youlaitech / youlai-mall Goto Github PK

🚀基于 Spring Boot 3、Spring Cloud & Alibaba 2022、SAS OAuth2 、Vue3、Element-Plus、uni-app 构建的开源全栈商城。

License: Apache License 2.0

Java 99.03% Dockerfile 0.97%

spring-boot spring-cloud mybatis-plus spring-cloud-alibaba youlai-mall uniapp spring-security-oauth2 element-plus vue3-element-admin redis

youlai-mall's Issues

小程序会员没有RBAC设定吗

在User的构造方法User(AuthMemberDTO member)中，不进行authorities的添加，那么在生成token是不包含 role id的吧。

提问：关于资源服务器的定位问题

看到网上的实例对资源的鉴权主要分两种，一种是将gateway作为资源管理器，其他服务之间调用不需要安全认证直接访问（这正是该项目的做法），另一种是每个微服务都加入资源服务器配置，实现处处认证。感觉这两种方案好像都不太实际，有咩有更好的方案呢。

Specified key was too long; max key length is 767 bytes

不明白 varchar 要 256这么大?

不知道数据库类型选什么?

关于seata配置

docs里只有Default和Sentinel分组的nacos配置，但是mall-pms.yaml里面又有seata的配置，用到了SEATA_GROUP和service.vgroupMapping.mall_tx_group。代码中似乎没有给出这些配置的内容

http://vue3.youlai.tech/#/login 无法进入预览页面

用户名: admin密码: 123456 提示用户名或密码错误

请问有考虑做树的模糊查询功能吗

目前像部门管理和菜单管理里的名称条件是没有使用的，请问后续有增加按名称模糊查询的功能计划吗

建议针对vscode添加gitignore

vscode 会生成很多文件
参考:
https://raw.githubusercontent.com/redhat-developer/vscode-java/master/.gitignore

生产环境nacos的注册密码不需要增加吗？

之前有项目部署在客户的生产环境，模块注册没有使用密码认证，结果客户的漏扫工具扫出了漏洞，提示说弱密码。
直接把模块强制下线了，后来也解决了这个问题，但是现在nacos2.0版本出来后，想要在密码中加入特殊字符就报错，例如：`/`、`@`。这个怎么解决呢？

您好，请问下每个服务下对应都有两个模块api和boot，这样分模块是为什么呢

他们分别是做什么用的？我看api模块内部好像都是本服务内部接口对应的的feignclient，这些客户端不是在调用方声明吗？在这里先多谢了！

关于异常处理取消了HTTP状态也改为异常码的疑问

commit:317c1d7ec6ea69f28e745d53a9dadfaf2da67d82 把用于将HTTP状态码改为400的ResponseStatus注解都注释掉是出于什么考虑呢？axios这个时候如果不能在res里处理的话也可以在error回调里处理的

前端跟换Authorization后, oauth/token 报403

/laboratory/rabbitmq/part1

http://youlaitech.gitee.io/youlai-mall/#/laboratory/rabbitmq/part1

Description

请问gateWay中AuthorizationManager这个类中权限判断为什么进不去

 使用的是admin账号，在执行到.any()时直接跳过，无法进入到里面的权限判断，请问这是什么原因呢？该怎么解决呢？

     Mono<AuthorizationDecision> authorizationDecisionMono = mono
                .filter(Authentication::isAuthenticated)
                .flatMapIterable(Authentication::getAuthorities)
                .map(GrantedAuthority::getAuthority)
                .any(roleId -> {
                    // roleId是请求用户的角色(格式:ROLE_{roleId})，authorities是请求资源所需要角色的集合
                    log.info("访问路径：{}", path);
                    log.info("用户角色信息：{}", roleId);
                    log.info("资源需要权限authorities：{}", authorities);
                    return authorities.contains(roleId);
                })
                .map(AuthorizationDecision::new)
                .defaultIfEmpty(new AuthorizationDecision(false));

网关的RedisGatewayConfig拼写错了，少了个a

https://github.com/hxrui/youlai-mall/blob/bff37cda62dd6796a1b6f8f673dc9721cfcc2507/youlai-gateway/src/main/java/com/youlai/gateway/config/RedisGatewyConfig.java#L11-L16

