From 54d29f0fb52e669d1436cb1305a1da7f5a01957d Mon Sep 17 00:00:00 2001
From: cuiguiyang <guiyang.cui@spacemit.com>
Date: Tue, 9 Apr 2024 15:30:59 +0800
Subject: [PATCH 001/172] =?UTF-8?q?=E5=85=BC=E5=AE=B9=E8=AF=B7=E6=B1=82/oa?=
 =?UTF-8?q?uth2/token=E6=8E=A5=E5=8F=A3=E6=97=B6Basic=E4=B8=AD=E6=90=BA?=
 =?UTF-8?q?=E5=B8=A6clientId=E5=92=8CclientSecret=E7=9A=84=E5=9C=BA?=
 =?UTF-8?q?=E6=99=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/oauth2/logic/SaOAuth2Handle.java    | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
index 59c13a5f..99403d0d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
@@ -15,6 +15,7 @@
  */
 package cn.dev33.satoken.oauth2.logic;
 
+import cn.dev33.satoken.basic.SaBasicUtil;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
@@ -32,6 +33,7 @@ import cn.dev33.satoken.oauth2.model.CodeModel;
 import cn.dev33.satoken.oauth2.model.RequestAuthModel;
 import cn.dev33.satoken.oauth2.model.SaClientModel;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 /**
@@ -177,9 +179,20 @@ public class SaOAuth2Handle {
 	 */
 	public static Object token(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
 		// 获取参数
+		String authorizationValue = SaBasicUtil.getAuthorizationValue();
+		String clientId;
+		String clientSecret;
+		// gitlab回调token接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
+		if(SaFoxUtil.isEmpty(authorizationValue)){
+			clientId = req.getParamNotNull(Param.client_id);
+			clientSecret = req.getParamNotNull(Param.client_secret);
+		} else {
+			String[] clientIdAndSecret = authorizationValue.split(":");
+			clientId = clientIdAndSecret[0];
+			clientSecret = clientIdAndSecret[1];
+		}
+
 		String code = req.getParamNotNull(Param.code);
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
 		String redirectUri = req.getParam(Param.redirect_uri);
 
 		// 校验参数
-- 
Gitee


From 14a97a1fcb60337557156ca806d89a793a0076a1 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 1 May 2024 05:53:18 +0800
Subject: [PATCH 002/172] =?UTF-8?q?sso=20=E6=A8=A1=E5=9D=97=E6=96=B0?=
 =?UTF-8?q?=E5=A2=9E=20maxRegClient=20=E5=B1=9E=E6=80=A7=EF=BC=8C=E7=94=A8?=
 =?UTF-8?q?=E4=BA=8E=E6=8E=A7=E5=88=B6=E6=A8=A1=E5=BC=8F=E4=B8=89=E4=B8=8B?=
 =?UTF-8?q?=20client=20=E6=B3=A8=E5=86=8C=E6=95=B0=E9=87=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/SaSso2ClientApplication.java  |   6 +-
 .../src/main/resources/application.yml        |   6 +-
 .../java/com/pj/SaSso3ClientApplication.java  |   6 +-
 .../src/main/resources/application.yml        |   2 +-
 .../satoken/sso/model/SaSsoClientModel.java   |  78 +++++----
 .../sso/processor/SaSsoClientProcessor.java   |  11 +-
 .../sso/template/SaSsoClientTemplate.java     |   2 +
 .../sso/template/SaSsoServerTemplate.java     | 161 ++++++++----------
 .../satoken/sso/template/SaSsoTemplate.java   |   4 -
 .../dev33/satoken/sso/template/SaSsoUtil.java |   2 +-
 10 files changed, 142 insertions(+), 136 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/SaSso2ClientApplication.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/SaSso2ClientApplication.java
index d19c7528..2ab50f98 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/SaSso2ClientApplication.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/SaSso2ClientApplication.java
@@ -13,9 +13,9 @@ public class SaSso2ClientApplication {
 		System.out.println();
 		System.out.println("---------------------- Sa-Token SSO 模式二 Client 端启动成功 ----------------------");
 		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
-		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9001");
-		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9001");
-		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9001");
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9002");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9002");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9002");
 		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
 		System.out.println();
 	}
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
index bf59d24b..f971cae7 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
@@ -1,9 +1,11 @@
 # 端口
 server:
-    port: 9001
+    port: 9002
 
 # sa-token配置 
-sa-token: 
+sa-token:
+    # 每次登录时，产生不同的token
+    is-share: false
     # SSO-相关配置
     sso-client:
         # SSO-Server端 统一认证地址 
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/java/com/pj/SaSso3ClientApplication.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/java/com/pj/SaSso3ClientApplication.java
index cdcd78ce..ff233b83 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/java/com/pj/SaSso3ClientApplication.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/java/com/pj/SaSso3ClientApplication.java
@@ -13,9 +13,9 @@ public class SaSso3ClientApplication {
 		System.out.println();
 		System.out.println("---------------------- Sa-Token SSO 模式三 Client 端启动成功 ----------------------");
 		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
-		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9001");
-		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9001");
-		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9001");
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9003");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9003");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9003");
 		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
 		System.out.println();
 	}
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
index 4d669453..f1bce7e4 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
@@ -1,6 +1,6 @@
 # 端口
 server:
-    port: 9001
+    port: 9003
 
 # sa-token配置 
 sa-token: 
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
index db3ed6a4..81e51ca3 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
@@ -16,6 +16,8 @@
 package cn.dev33.satoken.sso.model;
 
 
+import cn.dev33.satoken.sso.util.SaSsoConsts;
+
 /**
  * Sa-Token SSO Model
  *
@@ -24,6 +26,11 @@ package cn.dev33.satoken.sso.model;
  */
 public class SaSsoClientModel {
 
+    /*
+     * 只能记录模式三登录的 client 信息，模式一和模式二的信息即使记录上，也无法完成单点注销操作，遂不记录
+     * 所以：mode、tokenValue 字段，仅留作扩展，暂时无用
+     */
+
     /**
      * 此 client 登录模式（1=模式一，2=模式二，3=模式三）
      */
@@ -34,15 +41,15 @@ public class SaSsoClientModel {
      */
     public String client;
 
-    /**
-     * 此次登录 token 值
-     */
-    public String tokenValue;
+//    /**
+//     * 此次登录 token 值
+//     */
+//    public String tokenValue;
 
     /**
      * 单点注销回调url
      */
-    public String ssoLogoutCall;
+    public String sloCallbackUrl;
 
     /**
      * 此 client 注册信息的时间，13位时间戳
@@ -57,10 +64,15 @@ public class SaSsoClientModel {
     public SaSsoClientModel() {
     }
 
-    public SaSsoClientModel(String client, String ssoLogoutCall) {
+    /**
+     * 模式三构建
+     */
+    public SaSsoClientModel(String client, String sloCallbackUrl, int index) {
+        this.mode = SaSsoConsts.SSO_MODE_3;
         this.client = client;
-        this.ssoLogoutCall = ssoLogoutCall;
+        this.sloCallbackUrl = sloCallbackUrl;
         this.regTime = System.currentTimeMillis();
+        this.index = index;
     }
 
 
@@ -104,43 +116,43 @@ public class SaSsoClientModel {
         return this;
     }
 
-    /**
-     * 获取 此次登录 token 值
-     *
-     * @return tokenValue 此次登录 token 值
-     */
-    public String getTokenValue() {
-        return this.tokenValue;
-    }
-
-    /**
-     * 设置 此次登录 token 值
-     *
-     * @param tokenValue 此次登录 token 值
-     * @return /
-     */
-    public SaSsoClientModel setTokenValue(String tokenValue) {
-        this.tokenValue = tokenValue;
-        return this;
-    }
+//    /**
+//     * 获取 此次登录 token 值
+//     *
+//     * @return tokenValue 此次登录 token 值
+//     */
+//    public String getTokenValue() {
+//        return this.tokenValue;
+//    }
+//
+//    /**
+//     * 设置 此次登录 token 值
+//     *
+//     * @param tokenValue 此次登录 token 值
+//     * @return /
+//     */
+//    public SaSsoClientModel setTokenValue(String tokenValue) {
+//        this.tokenValue = tokenValue;
+//        return this;
+//    }
 
     /**
      * 获取 单点注销回调url
      *
      * @return ssoLogoutCall 单点注销回调url
      */
-    public String getSsoLogoutCall() {
-        return this.ssoLogoutCall;
+    public String getSloCallbackUrl() {
+        return this.sloCallbackUrl;
     }
 
     /**
      * 设置 单点注销回调url
      *
-     * @param ssoLogoutCall 单点注销回调url
+     * @param sloCallbackUrl 单点注销回调url
      * @return /
      */
-    public SaSsoClientModel setSsoLogoutCall(String ssoLogoutCall) {
-        this.ssoLogoutCall = ssoLogoutCall;
+    public SaSsoClientModel setSloCallbackUrl(String sloCallbackUrl) {
+        this.sloCallbackUrl = sloCallbackUrl;
         return this;
     }
 
@@ -189,8 +201,8 @@ public class SaSsoClientModel {
         return "SaSsoClientModel{" +
                 "mode=" + mode +
                 ", client='" + client + '\'' +
-                ", tokenValue='" + tokenValue + '\'' +
-                ", ssoLogoutCall='" + ssoLogoutCall + '\'' +
+//                ", tokenValue='" + tokenValue + '\'' +
+                ", sloCallbackUrl='" + sloCallbackUrl + '\'' +
                 ", regTime=" + regTime +
                 ", index=" + index +
                 '}';
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index eb04a659..d5b65596 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -227,10 +227,13 @@ public class SaSsoClientProcessor {
 
 		// 获取参数
 		String loginId = req.getParamNotNull(paramName.loginId);
+		// String client = req.getParam(paramName.client);
+		// String autoLogout = req.getParam(paramName.autoLogout);
 
 		// 校验参数签名
 		if(ssoConfig.getIsCheckSign()) {
-			ssoClientTemplate.getSignTemplate(ssoConfig.getClient()).checkRequest(req, paramName.loginId);
+			ssoClientTemplate.getSignTemplate(ssoConfig.getClient()).
+					checkRequest(req, paramName.loginId, paramName.client, paramName.autoLogout);
 		} else {
 			SaSsoManager.printNoCheckSignWarningByRuntime();
 		}
@@ -289,7 +292,11 @@ public class SaSsoClientProcessor {
 			}
 		} else {
 			// q2、使用模式二：直连Redis校验ticket
-			// return ssoClientTemplate.checkTicket(ticket);
+			// 		注意此处调用了 SaSsoServerProcessor 处理器里的方法，
+			// 		这意味着如果你的 sso-server 端重写了 SaSsoServerProcessor 里的部分方法，
+			// 		而在当前 sso-client 没有按照相应格式重写 SaSsoClientProcessor 里的方法，
+			// 		可能会导致调用失败（注意是可能，而非一定），
+			// 		解决方案为：在当前 sso-client 端也按照 sso-server 端的格式重写 SaSsoClientProcessor 里的方法
 			return SaSsoServerProcessor.instance.ssoServerTemplate.checkTicket(ticket, cfg.getClient());
 		}
 	}
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoClientTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoClientTemplate.java
index 7a2034e5..80b4d603 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoClientTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoClientTemplate.java
@@ -42,6 +42,8 @@ public class SaSsoClientTemplate extends SaSsoTemplate {
         return SaSsoManager.getClientConfig();
     }
 
+
+
     // ------------------- SSO 模式三相关 -------------------
 
     /**
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
index d9d922fc..1c60027b 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
@@ -17,12 +17,12 @@ package cn.dev33.satoken.sso.template;
 
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.session.SaSession;
-import cn.dev33.satoken.sso.util.SaSsoConsts;
 import cn.dev33.satoken.sso.SaSsoManager;
 import cn.dev33.satoken.sso.config.SaSsoServerConfig;
 import cn.dev33.satoken.sso.error.SaSsoErrorCode;
 import cn.dev33.satoken.sso.exception.SaSsoException;
 import cn.dev33.satoken.sso.model.SaSsoClientModel;
+import cn.dev33.satoken.sso.util.SaSsoConsts;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
@@ -266,44 +266,7 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
     }
 
 
-
-    // ------------------- SSO 模式三相关 -------------------
-
-    /**
-     * 为指定账号id注册单点注销回调URL
-     * @param loginId 账号id
-     * @param client 指定客户端标识，可为null
-     * @param sloCallbackUrl 单点注销时的回调URL
-     */
-    public void registerSloCallbackUrl(Object loginId, String client, String sloCallbackUrl) {
-        // 如果提供的参数是空值，则直接返回，不进行任何操作
-        if(SaFoxUtil.isEmpty(loginId) || SaFoxUtil.isEmpty(sloCallbackUrl)) {
-            return;
-        }
-
-        SaSession session = getStpLogic().getSessionByLoginId(loginId);
-
-        // 取出原来的
-        List<SaSsoClientModel> scmList = session.get(SaSsoConsts.SSO_CLIENT_MODEL_LIST_KEY_, ArrayList::new);
-
-        // 将 新登录client 加入到集合中
-        SaSsoClientModel scm = new SaSsoClientModel();
-        scm.mode = 3;
-        scm.client = client;
-        scm.ssoLogoutCall = sloCallbackUrl;
-        scm.regTime = System.currentTimeMillis();
-        scm.index = calcNextIndex(scmList);
-        scmList.add(scm);
-
-        // 如果登录的client数量超过了限制，则将最早的一个登录进行清退
-        if(scmList.size() > getServerConfig().getMaxRegClient()) {
-            SaSsoClientModel removeScm = scmList.remove(0);
-            notifyClientLogout(loginId, removeScm, true);
-        }
-
-        // 存入持久库
-        session.set(SaSsoConsts.SSO_CLIENT_MODEL_LIST_KEY_, scmList);
-    }
+    // ------------------- SSO -------------------
 
     /**
      * 指定账号单点注销
@@ -328,73 +291,97 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
     }
 
     /**
-     * 通知指定账号的指定客户端注销
-     * @param loginId 指定账号
-     * @param scm 客户端信息对象
-     * @param autoLogout 是否为超过 maxRegClient 的自动注销
+     * 计算下一个 index 值
+     * @param scmList /
+     * @return /
      */
-    public void notifyClientLogout(Object loginId, SaSsoClientModel scm, boolean autoLogout) {
+    public int calcNextIndex(List<SaSsoClientModel> scmList) {
+        // 如果目前还没有任何登录记录，则直接返回0
+        if(scmList == null || scmList.isEmpty()) {
+            return 0;
+        }
+        // 获取目前最大的index值
+        int maxIndex = scmList.get(scmList.size() - 1).index;
 
-        // 如果给个null值，不进行任何操作
-        if(scm == null) {
-            return;
+        // 如果已经是 int 最大值了，则直接返回0
+        if(maxIndex == Integer.MAX_VALUE) {
+            return 0;
         }
 
-        // 如果是模式二登录的
-        if(scm.mode == SaSsoConsts.SSO_MODE_2) {
-            // 获取登录 token
-            String tokenValue = scm.tokenValue;
-            if(SaFoxUtil.isEmpty(tokenValue)) {
-                return;
-            }
+        // 否则返回最大值+1
+        maxIndex++;
+        return maxIndex;
+    }
 
-            // 注销此 token
-            getStpLogic().logoutByTokenValue(scm.tokenValue);
+    /**
+     * 为指定账号id注册单点注销回调信息（模式三）
+     * @param loginId 账号id
+     * @param client 指定客户端标识，可为null
+     * @param sloCallbackUrl 单点注销时的回调URL
+     */
+    public void registerSloCallbackUrl(Object loginId, String client, String sloCallbackUrl) {
+        // 如果提供的参数是空值，则直接返回，不进行任何操作
+        if(SaFoxUtil.isEmpty(loginId)) {
+            return;
         }
 
-        // 如果是模式三登录的
-        else if(scm.mode != SaSsoConsts.SSO_MODE_3) {
-            // url
-            String sloCallUrl = scm.getSsoLogoutCall();
-            if(SaFoxUtil.isEmpty(sloCallUrl)) {
-                return;
-            }
+        SaSession session = getStpLogic().getSessionByLoginId(loginId);
 
-            // 参数
-            Map<String, Object> paramsMap = new TreeMap<>();
-            paramsMap.put(paramName.client, scm.getClient());
-            paramsMap.put(paramName.loginId, loginId);
-            paramsMap.put(paramName.autoLogout, autoLogout);
-            String signParamsStr = getSignTemplate(scm.getClient()).addSignParamsAndJoin(paramsMap);
+        // 取出原来的
+        List<SaSsoClientModel> scmList = session.get(SaSsoConsts.SSO_CLIENT_MODEL_LIST_KEY_, ArrayList::new);
 
-            // 拼接
-            String finalUrl = SaFoxUtil.joinParam(sloCallUrl, signParamsStr);
+        // 将 新登录client 加入到集合中
+        SaSsoClientModel scm = new SaSsoClientModel(client, sloCallbackUrl, calcNextIndex(scmList));
+        scmList.add(scm);
 
-            // 发起请求
-            getServerConfig().sendHttp.apply(finalUrl);
+        // 如果登录的client数量超过了限制，则从最早的一个登录开始清退
+        int maxRegClient = getServerConfig().maxRegClient;
+        if(maxRegClient != -1)  {
+            for (;;) {
+                if(scmList.size() > maxRegClient) {
+                    SaSsoClientModel removeScm = scmList.remove(0);
+                    notifyClientLogout(loginId, removeScm, true);
+                } else {
+                    break;
+                }
+            }
         }
+
+        // 存入持久库
+        session.set(SaSsoConsts.SSO_CLIENT_MODEL_LIST_KEY_, scmList);
     }
 
     /**
-     * 计算下一个 index 值
-     * @param scmList /
-     * @return /
+     * 通知指定账号的指定客户端注销
+     * @param loginId 指定账号
+     * @param scm 客户端信息对象
+     * @param autoLogout 是否为超过 maxRegClient 的自动注销
      */
-    private int calcNextIndex(List<SaSsoClientModel> scmList) {
-        // 如果目前还没有任何登录记录，则直接返回0
-        if(scmList == null || scmList.isEmpty()) {
-            return 0;
+    public void notifyClientLogout(Object loginId, SaSsoClientModel scm, boolean autoLogout) {
+
+        // 如果给个null值，不进行任何操作
+        if(scm == null || scm.mode != SaSsoConsts.SSO_MODE_3) {
+            return;
         }
-        // 获取目前最大的index值
-        int maxIndex = scmList.get(scmList.size() - 1).index;
 
-        // 如果已经是 int 最大值了，则直接返回0
-        if(maxIndex == Integer.MAX_VALUE) {
-            return 0;
+        // url
+        String sloCallUrl = scm.getSloCallbackUrl();
+        if(SaFoxUtil.isEmpty(sloCallUrl)) {
+            return;
         }
 
-        // 否则返回最大值+1
-        return maxIndex++;
+        // 参数
+        Map<String, Object> paramsMap = new TreeMap<>();
+        paramsMap.put(paramName.client, scm.getClient());
+        paramsMap.put(paramName.loginId, loginId);
+        paramsMap.put(paramName.autoLogout, autoLogout);
+        String signParamsStr = getSignTemplate(scm.getClient()).addSignParamsAndJoin(paramsMap);
+
+        // 拼接
+        String finalUrl = SaFoxUtil.joinParam(sloCallUrl, signParamsStr);
+
+        // 发起请求
+        getServerConfig().sendHttp.apply(finalUrl);
     }
 
     // ---------------------- 构建URL ----------------------
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoTemplate.java
index 8a525e8d..39465185 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoTemplate.java
@@ -21,9 +21,6 @@ import cn.dev33.satoken.sso.name.ApiName;
 import cn.dev33.satoken.sso.name.ParamName;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
-import cn.dev33.satoken.util.SaResult;
-
-import java.util.Map;
 
 /**
  * Sa-Token SSO 模板方法类 （公共端）
@@ -81,5 +78,4 @@ public class SaSsoTemplate {
 		return SaManager.getSaSignTemplate();
 	}
 
-
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoUtil.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoUtil.java
index 4ff93fc4..5b63e8af 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoUtil.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoUtil.java
@@ -144,7 +144,7 @@ public class SaSsoUtil {
 	}
 
 	/**
-	 * 指定账号单点注销 
+	 * 指定账号单点注销 (以Server方发起)
 	 * @param loginId 指定账号 
 	 */
 	public static void ssoLogout(Object loginId) {
-- 
Gitee


From 818c1cb4eb175e87ca38848aa2bff6150a67dbb8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 1 May 2024 11:14:35 +0800
Subject: [PATCH 003/172] =?UTF-8?q?=E4=BC=98=E5=8C=96sso=E7=AB=A0=E8=8A=82?=
 =?UTF-8?q?=E6=96=87=E6=A1=A3=E5=92=8Cdemo=E7=A4=BA=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/SaSsoServerApplication.java   |   7 +-
 .../java/com/pj/sso/SsoServerController.java  |   2 +-
 .../sa-token-demo-sso2-client/pom.xml         |   9 +-
 .../java/com/pj/sso/SsoClientController.java  |  15 ++
 .../src/main/resources/application.yml        |  16 +-
 .../.gitignore                                |  12 ++
 .../sa-token-demo-sso3-client-test2/pom.xml   |  68 ++++++++
 .../com/pj/SaSso3ClientTest2Application.java  |  23 +++
 .../java/com/pj/sso/SsoClientController.java  |  78 ++++++++++
 .../src/main/resources/application.yml        |  49 ++++++
 .../src/main/resources/application.yml        |   4 +-
 sa-token-doc/sso/sso-apidoc.md                |   8 +-
 sa-token-doc/sso/sso-server.md                |  39 +++--
 sa-token-doc/sso/sso-type1.md                 |  28 ++--
 sa-token-doc/sso/sso-type2.md                 | 139 +++++++++++++++--
 sa-token-doc/sso/sso-type3.md                 | 147 ++----------------
 .../sso/processor/SaSsoClientProcessor.java   |  14 +-
 .../sso/processor/SaSsoServerProcessor.java   |   2 +-
 18 files changed, 461 insertions(+), 199 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/.gitignore
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/SaSso3ClientTest2Application.java
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/sso/SsoClientController.java
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
index b898ed83..1d2c46d2 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
@@ -1,5 +1,6 @@
 package com.pj;
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
@@ -8,7 +9,11 @@ public class SaSsoServerApplication {
 
 	public static void main(String[] args) {
 		SpringApplication.run(SaSsoServerApplication.class, args);
-		System.out.println("\n------ Sa-Token-SSO 统一认证中心启动成功 ");
+
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 统一认证中心启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getServerConfig());
+		System.out.println();
 	}
 	
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/sso/SsoServerController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/sso/SsoServerController.java
index 7302afd7..6e2e64ee 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/sso/SsoServerController.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/sso/SsoServerController.java
@@ -25,7 +25,7 @@ public class SsoServerController {
 	 * 		http://{host}:{port}/sso/auth			-- 单点登录授权地址，接受参数：redirect=授权重定向地址 
 	 * 		http://{host}:{port}/sso/doLogin		-- 账号密码登录接口，接受参数：name、pwd 
 	 * 		http://{host}:{port}/sso/checkTicket	-- Ticket校验接口（isHttp=true时打开），接受参数：ticket=ticket码、ssoLogoutCall=单点注销回调地址 [可选] 
-	 * 		http://{host}:{port}/sso/signout		-- 单点注销地址（isSlo=true时打开），接受参数：loginId=账号id、secretkey=接口调用秘钥 
+	 * 		http://{host}:{port}/sso/signout		-- 单点注销地址（isSlo=true时打开），接受参数：loginId=账号id、sign=参数签名
 	 */
 	@RequestMapping("/sso/*")
 	public Object ssoRequest() {
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
index 513629c2..e2599ed8 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
@@ -60,7 +60,14 @@
 		    <artifactId>sa-token-alone-redis</artifactId>
             <version>${sa-token.version}</version>
 		</dependency>
-		
+
+		<!-- Http请求工具 -->
+		<dependency>
+			<groupId>com.dtflys.forest</groupId>
+			<artifactId>forest-spring-boot-starter</artifactId>
+			<version>1.5.26</version>
+		</dependency>
+
 	</dependencies>
 	
 	
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
index 11383970..4eeed193 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
@@ -1,8 +1,11 @@
 package com.pj.sso;
 
+import cn.dev33.satoken.sso.config.SaSsoClientConfig;
 import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
+import com.dtflys.forest.Forest;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -35,6 +38,18 @@ public class SsoClientController {
 		return SaSsoClientProcessor.instance.dister();
 	}
 
+	// 配置SSO相关参数
+	@Autowired
+	private void configSso(SaSsoClientConfig ssoClient) {
+		// 配置Http请求处理器
+		ssoClient.sendHttp = url -> {
+			System.out.println("------ 发起请求：" + url);
+			String resStr = Forest.get(url).executeAsString();
+			System.out.println("------ 请求结果：" + resStr);
+			return resStr;
+		};
+	}
+
 	// 全局异常拦截 
 	@ExceptionHandler
 	public SaResult handlerException(Exception e) {
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
index f971cae7..8ce56dd6 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
@@ -4,14 +4,15 @@ server:
 
 # sa-token配置 
 sa-token:
-    # 每次登录时，产生不同的token
-    is-share: false
     # SSO-相关配置
     sso-client:
-        # SSO-Server端 统一认证地址 
+        # SSO-Server 端主机地址
         server-url: http://sa-sso-server.com:9000
         # 前后端分离时用这个
         # auth-url: http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
     
     # 配置Sa-Token单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
     alone-redis: 
@@ -35,8 +36,7 @@ sa-token:
                 max-idle: 10
                 # 连接池中的最小空闲连接
                 min-idle: 0
-        
-        
-        
-        
-        
\ No newline at end of file
+
+forest:
+    # 关闭 forest 请求日志打印
+    log-enabled: false
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/.gitignore b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/.gitignore
new file mode 100644
index 00000000..99a6e767
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/.gitignore
@@ -0,0 +1,12 @@
+target/
+
+node_modules/
+bin/
+.settings/
+unpackage/
+.classpath
+.project
+
+.idea/
+
+.factorypath
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
new file mode 100644
index 00000000..cd61b769
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
@@ -0,0 +1,68 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-demo-sso3-client-test2</artifactId>
+	<version>0.0.1-SNAPSHOT</version>
+	
+	<!-- SpringBoot -->
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>2.5.14</version>
+		<relativePath/>
+	</parent>
+	
+	<!-- 定义 Sa-Token 版本号 -->
+	<properties>
+		<sa-token.version>1.37.0</sa-token.version>
+	</properties>
+
+	<dependencies>
+
+		<!-- SpringBoot依赖 -->
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-web</artifactId>
+		</dependency>
+		
+		<!-- Sa-Token 权限认证, 在线文档：https://sa-token.cc/ -->
+		<dependency>
+            <groupId>cn.dev33</groupId>
+            <artifactId>sa-token-spring-boot-starter</artifactId>
+            <version>${sa-token.version}</version>
+        </dependency>
+        
+		<!-- Sa-Token 插件：整合SSO -->
+		<dependency>
+            <groupId>cn.dev33</groupId>
+            <artifactId>sa-token-sso</artifactId>
+            <version>${sa-token.version}</version>
+        </dependency>
+        
+		<!-- Sa-Token 整合redis (使用jackson序列化方式) -->
+		<dependency>
+            <groupId>cn.dev33</groupId>
+            <artifactId>sa-token-redis-jackson</artifactId>
+            <version>${sa-token.version}</version>
+        </dependency>
+        
+		<!-- 提供Redis连接池 -->
+		<dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-pool2</artifactId>
+        </dependency>
+		
+		<!-- Http请求工具 -->
+		<dependency>
+		    <groupId>com.dtflys.forest</groupId>
+		    <artifactId>forest-spring-boot-starter</artifactId>
+		    <version>1.5.26</version>
+		</dependency>
+        
+		
+	</dependencies>
+	
+	
+</project>
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/SaSso3ClientTest2Application.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/SaSso3ClientTest2Application.java
new file mode 100644
index 00000000..1374e3b7
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/SaSso3ClientTest2Application.java
@@ -0,0 +1,23 @@
+package com.pj;
+
+import cn.dev33.satoken.sso.SaSsoManager;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SaSso3ClientTest2Application {
+
+	public static void main(String[] args) {
+		SpringApplication.run(SaSso3ClientTest2Application.class, args);
+
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 模式三 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9032");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9032");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9032");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
+	}
+	
+}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/sso/SsoClientController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/sso/SsoClientController.java
new file mode 100644
index 00000000..2492688a
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/java/com/pj/sso/SsoClientController.java
@@ -0,0 +1,78 @@
+package com.pj.sso;
+
+import cn.dev33.satoken.sso.config.SaSsoClientConfig;
+import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
+import cn.dev33.satoken.sso.template.SaSsoUtil;
+import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaResult;
+import com.dtflys.forest.Forest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Sa-Token-SSO Client端 Controller 
+ * @author click33
+ */
+@RestController
+public class SsoClientController {
+
+	// SSO-Client端：首页
+	@RequestMapping("/")
+	public String index() {
+		String str = "<h2>Sa-Token SSO-Client 应用端</h2>" + 
+					"<p>当前会话是否登录：" + StpUtil.isLogin() + "</p>" + 
+					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a>" + 
+					" <a href='/sso/logout?back=self'>注销</a></p>";
+		return str;
+	}
+	
+	/*
+	 * SSO-Client端：处理所有SSO相关请求 
+	 * 		http://{host}:{port}/sso/login			-- Client端登录地址，接受参数：back=登录后的跳转地址 
+	 * 		http://{host}:{port}/sso/logout			-- Client端单点注销地址（isSlo=true时打开），接受参数：back=注销后的跳转地址 
+	 * 		http://{host}:{port}/sso/logoutCall		-- Client端单点注销回调地址（isSlo=true时打开），此接口为框架回调，开发者无需关心
+	 */
+	@RequestMapping("/sso/*")
+	public Object ssoRequest() {
+		return SaSsoClientProcessor.instance.dister();
+	}
+
+	// 配置SSO相关参数 
+	@Autowired
+	private void configSso(SaSsoClientConfig ssoClient) {
+		// 配置Http请求处理器 
+		ssoClient.sendHttp = url -> {
+			System.out.println("------ 发起请求：" + url);
+			String resStr = Forest.get(url).executeAsString();
+			System.out.println("------ 请求结果：" + resStr);
+			return resStr;
+		};
+	}
+	
+	// 查询我的账号信息 
+	@RequestMapping("/sso/myInfo")
+	public Object myInfo() {
+		// 组织请求参数
+		Map<String, Object> map = new HashMap<>();
+		map.put("apiType", "userinfo");
+		map.put("loginId", StpUtil.getLoginId());
+
+		// 发起请求
+		Object resData = SaSsoUtil.getData(map);
+		System.out.println("sso-server 返回的信息：" + resData);
+		return resData;
+	}
+
+	// 全局异常拦截 
+	@ExceptionHandler
+	public SaResult handlerException(Exception e) {
+		e.printStackTrace(); 
+		return SaResult.error(e.getMessage());
+	}
+	
+}
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml
new file mode 100644
index 00000000..ebec4dde
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml
@@ -0,0 +1,49 @@
+# 端口
+server:
+    port: 9032
+
+# sa-token配置 
+sa-token: 
+    # sso-client 相关配置
+    sso-client:
+        # client 标识
+        client: sso-client3-test2
+        # sso-server 端主机地址
+        server-url: http://sa-sso-server.com:9000
+        # 使用 Http 请求校验ticket (模式三)
+        is-http: true
+
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+
+spring: 
+    # 配置 Redis 连接 （此处与SSO-Server端连接不同的Redis）
+    redis: 
+        # Redis数据库索引
+        database: 4
+        # Redis服务器地址
+        host: 127.0.0.1
+        # Redis服务器连接端口
+        port: 6379
+        # Redis服务器连接密码（默认为空）
+        password: 
+        # 连接超时时间
+        timeout: 10s
+        lettuce:
+            pool:
+                # 连接池最大连接数
+                max-active: 200
+                # 连接池最大阻塞等待时间（使用负值表示没有限制）
+                max-wait: -1ms
+                # 连接池中的最大空闲连接
+                max-idle: 10
+                # 连接池中的最小空闲连接
+                min-idle: 0
+        
+forest: 
+    # 关闭 forest 请求日志打印
+    log-enabled: false
+        
+        
+        
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
index f1bce7e4..ef48e853 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
@@ -6,6 +6,8 @@ server:
 sa-token: 
     # sso-client 相关配置
     sso-client:
+        # client 标识
+        client: sso-client3
         # sso-server 端主机地址
         server-url: http://sa-sso-server.com:9000
         # 使用 Http 请求校验ticket (模式三)
@@ -19,7 +21,7 @@ spring:
     # 配置 Redis 连接 （此处与SSO-Server端连接不同的Redis）
     redis: 
         # Redis数据库索引
-        database: 2
+        database: 3
         # Redis服务器地址
         host: 127.0.0.1
         # Redis服务器连接端口
diff --git a/sa-token-doc/sso/sso-apidoc.md b/sa-token-doc/sso/sso-apidoc.md
index 8cb487b2..14d29257 100644
--- a/sa-token-doc/sso/sso-apidoc.md
+++ b/sa-token-doc/sso/sso-apidoc.md
@@ -22,6 +22,7 @@ http://{host}:{port}/sso/auth
 | :--------		| :--------	| :--------															|
 | redirect		| 是		| 登录成功后的重定向地址，一般填写 location.href（从哪来回哪去）							|
 | mode			| 否		| 授权模式，取值 [simple, ticket]，simple=登录后直接重定向，ticket=带着ticket参数重定向，默认值为ticket			|
+| client		| 否		| 客户端标识，可不填，代表是一个匿名应用，若填写了，则校验 ticket 时也必须时这个 client 才可以校验成功			|
 
 访问接口后有两种情况：
 - 情况一：当前会话在 SSO 认证中心未登录，会进入登录页开始登录。
@@ -40,7 +41,7 @@ http://{host}:{port}/sso/doLogin
 | name			| 是		| 用户名  |
 | pwd			| 是		| 密码	 |
 
-此接口属于 RestAPI (使用ajax访问)，会进入后端配置的 `sso.setDoLoginHandle` 函数中，此函数的返回值即是此接口的响应值。
+此接口属于 RestAPI (使用ajax访问)，会进入后端配置的 `ssoServer.doLoginHandle` 函数中，此函数的返回值即是此接口的响应值。
 
 另外需要注意：此接口并非只能携带 name、pwd 参数，因为你可以在方法里通过 `SaHolder.getRequest().getParam("xxx")` 来获取前端提交的其它参数。 
 
@@ -58,6 +59,7 @@ http://{host}:{port}/sso/checkTicket
 | :--------		| :--------	| :--------												|
 | ticket		| 是		| 在步骤 1 中授权重定向时的 ticket 参数 						|
 | ssoLogoutCall	| 否		| 单点注销时的回调通知地址，只在SSO模式三单点注销时需要携带此参数|
+| client		| 否		| 客户端标识，可不填，代表是一个匿名应用，若填写了，则必须填写的和 `/sso/auth` 登录时填写的一致才可以校验成功			|
 
 返回值场景：
 - 校验成功时：
@@ -106,6 +108,7 @@ http://{host}:{port}/sso/signout?back=xxx
 | timestamp		| 是		| 当前时间戳，13位									|
 | nonce			| 是		| 随机字符串										|
 | sign			| 是		| 签名，生成算法：`md5( loginId={账号id}&nonce={随机字符串}&timestamp={13位时间戳}&key={secretkey秘钥} )`							|
+| client		| 否		| 客户端标识，可不填，一般在帮助 “sso-server 端不同client不同秘钥” 的场景下找到对应秘钥时，才填写		|
 
 例如：
 ``` url
@@ -198,7 +201,8 @@ http://{host}:{port}/sso/logoutCall
 | loginId		| 是		| 要注销的账号 id			 					|
 | timestamp		| 是		| 当前时间戳，13位								|
 | nonce			| 是		| 随机字符串										|
-| sign			| 是		| 签名，生成算法：`md5( loginId={账号id}&nonce={随机字符串}&timestamp={13位时间戳}&key={secretkey秘钥} )`							|
+| client		| 否		| 客户端标识，如果你在登录时向 sso-server 端传递了 client 值，那么在此处 sso-server 也会给你回传过来，否则此参数无值		|
+| sign			| 是		| 签名，生成算法：`md5( loginId={账号id}&nonce={随机字符串}&timestamp={13位时间戳}&key={secretkey秘钥} )` 如果 client 参数有值，则client也要参与签名，放在 loginId 参数签名（字典顺序）|
 
 返回数据：
 
diff --git a/sa-token-doc/sso/sso-server.md b/sa-token-doc/sso/sso-server.md
index b87084ab..9193a8ab 100644
--- a/sa-token-doc/sso/sso-server.md
+++ b/sa-token-doc/sso/sso-server.md
@@ -90,21 +90,21 @@ implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
 @RestController
 public class SsoServerController {
 
-	/*
+	/**
 	 * SSO-Server端：处理所有SSO相关请求 (下面的章节我们会详细列出开放的接口) 
 	 */
 	@RequestMapping("/sso/*")
 	public Object ssoRequest() {
-		return SaSsoProcessor.instance.serverDister();
+		return SaSsoServerProcessor.instance.dister();
 	}
 	
 	/**
 	 * 配置SSO相关参数 
 	 */
 	@Autowired
-	private void configSso(SaSsoConfig sso) {
+	private void configSso(SaSsoServerConfig ssoServer) {
 		// 配置：未登录时返回的View 
-		sso.notLoginView = () -> {
+		ssoServer.notLoginView = () -> {
 			String msg = "当前会话在SSO-Server端尚未登录，请先访问"
 					+ "<a href='/sso/doLogin?name=sa&pwd=123456' target='_blank'> doLogin登录 </a>"
 					+ "进行登录之后，刷新页面开始授权";
@@ -112,7 +112,7 @@ public class SsoServerController {
 		};
 		
 		// 配置：登录处理函数 
-		sso.doLoginHandle = (name, pwd) -> {
+		ssoServer.doLoginHandle = (name, pwd) -> {
 			// 此处仅做模拟登录，真实环境应该查询数据进行登录 
 			if("sa".equals(name) && "123456".equals(pwd)) {
 				StpUtil.login(10001);
@@ -122,11 +122,12 @@ public class SsoServerController {
 		};
 		
 		// 配置 Http 请求处理器 （在模式三的单点注销功能下用到，如不需要可以注释掉） 
-		sso.sendHttp = url -> {
+		ssoServer.sendHttp = url -> {
 			try {
-				// 发起 http 请求 
 				System.out.println("------ 发起请求：" + url);
-				return Forest.get(url).executeAsString();
+				String resStr = Forest.get(url).executeAsString();
+				System.out.println("------ 请求结果：" + resStr);
+				return resStr;
 			} catch (Exception e) {
 				e.printStackTrace();
 				return null;
@@ -138,8 +139,8 @@ public class SsoServerController {
 ```
 
