scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-10 22:41:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(auth): invalidate session when user account is disabled

Browse source
This commit is contained in:
xiose 2026-03-16 16:27:49 +08:00 • committed by vsxd
parent b83e8b8c27
commit dfa5837456
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/AuthController.java
View file

@ -5,6 +5,9 @@ import com.iflytek.skillhub.auth.rbac.PlatformPrincipal;
import com.iflytek.skillhub.auth.rbac.PlatformRoleDefaults;
import com.iflytek.skillhub.auth.repository.UserRoleBindingRepository;
import com.iflytek.skillhub.auth.session.PlatformSessionService;
import com.iflytek.skillhub.domain.user.UserAccount;
import com.iflytek.skillhub.domain.user.UserAccountRepository;
import com.iflytek.skillhub.domain.user.UserStatus;
import com.iflytek.skillhub.dto.ApiResponse;
import com.iflytek.skillhub.dto.ApiResponseFactory;
import com.iflytek.skillhub.dto.AuthMeResponse;
@ -45,6 +48,7 @@ public class AuthController extends BaseApiController {
private final AuthFailureThrottleService authFailureThrottleService;
private final UserRoleBindingRepository userRoleBindingRepository;
private final PlatformSessionService platformSessionService;
private final UserAccountRepository userAccountRepository;
public AuthController(ApiResponseFactory responseFactory,
AuthMethodCatalog authMethodCatalog,
@ -52,7 +56,8 @@ public class AuthController extends BaseApiController {
DirectAuthService directAuthService,
AuthFailureThrottleService authFailureThrottleService,
UserRoleBindingRepository userRoleBindingRepository,
PlatformSessionService platformSessionService) {
PlatformSessionService platformSessionService,
UserAccountRepository userAccountRepository) {
super(responseFactory);
this.authMethodCatalog = authMethodCatalog;
this.sessionBootstrapService = sessionBootstrapService;
@ -60,6 +65,7 @@ public class AuthController extends BaseApiController {
this.authFailureThrottleService = authFailureThrottleService;
this.userRoleBindingRepository = userRoleBindingRepository;
this.platformSessionService = platformSessionService;
this.userAccountRepository = userAccountRepository;
}
@GetMapping("/me")
@ -69,6 +75,11 @@ public class AuthController extends BaseApiController {
if (principal == null || authentication == null || !authentication.isAuthenticated()) {
throw new UnauthorizedException("error.auth.required");
}
UserAccount user = userAccountRepository.findById(principal.userId()).orElse(null);
if (user == null || user.getStatus() == UserStatus.DISABLED) {
request.getSession().invalidate();
throw new UnauthorizedException("error.auth.required");
}
Set<String> freshRoles = PlatformRoleDefaults.withDefaultUserRole(
userRoleBindingRepository.findByUserId(principal.userId()).stream()
.map(binding -> binding.getRole().getCode())