File contents 认证与权限开发指南
概述
本指南描述了摸鱼低代码平台的认证与权限架构，适用于需要处理用户身份验证、权限控制、数据权限等相关业务开发场景。
架构概览
认证链路
网关层 : mf-gateway/AuthFilter 校验 token，写入用户上下文 Header业务服务 : 通过 AuthInfoUtils 从 Header 获取用户上下文单体模式 : mf-oauth/TokenFilter 将信息放到 request attribute，AuthInfoUtils 兼容 attribute服务间通信 : BearerTokenInterceptor 透传 Header 和 Authorization 给 Feign 下游服务内部接口 : 使用 req-origin: inner + @InnerUser 做内部调用保护
用户上下文 Header
req-user-id: 当前用户 IDreq-tenant-id: 当前租户 ID req-account: 当前账号req-origin: inner: 内部调用标识
目录结构
快速开始
获取当前用户信息
String userId = AuthInfoUtils.getCurrentUserId();
String tenantId = AuthInfoUtils.getCurrentTenantId();
String account = AuthInfoUtils.getCurrentAccount();
标记内部接口
@InnerUser
@PostMapping("/internal/api")
public Result internalApi() {
// 内部接口逻辑
}
核心组件位置
网关认证过滤器: mf-gateway/src/main/java/cn/com/mfish/gateway/filter/AuthFilter.java
用户上下文工具: mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/utils/AuthInfoUtils.java
内部用户注解: mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/annotation/InnerUser.java
权限切面: mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/aop/AuthorizationAspect.java
数据权限切面: mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/aop/DataScopeAspect.java
Feign 拦截器: mf-common/mf-common-cloud/src/main/java/cn/com/mfish/common/cloud/feign/BearerTokenInterceptor.java
1 --- 2 name: auth-permission 3 description: 认证与权限开发指南 4 --- 5 # 认证与权限开发指南 6 7 ## 概述 8 9 本指南描述了摸鱼低代码平台的认证与权限架构，适用于需要处理用户身份验证、权限控制、数据权限等相关业务开发场景。 10 11 ## 架构概览 12 13 ### 认证链路 14 - **网关层**: mf-gateway/AuthFilter 校验 token，写入用户上下文 Header 15 - **业务服务**: 通过 `AuthInfoUtils` 从 Header 获取用户上下文 16 - **单体模式**: mf-oauth/TokenFilter 将信息放到 request attribute，AuthInfoUtils 兼容 attribute 17 - **服务间通信**: BearerTokenInterceptor 透传 Header 和 Authorization 给 Feign 下游服务 18 - **内部接口**: 使用 `req-origin: inner` + `@InnerUser` 做内部调用保护 19 20 ### 用户上下文 Header 21 - `req-user-id`: 当前用户 ID 22 - `req-tenant-id`: 当前租户 ID 23 - `req-account`: 当前账号 24 - `req-origin: inner`: 内部调用标识 25 26 ## 目录结构 27 28 - [架构概览](./architecture.md) - 完整的认证链路和组件说明 29 - [开发规范](./development-guide.md) - 获取用户信息、内部接口开发规范 30 - [安全注意事项](./security-guidelines.md) - 安全原则和风险规避 31 - [异步场景处理](./async-context.md) - 异步任务中的用户上下文处理 32 - [内部调用安全](./internal-call-security.md) - 内部服务调用的安全机制 33 - [常见问题](./faq.md) - 常见问题和解决方案 34 35 ## 快速开始 36 37 ### 获取当前用户信息 38 ```java 39 String userId = AuthInfoUtils.getCurrentUserId(); 40 String tenantId = AuthInfoUtils.getCurrentTenantId(); 41 String account = AuthInfoUtils.getCurrentAccount(); 42 ``` 43 44 ### 标记内部接口 45 ```java 46 @InnerUser 47 @PostMapping("/internal/api") 48 public Result internalApi() { 49 // 内部接口逻辑 50 } 51 ``` 52 53 ## 核心组件位置 54 - 网关认证过滤器: `mf-gateway/src/main/java/cn/com/mfish/gateway/filter/AuthFilter.java` 55 - 用户上下文工具: `mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/utils/AuthInfoUtils.java` 56 - 内部用户注解: `mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/annotation/InnerUser.java` 57 - 权限切面: `mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/aop/AuthorizationAspect.java` 58 - 数据权限切面: `mf-common/mf-common-core/src/main/java/cn/com/mfish/common/core/aop/DataScopeAspect.java` 59 - Feign 拦截器: `mf-common/mf-common-cloud/src/main/java/cn/com/mfish/common/cloud/feign/BearerTokenInterceptor.java`
commit 237e280633
Frequently asked questions How do I install the Auth Permission skill? Run npx skillmds@latest add mfish-qf/auth-permission in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
What does the Auth Permission skill do? 认证与权限开发指南 It is listed under Coding & Dev Tools on SkillMD.
Is Auth Permission safe to use? This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
Which AI agents work with Auth Permission? This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Is Auth Permission free to use? Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
Who published Auth Permission? mfish-qf (@mfish-qf) published this skill. Their other Agent Skills are listed on their SkillMD profile.
mfish-qf