 注意：
-- 在`setDoLoginHandle`函数里如果要获取name, pwd以外的参数，可通过`SaHolder.getRequest().getParam("xxx")`来获取 
-- 在 `setSendHttp` 函数中，使用 `try-catch` 是为了提高整个注销流程的容错性，避免在一些极端情况下注销失败（例如：某个 Client 端上线之后又下线，导致 http 请求无法调用成功，从而阻断了整个注销流程）
+- 在`doLoginHandle`函数里如果要获取name, pwd以外的参数，可通过`SaHolder.getRequest().getParam("xxx")`来获取 
+- 在 `sendHttp` 函数中，使用 `try-catch` 是为了提高整个注销流程的容错性，避免在一些极端情况下注销失败（例如：某个 Client 端上线之后又下线，导致 http 请求无法调用成功，从而阻断了整个注销流程）
 
 全局异常处理：
 ``` java
@@ -173,7 +174,7 @@ sa-token:
         # domain: stp.com 
         
     # ------- SSO-模式二相关配置 
-    sso: 
+    sso-server: 
         # Ticket有效期 (单位: 秒)，默认五分钟 
         ticket-timeout: 300
         # 所有允许的授权回调地址
@@ -215,13 +216,13 @@ server.port=9000
 
 # ------- SSO-模式二相关配置 
 # Ticket有效期 (单位: 秒)，默认五分钟 
-sa-token.sso.ticket-timeout=300
+sa-token.sso-server.ticket-timeout=300
 # 所有允许的授权回调地址
-sa-token.sso.allow-url=*
+sa-token.sso-server.allow-url=*
 
 # ------- SSO-模式三相关配置 （下面的配置在使用SSO模式三时打开）
 # 是否打开模式三 
-sa-token.sso.is-http=true
+sa-token.sso-server.is-http=true
 # API 接口调用秘钥
 sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
 
@@ -243,7 +244,7 @@ forest.log-enabled: false
 
 <!---------------------------- tabs:end ---------------------------->
 
-注意点：`sa-token.sso.allow-url`为了方便测试配置为`*`，线上生产环境一定要配置为详细URL地址 （之后的章节我们会详细阐述此配置项）
+注意点：`sa-token.sso-server.allow-url`为了方便测试配置为`*`，线上生产环境一定要配置为详细URL地址 （之后的章节我们会详细阐述此配置项）
 
 
 ### 4、创建启动类
@@ -252,7 +253,11 @@ forest.log-enabled: false
 public class SaSsoServerApplication {
 	public static void main(String[] args) {
 		SpringApplication.run(SaSsoServerApplication.class, args);
-		System.out.println("\n------ Sa-Token-SSO 认证中心启动成功");
+
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 统一认证中心启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getServerConfig());
+		System.out.println();
 	}
 }
 ```
@@ -261,7 +266,7 @@ public class SaSsoServerApplication {
 
 ![sso-server-start](https://oss.dev33.cn/sa-token/doc/sso/sso-server-start.png 's-w-sh')
 
-访问统一授权地址(仅测试SSO Server部署是否成功访问localhost,测试SSO模式一到模式三建议按照对应文档的域名进行配置并访问)：
+访问统一授权地址（仅测试 SSO-Server 是否部署成功，暂时还不需要点击登录）：
 - [http://localhost:9000/sso/auth](http://localhost:9000/sso/auth)
 
 ![sso-server-init-login.png](https://oss.dev33.cn/sa-token/doc/sso/sso-server-init-login.png 's-w-sh')
diff --git a/sa-token-doc/sso/sso-type1.md b/sa-token-doc/sso/sso-type1.md
index f5e59fa7..2bac82ca 100644
--- a/sa-token-doc/sso/sso-type1.md
+++ b/sa-token-doc/sso/sso-type1.md
@@ -135,8 +135,8 @@ public class SsoClientController {
 	// SSO-Client端：首页 
 	@RequestMapping("/")
 	public String index() {
-		String authUrl = SaSsoManager.getConfig().splicingAuthUrl();
-		String solUrl = SaSsoManager.getConfig().splicingSloUrl();
+		String authUrl = SaSsoManager.getClientConfig().splicingAuthUrl();
+		String solUrl = SaSsoManager.getClientConfig().splicingSloUrl();
 		String str = "<h2>Sa-Token SSO-Client 应用端</h2>" + 
 					"<p>当前会话是否登录：" + StpUtil.isLogin() + "</p>" + 
 					"<p><a href=\"javascript:location.href='" + authUrl + "?mode=simple&redirect=' + encodeURIComponent(location.href);\">登录</a> " + 
@@ -166,11 +166,9 @@ server:
 # Sa-Token 配置 
 sa-token: 
     # SSO-相关配置
-    sso: 
-        # SSO-Server端-单点登录授权地址 
-        auth-url: http://sso.stp.com:9000/sso/auth
-        # SSO-Server端-单点注销地址
-        slo-url: http://sso.stp.com:9000/sso/signout
+    sso-client:
+        # SSO-Server端主机地址
+        server-url: http://sso.stp.com:9000
     
     # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
     alone-redis: 
@@ -192,10 +190,8 @@ server.port=9001
 
 ######### Sa-Token 配置 #########
 
-# SSO-Server端-单点登录授权地址 
-sa-token.sso.auth-url=http://sso.stp.com:9000/sso/auth
-# SSO-Server端-单点注销地址
-sa-token.sso.slo-url=http://sso.stp.com:9000/sso/signout
+# SSO-Server端主机地址
+sa-token.sso-client.server-url=http://sso.stp.com:9000
 
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
 # Redis数据库索引
@@ -222,7 +218,15 @@ sa-token.alone-redis.timeout=10s
 public class SaSso1ClientApplication {
 	public static void main(String[] args) {
 		SpringApplication.run(SaSso1ClientApplication.class, args);
-		System.out.println("\nSa-Token SSO模式一 Client端启动成功");
+		
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 模式一 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://s1.stp.com:9001");
+		System.out.println("测试访问应用端二: http://s2.stp.com:9001");
+		System.out.println("测试访问应用端三: http://s3.stp.com:9001");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 }
 ```
diff --git a/sa-token-doc/sso/sso-type2.md b/sa-token-doc/sso/sso-type2.md
index 4ebe1e87..32d115ea 100644
--- a/sa-token-doc/sso/sso-type2.md
+++ b/sa-token-doc/sso/sso-type2.md
@@ -64,7 +64,7 @@ sa-token.cookie.domain=stp.com
 ```
 <!---------------------------- tabs:end ---------------------------->
 
-此为模式一专属配置，现在我们将其注释掉
+此为模式一专属配置，现在我们将其注释掉**（一定要注释掉！）**
 
 
 #### 3.2、创建 SSO-Client 端项目
@@ -151,7 +151,7 @@ public class SsoClientController {
 	 */
 	@RequestMapping("/sso/*")
 	public Object ssoRequest() {
-		return SaSsoProcessor.instance.clientDister();
+		return SaSsoClientProcessor.instance.dister();
 	}
 
 }
@@ -170,9 +170,9 @@ server:
 # sa-token配置 
 sa-token: 
     # SSO-相关配置
-    sso: 
-        # SSO-Server端 统一认证地址 
-        auth-url: http://sa-sso-server.com:9000/sso/auth
+    sso-client: 
+        # SSO-Server 端主机地址
+        server-url: http://sa-sso-server.com:9000
 
     # 配置Sa-Token单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
     alone-redis: 
@@ -194,7 +194,7 @@ server.port=9001
 
 ######### Sa-Token 配置 #########
 # SSO-Server端 统一认证地址 
-sa-token.sso.auth-url=http://sa-sso-server.com:9000/sso/auth
+sa-token.sso-client.server-url=http://sa-sso-server.com:9000
 
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
 # Redis数据库索引
@@ -211,7 +211,7 @@ sa-token.alone-redis.timeout=10s
 <!---------------------------- tabs:end ---------------------------->
 
 
-注意点：`sa-token.alone-redis` 的配置需要和SSO-Server端连接同一个Redis（database也要一样）
+注意点：`sa-token.alone-redis` 的配置需要和SSO-Server端连接同一个Redis**（database 值也要一样！database 值也要一样！database 值也要一样！重说三！）**
 
 #### 3.5、写启动类
 ``` java
@@ -219,7 +219,15 @@ sa-token.alone-redis.timeout=10s
 public class SaSso2ClientApplication {
 	public static void main(String[] args) {
 		SpringApplication.run(SaSso2ClientApplication.class, args);
-		System.out.println("\nSa-Token-SSO Client端启动成功");
+		
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 模式二 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9001");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9001");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9001");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 }
 ```
@@ -230,6 +238,8 @@ public class SaSso2ClientApplication {
 
 (1) 依次启动 `SSO-Server` 与 `SSO-Client`，然后从浏览器访问：[http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
 
+<!-- （注：先前版本文档测试demo端口号为9001，后为了方便区分三种模式改为了9002，因此出现文字描述与截图端口号不一致情况，请注意甄别，后不再赘述） -->
+
 ![sso-client-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-client-index.png 's-w-sh')
 
 (2) 首次打开，提示当前未登录，我们点击 **`登录`** 按钮，页面会被重定向到登录中心
@@ -282,10 +292,121 @@ public class SaSso2ClientApplication {
 
 默认测试密码：`sa / 123456`，其余流程保持不变 
  -->
+ 
+ 
+### 5、无刷单点注销
+
+有了单点登录，就必然伴随着单点注销（一处注销，全端下线）
+
+如果你的所有 client 都是基于 SSO 模式二来对接的，那么单点注销其实很简单：
+
+``` java
+// 在 `sa-token.is-share=true` 的情况下，调用此代码即可单点注销：
+StpUtil.logout();
+
+// 在 `sa-token.is-share=false` 的情况下，调用此代码即可单点注销：
+StpUtil.logout(StpUtil.getLoginId());
+```
+
+你可能会比较疑惑，这不就是个普通的会话注销API吗，为什么会有单点注销的效果？
+
+因为模式二需要各个 sso-client 和 sso-server 连接同一个 redis，即使登录再多的 client，本质上对应的仍是同一个会话，因此可以做到任意一处调用注销，全端一起下线的效果。
+
+而如果你的各个 client 架构各不相同，有的是模式二对接，有的是模式三对接，则需要麻烦一点才能做到单点注销。
+
+这里的“麻烦”指两处：1、框架内部逻辑麻烦；2、开发者集成麻烦。
+
+框架内部的麻烦 sa-token-sso 已经封装完毕，无需过多关注，而开发者的麻烦步骤也不是很多：
+
+
+#### 5.1、增加 pom.xml 配置 
+
+<!---------------------------- tabs:start ---------------------------->
+<!-------- tab:Maven 方式 -------->
+``` xml
+<!-- Http请求工具 -->
+<dependency>
+	<groupId>com.dtflys.forest</groupId>
+	<artifactId>forest-spring-boot-starter</artifactId>
+	<version>1.5.26</version>
+</dependency>
+```
+<!-------- tab:Gradle 方式 -------->
+``` gradle
+// Http请求工具
+implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
+```
+<!---------------------------- tabs:end ---------------------------->
+
+Forest 是一个轻量级 http 请求工具，详情参考：[Forest](https://forest.dtflyx.com/)
+
+因为我们已经在控制台手动打印 url 请求日志了，所以此处 `forest.log-enabled=false` 关闭 Forest 框架自身的日志打印，这不是必须的，你可以将其打开。
+
+
+#### 5.2、SSO-Client 端新增配置：API调用秘钥
+
+在 `application.yml` 增加：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token: 
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+		
+forest: 
+	# 关闭 forest 请求日志打印
+	log-enabled: false
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 接口调用秘钥 
+sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+```
+<!---------------------------- tabs:end ---------------------------->
+
+注意 secretkey 秘钥需要与SSO认证中心的一致 
+
+#### 5.3、SSO-Client 配置 http 请求处理器
+``` java
+// 配置SSO相关参数
+@Autowired
+private void configSso(SaSsoClientConfig ssoClient) {
+	// 配置Http请求处理器
+	ssoClient.sendHttp = url -> {
+		System.out.println("------ 发起请求：" + url);
+		String resStr = Forest.get(url).executeAsString();
+		System.out.println("------ 请求结果：" + resStr);
+		return resStr;
+	};
+}
+```
+
+#### 5.3、启动测试 
+重启项目，依次登录三个 client：
+- [http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
+- [http://sa-sso-client2.com:9001/](http://sa-sso-client2.com:9001/)
+- [http://sa-sso-client3.com:9001/](http://sa-sso-client3.com:9001/)
+
+![sso-type3-client-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-client-index.png 's-w-sh')
+
+在任意一个 client 里，点击 **`[注销]`** 按钮，即可单点注销成功（打开另外两个client，刷新一下页面，登录态丢失）。
+
+<!-- ![sso-type3-slo.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo.png 's-w-sh') -->
+
+![sso-type3-slo-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo-index.png 's-w-sh')
+
+PS：这里我们为了方便演示，使用的是超链接跳页面的形式，正式项目中使用 Ajax 调用接口即可做到无刷单点登录退出。
+
+例如，我们使用 [Apifox 接口测试工具](https://www.apifox.cn/) 可以做到同样的效果：
+
+![sso-slo-apifox.png](https://oss.dev33.cn/sa-token/doc/sso/sso-slo-apifox.png 's-w-sh')
 
+测试完毕！
 
 
-### 5、跨 Redis 的单点登录
+### 6、跨 Redis 的单点登录
 以上流程解决了跨域模式下的单点登录，但是后端仍然采用了共享Redis来同步会话，如果我们的架构设计中Client端与Server端无法共享Redis，又该怎么完成单点登录？
 
 这就要采用模式三了，且往下看：[SSO模式三：Http请求获取会话](/sso/sso-type3)
diff --git a/sa-token-doc/sso/sso-type3.md b/sa-token-doc/sso/sso-type3.md
index c339424f..4d9d0a5b 100644
--- a/sa-token-doc/sso/sso-type3.md
+++ b/sa-token-doc/sso/sso-type3.md
@@ -10,7 +10,7 @@
 
 1. Client 端无法直连 Redis 校验 ticket，取出账号id。
 2. Client 端无法与 Server 端共用一套会话，需要自行维护子会话。
-3. 由于不是一套会话，所以无法“一次注销，全端下线”，需要额外编写代码完成单点注销。
+3. 由于不是一套会话，所以无法“一次注销，全端下线”，需要额外编写代码完成单点注销（其实此处的“额外编写代码”已在SSO模式二“无刷单点注销”部分介绍完毕）。
 
 所以模式三的主要目标：也就是在 模式二的基础上 解决上述 三个难题 
 
@@ -20,76 +20,24 @@
 
 ### 2、在Client 端更改 Ticket 校验方式
 
-#### 2.1、增加 pom.xml 配置 
-
-<!---------------------------- tabs:start ---------------------------->
-<!-------- tab:Maven 方式 -------->
-``` xml
-<!-- Http请求工具 -->
-<dependency>
-	<groupId>com.dtflys.forest</groupId>
-	<artifactId>forest-spring-boot-starter</artifactId>
-	<version>1.5.26</version>
-</dependency>
-```
-<!-------- tab:Gradle 方式 -------->
-``` gradle
-// Http请求工具
-implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
-```
-<!---------------------------- tabs:end ---------------------------->
-
-
-> Forest 是一个轻量级 http 请求工具，详情参考：[Forest](https://forest.dtflyx.com/)
-
-#### 2.2、配置 http 请求处理器 
-在SSO-Client端的 `SsoClientController` 中，新增以下配置
-``` java
-// 配置SSO相关参数 
-@Autowired
-private void configSso(SaSsoConfig sso) {
-	// ... 其他代码
-	
-	// 配置 Http 请求处理器
-	sso.sendHttp = url -> {
-		System.out.println("------ 发起请求：" + url);
-		return Forest.get(url).executeAsString();
-	};
-}
-```
-
-#### 2.3、application.yml 新增配置
+在 application.yml 新增配置：
 
 <!---------------------------- tabs:start ---------------------------->
 <!------------- tab:yaml 风格  ------------->
 ``` yaml
 sa-token: 
-    sso: 
+    sso-client: 
         # 打开模式三（使用Http请求校验ticket）
         is-http: true
-        # SSO-Server端 ticket校验地址 
-        check-ticket-url: http://sa-sso-server.com:9000/sso/checkTicket
-		
-forest: 
-	# 关闭 forest 请求日志打印
-	log-enabled: false
 ```
 <!------------- tab:properties 风格  ------------->
 ``` properties
 # 打开模式三（使用Http请求校验ticket）
-sa-token.sso.is-http=true
-# SSO-Server端 ticket校验地址 
-sa-token.sso.check-ticket-url=http://sa-sso-server.com:9000/sso/checkTicket
-
-# 关闭 forest 请求日志打印
-forest.log-enabled: false
+sa-token.sso-client.is-http=true
 ```
 <!---------------------------- tabs:end ---------------------------->
 
-因为我们已经在控制台手动打印 url 请求日志了，所以此处 `forest.log-enabled=false` 关闭 Forest 框架自身的日志打印，这不是必须的，你可以将其打开。
-
 
-#### 2.4、启动项目测试
 重启项目，访问测试：
 - [http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
 - [http://sa-sso-client2.com:9001/](http://sa-sso-client2.com:9001/)
@@ -134,23 +82,7 @@ public SaResult getData(String apiType, String loginId) {
 
 #### 3.2、在 Client 端调用此接口查询数据
 
-首先在 application.yml 中配置接口地址：
-<!---------------------------- tabs:start ---------------------------->
-<!------------- tab:yaml 风格  ------------->
-``` yaml
-sa-token: 
-    sso: 
-        # sso-server 端拉取数据地址 
-        get-data-url: http://sa-sso-server.com:9000/sso/getData
-```
-<!------------- tab:properties 风格  ------------->
-``` properties
-# sso-server 端拉取数据地址 
-sa-token.sso.get-data-url=http://sa-sso-server.com:9000/sso/getData
-```
-<!---------------------------- tabs:end ---------------------------->
-
-然后在 `SsoClientController` 中新增接口 
+在 `SsoClientController` 中新增接口 
 ``` java
 // 查询我的账号信息 
 @RequestMapping("/sso/myInfo")
@@ -242,28 +174,19 @@ public Object getFansList(Long loginId) {
 }
 ```
 
-**注意：使用此方案时，需要在 client 端配置 `sa-token.sso.server-url` 地址，例如：**
-``` yaml
-sa-token: 
-    sso: 
-		# sso-server 端主机地址
-        server-url: http://sa-sso-server.com:9000
-```
-
 #### 4.3、访问测试
 访问测试：[http://sa-sso-client1.com:9001/sso/myFansList](http://sa-sso-client1.com:9001/sso/myFansList)
 
 
 
+### 5、单点注销
 
-### 5、无刷单点注销
+有关 SSO 单点注销的步骤，在上一章节的“无刷单点注销”部分已讲解完毕（模式二和模式三通用），所以此处就不再赘述了。
 
-有了单点登录就必然要有单点注销，网上给出的大多数解决方案是将注销请求重定向至SSO-Server中心，逐个通知Client端下线
-
-在某些场景下，页面的跳转可能造成不太好的用户体验，Sa-Token-SSO 允许你以 `REST API` 的形式构建接口，做到页面无刷新单点注销。
+此处简单介绍一下 SSO 模式三的单点注销链路过程：
 
 1. Client 端在校验 ticket 时，将注销回调地址发送到 Server 端。
-2. Server 端将此 Client 的注销回调地址存储到 Set 集合。
+2. Server 端将此 Client 的注销回调回调信息存储到 List 集合。
 3. Client 端向 Server 端发送单点注销请求。
 4. Server 端遍历Set集合，逐个通知 Client 端下线。
 5. Server 端注销下线。
@@ -273,57 +196,7 @@ sa-token:
 <button class="show-img" img-src="https://oss.dev33.cn/sa-token/doc/g/g3--sso3-logout.gif">加载动态演示图</button>
 
 
-这些逻辑 Sa-Token 内部已经封装完毕，你只需按照文档增加以下配置即可：
-
-#### 5.1、SSO-Client 端新增配置 
-
-在 `application.yml` 增加配置：`API调用秘钥` 和 `单点注销接口URL`。
-
-<!---------------------------- tabs:start ---------------------------->
-<!------------- tab:yaml 风格  ------------->
-``` yaml
-sa-token: 
-	sso: 
-		# 单点注销地址 
-		slo-url: http://sa-sso-server.com:9000/sso/signout
-    sign:
-        # API 接口调用秘钥
-        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
-```
-<!------------- tab:properties 风格  ------------->
-``` properties
-# 单点注销地址 
-sa-token.sso.slo-url=http://sa-sso-server.com:9000/sso/signout
-# 接口调用秘钥 
-sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
-```
-<!---------------------------- tabs:end ---------------------------->
-
-
-注意 secretkey 秘钥需要与SSO认证中心的一致 
-
-
-#### 5.2、启动测试 
-重启项目，访问测试：[http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)，
-我们主要的测试点在于 `单点注销`，正常登录即可。
-
-![sso-type3-client-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-client-index.png 's-w-sh')
-
-点击 **`[注销]`** 按钮，即可单点注销成功。
-
-<!-- ![sso-type3-slo.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo.png 's-w-sh') -->
-
-![sso-type3-slo-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo-index.png 's-w-sh')
-
-PS：这里我们为了方便演示，使用的是超链接跳页面的形式，正式项目中使用 Ajax 调用接口即可做到无刷单点登录退出。
-
-例如，我们使用 [Apifox 接口测试工具](https://www.apifox.cn/) 可以做到同样的效果：
-
-![sso-slo-apifox.png](https://oss.dev33.cn/sa-token/doc/sso/sso-slo-apifox.png 's-w-sh')
-
-测试完毕！
-
-
+这些逻辑 Sa-Token 内部已经封装完毕，你只需按照文档步骤集成即可。
 
 
 ### 6、后记
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index d5b65596..5401d2f8 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -148,14 +148,10 @@ public class SaSsoClientProcessor {
 		// 获取对象
 		SaSsoClientConfig cfg = ssoClientTemplate.getClientConfig();
 
-		// ---------- SSO-Client端：单点注销 [模式二]
+		// 无论登录时选择的是模式二还是模式三
+		//  在注销时都应该按照模式三的方法，通过 http 请求调用 sso-server 的单点注销接口来做到全端下线
 		if(cfg.getIsSlo() && ! cfg.getIsHttp()) {
-			return ssoLogoutType2();
-		}
-
-		// ---------- SSO-Client端：单点注销 [模式三]
-		if(cfg.getIsSlo() && cfg.getIsHttp()) {
-			return ssoLogoutType3();
+			return ssoLogoutByMode3();
 		}
 
 		// 默认返回
@@ -166,7 +162,7 @@ public class SaSsoClientProcessor {
 	 * SSO-Client端：单点注销 [模式二]
 	 * @return 处理结果
 	 */
-	public Object ssoLogoutType2() {
+	public Object ssoLogoutByMode2() {
 		// 获取对象
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
@@ -185,7 +181,7 @@ public class SaSsoClientProcessor {
 	 * SSO-Client端：单点注销 [模式三]
 	 * @return 处理结果
 	 */
-	public Object ssoLogoutType3() {
+	public Object ssoLogoutByMode3() {
 		// 获取对象
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index 2f12fa92..22fea638 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -223,7 +223,7 @@ public class SaSsoServerProcessor {
 
 		// step.1 校验签名
 		if(ssoServerTemplate.getServerConfig().getIsCheckSign()) {
-			ssoServerTemplate.getSignTemplate(client).checkRequest(req, paramName.loginId);
+			ssoServerTemplate.getSignTemplate(client).checkRequest(req, paramName.client, paramName.loginId);
 		} else {
 			SaSsoManager.printNoCheckSignWarningByRuntime();
 		}
-- 
Gitee


From c52fd9c86f78a53f43b099f95f38bc534fdf4ae7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 1 May 2024 11:33:17 +0800
Subject: [PATCH 004/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20sso=20=E7=AB=A0?=
 =?UTF-8?q?=E8=8A=82=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-check-domain.md |   4 +-
 sa-token-doc/sso/sso-custom-api.md   |  16 ++---
 sa-token-doc/sso/sso-custom-login.md |   6 +-
 sa-token-doc/sso/sso-h5.md           |   6 +-
 sa-token-doc/sso/sso-home-jump.md    |   2 +-
 sa-token-doc/sso/sso-questions.md    | 100 ++++++++++++++-------------
 6 files changed, 69 insertions(+), 65 deletions(-)

diff --git a/sa-token-doc/sso/sso-check-domain.md b/sa-token-doc/sso/sso-check-domain.md
index 96caff48..db82615d 100644
--- a/sa-token-doc/sso/sso-check-domain.md
+++ b/sa-token-doc/sso/sso-check-domain.md
@@ -3,7 +3,7 @@
 --- 
 
 ### 1、Ticket劫持攻击
-在前面章节的 SSO-Server 示例中，配置项 `sa-token.sso.allow-url=*` 意为配置所有允许的Client端授权地址，不在此配置项中的URL将无法单点登录成功
+在前面章节的 SSO-Server 示例中，配置项 `sa-token.sso-server.allow-url=*` 意为配置所有允许的Client端授权地址，不在此配置项中的URL将无法单点登录成功
 
 为了方便测试，上述代码将其配置为`*`，但是，<font color="#FF0000" >在生产环境中，此配置项绝对不能配置为 * </font>，否则会有被 Ticket 劫持的风险 
 
@@ -26,7 +26,7 @@
 <!------------- tab:yaml 风格  ------------->
 ``` yaml
 sa-token: 
-	sso: 
+	sso-server: 
         # 配置允许单点登录的 url 
         allow-url: http://sa-sso-client1.com:9001/sso/login
 ```
diff --git a/sa-token-doc/sso/sso-custom-api.md b/sa-token-doc/sso/sso-custom-api.md
index ea6d933e..fb734e82 100644
--- a/sa-token-doc/sso/sso-custom-api.md
+++ b/sa-token-doc/sso/sso-custom-api.md
@@ -15,7 +15,7 @@ public class SsoServerController {
 	// SSO-Server端：处理所有SSO相关请求 
 	@RequestMapping("/sso/*")
 	public Object ssoRequest() {
-		return SaSsoProcessor.instance.serverDister();
+		return SaSsoServerProcessor.instance.dister();
 	}
 	
 	// ... 其它代码
@@ -33,13 +33,13 @@ public class SsoServerController {
 ``` java
 // 配置SSO相关参数 
 @Autowired
-private void configSso(SaSsoConfig sso) {
+private void configSso(SaSsoServerConfig ssoServer) {
 	// 自定义API地址
-	SaSsoUtil.ssoTemplate.apiName.ssoAuth = "/sso/auth2";
+	SaSsoServerProcessor.instance.ssoServerTemplate.apiName.ssoAuth = "/sso/auth2";
 	// ... 
 	
 	// SSO 相关配置
-	sso.setXxx ... ;
+	ssoServer.xxx ... ;
 }
 ```
 
@@ -61,25 +61,25 @@ public class SsoServerController {
 	// SSO-Server：统一认证地址 
 	@RequestMapping("/sso/auth")
 	public Object ssoAuth() {
-		return SaSsoProcessor.instance.ssoAuth();
+		return SaSsoServerProcessor.instance.ssoAuth();
 	}
 
 	// SSO-Server：RestAPI 登录接口 
 	@RequestMapping("/sso/doLogin")
 	public Object ssoDoLogin() {
-		return SaSsoProcessor.instance.ssoDoLogin();
+		return SaSsoServerProcessor.instance.ssoDoLogin();
 	}
 
 	// SSO-Server：校验ticket 获取账号id 
 	@RequestMapping("/sso/checkTicket")
 	public Object ssoCheckTicket() {
-		return SaSsoProcessor.instance.ssoCheckTicket();
+		return SaSsoServerProcessor.instance.ssoCheckTicket();
 	}
 
 	// SSO-Server：单点注销 
 	@RequestMapping("/sso/signout")
 	public Object ssoSignout() {
-		return SaSsoProcessor.instance.ssoSignout();
+		return SaSsoServerProcessor.instance.ssoSignout();
 	}
 	
 	// ... 其它方法 
diff --git a/sa-token-doc/sso/sso-custom-login.md b/sa-token-doc/sso/sso-custom-login.md
index bf5dfbf1..95638d58 100644
--- a/sa-token-doc/sso/sso-custom-login.md
+++ b/sa-token-doc/sso/sso-custom-login.md
@@ -81,16 +81,16 @@ if(res.code == 401) {
 
 ``` java
 // 配置：未登录时返回的View 
-sso.setNotLoginView(() -> {
+sso.notLoginView = () -> {
 	return new ModelAndView("xxx.html");
-})
+}
 ```
 
 
 ### 3、如何自定义登录API的接口地址？
 根据需求点选择解决方案：
 
-#### 3.1、如果只是想在 setDoLoginHandle 函数里获取除 name、pwd 以外的参数？
+#### 3.1、如果只是想在 doLoginHandle 函数里获取除 name、pwd 以外的参数？
 ``` java
 // 在任意代码处获取前端提交的参数 
 String xxx = SaHolder.getRequest().getParam("xxx");
diff --git a/sa-token-doc/sso/sso-h5.md b/sa-token-doc/sso/sso-h5.md
index 6f4f2eb6..22d8d8a3 100644
--- a/sa-token-doc/sso/sso-h5.md
+++ b/sa-token-doc/sso/sso-h5.md
@@ -30,7 +30,7 @@ public class H5Controller {
 	// 根据ticket进行登录 
 	@RequestMapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
+		Object loginId = SaSsoClientProcessor.instance.checkTicketByMode2Or3(ticket, "/sso/doLoginByTicket");
 		if(loginId != null) {
 			StpUtil.login(loginId);
 			return SaResult.data(StpUtil.getTokenValue());
@@ -122,14 +122,14 @@ public class H5Controller {
 <!------------- tab:yaml 风格  ------------->
 ``` yaml
 sa-token: 
-	sso: 
+	sso-client: 
 		# SSO-Server端 统一认证地址 
 	    auth-url: http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
 ```
 <!------------- tab:properties 风格  ------------->
 ``` properties
 # SSO-Server端 统一认证地址 
-sa-token.sso.auth-url=http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
+sa-token.sso-client.auth-url=http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
 ```
 <!---------------------------- tabs:end ---------------------------->
 
diff --git a/sa-token-doc/sso/sso-home-jump.md b/sa-token-doc/sso/sso-home-jump.md
index a5a8f8d3..a8c6e405 100644
--- a/sa-token-doc/sso/sso-home-jump.md
+++ b/sa-token-doc/sso/sso-home-jump.md
@@ -75,7 +75,7 @@ public Object ssoRequest() {
 	if(req.isPath("/sso/auth") && req.hasParam("redirect") == false && StpUtil.isLogin()) {
 		return SaHolder.getResponse().redirect("/home");
 	}
-	return SaSsoProcessor.instance.serverDister();
+	return SaSsoServerProcessor.instance.serverDister();
 }
 ```
 
diff --git a/sa-token-doc/sso/sso-questions.md b/sa-token-doc/sso/sso-questions.md
index d3ef9aa9..cbd73f4a 100644
--- a/sa-token-doc/sso/sso-questions.md
+++ b/sa-token-doc/sso/sso-questions.md
@@ -212,19 +212,23 @@ public class SsoController {
 	// 处理 SSO-Server 端所有请求 
 	@RequestMapping({"/sso/auth", "/sso/doLogin", "/sso/checkTicket", "/sso/signout"})
 	public Object ssoServerRequest() {
-		return SaSsoProcessor.instance.serverDister();
+		return SaSsoServerProcessor.instance.dister();
 	}
 	
 	// 处理 SSO-Client 端所有请求 
 	@RequestMapping({"/sso/login", "/sso/logout", "/sso/logoutCall"})
 	public Object ssoClientRequest() {
-		return SaSsoProcessor.instance.clientDister();
+		return SaSsoClientProcessor.instance.dister();
 	}
 	
 	// 配置SSO相关参数 
 	@Autowired
-	private void configSso(SaSsoConfig sso) {
-		// SSO配置代码，参考文档前几章 ... 
+	private void configSsoServer(SaSsoServerConfig ssoServer) {
+		// SSO Server 配置代码，参考文档前几章 ... 
+	}
+	@Autowired
+	private void configSsoClient(SaSsoClientConfig ssoClient) {
+		// SSO Client 配置代码，参考文档前几章 ... 
 	}
 	
 }
@@ -248,58 +252,58 @@ public class SsoController {
 @RestController
 public class SsoUserServerController {
 
-	/**
-	 * 新建一个 SaSsoProcessor 请求处理器 
-	 */
-	public static SaSsoProcessor ssoUserProcessor = new SaSsoProcessor();
-	static {
-		// 自定义一个 SaSsoTemplate 对象
-		SaSsoTemplate ssoUserTemplate = new SaSsoTemplate() {
-			// 使用的会话对象 是自定义的 StpUserUtil 
-			@Override
-			public StpLogic getStpLogic() {
-				return StpUserUtil.stpLogic;
-			}
+    /**
+     * 新建一个 SaSsoServerProcessor 请求处理器
+     */
+    public static SaSsoServerProcessor ssoUserServerProcessor = new SaSsoServerProcessor();
+    static {
+        // 自定义一个 SaSsoTemplate 对象
+        SaSsoServerTemplate ssoUserTemplate = new SaSsoServerTemplate() {
+            // 使用的会话对象 是自定义的 StpUserUtil
+            @Override
+            public StpLogic getStpLogic() {
+                return StpUserUtil.stpLogic;
+            }
             // 使用自定义的签名秘钥
             SaSignConfig signConfig =  new SaSignConfig().setSecretKey("xxxx-新的秘钥-xxxx");
             SaSignTemplate userSignTemplate = new SaSignTemplate().setSignConfig(signConfig);
             @Override
-            public SaSignTemplate getSignTemplate() {
+            public SaSignTemplate getSignTemplate(String client) {
                 return userSignTemplate;
             }
-		};
-		// 让这个SSO请求处理器，使用的路由前缀是 /sso-user，而不是原先的 /sso 
-		ssoUserTemplate.apiName.replacePrefix("/sso-user");
-		
-		// 给这个 SSO 请求处理器使用自定义的 SaSsoTemplate 对象 
-		ssoUserProcessor.ssoTemplate = ssoUserTemplate;
-	}
+        };
+        // 让这个SSO请求处理器，使用的路由前缀是 /sso-user，而不是原先的 /sso
+        ssoUserTemplate.apiName.replacePrefix("/sso-user");
 
-	/*
-	 * 第二套 sso-server 服务：处理所有SSO相关请求 
-	 * 		http://{host}:{port}/sso-user/auth			-- 单点登录授权地址，接受参数：redirect=授权重定向地址 
-	 * 		http://{host}:{port}/sso-user/doLogin		-- 账号密码登录接口，接受参数：name、pwd 
-	 * 		http://{host}:{port}/sso-user/checkTicket	-- Ticket校验接口（isHttp=true时打开），接受参数：ticket=ticket码、ssoLogoutCall=单点注销回调地址 [可选] 
-	 * 		http://{host}:{port}/sso-user/signout		-- 单点注销地址（isSlo=true时打开），接受参数：loginId=账号id、secretkey=接口调用秘钥 
-	 */
-	@RequestMapping("/sso-user/*")
-	public Object ssoUserRequest() {
-		return ssoUserProcessor.serverDister();
-	}
+        // 给这个 SSO 请求处理器使用自定义的 SaSsoTemplate 对象
+        ssoUserServerProcessor.ssoServerTemplate = ssoUserTemplate;
+    }
+
+    /*
+     * 第二套 sso-server 服务：处理所有SSO相关请求
+     * 		http://{host}:{port}/sso-user/auth			-- 单点登录授权地址，接受参数：redirect=授权重定向地址
+     * 		http://{host}:{port}/sso-user/doLogin		-- 账号密码登录接口，接受参数：name、pwd
+     * 		http://{host}:{port}/sso-user/checkTicket	-- Ticket校验接口（isHttp=true时打开），接受参数：ticket=ticket码、ssoLogoutCall=单点注销回调地址 [可选]
+     * 		http://{host}:{port}/sso-user/signout		-- 单点注销地址（isSlo=true时打开），接受参数：loginId=账号id、secretkey=接口调用秘钥
+     */
+    @RequestMapping("/sso-user/*")
+    public Object ssoUserRequest() {
+        return ssoUserServerProcessor.dister();
+    }
+
+    // 自定义 doLogin 方法 */
+    // 注意点：
+    // 		1、第2套 sso-server 对应的 RestApi 登录接口也应该更换为 /sso-user/doLogin，而不是原先的 /sso/doLogin
+    // 		2、在这里，登录函数要使用自定义的 StpUserUtil.login()，而不是原先的 StpUtil.login()
+    @RequestMapping("/sso-user/doLogin")
+    public Object ssoUserRequest(String name, String pwd) {
+        if("sa".equals(name) && "123456".equals(pwd)) {
+            StpUserUtil.login(10001);
+            return SaResult.ok("登录成功！").setData(StpUserUtil.getTokenValue());
+        }
+        return SaResult.error("登录失败！");
+    }
 
