实战！用 Spring Gateway 配合 Sa-Token 实现微服务无感鉴权

plugins {
  // 引入 Java 插件
  java
  // 引入 Spring Boot 插件
  id("org.springframework.boot") version "3.1.2"
  // 引入 Spring 依赖管理插件
  id("io.spring.dependency-management") version "1.1.2"
}

java {
    // 设置 Java 源代码版本为 Java 17
    sourceCompatibility = JavaVersion.VERSION_17
}

repositories {
  // 引入 Maven 中央库
  mavenCentral()
}

// 设置 Spring Cloud 版本
extra["springCloudVersion"] = "2022.0.4"

dependencies {
    // 引入 Spring Cloud Gateway 的 Spring Boot starter 依赖
    implementation("org.springframework.cloud:spring-cloud-starter-gateway")

    // 重要：引入 Sa-Token 的 Spring Boot 3 Webflux 依赖（而不是 Spring Boot 2 Webflux）
    implementation("cn.dev33:sa-token-reactor-spring-boot3-starter:1.35.0.RC")
    // 引入 Sa-Token 的 redis 支持依赖
    implementation("cn.dev33:sa-token-redis:1.35.0.RC")
    // 引入连接池
    implementation("org.apache.commons:commons-pool2")
}

dependencyManagement {
  // 导入 Maven Bom
  imports {
    mavenBom("org.springframework.cloud:spring-cloud-dependencies:${property("springCloudVersion")}")
  }
}

import org.springframework.cloud.gateway.route.RouteLocator;
import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class RoutesConfiguration {

    @Bean
    public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
        return builder.routes()
                .route("service-user", r -> r.path("/api/users/**")
                        .uri("lb://service-user"))
                .route("service-auth", r -> r.path("/api/authorization/**")
                        .uri("lb://service-auth"))
                .route("frontend", r -> r.path("/**")
                        .uri(frontendUrl))
                .build();
    }

}

import cn.dev33.satoken.stp.StpInterface;
import org.springframework.stereotype.Component;

import java.util.List;

@Component
public class StpInterfaceImpl implements StpInterface {

    @Override
    public List<String> getPermissionList(Object loginId, String loginType) {
        return List.of(); // TODO: 返回此 loginId 拥有的权限列表
    }

    @Override
    public List<String> getRoleList(Object loginId, String loginType) {
        return List.of(); // TODO: 返回此 loginId 拥有的角色列表
    }

}

@Configuration
public class SaTokenConfigure {
    // 注册 Sa-Token全局过滤器 
    @Bean
    public SaReactorFilter getSaReactorFilter() {
        return new SaReactorFilter()
            // 拦截地址 
            .addInclude("/**")    /* 拦截全部path */
            // 开放地址 
            .addExclude("/favicon.ico")
            // 鉴权方法：每次访问进入 
            .setAuth(obj -> {
                // 登录校验 -- 拦截所有路由，并排除/user/doLogin 用于开放登录 
                SaRouter.match("/**", "/user/doLogin", r -> StpUtil.checkLogin());

                // 权限认证 -- 不同模块, 校验不同权限 
                SaRouter.match("/user/**", r -> StpUtil.checkPermission("user"));
                SaRouter.match("/admin/**", r -> StpUtil.checkPermission("admin"));
                SaRouter.match("/goods/**", r -> StpUtil.checkPermission("goods"));
                SaRouter.match("/orders/**", r -> StpUtil.checkPermission("orders"));

                // 更多匹配 ...  */
            })
            // 异常处理方法：每次setAuth函数出现异常时进入 
            .setError(e -> {
                return SaResult.error(e.getMessage());
            })
            ;
    }
}

import cn.dev33.satoken.stp.StpUtil;
import io.hikarilan.nerabbs.common.BizConstants;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

@Component
public class AuthorizeFilter implements GlobalFilter {
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest newRequest = exchange
                .getRequest()
                .mutate()
                .header("X-User-ID", StpUtil.getLoginId(-1L).toString())
                .build();
        ServerWebExchange newExchange = exchange.mutate().request(newRequest).build();

        return chain.filter(newExchange);
    }
}

@GetMapping
@ResponseBody
public UserBasicInfoVo getUserBasicInfoFromHeader(@RequestHeader("X-User-ID") long userID) {
    if (userID == -1)
        throw new UnauthorizedException();

    return userInfoService.getUserBasicInfoByID(userID);
}