Nacos启动报错

mysql版本为5.7.16.
解决方式为：
将application.properties名字改为 bootstrap.properties

启动com.youlai.admin.AdminApplication报错。应该是ElasticSearch配置有问题

org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'dashboardController' defined in file [D:\youlai-mall\youlai-admin\admin-boot\target\classes\com\youlai\admin\controller\v1\DashboardController.class]: Unsatisfied dependency expressed through constructor parameter 1; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'com.youlai.common.elasticsearch.service.ElasticSearchService': Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'restHighLevelClient' defined in class path resource [com/youlai/common/elasticsearch/config/RestHighLevelClientConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.elasticsearch.client.RestHighLevelClient]: Factory method 'restHighLevelClient' threw exception; nested exception is java.lang.IllegalArgumentException: hosts must not be null nor empty
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:800)
at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:229)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1354)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1204)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:564)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:524)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:944)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:918)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:583)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:758)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:438)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:337)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1336)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1325)
at com.youlai.admin.AdminApplication.main(AdminApplication.java:11)
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'com.youlai.common.elasticsearch.service.ElasticSearchService': Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'restHighLevelClient' defined in class path resource [com/youlai/common/elasticsearch/config/RestHighLevelClientConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.elasticsearch.client.RestHighLevelClient]: Factory method 'restHighLevelClient' threw exception; nested exception is java.lang.IllegalArgumentException: hosts must not be null nor empty
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:800)
at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:229)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1354)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1204)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:564)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:524)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:276)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1380)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1300)
at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:887)
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:791)
... 19 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'restHighLevelClient' defined in class path resource [com/youlai/common/elasticsearch/config/RestHighLevelClientConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.elasticsearch.client.RestHighLevelClient]: Factory method 'restHighLevelClient' threw exception; nested exception is java.lang.IllegalArgumentException: hosts must not be null nor empty
at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:486)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1334)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1177)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:564)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:524)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:276)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1380)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1300)
at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:887)
at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:791)
... 33 common frames omitted
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.elasticsearch.client.RestHighLevelClient]: Factory method 'restHighLevelClient' threw exception; nested exception is java.lang.IllegalArgumentException: hosts must not be null nor empty
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185)
at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
... 47 common frames omitted
Caused by: java.lang.IllegalArgumentException: hosts must not be null nor empty
at org.elasticsearch.client.RestClient.builder(RestClient.java:200)
at com.youlai.common.elasticsearch.config.RestHighLevelClientConfig.restHighLevelClient(RestHighLevelClientConfig.java:34)
at com.youlai.common.elasticsearch.config.RestHighLevelClientConfig$$EnhancerBySpringCGLIB$$65618ff1.CGLIB$restHighLevelClient$1()
at com.youlai.common.elasticsearch.config.RestHighLevelClientConfig$$EnhancerBySpringCGLIB$$65618ff1$$FastClassBySpringCGLIB$$ceeea995.invoke()
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244)
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331)
at com.youlai.common.elasticsearch.config.RestHighLevelClientConfig$$EnhancerBySpringCGLIB$$65618ff1.restHighLevelClient()
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154)
... 48 common frames omitted

是不是es没有配置的原因，文档中也没有看到相关的配置。

关于Open-Feign转发丢失请求头

部分api接口在处理中需要根据jwt认证头来获取用户id，现在代码中的通过服务名直接调用的操作会导致调用的时候丢失请求头，因此可以将其改为使用网关转发。

示例如下：
原MemberAddressFeignClient.java
https://github.com/hxrui/youlai-mall/blob/bff37cda62dd6796a1b6f8f673dc9721cfcc2507/mall-ums/ums-api/src/main/java/com/youlai/mall/ums/api/MemberAddressFeignClient.java#L11-L26

修改后：

@FeignClient("youlai-gateway")
public interface MemberAddressFeignClient {

    /**
     * 获取地址详情
     */
    @GetMapping("/mall-ums/app-api/v1/addresses/{id}")
    Result<UmsAddress> getById(@PathVariable("id") Long id);


    @GetMapping("/mall-ums/app-api/v1/addresses")
    Result<List<UmsAddress>> list(@RequestParam Long memberId);

}

请问如何获取登陆用户的信息? 例如像(Pig)其他开源的项目拥有SecurityUtils

@UtilityClass
public class SecurityUtils {

/**
 * 获取Authentication
 */
public Authentication getAuthentication() {
	return SecurityContextHolder.getContext().getAuthentication();
}

/**
 * 获取用户
 */
public PigUser getUser(Authentication authentication) {
	Object principal = authentication.getPrincipal();
	if (principal instanceof PigUser) {
		return (PigUser) principal;
	}
	return null;
}