-	// 自定义 doLogin 方法 */
-	// 注意点：
-	// 		1、第2套 sso-server 对应的 RestApi 登录接口也应该更换为 /sso-user/doLogin，而不是原先的 /sso/doLogin 
-	// 		2、在这里，登录函数要使用自定义的 StpUserUtil.login()，而不是原先的 StpUtil.login() 
-	@RequestMapping("/sso-user/doLogin")
-	public Object ssoUserRequest(String name, String pwd) {
-		if("sa".equals(name) && "123456".equals(pwd)) {
-			StpUserUtil.login(10001);
-			return SaResult.ok("登录成功！").setData(StpUserUtil.getTokenValue());
-		}
-		return SaResult.error("登录失败！");
-	}
-	
 }
 ```
 
-- 
Gitee


From 8d6b648d4bf1aad38a47620bc5451ba399f46241 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 2 May 2024 07:17:11 +0800
Subject: [PATCH 005/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E4=B8=8D=E5=90=8C=20?=
 =?UTF-8?q?SSO=20Client=20=E9=85=8D=E7=BD=AE=E4=B8=8D=E5=90=8C=E7=A7=98?=
 =?UTF-8?q?=E9=92=A5=E7=9A=84=E6=96=B9=E6=A1=88?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../cn/dev33/satoken/config/SaSignConfig.java |  11 ++
 .../cn/dev33/satoken/sign/SaSignTemplate.java |  22 +++-
 .../src/main/resources/application.yml        |   2 +-
 .../src/main/resources/application.yml        |   2 +-
 .../src/main/resources/application.yml        |   2 +-
 sa-token-doc/_sidebar.md                      |  13 +-
 sa-token-doc/sso/sso-apidoc.md                |   6 +-
 sa-token-doc/sso/sso-diff-key.md              | 119 ++++++++++++++++++
 sa-token-doc/sso/sso-type2.md                 |   3 +
 .../sso/processor/SaSsoClientProcessor.java   |   2 +-
 10 files changed, 169 insertions(+), 13 deletions(-)
 create mode 100644 sa-token-doc/sso/sso-diff-key.md

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/config/SaSignConfig.java b/sa-token-core/src/main/java/cn/dev33/satoken/config/SaSignConfig.java
index 1e5cd72d..995ab523 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/config/SaSignConfig.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/config/SaSignConfig.java
@@ -37,6 +37,17 @@ public class SaSignConfig {
     private long timestampDisparity = 1000  * 60 * 15;
 
 
+    public SaSignConfig() {
+    }
+
+    /**
+     * 构造函数
+     * @param secretKey 秘钥
+     */
+    public SaSignConfig(String secretKey) {
+        this.secretKey = secretKey;
+    }
+
     /**
      * 获取 API 调用签名秘钥
      *
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignTemplate.java b/sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignTemplate.java
index 1076511d..4ea4f9d4 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignTemplate.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignTemplate.java
@@ -26,6 +26,8 @@ import cn.dev33.satoken.util.SaFoxUtil;
 import java.util.Map;
 import java.util.TreeMap;
 
+import static cn.dev33.satoken.SaManager.log;
+
 /**
  * API 参数签名算法，在跨系统接口调用时防参数篡改、防重放攻击。
  *
@@ -42,6 +44,17 @@ import java.util.TreeMap;
  */
 public class SaSignTemplate {
 
+	public SaSignTemplate() {
+	}
+
+	/**
+	 * 构造函数
+	 * @param signConfig 签名参数配置对象
+	 */
+	public SaSignTemplate(SaSignConfig signConfig) {
+		this.signConfig = signConfig;
+	}
+
 	// ----------- 签名配置
 
 	SaSignConfig signConfig;
@@ -160,7 +173,14 @@ public class SaSignTemplate {
 		// 计算签名
 		String paramsStr = joinParamsDictSort(paramsMap);
 		String fullStr = paramsStr + "&" + key + "=" + secretKey;
-		return abstractStr(fullStr);
+		String signStr = abstractStr(fullStr);
+
+		// 输入日志，方便调试
+		log.debug("fullStr：{}", fullStr);
+		log.debug("signStr：{}", signStr);
+
+		// 返回
+		return signStr;
 	}
 
 	/**
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/resources/application.yml
index 04395bf6..901f2838 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/resources/application.yml
@@ -3,7 +3,7 @@ server:
     port: 9000
 
 # Sa-Token 配置
-sa-token: 
+sa-token:
     # ------- SSO-模式一相关配置  (非模式一不需要配置) 
     # cookie:
          # 配置 Cookie 作用域 
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml
index ebec4dde..f829c1fe 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/src/main/resources/application.yml
@@ -3,7 +3,7 @@ server:
     port: 9032
 
 # sa-token配置 
-sa-token: 
+sa-token:
     # sso-client 相关配置
     sso-client:
         # client 标识
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
index ef48e853..b5426f8f 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
@@ -3,7 +3,7 @@ server:
     port: 9003
 
 # sa-token配置 
-sa-token: 
+sa-token:
     # sso-client 相关配置
     sso-client:
         # client 标识
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 9a575347..c017ef18 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -41,12 +41,13 @@
 	- [SSO模式一 共享Cookie同步会话](/sso/sso-type1)
 	- [SSO模式二 URL重定向传播会话](/sso/sso-type2)
 	- [SSO模式三 Http请求获取会话](/sso/sso-type3)
-	- [SSO整合：配置域名校验](/sso/sso-check-domain)
-	- [SSO整合：定制化登录页面](/sso/sso-custom-login)
-	- [SSO整合：自定义API路由](/sso/sso-custom-api)
-	- [SSO扩展：前后端分离下的整合方案](/sso/sso-h5)
-	- [SSO扩展：平台中心跳转模式](/sso/sso-home-jump)
-	- [SSO扩展：常见问题总结](/sso/sso-questions)
+	- [配置域名校验](/sso/sso-check-domain)
+	- [定制化登录页面](/sso/sso-custom-login)
+	- [自定义API路由](/sso/sso-custom-api)
+	- [前后端分离下的整合方案](/sso/sso-h5)
+	- [平台中心跳转模式](/sso/sso-home-jump)
+	- [不同 Client 不同秘钥](/sso/sso-diff-key)
+	- [常见问题总结](/sso/sso-questions)
 	- [Sa-Sso-Pro：单点登录商业版](/sso/sso-pro)
 
 - **OAuth2.0**
diff --git a/sa-token-doc/sso/sso-apidoc.md b/sa-token-doc/sso/sso-apidoc.md
index 14d29257..2d03713a 100644
--- a/sa-token-doc/sso/sso-apidoc.md
+++ b/sa-token-doc/sso/sso-apidoc.md
@@ -201,8 +201,10 @@ http://{host}:{port}/sso/logoutCall
 | loginId		| 是		| 要注销的账号 id			 					|
 | timestamp		| 是		| 当前时间戳，13位								|
 | nonce			| 是		| 随机字符串										|
-| client		| 否		| 客户端标识，如果你在登录时向 sso-server 端传递了 client 值，那么在此处 sso-server 也会给你回传过来，否则此参数无值		|
-| sign			| 是		| 签名，生成算法：`md5( loginId={账号id}&nonce={随机字符串}&timestamp={13位时间戳}&key={secretkey秘钥} )` 如果 client 参数有值，则client也要参与签名，放在 loginId 参数签名（字典顺序）|
+| sign			| 是		| 签名，生成算法：`md5( loginId={账号id}&nonce={随机字符串}&timestamp={13位时间戳}&key={secretkey秘钥} )` |
+| client		| 否		| 客户端标识，如果你在登录时向 sso-server 端传递了 client 值，那么在此处 sso-server 也会给你回传过来，否则此参数无值。如果此参数有值，则此参数也要参与签名，放在 loginId 参数前面（字典顺序）		|
+| autoLogout	| 否		| 是否为“登录client超过最大数量”引起的自动注销（true=超限系统自动注销，false=用户主动发起注销）。如果此参数有值，则此参数也要参与签名，放在 client 参数前面（字典顺序）		|
+
 
 返回数据：
 
diff --git a/sa-token-doc/sso/sso-diff-key.md b/sa-token-doc/sso/sso-diff-key.md
new file mode 100644
index 00000000..17fb0344
--- /dev/null
+++ b/sa-token-doc/sso/sso-diff-key.md
@@ -0,0 +1,119 @@
+# 不同 SSO Client 配置不同秘钥
+
+在校验 ticket、单点注销等操作发起的 http 调用时，需要配置秘钥参数，像这样：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token: 
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 接口调用秘钥 
+sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+如果 SSO Client 端和 SSO Server 端配置的秘钥不同，则无法调通请求，显示无效签名：
+``` js
+{
+  "code": 500,
+  "msg": "无效签名：9f1b453817bfeac56d2f772a66c01eb2",
+  "data": null
+}
+```
+
+如果你有多个 SSO Client，你可能想让每个应用配置不同的秘钥，让它们彼此之间不能互相“冒充”，怎么做呢？
+
+### 1、首先在 SSO Client 端，你需要配置上不同的 Client 标识参数：
+
+例如在 client1 我们配置上：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token:
+    sso-client:
+        # 当前 client 标识
+        client: sso-client1
+        # ... 
+    sign:
+        # sso-client1 使用的秘钥 
+        secret-key: secret-key-xxxx-1
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 当前 client 标识
+sa-token.sso-client.client=sso-client1
+
+# sso-client1 使用的秘钥 
+sa-token.sign.secret-key=secret-key-xxxx-1
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+在 client2 我们配置上：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token:
+    sso-client:
+        # 当前 client 标识
+        client: sso-client2
+        # ... 
+    sign:
+        # sso-client2 使用的秘钥 
+        secret-key: secret-key-xxxx-2
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 当前 client 标识
+sa-token.sso-client.client=sso-client2
+
+# sso-client2 使用的秘钥 
+sa-token.sign.secret-key=secret-key-xxxx-2
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+### 2、然后在 SSO Server 端，重写获取秘钥的函数
+
+在 SSO Server 端新建 `CustomSaSsoServerTemplate.java`，继承 `SaSsoServerTemplate`，重写其 `getSignTemplate` 函数：
+
+``` java
+/**
+ * 自定义 SaSsoServerTemplate 子类 
+ */
+@Component
+public class CustomSaSsoServerTemplate extends SaSsoServerTemplate {
+
+	// 存储所有 client 的秘钥 
+    static Map<String, SaSignTemplate> signMap = new HashMap<>();
+    static {
+        signMap.put("sso-client1", new SaSignTemplate(new SaSignConfig("secret-key-xxxx-1")));
+        signMap.put("sso-client2", new SaSignTemplate(new SaSignConfig("secret-key-xxxx-2")));
+        signMap.put("sso-client3", new SaSignTemplate(new SaSignConfig("secret-key-xxxx-3")));
+		// ... 
+    }
+
+    @Override
+    public SaSignTemplate getSignTemplate(String client) {
+        // 先从自定义的 signMap 中获取
+        SaSignTemplate saSignTemplate = signMap.get(client);
+        if (saSignTemplate != null) {
+            return saSignTemplate;
+        }
+        // 找不到就返回全局默认的 SaSignTemplate
+        return SaManager.getSaSignTemplate();
+    }
+}
+```
+
+至此完成，其它代码一切照旧。
+
+
diff --git a/sa-token-doc/sso/sso-type2.md b/sa-token-doc/sso/sso-type2.md
index 32d115ea..b19cb153 100644
--- a/sa-token-doc/sso/sso-type2.md
+++ b/sa-token-doc/sso/sso-type2.md
@@ -363,6 +363,9 @@ forest:
 ``` properties
 # 接口调用秘钥 
 sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+
+# 关闭 forest 请求日志打印
+forest.log-enabled=false
 ```
 <!---------------------------- tabs:end ---------------------------->
 
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index 5401d2f8..6665ff9e 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -150,7 +150,7 @@ public class SaSsoClientProcessor {
 
 		// 无论登录时选择的是模式二还是模式三
 		//  在注销时都应该按照模式三的方法，通过 http 请求调用 sso-server 的单点注销接口来做到全端下线
-		if(cfg.getIsSlo() && ! cfg.getIsHttp()) {
+		if(cfg.getIsSlo()) {
 			return ssoLogoutByMode3();
 		}
 
-- 
Gitee


From 27618484dc4743d6579aebcc2df1b8625fec4985 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 2 May 2024 07:42:20 +0800
Subject: [PATCH 006/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20sso=20nosdk=20demo?=
 =?UTF-8?q?=20=E4=B8=8D=E6=AD=A3=E7=A1=AE=E4=B9=8B=E5=A4=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ....java => SaSsoClientNoSdkApplication.java} | 14 ++++-
 .../java/com/pj/sso/SsoClientController.java  | 31 ++++++----
 .../main/java/com/pj/sso/SsoRequestUtil.java  | 61 +++++++++++--------
 .../src/main/resources/application.yml        |  2 +-
 4 files changed, 67 insertions(+), 41 deletions(-)
 rename sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/{SaSsoClientApplication.java => SaSsoClientNoSdkApplication.java} (31%)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientApplication.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientNoSdkApplication.java
similarity index 31%
rename from sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientApplication.java
rename to sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientNoSdkApplication.java
index 5a6393e2..1bd993de 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientApplication.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/SaSsoClientNoSdkApplication.java
@@ -4,11 +4,19 @@ import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
 @SpringBootApplication
-public class SaSsoClientApplication {
+public class SaSsoClientNoSdkApplication {
 
 	public static void main(String[] args) {
-		SpringApplication.run(SaSsoClientApplication.class, args);
+		SpringApplication.run(SaSsoClientNoSdkApplication.class, args);
 		System.out.println("\nSa-Token SSO模式三 Client端 （无SDK版本） 启动成功");
+
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 模式三 NoSdk 模式 demo 启动成功 ----------------------");
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9004");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9004");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9004");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
-	
+
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoClientController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoClientController.java
index 243a0550..15098acc 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoClientController.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoClientController.java
@@ -29,7 +29,7 @@ public class SsoClientController {
 					"<p>当前会话登录账号：" + session.getAttribute("userId") + "</p>" + 
 					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a>" + 
 					" <a href='/sso/logout?back=' +  + encodeURIComponent(location.href);>注销</a>" + 
-					" <a href='/sso/myinfo' target=\"_blank\">获取资料</a></p>";
+					" <a href='/sso/myInfo' target=\"_blank\">获取资料</a></p>";
 		return str;
 	}
 
@@ -62,8 +62,16 @@ public class SsoClientController {
 				ssoLogoutCall = request.getRequestURL().toString().replace("/sso/login", "/sso/logoutCall"); 
 			}
 			
-			// 校验 ticket 
-			String checkUrl = SsoRequestUtil.checkTicketUrl + "?ticket=" + ticket + "&ssoLogoutCall=" + ssoLogoutCall;
+			// 校验 ticket
+			String timestamp = String.valueOf(System.currentTimeMillis());	// 时间戳
+			String nonce = SsoRequestUtil.getRandomString(20);		// 随机字符串
+			String sign = SsoRequestUtil.getSignByTicket(ticket, ssoLogoutCall, timestamp, nonce);	// 参数签名
+			String checkUrl = SsoRequestUtil.checkTicketUrl +
+					"?timestamp=" + timestamp +
+					"&nonce=" + nonce +
+					"&sign=" + sign +
+					"&ticket=" + ticket +
+					"&ssoLogoutCall=" + ssoLogoutCall;
 			AjaxJson result = SsoRequestUtil.request(checkUrl);
 			
 			// 200 代表校验成功 
@@ -97,7 +105,7 @@ public class SsoClientController {
         Object loginId = session.getAttribute("userId");  // 账号id 
 		String timestamp = String.valueOf(System.currentTimeMillis());	// 时间戳 
 		String nonce = SsoRequestUtil.getRandomString(20);		// 随机字符串
-		String sign = SsoRequestUtil.getSign(loginId, timestamp, nonce, SsoRequestUtil.secretkey);	// 参数签名
+		String sign = SsoRequestUtil.getSign(loginId, timestamp, nonce);	// 参数签名
 		
         String url = SsoRequestUtil.sloUrl + 
         		"?loginId=" + loginId +
@@ -123,12 +131,13 @@ public class SsoClientController {
 	
 	// SSO-Client端：单点注销回调地址
 	@RequestMapping("/sso/logoutCall")
-	public Object ssoLogoutCall(String loginId, String timestamp, String nonce, String sign) {
+	public Object ssoLogoutCall(String loginId, String autoLogout, String timestamp, String nonce, String sign) {
 		
 		// 校验签名 
-		String calcSign = SsoRequestUtil.getSign(loginId, timestamp, nonce, SsoRequestUtil.secretkey);
+		String calcSign = SsoRequestUtil.getSignByLogoutCall(loginId, autoLogout, timestamp, nonce);
 		if(calcSign.equals(sign) == false) {
-			return AjaxJson.getError("无效签名，拒绝应答");
+			System.out.println("无效签名，拒绝应答：" + sign);
+			return AjaxJson.getError("无效签名，拒绝应答" + sign);
 		}
 		
 		// 注销这个账号id 
@@ -143,8 +152,8 @@ public class SsoClientController {
 	}
 
 	// 查询我的账号信息 (调用此接口的前提是 sso-server 端开放了 /sso/userinfo 路由)
-	@RequestMapping("/sso/myinfo")
-	public Object myinfo(HttpSession session) {
+	@RequestMapping("/sso/myInfo")
+	public Object myInfo(HttpSession session) {
 		// 如果尚未登录 
 		if(session.getAttribute("userId") == null) {
 			return "尚未登录，无法获取";
@@ -154,9 +163,9 @@ public class SsoClientController {
         Object loginId = session.getAttribute("userId");  // 账号id 
 		String timestamp = String.valueOf(System.currentTimeMillis());	// 时间戳 
 		String nonce = SsoRequestUtil.getRandomString(20);		// 随机字符串
-		String sign = SsoRequestUtil.getSign(loginId, timestamp, nonce, SsoRequestUtil.secretkey);	// 参数签名
+		String sign = SsoRequestUtil.getSign(loginId, timestamp, nonce);	// 参数签名
 		
-        String url = SsoRequestUtil.userinfoUrl + 
+        String url = SsoRequestUtil.getDataUrl +
         		"?loginId=" + loginId +
         		"&timestamp=" + timestamp +
         		"&nonce=" + nonce +
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
index 3ac8f181..0cbfa27d 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
@@ -1,14 +1,14 @@
 package com.pj.sso;
 
+import com.dtflys.forest.Forest;
+import com.pj.sso.util.AjaxJson;
+
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.security.MessageDigest;
 import java.util.Map;
 import java.util.Random;
 
-import com.dtflys.forest.Forest;
-import com.pj.sso.util.AjaxJson;
-
 /**
  * 封装一些 sso 共用方法 
  * 
@@ -18,39 +18,40 @@ import com.pj.sso.util.AjaxJson;
 public class SsoRequestUtil {
 
 	/**
-	 * SSO-Server端 统一认证地址 
+	 * SSO-Server端主机地址
 	 */
-	public static String authUrl = "http://sa-sso-server.com:9000/sso/auth";
-	
+	public static String serverUrl = "http://sa-sso-server.com:9000";
+
 	/**
-	 * 使用 Http 请求校验ticket 
+	 * SSO-Server端 统一认证地址 
 	 */
-//	public static boolean isHttp = true;
-	
+	public static String authUrl = serverUrl + "/sso/auth";
+
 	/**
 	 * SSO-Server端 ticket校验地址 
 	 */
-	public static String checkTicketUrl = "http://sa-sso-server.com:9000/sso/checkTicket";
-	
+	public static String checkTicketUrl = serverUrl + "/sso/checkTicket";
+
 	/**
-	 * 打开单点注销功能 
+	 * 单点注销地址 
 	 */
-	public static boolean isSlo = true;
-	
+	public static String sloUrl = serverUrl + "/sso/signout";
+
 	/**
-	 * 单点注销地址 
+	 * SSO-Server端 查询userinfo地址
 	 */
-	public static String sloUrl = "http://sa-sso-server.com:9000/sso/signout";
-	
+	public static String getDataUrl = serverUrl + "/sso/getData";
+
 	/**
-	 * 接口调用秘钥 
+	 * 打开单点注销功能
 	 */
-	public static String secretkey = "kQwIOrYvnXmSDkwEiFngrKidMcdrgKor";
-	
+	public static boolean isSlo = true;
+
 	/**
-	 * SSO-Server端 查询userinfo地址 
+	 * 接口调用秘钥 
 	 */
-	public static String userinfoUrl = "http://sa-sso-server.com:9000/sso/userinfo";
+	public static String secretKey = "kQwIOrYvnXmSDkwEiFngrKidMcdrgKor";
+
 	
 	
 	// -------------------------- 工具方法 
@@ -69,12 +70,20 @@ public class SsoRequestUtil {
 	 * 根据参数计算签名 
 	 * @param loginId 账号id
 	 * @param timestamp 当前时间戳，13位
-	 * @param nonce 随机字符串 
-	 * @param secretkey 账号id
+	 * @param nonce 随机字符串
 	 * @return 签名 
 	 */
-	public static String getSign(Object loginId, String timestamp, String nonce, String secretkey) {
-		return md5("loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretkey);
+	public static String getSign(Object loginId, String timestamp, String nonce) {
+		return md5("loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretKey);
+	}
+	// 单点注销回调时构建签名
+	public static String getSignByLogoutCall(Object loginId, String autoLogout, String timestamp, String nonce) {
+		System.out.println("autoLogout=" + autoLogout + "loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretKey);
+		return md5("autoLogout=" + autoLogout + "&loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretKey);
+	}
+	// 校验ticket 时构建签名
+	public static String getSignByTicket(String ticket, String ssoLogoutCall, String timestamp, String nonce) {
+		return md5("nonce=" + nonce + "&ssoLogoutCall=" + ssoLogoutCall + "&ticket=" + ticket + "&timestamp=" + timestamp + "&key=" + secretKey);
 	}
 
 	/**
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/resources/application.yml
index bb9f457b..982a1264 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/resources/application.yml
@@ -1,6 +1,6 @@
 # 端口
 server:
-    port: 9001
+    port: 9004
 
 forest: 
     # 打开/关闭Forest请求日志（默认为 true）
-- 
Gitee


From 7ee27add84ee992c3716a1f48f0a9bba81c920f0 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 2 May 2024 07:42:54 +0800
Subject: [PATCH 007/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20sso=20nosdk=20demo?=
 =?UTF-8?q?=20=E4=B8=8D=E6=AD=A3=E7=A1=AE=E4=B9=8B=E5=A4=84..?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/sso/SsoRequestUtil.java                 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
index 0cbfa27d..0fc8c3ee 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk/src/main/java/com/pj/sso/SsoRequestUtil.java
@@ -78,7 +78,6 @@ public class SsoRequestUtil {
 	}
 	// 单点注销回调时构建签名
 	public static String getSignByLogoutCall(Object loginId, String autoLogout, String timestamp, String nonce) {
-		System.out.println("autoLogout=" + autoLogout + "loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretKey);
 		return md5("autoLogout=" + autoLogout + "&loginId=" + loginId + "&nonce=" + nonce + "&timestamp=" + timestamp + "&key=" + secretKey);
 	}
 	// 校验ticket 时构建签名
-- 
Gitee


From 4c216069aaf462a4961019dc4b41887c7b3fd247 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 2 May 2024 10:36:54 +0800
Subject: [PATCH 008/172] =?UTF-8?q?=E5=8C=BF=E5=90=8D=20client=20=E5=B0=86?=
 =?UTF-8?q?=E4=B8=8D=E5=86=8D=E8=83=BD=E8=A7=A3=E6=9E=90=E5=87=BA=E6=89=80?=
 =?UTF-8?q?=E6=9C=89=E5=BA=94=E7=94=A8=E7=9A=84=20client?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/error/SaSsoErrorCode.java     |  3 +++
 .../sso/processor/SaSsoServerProcessor.java   | 25 +++++++++++++++----
 .../sso/template/SaSsoServerTemplate.java     | 17 +++++++++----
 .../dev33/satoken/sso/util/SaSsoConsts.java   |  5 ++++
 4 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
index 9f748ade..c27bfdff 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
@@ -59,4 +59,7 @@ public interface SaSsoErrorCode {
 	/** 当前缺少配置 server-url 地址 */
 	int CODE_30012 = 30012;
 
+	/** 提供的 client 参数值无效 */
+	int CODE_30013 = 30013;
+
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index 22fea638..c99e5f5e 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -20,6 +20,8 @@ import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
 import cn.dev33.satoken.sso.SaSsoManager;
 import cn.dev33.satoken.sso.config.SaSsoServerConfig;
+import cn.dev33.satoken.sso.error.SaSsoErrorCode;
+import cn.dev33.satoken.sso.exception.SaSsoException;
 import cn.dev33.satoken.sso.name.ApiName;
 import cn.dev33.satoken.sso.name.ParamName;
 import cn.dev33.satoken.sso.template.SaSsoServerTemplate;
@@ -112,8 +114,16 @@ public class SaSsoServerProcessor {
 			return res.redirect(redirect);
 		} else {
 			// 方式2：带着ticket参数重定向回Client端 (mode=ticket)
+
+			// 校验提供的client是否为非法字符
+			String client = req.getParam(paramName.client);
+			if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
+				throw new SaSsoException("无效 client 标识：" + client).setCode(SaSsoErrorCode.CODE_30013);
+			}
+
+			// 开始重定向
 			String redirectUrl = ssoServerTemplate.buildRedirectUrl(
-					stpLogic.getLoginId(), req.getParam(paramName.client), req.getParam(paramName.redirect));
+					stpLogic.getLoginId(), client, req.getParam(paramName.redirect));
 			return res.redirect(redirectUrl);
 		}
 	}
@@ -145,7 +155,12 @@ public class SaSsoServerProcessor {
 		String ticket = req.getParamNotNull(paramName.ticket);
 		String sloCallback = req.getParam(paramName.ssoLogoutCall);
 
-		// 2、校验签名
+		// 2、校验提供的client是否为非法字符
+		if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
+			return SaResult.error("无效 client 标识：" + client);
+		}
+
+		// 3、校验签名
 		if(ssoServerTemplate.getServerConfig().getIsCheckSign()) {
 			ssoServerTemplate.getSignTemplate(client).checkRequest(req,
 					paramName.client, paramName.ticket, paramName.ssoLogoutCall);
@@ -153,16 +168,16 @@ public class SaSsoServerProcessor {
 			SaSsoManager.printNoCheckSignWarningByRuntime();
 		}
 
-		// 3、校验ticket，获取 loginId
+		// 4、校验ticket，获取 loginId
 		Object loginId = ssoServerTemplate.checkTicket(ticket, client);
 		if(SaFoxUtil.isEmpty(loginId)) {
 			return SaResult.error("无效ticket：" + ticket);
 		}
 
-		// 4、注册此客户端的单点注销回调URL
+		// 5、注册此客户端的单点注销回调URL
 		ssoServerTemplate.registerSloCallbackUrl(loginId, client, sloCallback);
 
-		// 5、给 client 端响应结果
+		// 6、给 client 端响应结果
 		return SaResult.data(loginId);
 	}
 
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
index 1c60027b..42255ac0 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
@@ -187,7 +187,7 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
      * @return 账号id
      */
     public Object checkTicket(String ticket) {
-        return checkTicket(ticket, null);
+        return checkTicket(ticket, SaSsoConsts.CLIENT_WILDCARD);
     }
 
     /**
@@ -205,10 +205,17 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
             // 解析出这个 ticket 关联的 Client
             String ticketClient = getTicketToClient(ticket);
 
-            // 如果指定了 client 标识，则校验一下 client 标识是否一致
-            if(SaFoxUtil.isNotEmpty(client) && SaFoxUtil.notEquals(client, ticketClient)) {
-                throw new SaSsoException("该 ticket 不属于 client=" + client + ", ticket 值: " + ticket)
-                        .setCode(SaSsoErrorCode.CODE_30011);
+            // 校验 client 参数是否正确，即：创建 ticket 的 client 和当前校验 ticket 的 client 是否一致
+            if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
+                // 如果提供的是通配符，直接越过 client 校验
+            } else if (SaFoxUtil.isEmpty(client) && SaFoxUtil.isEmpty(ticketClient)) {
+                // 如果提供的和期望的两者均为空，则通过校验
+            } else {
+                // 开始详细比对
+                if(SaFoxUtil.notEquals(client, ticketClient)) {
+                    throw new SaSsoException("该 ticket 不属于 client=" + client + ", ticket 值: " + ticket)
+                            .setCode(SaSsoErrorCode.CODE_30011);
+                }
             }
 
             // 删除 ticket 信息，使其只有一次性有效
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/util/SaSsoConsts.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/util/SaSsoConsts.java
index 64050ae7..8eea64f4 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/util/SaSsoConsts.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/util/SaSsoConsts.java
@@ -45,6 +45,9 @@ public class SaSsoConsts {
 	/** 表示请求没有得到任何有效处理 {msg: "not handle"} */
 	public static final String NOT_HANDLE = "{\"msg\": \"not handle\"}";
 
+	/** client 身份，* 代表通配，可以解析出所有 client 的 ticket */
+	public static final String CLIENT_WILDCARD = "*";
+
 	/** SSO 模式1 */
 	public static final int SSO_MODE_1 = 1;
 	/** SSO 模式2 */
@@ -52,4 +55,6 @@ public class SaSsoConsts {
 	/** SSO 模式3 */
 	public static final int SSO_MODE_3 = 3;
 
+
+
 }
-- 
Gitee


From cf1f255a4ae797760e829ff9624f3595ddb4249f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 3 May 2024 04:04:52 +0800
Subject: [PATCH 009/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20homeRoute=20?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E9=A1=B9=EF=BC=9A=E5=9C=A8=20/sso/auth=20?=
 =?UTF-8?q?=E7=99=BB=E5=BD=95=E5=90=8E=E4=B8=8D=E6=8C=87=E5=AE=9A=20redire?=
 =?UTF-8?q?ct=20=E5=8F=82=E6=95=B0=E7=9A=84=E6=83=85=E5=86=B5=E4=B8=8B?=
 =?UTF-8?q?=E9=BB=98=E8=AE=A4=E8=B7=B3=E8=BD=AC=E7=9A=84=E8=B7=AF=E7=94=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/SaSsoServerApplication.java   |  2 ++
 .../satoken/sso/config/SaSsoServerConfig.java | 22 ++++++++++++++++++
 .../satoken/sso/error/SaSsoErrorCode.java     |  3 +++
 .../sso/processor/SaSsoServerProcessor.java   | 23 +++++++++++++++----
 4 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
index 1d2c46d2..f8559239 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/SaSsoServerApplication.java
@@ -13,6 +13,8 @@ public class SaSsoServerApplication {
 		System.out.println();
 		System.out.println("---------------------- Sa-Token SSO 统一认证中心启动成功 ----------------------");
 		System.out.println("配置信息：" + SaSsoManager.getServerConfig());
+		System.out.println("统一认证登录地址：http://sa-sso-server.com:9000/sso/auth");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
 		System.out.println();
 	}
 	
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
index a0855c57..2ba6a8a3 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
@@ -54,6 +54,11 @@ public class SaSsoServerConfig implements Serializable {
      */
     public String allowUrl = "*";
 
+    /**
+     * 主页路由：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由
+     */
+    public String homeRoute;
+
     /**
      * 是否打开单点注销功能
      */
@@ -127,6 +132,22 @@ public class SaSsoServerConfig implements Serializable {
         return this;
     }
 
+    /**
+     * @return 主页路由：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由
+     */
+    public String getHomeRoute() {
+        return homeRoute;
+    }
+
+    /**
+     * @param homeRoute 主页路由：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由
+     * @return 对象自身
+     */
+    public SaSsoServerConfig setHomeRoute(String homeRoute) {
+        this.homeRoute = homeRoute;
+        return this;
+    }
+
     /**
      * @return 是否打开单点注销功能
      */
@@ -210,6 +231,7 @@ public class SaSsoServerConfig implements Serializable {
                 + "mode=" + mode
                 + ", ticketTimeout=" + ticketTimeout
                 + ", allowUrl=" + allowUrl
+                + ", homeRoute=" + homeRoute
                 + ", isSlo=" + isSlo
                 + ", isHttp=" + isHttp
                 + ", maxRegClient=" + maxRegClient
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
index c27bfdff..9d0c6b16 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
@@ -62,4 +62,7 @@ public interface SaSsoErrorCode {
 	/** 提供的 client 参数值无效 */
 	int CODE_30013 = 30013;
 
+	/** 在 /sso/auth 既没有指定 redirect 参数，也没有配置 homeRoute 路由 */
+	int CODE_30014 = 30014;
+
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index c99e5f5e..e6d93561 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -106,10 +106,18 @@ public class SaSsoServerProcessor {
 		}
 		// ---- 情况2：在SSO认证中心已经登录，需要重定向回 Client 端，而这又分为两种方式：
 		String mode = req.getParam(paramName.mode, "");
+		String redirect = req.getParam(paramName.redirect);
 
 		// 方式1：直接重定向回Client端 (mode=simple)
 		if(mode.equals(SaSsoConsts.MODE_SIMPLE)) {
-			String redirect = req.getParam(paramName.redirect);
+
+			// 若 redirect 为空，则选择 homeRoute，若 homeRoute 也为空，则抛出异常
+			if(SaFoxUtil.isEmpty(redirect)) {
+				if(SaFoxUtil.isEmpty(cfg.getHomeRoute())) {
+					throw new SaSsoException("未指定 redirect 参数，也未配置 homeRoute 路由，无法完成重定向操作").setCode(SaSsoErrorCode.CODE_30014);
+				}
+				return res.redirect(cfg.getHomeRoute());
+			}
 			ssoServerTemplate.checkRedirectUrl(redirect);
 			return res.redirect(redirect);
 		} else {
@@ -121,9 +129,16 @@ public class SaSsoServerProcessor {
 				throw new SaSsoException("无效 client 标识：" + client).setCode(SaSsoErrorCode.CODE_30013);
 			}
 
-			// 开始重定向
-			String redirectUrl = ssoServerTemplate.buildRedirectUrl(
-					stpLogic.getLoginId(), client, req.getParam(paramName.redirect));
+			// 若 redirect 为空，则选择 homeRoute，若 homeRoute 也为空，则抛出异常
+			if(SaFoxUtil.isEmpty(redirect)) {
+				if(SaFoxUtil.isEmpty(cfg.getHomeRoute())) {
+					throw new SaSsoException("未指定 redirect 参数，也未配置 homeRoute 路由，无法完成重定向操作").setCode(SaSsoErrorCode.CODE_30014);
+				}
+				return res.redirect(cfg.getHomeRoute());
+			}
+
+			// 构建并跳转
+			String redirectUrl = ssoServerTemplate.buildRedirectUrl(stpLogic.getLoginId(), client, redirect);
 			return res.redirect(redirectUrl);
 		}
 	}
-- 
Gitee


From 5a7463dc91ce11a6517968b9bdc46947b960c3f5 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 3 May 2024 14:22:27 +0800
Subject: [PATCH 010/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E6=9C=89=E6=95=88=E6=9C=9F=E7=AD=96=E7=95=A5=EF=BC=8CSSO=20Cli?=
 =?UTF-8?q?ent=20=E7=AB=AF=E7=99=BB=E5=BD=95=E6=97=B6=E5=B0=86=E5=BB=B6?=
 =?UTF-8?q?=E7=BB=AD=20SSO=20Server=20=E7=AB=AF=E7=9A=84=E4=BC=9A=E8=AF=9D?=
 =?UTF-8?q?=E5=89=A9=E4=BD=99=E6=9C=89=E6=95=88=E6=9C=9F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/exception/SaSsoException.java | 33 +++++++++-
 .../function/TicketResultHandleFunction.java  |  4 +-
 .../cn/dev33/satoken/sso/name/ParamName.java  |  3 +
 .../sso/processor/SaSsoClientProcessor.java   | 65 ++++++++++++++-----
 .../sso/processor/SaSsoServerProcessor.java   |  4 +-
 5 files changed, 88 insertions(+), 21 deletions(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/exception/SaSsoException.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/exception/SaSsoException.java
index a33a3453..b4c50995 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/exception/SaSsoException.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/exception/SaSsoException.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.sso.exception;
 
 import cn.dev33.satoken.exception.SaTokenException;
+import cn.dev33.satoken.util.SaFoxUtil;
 
 
 /**
@@ -57,12 +58,38 @@ public class SaSsoException extends SaTokenException {
 		super.setCode(code);
 		return this;
 	}
-	
+
+
+	/**
+	 * 断言 flag 不为 true，否则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息
+	 * @param code 异常细分状态码
+	 */
+	public static void notTrue(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaSsoException(message).setCode(code);
+		}
+	}
+
+	/**
+	 * 断言 value 不为空，否则抛出 message 异常
+	 * @param value 值
+	 * @param message 异常信息
+	 * @param code 异常细分状态码
+	 */
+	public static void notEmpty(Object value, String message, int code) {
+		if(SaFoxUtil.isEmpty(value)) {
+			throw new SaSsoException(message).setCode(code);
+		}
+	}
+
 	/**
-	 * 如果flag==true，则抛出message异常 
+	 * 如果flag==true，则抛出message异常
 	 * @param flag 标记
-	 * @param message 异常信息 
+	 * @param message 异常信息
 	 */
+	@Deprecated
 	public static void throwBy(boolean flag, String message) {
 		if(flag) {
 			throw new SaSsoException(message);
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
index 7fdc26e0..f1100000 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
@@ -15,6 +15,8 @@
  */
 package cn.dev33.satoken.sso.function;
 
+import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
+
 import java.util.function.BiFunction;
 
 /**
@@ -27,6 +29,6 @@ import java.util.function.BiFunction;
  * @since 1.38.0
  */
 @FunctionalInterface
-public interface TicketResultHandleFunction extends BiFunction<Object, String, Object> {
+public interface TicketResultHandleFunction extends BiFunction<SaSsoClientProcessor.CheckTicketResult, String, Object> {
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/name/ParamName.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/name/ParamName.java
index ab456a06..c0f7b188 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/name/ParamName.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/name/ParamName.java
@@ -57,4 +57,7 @@ public class ParamName {
 	public String nonce = "nonce";
 	public String sign = "sign";
 
+	/** Session 剩余有效期 参数名称 */
+	public String remainSessionTimeout = "remainSessionTimeout";
+
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index 6665ff9e..9e589c81 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -121,22 +121,17 @@ public class SaSsoClientProcessor {
 			String serverAuthUrl = ssoClientTemplate.buildServerAuthUrl(currSsoLoginUrl, back);
 			return res.redirect(serverAuthUrl);
 		} else {
-			// ------- 1、校验ticket，获取 loginId
-			Object loginId = checkTicketByMode2Or3(ticket, apiName.ssoLogin);
+			// 1、校验ticket，获取 loginId
+			CheckTicketResult ctr = checkTicketByMode2Or3(ticket, apiName.ssoLogin);
 
-			// Be: 如果开发者自定义了处理逻辑
+			// 2、如果开发者自定义了ticket结果值处理函数，则使用自定义的函数
 			if(cfg.ticketResultHandle != null) {
-				return cfg.ticketResultHandle.apply(loginId, back);
+				return cfg.ticketResultHandle.apply(ctr, back);
 			}
 
-			// ------- 2、如果 loginId 无值，说明 ticket 无效
-			if(SaFoxUtil.isEmpty(loginId)) {
-				throw new SaSsoException("无效ticket：" + ticket).setCode(SaSsoErrorCode.CODE_30004);
-			} else {
-				// 3、如果 loginId 有值，说明 ticket 有效，此时进行登录并重定向至back地址
-				stpLogic.login(loginId);
-				return res.redirect(back);
-			}
+			// 3、登录并重定向至back地址
+			stpLogic.login(ctr.loginId, ctr.remainSessionTimeout);
+			return res.redirect(back);
 		}
 	}
 
@@ -244,14 +239,15 @@ public class SaSsoClientProcessor {
 	// 工具方法
 
 	/**
-	 * 封装：校验ticket，取出loginId
+	 * 封装：校验ticket，取出loginId，如果 ticket 无效则抛出异常
 	 * @param ticket ticket码
 	 * @param currUri 当前路由的uri，用于计算单点注销回调地址
 	 * @return loginId
 	 */
-	public Object checkTicketByMode2Or3(String ticket, String currUri) {
+	public CheckTicketResult checkTicketByMode2Or3(String ticket, String currUri) {
 		SaSsoClientConfig cfg = ssoClientTemplate.getClientConfig();
 		ApiName apiName = ssoClientTemplate.apiName;
+		ParamName paramName = ssoClientTemplate.paramName;
 
 		// --------- 两种模式
 		if(cfg.getIsHttp()) {
@@ -281,7 +277,18 @@ public class SaSsoClientProcessor {
 
 			// 校验
 			if(result.getCode() != null && result.getCode() == SaResult.CODE_SUCCESS) {
-				return result.getData();
+				// 取出 loginId
+				Object loginId = result.getData();
+				if(SaFoxUtil.isEmpty(loginId)) {
+					throw new SaSsoException("无效ticket：" + ticket).setCode(SaSsoErrorCode.CODE_30004);
+				}
+				// 取出 Session 剩余有效期
+				Long remainSessionTimeout = result.get(paramName.remainSessionTimeout, Long.class);
+				if(remainSessionTimeout == null) {
+					remainSessionTimeout = ssoClientTemplate.getStpLogic().getConfig().getTimeout();
+				}
+				// 构建返回
+				return new CheckTicketResult(loginId, remainSessionTimeout);
 			} else {
 				// 将 sso-server 回应的消息作为异常抛出
 				throw new SaSsoException(result.getMsg()).setCode(SaSsoErrorCode.CODE_30005);
@@ -293,7 +300,16 @@ public class SaSsoClientProcessor {
 			// 		而在当前 sso-client 没有按照相应格式重写 SaSsoClientProcessor 里的方法，
 			// 		可能会导致调用失败（注意是可能，而非一定），
 			// 		解决方案为：在当前 sso-client 端也按照 sso-server 端的格式重写 SaSsoClientProcessor 里的方法
-			return SaSsoServerProcessor.instance.ssoServerTemplate.checkTicket(ticket, cfg.getClient());
+
+			// 取出 loginId
+			Object loginId = SaSsoServerProcessor.instance.ssoServerTemplate.checkTicket(ticket, cfg.getClient());
+			if(SaFoxUtil.isEmpty(loginId)) {
+				throw new SaSsoException("无效ticket：" + ticket).setCode(SaSsoErrorCode.CODE_30004);
+			}
+			// 取出 Session 剩余有效期
+			long remainSessionTimeout = ssoClientTemplate.getStpLogic().getSessionTimeoutByLoginId(loginId);
+			// 构建返回
+			return new CheckTicketResult(loginId, remainSessionTimeout);
 		}
 	}
 
@@ -307,4 +323,21 @@ public class SaSsoClientProcessor {
 		return SaSsoProcessorHelper.ssoLogoutBack(req, res, ssoClientTemplate.paramName);
 	}
 
+
+	public static class CheckTicketResult {
+		public Object loginId;
+		public long remainSessionTimeout;
+		public CheckTicketResult(Object loginId, long remainSessionTimeout) {
+			this.loginId = loginId;
+			this.remainSessionTimeout = remainSessionTimeout;
+		}
+		@Override
+		public String toString() {
+			return "CheckTicketResult{" +
+					"loginId=" + loginId +
+					", remainSessionTimeout=" + remainSessionTimeout +
+					'}';
+		}
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index e6d93561..3a917376 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -193,7 +193,9 @@ public class SaSsoServerProcessor {
 		ssoServerTemplate.registerSloCallbackUrl(loginId, client, sloCallback);
 
 		// 6、给 client 端响应结果
-		return SaResult.data(loginId);
+		long remainSessionTimeout = ssoServerTemplate.getStpLogic().getSessionTimeoutByLoginId(loginId);
+		return SaResult.data(loginId)
+				.set(paramName.remainSessionTimeout, remainSessionTimeout);
 	}
 
 	/**
-- 
Gitee


From 64abd69715f90eab7dd3e0dc37f68ca941f7005d Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 3 May 2024 16:14:40 +0800
Subject: [PATCH 011/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20autoRenewTimeout?=
 =?UTF-8?q?=20=E9=85=8D=E7=BD=AE=E9=A1=B9=EF=BC=9A=E6=98=AF=E5=90=A6?=
 =?UTF-8?q?=E5=9C=A8=E6=AF=8F=E6=AC=A1=E4=B8=8B=E5=8F=91=20ticket=20?=
 =?UTF-8?q?=E6=97=B6=EF=BC=8C=E8=87=AA=E5=8A=A8=E7=BB=AD=E6=9C=9F=20token?=
 =?UTF-8?q?=20=E7=9A=84=E6=9C=89=E6=95=88=E6=9C=9F=EF=BC=88=E6=A0=B9?=
 =?UTF-8?q?=E6=8D=AE=E5=85=A8=E5=B1=80=20timeout=20=E5=80=BC=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/config/SaSsoServerConfig.java | 22 +++++++++++++++++++
 .../sso/processor/SaSsoClientProcessor.java   |  2 +-
 .../sso/processor/SaSsoServerProcessor.java   |  5 +++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
index 2ba6a8a3..1830962f 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
@@ -69,6 +69,11 @@ public class SaSsoServerConfig implements Serializable {
      */
     public Boolean isHttp = false;
 
+    /**
+     * 是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
+     */
+    public Boolean autoRenewTimeout = false;
+
     /**
      * 在 Access-Session 上记录 Client 信息的最高数量（-1=无限），超过此值将进行自动清退处理，先进先出
      */
@@ -180,6 +185,22 @@ public class SaSsoServerConfig implements Serializable {
         return this;
     }
 
+    /**
+     * @return 是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
+     */
+    public Boolean getAutoRenewTimeout() {
+        return autoRenewTimeout;
+    }
+
+    /**
+     * @param autoRenewTimeout 是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
+     * @return 对象自身
+     */
+    public SaSsoServerConfig setAutoRenewTimeout(Boolean autoRenewTimeout) {
+        this.autoRenewTimeout = autoRenewTimeout;
+        return this;
+    }
+
     /**
      * @return maxLoginClient 在 Access-Session 上记录 Client 信息的最高数量（-1=无限），超过此值将进行自动清退处理，先进先出
      */
@@ -234,6 +255,7 @@ public class SaSsoServerConfig implements Serializable {
                 + ", homeRoute=" + homeRoute
                 + ", isSlo=" + isSlo
                 + ", isHttp=" + isHttp
+                + ", autoRenewTimeout=" + autoRenewTimeout
                 + ", maxRegClient=" + maxRegClient
                 + ", isCheckSign=" + isCheckSign
                 + "]";
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index 9e589c81..9c8dc651 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -285,7 +285,7 @@ public class SaSsoClientProcessor {
 				// 取出 Session 剩余有效期
 				Long remainSessionTimeout = result.get(paramName.remainSessionTimeout, Long.class);
 				if(remainSessionTimeout == null) {
-					remainSessionTimeout = ssoClientTemplate.getStpLogic().getConfig().getTimeout();
+					remainSessionTimeout = ssoClientTemplate.getStpLogic().getConfigOrGlobal().getTimeout();
 				}
 				// 构建返回
 				return new CheckTicketResult(loginId, remainSessionTimeout);
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index 3a917376..ec9e00c2 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -139,6 +139,11 @@ public class SaSsoServerProcessor {
 
 			// 构建并跳转
 			String redirectUrl = ssoServerTemplate.buildRedirectUrl(stpLogic.getLoginId(), client, redirect);
+			// 构建成功，说明 redirect 地址合法，此时需要更新一下该账号的Session有效期
+			if(cfg.getAutoRenewTimeout()) {
+				stpLogic.renewTimeout(stpLogic.getConfigOrGlobal().getTimeout());
+			}
+			// 跳转
 			return res.redirect(redirectUrl);
 		}
 	}
-- 
Gitee


From c850874e49c19f91af4b4772a53c3ef9592e9b81 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 04:49:51 +0800
Subject: [PATCH 012/172] =?UTF-8?q?=E9=A6=96=E9=A1=B5=E4=BB=8B=E7=BB=8D?=
 =?UTF-8?q?=E6=96=87=E5=AD=97=E5=A2=9E=E5=8A=A0=E9=80=90=E5=AD=97=E6=89=93?=
 =?UTF-8?q?=E5=8D=B0=E6=95=88=E6=9E=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index a7abea2c..da8dd5ee 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -1095,5 +1095,31 @@
 			}
 		</script>
 		
+		<script>
+			// 逐字打印效果
+			var tcStr = '一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！';
+			var con = $('.sub-title');
+			var index = 1;
+			var length = tcStr.length;
+			var tId = null;
+			 
+			function start(){
+				con.text(tcStr.charAt(0));
+
+				tId = setInterval(function(){
+					con.append(tcStr.charAt(index));
+					if(index++ === length){
+						clearInterval(tId);
+						index = 1;
+						setTimeout(function(){
+							start()
+						}, 2000)
+					}
+				}, 90);
+			}
+			start();
+
+		</script>
+		
 	</body>
 </html>
\ No newline at end of file
-- 
Gitee


From 21948fbf7e1329137889aa8b577aa166201e988c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 05:31:48 +0800
Subject: [PATCH 013/172] =?UTF-8?q?=E6=96=87=E5=AD=97=E9=80=90=E5=AD=97?=
 =?UTF-8?q?=E6=89=93=E5=8D=B0=E6=95=88=E6=9E=9C..?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index da8dd5ee..1ad4665d 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -13,6 +13,10 @@
 		<link rel="stylesheet" href="static/index.css">
 		<link rel="stylesheet" href="static/swiper/swiper-bundle.min.css">
 		<link rel="stylesheet" href="static/swiper/index-swiper.css">
+		<style>
+			.gb-cursor {display: inline-block;width: 2px;height: 22px;position: relative;top: 4px;left: -4px;background-color: black;animation: blink 0.7s infinite alternate;}
+			@keyframes blink { from {opacity: 0;} to {opacity: 1;} }
+		</style>
 	</head>
 	<body>
 		<!-- 总盒子 -->
@@ -110,7 +114,10 @@
 				<div class="content-box">
 					<!-- <div class="fenge"></div> -->
 					<h1>Sa-Token<small>v1.37.0</small></h1>
-					<div class="sub-title">一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！</div>
+					<div class="sub-title">
+						<span class="sub-title-nr">一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！</span>
+						<div class="gb-cursor">&nbsp;</div>
+					</div>
 					<div class="btn-box">
 						<a class="abtn" href="https://gitee.com/dromara/sa-token" target="_blank">Gitee</a>
 						<a class="abtn" href="https://github.com/dromara/sa-token" target="_blank">GitHub</a>
@@ -1098,7 +1105,7 @@
 		<script>
 			// 逐字打印效果
 			var tcStr = '一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！';
-			var con = $('.sub-title');
+			var con = $('.sub-title .sub-title-nr');
 			var index = 1;
 			var length = tcStr.length;
 			var tId = null;
@@ -1113,7 +1120,7 @@
 						index = 1;
 						setTimeout(function(){
 							start()
-						}, 2000)
+						}, 3000)
 					}
 				}, 90);
 			}
-- 
Gitee


From 2eacec953995f2d17f25ceaed7df734b64a06966 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 05:58:18 +0800
Subject: [PATCH 014/172] =?UTF-8?q?=E8=A1=A5=E9=BD=90=20sa-token-spring-ao?=
 =?UTF-8?q?p=20=E6=A8=A1=E5=9D=97=E4=B8=AD=E9=81=97=E6=BC=8F=E7=9B=91?=
 =?UTF-8?q?=E5=90=AC=E7=9A=84=E6=B3=A8=E8=A7=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java
index b2d7d074..8d4a0e7e 100644
--- a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java
@@ -59,7 +59,9 @@ public class SaCheckAspect {
 			+ "@within(cn.dev33.satoken.annotation.SaCheckPermission) || @annotation(cn.dev33.satoken.annotation.SaCheckPermission) || "
 			+ "@within(cn.dev33.satoken.annotation.SaCheckSafe) || @annotation(cn.dev33.satoken.annotation.SaCheckSafe) || "
 			+ "@within(cn.dev33.satoken.annotation.SaCheckDisable) || @annotation(cn.dev33.satoken.annotation.SaCheckDisable) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckBasic) || @annotation(cn.dev33.satoken.annotation.SaCheckBasic)";
+			+ "@within(cn.dev33.satoken.annotation.SaCheckHttpDigest) || @annotation(cn.dev33.satoken.annotation.SaCheckHttpDigest) || "
+			+ "@within(cn.dev33.satoken.annotation.SaCheckOr) || @annotation(cn.dev33.satoken.annotation.SaCheckOr) || "
+			+ "@within(cn.dev33.satoken.annotation.SaCheckHttpBasic) || @annotation(cn.dev33.satoken.annotation.SaCheckHttpBasic)";
 
 	/**
 	 * 声明AOP签名
-- 
Gitee


From c0a993a0f54257b400067690dd8f6394601b3746 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 08:54:23 +0800
Subject: [PATCH 015/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20Sa-Token=20?=
 =?UTF-8?q?=E9=97=AE=E5=8D=B7=E8=B0=83=E6=9F=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md     | 1 +
 sa-token-doc/doc.html        | 2 +-
 sa-token-doc/index.html      | 2 +-
 sa-token-doc/more/wenjuan.md | 5 +++++
 4 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 sa-token-doc/more/wenjuan.md

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index c017ef18..f471adac 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -93,6 +93,7 @@
 	- [加入讨论群](/more/join-group) 
 	- [赞助 Sa-Token](/more/sa-token-donate)
 	- [需求提交](/more/demand-commit) 
+	- [问卷调查](/more/wenjuan) 
 
 - **附录**
 	- [常见问题排查](/more/common-questions)  
diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 876b1bdd..92ac71ce 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -122,7 +122,7 @@
 							<a href="#/fun/sa-token-test">在线考试</a>
 							<a href="#/fun/issue-template">在线提问</a>
 							<!-- <a href="https://wj.qq.com/s2/10852322/0d8b/" target="_blank">需求提交</a> -->
-							<a href="https://wj.qq.com/s2/8475114/2f6a/" target="_blank">问卷调查</a>
+							<a href="#/more/wenjuan">问卷调查</a>
 						</div>
 					</div>
 				</div>
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 1ad4665d..ae38c300 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -89,7 +89,7 @@
 								<a href="doc.html#/fun/sa-token-test">在线考试</a>
 								<a href="doc.html#/fun/issue-template">在线提问</a>
 								<!-- <a href="https://wj.qq.com/s2/10852322/0d8b/" target="_blank">需求提交</a> -->
-								<a href="https://wj.qq.com/s2/8475114/2f6a/" target="_blank">问卷调查</a>
+								<a href="doc.html#/more/wenjuan">问卷调查</a>
 							</div>
 						</div>
 					</div>
diff --git a/sa-token-doc/more/wenjuan.md b/sa-token-doc/more/wenjuan.md
new file mode 100644
index 00000000..7324ccb0
--- /dev/null
+++ b/sa-token-doc/more/wenjuan.md
@@ -0,0 +1,5 @@
+# 问卷调查
+
+我们想以运营一款产品的心态来运营一个开源框架，所以我们迫切希望您能够填写这份问卷，这有6道选择题，应该只会略微占用您1-3分钟的时间，Sa-Token将会非常重视每一位粉丝的宝贵意见！
+
+[https://wj.qq.com/s2/14587150/b5b4/](https://wj.qq.com/s2/14587150/b5b4/)
-- 
Gitee


From 7f5ae1196124bfc0cf36dfff8ff0953e4f97ca4c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 09:48:31 +0800
Subject: [PATCH 016/172] =?UTF-8?q?=E4=BC=98=E5=8C=96demo=E7=A4=BA?=
 =?UTF-8?q?=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/satoken/SaTokenConfigure.java  | 18 +++++++++---------
 .../main/java/com/pj/satoken/StpUserUtil.java  |  2 ++
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
index c5c9f7a5..95940185 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -1,12 +1,5 @@
 package com.pj.satoken;
 
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.core.annotation.AnnotatedElementUtils;
-import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.filter.SaServletFilter;
 import cn.dev33.satoken.interceptor.SaInterceptor;
@@ -14,6 +7,13 @@ import cn.dev33.satoken.router.SaRouter;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaResult;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.AnnotatedElementUtils;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import javax.annotation.PostConstruct;
 
 
 /**
@@ -114,11 +114,11 @@ public class SaTokenConfigure implements WebMvcConfigurer {
     /**
      * 重写 Sa-Token 框架内部算法策略 
      */
-    @Autowired
+    @PostConstruct
     public void rewriteSaStrategy() {
     	// 重写Sa-Token的注解处理器，增加注解合并功能 
     	SaStrategy.instance.getAnnotation = (element, annotationClass) -> {
-    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass); 
+    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass);
     	};
     }
     
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
index ddaf4d25..c5372b74 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
@@ -7,6 +7,7 @@ import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.SaTokenInfo;
 import cn.dev33.satoken.stp.StpLogic;
+import org.springframework.stereotype.Component;
 
 import java.util.List;
 
@@ -16,6 +17,7 @@ import java.util.List;
  * @author click33
  * @since 1.0.0
  */
+@Component
 public class StpUserUtil {
 
 	private StpUserUtil() {}
-- 
Gitee


From b92ba4de87455fa6da7e526c8d7886d1ca1d6300 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 4 May 2024 11:02:22 +0800
Subject: [PATCH 017/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
 =?UTF-8?q?=E5=92=8Cdemo=E7=A4=BA=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/satoken/SaTokenConfigure.java |  7 ++---
 sa-token-doc/more/common-questions.md         | 28 +++++++++++++++++++
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-webflux/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-webflux/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 287f9401..6fb386a0 100644
--- a/sa-token-demo/sa-token-demo-webflux/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-webflux/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -1,12 +1,10 @@
 package com.pj.satoken;
 
+import cn.dev33.satoken.reactor.filter.SaReactorFilter;
+import com.pj.util.AjaxJson;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-import com.pj.util.AjaxJson;
-
-import cn.dev33.satoken.reactor.filter.SaReactorFilter;
-
 /**
  * [Sa-Token 权限认证] 配置类 
  * @author click33
@@ -33,6 +31,7 @@ public class SaTokenConfigure {
         		// 指定[异常处理函数]：每次[认证函数]发生异常时执行此函数 
         		.setError(e -> {
         			System.out.println("---------- sa全局异常 ");
+					e.printStackTrace();
         			return AjaxJson.getError(e.getMessage());
         		})
         		;
diff --git a/sa-token-doc/more/common-questions.md b/sa-token-doc/more/common-questions.md
index 0b87c7f2..04f7c4cf 100644
--- a/sa-token-doc/more/common-questions.md
+++ b/sa-token-doc/more/common-questions.md
@@ -534,7 +534,35 @@ public class SaTokenContextByPatternsRequestCondition extends SaTokenContextForS
 ```
 
