feat(security): 优化权限控制并添加用户删除功能
- 更新 SecurityConfig,增加精确控制的公开阅读端点 - 实现用户删除功能,仅允许删除当前登录用户 - 优化用户删除接口,增加安全性检查
This commit is contained in:
@@ -62,14 +62,19 @@ public class UserController {
|
||||
return R.success(tokenMap);
|
||||
}
|
||||
|
||||
@Operation(summary = "用户删除")
|
||||
@Parameters({
|
||||
@Parameter(name = "id", description = "用户id",required = true)
|
||||
})
|
||||
@Operation(summary = "删除当前登录的用户")
|
||||
@DeleteMapping("/deleteUser")
|
||||
public R<String> deleteUser(Integer id){
|
||||
userService.deleteUser(id);
|
||||
return R.success("删除成功");
|
||||
public R<String> deleteUser(){
|
||||
UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
|
||||
String username = userDetails.getUsername();
|
||||
User user = userService.getOne(new com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<User>().eq("username", username));
|
||||
|
||||
if (user == null) {
|
||||
return R.fail("无法获取用户信息,删除失败");
|
||||
}
|
||||
|
||||
userService.deleteUser(user.getId().intValue());
|
||||
return R.success("用户删除成功");
|
||||
}
|
||||
|
||||
@Operation(summary = "验证Token有效性")
|
||||
|
||||
Reference in New Issue
Block a user