一、前言

##二、 整合Swagger2
Swagger2大家肯定都用過，為什麼我在這裡還要提到呢，因為各個微服務都會提供自己的API文件，我們總不能一個地址一個地址去查吧，能不能有個統一的入口呢。這就是這節要講的。

2.1 Zuul整合Swagger2

其他的都不說直接上程式碼

@Component
@Primary
public class GatewaySwaggerResourcesProvider implements SwaggerResourcesProvider {
    private final RouteLocator routeLocator;

    public GatewaySwaggerResourcesProvider(RouteLocator routeLocator) {
        this.routeLocator = routeLocator;
    }

    @Override
    public List<SwaggerResource> get() {
        List<SwaggerResource> resources = new ArrayList<>();
        List<Route> routes = routeLocator.getRoutes();
        for (Route route:routes) {
            resources.add(swaggerResource(route.getId(), route.getFullPath().replace("**", "v2/api-docs")));
        }
        return resources;
    }
    private SwaggerResource swaggerResource(String name, String location) {
        SwaggerResource swaggerResource = new SwaggerResource();
        swaggerResource.setName(name);
        swaggerResource.setLocation(location);
        swaggerResource.setSwaggerVersion("2.0");
        return swaggerResource;
    }
}
 

SwaggerResourcesProvider 是資源提供者，我們重寫他，把各個微服務的資源路徑返回，即：resources.add(swaggerResource(route.getId(), route.getFullPath().replace("**", “v2/api-docs”)));
參看InMemorySwaggerResourcesProvider寫法，如下，預設是當前應用的/v2/api-docs。

@Autowired
  public InMemorySwaggerResourcesProvider(
      Environment environment,
      DocumentationCache documentationCache) {
    swagger1Url = environment.getProperty("springfox.documentation.swagger.v1.path", "/api-docs");
    swagger2Url = environment.getProperty("springfox.documentation.swagger.v2.path", "/v2/api-docs");
    swagger1Available = classByName("springfox.documentation.swagger1.web.Swagger1Controller").isPresent();
    swagger2Available = classByName("springfox.documentation.swagger2.web.Swagger2Controller").isPresent();
    this.documentationCache = documentationCache;
  }

  @Override
  public List<SwaggerResource> get() {
    List<SwaggerResource> resources = new ArrayList<SwaggerResource>();

    for (Map.Entry<String, Documentation> entry : documentationCache.all().entrySet()) {
      String swaggerGroup = entry.getKey();
      if (swagger1Available) {
        SwaggerResource swaggerResource = resource(swaggerGroup, swagger1Url);
        swaggerResource.setSwaggerVersion("1.2");
        resources.add(swaggerResource);
      }

      if (swagger2Available) {
        SwaggerResource swaggerResource = resource(swaggerGroup, swagger2Url);
        swaggerResource.setSwaggerVersion("2.0");
        resources.add(swaggerResource);
      }
    }
    Collections.sort(resources);
    return resources;
  }
 

最後記得配置Swagger

@Configuration
@EnableSwagger2
public class Swagger2Config {
    @Bean
    public Docket createRestApi() {
        return new Docket(DocumentationType.SWAGGER_2)
                .apiInfo(apiInfo());
    }

    private ApiInfo apiInfo() {
        return new ApiInfoBuilder()
                .title("說明文件")
                .description("介面說明文件")
                .termsOfServiceUrl("")
                .contact(new Contact("楊秀峰","
 
[email protected]","[email protected]"))
                .version("1.0")
                .build();
    }
}

三、Zuul許可權控制

Spring cloud微服務實戰（一）的Zuul只是做為一個路由，並沒有做許可權限制，具體的許可權控制要到各個微服務自己實現，這樣一來不免要有很多重複的工作。那麼就把許可權控制放在閘道器的進行。
注意： 我這裡是基於到URL的細粒度的許可權控制
Zuul到這裡就充當了資源伺服器的角色。
配置資源伺服器：

@Configuration
@EnableResourceServer
public class SecurityConfig extends ResourceServerConfigurerAdapter {

    @Autowired
    private OAuth2WebSecurityExpressionHandler expressionHandler;

    private static final String[] AUTH_WHITELIST = {
          
    };

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/v2/api-docs","/uaa/**").permitAll();

        ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http
                .authorizeRequests();
        for (String au:AUTH_WHITELIST
             ) {
            http.authorizeRequests().antMatchers(au).permitAll();
        }
        http.authorizeRequests().anyRequest().authenticated();
        registry.anyRequest()
                .access("@permissionService.hasPermission(request,authentication)");
    }
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.expressionHandler(expressionHandler);
    }
    @Bean
    public OAuth2WebSecurityExpressionHandler oAuth2WebSecurityExpressionHandler(ApplicationContext applicationContext) {
        OAuth2WebSecurityExpressionHandler expressionHandler = new OAuth2WebSecurityExpressionHandler();
        expressionHandler.setApplicationContext(applicationContext);
        return expressionHandler;
    }
}

注意如下這段

registry.anyRequest()
                .access("@permissionService.hasPermission(request,authentication)");

我們自定義表示式決策。最終在WebExpressionVoter的vote方法的ExpressionUtils.evaluateAsBoolean會呼叫到hasPermission(request,authentication)；

PermissionService的程式碼如下：

@Service("permissionService")
@Slf4j
public class PermissionServiceImpl implements PermissionService {

    /**
     * 可以做URLs匹配，規則如下
     *
     * ？匹配一個字元
     * *匹配0個或多個字元
     * **匹配0個或多個目錄
     * 用例如下
     * <p>https://www.cnblogs.com/zhangxiaoguang/p/5855113.html</p>
     */

    private AntPathMatcher antPathMatcher = new AntPathMatcher();

    @Override
    public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
        Object principal = authentication.getPrincipal();
        String requestUrl = request.getRequestURI();
        log.info("requestUrl:{}",requestUrl);
        List<SimpleGrantedAuthority> grantedAuthorityList = (List<SimpleGrantedAuthority>) authentication.getAuthorities();
        boolean hasPermission = false;

        if (principal != null){
            if (CollectionUtils.isEmpty(grantedAuthorityList)){
                return hasPermission;
            }
            for (SimpleGrantedAuthority authority:grantedAuthorityList
                 ) {
                if (antPathMatcher.match(authority.getAuthority(),requestUrl)){
                    hasPermission = true;
                    break;
                }
            }
        }

        return hasPermission;
    }
}

我這裡只做了簡單的URL校驗，完善的應該是判斷URL、Request Method是否一致等等，大家有更多的發揮空間。
最後記得在application.yml裡配置

security:
  basic:
    enabled: false
  oauth2:
    resource:
      user-info-uri:  http://localhost:9060/user
      prefer-token-info: false

更好的做法應該直接從redis獲取使用者資訊，減少一次HTTP請求；後面再完善吧，今兒有點賴了。

結束