 
+### Q：Webflux 环境集成，或者 SpringCloud Gateway 环境集成后，过滤器里路由拦截鉴权报错：`java.lang.NoSuchFieldError: defaultInstance`
 
+``` java
+java.lang.NoSuchFieldError: defaultInstance
+	at cn.dev33.satoken.spring.pathmatch.SaPathPatternParserUtil.match(SaPathPatternParserUtil.java:40)
+	at cn.dev33.satoken.reactor.spring.SaTokenContextForSpringReactor.matchPath(SaTokenContextForSpringReactor.java:34)
+	at cn.dev33.satoken.router.SaRouter.isMatch(SaRouter.java:58)
+	at cn.dev33.satoken.router.SaRouter.isMatch(SaRouter.java:72)
+	... 
+```
+
+原因：SpringBoot 版本用的太低了，导致一些类不存在。
+
+- 方案一：升级项目的 SpringBoot 版本至 `2.3.x` 以上
+- 方案二：像上面的问题解决方案一样，重写一下相关类：
+
+``` java
+/**
+ * 自定义 SaTokenContext 实现类，重写 matchPath 方法，将 PathPatternParser.defaultInstance 改为 SaPathMatcherHolder.getPathMatcher()
+ */
+@Primary
+@Component
+public class SaTokenContextByPatternsRequestCondition extends SaTokenContextForSpringReactor {
+    @Override
+    public boolean matchPath(String pattern, String path) {
+        return SaPathMatcherHolder.getPathMatcher().match(pattern, path);
+    }
+}
+```
 
 
 
-- 
Gitee


From ce4d12b0ca1cc02e2b01b5c99d6ee317abfbec39 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 04:24:01 +0800
Subject: [PATCH 018/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=20Dromara=20?=
 =?UTF-8?q?=E7=A4=BE=E5=8C=BA=E9=A1=B9=E7=9B=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html       | 159 +++++++++++++++++-----------------
 sa-token-doc/static/index.css |   9 ++
 2 files changed, 89 insertions(+), 79 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index ae38c300..c96404be 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -13,10 +13,6 @@
 		<link rel="stylesheet" href="static/index.css">
 		<link rel="stylesheet" href="static/swiper/swiper-bundle.min.css">
 		<link rel="stylesheet" href="static/swiper/index-swiper.css">
-		<style>
-			.gb-cursor {display: inline-block;width: 2px;height: 22px;position: relative;top: 4px;left: -4px;background-color: black;animation: blink 0.7s infinite alternate;}
-			@keyframes blink { from {opacity: 0;} to {opacity: 1;} }
-		</style>
 	</head>
 	<body>
 		<!-- 总盒子 -->
@@ -35,11 +31,9 @@
 					</a>
 				</div>
 				<nav class="nav-right">
-					<div class="zk-box p-none">
+					<!-- <div class="zk-box p-none">
 						<a class="wzi" href="javascript:;">
-							<!-- <span>背景 </span> -->
 							<img class="theme-btn" src="static/icon/theme.svg">
-							<!-- <span class="zk-icon"></span> -->
 						</a>
 						<div class="zk-context theme-box">
 							<div>
@@ -56,14 +50,9 @@
 								<span style="background-color: #ebe5dd;"></span>
 								<span style="background-color: #e8f4ff;"></span>
 
-								<!-- <span style="background-color: #F0DAD2;"></span> -->
-								<!-- <span style="background-color: #f5d5d5;"></span> -->
-								<!-- <span style="background-color: #FFFFE0;"></span> -->
-								<!-- <span style="background-color: #eeeeee;"></span> -->
-								<!-- <span style="background-color: #f5fafe;"></span> -->
 							</div>
 						</div>
-					</div>
+					</div> -->
 					<a class="wzi" href="index.html">首页</a>
 					<a class="wzi" href="doc.html">文档</a>
 					<a class="p-none wzi" href="doc.html#/more/link">案例</a>
@@ -122,7 +111,7 @@
 						<a class="abtn" href="https://gitee.com/dromara/sa-token" target="_blank">Gitee</a>
 						<a class="abtn" href="https://github.com/dromara/sa-token" target="_blank">GitHub</a>
 						<a class="abtn" href="doc.html#/more/join-group" target="_self">加入讨论群</a>
-						<a class="abtn doc-btn" href="doc.html" target="_self">开发文档</a>
+						<a class="abtn doc-btn" href="doc.html" target="_self">现在出发 →</a>
 						<!-- <a href="https://gitee.com/dromara/sa-token" target="_blank">集成案例</a> -->
 					</div>
 					<h4 align="center" class="badge-box">
@@ -431,12 +420,12 @@
 						<a href="http://www.jmwl51.com/" target="_blank" title="济南极梦网络科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/jimeng.png">
 						</a>
-						<a href="https://uniadmin.jiangruyi.com/" target="_blank" title="南京星意信息科技有限公司">
-							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/uniadmin.png">
-						</a>
 						<a href="http://www.tuodan.tech/" target="_blank" title="深圳加速脱单科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/tuodan.jpeg">
 						</a>
+						<a href="https://uniadmin.jiangruyi.com/" target="_blank" title="南京星意信息科技有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/uniadmin.png">
+						</a>
 						<a href="https://www.yangxuwang.com/" target="_blank" title="上海阳旭网络科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/shouxin.png">
 						</a>
@@ -498,15 +487,15 @@
 						<a href="https://www.aegis-info.com/" target="_blank" title="北京擎盾信息科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/beijingqingdun.png">
 						</a>
+						<a href="https://mimirii.com/" target="_blank" title="西安米默网络科技有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/mimokeji.png">
+						</a>
 						<a href="https://www.geostar.com.cn/" target="_blank" title="吉奥时空">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/jieaoshikong.png">
 						</a>
 						<a href="http://www.stbella.cn/" target="_blank" title="贝康国际">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/beikangguoji.png">
 						</a>
-						<a href="https://mimirii.com/" target="_blank" title="西安米默网络科技有限公司">
-							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/mimokeji.png">
-						</a>
 						<a href="http://www.chually.cn/" target="_blank" title="湖北楚商联盟金融信息服务有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/chushangjinfu.png">
 						</a>
@@ -519,18 +508,18 @@
 						<a href="https://hxp.liuxin.online/" target="_blank" title="沪小漂">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/hero.png">
 						</a>
-						<a href="https://www.mall4j.com/" target="_blank" title="广州市蓝海创新科技有限公司">
-							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/guangzhoulanhai.png">
-						</a>
 						<a href="https://www.brath.cn" target="_blank" title="荔知AI助手">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/lizhi-ai.png">
 						</a>
-						<a href="http://www.njhrchina.top/" target="_blank" title="南京桓瑞软件科技有限公司">
-							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/nanjing-hengrui.png">
-						</a>
 						<a href="https://www.ninthpalace.com/" target="_blank" title="苏州九宫数字科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/jiugongshuzi.png">
 						</a>
+						<a href="https://www.mall4j.com/" target="_blank" title="广州市蓝海创新科技有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/guangzhoulanhai.png">
+						</a>
+						<a href="http://www.njhrchina.top/" target="_blank" title="南京桓瑞软件科技有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/nanjing-hengrui.png">
+						</a>
 						<a href="https://sohelp.net/" target="_blank" title="宁波互邦软件有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/ningbohubang.png">
 						</a>
@@ -558,7 +547,7 @@
 					<h2 class="s-title">
 						Dromara 成员项目
 					</h2>
-					<div class="com-box com-box-you">
+					<div class="com-box com-box-you table-show-pj">
 						<a href="https://gitee.com/dromara/TLog" target="_blank">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/tlog.png"
 								msg="一个轻量级的分布式日志标记追踪神器，10分钟即可接入，自动对日志打标签完成微服务的链路追踪">
@@ -780,6 +769,18 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/mybatis-jpa-extra.png"
 								msg="扩展MyBatis JPA支持，简化CUID操作，增强SELECT分页查询">
 						</a>
+						<a href="https://newcar.js.org/zh/" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/newcar.png"
+								msg="现代化的动画引擎">
+						</a>
+						<a href="http://warm-flow.cn" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/warm-flow.png"
+								msg="国产自研工作流，其特点简洁(只有6张表)但又不简单，五脏俱全，组件独立，可扩展，可满足中小项目的组件。">
+						</a>
+						<a href="https://gitee.com/dromara/dy-java" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dy-java.png"
+								msg="DyJava是一款功能强大的抖音Java开发工具包">
+						</a>
 						<a href="https://dromara.org/zh/projects/" target="_blank">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dromara.png"
 								msg="让每一位开源爱好者，体会到开源的快乐。">
@@ -789,11 +790,11 @@
 					<p>
 						为往圣继绝学，一个人或许能走的更快，但一群人会走的更远。
 					</p>
-					<div style=" margin: 40px 14px 0; padding: 20px 0 10px; background-color: #f4f5f7;">
+					<!-- <div style=" margin: 40px 14px 0; padding: 20px 0 10px; background-color: #f4f5f7;">
 						<h3 style="padding: 0px 0 10px; ">Dromara 知识星球</h3>
 						<img class="lazy" data-original="https://oss.dev33.cn/sa-token/dromara-xingqiu--sa-token.jpg"
 							style="width: 300px;">
-					</div>
+					</div> -->
 				</div>
 				<div style="height: 30px;"></div>
 			</div>
@@ -1016,62 +1017,62 @@
 
 		<!-- 修改背景颜色 -->
 		<script>
-			// 绑定修改背景色的按钮事件
-			$('.theme-box span').click(function() {
-				let bgColor = this.style.backgroundColor;
-				setBg(bgColor);
-				localStorage.setItem('bg-color-value', bgColor)
-			})
-			// 读取上次记录
-			let bgColor = localStorage.getItem('bg-color-value');
-			if (bgColor) {
-				setBg(bgColor);
-			}
+			// // 绑定修改背景色的按钮事件
+			// $('.theme-box span').click(function() {
+			// 	let bgColor = this.style.backgroundColor;
+			// 	setBg(bgColor);
+			// 	localStorage.setItem('bg-color-value', bgColor)
+			// })
+			// // 读取上次记录
+			// let bgColor = localStorage.getItem('bg-color-value');
+			// if (bgColor) {
+			// 	setBg(bgColor);
+			// }
 
-			// 设置背景颜色 
-			function setBg(bgColor) {
-				console.log('---- 背景颜色设定为：', bgColor);
+			// // 设置背景颜色 
+			// function setBg(bgColor) {
+			// 	console.log('---- 背景颜色设定为：', bgColor);
 
-				// -------- 设置 body 背景
-				document.body.style.backgroundColor = bgColor;
+			// 	// -------- 设置 body 背景
+			// 	document.body.style.backgroundColor = bgColor;
 
-				// -------- 设置 header 头背景
-				// 如果是 16 进制，转 rgba
-				if (bgColor.indexOf('#') == 0) {
-					bgColor = hexToRgba(bgColor, 0.97);
-				}
-				// 如果是 rgb，转 rgba
-				else if (bgColor.match(/\,/g).length == 2) {
-					bgColor = bgColor.replace(')', ' ,0.97)');
-				}
+			// 	// -------- 设置 header 头背景
+			// 	// 如果是 16 进制，转 rgba
+			// 	if (bgColor.indexOf('#') == 0) {
+			// 		bgColor = hexToRgba(bgColor, 0.97);
+			// 	}
+			// 	// 如果是 rgb，转 rgba
+			// 	else if (bgColor.match(/\,/g).length == 2) {
+			// 		bgColor = bgColor.replace(')', ' ,0.97)');
+			// 	}
 
-				document.querySelector('.doc-header').style.backgroundColor = bgColor;
-			}
+			// 	document.querySelector('.doc-header').style.backgroundColor = bgColor;
+			// }
 
-			// 16进制 转 rgba
-			function hexToRgba(str, a) {
-				a = a || 1;
+			// // 16进制 转 rgba
+			// function hexToRgba(str, a) {
+			// 	a = a || 1;
 
-				var reg = /^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/
-				if (!reg.test(str)) {
-					return;
-				}
-				let newStr = (str.toLowerCase()).replace(/\#/g, '')
-				let len = newStr.length;
-				if (len == 3) {
-					let t = ''
-					for (var i = 0; i < len; i++) {
-						t += newStr.slice(i, i + 1).concat(newStr.slice(i, i + 1))
-					}
-					newStr = t
-				}
-				let arr = []; //将字符串分隔，两个两个的分隔
-				for (var i = 0; i < 6; i = i + 2) {
-					let s = newStr.slice(i, i + 2)
-					arr.push(parseInt("0x" + s))
-				}
-				return 'rgb(' + arr.join(",") + ', ' + a + ')';
-			}
+			// 	var reg = /^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/
+			// 	if (!reg.test(str)) {
+			// 		return;
+			// 	}
+			// 	let newStr = (str.toLowerCase()).replace(/\#/g, '')
+			// 	let len = newStr.length;
+			// 	if (len == 3) {
+			// 		let t = ''
+			// 		for (var i = 0; i < len; i++) {
+			// 			t += newStr.slice(i, i + 1).concat(newStr.slice(i, i + 1))
+			// 		}
+			// 		newStr = t
+			// 	}
+			// 	let arr = []; //将字符串分隔，两个两个的分隔
+			// 	for (var i = 0; i < 6; i = i + 2) {
+			// 		let s = newStr.slice(i, i + 2)
+			// 		arr.push(parseInt("0x" + s))
+			// 	}
+			// 	return 'rgb(' + arr.join(",") + ', ' + a + ')';
+			// }
 		</script>
 
 		<!-- 图片懒加载 -->
diff --git a/sa-token-doc/static/index.css b/sa-token-doc/static/index.css
index 20c0c712..b860c3cc 100644
--- a/sa-token-doc/static/index.css
+++ b/sa-token-doc/static/index.css
@@ -50,6 +50,9 @@ body{font-size: 16px; color: #34495E; font-family: "Source Sans Pro","Helvetica
 /* .content-box p{line-height: 30px; padding: 0px 1em;} */
 /* 角标位置修复 */
 .badge-box a:nth-child(-n+2) img{position: relative; top: 1px;}
+/* 模拟副标题的光标闪烁 */
+.gb-cursor {display: inline-block;width: 2px;height: 22px;position: relative;top: 4px;left: -4px;background-color: black;animation: blink 0.7s infinite alternate;}
+@keyframes blink { from {opacity: 0;} to {opacity: 1;} }
 
 /* .main-box{background-image: url(https://oss.dev33.cn/sa-token/home-bg.jpg);} */
 .main-box{background-image: url(https://oss.dev33.cn/sa-token/home-bg3.png); background-size: 120% 100%;}
@@ -172,6 +175,12 @@ body{font-size: 16px; color: #34495E; font-family: "Source Sans Pro","Helvetica
 .com-box-you a{flex: 0 0 14.5%; line-height: 60px; height: 60px; margin: 10px;}
 .com-box-you a img{min-width: 60%; max-width: 85%; vertical-align: middle; max-height: 100%;}
 
+/* -------- Dromara 成员项目 --------- */
+.table-show-pj{border: 1px #ddd solid; border-width: 1px 0 0 1px ;}
+.table-show-pj a{flex: 0 0 16.5%; border: 1px #ddd solid; margin: 0; padding: 7px 0; overflow: hidden;}
+.table-show-pj a{border-width: 0 1px 1px 0px;}
+.table-show-pj a img{min-width: 60%; max-width: 70%; }
+
 /* -------- 底部 - 连接 --------- */
 #footer{background-color: #181818;}
 #footer h3{font-weight: 400; font-size: 16px; color: #ccc; margin-top: 20px; margin-bottom: 20px;}
-- 
Gitee