资源服务器配置jwk-set-uri: 'http://localhost:8000/getPublicKey'的问题

您好，有个问题想请教一下：
jwk这里完全是写死了。如果生产中auth服务有多个，正好写死的这个崩了，那不是整个系统都不可用了吗？
能不能用注册中心来管理，通过服务名调用呢？
期待您的回复！

youlai-auth中的pom.xml common-web依赖重复引入了

/

http://youlaitech.gitee.io/youlai-mall/#/

Description

感谢你的无私奉献，我这边有个权限问题想咨询下

我看了您的auth服务，因为我最近正好也再做授权服务器，也想采用security-oauth2，

您这边有几个问题，
关于微信登录，您这边默认采用openid作为用户密码进行保存，然后登录，我认为这个再实际项目中使用相对不太严谨。

还有就是关于您登陆接口暴漏出了client-id以及client-secret。这种再实际使用中似乎也不太妥当。

其次关于，如果使用短信登录，您这边应该是没办法去做登录逻辑，而我刚好也卡再这个地方，不明白短信登录这块，我应该去重写哪些类，或者方法，或者说是否要重写tokenEndPoint。

如果您有好的意见，希望您能帮我一下。

配置文件更新后不能立即生效

通过nacos配置列表，编辑修改yaml配置后，发布后不能生效，还是需要重启项目

bug:There is no client authentication

`@PostMapping("/token")
public Object postAccessToken(
@ApiIgnore Principal principal,
@ApiIgnore @RequestParam Map<String, String> parameters
) throws HttpRequestMethodNotSupportedException {

    /**
     * 获取登录认证的客户端ID
     *
     * 兼容两种方式获取Oauth2客户端信息（client_id、client_secret）
     * 方式一：client_id、client_secret放在请求路径中(注：当前版本已废弃)
     * 方式二：放在请求头（Request Headers）中的Authorization字段，且经过加密，例如 Basic Y2xpZW50OnNlY3JldA== 明文等于 client:secret
     */
    String clientId = RequestUtils.getOAuth2ClientId();
    log.info("OAuth认证授权 客户端ID:{}，请求参数：{}", clientId, JSONUtil.toJsonStr(parameters));

    /**
     * 构造principal
     */

    /**
     * knife4j接口文档测试使用
     *
     * 请求头自动填充，token必须原生返回，不能有任何包装，否则显示 undefined undefined
     * 账号/密码:  client_id/client_secret : client/123456
     */
    if (SecurityConstants.TEST_CLIENT_ID.equals(clientId)) {
        return tokenEndpoint.postAccessToken(principal, parameters).getBody();
    }

    OAuth2AccessToken accessToken = tokenEndpoint.postAccessToken(principal, parameters).getBody();
    return Result.success(accessToken);
}

principal is always null, and postAccessToken function throw exception. we get

{ "code": "B0001", "data": null, "msg": "There is no client authentication. Try adding an appropriate authentication filter." }

[讨论]关于小程序不支持PATCH请求的处理

小程序官方说明是不支持PATCH操作的，我现在的解决方案是用axios拦截器，将patch请求转为post，并在header中加上X-Http-Method: PATCH。
然后再在SecurityGlobalFilter里读取这个header，重新包装成patch请求。线上的话可以考虑换成nginx等进行处理。大佬们有没有更好的处理方法呢

/quickstart/introduction

http://youlaitech.gitee.io/youlai-mall/#/quickstart/introduction

Description

新拉取的项目显示undefined

OrderStatusEnum.java
xThe constructor OrderStatusEnum(int, String) is undefined

请问gateWay中AuthorizationManager这个类中roleId怎么来的。

我把某些注释掉了就走到下面

Mono authorizationDecisionMono = mono
.filter(Authentication::isAuthenticated)
.flatMapIterable(Authentication::getAuthorities)
.map(GrantedAuthority::getAuthority)
.any(roleId -> {
// roleId是请求用户的角色(格式:ROLE_{roleId})，authorities是请求资源所需要角色的集合
log.info("访问路径：{}", path);
log.info("用户角色信息：{}", roleId);
log.info("资源需要权限authorities：{}", authorities);
return authorities.contains(roleId);
})
.map(AuthorizationDecision::new)
.defaultIfEmpty(new AuthorizationDecision(false));

这东西怎么填，不太会

gateway对外内存溢出

有出现过gateway堆外内存溢出的情况吗？
io.netty.handler.codec.EncoderException: io.netty.util.internal.OutOfDirectMemoryError: failed to allocate 16777216 byte(s) of direct memory (used: 855638023, max: 872415232)
at io.netty.handler.codec.MessageToMessageEncoder.write(MessageToMessageEncoder.java:104)
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
Error has been observed at the following site(s):
|_ checkpoint ⇢ org.springframework.web.cors.reactive.CorsWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.cloud.gateway.filter.WeightCalculatorWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.authorization.AuthorizationWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.authorization.ExceptionTranslationWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.authentication.logout.LogoutWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.savedrequest.ServerRequestCacheWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.context.SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$BearerTokenAuthenticationWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.context.ReactorContextWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.web.server.header.HttpHeaderWriterWebFilter [DefaultWebFilterChain]
|_ checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.