修复评审功能和用户认证问题

Codex Assistant

昨天 afeeed281e60466b576fbe74d339634cc5d07b82

 backend/src/main/java/com/rongyichuang/auth/filter/JwtAuthenticationFilter.java

@@ -169,7 +169,7 @@
     * 返回权限错误响应
     */
    private void sendUnauthorizedResponse(HttpServletResponse response) throws IOException {
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().write("{\"errors\":[{\"message\":\"没有权限访问，请先登录\",\"extensions\":{\"code\":\"UNAUTHORIZED\"}}]}");
    }
@@ -247,7 +247,20 @@
                    return;
                }
                
                // 查找用户信息并设置认证
                // 检查是否为匿名用户（负数用户ID）
                if (userId < 0) {
                    // 匿名用户，设置特殊的认证信息
                    UsernamePasswordAuthenticationToken authToken = 
                        new UsernamePasswordAuthenticationToken(
                            "anonymous_" + userId, 
                            null, 
                            Arrays.asList(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))
                        );
                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                    logger.debug("GraphQL请求匿名用户认证成功: userId={}", userId);
                } else {
                    // 正常用户，查找用户信息并设置认证
                Optional<User> userOpt = userRepository.findById(userId);
                if (userOpt.isPresent()) {
                    User user = userOpt.get();
@@ -264,6 +277,7 @@
                    logger.warn("GraphQL请求的用户不存在: userId={}", userId);
                    sendUnauthorizedResponse(response);
                    return;
                    }
                }
            } catch (Exception e) {
                logger.error("GraphQL请求JWT验证失败: {}", e.getMessage());
@@ -306,7 +320,20 @@
            if (jwtUtil.validateToken(token)) {
                logger.debug("Token验证成功，查找用户信息");
                
                // 查找用户信息
                // 检查是否为匿名用户（负数用户ID）
                if (userId < 0) {
                    // 匿名用户，设置特殊的认证信息
                    UsernamePasswordAuthenticationToken authToken = 
                        new UsernamePasswordAuthenticationToken(
                            "anonymous_" + userId, 
                            null, 
                            Arrays.asList(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))
                        );
                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                    logger.info("匿名用户认证成功: userId={}", userId);
                } else {
                    // 正常用户，查找用户信息
                Optional<User> userOpt = userRepository.findById(userId);
                if (userOpt.isPresent()) {
                    User user = userOpt.get();
@@ -327,6 +354,7 @@
                } else {
                    logger.warn("用户不存在: userId={}", userId);
                }
                }
            } else {
                logger.warn("Token验证失败");
            }