From 9680d6cb9f713cdc67cf731f9d657d242aa9498f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 05:47:34 +0800
Subject: [PATCH 019/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=88=97=E8=A1=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html                   | 12 ++++++------
 sa-token-doc/static/donate/donate-list.js |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index c96404be..e0acb5ed 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -214,14 +214,14 @@
 									<img src="https://oss.dev33.cn/sa-token/awards/dromara.jpg?x-oss-process=style/st" /> <br>
 									<p>Dromara 组织顶尖项目（之一）</p>
 								</div>
-								<!-- <div class="swiper-slide" style="width: 750px;">
-									<img src="https://oss.dev33.cn/sa-token/awards/gitee-star-10k.png" /> <br>
-									<p>Gitee stars 超 10k+</p>
+								<div class="swiper-slide" style="width: 750px;">
+									<img src="https://oss.dev33.cn/sa-token/awards/gitee-top-1.png" /> <br>
+									<p>Gitee 项目推荐榜 top 1</p>
 								</div>
 								<div class="swiper-slide" style="width: 750px;">
-									<img src="https://oss.dev33.cn/sa-token/awards/github-star-10k.png" /> <br>
-									<p>GitHub stars 超 10k+</p>
-								</div> -->
+									<img src="https://oss.dev33.cn/sa-token/awards/github-star-15k.png" /> <br>
+									<p>GitHub stars 超 15k+</p>
+								</div>
 							</div>
 							<div class="swiper-button-next"></div>
 							<div class="swiper-button-prev"></div>
diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 7944be70..84c1465f 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -930,7 +930,7 @@ var donateList = [
 		"name": "MetaLowCode",
 		"link": "https://gitee.com/meta_low_code_admin",
 		"money": 220.0,
-		"msg": "可能是最适合Java程序员的低代码平台 -- 美乐低代码 https://melecode.com/",
+		"msg": '<a href="https://melecode.com/" target="_blank">可能是最适合Java程序员的低代码平台 -- 美乐低代码 https://melecode.com/</a>',
 		"date": "2023-11-23"
 	},
 	{
@@ -951,7 +951,7 @@ var donateList = [
 		"name": "Justin Chia",
 		"link": "https://gitee.com/justin-chia",
 		"money": 218.0,
-		"msg": "可以二开的国产低代码表单 https://vform666.com/",
+		"msg": '<a href="https://vform666.com/" target="_blank">可以二开的国产低代码表单 https://vform666.com/</a>',
 		"date": "2023-12-05"
 	},
 	{
-- 
Gitee


From 1ba8d6f8d482744c3af8bca26514d8c7d986009d Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 06:44:28 +0800
Subject: [PATCH 020/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E9=97=AE=E5=8D=B7?=
 =?UTF-8?q?=E8=B0=83=E6=9F=A5=E5=BC=B9=E7=AA=97=E6=8F=90=E7=A4=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html                       |   4 +-
 sa-token-doc/index.html                     |   2 +-
 sa-token-doc/static/is-fill-in-wj-plugin.js | 114 ++++++++++++++++++++
 3 files changed, 118 insertions(+), 2 deletions(-)
 create mode 100644 sa-token-doc/static/is-fill-in-wj-plugin.js

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 92ac71ce..b0a61f7e 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -166,6 +166,7 @@
 		<!--  -->
 		<script src="./static/docsify-plugin.js?v=6"></script>
 		<script src="./static/is-star-plugin.js?v=6"></script>
+		<script src="./static/is-fill-in-wj-plugin.js?v=6"></script>
 		<script>
 			var saTokenTopVersion = '1.37.0';	// Sa-Token最新版本 
 			var name = '<img style="width: 60px; height: 60px; vertical-align: middle;" src="logo.png" alt="logo" /> ';
@@ -201,7 +202,7 @@
 					tabHeadings: true       // 用标题+粗体来定制选项卡
 				},
 				// 自定义插件 
-				plugins: [myDocsifyPlugin, window.isStarPlugin],
+				plugins: [myDocsifyPlugin, window.isStarPlugin, window.isFillInWjPlugin],
 			}
 		</script>
 		<script src="static/docsify.min.js"></script>
@@ -388,5 +389,6 @@
 				$('.zk-btn--1').show();
 			}
 		</script>
+		
 	</body>
 </html>
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index e0acb5ed..93789c4f 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -922,7 +922,7 @@
 				</style>
 				<div class="foot-box" id="foot">
 					<div class="s-width" style="text-align: center;">
-						Copyright ©2022 Sa-Token java权限认证 | sa-token.cc | <a href="https://beian.miit.gov.cn/"
+						Copyright ©2024 Sa-Token java权限认证 | sa-token.cc | <a href="https://beian.miit.gov.cn/"
 							target="_blank">鲁ICP备18046274号-4</a>
 					</div>
 				</div>
diff --git a/sa-token-doc/static/is-fill-in-wj-plugin.js b/sa-token-doc/static/is-fill-in-wj-plugin.js
new file mode 100644
index 00000000..d9def006
--- /dev/null
+++ b/sa-token-doc/static/is-fill-in-wj-plugin.js
@@ -0,0 +1,114 @@
+// 
+
+// 声明 docsify 插件
+var isFillInWjPlugin = function(hook, vm) {
+	
+	// 钩子函数：解析之前执行
+	hook.beforeEach(function(content) {
+		return content;
+	});
+	
+	// 钩子函数：每次路由切换时，解析内容之后执行 
+	hook.afterEach(function(html) {
+		return html;
+	});
+	
+	// 钩子函数：每次路由切换时数据全部加载完成后调用，没有参数。
+	hook.doneEach(function() {
+		isFillIn(vm);
+	});
+	
+	// 钩子函数：初始化并第一次加载完成数据后调用，没有参数。
+	hook.ready(function() {
+		
+	});
+	
+}
+
+
+// 检查成功后，多少天不再检查 
+const wjAllowDisparity = 1000 * 60 * 60 * 24 * 30 * 3;
+// const allowDisparity = 1000 * 10;
+
+
+// 判断当前是否已填写 
+function isFillIn(vm) {
+	// 非PC端不检查
+	if(document.body.offsetWidth < 800) {
+		console.log('small screen ... wj ');
+		return;
+	}
+	
+	// 白名单路由不判断
+	const whiteList = ['/', '/more/link', '/more/demand-commit', '/more/join-group', '/more/sa-token-donate', '/more/wenjuan', 
+			'/sso/sso-pro', '/more/update-log', '/more/common-questions', '/fun/sa-token-test', '/fun/issue-template'];
+	if(whiteList.indexOf(vm.route.path) >= 0) {
+		console.log('white route ... wj');
+		return;
+	}
+	
+	// 判断是否近期已经判断过了
+	try{
+		const isFillIn = localStorage.isFillIn;
+		if(isFillIn) {
+			// 记录 star 的时间，和当前时间的差距
+			const disparity = new Date().getTime() - parseInt(isFillIn);
+			
+			// 差距小于一月，不再检测，大于一月，再检测一下
+			if(disparity < wjAllowDisparity) {
+				console.log('checked ... wj ');
+				return;
+			}
+		}
+	}catch(e){
+		console.error(e);
+	}
+	
+	// 本次打开页面的内存内已经弹出了的话，也不再弹了 
+	if(window.isYtcXsjfkasjda) {
+		return;
+	}
+	window.isYtcXsjfkasjda = true;
+	
+	// 弹出弹框，邀请填写 
+	const tipStr = `
+		<div>
+			<h3>
+				嗨，同学你好！  
+			</h3>
+			<p>
+				我们想以运营一款产品的心态来运营一个开源框架，所以我们迫切希望您能够填写这份问卷，这有 6 道选择题，
+				应该只会略微占用您 1~3 分钟的时间。  
+			</p>
+			<p>问卷地址：<a href="https://wj.qq.com/s2/14587150/b5b4/" target="_blank">https://wj.qq.com/s2/14587150/b5b4/</a></p>
+			<p>Sa-Token 将会非常重视每一位粉丝的宝贵意见！😇😇😇</p>
+		</div>
+		`;
+	
+	const index = layer.confirm(tipStr, {
+			title: '问卷调查填写邀请', 
+			btn: ['我已填写 (1月内不再弹出)', '暂时不要 (1天内不再弹出)'], 
+			// btn: ['同意授权检测', '暂时不要，我先看看文档'], 
+			area: '480px', 
+			offset: '30%'
+		}, 
+		// 点击确定
+		function(index) {
+			layer.close(index);
+			localStorage.isFillIn = new Date().getTime();
+			
+			layer.msg('感谢你的支持，Sa-Token 将努力变得更加完善！  ❤️ ❤️ ❤️ ')
+		},
+		// 点击取消
+		function(){
+			// 一天内不再检查
+			const ygTime = allowDisparity - (1000 * 60 * 60 * 24);
+			localStorage.isFillIn = new Date().getTime() - ygTime;
+			
+			layer.alert('你可以随时在右上角 [ 相关资源 -> 问卷调查 ] 处找到问卷链接', function(index) {
+				layer.close(index);
+			})
+		}
+	);
+}
+
-- 
Gitee


From 42d94827c1e2e8ae30ae8047259fdbfb4fee67e6 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 12:27:49 +0800
Subject: [PATCH 021/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=20Http=20Digest=20?=
 =?UTF-8?q?=E8=AE=A4=E8=AF=81=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md      |  2 +-
 sa-token-doc/up/basic-auth.md | 51 +++++++++++++++++++++++++++++------
 2 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index f471adac..230e3f31 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -29,7 +29,7 @@
 	- [账号封禁](/up/disable) 
 	- [密码加密](/up/password-secure) 
 	- [会话查询](/up/search-session) 
-	- [Http Basic 认证](/up/basic-auth) 
+	- [Http Basic/Digest 认证](/up/basic-auth) 
 	- [全局侦听器](/up/global-listener) 
 	- [全局过滤器](/up/global-filter) 
 	- [多账号认证](/up/many-account) 
diff --git a/sa-token-doc/up/basic-auth.md b/sa-token-doc/up/basic-auth.md
index d9e4a178..f28121ce 100644
--- a/sa-token-doc/up/basic-auth.md
+++ b/sa-token-doc/up/basic-auth.md
@@ -14,7 +14,7 @@ Http Basic 是 http 协议中最基础的认证方式，其有两个特点：
 ``` java
 @RequestMapping("test3")
 public SaResult test3() {
-    SaBasicUtil.check("sa:123456");
+    SaHttpBasicUtil.check("sa:123456");
 	// ... 其它代码
 	return SaResult.ok();
 }
@@ -44,14 +44,14 @@ public class GlobalExceptionHandler {
 
 ### 2、其它启用方式 
 ``` java
-// 对当前会话进行 Basic 校验，账号密码为 yml 配置的值（例如：sa-token.basic=sa:123456）
-SaBasicUtil.check();
+// 对当前会话进行 Http Basic 校验，账号密码为 yml 配置的值（例如：sa-token.http-basic=sa:123456）
+SaHttpBasicUtil.check();
 
-// 对当前会话进行 Basic 校验，账号密码为：`sa / 123456`
-SaBasicUtil.check("sa:123456");
+// 对当前会话进行 Http Basic 校验，账号密码为：`sa / 123456`
+SaHttpBasicUtil.check("sa:123456");
 
-// 以注解方式启用 Basic 校验
-@SaCheckBasic(account = "sa:123456")
+// 以注解方式启用 Http Basic 校验
+@SaCheckHttpBasic(account = "sa:123456")
 @RequestMapping("test3")
 public SaResult test3() {
 	return SaResult.ok();
@@ -63,7 +63,7 @@ public SaServletFilter getSaServletFilter() {
 	return new SaServletFilter()
 			.addInclude("/**").addExclude("/favicon.ico")
 			.setAuth(obj -> {
-				SaRouter.match("/test/**", () -> SaBasicUtil.check("sa:123456"));
+				SaRouter.match("/test/**", () -> SaHttpBasicUtil.check("sa:123456"));
 			});
 }
 ```
@@ -75,6 +75,41 @@ http://sa:123456@127.0.0.1:8081/test/test3
 ```
 
 
+### 4、Http Digest 认证 
+
+Http Digest 认证是 Http Basic 认证的升级版，Http Digest 在提交请求时不会使用明文方式传输认证信息，而是使用一定的规则加密后提交。
+不过对于开发者来讲，开启 Http Digest 认证校验的流程与 Http Basic 认证基本是一致的。
+
+``` java
+// 测试 Http Digest 认证   浏览器访问： http://localhost:8081/test/testDigest
+@RequestMapping("testDigest")
+public SaResult testDigest() {
+	SaHttpDigestUtil.check("sa", "123456");
+	return SaResult.ok();
+}
+
+// 使用注解方式开启 Http Digest 认证
+@SaCheckHttpDigest("sa:123456")
+@RequestMapping("testDigest2")
+public SaResult testDigest() {
+	return SaResult.ok();
+}
+
+
+// 对当前会话进行 Http Digest 校验，账号密码为 yml 配置的值（例如：sa-token.http-digest=sa:123456）
+SaHttpDigestUtil.check();
+```
+
+与上面的 Http Basic 认证一致，在访问这个路由时，浏览器会强制弹出一个表单，客户端输入正确的账号密码后即可通过校验。
+
+同样的，Http Digest 也支持在浏览器访问接口时直接使用 @ 符号拼接账号密码信息，使客户端直接通过校验。
+
+``` url
+http://sa:123456@127.0.0.1:8081/test/testDigest
+```
+
+
+
 --- 
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/HttpBasicController.java"
-- 
Gitee


From c1bc858f14ce7640a81be45c058e0ab04e52bc90 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 12:30:14 +0800
Subject: [PATCH 022/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/plugin/dao-extend.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sa-token-doc/plugin/dao-extend.md b/sa-token-doc/plugin/dao-extend.md
index 8e3db5ea..04b0eca4 100644
--- a/sa-token-doc/plugin/dao-extend.md
+++ b/sa-token-doc/plugin/dao-extend.md
@@ -14,6 +14,7 @@
 - sa-token-redis-fastjson2：Redis集成包，使用 fastjson2 序列化方式。
 - sa-token-redisson-jackson：Redis集成包，Redisson客户端使用，jackson 序列化方式。
 - sa-token-redisson-jackson2：通用 redisson 集成方案 （spring, solon, jfinal 等都可用）。
+- sa-token-hutool-timed-cache：集成 hutool 框架的 Timed-Cache 缓存方案（基于内存）。
 
 有关 Redis 集成，详细参考：[集成Redis](/up/integ-redis)，更多存储方式欢迎提交PR 
 
-- 
Gitee


From 9e37896bb08b1cfd6b08136fad3f7dfd45cda6a5 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 12:39:54 +0800
Subject: [PATCH 023/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=E7=BC=BA=E5=A4=B1?=
 =?UTF-8?q?=E7=9A=84=20clean=20=E9=A1=B9=E7=9B=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mvn clean.bat | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mvn clean.bat b/mvn clean.bat
index baf093d2..d4044c83 100644
--- a/mvn clean.bat	
+++ b/mvn clean.bat	
@@ -26,6 +26,7 @@ cd sa-token-demo-websocket-spring & call mvn clean & cd ..
 cd sa-token-demo-bom-import & call mvn clean & cd ..
 
 cd sa-token-demo-hutool-timed-cache & call mvn clean & cd ..
+cd sa-token-demo-ssm & call mvn clean & cd ..
 
 
 
@@ -34,6 +35,7 @@ cd sa-token-demo-sso-server & call mvn clean & cd ..
 cd sa-token-demo-sso1-client & call mvn clean & cd ..
 cd sa-token-demo-sso2-client & call mvn clean & cd ..
 cd sa-token-demo-sso3-client & call mvn clean & cd ..
+cd sa-token-demo-sso3-client-test2 & call mvn clean & cd ..
 cd sa-token-demo-sso3-client-nosdk & call mvn clean & cd ..
 cd ..
 
-- 
Gitee


From 78fd26e9db3738009d2a62c7e1616ee17397bff2 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 12:40:05 +0800
Subject: [PATCH 024/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/api/stp-util.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sa-token-doc/api/stp-util.md b/sa-token-doc/api/stp-util.md
index 8395090f..d7ca8f94 100644
--- a/sa-token-doc/api/stp-util.md
+++ b/sa-token-doc/api/stp-util.md
@@ -38,6 +38,8 @@ StpUtil.login(10001, new SaLoginModel()
             .setToken("xxxx-xxxx-xxxx-xxxx") // 预定此次登录生成的Token 
 	        .setExtra("name", "zhangsan")    // Token挂载的扩展参数 （此方法只有在集成jwt插件时才会生效）
             .setIsWriteHeader(false)         // 是否在登录后将 Token 写入到响应头
+			.setActiveTimeout(300)           // 指定此次登录token的最低活跃频率, 单位:秒，设置此参数需要在配置文件打开dynamicActiveTimeout=true
+			.setTokenSignTag("xxx")          // 指定此次登录挂载在 TokenSign 上的 tag 值, 任意值
             );
 ```
 
@@ -139,6 +141,7 @@ StpUtil.getTokenValueByLoginId(10001, "PC");   // 获取指定账号id指定设
 StpUtil.getTokenValueListByLoginId(10001);   // 获取指定账号id的tokenValue集合 
 StpUtil.getTokenValueListByLoginId(10001, "APP");   // 获取指定账号id指定设备类型端的tokenValue 集合 
 StpUtil.getLoginDevice();   // 返回当前会话的登录设备类型
+StpUtil.getLoginDeviceByToken(xxx);   // // 返回任意 token 的登录设备类型
 ```
 
 
-- 
Gitee


From f4dda6eb6c17ed6e5f8767c06b962773cbeb982b Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 5 May 2024 12:45:04 +0800
Subject: [PATCH 025/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/start/download.md | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/sa-token-doc/start/download.md b/sa-token-doc/start/download.md
index 607676aa..68636eef 100644
--- a/sa-token-doc/start/download.md
+++ b/sa-token-doc/start/download.md
@@ -238,13 +238,6 @@ Maven依赖一直无法加载成功？[参考解决方案](https://sa-token.cc/d
 		├── sa-token-demo-oauth2                  // [示例] Sa-Token 集成 OAuth2.0
 			├── sa-token-demo-oauth2-server           // [示例] Sa-Token 集成 OAuth2.0 (服务端)
 			├── sa-token-demo-oauth2-client           // [示例] Sa-Token 集成 OAuth2.0 (客户端)
-		├── sa-token-demo-cross                   // [示例] Sa-Token 跨域示例 
-			├── sa-token-demo-cross-header-server     // [示例] Sa-Token 跨域测试 - Header 参数版，后端接口
-			├── sa-token-demo-cross-header-h5         // [示例] Sa-Token 跨域测试 - Header 参数版，h5 页面（jquery请求）
-			├── sa-token-demo-cross-header-vue3       // [示例] Sa-Token 跨域测试 - Header 参数版，vue3 页面
-			├── sa-token-demo-cross-cookie-server     // [示例] Sa-Token 跨域测试 - 第三方 Cookie 版，后端接口
-			├── sa-token-demo-cross-cookie-h5         // [示例] Sa-Token 跨域测试 - 第三方 Cookie 版，h5 页面（jquery请求）
-			├── sa-token-demo-cross-cookie-vue3       // [示例] Sa-Token 跨域测试 - 第三方 Cookie 版，vue3 页面
 		├── sa-token-demo-dubbo                   // [示例] Sa-Token 集成 dubbo
 			├── sa-token-demo-dubbo-consumer          // [示例] Sa-Token 集成 dubbo 鉴权，消费端（调用端）
 			├── sa-token-demo-dubbo-provider          // [示例] Sa-Token 集成 dubbo 鉴权，生产端（被调用端）
@@ -263,6 +256,12 @@ Maven依赖一直无法加载成功？[参考解决方案](https://sa-token.cc/d
 	├──pom.xml                                // [依赖] 顶级pom文件 
 ```
 
+其它：
+
+- [sa-token-demo-cross](https://gitee.com/sa-tokens/sa-token-demo-cross)：Sa-Token 处理跨域示例。
+- [sa-token-three-plugin](https://gitee.com/sa-tokens/sa-token-three-plugin)：Sa-Token 第三方插件合集。
+- [sa-token-study](https://gitee.com/sa-tokens/sa-token-study)：Sa-Token 涉及知识点学习。
+
 
 
 ## 运行示例
-- 
Gitee


From 83ac2036318ae9e0536fdf0863968a3d01def6ed Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 10:33:42 +0800
Subject: [PATCH 026/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/api/stp-util.md   |   1 +
 sa-token-doc/sso/sso-apidoc.md |   8 ++-
 sa-token-doc/static/index.css  |   4 +-
 sa-token-doc/use/config.md     | 108 ++++++++++++++++++++++++++-------
 4 files changed, 94 insertions(+), 27 deletions(-)

diff --git a/sa-token-doc/api/stp-util.md b/sa-token-doc/api/stp-util.md
index d7ca8f94..f9be25de 100644
--- a/sa-token-doc/api/stp-util.md
+++ b/sa-token-doc/api/stp-util.md
@@ -94,6 +94,7 @@ StpUtil.getSessionBySessionId("xxxx-xxxx-xxxx");   // 获取指定key的Session,
 ``` java
 // Token 最低活跃频率
 StpUtil.getTokenActiveTimeout();   // 获取当前 token 距离被冻结还剩多少时间 (单位: 秒)
+StpUtil.getTokenLastActiveTime();  // 获取当前 token 最后活跃时间
 StpUtil.checkActiveTimeout();   // 检查当前token 是否已经被冻结，如果是则抛出异常  
 StpUtil.updateLastActiveToNow();   // 续签当前token：(将 [最后操作时间] 更新为当前时间戳)   
 
diff --git a/sa-token-doc/sso/sso-apidoc.md b/sa-token-doc/sso/sso-apidoc.md
index 2d03713a..53d47ef4 100644
--- a/sa-token-doc/sso/sso-apidoc.md
+++ b/sa-token-doc/sso/sso-apidoc.md
@@ -22,7 +22,7 @@ http://{host}:{port}/sso/auth
 | :--------		| :--------	| :--------															|
 | redirect		| 是		| 登录成功后的重定向地址，一般填写 location.href（从哪来回哪去）							|
 | mode			| 否		| 授权模式，取值 [simple, ticket]，simple=登录后直接重定向，ticket=带着ticket参数重定向，默认值为ticket			|
-| client		| 否		| 客户端标识，可不填，代表是一个匿名应用，若填写了，则校验 ticket 时也必须时这个 client 才可以校验成功			|
+| client		| 否		| 客户端标识，可不填，代表是一个匿名应用，若填写了，则校验 ticket 时也必须是这个 client 才可以校验成功			|
 
 访问接口后有两种情况：
 - 情况一：当前会话在 SSO 认证中心未登录，会进入登录页开始登录。
@@ -60,6 +60,9 @@ http://{host}:{port}/sso/checkTicket
 | ticket		| 是		| 在步骤 1 中授权重定向时的 ticket 参数 						|
 | ssoLogoutCall	| 否		| 单点注销时的回调通知地址，只在SSO模式三单点注销时需要携带此参数|
 | client		| 否		| 客户端标识，可不填，代表是一个匿名应用，若填写了，则必须填写的和 `/sso/auth` 登录时填写的一致才可以校验成功			|
+| timestamp		| 是		| 当前时间戳，13位									|
+| nonce			| 是		| 随机字符串										|
+| sign			| 是		| 签名，生成算法：`md5( [client={client值}&]nonce={随机字符串}&[ssoLogoutCall={单点注销回调地址}&]ticket={ticket值}&timestamp={13位时间戳}&key={secretkey秘钥} )`	 注：[]内容代表可选 				|
 
 返回值场景：
 - 校验成功时：
@@ -68,7 +71,8 @@ http://{host}:{port}/sso/checkTicket
 {
     "code": 200,
     "msg": "ok",
-    "data": "10001"	// 此 ticket 指向的 loginId
+    "data": "10001",	// 此 ticket 指向的 loginId
+	"remainSessionTimeout": 7200, // 此账号在 sso-server 端的会话剩余有效期（单位：s）
 }
 ```
 
diff --git a/sa-token-doc/static/index.css b/sa-token-doc/static/index.css
index b860c3cc..08cfc6bc 100644
--- a/sa-token-doc/static/index.css
+++ b/sa-token-doc/static/index.css
@@ -176,8 +176,8 @@ body{font-size: 16px; color: #34495E; font-family: "Source Sans Pro","Helvetica
 .com-box-you a img{min-width: 60%; max-width: 85%; vertical-align: middle; max-height: 100%;}
 
 /* -------- Dromara 成员项目 --------- */
-.table-show-pj{border: 1px #ddd solid; border-width: 1px 0 0 1px ;}
-.table-show-pj a{flex: 0 0 16.5%; border: 1px #ddd solid; margin: 0; padding: 7px 0; overflow: hidden;}
+.table-show-pj{border: 1px #d5d5d5 solid; border-width: 1px 0 0 1px ;}
+.table-show-pj a{flex: 0 0 16.5%; border: 1px #d5d5d5 solid; margin: 0; padding: 7px 0; overflow: hidden;}
 .table-show-pj a{border-width: 0 1px 1px 0px;}
 .table-show-pj a img{min-width: 60%; max-width: 70%; }
 
diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index 6ea30755..d9dbc48c 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -4,7 +4,9 @@
 
 --- 
 
-### 方式1、在 application.yml 配置
+### 1、配置方式
+
+##### 方式1、在 application.yml 配置
 
 <!---------------------------- tabs:start ---------------------------->
 
@@ -52,7 +54,7 @@ sa-token.is-log=true
 
 
 
-### 方式2、通过代码配置
+##### 方式2、通过代码配置
 
 <!------------------------------ tabs:start ------------------------------>
 <!------------- tab:模式 1 ------------->
@@ -108,7 +110,7 @@ public class SaTokenConfigure {
 
 
 --- 
-### 所有可配置项
+### 2、核心包所有可配置项
 
 **你不必立刻掌握整个表格，只需要在用到某个功能时再详细查阅它即可**
 
@@ -141,7 +143,8 @@ public class SaTokenConfigure {
 | basic					| String	| ""		| Http Basic 认证的账号和密码 [参考：Http Basic 认证](/up/basic-auth)						|
 | currDomain			| String	| null		| 配置当前项目的网络访问地址													|
 | checkSameToken			| Boolean		| false		| 是否校验Same-Token（部分rpc插件有效）															|
-| cookie				| Object	| new SaCookieConfig()	| Cookie配置对象															|
+| cookie				| Object	| new SaCookieConfig()	| Cookie 配置对象															|
+| sign					| Object	| new SaSignConfig()	| API 签名配置对象															|
 
 Cookie相关配置：
 
@@ -179,35 +182,90 @@ sa-token.cookie.sameSite=Lax
 ```
 <!---------------------------- tabs:end ---------------------------->
 
+Sign 参数签名相关配置：
+
+| 参数名称				| 类型		| 默认值		| 说明																	|
+| :--------				| :--------	| :--------	| :--------																|
+| secretKey				| String	| null		| API 调用签名秘钥														|
+| timestampDisparity	| long		| 900000		| 接口调用时的时间戳允许的差距（单位：ms），-1 代表不校验差距，默认15分钟		|
+
+示例：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# Sa-Token 配置
+sa-token: 
+    # 参数签名配置 
+    sign: 
+		# API 接口调用签名秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# API 接口调用签名秘钥
+sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+
 
-### 单点登录相关配置 
+### 3、单点登录相关配置 
 
-Server 端配置：
+**SSO-Server 端配置：**
 
 | 参数名称		| 类型		| 默认值		| 说明																			|
 | :--------		| :--------	| :--------	| :--------																		|
+| mode			| String	| 			| 指定当前系统集成 SSO 时使用的模式（约定型配置项，不对代码逻辑产生任何影响）			|
 | ticketTimeout	| long		| 300		| ticket 有效期 （单位: 秒）														|
 | allowUrl		| String	| *			| 所有允许的授权回调地址，多个用逗号隔开（不在此列表中的URL将禁止下放ticket），参考：[SSO整合：配置域名校验](/sso/sso-check-domain)	|
+| homeRoute		| String	|  			| 主页路由：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由			|
 | isSlo			| Boolean	| false		| 是否打开单点注销功能															|
 | isHttp		| Boolean	| false		| 是否打开模式三（此值为 true 时将使用 http 请求：校验 ticket 值、单点注销、获取 userinfo），参考：[详解](/use/config?id=配置项详解：isHttp) 	|
-| secretkey		| String	| null		| 调用秘钥 （用于SSO模式三单点注销的接口通信身份校验）								|
+| autoRenewTimeout	| Bolean	| false	| 是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）			|
+| maxRegClient	| int		| 32		| 在 Access-Session 上记录 Client 信息的最高数量（-1=无限），超过此值将进行自动清退处理，先进先出			|
+| isCheckSign	| Boolean	| true		| 是否校验参数签名（方便本地调试用的一个配置项，生产环境请务必为true）		|
 
+配置示例：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# Sa-Token 配置
+sa-token:
+    # SSO 单点登录服务端配置 
+    sso-server:
+        # Ticket有效期 (单位: 秒)，默认五分钟 
+        ticket-timeout: 300
+        # 所有允许的授权回调地址
+        allow-url: "*"
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# Ticket有效期 (单位: 秒)，默认五分钟 
+sa-token.sso-server.ticket-timeout=300
+# 所有允许的授权回调地址
+sa-token.sso-server.allow-url="*"
+```
+<!---------------------------- tabs:end ---------------------------->
 
-Client 端配置：
+**SSO-Client 端配置：**
 
 | 参数名称		| 类型		| 默认值		| 说明											|
 | :--------		| :--------	| :--------	| :--------										|
+| mode			| String	| 					| 指定当前系统集成 SSO 时使用的模式（约定型配置项，不对代码逻辑产生任何影响）			|
+| client		| String	| ""				| 当前 Client 名称标识，用于和 ticket 码的互相锁定			|
+| serverUrl		| String	| null				| 配置 Server 端主机总地址，拼接在 `authUrl`、`checkTicketUrl`、`userinfoUrl`、`sloUrl` 属性前面，用以简化各种 url 配置，参考：[详解](/sso/sso-questions?id=问：模式三配置一堆-xxx-url-，有办法简化一下吗？)	|
 | authUrl		| String	| /sso/auth			| 配置 Server 端单点登录授权地址					|
-| isSlo			| Boolean	| false				| 是否打开单点注销功能							|
-| isHttp		| Boolean	| false				| 是否打开模式三（此值为 true 时将使用 http 请求：校验 ticket 值、单点注销、获取 userinfo），参考：[详解](/use/config?id=配置项详解：isHttp) 	|
 | checkTicketUrl| String	| /sso/checkTicket	| 配置 Server 端的 `ticket` 校验地址							|
-| userinfoUrl	| String	| /sso/userinfo		| 配置 Server 端查询 `userinfo` 地址									|
+| getDataUrl	| String	| /sso/getData		| 配置 Server 端的 拉取数据 地址									|
 | sloUrl		| String	| /sso/signout		| 配置 Server 端单点注销地址										|
-| ssoLogoutCall	| String	| null				| 配置当前 Client 端的单点注销回调URL （为空时自动获取）	|
-| secretkey		| String	| null				| 接口调用秘钥 （用于SSO模式三单点注销的接口通信身份校验）		|
-| serverUrl		| String	| null				| 配置 Server 端主机总地址，拼接在 `authUrl`、`checkTicketUrl`、`userinfoUrl`、`sloUrl` 属性前面，用以简化各种 url 配置，参考：[详解](/sso/sso-questions?id=问：模式三配置一堆-xxx-url-，有办法简化一下吗？)	|
-| client		| String	| ""				| 当前 Client 名称标识，用于和 ticket 码的互相锁定			|
-
+| currSsoLogin	| String	| null				| 配置当前 Client 端的登录地址（为空时自动获取）	|
+| currSsoLogoutCall	| String	| null			| 配置当前 Client 端的单点注销回调URL （为空时自动获取）	|
+| isSlo			| Boolean	| true				| 是否打开单点注销功能							|
+| isHttp		| Boolean	| false				| 是否打开模式三（此值为 true 时将使用 http 请求：校验 ticket 值、单点注销、拉取数据getData），参考：[详解](/use/config?id=配置项详解：isHttp) 	|
+| isCheckSign	| Boolean	| true		| 是否校验参数签名（方便本地调试用的一个配置项，生产环境请务必为true）		|
 
