From 4a682c69638659fea84ca808444861025c92bd90 Mon Sep 17 00:00:00 2001
From: chenchuchuan <13554600537@163.com>
Date: Wed, 14 Oct 2026 16:41:07 +0800
Subject: [PATCH] =?UTF-8?q?feat(openapi):=20=E9=85=8D=E7=BD=AE=20OpenAPI?=
 =?UTF-8?q?=20=E8=B7=AF=E7=94=B1=E9=89=B4=E6=9D=83=E6=8B=A6=E6=88=AA?=
 =?UTF-8?q?=E5=99=A8=E4=BD=93=E7=B3=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 在 InterceptorConfig 中注册 OpenApiAuthInterceptor 处理 OpenAPI 路由鉴权
- 将 OpenAPI 路径从 AuthenticationInterceptor 中排除，避免误拦截
- 通过 ObjectProvider 条件注册拦截器，支持 operationEnabled 开关
- 为 pageFormTree、files、download 接口添加 @NoAuthInterface 注解
---
 .../tenantadmin/config/InterceptorConfig.java      | 25 +++++++++++++++++++++-
 .../openapi/controller/OpenApiKbController.java    |  3 +++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java b/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
index bf73b41..248604b 100644
--- a/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
+++ b/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
@@ -1,6 +1,10 @@
 package apelet.tenantadmin.config;
 
+import apelet.common.openapi.config.OpenApiProperties;
+import apelet.common.openapi.interceptor.OpenApiAuthInterceptor;
 import apelet.tenantadmin.interceptor.AuthenticationInterceptor;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -14,8 +18,27 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @Configuration
 public class InterceptorConfig implements WebMvcConfigurer {
 
+    @Autowired
+    private ObjectProvider<OpenApiAuthInterceptor> openApiAuthInterceptorProvider;
+    @Autowired
+    private OpenApiProperties openApiProperties;
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(new AuthenticationInterceptor()).addPathPatterns("/tenantadmin/**").addPathPatterns("/botp/**");
+        String openApiPrefix = openApiProperties.getUrlPrefix();
+        registry.addInterceptor(new AuthenticationInterceptor())
+                .addPathPatterns("/tenantadmin/**").addPathPatterns("/botp/**")
+                // OpenAPI 对外开放部分不依赖应用登录态：{prefix}/v1/** 由 OpenApiAuthInterceptor 校验 accessToken，
+                // {prefix}/auth/token 是公开的签发接口。这里一并排除，避免调用方误带 Authorization 头时
+                // 被登录态拦截器抢先拦下（它注册在前，会先执行）。
+                .excludePathPatterns(openApiPrefix + "/v1/**")
+                .excludePathPatterns(openApiPrefix + "/auth/**");
+        // OpenAPI 对外开放路由鉴权（{prefix}/v1/**）：校验 accessToken 并把 TokenData 注入请求上下文。
+        // 注意 HandlerInterceptor 即使标了 @Component 也不会被 Spring Boot 自动注册，必须在这里显式挂上；
+        // common-openapi.operationEnabled=false 时该 bean 不存在，getIfAvailable() 返回 null，跳过注册即可。
+        OpenApiAuthInterceptor openApiAuthInterceptor = openApiAuthInterceptorProvider.getIfAvailable();
+        if (openApiAuthInterceptor != null) {
+            registry.addInterceptor(openApiAuthInterceptor).addPathPatterns(openApiPrefix + "/v1/**");
+        }
     }
 }
diff --git a/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java b/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
index 1f6d6b4..fad705e 100644
--- a/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
+++ b/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
@@ -45,6 +45,7 @@ public class OpenApiKbController {
      * @return 页面节点列表。
      */
     @PostMapping("/pageFormTree")
+    @NoAuthInterface
     public ResponseResult<List<OpenApiKbPageNodeDto>> pageFormTree(@RequestBody(required = false) OpenApiKbTreeQueryDto queryDto) {
         if (queryDto == null) {
             queryDto = new OpenApiKbTreeQueryDto();
@@ -61,6 +62,7 @@ public class OpenApiKbController {
      * @return data 为分页对象（list/pageNo/pageSize/total/hasMore）。
      */
     @PostMapping("/files")
+    @NoAuthInterface
     public ResponseResult<OpenApiKbFilePageDto> files(@RequestBody(required = false) OpenApiKbFileQueryDto queryDto) {
         if (queryDto == null) {
             return ResponseResult.error(ErrorCodeEnum.ARGUMENT_NULL_EXIST, "请求体不能为空！");
@@ -79,6 +81,7 @@ public class OpenApiKbController {
      * @throws IOException 写出应答时发生错误。
      */
     @GetMapping("/download")
+    @NoAuthInterface
     public void download(@RequestParam(required = false) Long formId,
                          @RequestParam(required = false) String dataId,
                          @RequestParam(required = false) String fieldName,