修复评审功能和用户认证问题

Codex Assistant

1 天以前 afeeed281e60466b576fbe74d339634cc5d07b82

 backend/src/main/java/com/rongyichuang/auth/filter/JwtAuthenticationFilter.java

@@ -247,23 +247,37 @@
                    return;
                }
                
                // 查找用户信息并设置认证
                Optional<User> userOpt = userRepository.findById(userId);
                if (userOpt.isPresent()) {
                    User user = userOpt.get();
                // 检查是否为匿名用户（负数用户ID）
                if (userId < 0) {
                    // 匿名用户，设置特殊的认证信息
                    UsernamePasswordAuthenticationToken authToken = 
                        new UsernamePasswordAuthenticationToken(
                            user.getId().toString(), 
                            "anonymous_" + userId, 
                            null, 
                            new ArrayList<>()
                            Arrays.asList(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))
                        );
                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                    logger.debug("GraphQL请求认证成功: userId={}", user.getId());
                    logger.debug("GraphQL请求匿名用户认证成功: userId={}", userId);
                } else {
                    logger.warn("GraphQL请求的用户不存在: userId={}", userId);
                    sendUnauthorizedResponse(response);
                    return;
                    // 正常用户，查找用户信息并设置认证
                    Optional<User> userOpt = userRepository.findById(userId);
                    if (userOpt.isPresent()) {
                        User user = userOpt.get();
                        UsernamePasswordAuthenticationToken authToken = 
                            new UsernamePasswordAuthenticationToken(
                                user.getId().toString(), 
                                null, 
                                new ArrayList<>()
                            );
                        authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                        SecurityContextHolder.getContext().setAuthentication(authToken);
                        logger.debug("GraphQL请求认证成功: userId={}", user.getId());
                    } else {
                        logger.warn("GraphQL请求的用户不存在: userId={}", userId);
                        sendUnauthorizedResponse(response);
                        return;
                    }
                }
            } catch (Exception e) {
                logger.error("GraphQL请求JWT验证失败: {}", e.getMessage());
@@ -306,26 +320,40 @@
            if (jwtUtil.validateToken(token)) {
                logger.debug("Token验证成功，查找用户信息");
                
                // 查找用户信息
                Optional<User> userOpt = userRepository.findById(userId);
                if (userOpt.isPresent()) {
                    User user = userOpt.get();
                    logger.debug("找到用户: userId={}, phone={}", user.getId(), user.getPhone());
                    
                    // 创建认证对象
                // 检查是否为匿名用户（负数用户ID）
                if (userId < 0) {
                    // 匿名用户，设置特殊的认证信息
                    UsernamePasswordAuthenticationToken authToken = 
                        new UsernamePasswordAuthenticationToken(
                            user.getId().toString(), 
                            "anonymous_" + userId, 
                            null, 
                            new ArrayList<>() // 暂时不设置权限，后续可以根据角色设置
                            Arrays.asList(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))
                        );
                    
                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                    
                    logger.info("用户认证成功: userId={}, phone={}", user.getId(), user.getPhone());
                    logger.info("匿名用户认证成功: userId={}", userId);
                } else {
                    logger.warn("用户不存在: userId={}", userId);
                    // 正常用户，查找用户信息
                    Optional<User> userOpt = userRepository.findById(userId);
                    if (userOpt.isPresent()) {
                        User user = userOpt.get();
                        logger.debug("找到用户: userId={}, phone={}", user.getId(), user.getPhone());
                        
                        // 创建认证对象
                        UsernamePasswordAuthenticationToken authToken = 
                            new UsernamePasswordAuthenticationToken(
                                user.getId().toString(), 
                                null, 
                                new ArrayList<>() // 暂时不设置权限，后续可以根据角色设置
                            );
                        
                        authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                        SecurityContextHolder.getContext().setAuthentication(authToken);
                        
                        logger.info("用户认证成功: userId={}, phone={}", user.getId(), user.getPhone());
                    } else {
                        logger.warn("用户不存在: userId={}", userId);
                    }
                }
            } else {
                logger.warn("Token验证失败");