 配置示例：
 
@@ -217,21 +275,25 @@ Client 端配置：
 # Sa-Token 配置
 sa-token: 
     # SSO-相关配置
-    sso: 
-        # SSO-Server端 单点登录授权地址 
-        auth-url: http://sa-sso-server.com:9000/sso/auth
+    sso-client: 
+        # sso-server 端主机地址
+        server-url: http://sa-sso-server.com:9000
+        # 是否打开单点注销功能 
+        is-slo: true
 ```
 <!------------- tab:properties 风格  ------------->
 ``` properties
-# SSO-Server端 单点登录授权地址 
-sa-token.sso.auth-url=http://sa-sso-server.com:9000/sso/auth
+# sso-server 端主机地址
+sa-token.sso-client.server-url=http://sa-sso-server.com:9000
+# 是否打开单点注销功能 
+sa-token.sso-client.is-slo=true
 ```
 <!---------------------------- tabs:end ---------------------------->
 
 
 
 
-### OAuth2.0相关配置 
+### 4、OAuth2.0相关配置 
 | 参数名称				| 类型		| 默认值	| 说明																		|
 | :--------				| :--------	| :--------	| :--------																	|
 | isCode				| Boolean	| true		| 是否打开模式：授权码（`Authorization Code`）								|
@@ -292,7 +354,7 @@ sa-token.oauth2.is-client=true
 
 
 
-### 部分配置项详解
+### 5、部分配置项详解
 
 对部分配置项做一下详解 
 
-- 
Gitee


From b926bad13d3e0275372a5dd86808ac854febba96 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 10:34:00 +0800
Subject: [PATCH 027/172] =?UTF-8?q?=E7=A7=BB=E9=99=A4=E8=BF=87=E6=9C=9F?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E9=A1=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/config/SaSsoClientConfig.java | 35 ++-----------------
 1 file changed, 3 insertions(+), 32 deletions(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
index 097adfb5..ccdf9c73 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
@@ -64,11 +64,6 @@ public class SaSsoClientConfig implements Serializable {
      */
     public String getDataUrl = "/sso/getData";
 
-    /**
-     * 单独配置 Server 端查询 userinfo 地址
-     */
-    public String userinfoUrl = "/sso/userinfo";
-
     /**
      * 单独配置 Server 端单点注销地址
      */
@@ -90,7 +85,7 @@ public class SaSsoClientConfig implements Serializable {
     public Boolean isSlo = true;
 
     /**
-     * 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、获取userinfo）
+     * 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、拉取数据getData）
      */
     public Boolean isHttp = false;
 
@@ -137,14 +132,14 @@ public class SaSsoClientConfig implements Serializable {
     }
 
     /**
-     * @return isHttp 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、获取userinfo）
+     * @return isHttp 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、拉取数据getData）
      */
     public Boolean getIsHttp() {
         return isHttp;
     }
 
     /**
-     * @param isHttp 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、获取userinfo）
+     * @param isHttp 是否打开模式三（此值为 true 时将使用 http 请求：校验ticket值、单点注销、拉取数据getData）
      * @return 对象自身
      */
     public SaSsoClientConfig setIsHttp(Boolean isHttp) {
@@ -215,22 +210,6 @@ public class SaSsoClientConfig implements Serializable {
         return this;
     }
 
-    /**
-     * @return 配置的 Server 端查询 userinfo 地址
-     */
-    public String getUserinfoUrl() {
-        return userinfoUrl;
-    }
-
-    /**
-     * @param userinfoUrl 配置 Server 端查询 userinfo 地址
-     * @return 对象自身
-     */
-    public SaSsoClientConfig setUserinfoUrl(String userinfoUrl) {
-        this.userinfoUrl = userinfoUrl;
-        return this;
-    }
-
     /**
      * @return 配置 Server 端单点注销地址
      */
@@ -323,7 +302,6 @@ public class SaSsoClientConfig implements Serializable {
                 + ", authUrl=" + authUrl
                 + ", checkTicketUrl=" + checkTicketUrl
                 + ", getDataUrl=" + getDataUrl
-                + ", userinfoUrl=" + userinfoUrl
                 + ", sloUrl=" + sloUrl
                 + ", currSsoLogin=" + currSsoLogin
                 + ", currSsoLogoutCall=" + currSsoLogoutCall
@@ -356,13 +334,6 @@ public class SaSsoClientConfig implements Serializable {
         return SaFoxUtil.spliceTwoUrl(getServerUrl(), getGetDataUrl());
     }
 
-    /**
-     * @return 获取拼接url：Server 端查询 userinfo 地址
-     */
-    public String splicingUserinfoUrl() {
-        return SaFoxUtil.spliceTwoUrl(getServerUrl(), getUserinfoUrl());
-    }
-
     /**
      * @return 获取拼接url：Server 端单点注销地址
      */
-- 
Gitee


From cc9fe4c08bd0ca56f0e593ff208ac52581365dd0 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 10:57:57 +0800
Subject: [PATCH 028/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=E9=81=97=E6=BC=8F?=
 =?UTF-8?q?=E9=A1=B9=E7=9B=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mvn clean.bat | 48 +++++++++++++++++++-----------------------------
 1 file changed, 19 insertions(+), 29 deletions(-)

diff --git a/mvn clean.bat b/mvn clean.bat
index d4044c83..3f051542 100644
--- a/mvn clean.bat	
+++ b/mvn clean.bat	
@@ -2,33 +2,48 @@
 :: 整体clean
 call mvn clean
 
+
 :: demo模块clean
 cd sa-token-demo
 
 cd sa-token-demo-alone-redis & call mvn clean & cd ..
 cd sa-token-demo-alone-redis-cluster & call mvn clean & cd ..
+cd sa-token-demo-beetl & call mvn clean & cd ..
+cd sa-token-demo-bom-import & call mvn clean & cd ..
 cd sa-token-demo-case & call mvn clean & cd ..
 cd sa-token-demo-grpc & call mvn clean & cd ..
+cd sa-token-demo-hutool-timed-cache & call mvn clean & cd ..
 cd sa-token-demo-jwt & call mvn clean & cd ..
 cd sa-token-demo-quick-login & call mvn clean & cd ..
 cd sa-token-demo-solon & call mvn clean & cd ..
+cd sa-token-demo-solon-redisson & call mvn clean & cd ..
 cd sa-token-demo-springboot & call mvn clean & cd ..
 cd sa-token-demo-springboot3-redis & call mvn clean & cd ..
 cd sa-token-demo-springboot-redis & call mvn clean & cd ..
 cd sa-token-demo-springboot-redisson & call mvn clean & cd ..
+cd sa-token-demo-ssm & call mvn clean & cd ..
 cd sa-token-demo-test & call mvn clean & cd ..
 cd sa-token-demo-thymeleaf & call mvn clean & cd ..
-cd sa-token-demo-beetl & call mvn clean & cd ..
 cd sa-token-demo-webflux & call mvn clean & cd ..
 cd sa-token-demo-webflux-springboot3 & call mvn clean & cd ..
 cd sa-token-demo-websocket & call mvn clean & cd ..
 cd sa-token-demo-websocket-spring & call mvn clean & cd ..
-cd sa-token-demo-bom-import & call mvn clean & cd ..
 
-cd sa-token-demo-hutool-timed-cache & call mvn clean & cd ..
-cd sa-token-demo-ssm & call mvn clean & cd ..
+cd sa-token-demo-dubbo
+cd sa-token-demo-dubbo-consumer & call mvn clean & cd ..
+cd sa-token-demo-dubbo-provider & call mvn clean & cd ..
+cd sa-token-demo-dubbo3-consumer & call mvn clean & cd ..
+cd sa-token-demo-dubbo3-provider & call mvn clean & cd ..
+cd ..
 
+cd sa-token-demo-oauth2
+cd sa-token-demo-oauth2-client & call mvn clean & cd ..
+cd sa-token-demo-oauth2-server & call mvn clean & cd ..
+cd ..
 
+cd sa-token-demo-remember-me
+cd sa-token-demo-remember-me-server & call mvn clean & cd ..
+cd ..
 
 cd sa-token-demo-sso
 cd sa-token-demo-sso-server & call mvn clean & cd ..
@@ -46,31 +61,6 @@ cd sa-token-demo-sso3-client-solon & call mvn clean & cd ..
 cd sa-token-demo-sso-server-solon & call mvn clean & cd ..
 cd ..
 
-cd sa-token-demo-oauth2
-cd sa-token-demo-oauth2-client & call mvn clean & cd ..
-cd sa-token-demo-oauth2-server & call mvn clean & cd ..
-cd ..
-
-:: cd sa-token-demo-cross
-:: cd sa-token-demo-cross-header-server & call mvn clean & cd ..
-:: cd sa-token-demo-cross-cookie-server & call mvn clean & cd ..
-:: cd ..
-
-cd sa-token-demo-dubbo
-cd sa-token-demo-dubbo-consumer & call mvn clean & cd ..
-cd sa-token-demo-dubbo-provider & call mvn clean & cd ..
-cd sa-token-demo-dubbo3-consumer & call mvn clean & cd ..
-cd sa-token-demo-dubbo3-provider & call mvn clean & cd ..
-cd ..
-
-cd sa-token-demo-remember-me
-cd sa-token-demo-remember-me-server & call mvn clean & cd ..
-cd ..
-
-
-
-
-
 
 
 cd ..
-- 
Gitee


From ce40fe2dad33abce834d6a659b51e609697c9638 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 12:01:07 +0800
Subject: [PATCH 029/172] v1.38.0 update

---
 README.md                                     |  2 +-
 pom.xml                                       |  2 +-
 sa-token-bom/pom.xml                          |  2 +-
 .../cn/dev33/satoken/util/SaTokenConsts.java  |  2 +-
 .../sa-token-demo-alone-redis-cluster/pom.xml |  2 +-
 .../sa-token-demo-alone-redis/pom.xml         |  2 +-
 sa-token-demo/sa-token-demo-beetl/pom.xml     |  2 +-
 .../sa-token-demo-bom-import/pom.xml          |  4 +-
 sa-token-demo/sa-token-demo-case/pom.xml      |  2 +-
 .../sa-token-demo-dubbo-consumer/pom.xml      |  2 +-
 .../sa-token-demo-dubbo-provider/pom.xml      |  2 +-
 .../sa-token-demo-dubbo3-consumer/pom.xml     |  2 +-
 .../sa-token-demo-dubbo3-provider/pom.xml     |  2 +-
 sa-token-demo/sa-token-demo-grpc/pom.xml      |  2 +-
 .../sa-token-demo-hutool-timed-cache/pom.xml  |  2 +-
 sa-token-demo/sa-token-demo-jwt/pom.xml       |  2 +-
 .../sa-token-demo-oauth2-client/pom.xml       |  2 +-
 .../sa-token-demo-oauth2-server/pom.xml       |  2 +-
 .../sa-token-demo-quick-login/pom.xml         |  2 +-
 .../sa-token-demo-remember-me-server/pom.xml  |  2 +-
 .../sa-token-demo-solon-redisson/pom.xml      |  2 +-
 sa-token-demo/sa-token-demo-solon/pom.xml     |  2 +-
 .../sa-token-demo-springboot-redis/pom.xml    |  2 +-
 .../sa-token-demo-springboot-redisson/pom.xml |  2 +-
 .../sa-token-demo-springboot/pom.xml          |  2 +-
 .../sa-token-demo-springboot3-redis/pom.xml   |  2 +-
 sa-token-demo/sa-token-demo-ssm/pom.xml       |  2 +-
 .../sa-token-demo-sso-server-solon/pom.xml    |  2 +-
 .../sa-token-demo-sso1-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso2-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso3-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso-server/pom.xml          |  2 +-
 .../sa-token-demo-sso1-client/pom.xml         |  2 +-
 .../sa-token-demo-sso2-client/pom.xml         |  2 +-
 .../sa-token-demo-sso3-client-test2/pom.xml   |  2 +-
 .../sa-token-demo-sso3-client/pom.xml         |  2 +-
 sa-token-demo/sa-token-demo-test/pom.xml      |  2 +-
 sa-token-demo/sa-token-demo-thymeleaf/pom.xml |  2 +-
 .../sa-token-demo-webflux-springboot3/pom.xml |  2 +-
 sa-token-demo/sa-token-demo-webflux/pom.xml   |  2 +-
 .../sa-token-demo-websocket-spring/pom.xml    |  2 +-
 sa-token-demo/sa-token-demo-websocket/pom.xml |  2 +-
 sa-token-dependencies/pom.xml                 |  2 +-
 sa-token-doc/README.md                        |  2 +-
 sa-token-doc/doc.html                         | 10 ++--
 sa-token-doc/index.html                       |  2 +-
 sa-token-doc/more/update-log.md               | 46 +++++++++++++++++++
 sa-token-doc/start/new-version.md             |  4 +-
 sa-token-doc/up/disable.md                    |  2 +-
 sa-token-doc/up/global-filter.md              |  2 +-
 sa-token-doc/up/global-listener.md            |  2 +-
 sa-token-doc/up/many-account.md               |  2 +-
 sa-token-doc/up/mock-person.md                |  2 +-
 sa-token-doc/up/mutex-login.md                |  2 +-
 sa-token-doc/up/not-cookie.md                 |  2 +-
 sa-token-doc/up/password-secure.md            |  2 +-
 sa-token-doc/up/remember-me.md                |  2 +-
 sa-token-doc/up/safe-auth.md                  |  2 +-
 sa-token-doc/up/search-session.md             |  2 +-
 sa-token-doc/use/at-check.md                  |  2 +-
 sa-token-doc/use/jur-auth.md                  |  2 +-
 sa-token-doc/use/kick.md                      |  2 +-
 sa-token-doc/use/login-auth.md                |  2 +-
 sa-token-doc/use/route-check.md               |  2 +-
 sa-token-doc/use/session.md                   |  2 +-
 65 files changed, 117 insertions(+), 69 deletions(-)

diff --git a/README.md b/README.md
index f67bf874..55e7a24f 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 <p align="center">
 	<img alt="logo" src="https://sa-token.cc/logo.png" width="150" height="150">
 </p>
-<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.37.0</h1>
+<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.38.0</h1>
 <h4 align="center">一个轻量级 Java 权限认证框架，让鉴权变得简单、优雅！</h4>
 <p align="center">
 	<a href="https://gitee.com/dromara/sa-token/stargazers"><img src="https://gitee.com/dromara/sa-token/badge/star.svg?theme=gvp"></a>
diff --git a/pom.xml b/pom.xml
index 4e3a16df..9dce4b56 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,7 +37,7 @@
 	
 	<!-- 一些属性 -->
 	<properties>
-        <revision>1.37.0</revision>
+        <revision>1.38.0</revision>
         <jdk.version>1.8</jdk.version>
 		<project.build.sourceEncoding>utf-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>utf-8</project.reporting.outputEncoding>
diff --git a/sa-token-bom/pom.xml b/sa-token-bom/pom.xml
index 3eb7454d..872a1252 100644
--- a/sa-token-bom/pom.xml
+++ b/sa-token-bom/pom.xml
@@ -13,7 +13,7 @@
     <url>https://github.com/dromara/sa-token</url>
 
     <properties>
-        <revision>1.37.0</revision>
+        <revision>1.38.0</revision>
     </properties>
 
     <dependencyManagement>
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
index 05be26a0..baebafe7 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
@@ -36,7 +36,7 @@ public class SaTokenConsts {
 	/**
 	 * Sa-Token 当前版本号 
 	 */
-	public static final String VERSION_NO = "v1.37.0";
+	public static final String VERSION_NO = "v1.38.0";
 
 	/**
 	 * Sa-Token 开源地址 Gitee 
diff --git a/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml b/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
index 0981fe02..240b63a3 100644
--- a/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
+++ b/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-alone-redis/pom.xml b/sa-token-demo/sa-token-demo-alone-redis/pom.xml
index 21b48f89..8d24f792 100644
--- a/sa-token-demo/sa-token-demo-alone-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-alone-redis/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-beetl/pom.xml b/sa-token-demo/sa-token-demo-beetl/pom.xml
index e5d3de42..a51ea399 100644
--- a/sa-token-demo/sa-token-demo-beetl/pom.xml
+++ b/sa-token-demo/sa-token-demo-beetl/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-bom-import/pom.xml b/sa-token-demo/sa-token-demo-bom-import/pom.xml
index c2dc16f4..0e0ee7f4 100644
--- a/sa-token-demo/sa-token-demo-bom-import/pom.xml
+++ b/sa-token-demo/sa-token-demo-bom-import/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
@@ -73,7 +73,7 @@
 			<dependency>
 				<groupId>cn.dev33</groupId>
 				<artifactId>sa-token-bom</artifactId>
-				<version>1.37.0</version>
+				<version>1.38.0</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
diff --git a/sa-token-demo/sa-token-demo-case/pom.xml b/sa-token-demo/sa-token-demo-case/pom.xml
index fb56e1f7..c8972fea 100644
--- a/sa-token-demo/sa-token-demo-case/pom.xml
+++ b/sa-token-demo/sa-token-demo-case/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
index fcfdc51d..6f3fd5f4 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<dubbo.version>2.7.21</dubbo.version>
 		<nacos.version>1.4.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
index 2b4ff53a..aeb6f90d 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<dubbo.version>2.7.21</dubbo.version>
 		<nacos.version>1.4.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
index 9f55d960..9a7a1af2 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<dubbo.version>3.2.2</dubbo.version>
 		<nacos.version>2.2.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
index dee3179f..c420e235 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<dubbo.version>3.2.2</dubbo.version>
 		<nacos.version>2.2.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-grpc/pom.xml b/sa-token-demo/sa-token-demo-grpc/pom.xml
index 5ef2e36c..df0cc5ca 100644
--- a/sa-token-demo/sa-token-demo-grpc/pom.xml
+++ b/sa-token-demo/sa-token-demo-grpc/pom.xml
@@ -27,7 +27,7 @@
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <lombok.version>1.18.10</lombok.version>
-        <sa-token.version>1.37.0</sa-token.version>
+        <sa-token.version>1.38.0</sa-token.version>
     </properties>
 
     <dependencies>
diff --git a/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml b/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
index 10250bae..18897f60 100644
--- a/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
+++ b/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-jwt/pom.xml b/sa-token-demo/sa-token-demo-jwt/pom.xml
index bbe04ad1..2359117a 100644
--- a/sa-token-demo/sa-token-demo-jwt/pom.xml
+++ b/sa-token-demo/sa-token-demo-jwt/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
index d4d0e7f6..57ef7f5d 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
@@ -17,7 +17,7 @@
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
 		<!-- 定义 Sa-Token 版本号 -->
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 	
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
index c4016193..0363705c 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
@@ -17,7 +17,7 @@
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
 		<!-- 定义 Sa-Token 版本号 -->
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 	
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-quick-login/pom.xml b/sa-token-demo/sa-token-demo-quick-login/pom.xml
index 8baf9914..51bb3868 100644
--- a/sa-token-demo/sa-token-demo-quick-login/pom.xml
+++ b/sa-token-demo/sa-token-demo-quick-login/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml b/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
index 91a781cc..ccc15d35 100644
--- a/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
@@ -17,7 +17,7 @@
     </parent>
 
     <properties>
-        <sa-token.version>1.37.0</sa-token.version>
+        <sa-token.version>1.38.0</sa-token.version>
     </properties>
 
     <dependencies>
diff --git a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
index 5a9fdf68..c08a7b8d 100644
--- a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
@@ -16,7 +16,7 @@
 
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-solon/pom.xml b/sa-token-demo/sa-token-demo-solon/pom.xml
index 4d41d909..01b44aa5 100644
--- a/sa-token-demo/sa-token-demo-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon/pom.xml
@@ -16,7 +16,7 @@
 
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-springboot-redis/pom.xml b/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
index 8fab3f09..f60c4ed8 100644
--- a/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml b/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
index 6dbb9a1d..b3a373cd 100644
--- a/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot/pom.xml b/sa-token-demo/sa-token-demo-springboot/pom.xml
index d76bfed3..a6f41c64 100644
--- a/sa-token-demo/sa-token-demo-springboot/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml b/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
index e745f7dd..8cd82921 100644
--- a/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-ssm/pom.xml b/sa-token-demo/sa-token-demo-ssm/pom.xml
index fea3458d..0e35d6e1 100644
--- a/sa-token-demo/sa-token-demo-ssm/pom.xml
+++ b/sa-token-demo/sa-token-demo-ssm/pom.xml
@@ -27,7 +27,7 @@
 		<!--<spring.version>4.2.5.RELEASE</spring.version>-->
 		<spring.version>5.3.7</spring.version>
 		<jackson.version>2.16.1</jackson.version>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
index dd081fd9..a5df50ba 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<solon.version>2.2.3</solon.version>
 	</properties>
 
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
index 4f663aa4..b98ecd47 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
index 91bfb5b0..8ae7b7d4 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
index d07642aa..2750f9cd 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
index 5a462047..dc7c6767 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
index 38d8109a..50ef2657 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
index e2599ed8..cd026558 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
index cd61b769..3c32f669 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
index 8abbcc9c..d45bff0b 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-test/pom.xml b/sa-token-demo/sa-token-demo-test/pom.xml
index de93da1f..df740e04 100644
--- a/sa-token-demo/sa-token-demo-test/pom.xml
+++ b/sa-token-demo/sa-token-demo-test/pom.xml
@@ -18,7 +18,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 		<java.run.main.class>com.pj.SaTokenApplication</java.run.main.class>
 	</properties>
 
diff --git a/sa-token-demo/sa-token-demo-thymeleaf/pom.xml b/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
index dae8f76f..4175c35c 100644
--- a/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
+++ b/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml b/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
index 44bf8932..609b90c7 100644
--- a/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
+++ b/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-webflux/pom.xml b/sa-token-demo/sa-token-demo-webflux/pom.xml
index 2ed92f33..058edaa9 100644
--- a/sa-token-demo/sa-token-demo-webflux/pom.xml
+++ b/sa-token-demo/sa-token-demo-webflux/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-websocket-spring/pom.xml b/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
index a0c31faa..44134e1c 100644
--- a/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
+++ b/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-websocket/pom.xml b/sa-token-demo/sa-token-demo-websocket/pom.xml
index 4b90b853..a15d39b8 100644
--- a/sa-token-demo/sa-token-demo-websocket/pom.xml
+++ b/sa-token-demo/sa-token-demo-websocket/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.37.0</sa-token.version>
+		<sa-token.version>1.38.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-dependencies/pom.xml b/sa-token-dependencies/pom.xml
index 5fcdd718..5be7f46f 100644
--- a/sa-token-dependencies/pom.xml
+++ b/sa-token-dependencies/pom.xml
@@ -12,7 +12,7 @@
     <description>Sa-Token Dependencies</description>
 
     <properties>
-        <revision>1.37.0</revision>
+        <revision>1.38.0</revision>
 		
 		<!-- 统一定义依赖版本号 -->
 		<springboot.version>2.5.15</springboot.version>
diff --git a/sa-token-doc/README.md b/sa-token-doc/README.md
index d5c29289..62a4c9b8 100644
--- a/sa-token-doc/README.md
+++ b/sa-token-doc/README.md
@@ -1,7 +1,7 @@
 <p align="center">
 	<img alt="logo" src="https://sa-token.cc/logo.png" width="150" height="150">
 </p>
-<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.37.0</h1>
+<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.38.0</h1>
 <h5 align="center">一个轻量级 Java 权限认证框架，让鉴权变得简单、优雅！</h5>
 <p align="center" class="badge-box">
 	<a href="https://gitee.com/dromara/sa-token/stargazers"><img src="https://gitee.com/dromara/sa-token/badge/star.svg?theme=gvp"></a>
diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index b0a61f7e..d6a3717f 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -18,7 +18,7 @@
 					<div class="logo-box">
 						<img src="logo.png" title="logo" />
 						<h1 class="logo-text">Sa-Token</h1>
-						<sub>v1.37.0</sub>
+						<sub>v1.38.0</sub>
 					</div>
 				</a>
 			</div>
@@ -28,6 +28,7 @@
 				</div>
 				<select class="select-version p-none" onchange="location.href=this.value">
 					<option value="doc.html">最新版</option>
+					<option value="v/v1.37.0/doc.html">v1.37.0</option>
 					<option value="v/v1.36.0/doc.html">v1.36.0</option>
 					<option value="v/v1.35.0/doc.html">v1.35.0</option>
 					<option value="v/v1.34.0/doc.html">v1.34.0</option>
@@ -168,7 +169,7 @@
 		<script src="./static/is-star-plugin.js?v=6"></script>
 		<script src="./static/is-fill-in-wj-plugin.js?v=6"></script>
 		<script>
-			var saTokenTopVersion = '1.37.0';	// Sa-Token最新版本 
+			var saTokenTopVersion = '1.38.0';	// Sa-Token最新版本 
 			var name = '<img style="width: 60px; height: 60px; vertical-align: middle;" src="logo.png" alt="logo" /> ';
 			name += '<b style="font-size: 28px; vertical-align: middle;">Sa-Token</b> <sub>v' + saTokenTopVersion + '</sub>';
 			window.$docsify = {
@@ -292,11 +293,12 @@
 						<p>1、如果你是使用 PC 端微信，请点此链接：<a href="https://work.weixin.qq.com/kfid/kfcdd45c432fee9655f" target="_blank">https://work.weixin.qq.com/kfid/kfcdd45c432fee9655f</a></p>
 						<p>2、如果你是使用手机端微信，请扫码：</p>
 						<p><img src="https://oss.dev33.cn/sa-token/sa-token-xiaozhushou.jpg" width="200px"></p>
+						<p>如果您的问题已解决，我们希望您能够花费一点时间将解决方案发布在：<a href="https://gitee.com/dromara/sa-token/issues/I9I9CY" target="_blank">踩坑记录征集</a>，帮助以后遇到同样问题的开发者快速排查，感激不尽！</p>
 					</div>
 				`;
 				layer.alert(str, {
 					title: '技术求助', 
-					area: '550px', 
+					area: '650px', 
 					offset: '10%',
 				})
 			})
@@ -304,7 +306,7 @@
 				// 给个小提示
 				const index = layer.tips('框架技术支持，点此求助', '.help-tips', {
 					tips: [1, '#000'] ,//还可配置颜色
-					time: 5000,
+					// time: 5000,
 				});
 				// 改为 fixed 定位，否则它会随着滚动条移动，样式就跑偏了
 				$('#layui-layer' + index).css('position', 'fixed');
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 93789c4f..589da8a9 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -102,7 +102,7 @@
 			<div class="main-box">
 				<div class="content-box">
 					<!-- <div class="fenge"></div> -->
-					<h1>Sa-Token<small>v1.37.0</small></h1>
+					<h1>Sa-Token<small>v1.38.0</small></h1>
 					<div class="sub-title">
 						<span class="sub-title-nr">一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！</span>
 						<div class="gb-cursor">&nbsp;</div>
diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index fa8b6fe7..231d1c32 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -1,5 +1,51 @@
 # 更新日志 
 
+### v1.38.0 @2023-10-18
+- sa-token-core：
+	- 修复：修复 StpUtil.getSessionByLoginId(xx) 参数为 null 时创建无效 SaSession 的 bug。
+	- 优化：在 SpringBoot 3.x 版本下错误的引入依赖时将得到启动失败的提示。 （感谢`Uncarbon`提交的pr）
+	- 优化：进一步优化权限校验算法，hasXxx API 只会返回true或false，不再抛出异常。
+	- 重构：InvalidContextException 更名为 SaTokenContextException。 **[已做向下兼容处理]**
+	- 重构：彻底删除 NotPermissionException 异常中的 getCode() 方法。 **[过期API清理]**
+	- 重构：重构 SaTokenException 类方法 throwBy->notTrue、throwByNull->notEmpty。**[已做向下兼容处理]**
+	- 重构：StpUtil.getSessionBySessionId 提供的 SessionId 为空时将直接抛出异常，而不是再返回null。**[不向下兼容]**
+	- 新增：新增 Http Digest 认证模块简单实现。	**[重要]**
+	- 重构：更换 HttpBasic 认证模块包名。	**[已做向下兼容处理]**
+	- 新增：新增 `StpUtil.getLoginDeviceByToken(xxx)` 方法，用于获取任意 token 的登录设备类型。
+	- 新增：新增 `StpUtil.getTokenLastActiveTime()` 方法，获取当前 token 最后活跃时间。
+	- 修复：修复“当登录时指定 timeout 小于全局 timeout 时，Account-Session 有效期为全局 timeout”的问题。
+	- 优化：首次获取 Token-Session 时，其有效期将保持和 token 有效期相同，而不是再是全局 timeout 值。
+	- 移除：移除 SaSignConfig 的 isCheckNonce 配置项。 **[不向下兼容]**
+	- 新增：SaSignTemplate#checkRequest 增加“可指定参与签名参数”的功能。
+	- 重构：将部分加密算法设置为过期。
+- sa-token-sso：
+	- 优化：SSO 模式三，API 调用签名校验时，限定参与签名的参数列表，更安全。
+	- 新增：新增 autoRenewTimeout 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
+	- 新增：SaSsoConfig 新增配置 isCheckSign（是否校验参数签名），方便本地开发时的调试。
+	- 新增：SaSsoConfig 新增配置 currSsoLogin，用于强制指定当前系统的 sso 登录地址。
+	- 重构：整体重构 sa-token-sso 模块，将 server 端和 client 端代码拆分。 **[重要]** **[不向下兼容]**
+	- 新增：SaSsoConfig 配置项 ssoLogoutCall 重命名为 currSsoLogoutCall。**[已做向下兼容处理]**
+	- 重构：模式三在校验 Ticket 时，也将强制校验签名才能调通请求。**[不向下兼容]**
+	- 新增：新增 maxRegClient 配置项，用于控制模式三下 client 注册数量。
+	- 新增：新增不同 SSO Client 配置不同 secret-key 的方案。 **[重要]**
+	- 重构：匿名 client 将不再能解析出所有应用的 ticket。**[不向下兼容]**
+	- 新增：新增 homeRoute 配置项：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由。
+	- 优化：优化登录有效期策略，SSO Client 端登录时将延续 SSO Server 端的会话剩余有效期。
+- 新增插件/示例：
+	- 新增：新增插件 sa-token-hutool-timed-cache，用于整合 Hutool 缓存插件 TimedCache。 **[重要]**
+	- 新增：新增 SSM 架构整合 Sa-Token 简单示例。 	**[重要]**
+	- 新增：新增 beetl 整合 Sa-Token 简单示例。 	**[重要]**
+- 文档：
+	- 部分章节将 `@Autowired` 更换为更合适的 `@PostConstruct`
+	- 新增过滤器执行顺序更改示例。
+- 其它：
+	- 优化：将跨域处理demo拆分为独立仓库。
+	- 优化：解决 springboot 集成 sa-token 后排除 jsckson 依赖无法成功启动的问题。
+	- 优化：解决 sa-token-jwt 模块重复设置 keyt 秘钥问题。（感谢`KonBAI`提交的pr）
+	- 优化：jwt模式 token 过期后，抛出的异常描述是 token 已过期，而不再是 token 无效。
+	- 修复：补齐 sa-token-spring-aop 模块中遗漏监听的注解。
+
+
 ### v1.37.0 @2023-10-18
 - 修复：修复路由拦截鉴权可被绕过的问题。 **[漏洞修复]**
 - 重构：未登录时调用鉴权 API 抛出未登录异常而不再是无权限异常。
diff --git a/sa-token-doc/start/new-version.md b/sa-token-doc/start/new-version.md
index 25cd495f..60424752 100644
--- a/sa-token-doc/start/new-version.md
+++ b/sa-token-doc/start/new-version.md
@@ -5,14 +5,14 @@
 --- 
 
 ### 正式版本 
-v1.37.0 正式版，可上生产：
+v1.38.0 正式版，可上生产：
 
 ``` xml
 <!-- Sa-Token 权限认证 -->
 <dependency>
     <groupId>cn.dev33</groupId>
     <artifactId>sa-token-spring-boot-starter</artifactId>
-    <version>1.37.0</version>
+    <version>1.38.0</version>
 </dependency>
 ```
 
diff --git a/sa-token-doc/up/disable.md b/sa-token-doc/up/disable.md
index 8a6aac1f..7ff979aa 100644
--- a/sa-token-doc/up/disable.md
+++ b/sa-token-doc/up/disable.md
@@ -235,5 +235,5 @@ public SaResult send() {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/DisableController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 账号禁用  —— [ com.pj.cases.up.DisableController.java ]
+	本章代码示例：Sa-Token 账号禁用  —— [ DisableController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/global-filter.md b/sa-token-doc/up/global-filter.md
index b25efc62..5be9948d 100644
--- a/sa-token-doc/up/global-filter.md
+++ b/sa-token-doc/up/global-filter.md
@@ -144,5 +144,5 @@ public class SaTokenConfigure {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java"
 	target="_blank">
-	本章代码示例：Sa-Token 全局过滤器 —— [ com.pj.satoken.SaTokenConfigure.java ]
+	本章代码示例：Sa-Token 全局过滤器 —— [ SaTokenConfigure.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/global-listener.md b/sa-token-doc/up/global-listener.md
index 4a1330dc..07790ea7 100644
--- a/sa-token-doc/up/global-listener.md
+++ b/sa-token-doc/up/global-listener.md
@@ -214,6 +214,6 @@ SaTokenEventCenter.registerListener(new SaTokenListenerForSimple() {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/MySaTokenListener.java"
 	target="_blank">
-	本章代码示例：Sa-Token 自定义侦听器  —— [ com.pj.satoken.MySaTokenListener.java ]
+	本章代码示例：Sa-Token 自定义侦听器  —— [ MySaTokenListener.java ]
 </a>
 
diff --git a/sa-token-doc/up/many-account.md b/sa-token-doc/up/many-account.md
index 5808affb..939675e2 100644
--- a/sa-token-doc/up/many-account.md
+++ b/sa-token-doc/up/many-account.md
@@ -232,5 +232,5 @@ public void addInterceptors(InterceptorRegistry registry) {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java"
 	target="_blank">
-	本章代码示例：Sa-Token 多账号体系认证 —— [ com.pj.satoken.StpUserUtil.java ]
+	本章代码示例：Sa-Token 多账号体系认证 —— [ StpUserUtil.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/mock-person.md b/sa-token-doc/up/mock-person.md
index 748cd384..b7660cf1 100644
--- a/sa-token-doc/up/mock-person.md
+++ b/sa-token-doc/up/mock-person.md
@@ -62,5 +62,5 @@ System.out.println("------- [身份临时切换]调用结束...");
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SwitchToController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 身份切换 —— [ com.pj.cases.up.SwitchToController.java ]
+	本章代码示例：Sa-Token 身份切换 —— [ SwitchToController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/mutex-login.md b/sa-token-doc/up/mutex-login.md
index 9905b315..14fb9c20 100644
--- a/sa-token-doc/up/mutex-login.md
+++ b/sa-token-doc/up/mutex-login.md
@@ -48,5 +48,5 @@ StpUtil.getTokenValueByLoginId(10001, "APP");
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/MutexLoginController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 同端互斥登录  —— [ com.pj.cases.up.MutexLoginController.java ]
+	本章代码示例：Sa-Token 同端互斥登录  —— [ MutexLoginController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/not-cookie.md b/sa-token-doc/up/not-cookie.md
index e657d550..b263a3c5 100644
--- a/sa-token-doc/up/not-cookie.md
+++ b/sa-token-doc/up/not-cookie.md
@@ -106,5 +106,5 @@ uni.request({
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/NotCookieController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 前后端分离样例 —— [ com.pj.cases.up.NotCookieController.java ]
+	本章代码示例：Sa-Token 前后端分离样例 —— [ NotCookieController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/password-secure.md b/sa-token-doc/up/password-secure.md
index df6a2ddf..9e22f04c 100644
--- a/sa-token-doc/up/password-secure.md
+++ b/sa-token-doc/up/password-secure.md
@@ -104,5 +104,5 @@ String stronger_salt = BCrypt.gensalt(12);
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SecureController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 密码加密 —— [ com.pj.cases.up.SecureController.java ]
+	本章代码示例：Sa-Token 密码加密 —— [ SecureController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/remember-me.md b/sa-token-doc/up/remember-me.md
index ff81bbd1..c177fc83 100644
--- a/sa-token-doc/up/remember-me.md
+++ b/sa-token-doc/up/remember-me.md
@@ -87,5 +87,5 @@ StpUtil.login(10001, new SaLoginModel()
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/RememberMeController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 记住我登录 —— [ com.pj.cases.up.RememberMeController.java ]
+	本章代码示例：Sa-Token 记住我登录 —— [ RememberMeController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/safe-auth.md b/sa-token-doc/up/safe-auth.md
index 782d0685..6d6d740b 100644
--- a/sa-token-doc/up/safe-auth.md
+++ b/sa-token-doc/up/safe-auth.md
@@ -140,5 +140,5 @@ public String add2() {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SafeAuthController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 二级认证 —— [ com.pj.cases.up.SafeAuthController.java ]
+	本章代码示例：Sa-Token 二级认证 —— [ SafeAuthController.java ]
 </a>
\ No newline at end of file
diff --git a/sa-token-doc/up/search-session.md b/sa-token-doc/up/search-session.md
index 0e5b4d68..9032eed2 100644
--- a/sa-token-doc/up/search-session.md
+++ b/sa-token-doc/up/search-session.md
@@ -90,7 +90,7 @@ for (String sessionId : sessionIdList) {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SearchSessionController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 会话查询  —— [ com.pj.cases.up.SearchSessionController.java ]
+	本章代码示例：Sa-Token 会话查询  —— [ SearchSessionController.java ]
 </a>
 
 
diff --git a/sa-token-doc/use/at-check.md b/sa-token-doc/use/at-check.md
index ac2d33d1..2f0e6ef4 100644
--- a/sa-token-doc/use/at-check.md
+++ b/sa-token-doc/use/at-check.md
@@ -215,7 +215,7 @@ public SaResult test() {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/use/AtCheckController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 注解鉴权 —— [ com.pj.cases.use.AtCheckController.java ]
+	本章代码示例：Sa-Token 注解鉴权 —— [ AtCheckController.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/ARJvIbA/" target="_blank">本章小练习：Sa-Token 基础 - 注解鉴权，章节测试</a>
 
diff --git a/sa-token-doc/use/jur-auth.md b/sa-token-doc/use/jur-auth.md
index 4989c6b2..e1639eec 100644
--- a/sa-token-doc/use/jur-auth.md
+++ b/sa-token-doc/use/jur-auth.md
@@ -196,6 +196,6 @@ StpUtil.hasPermission("index.html");      // false
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/use/JurAuthController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 权限认证 —— [ com.pj.cases.use.JurAuthController.java ]
+	本章代码示例：Sa-Token 权限认证 —— [ JurAuthController.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/ZfIjYr9/" target="_blank">本章小练习：Sa-Token 基础 - 权限认证，章节测试</a>
diff --git a/sa-token-doc/use/kick.md b/sa-token-doc/use/kick.md
index b4c19629..bc7c88dc 100644
--- a/sa-token-doc/use/kick.md
+++ b/sa-token-doc/use/kick.md
@@ -34,7 +34,7 @@ StpUtil.kickoutByTokenValue("token");      // 将指定 Token 踢下线
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/use/KickoutController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 踢人下线 —— [ com.pj.cases.use.KickoutController.java ]
+	本章代码示例：Sa-Token 踢人下线 —— [ KickoutController.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/MFNN7bK/" target="_blank">本章小练习：Sa-Token 基础 - 踢人下线，章节测试</a>
 
diff --git a/sa-token-doc/use/login-auth.md b/sa-token-doc/use/login-auth.md
index 18be865f..36efa67f 100644
--- a/sa-token-doc/use/login-auth.md
+++ b/sa-token-doc/use/login-auth.md
@@ -174,7 +174,7 @@ public class LoginController {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/use/LoginAuthController.java"
 	target="_blank">
-	本章代码示例：Sa-Token 登录认证 —— [ com.pj.cases.use.LoginAuthController.java ]
+	本章代码示例：Sa-Token 登录认证 —— [ LoginAuthController.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/UZBZJvb2ej/" target="_blank">本章小练习：Sa-Token 基础 - 登录认证，章节测试</a>
 
diff --git a/sa-token-doc/use/route-check.md b/sa-token-doc/use/route-check.md
index 13b15458..d986c1b6 100644
--- a/sa-token-doc/use/route-check.md
+++ b/sa-token-doc/use/route-check.md
@@ -237,7 +237,7 @@ public void addInterceptors(InterceptorRegistry registry) {
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java"
 	target="_blank">
-	本章代码示例：Sa-Token 路由拦截鉴权 —— [ com.pj.satoken.SaTokenConfigure.java ]
+	本章代码示例：Sa-Token 路由拦截鉴权 —— [ SaTokenConfigure.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/rY7VFv/" target="_blank">本章小练习：Sa-Token 基础 - 路由拦截鉴权，章节测试</a>
 
diff --git a/sa-token-doc/use/session.md b/sa-token-doc/use/session.md
index c86e69ce..ca5af13c 100644
--- a/sa-token-doc/use/session.md
+++ b/sa-token-doc/use/session.md
@@ -175,7 +175,7 @@ StpUtil.getAnonTokenSession();
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/use/SaSessionController.java"
 	target="_blank">
-	本章代码示例：Sa-Token Session 会话 —— [ com.pj.cases.use.SaSessionController.java ]
+	本章代码示例：Sa-Token Session 会话 —— [ SaSessionController.java ]
 </a>
 <a class="dt-btn" href="https://www.wenjuan.ltd/s/MNnUr2V/" target="_blank">本章小练习：Sa-Token 基础 - Session 会话，章节测试</a>
 
-- 
Gitee


From 60fdc4ca2a63048057b8e15b2eca4b295cc4fbc6 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 13:37:04 +0800
Subject: [PATCH 030/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=E7=BC=BA=E5=A4=B1?=
 =?UTF-8?q?=E6=96=B9=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../main/java/com/pj/satoken/StpUserUtil.java | 43 ++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
index c5372b74..d2fab5fd 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
@@ -4,6 +4,7 @@ import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.fun.SaFunction;
 import cn.dev33.satoken.listener.SaTokenEventCenter;
 import cn.dev33.satoken.session.SaSession;
+import cn.dev33.satoken.session.TokenSign;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.SaTokenInfo;
 import cn.dev33.satoken.stp.StpLogic;
@@ -12,7 +13,7 @@ import org.springframework.stereotype.Component;
 import java.util.List;
 
 /**
- * Sa-Token 权限认证工具类 (User 版)
+ * Sa-Token 权限认证工具类（User版）
  *
  * @author click33
  * @since 1.0.0
@@ -304,6 +305,15 @@ public class StpUserUtil {
 		return stpLogic.isLogin();
 	}
 
+	/**
+	 * 判断指定账号是否已经登录
+	 *
+	 * @return 已登录返回 true，未登录返回 false
+	 */
+	public static boolean isLogin(Object loginId) {
+		return stpLogic.isLogin(loginId);
+	}
+
 	/**
 	 * 检验当前会话是否已经登录，如未登录，则抛出异常
 	 */
@@ -804,6 +814,17 @@ public class StpUserUtil {
 		return stpLogic.getTokenValueListByLoginId(loginId, device);
 	}
 
+	/**
+	 * 获取指定账号 id 指定设备类型端的 tokenSign 集合
+	 *
+	 * @param loginId 账号id
+	 * @param device 设备类型，填 null 代表不限设备类型
+	 * @return 此 loginId 的所有登录 tokenSign
+	 */
+	public static List<TokenSign> getTokenSignListByLoginId(Object loginId, String device) {
+		return stpLogic.getTokenSignListByLoginId(loginId, device);
+	}
+
 	/**
 	 * 返回当前会话的登录设备类型
 	 *
@@ -813,6 +834,26 @@ public class StpUserUtil {
 		return stpLogic.getLoginDevice();
 	}
 
+	/**
+	 * 返回指定 token 会话的登录设备类型
+	 *
+	 * @param tokenValue 指定token
+	 * @return 当前令牌的登录设备类型
+	 */
+	public static String getLoginDeviceByToken(String tokenValue) {
+		return stpLogic.getLoginDeviceByToken(tokenValue);
+	}
+
+	/**
+	 * 获取当前 token 的最后活跃时间（13位时间戳），如果不存在则返回 -2
+	 *
+	 * @return /
+	 */
+	public static long getTokenLastActiveTime() {
+		return stpLogic.getTokenLastActiveTime();
+	}
+
+
 
 	// ------------------- 会话管理 -------------------
 
-- 
Gitee


From 73843741af048393ea54aa08d2648b9a92594c2a Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 13:37:23 +0800
Subject: [PATCH 031/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=E5=A4=9A=E8=B4=A6?=
 =?UTF-8?q?=E5=8F=B7=E4=BD=93=E7=B3=BB=E9=89=B4=E6=9D=83=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/up/many-account.md | 86 ++++++++++++++++++++++++++++-----
 1 file changed, 73 insertions(+), 13 deletions(-)

diff --git a/sa-token-doc/up/many-account.md b/sa-token-doc/up/many-account.md
index 939675e2..6879e15f 100644
--- a/sa-token-doc/up/many-account.md
+++ b/sa-token-doc/up/many-account.md
@@ -50,12 +50,72 @@ public class StpUserUtil {
 
 }
 ```
-4. 接下来就可以像调用`StpUtil.java`一样调用 `StpUserUtil.java`了，这两套账号认证的逻辑是完全隔离的。
 
