compile(replaceRegex).matcher(splitResourceUrls[i]);
         if (m1.matches()) {
            String afterStr = splitResourceUrls[i - 1];
            for (int j = 0; j < splitUris.length; j++) {
               if (afterStr.equals(splitUris[j])) {
                  String key = m1.group().substring(1, m1.group().length() - 1) + "Path";
                  map.put(key, splitUris[j + 1]);
               }
            }
         }
      }
      return map;
   }

 
   private List<Role> getRolesByTenant(String realmId,String sessionId) {
      List<Role> roles = null;
      if (StringUtils.isBlank(realmId)) {// 前端没有上报领域id
         roles = SessionManagerHolder.getRole(sessionId);// 获取租户下默认领域的所有角色列表
      } else {
         List<Realm> realms = SessionManagerHolder.getRealm(sessionId);// 获取领域列表
         roles = getRolesByRealm(realms, realmId);// 获取相应领域下的角色列表
      }
      return roles;
   }


    * @Desc 获取领域下相应角色列表. <br/>
 
   private List<Role> getRolesByRealm(List<Realm> realms, String realmId) {

      for (Realm realm : realms) {
         if (realmId.equals(realm.getRealmId())) {
            return realm.getRoles();
         }
      }
      LOGGER.info("-----该领域[{}]下没有分配任何角色-----", realmId);
      return Lists.newArrayList();
   }

   private void outResponse(HttpServletResponse response, String status) throws IOException {
      LSResponse<Object> lsResponse = new LSResponse<>();
      lsResponse.setFaild(status);
      lsResponse.setStatus(Integer.parseInt(status));
      response.setStatus(401);
      response.setHeader("content-type", "text/html;charset=UTF-8");
      ObjectMapper mapper = new ObjectMapper();
      mapper.setSerializationInclusion(Include.NON_NULL);
      IOUtils.write(mapper.writeValueAsString(lsResponse), response.getOutputStream(), Charset.defaultCharset());
   }

   private Mono<Void> outResponse(ServerHttpResponse response, String status) {
      try {
         LSResponse<Object> lsResponse = new LSResponse<>();
         lsResponse.setFaild(status);
         lsResponse.setStatus(Integer.parseInt(status));
         // 对象转JSON转byte数组
         ObjectMapper objectMapper = new ObjectMapper();
         byte[] data = objectMapper.writeValueAsBytes(lsResponse);
         // 写入响应头
         DataBuffer buffer = response.bufferFactory().wrap(data);
         response.setStatusCode(HttpStatus.UNAUTHORIZED);
         response.getHeaders().add(HttpHeaders.CONTENT_TYPE, "application/json;charset=UTF-8");
         return response.writeWith(Mono.just(buffer));
      } catch (JsonProcessingException e) {
         LOGGER.error("lsResponse.parse.jsonException");
      }
      return null;
   }

   /**
    * 执行drools引擎，匹配参数
    *
    * @param scopeList
    * @param parameterMap
    */
   private Boolean droolsHandle(List<String> scopeList, Map<String, Object> parameterMap) {
      DataScopeRuleEngine ruleEngine = new DataScopeRuleEngineImpl();
      if (CollectionUtils.isEmpty(scopeList)) {
         return true;
      }
      boolean flag = false;
      for (String scope : scopeList) {
         ruleEngine.initEngine(scope);
         boolean f = ruleEngine.executeRuleEngine(parameterMap);
         flag = f || flag;
      }
      return flag;
   }

   /**
    * 从配置文件中获取白名单资源
    * @return
    */
   private List<String> getGuestUrlFromConfig(){
      String guestUrl = sdkConfig.getGuestUrl();
      String[] strings = guestUrl.split(",");
      return Arrays.asList(strings);
   }

   @Override
   public int getOrder() {
      return 150;
   }

}