feat(security): 优化权限控制并添加用户删除功能

- 更新 SecurityConfig,增加精确控制的公开阅读端点
- 实现用户删除功能,仅允许删除当前登录用户
- 优化用户删除接口,增加安全性检查
This commit is contained in:
ikmkj
2025-08-02 12:12:59 +08:00
parent 7d8297bb96
commit 2b3484d4cf
2 changed files with 35 additions and 10 deletions

View File

@@ -62,14 +62,19 @@ public class UserController {
return R.success(tokenMap);
}
@Operation(summary = "用户删除")
@Parameters({
@Parameter(name = "id", description = "用户id",required = true)
})
@Operation(summary = "删除当前登录的用户")
@DeleteMapping("/deleteUser")
public R<String> deleteUser(Integer id){
userService.deleteUser(id);
return R.success("删除成功");
public R<String> deleteUser(){
UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
String username = userDetails.getUsername();
User user = userService.getOne(new com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<User>().eq("username", username));
if (user == null) {
return R.fail("无法获取用户信息,删除失败");
}
userService.deleteUser(user.getId().intValue());
return R.success("用户删除成功");
}
@Operation(summary = "验证Token有效性")