-> 成品样例参考：[码云 StpUserUtil.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java)
+成品样例参考：[码云 StpUserUtil.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java)
 
+4、接下来就可以像调用`StpUtil.java`一样调用 `StpUserUtil.java`了，这两套账号认证的逻辑是完全隔离的。例如：
 
-### 5、在多账户模式下使用注解鉴权
+``` java
+// 凡是在 StpUtil 上有的方法，都可以在 StpUserUtil 上调用 
+StpUserUtil.login(10001);    // 在当前会话以10001账号进行登录 
+StpUserUtil.checkLogin();    // 校验当前账号是否以 User 身份进行登录 
+StpUserUtil.getSession();    // 获取当前 User 账号的 Access-Session 对象 
+StpUserUtil.checkPermission('xx');    // 校验当前登录的 user 账号是否具有 xx 权限 
+// ...
+```
+
+
+### 5、Kit模式 
+如果你觉得 “复制代码” 的方式繁琐不够优雅，这里还有另一种方案：建立一个 `StpKit.java` 门面类，声明所有的 `StpLogic` 引用：
+``` java
+/**
+ * StpLogic 门面类，管理项目中所有的 StpLogic 账号体系
+ */
+public class StpKit {
+
+    /**
+     * 默认原生会话对象
+     */
+    public static final StpLogic DEFAULT = StpUtil.stpLogic;
+
+    /**
+     * Admin 会话对象，管理 Admin 表所有账号的登录、权限认证
+     */
+    public static final StpLogic ADMIN = new StpLogic("admin");
+
+    /**
+     * User 会话对象，管理 User 表所有账号的登录、权限认证
+     */
+    public static final StpLogic USER = new StpLogic("user");
+
+    /**
+     * XX 会话对象，（项目中有多少套账号表，就声明几个 StpLogic 会话对象）
+     */
+    public static final StpLogic XXX = new StpLogic("xx");
+
+}
+```
+
+在需要登录、权限认证的地方：
+``` java
+// 在当前会话进行 Admin 账号登录
+StpKit.ADMIN.login(10001);
+
+// 在当前会话进行 User 账号登录
+StpKit.USER.login(10001);
+
+// 检测当前会话是否以 Admin 账号登录，并具有 article:add 权限
+StpKit.ADMIN.checkPermission("article:add");
+
+// 检测当前会话是否以 User 账号登录，并通过了二级认证
+StpKit.USER.checkSafe();
+
+// 获取当前 User 会话的 Session 对象，并进行写值操作 
+StpKit.USER.getSession().set("name", "zhang");
+```
+
+
+### 6、在多账户模式下使用注解鉴权
 框架默认的注解鉴权 如`@SaCheckLogin` 只针对原生`StpUtil`进行鉴权。
 
 例如，我们在一个方法上加上`@SaCheckLogin`注解，这个注解只会放行通过`StpUtil.login(id)`进行登录的会话，
@@ -74,9 +134,8 @@ public String info() {
 
 注：`@SaCheckRole("xxx")`、`@SaCheckPermission("xxx")`同理，亦可根据type属性指定其校验的账号体系，此属性默认为`""`，代表使用原生`StpUtil`账号体系。
 
-> 使用注解必须[添加注解拦截器](/use/at-check)
 
-### 6、使用注解合并简化代码
+### 7、使用注解合并简化代码
 交流群里有同学反应，虽然可以根据 `@SaCheckLogin(type = "user")` 指定账号类型，但几十上百个注解都加上这个的话，还是有些繁琐，代码也不够优雅，有么有更简单的解决方案？
 
 我们期待一种`[注解继承/合并]`的能力，即：自定义一个注解，标注上`@SaCheckLogin(type = "user")`，
@@ -130,14 +189,14 @@ public String info() {
 
 
 
-
-### 7、同端多登陆 
+### 8、同端多登陆 
 假设我们不仅需要在后台同时集成两套账号，我们还需要在一个客户端同时登陆两套账号（业务场景举例：一个APP中可以同时登陆商家账号和用户账号）。
 
-如果我们不做任何特殊处理的话，在客户端会发生`token覆盖`，新登录的token会覆盖掉旧登录的token从而导致旧登录失效。
+如果我们不做任何特殊处理的话，在客户端会发生`token覆盖`，新登录的 token 会覆盖掉旧登录的 token 从而导致旧登录失效。
+
+具体表现大致为：在一个浏览器登录商家账号后，再登录用户账号，然后商家账号的登录态就会自动失效。
 
-那么如何解决这个问题？<br>
-很简单，我们只要更改一下 `StpUserUtil` 的 `TokenName` 即可，参考示例如下：
+那么如何解决这个问题？很简单，我们只要更改一下 `StpUserUtil` 的 `TokenName` 即可，参考示例如下：
 
 ``` java
 public class StpUserUtil {
@@ -157,10 +216,10 @@ public class StpUserUtil {
 }
 ```
 
-再次调用 `StpUserUtil.login(10001)` 进行登录授权时，token的名称将不再是 `satoken`，而是我们重写后的 `satoken-user`。
+再次调用 `StpUserUtil.login(10001)` 进行登录授权时，token的名称将不再是 `satoken`，而是我们重写后的 `satoken-user`，这样就不会再客户端发生 token 的相互覆盖了。
 
 
-### 8、不同体系不同 SaTokenConfig 配置
+### 9、不同体系不同 SaTokenConfig 配置
 如果自定义的 StpUserUtil 需要使用不同 SaTokenConfig 对象, 也很简单，参考示例如下：
 
 ``` java
@@ -190,7 +249,8 @@ public class SaTokenConfigure {
 
 ```
 
-### 9、多账号体系混合鉴权
+
+### 10、多账号体系混合鉴权
 QQ群中经常有小伙伴提问：在多账号体系下，怎么在 SaInterceptor 拦截器中给一个接口登录鉴权？
 
 其实这个问题，主要是靠你的业务需求来决定，以后台 Admin 账号和前台 User 账号为例：
-- 
Gitee


From 1bbf127b95b891e6a436a40272ede8cdc6d35c43 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 6 May 2024 16:02:32 +0800
Subject: [PATCH 032/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html                | 31 ++++++++++++++++++++++++++++
 sa-token-doc/more/sa-token-donate.md |  2 ++
 sa-token-doc/static/doc.css          |  2 ++
 3 files changed, 35 insertions(+)

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index d6a3717f..67355441 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -392,5 +392,36 @@
 			}
 		</script>
 		
+		<!-- 赞助效果图展示 -->
+		<script>
+			function showSyzz(){
+				layer.photos({
+					photos: {
+						title: '',
+						id: new Date().getTime(),
+						start: 0,
+						data: [
+							{
+								pid: 1,
+								alt: 'gitee 开源项目推广，日增 star 74',
+								src: 'https://oss.dev33.cn/sa-token/more/syzz-xg-1.png',
+							},
+							{
+								pid: 2,
+								alt: 'gitee 开源项目推广，日增 star 247',
+								src: 'https://oss.dev33.cn/sa-token/more/syzz-xg-2.png',
+							},
+							{
+								pid: 3,
+								alt: '某互联网公司线下活动，报名邀请',
+								src: 'https://oss.dev33.cn/sa-token/more/syzz-xg-3.png',
+							}
+						]
+					}
+					,anim: 5 //0-6的选择，指定弹出图片动画类型，默认随机（请注意，3.0之前的版本用shift参数）
+				});	
+			}
+		</script>
+		
 	</body>
 </html>
diff --git a/sa-token-doc/more/sa-token-donate.md b/sa-token-doc/more/sa-token-donate.md
index 0180bacd..5b63f43d 100644
--- a/sa-token-doc/more/sa-token-donate.md
+++ b/sa-token-doc/more/sa-token-donate.md
@@ -73,3 +73,5 @@ xxx 商品名称
 - 1、目前不接受 Sa-Token 官网文档插入广告推广，只接受一次性商业赞助推广。
 - 2、助力开源项目：如果您要推广的是一个开源项目，赞助金额可打五折，即：赞助 100 元即可。
 - 3、如果你的开源项目集成了 Sa-Token，可以免费得到推广机会一次。**请大胆联系我们，不要害羞！**
+
+<button class="syzz-show-btn" onclick="showSyzz()">部分推广效果截图(点击查看)</button>
\ No newline at end of file
diff --git a/sa-token-doc/static/doc.css b/sa-token-doc/static/doc.css
index b0be04ac..316f62ff 100644
--- a/sa-token-doc/static/doc.css
+++ b/sa-token-doc/static/doc.css
@@ -367,6 +367,8 @@ body {
 .zz-btn-box button{padding: 5px 10px; cursor: pointer; border: 1px #ccc solid; color: #999; background-color: #FFF;}
 .zz-btn-box button:hover{box-shadow: 0 0 10px #ddd;}
 
+.syzz-show-btn{border: 1px #ccc solid; padding: 5px 10px; background-color: #FFF; color: #666; cursor: pointer;}
+.syzz-show-btn:hover{box-shadow: 0 0 10px #ddd;}
 
 /* ajax加载时的转圈圈样式 */
 .ajax-layer-load.layui-layer-dialog{min-width: 0px !important; background-color: rgba(0,0,0,0.85);}
-- 
Gitee


From 278dd4269537cafc5e9894426c962b0045c00737 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 7 May 2024 15:53:47 +0800
Subject: [PATCH 033/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20readme?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 134 ++++++++++++++++++++++++++----------------------------
 1 file changed, 64 insertions(+), 70 deletions(-)

diff --git a/README.md b/README.md
index 55e7a24f..5aac4fee 100644
--- a/README.md
+++ b/README.md
@@ -12,20 +12,20 @@
 	<a href="https://github.com/dromara/sa-token/issues"><img src="https://img.shields.io/github/issues/dromara/sa-token.svg?style=flat-square&logo=GitHub"></a>
 	<a href="https://github.com/dromara/sa-token/blob/master/LICENSE"><img src="https://img.shields.io/github/license/dromara/sa-token.svg?style=flat-square"></a>
 </p>
+<!-- <p align="center">学习测试请拉取 master 分支，dev 是在开发分支 (在根目录执行 `git checkout master`)</p> -->
+<p align="center"><a href="https://sa-token.cc" target="_blank">在线文档：https://sa-token.cc</a></p>
 
----
 
-## 前言：
-- [在线文档：https://sa-token.cc](https://sa-token.cc)
+---
 
-- 注：学习测试请拉取 master 分支，dev 是开发分支，有很多特性并不稳定（在项目根目录执行 `git checkout master`）。
+### Sa-Token 介绍
 
--  开源不易，点个 star 鼓励一下吧！
+Sa-Token 是一个轻量级 Java 权限认证框架，目前拥有五大核心模块：登录认证、权限认证、单点登录、OAuth2.0、微服务鉴权。
 
 
-## Sa-Token 介绍
 
-**Sa-Token** 是一个轻量级 Java 权限认证框架，主要解决：登录认证、权限认证、单点登录、OAuth2.0、分布式Session会话、微服务网关鉴权 等一系列权限相关问题。
+<details>
+<summary><b>简单示例展示：（点击展开 / 折叠）</b></summary>
 
 Sa-Token 旨在以简单、优雅的方式完成系统的权限认证部分，以登录认证为例，你只需要：
 
@@ -79,62 +79,72 @@ registry.addInterceptor(new SaInterceptor(handler -> {
 
 当你受够 Shiro、SpringSecurity 等框架的三拜九叩之后，你就会明白，相对于这些传统老牌框架，Sa-Token 的 API 设计是多么的简单、优雅！
 
+</details>
+
+
+<details>
+<summary> <b>核心模块一览：（点击展开 / 折叠）</b> </summary>
+
+- **登录认证** —— 单端登录、多端登录、同端互斥登录、七天内免登录。
+- **权限认证** —— 权限认证、角色认证、会话二级认证。
+- **Session会话** —— 全端共享Session、单端独享Session、自定义Session。
+- **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线。
+- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁。 
+- **持久层扩展** —— 可集成Redis、Memcached等专业缓存中间件，重启数据不丢失。
+- **分布式会话** —— 提供jwt集成、共享数据中心两种分布式会话方案。
+- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证。
+- **单点登录** —— 内置三种单点登录模式：无论是否跨域、是否共享Redis，都可以搞定。
+- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 。
+- **二级认证** —— 在已登录的基础上再次认证，保证安全性。 
+- **Http Basic认证** —— 一行代码接入 Http Basic、Digest 认证。
+- **独立Redis** —— 将权限缓存与业务缓存分离。
+- **临时Token认证** —— 解决短时间的 Token 授权问题。
+- **模拟他人账号** —— 实时操作任意用户状态数据。
+- **临时身份切换** —— 将会话身份临时切换为其它账号。
+- **前后台分离** —— APP、小程序等不支持Cookie的终端。
+- **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录。
+- **多账号认证体系** —— 比如一个商城项目的user表和admin表分开鉴权。
+- **Token风格定制** —— 内置六种Token风格，还可：自定义Token生成策略、自定义Token前缀。
+- **注解式鉴权** —— 优雅的将鉴权与业务代码分离。
+- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配restful模式。
+- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签。
+- **会话治理** —— 提供方便灵活的会话查询接口。
+- **记住我模式** —— 适配[记住我]模式，重启浏览器免验证。
+- **密码加密** —— 提供密码加密模块，可快速MD5、SHA1、SHA256、AES、RSA加密。
+- **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作。
+- **开箱即用** —— 提供SpringMVC、WebFlux、Solon 等常见web框架集成包，方便开箱即用。
+
+</details>
 
 
-## Sa-Token 功能模块一览
-
-Sa-Token 目前主要五大功能模块：登录认证、权限认证、单点登录、OAuth2.0、微服务鉴权。
-
-- **登录认证** —— 单端登录、多端登录、同端互斥登录、七天内免登录
-- **权限认证** —— 权限认证、角色认证、会话二级认证
-- **Session会话** —— 全端共享Session、单端独享Session、自定义Session 
-- **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线
-- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁 
-- **持久层扩展** —— 可集成Redis、Memcached等专业缓存中间件，重启数据不丢失
-- **分布式会话** —— 提供jwt集成、共享数据中心两种分布式会话方案
-- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证
-- **单点登录** —— 内置三种单点登录模式：无论是否跨域、是否共享Redis，都可以搞定
-- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 
-- **二级认证** —— 在已登录的基础上再次认证，保证安全性 
-- **Basic认证** —— 一行代码接入 Http Basic 认证 
-- **独立Redis** —— 将权限缓存与业务缓存分离 
-- **临时Token认证** —— 解决短时间的Token授权问题
-- **模拟他人账号** —— 实时操作任意用户状态数据
-- **临时身份切换** —— 将会话身份临时切换为其它账号
-- **前后台分离** —— APP、小程序等不支持Cookie的终端
-- **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录
-- **多账号认证体系** —— 比如一个商城项目的user表和admin表分开鉴权
-- **Token风格定制** —— 内置六种Token风格，还可：自定义Token生成策略、自定义Token前缀
-- **注解式鉴权** —— 优雅的将鉴权与业务代码分离
-- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配restful模式
-- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签
-- **会话治理** —— 提供方便灵活的会话查询接口
-- **记住我模式** —— 适配[记住我]模式，重启浏览器免验证
-- **密码加密** —— 提供密码加密模块，可快速MD5、SHA1、SHA256、AES、RSA加密 
-- **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作
-- **开箱即用** —— 提供SpringMVC、WebFlux等常见web框架starter集成包，真正的开箱即用
-
-功能结构图：
-
 ![sa-token-js](https://color-test.oss-cn-qingdao.aliyuncs.com/sa-token/x/sa-token-js4.png)
 
 
-## Sa-Token-SSO 单点登录
-Sa-Token-SSO 由简入难划分为三种模式，解决不同架构下的 SSO 接入问题：
+### SSO 单点登录
+Sa-Token SSO 分为三种模式，解决同域、跨域、共享Redis、跨Redis、前后端一体、前后端分离……等不同架构下的 SSO 接入问题：
 
 | 系统架构						| 采用模式	| 简介						|  文档链接	|
 | :--------						| :--------	| :--------					| :--------	|
-| 前端同域 + 后端同 Redis		| 模式一		| 共享Cookie同步会话			| [文档](https://sa-token.cc/doc.html#/sso/sso-type1)、[示例](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-sso1-client)	|
+| 前端同域 + 后端同 Redis			| 模式一		| 共享Cookie同步会话			| [文档](https://sa-token.cc/doc.html#/sso/sso-type1)、[示例](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-sso1-client)	|
 | 前端不同域 + 后端同 Redis		| 模式二		| URL重定向传播会话 			| [文档](https://sa-token.cc/doc.html#/sso/sso-type2)、[示例](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-sso2-client)	|
-| 前端不同域 + 后端 不同Redis	| 模式三		| Http请求获取会话			| [文档](https://sa-token.cc/doc.html#/sso/sso-type3)、[示例](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-sso3-client)	|
+| 前端不同域 + 后端 不同Redis		| 模式三		| Http请求获取会话			| [文档](https://sa-token.cc/doc.html#/sso/sso-type3)、[示例](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-sso3-client)	|
 
 
 1. 前端同域：就是指多个系统可以部署在同一个主域名之下，比如：`c1.domain.com`、`c2.domain.com`、`c3.domain.com`
-2. 后端同Redis：就是指多个系统可以连接同一个Redis。PS：这里并不需要把所有项目的数据都放在同一个Redis中，Sa-Token提供了 **`[权限缓存与业务缓存分离]`** 的解决方案，详情戳：[Alone独立Redis插件](https://sa-token.cc/doc.html#/plugin/alone-redis)
-3. 如果既无法做到前端同域，也无法做到后端同Redis，那么只能走模式三，Http请求获取会话（Sa-Token对SSO提供了完整的封装，你只需要按照示例从文档上复制几段代码便可以轻松集成）
+2. 后端同Redis：就是指多个系统可以连接同一个Redis。（此处并非要所有项目数据都放在一个Redis中，Sa-Token提供 **`[权限缓存与业务缓存分离]`** 的解决方案）
+3. 如果既无法做到前端同域，也无法做到后端同Redis，可以走模式三，Http请求校验 ticket 获取会话。
+4. 提供 NoSdk 模式示例，不使用 Sa-Token 的系统也可以对接。
+5. 提供 sso-server 接口文档，不使用 java 语言的系统也可以对接。
+6. 提供前后端分离整合方案：无论是 sso-server 还是 sso-client 的前后端分离都可以整合。
+7. 提供安全校验：域名校验、ticket校验、参数签名校验，有效防 ticket 劫持，防请求重放等攻击。
+8. 参数防丢：笔者曾试验多个SSO框架，均有参数丢失情况，比如登录前是：`http://a.com?id=1&name=2`，登录成功后就变成了：`http://a.com?id=1`，Sa-Token-SSO 内有专门算法保证了参数不丢失，登录成功后精准原路返回。
+9. 提供用户数据迁移方案的建议：开发前统一迁移、运行时实时数据同步、根据关键字段匹配、根据 center_id 字段匹配。
+10. 提供直接可运行的 demo 示例，帮助你快速熟悉 SSO 大致登录流程。
+
+
 
-## Sa-Token-OAuth2 授权认证
-Sa-OAuth2 模块分为四种授权模式，解决不同场景下的授权需求 
+### OAuth2 授权认证
+Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权需求 
 
 | 授权模式						| 简介						|
 | :--------						| :--------					|
@@ -146,50 +156,34 @@ Sa-OAuth2 模块分为四种授权模式，解决不同场景下的授权需求
 详细参考文档：[https://sa-token.cc/doc.html#/oauth2/readme](https://sa-token.cc/doc.html#/oauth2/readme)
 
 
-## 使用 Sa-Token 的开源项目 
+### 开源集成案例
 
 - [[ Snowy ]](https://gitee.com/xiaonuobase/snowy)：国内首个国密前后分离快速开发平台，采用 Vue3 + AntDesignVue3 + Vite + SpringBoot + Mp + HuTool + SaToken。
-
 - [[ RuoYi-Vue-Plus ]](https://gitee.com/dromara/RuoYi-Vue-Plus)：重写RuoYi-Vue所有功能 集成 Sa-Token+Mybatis-Plus+Jackson+Xxl-Job+knife4j+Hutool+OSS 定期同步
-
 - [[ RuoYi-Cloud-Plus ]](https://gitee.com/dromara/RuoYi-Cloud-Plus)：重写RuoYi-Cloud所有功能 整合 SpringCloudAlibaba Dubbo3.0 Sa-Token Mybatis-Plus MQ OSS ES Xxl-Job Docker 全方位升级 定期同步
-
 - [[ EasyAdmin ]](https://gitee.com/lakernote/easy-admin)：一个基于SpringBoot2 + Sa-Token + Mybatis-Plus + Snakerflow + Layui 的后台管理系统，灵活多变可前后端分离，也可单体，内置代码生成器、权限管理、工作流引擎等
-
 - [[ YC-Framework ]](http://framework.youcongtech.com/)：致力于打造一款优秀的分布式微服务解决方案。
-
 - [[ Pig-Satoken ]](https://gitee.com/wchenyang/cloud-satoken)：重写 Pig 授权方式为 Sa-Token，其他代码不变。
 
-更多开源案例可参考：[Awesome-Sa-Token](https://gitee.com/sa-token/awesome-sa-token)
+还有更多优秀开源案例无法逐一展示，请参考：[Awesome-Sa-Token](https://gitee.com/sa-token/awesome-sa-token)
 
 
-## 友情链接
+### 友情链接
 - [[ OkHttps ]](https://gitee.com/ejlchina-zhxu/okhttps)：轻量级 http 通信框架，API无比优雅，支持 WebSocket、Stomp 协议
-
 - [[ Bean Searcher ]](https://github.com/ejlchina/bean-searcher)：专注高级查询的只读 ORM，使一行代码实现复杂列表检索！
-
 - [[ Jpom ]](https://gitee.com/dromara/Jpom)：简而轻的低侵入式在线构建、自动部署、日常运维、项目监控软件。
-
 - [[ TLog ]](https://gitee.com/dromara/TLog)：一个轻量级的分布式日志标记追踪神器。
-
 - [[ hippo4j ]](https://gitee.com/agentart/hippo4j)：强大的动态线程池框架，附带监控报警功能。
-
 - [[ hertzbeat ]](https://gitee.com/dromara/hertzbeat)：易用友好的开源实时监控告警系统，无需Agent，高性能集群，强大自定义监控能力。
-
 - [[ Solon ]](https://gitee.com/noear/solon)：一个更现代感的应用开发框架：更快、更小、更自由。
 
 
-## 知识星球
-<img src="https://oss.dev33.cn/sa-token/dromara-xingqiu--sa-token.jpg" width="300px" />
-
-
-## 交流群
+### 交流群
 QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
 
 微信交流群：
 
 <img src="https://oss.dev33.cn/sa-token/qr/wx-qr-m-400k.png" width="230px" title="微信群" />
-<!-- ![微信群](https://dev33-test.oss-cn-beijing.aliyuncs.com/sa-token/i-wx-qr.png ':size=230') -->
 
 (扫码添加微信，备注：sa-token，邀您加入群聊)
 
-- 
Gitee


From 7556796eaa62592f227a36d2300f8c2cfee74f88 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 7 May 2024 16:29:14 +0800
Subject: [PATCH 034/172] =?UTF-8?q?=E4=BC=98=E5=8C=96readme?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                        | 47 +++++++++++++++++++-------------
 sa-token-doc/fun/plugin-dev.md   |  2 +-
 sa-token-doc/up/global-filter.md |  2 +-
 3 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index 5aac4fee..7309baae 100644
--- a/README.md
+++ b/README.md
@@ -87,32 +87,41 @@ registry.addInterceptor(new SaInterceptor(handler -> {
 
 - **登录认证** —— 单端登录、多端登录、同端互斥登录、七天内免登录。
 - **权限认证** —— 权限认证、角色认证、会话二级认证。
-- **Session会话** —— 全端共享Session、单端独享Session、自定义Session。
 - **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线。
-- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁。 
-- **持久层扩展** —— 可集成Redis、Memcached等专业缓存中间件，重启数据不丢失。
-- **分布式会话** —— 提供jwt集成、共享数据中心两种分布式会话方案。
-- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证。
-- **单点登录** —— 内置三种单点登录模式：无论是否跨域、是否共享Redis，都可以搞定。
-- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 。
+- **注解式鉴权** —— 优雅的将鉴权与业务代码分离。
+- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配 restful 模式。
+- **Session会话** —— 全端共享Session、单端独享Session、自定义Session，方便的存取值。
+- **持久层扩展** —— 可集成 Redis，重启数据不丢失。
+- **前后台分离** —— APP、小程序等不支持 Cookie 的终端也可以轻松鉴权。
+- **Token风格定制** —— 内置六种 Token 风格，还可：自定义 Token 生成策略、自定义 Token 前缀。
+- **记住我模式** —— 适配 [记住我] 模式，重启浏览器免验证。
 - **二级认证** —— 在已登录的基础上再次认证，保证安全性。 
-- **Http Basic认证** —— 一行代码接入 Http Basic、Digest 认证。
-- **独立Redis** —— 将权限缓存与业务缓存分离。
-- **临时Token认证** —— 解决短时间的 Token 授权问题。
 - **模拟他人账号** —— 实时操作任意用户状态数据。
 - **临时身份切换** —— 将会话身份临时切换为其它账号。
-- **前后台分离** —— APP、小程序等不支持Cookie的终端。
 - **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录。
-- **多账号认证体系** —— 比如一个商城项目的user表和admin表分开鉴权。
-- **Token风格定制** —— 内置六种Token风格，还可：自定义Token生成策略、自定义Token前缀。
-- **注解式鉴权** —— 优雅的将鉴权与业务代码分离。
-- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配restful模式。
-- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签。
-- **会话治理** —— 提供方便灵活的会话查询接口。
-- **记住我模式** —— 适配[记住我]模式，重启浏览器免验证。
-- **密码加密** —— 提供密码加密模块，可快速MD5、SHA1、SHA256、AES、RSA加密。
+- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁。
+- **密码加密** —— 提供基础的密码加密算法，可快速 MD5、SHA1、SHA256、AES 加密。
+- **会话查询** —— 提供方便灵活的会话查询接口。
+- **Http Basic认证** —— 一行代码接入 Http Basic、Digest 认证。
 - **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作。
+- **全局过滤器** —— 方便的处理跨域，全局设置安全响应头等操作。
+- **多账号体系认证** —— 一个系统多套账号分开鉴权（比如商城项目的 User 表和 Admin 表）。
+- **单点登录** —— 内置三种单点登录模式：同域、跨域、同Redis、跨Redis、前后端分离等架构都可以搞定。
+- **单点注销** —— 任意子系统内发起注销，即可全端下线。
+- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 。
+- **分布式会话** —— 提供共享数据中心分布式会话方案。
+- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证。
+- **RPC调用鉴权** —— 提供子服务外网隔离功能：网关转发鉴权，RPC调用鉴权，让服务调用不再裸奔。
+- **临时Token认证** —— 解决短时间的 Token 授权问题。
+- **独立Redis** —— 将权限缓存与业务缓存分离。
+- **Quick快速登录认证** —— 为项目零代码注入一个登录页面。
+- **标签方言** —— 提供 Thymeleaf 标签方言集成包，提供 beetl 集成示例。
+- **jwt集成** —— 提供三种模式的 jwt 集成方案，提供 token 扩展参数能力。
+- **RPC调用状态传递** —— 提供 dubbo、grpc 等集成包，在RPC调用鉴权时登录状态不丢失。
+- **参数签名** —— 提供跨系统API调用签名校验模块，防参数篡改，防请求重放。
+- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签。
 - **开箱即用** —— 提供SpringMVC、WebFlux、Solon 等常见web框架集成包，方便开箱即用。
+- **最新技术栈** —— 适配最新技术栈：支持 SpringBoot 3.x，jdk 17。
 
 </details>
 
diff --git a/sa-token-doc/fun/plugin-dev.md b/sa-token-doc/fun/plugin-dev.md
index 07eea450..944ba1c8 100644
--- a/sa-token-doc/fun/plugin-dev.md
+++ b/sa-token-doc/fun/plugin-dev.md
@@ -124,7 +124,7 @@ SaTokenContext 是对接不同框架的上下文接口，注入流程和第二
 
 
 ### 6、发布代码
-插件开发完毕之后，你可以将其pr到官方仓库，或：
+插件开发完毕之后，你可以将其 pr 到 [sa-token-three-plugin](https://gitee.com/sa-tokens/sa-token-three-plugin)，或：
 
 上传到 gitee/github 作为独立项目维护，并发布到 Maven 中央仓库，参考这篇：[https://juejin.cn/post/6844904104834105358](https://juejin.cn/post/6844904104834105358)
 
