Repository navigation
feat(auth): 登录会话切换至 Starter Refresh Token 模块 - #231
Merged
Merged
Conversation
Charles7c
force-pushed
the
feat/auth-refresh-token-starter
branch
4 times, most recently
from
October 4, 2026 15:19
250788f to
265463e
Compare
|
🔍 OpenCodeReview found 5 issue(s) in this PR.
📄
|
![mochou-opencontinew-cr-bot[bot]](https://avatars.githubusercontent.com/in/4814255?s=60&v=4){kind=small}
Comment on lines
25
to
26
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | ||
| import top.continew.admin.system.enums.LogoutModeEnum; |
There was a problem hiding this comment.
import 顺序不符合 checkstyle 规范：top.continew.admin.common.* 排在了 top.continew.starter.auth.* 之后。应先按字母序列出全部 top.continew.admin.* 包（common、system 等），再列 top.continew.starter.* 包。可对照 ClientResp 中 admin 包在前、starter 包在后的写法调整。
Suggestion:
Suggested change
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.common.base.model.entity.BaseDO; | |
| import top.continew.admin.common.enums.DisEnableStatusEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.system.enums.ReplacedRangeEnum; | |
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; |
Comment on lines
30
to
31
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | ||
| import top.continew.admin.system.enums.LogoutModeEnum; |
There was a problem hiding this comment.
import 顺序不符合 checkstyle 规范：top.continew.admin.system.* 排在了 top.continew.starter.auth.* 之后。应先按字母序列出全部 top.continew.admin.* 包，再列 top.continew.starter.* 包。
Suggestion:
Suggested change
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.common.enums.DisEnableStatusEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.system.enums.ReplacedRangeEnum; | |
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; |
Comment on lines
27
to
28
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | ||
| import top.continew.admin.system.enums.LogoutModeEnum; |
There was a problem hiding this comment.
import 顺序不符合 checkstyle 规范：top.continew.admin.system.* 排在了 top.continew.starter.auth.* 之后。应先按字母序列出全部 top.continew.admin.* 包，再列 top.continew.starter.* 包。
Suggestion:
Suggested change
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.common.base.model.resp.BaseDetailResp; | |
| import top.continew.admin.common.config.excel.DictExcelProperty; | |
| import top.continew.admin.common.config.excel.ExcelDictConverter; | |
| import top.continew.admin.common.enums.DisEnableStatusEnum; | |
| import top.continew.admin.system.enums.LogoutModeEnum; | |
| import top.continew.admin.system.enums.ReplacedRangeEnum; | |
| import top.continew.starter.auth.refresh.token.enums.RefreshTokenModeEnum; |
Comment on lines
28
to
31
| import top.continew.starter.auth.refresh.token.service.SessionInvalidationService; | ||
| import top.continew.admin.auth.adapter.ClientPolicyLockTargetResolver; | ||
| import top.continew.admin.auth.api.AuthPolicyWriteLocked; | ||
| import top.continew.starter.auth.refresh.token.api.AuthPolicyWriteLocked; | ||
| import top.continew.admin.common.base.service.BaseServiceImpl; |
There was a problem hiding this comment.
import 顺序不符合 checkstyle 规范：top.continew.starter.* 与 top.continew.admin.* 交错排列。应按包名分组排序，将两处 top.continew.starter.auth.refresh.token.* 的 import 放在所有 top.continew.admin.* 之后（对照 ClientResp 中 starter 包位于 admin 包之后的写法）。
Suggestion:
Suggested change
| import top.continew.starter.auth.refresh.token.service.SessionInvalidationService; | |
| import top.continew.admin.auth.adapter.ClientPolicyLockTargetResolver; | |
| import top.continew.admin.auth.api.AuthPolicyWriteLocked; | |
| import top.continew.starter.auth.refresh.token.api.AuthPolicyWriteLocked; | |
| import top.continew.admin.common.base.service.BaseServiceImpl; | |
| import top.continew.admin.auth.adapter.ClientPolicyLockTargetResolver; | |
| import top.continew.admin.common.base.service.BaseServiceImpl; | |
| import top.continew.starter.auth.refresh.token.api.AuthPolicyWriteLocked; | |
| import top.continew.starter.auth.refresh.token.service.SessionInvalidationService; |
Charles7c
force-pushed
the
feat/auth-refresh-token-starter
branch
4 times, most recently
from
October 5, 2026 06:12
660056d to
c7a18c8
Compare
引入 continew-starter-auth-refresh-token（ContiNew Starter 2.17.0），删除 continew-auth-refresh 模块，登录会话能力改由 Starter 模块统一供给： - 父 POM 升级至 ContiNew Starter 2.17.0-SNAPSHOT，Enforcer/Spotless/Checkstyle/SpotBugs 门禁插件与版本改由父 POM 统一供给，移除本地声明 - continew-common 新增 continew-starter-auth-refresh-token 依赖（排除 spring-boot-starter-web， 与既有认证依赖保持一致） - 删除 continew-auth-refresh 模块：可轮换会话核心实现已上移 Starter，剩余 Web 层按归属 就位——SessionController、RefreshTokenReq、LoginResp 移入 continew-system 对应包（包名 不变，同步消除 model.resp 跨 jar split package）；RefreshTokenExceptionHandler 移入 continew-common 全局异常处理包；刷新端点改用 Starter refresh 模板固化四步安全契约 - 新增 RefreshSessionPrincipalAdapter 适配 Starter 登录主体快照 SPI； RefreshAccessTokenIssuerImpl 适配 Starter IssuedAccessToken 签发契约 - 配置前缀 auth.refresh-token 迁移至 continew-starter.refresh-token；dev 显式声明 cookie-insecure-allowed 确认本地 HTTP 的知情选择 - 适配 Starter 工具类更名：URLUtils→UrlUtils、JSONUtils→JsonUtils、 ServletUtils.writeJSON→writeJson、ContiNewStarterVersion.getVersion→VERSION - 登出 Cookie 安全边界测试（SessionControllerTest）随迁至 continew-system 并在 CI 实际运行 Assisted-by: ZCode
- checkstyle 新增 CustomImportOrder 规则（组内字典序、组间空行、静态导入置顶、java 组收尾），与 Spotless 格式化产物对齐 - 此前四道门禁均无 import 顺序检查，存量乱序多年未被拦截；规则启用后规范化 413 处 import 分组/排序 - ClientServiceImpl 字段与 @OverRide 方法间补空行 Assisted-by: ZCode
Charles7c
force-pushed
the
feat/auth-refresh-token-starter
branch
from
October 5, 2026 09:46
c7a18c8 to
e115387
Compare
readMessage 与 add 均改用 sendMessageToAll 并遍历用户全部在线令牌： 多会话并发时仅取最新令牌会遗漏其余会话，同一令牌多标签页时仅推单条连接。 Assisted-by: ZCode
- 父 POM 由 2.17.0-SNAPSHOT 切换为 2.17.0（Maven Central 已发布） - README 同步 Starter 版本徽章与技术栈版本表 Assisted-by: ZCode
…259 报告 Sonar 无法把 starter 的 throwIfNull 识别为空护卫，PR #231 新代码上报告两处 S2259（currentClient/client 首次解引用）。改为显式 if-null 抛同类异常，行为不变； 顺带给 loginHandler 补上缺失的空护卫（认证类型无对应处理器时由 NPE 500 变为 400）。 Assisted-by: ZCode
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更类型
破坏性变更
变更目的
ContiNew Starter 2.17.0 已将可轮换 Refresh Token 登录会话体系沉淀为独立模块
continew-starter-auth-refresh-token（continew-org/continew-starter#25，由本仓库continew-auth-refresh模块抽取并加固）。本 PR 将 Admin 切换为消费 Starter 模块，删除本仓库的continew-auth-refresh模块，使登录会话能力随 Starter 统一演进。破坏性变更说明：
auth.refresh-token迁移为continew-starter.refresh-token（Admin 自带配置已同步迁移，使用方需自行迁移外部覆盖配置）；continew-auth-refresh模块删除，核心 API 包名由top.continew.admin.auth.*变更为top.continew.starter.auth.refresh.token.*，Web 层类按归属并入既有模块（见解决方案）。解决方案
continew-common新增continew-starter-auth-refresh-token依赖（排除spring-boot-starter-web，与既有认证依赖声明保持一致）continew-auth-refresh模块：36 个核心类与 5 个重复单元测试由 Starter 模块承载（Starter 侧含 67 个单元测试），剩余 Web 层按归属并入既有模块——SessionController、RefreshTokenReq、LoginResp移入continew-system对应包（全限定名不变，零 import 改动，并顺带消除top.continew.admin.auth.model.resp跨 jar split package）；RefreshTokenExceptionHandler移入continew-common全局异常处理包（与 GlobalExceptionHandler 同址）；SessionControllerTest随迁至continew-system并保持 CI 实际运行。refresh模板固化"解析 → 限流 → 来源校验 → 原子轮换"四步安全契约RefreshSessionPrincipalAdapter将 Admin 用户上下文适配为 Starter 登录主体快照 SPI；RefreshAccessTokenIssuerImpl适配 StarterIssuedAccessToken签发契约URLUtils→UrlUtils、JSONUtils→JsonUtils、ServletUtils.writeJSON→writeJson、ContiNewStarterVersion.getVersion()→VERSION测试情况
./mvnw verify全部通过：继承自 Starter 2.17.0-SNAPSHOT 父 POM 的 Enforcer / Spotless / Checkstyle / SpotBugs 四道门禁；SessionControllerTest（3 用例，登出 Cookie 安全边界）随迁至continew-system后继续在 CI 实际运行Changelog