diff --git a/sa-token-doc/up/global-filter.md b/sa-token-doc/up/global-filter.md
index 5be9948d..25b42ccf 100644
--- a/sa-token-doc/up/global-filter.md
+++ b/sa-token-doc/up/global-filter.md
@@ -109,7 +109,7 @@ public FilterRegistrationBean<SaServletFilter> getSaServletFilter() {
 				})
 				// 等等，其它代码 ... 
 	);
-	frBean.setOrder(100);  // 更改顺序为 -101
+	frBean.setOrder(-101);  // 更改顺序为 -101
 	return frBean;
 }
 ```
-- 
Gitee


From 9261a2687cf4b4d444088d9139121dfe82eeb5f7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 7 May 2024 16:37:00 +0800
Subject: [PATCH 035/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20readme?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 7309baae..97ea985e 100644
--- a/README.md
+++ b/README.md
@@ -90,37 +90,37 @@ registry.addInterceptor(new SaInterceptor(handler -> {
 - **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线。
 - **注解式鉴权** —— 优雅的将鉴权与业务代码分离。
 - **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配 restful 模式。
-- **Session会话** —— 全端共享Session、单端独享Session、自定义Session，方便的存取值。
+- **Session会话** —— 全端共享Session,单端独享Session,自定义Session,方便的存取值。
 - **持久层扩展** —— 可集成 Redis，重启数据不丢失。
 - **前后台分离** —— APP、小程序等不支持 Cookie 的终端也可以轻松鉴权。
-- **Token风格定制** —— 内置六种 Token 风格，还可：自定义 Token 生成策略、自定义 Token 前缀。
+- **Token风格定制** —— 内置六种 Token 风格，还可：自定义 Token 生成策略。
 - **记住我模式** —— 适配 [记住我] 模式，重启浏览器免验证。
 - **二级认证** —— 在已登录的基础上再次认证，保证安全性。 
 - **模拟他人账号** —— 实时操作任意用户状态数据。
 - **临时身份切换** —— 将会话身份临时切换为其它账号。
 - **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录。
 - **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁。
-- **密码加密** —— 提供基础的密码加密算法，可快速 MD5、SHA1、SHA256、AES 加密。
+- **密码加密** —— 提供基础加密算法，可快速 MD5、SHA1、SHA256、AES 加密。
 - **会话查询** —— 提供方便灵活的会话查询接口。
 - **Http Basic认证** —— 一行代码接入 Http Basic、Digest 认证。
 - **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作。
 - **全局过滤器** —— 方便的处理跨域，全局设置安全响应头等操作。
-- **多账号体系认证** —— 一个系统多套账号分开鉴权（比如商城项目的 User 表和 Admin 表）。
+- **多账号体系认证** —— 一个系统多套账号分开鉴权（比如商城的 User 表和 Admin 表）
 - **单点登录** —— 内置三种单点登录模式：同域、跨域、同Redis、跨Redis、前后端分离等架构都可以搞定。
 - **单点注销** —— 任意子系统内发起注销，即可全端下线。
 - **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 。
 - **分布式会话** —— 提供共享数据中心分布式会话方案。
 - **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证。
-- **RPC调用鉴权** —— 提供子服务外网隔离功能：网关转发鉴权，RPC调用鉴权，让服务调用不再裸奔。
+- **RPC调用鉴权** —— 网关转发鉴权，RPC调用鉴权，让服务调用不再裸奔
 - **临时Token认证** —— 解决短时间的 Token 授权问题。
 - **独立Redis** —— 将权限缓存与业务缓存分离。
 - **Quick快速登录认证** —— 为项目零代码注入一个登录页面。
 - **标签方言** —— 提供 Thymeleaf 标签方言集成包，提供 beetl 集成示例。
 - **jwt集成** —— 提供三种模式的 jwt 集成方案，提供 token 扩展参数能力。
-- **RPC调用状态传递** —— 提供 dubbo、grpc 等集成包，在RPC调用鉴权时登录状态不丢失。
+- **RPC调用状态传递** —— 提供 dubbo、grpc 等集成包，在RPC调用时登录状态不丢失。
 - **参数签名** —— 提供跨系统API调用签名校验模块，防参数篡改，防请求重放。
 - **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签。
-- **开箱即用** —— 提供SpringMVC、WebFlux、Solon 等常见web框架集成包，方便开箱即用。
+- **开箱即用** —— 提供SpringMVC、WebFlux、Solon 等常见框架集成包，开箱即用。
 - **最新技术栈** —— 适配最新技术栈：支持 SpringBoot 3.x，jdk 17。
 
 </details>
-- 
Gitee


From e78166484096979dbdfe33bfd43eb3bdc18f52a8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 7 May 2024 17:06:10 +0800
Subject: [PATCH 036/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=90=8D=E5=8D=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/static/donate/donate-list.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 84c1465f..ec1252e2 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1097,10 +1097,17 @@ var donateList = [
 		"date": "2024-03-30"
 	},
 	{
-		"name": "孤独的造梦者	",
+		"name": "孤独的造梦者",
 		"link": "https://gitee.com/dpxz",
 		"money": 10.0,
 		"msg": "感谢您的开源项目！",
 		"date": "2024-04-01"
 	},
+	{
+		"name": "HiSin",
+		"link": "https://gitee.com/HisinLx",
+		"money": 20.0,
+		"msg": "感谢您的开源项目！",
+		"date": "2024-05-07"
+	},
 ]
\ No newline at end of file
-- 
Gitee


From b23aa55ffaba08ddd52d1d47109f157da0b73413 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 8 May 2024 17:21:41 +0800
Subject: [PATCH 037/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20checkTicketAppendD?=
 =?UTF-8?q?ata=20=E7=AD=96=E7=95=A5=E5=87=BD=E6=95=B0=EF=BC=8C=E7=94=A8?=
 =?UTF-8?q?=E4=BA=8E=E5=9C=A8=E6=A0=A1=E9=AA=8C=20ticket=20=E5=90=8E?=
 =?UTF-8?q?=EF=BC=8C=E7=BB=99=20sso-client=20=E7=AB=AF=E8=BF=BD=E5=8A=A0?=
 =?UTF-8?q?=E8=BF=94=E5=9B=9E=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/config/SaSsoClientConfig.java |  2 +-
 .../satoken/sso/config/SaSsoServerConfig.java |  8 +++
 .../CheckTicketAppendDataFunction.java        | 34 +++++++++++++
 .../function/TicketResultHandleFunction.java  | 10 ++--
 .../sso/model/SaCheckTicketResult.java        | 51 +++++++++++++++++++
 .../sso/processor/SaSsoClientProcessor.java   | 26 +++-------
 .../sso/processor/SaSsoServerProcessor.java   |  8 +--
 7 files changed, 110 insertions(+), 29 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/CheckTicketAppendDataFunction.java
 create mode 100644 sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
index ccdf9c73..dd7d4a3d 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoClientConfig.java
@@ -345,7 +345,7 @@ public class SaSsoClientConfig implements Serializable {
     // -------------------- 所有回调函数 --------------------
 
     /**
-     * SSO-Client端：自定义校验Ticket返回值的处理逻辑 （每次从认证中心获取校验Ticket的结果后调用）
+     * SSO-Client端：自定义校验 ticket 返回值的处理逻辑 （每次从认证中心获取校验 ticket 的结果后调用）
      * <p> 参数：loginId, back
      * <p> 返回值：返回给前端的值
      */
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
index 1830962f..47aa280f 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
@@ -18,6 +18,7 @@ package cn.dev33.satoken.sso.config;
 
 import cn.dev33.satoken.sso.error.SaSsoErrorCode;
 import cn.dev33.satoken.sso.exception.SaSsoException;
+import cn.dev33.satoken.sso.function.CheckTicketAppendDataFunction;
 import cn.dev33.satoken.sso.function.DoLoginHandleFunction;
 import cn.dev33.satoken.sso.function.NotLoginViewFunction;
 import cn.dev33.satoken.sso.function.SendHttpFunction;
@@ -279,6 +280,13 @@ public class SaSsoServerConfig implements Serializable {
         return SaResult.error();
     };
 
+    /**
+     * SSO-Server端：在校验 ticket 后，给 sso-client 端追加返回信息的函数
+     */
+    public CheckTicketAppendDataFunction checkTicketAppendData = (loginId, result) -> {
+        return result;
+    };
+
     /**
      * SSO-Server端：发送Http请求的处理函数
      */
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/CheckTicketAppendDataFunction.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/CheckTicketAppendDataFunction.java
new file mode 100644
index 00000000..b99bb802
--- /dev/null
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/CheckTicketAppendDataFunction.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.sso.function;
+
+import cn.dev33.satoken.util.SaResult;
+
+import java.util.function.BiFunction;
+
+/**
+ * 函数式接口：SSO-Server端：在校验 ticket 后，给 sso-client 端追加返回信息的函数
+ *
+ * <p>  参数：loginId, SaResult 响应参数对象  </p>
+ * <p>  返回：SaResult 响应参数对象  </p>
+ *
+ * @author click33
+ * @since 1.38.0
+ */
+@FunctionalInterface
+public interface CheckTicketAppendDataFunction extends BiFunction<Object, SaResult, SaResult> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
index f1100000..739d4658 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/function/TicketResultHandleFunction.java
@@ -15,12 +15,10 @@
  */
 package cn.dev33.satoken.sso.function;
 
-import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
-
-import java.util.function.BiFunction;
+import cn.dev33.satoken.sso.model.SaCheckTicketResult;
 
 /**
- * 函数式接口：SSO-Client端：自定义校验Ticket返回值的处理逻辑 （每次从认证中心获取校验Ticket的结果后调用）
+ * 函数式接口：SSO-Client端：自定义校验 ticket 返回值的处理逻辑 （每次从认证中心获取校验 ticket 的结果后调用）
  *
  * <p>  参数：loginId, back  </p>
  * <p>  返回：返回给前端的值  </p>
@@ -29,6 +27,8 @@ import java.util.function.BiFunction;
  * @since 1.38.0
  */
 @FunctionalInterface
-public interface TicketResultHandleFunction extends BiFunction<SaSsoClientProcessor.CheckTicketResult, String, Object> {
+public interface TicketResultHandleFunction {
+
+    Object run(SaCheckTicketResult ctr, String back);
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java
new file mode 100644
index 00000000..890d203d
--- /dev/null
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.sso.model;
+
+import cn.dev33.satoken.util.SaResult;
+
+/**
+ * 校验 ticket 返回 loginId 等结果的参数封装
+ *
+ * @author click33
+ * @since 1.38.0
+ */
+public class SaCheckTicketResult {
+
+    /** 账号id */
+    public Object loginId;
+
+    /** 此账号会话剩余有效期 */
+    public long remainSessionTimeout;
+
+    /** 从 sso-server 返回的所有参数 */
+    public SaResult result;
+
+    public SaCheckTicketResult(Object loginId, long remainSessionTimeout, SaResult result) {
+        this.loginId = loginId;
+        this.remainSessionTimeout = remainSessionTimeout;
+        this.result = result;
+    }
+    @Override
+    public String toString() {
+        return "CheckTicketResult{" +
+                "loginId=" + loginId +
+                ", remainSessionTimeout=" + remainSessionTimeout +
+                ", result=" + result +
+                '}';
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index 9c8dc651..aef2e26e 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -22,6 +22,7 @@ import cn.dev33.satoken.sso.SaSsoManager;
 import cn.dev33.satoken.sso.config.SaSsoClientConfig;
 import cn.dev33.satoken.sso.error.SaSsoErrorCode;
 import cn.dev33.satoken.sso.exception.SaSsoException;
+import cn.dev33.satoken.sso.model.SaCheckTicketResult;
 import cn.dev33.satoken.sso.name.ApiName;
 import cn.dev33.satoken.sso.name.ParamName;
 import cn.dev33.satoken.sso.template.SaSsoClientTemplate;
@@ -122,11 +123,11 @@ public class SaSsoClientProcessor {
 			return res.redirect(serverAuthUrl);
 		} else {
 			// 1、校验ticket，获取 loginId
-			CheckTicketResult ctr = checkTicketByMode2Or3(ticket, apiName.ssoLogin);
+			SaCheckTicketResult ctr = checkTicketByMode2Or3(ticket, apiName.ssoLogin);
 
 			// 2、如果开发者自定义了ticket结果值处理函数，则使用自定义的函数
 			if(cfg.ticketResultHandle != null) {
-				return cfg.ticketResultHandle.apply(ctr, back);
+				return cfg.ticketResultHandle.run(ctr, back);
 			}
 
 			// 3、登录并重定向至back地址
@@ -244,7 +245,7 @@ public class SaSsoClientProcessor {
 	 * @param currUri 当前路由的uri，用于计算单点注销回调地址
 	 * @return loginId
 	 */
-	public CheckTicketResult checkTicketByMode2Or3(String ticket, String currUri) {
+	public SaCheckTicketResult checkTicketByMode2Or3(String ticket, String currUri) {
 		SaSsoClientConfig cfg = ssoClientTemplate.getClientConfig();
 		ApiName apiName = ssoClientTemplate.apiName;
 		ParamName paramName = ssoClientTemplate.paramName;
@@ -288,7 +289,7 @@ public class SaSsoClientProcessor {
 					remainSessionTimeout = ssoClientTemplate.getStpLogic().getConfigOrGlobal().getTimeout();
 				}
 				// 构建返回
-				return new CheckTicketResult(loginId, remainSessionTimeout);
+				return new SaCheckTicketResult(loginId, remainSessionTimeout, result);
 			} else {
 				// 将 sso-server 回应的消息作为异常抛出
 				throw new SaSsoException(result.getMsg()).setCode(SaSsoErrorCode.CODE_30005);
@@ -309,7 +310,7 @@ public class SaSsoClientProcessor {
 			// 取出 Session 剩余有效期
 			long remainSessionTimeout = ssoClientTemplate.getStpLogic().getSessionTimeoutByLoginId(loginId);
 			// 构建返回
-			return new CheckTicketResult(loginId, remainSessionTimeout);
+			return new SaCheckTicketResult(loginId, remainSessionTimeout, null);
 		}
 	}
 
@@ -324,20 +325,5 @@ public class SaSsoClientProcessor {
 	}
 
 
-	public static class CheckTicketResult {
-		public Object loginId;
-		public long remainSessionTimeout;
-		public CheckTicketResult(Object loginId, long remainSessionTimeout) {
-			this.loginId = loginId;
-			this.remainSessionTimeout = remainSessionTimeout;
-		}
-		@Override
-		public String toString() {
-			return "CheckTicketResult{" +
-					"loginId=" + loginId +
-					", remainSessionTimeout=" + remainSessionTimeout +
-					'}';
-		}
-	}
 
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index ec9e00c2..a17ff711 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -171,6 +171,7 @@ public class SaSsoServerProcessor {
 
 		// 1、获取参数
 		SaRequest req = SaHolder.getRequest();
+		SaSsoServerConfig ssoServerConfig = ssoServerTemplate.getServerConfig();
 		String client = req.getParam(paramName.client);
 		String ticket = req.getParamNotNull(paramName.ticket);
 		String sloCallback = req.getParam(paramName.ssoLogoutCall);
@@ -181,7 +182,7 @@ public class SaSsoServerProcessor {
 		}
 
 		// 3、校验签名
-		if(ssoServerTemplate.getServerConfig().getIsCheckSign()) {
+		if(ssoServerConfig.getIsCheckSign()) {
 			ssoServerTemplate.getSignTemplate(client).checkRequest(req,
 					paramName.client, paramName.ticket, paramName.ssoLogoutCall);
 		} else {
@@ -199,8 +200,9 @@ public class SaSsoServerProcessor {
 
 		// 6、给 client 端响应结果
 		long remainSessionTimeout = ssoServerTemplate.getStpLogic().getSessionTimeoutByLoginId(loginId);
-		return SaResult.data(loginId)
-				.set(paramName.remainSessionTimeout, remainSessionTimeout);
+		SaResult result = SaResult.data(loginId).set(paramName.remainSessionTimeout, remainSessionTimeout);
+		result = ssoServerConfig.checkTicketAppendData.apply(loginId, result);
+		return result;
 	}
 
 	/**
-- 
Gitee


From 55821d09c69ff7919b5af47790ad611b4236fdee Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 8 May 2024 17:29:04 +0800
Subject: [PATCH 038/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E7=94=A8=E6=88=B7?=
 =?UTF-8?q?=E6=95=B0=E6=8D=AE=E5=90=8C=E6=AD=A5/=E8=BF=81=E7=A7=BB?=
 =?UTF-8?q?=E6=96=B9=E6=A1=88=E7=9A=84=E5=BB=BA=E8=AE=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                          |   2 +-
 sa-token-doc/_sidebar.md           |   1 +
 sa-token-doc/more/update-log.md    |   2 +
 sa-token-doc/sso/user-data-sync.md | 234 +++++++++++++++++++++++++++++
 4 files changed, 238 insertions(+), 1 deletion(-)
 create mode 100644 sa-token-doc/sso/user-data-sync.md

diff --git a/README.md b/README.md
index 97ea985e..4848d217 100644
--- a/README.md
+++ b/README.md
@@ -147,7 +147,7 @@ Sa-Token SSO 分为三种模式，解决同域、跨域、共享Redis、跨Redis
 6. 提供前后端分离整合方案：无论是 sso-server 还是 sso-client 的前后端分离都可以整合。
 7. 提供安全校验：域名校验、ticket校验、参数签名校验，有效防 ticket 劫持，防请求重放等攻击。
 8. 参数防丢：笔者曾试验多个SSO框架，均有参数丢失情况，比如登录前是：`http://a.com?id=1&name=2`，登录成功后就变成了：`http://a.com?id=1`，Sa-Token-SSO 内有专门算法保证了参数不丢失，登录成功后精准原路返回。
-9. 提供用户数据迁移方案的建议：开发前统一迁移、运行时实时数据同步、根据关键字段匹配、根据 center_id 字段匹配。
+9. 提供用户数据同步/迁移方案的建议：开发前统一迁移、运行时实时数据同步、根据关联字段匹配、根据 center_id 字段匹配等。
 10. 提供直接可运行的 demo 示例，帮助你快速熟悉 SSO 大致登录流程。
 
 
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 230e3f31..c75611db 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -47,6 +47,7 @@
 	- [前后端分离下的整合方案](/sso/sso-h5)
 	- [平台中心跳转模式](/sso/sso-home-jump)
 	- [不同 Client 不同秘钥](/sso/sso-diff-key)
+	- [用户数据同步 / 迁移](/sso/user-data-sync)
 	- [常见问题总结](/sso/sso-questions)
 	- [Sa-Sso-Pro：单点登录商业版](/sso/sso-pro)
 
diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 231d1c32..ba48a84e 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -31,6 +31,8 @@
 	- 重构：匿名 client 将不再能解析出所有应用的 ticket。**[不向下兼容]**
 	- 新增：新增 homeRoute 配置项：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由。
 	- 优化：优化登录有效期策略，SSO Client 端登录时将延续 SSO Server 端的会话剩余有效期。
+	- 新增：新增 `checkTicketAppendData` 策略函数，用于在校验 ticket 后，给 sso-client 端追加返回信息。
+	- 新增：SSO章节文档新增用户数据同步/迁移方案的建议。
 - 新增插件/示例：
 	- 新增：新增插件 sa-token-hutool-timed-cache，用于整合 Hutool 缓存插件 TimedCache。 **[重要]**
 	- 新增：新增 SSM 架构整合 Sa-Token 简单示例。 	**[重要]**
diff --git a/sa-token-doc/sso/user-data-sync.md b/sa-token-doc/sso/user-data-sync.md
new file mode 100644
index 00000000..e5f018f3
--- /dev/null
+++ b/sa-token-doc/sso/user-data-sync.md
@@ -0,0 +1,234 @@
+# 用户数据同步 / 迁移
+
+本篇文章仅提供架构设计的略微参考，真实场景中每个公司的架构设计都是千差万别的，一套设计理论未必能够适应所有公司的项目。
+所以如果你觉着本篇文章的设计理念不能契合你公司的需求，请以你公司的原设计为准。
+
+--- 
+
+### 数据同步需求
+
+在前面的不同架构 SSO 对接示例中，我们均假设了一个前提：
+
+-- _所有的 sso-client 只负责业务操作，不存储 user 数据，user 数据全部来源于 sso-server，包括登录认证也都是基于 sso-server 里的 user 账号进行校验操作。_
+
+这种架构比较简洁、清晰，是一种理想化的 SSO 架构模型。
+
+然而更多时候，我们遇到的实际情况是：
+
+-- _公司已经有了 N 多个系统，每个系统都有自己独立的一套账号认证体系，现在老板要让这 N 个毫无关系的系统集成单点登录。_
+
+要完成这种需求，首先你得考虑两个问题：
+1. 问题一：sso-client 需不需要保留 user 数据。
+	- sso-client 不涉及 user 信息连表查的业务，就可以不保留 user 信息。
+	- sso-client 涉及 user 信息连表查业务，就需要在 sso-client 保留 user 数据。
+2. 问题二：如果保留的话，是和 sso-server 强同步，还是弱同步。
+	- 强同步就是指 sso-client 的 user 数据和 sso-server 的 user 数据，字段值必须保持一致。比如说：一个用户在server端昵称修改为“张三”，那么在 client 端也要实时同步修改。
+	- 弱同步就是指两边可以各改各的。比如说：一个用户 server 端修改了昵称为 “张三”，他在 client 端依然可以昵称为 “李四”。
+
+
+由此可大致分为三种设计方案：
+
+| 方案序号	| 方案名称	| 简单说明															|  适用系统									|
+| :--------	| :--------	| :--------															| :--------									|
+| 方案一	 	| 统一迁移	| 统一把用户数据迁移到 sso-server 认证中心再进行对接					| 比较简单的系统，业务上不需要 user 信息连表查	|
+| 方案二	 	| 实时同步	| 按照一定的规则，使 sso-client 和 sso-server 保持 user 信息实时同步 	| 一般业务上需要 user 信息连表查的系统			|
+| 方案三	 	| 字段关联	| 不同步，但找一个关键字段，将 sso-client 和 sso-server 的 user 账号进行关联起来	| sso-client 不打算过分依赖 sso-server 的 user 数据，只是想借助 sso-server 完成一下统一登录		|
+
+下面逐一拆解三种方案具体实现。
+
+
+### 1、方案一：统一迁移
+
+对接工作开发前，sso-client 的 user 数据完全迁移到 sso-server 中，且自身不再保留 user 数据，只进行业务数据处理操作。
+
+这种方案其实不必过多讲解，因为数据完成迁移后整个架构就转化为了上述的“理想化SSO模型”，后续对接也比较方便。
+迁移方式可以选择数据库同步工具，或者手写代码从 sso-client 库读取数据然后 insert 到 sso-server 库中。
+这并非此文探讨的重点，因此不再过多赘述了。
+
+- 方案优点：架构简洁明了，SSO 登录、注销对接起来非常方便
+- 方案缺点：sso-client 不存储 user 信息，因此业务上需要连表查询 user 信息的地方会比较麻烦（例如：拉取帖子列表时需要附加显示用户头像和昵称信息）
+
+方案适用范围：适合业务比较简单，不涉及 user资料连表查业务 的子系统。
+
+
+### 2、方案二：实时同步
+
+首先，对接前，数据还是要迁移的，只不过迁移后 sso-client 的 user 数据不删除掉，依然保留。
+
+然后在项目运行阶段，每当 sso-server 的 user 数据发生变动时（增删改），逐一向每个 sso-client 推送变化信息。使 sso-client 与 sso-server 的 user 数据保持强同步。
+
+你可能会有疑问，那 sso-client 的 user 数据发生变动时，要不要向 sso-server 推送信息，我的建议是：尽量不要让 sso-client 的 user 信息主动发生变化。
+
+举个例子：
+
+> 公司有电商、论坛、短视频 3 个子系统 + 1 个 sso-server 认证中心，无论用户从哪个子系统点击 “修改我的资料” 按钮时，都应该统一跳转到 sso-server 认证中心进行修改，
+> 修改完毕后再由 sso-server 将 user 信息推送至 3 个子系统。以此来保证 4 个系统间的 user 信息同步。
+
+- 方案优点：sso-client 存储了 user 信息，可以比较方便的进行 user 连表查操作。
+- 方案缺点：sso-server 与 sso-client 的 user 数据同步功能不算简单，开发起来可能要耗费一段不小的工期。
+
+方案适用范围：一般业务上需要 user 信息连表查的子系统都适合。
+
+
+### 3、方案三：字段关联
+
+如果子系统不需要和 sso-server 做到信息强同步，可以使用字段关联法做到账户关联进行登录。
+
+举个例子：公司有三个子系统，电商、论坛、短视频。同一个用户可以在这三个子系统以及 sso-server 认证中心拥有不同的昵称、头像等信息，互不干扰。
+
+例如，在 sso-server 认证中心里，张三的数据库信息为：
+
+| id		| username	| avatar 	| password 		| age 			| email				|
+| :--------	| :--------	| :--------	| :--------		| :--------		| :--------			|
+| 10001		| ...		| ...		| ...			| ...			| ...				|
+| 10002		| 小明		| cat.jpg	| 123456		| 18 			| `23397@xx.com`		|
+| 10003		| ...		| ...		| ...			| ...			| ...				|
+
+在电商系统里中，张三的数据库信息为：
+
+| id			| name		| avatar 		| money			| email				|
+| :--------		| :--------	| :--------		| :--------		| :--------			|
+| 100334		| ...		| ...			| ...			| ...				|
+| 100335		| 二明		| dog.jpg		| 1000 			| `23397@xx.com`		|
+| 100336		| ...		| ...			| ...			| ...				|
+
+这里的关键点在于，虽然用户 “张三” 在每个系统里的资料都是不同的，但是程序要想办法将它们识别为同一个用户，
+要做到这一点，就需要我们准备一个关键字段将信息打通串联起来。例如表中的 “邮箱” 信息可以作为这个“关联字段”。
+
+（注：此处仅展示使用邮箱作为关联字段的操作，实际上除了邮箱以外，手机号、身份证号等具有唯一性的信息都可以作为关联字段）
+
+首先，在 sso-server 端，我们需要重写一下 `checkTicketAppendData` 函数，使其在 “校验 ticket 返回 loginId” 时，追加返回 email 字段。
+
+```  java 
+// 配置SSO相关参数 
+@Autowired
+private void configSso(SaSsoServerConfig ssoServer) {
+	
+	// 其它配置 ...
+	
+	// 配置：Ticket校验函数
+	ssoServer.checkTicketAppendData = (loginId, result) -> {
+		System.out.println("-------- 追加返回信息到 sso-client --------");
+
+		// 在校验 ticket 后，给 sso-client 端追加返回信息的函数
+		SysUser user = sysUserMapper.getById(loginId);
+		result.set("email", user.getEmail());
+		// result.set("user", user);  // 你也可以将整个user 对象的信息都返回到 sso-client，自由决定
+
+		return result;
+	};
+	
+}
+```
+
+在 sso-client 端，重写 ticketResultHandle 函数，根据 sso-server 返回的信息查询本地 user 信息并登录：
+
+``` java
+// 配置SSO相关参数 
+@Autowired
+private void configSso(SaSsoClientConfig ssoClient) {
+
+	// 其它配置 ... 
+
+	// 自定义校验 ticket 返回值的处理逻辑 （每次从认证中心获取校验 ticket 的结果后调用）
+	ssoClient.ticketResultHandle = (ctr, back) -> {
+		System.out.println("--------- 自定义 ticket 校验结果处理函数 ---------");
+		System.out.println("此账号在 sso-server 的 userId：" + ctr.loginId);
+		System.out.println("此账号在 sso-server 会话剩余有效期：" + ctr.remainSessionTimeout + " 秒");
+		System.out.println("此账号返回的 email 信息：" + ctr.result.get("email"));
+
+		// 模拟代码：
+		// 根据 email 字段找到此账号在本系统对应的 user 信息
+		String email = (String) ctr.result.get("email");
+		SysUser user = sysUserMapper.getByEmail(email);
+
+		// 如果找不到，说明是首次登录本系统的新用户，需要自动注册一个新账号给他
+		if(user == null) {
+			// 涉及到数据库操作，此处仅做模拟代码
+			// 1、构建 user 信息
+			// 2、插入到数据库
+			// 3、查询出最新刚插入的这条 user 信息
+			user = sysUserMapper.getByEmail(email);
+		}
+
+		// 进行登录
+		StpUtil.login(user.getId(), ctr.remainSessionTimeout);
+		StpUtil.getSession().set("user", user);
+
+		// 一切工作完毕，重定向回 back 页面
+		return SaHolder.getResponse().redirect(back);
+	};
+
+}
+```
+
+至此完毕。
+
+- 方案优点：
+	- 1、sso-client 不需要和 sso-server 保持信息强同步，实现起来不复杂，架构也比较清晰易维护。
+	- 2、同一个用户的信息，sso-client 可以和 sso-client 保持不同，各自维护各自的，互不干扰。
+- 方案缺点：好像没啥缺点，除非你觉着上述的第2条优点属于缺点。
+
+方案适用范围：在 user 信息方面不打算过分依赖 sso-server 的系统，希望自己维护自己的 user 信息，只是想借助 sso-server 完成一下统一登录。
+
+
+### 4、扩展：没有关联字段
+
+如果我们的子系统 user 表没有邮箱、手机号等唯一性字段和 sso-server 的 user 表进行关联，该怎么办呢？
+
+没有字段，那就创造个字段，例如：
+
+| id			| name		| avatar 		| age			| center_id			|
+| :--------		| :--------	| :--------		| :--------		| :--------			|
+| 205421		| ...		| ...			| ...			| ...				|
+| 205422		| 小风筝		| dog.jpg		| 21 			| 10002				|
+| 205423		| ...		| ...			| ...			| ...				|
+
+如上表所示，我们可以在子系统的 user 表新增一列 `center_id`，记录这个用户在认证中心所属的账号id。然后在登录时根据这个 `center_id` 来查找相应的用户。 
+
+由于 sso-server 端默认就是会返回 loginId 参数的，因此在 sso-server 端不必再重写一下 `checkTicketAppendData` 函数来追加返回信息了，
+我们只需要重写 sso-client 端的 `ticketResultHandle` 函数即可：
+
+``` java
+// 配置SSO相关参数 
+@Autowired
+private void configSso(SaSsoClientConfig ssoClient) {
+
+	// 其它配置 ... 
+
+	// 自定义校验 ticket 返回值的处理逻辑 （每次从认证中心获取校验 ticket 的结果后调用）
+	ssoClient.ticketResultHandle = (ctr, back) -> {
+		System.out.println("--------- 自定义 ticket 校验结果处理函数 ---------");
+		System.out.println("此账号在 sso-server 的 userId：" + ctr.loginId);
+		System.out.println("此账号在 sso-server 会话剩余有效期：" + ctr.remainSessionTimeout + " 秒");
+
+		// 模拟代码：
+		// 根据 center_id 字段找到此账号在本系统对应的 user 信息
+		long centerId = SaFoxUtil.getValueByType(ctr.loginId, long.class);
+		SysUser user = sysUserMapper.getByCenterId(centerId);
+
+		// 如果找不到，说明是首次登录本系统的新用户，需要自动注册一个新账号给他
+		if(user == null) {
+			// 涉及到数据库操作，此处仅做模拟
+			// 1、构建 user 信息
+			// 2、插入到数据库
+			// 3、查询出最新刚插入的这条 user 信息
+			user = sysUserMapper.getByCenterId(userId);
+		}
+
+		// 进行登录
+		StpUtil.login(user.getId(), ctr.remainSessionTimeout);
+		StpUtil.getSession().set("user", user);
+
+		// 一切工作完毕，重定向回 back 页面
+		return SaHolder.getResponse().redirect(back);
+	};
+
+}
+```
+
+至此完毕。
+
+
+
+
-- 
Gitee


From aa47362cfa4371c3ace9c438857f6f4cef77a09f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 8 May 2024 18:12:40 +0800
Subject: [PATCH 039/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E6=A1=88=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 67355441..965480b6 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -415,6 +415,11 @@
 								pid: 3,
 								alt: '某互联网公司线下活动，报名邀请',
 								src: 'https://oss.dev33.cn/sa-token/more/syzz-xg-3.png',
+							},
+							{
+								pid: 4,
+								alt: 'gitee 开源项目推广，日增 star 70',
+								src: 'https://oss.dev33.cn/sa-token/more/syzz-xg-4.png',
 							}
 						]
 					}
-- 
Gitee


From f35a6f6ad82d5997929bd7e1590434dfaa5015a3 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 9 May 2024 10:15:57 +0800
Subject: [PATCH 040/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=88=A9=E7=94=A8@?=
 =?UTF-8?q?=E5=AD=97=E7=AC=A6=E5=8F=AF=E4=BB=A5=E7=BB=95=E8=BF=87=E5=9F=9F?=
 =?UTF-8?q?=E5=90=8D=E5=85=81=E8=AE=B8=E5=88=97=E8=A1=A8=E6=A0=A1=E9=AA=8C?=
 =?UTF-8?q?=E7=9A=84=E6=BC=8F=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../sso/template/SaSsoServerTemplate.java     | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
index 42255ac0..b8748d84 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
@@ -263,7 +263,25 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
             url = url.substring(0, qIndex);
         }
 
-        // 3、是否在[允许地址列表]之中
+        // 3、不允许出现@字符
+        // 为什么不允许出现 @ 字符呢，因为这有可能导致 redirect 参数绕过 AllowUrl 列表的校验
+        // 举个例子 配置文件：
+        //      sa-token.sso-server.allow-url=http://sa-sso-client1.com*
+        // 开发者原意是为了允许 sa-sso-client1.com 下的所有地址都可以下放ticket
+        // 但是如果攻击者精心构建一个url：
+        //      http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com@sa-token.cc
+        // 那么这个url就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
+        //      https://sa-token.cc/?ticket=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
+        // 造成了ticket 参数劫持
+        // 所以此处需要禁止在 url 中出现 @ 字符
+        // 这么一刀切的做法，可能会导致一些特殊的正常url也无法通过校验，例如：
+        //      http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com:9003/@getInfo
+        // 但是为了安全起见，这么做还是有必要的
+        if(url.contains("@")) {
+            throw new SaSsoException("无效redirect（不允许出现@字符）：" + url).setCode(SaSsoErrorCode.CODE_30001);
+        }
+
+        // 4、判断是否在[允许地址列表]之中
         List<String> authUrlList = Arrays.asList(getAllowUrl().replaceAll(" ", "").split(","));
         if( ! SaStrategy.instance.hasElement.apply(authUrlList, url) ) {
             throw new SaSsoException("非法redirect：" + url).setCode(SaSsoErrorCode.CODE_30002);
-- 
Gitee


From c169721ebfee08a8bca57ff16db90dc30ca8e10d Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 9 May 2024 11:04:50 +0800
Subject: [PATCH 041/172] =?UTF-8?q?=E7=A6=81=E6=AD=A2=20allow-url=20?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E9=A1=B9=20*=20=E7=AC=A6=E5=8F=B7=E5=87=BA?=
 =?UTF-8?q?=E7=8E=B0=E5=9C=A8=E4=B8=AD=E9=97=B4=E4=BD=8D=E7=BD=AE=EF=BC=8C?=
 =?UTF-8?q?=E5=9B=A0=E4=B8=BA=E8=BF=99=E6=9C=89=E5=8F=AF=E8=83=BD=E5=AF=BC?=
 =?UTF-8?q?=E8=87=B4=E6=A0=A1=E9=AA=8C=E8=A2=AB=E7=BB=95=E8=BF=87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/sso/config/SaSsoServerConfig.java |  9 +-
 .../satoken/sso/error/SaSsoErrorCode.java     |  3 +
 .../sso/template/SaSsoServerTemplate.java     | 82 +++++++++++++++----
 3 files changed, 77 insertions(+), 17 deletions(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
index 47aa280f..4249fb6a 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/config/SaSsoServerConfig.java
@@ -22,10 +22,12 @@ import cn.dev33.satoken.sso.function.CheckTicketAppendDataFunction;
 import cn.dev33.satoken.sso.function.DoLoginHandleFunction;
 import cn.dev33.satoken.sso.function.NotLoginViewFunction;
 import cn.dev33.satoken.sso.function.SendHttpFunction;
+import cn.dev33.satoken.sso.template.SaSsoServerTemplate;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.io.Serializable;
+import java.util.List;
 
 /**
  * Sa-Token SSO 单点登录模块 配置类 （Server端）
@@ -134,6 +136,11 @@ public class SaSsoServerConfig implements Serializable {
      * @return 对象自身
      */
     public SaSsoServerConfig setAllowUrl(String allowUrl) {
+        // 提前校验一下配置的 allowUrl 是否合法，让开发者尽早发现错误
+        if(SaFoxUtil.isNotEmpty(allowUrl)) {
+            List<String> allowUrlList = SaFoxUtil.convertStringToList(allowUrl);
+            SaSsoServerTemplate.checkAllowUrlListStaticMethod(allowUrlList);
+        }
         this.allowUrl = allowUrl;
         return this;
     }
@@ -243,7 +250,7 @@ public class SaSsoServerConfig implements Serializable {
      * @return 对象自身
      */
     public SaSsoServerConfig setAllow(String ...url) {
-        this.allowUrl = SaFoxUtil.arrayJoin(url);
+        this.setAllowUrl(SaFoxUtil.arrayJoin(url));
         return this;
     }
 
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
index 9d0c6b16..49b67781 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
@@ -65,4 +65,7 @@ public interface SaSsoErrorCode {
 	/** 在 /sso/auth 既没有指定 redirect 参数，也没有配置 homeRoute 路由 */
 	int CODE_30014 = 30014;
 
+	/** 无效的 allow-url 配置 */
+	int CODE_30015 = 30015;
+
 }
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
index b8748d84..d5367e17 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
@@ -264,32 +264,82 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
         }
 
         // 3、不允许出现@字符
-        // 为什么不允许出现 @ 字符呢，因为这有可能导致 redirect 参数绕过 AllowUrl 列表的校验
-        // 举个例子 配置文件：
-        //      sa-token.sso-server.allow-url=http://sa-sso-client1.com*
-        // 开发者原意是为了允许 sa-sso-client1.com 下的所有地址都可以下放ticket
-        // 但是如果攻击者精心构建一个url：
-        //      http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com@sa-token.cc
-        // 那么这个url就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
-        //      https://sa-token.cc/?ticket=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
-        // 造成了ticket 参数劫持
-        // 所以此处需要禁止在 url 中出现 @ 字符
-        // 这么一刀切的做法，可能会导致一些特殊的正常url也无法通过校验，例如：
-        //      http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com:9003/@getInfo
-        // 但是为了安全起见，这么做还是有必要的
         if(url.contains("@")) {
+            //  为什么不允许出现 @ 字符呢，因为这有可能导致 redirect 参数绕过 AllowUrl 列表的校验
+            //
+            //  举个例子 配置文件：
+            //       sa-token.sso-server.allow-url=http://sa-sso-client1.com*
+            //
+            //  开发者原意是为了允许 sa-sso-client1.com 下的所有地址都可以下放ticket
+            //
+            //  但是如果攻击者精心构建一个url：
+            //       http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com@sa-token.cc
+            //
+            //  那么这个url就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
+            //       https://sa-token.cc/?ticket=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
+            //
+            //  造成了ticket 参数劫持
+            //  所以此处需要禁止在 url 中出现 @ 字符
+            //
+            //  这么一刀切的做法，可能会导致一些特殊的正常url也无法通过校验，例如：
+            //       http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com:9003/@getInfo
+            //
+            //  但是为了安全起见，这么做还是有必要的
             throw new SaSsoException("无效redirect（不允许出现@字符）：" + url).setCode(SaSsoErrorCode.CODE_30001);
         }
 
-        // 4、判断是否在[允许地址列表]之中
-        List<String> authUrlList = Arrays.asList(getAllowUrl().replaceAll(" ", "").split(","));
-        if( ! SaStrategy.instance.hasElement.apply(authUrlList, url) ) {
+        // 4、判断是否在 [ 允许的地址列表 ] 之中
+        List<String> allowUrlList = Arrays.asList(getAllowUrl().replaceAll(" ", "").split(","));
+        checkAllowUrlList(allowUrlList);
+        if( ! SaStrategy.instance.hasElement.apply(allowUrlList, url) ) {
             throw new SaSsoException("非法redirect：" + url).setCode(SaSsoErrorCode.CODE_30002);
         }
 
         // 校验通过 √
     }
 
+    /**
+     * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
+     * @param allowUrlList 待校验的 allow-url 地址列表 
+     */
+    public void checkAllowUrlList(List<String> allowUrlList){
+        checkAllowUrlListStaticMethod(allowUrlList);
+    }
+
+    /**
+     * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
+     * @param allowUrlList 待校验的 allow-url 地址列表
+     */
+    public static void checkAllowUrlListStaticMethod(List<String> allowUrlList){
+        for (String url : allowUrlList) {
+            int index = url.indexOf("*");
+            // 如果配置了 * 字符，则必须出现在最后一位，否则属于无效配置项
+            if(index != -1 && index != url.length() - 1) {
+                //  为什么不允许 * 字符出现在中间位置呢，因为这有可能导致 redirect 参数绕过 allow-url 列表的校验
+                //
+                //  举个例子 配置文件：
+                //      sa-token.sso-server.allow-url=http://*.sa-sso-client1.com
+                //
+                //  开发者原意是为了允许 sa-sso-client1.com 下的所有子域名都可以下放ticket
+                //      例如：http://shop.sa-sso-client1.com
+                //
+                //  但是如果攻击者精心构建一个url：
+                //       http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-token.cc/a.sa-sso-client1.com/sso/login
+                //
+                //  那么这个 url 就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
+                //       https://sa-token.cc/a.sa-sso-client1.com/sso/login?ticket=v2KKMUFK7dDsMMzXLQ3aWGsyGUjrA0dBB2jeOWrpCnC8b5ScmXXQSv20mIwPK7Cx
+                //
+                //  造成了 ticket 参数劫持
+                //  所以此处需要禁止 allow-url 配置项的中间位置出现 * 字符（出现在末尾是没有问题的）
+                //
+                //  这么一刀切的做法，可能会导致正常场景下的子域名url也无法通过校验，例如：
+                //       http://sa-sso-server.com:9000/sso/auth?redirect=http://shop.sa-sso-client1.com/sso/login
+                //
+                //  但是为了安全起见，这么做还是有必要的
+                throw new SaSsoException("无效的 allow-url 配置（*通配符只允许出现在最后一位）：" + url).setCode(SaSsoErrorCode.CODE_30015);
+            }
+        }
+    }
 
     // ------------------- SSO -------------------
 
-- 
Gitee


From d6f2be4a2ec4275b69886d2207203e65ef225fa9 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 9 May 2024 11:06:34 +0800
Subject: [PATCH 042/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?=E6=97=A5=E5=BF=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index ba48a84e..021d860a 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -33,6 +33,8 @@
 	- 优化：优化登录有效期策略，SSO Client 端登录时将延续 SSO Server 端的会话剩余有效期。
 	- 新增：新增 `checkTicketAppendData` 策略函数，用于在校验 ticket 后，给 sso-client 端追加返回信息。
 	- 新增：SSO章节文档新增用户数据同步/迁移方案的建议。
+	- 修复：修复利用@字符可以绕过域名允许列表校验的漏洞。
+	- 修复：禁止 allow-url 配置项 * 符号出现在中间位置，因为这有可能导致校验被绕过。
 - 新增插件/示例：
 	- 新增：新增插件 sa-token-hutool-timed-cache，用于整合 Hutool 缓存插件 TimedCache。 **[重要]**
 	- 新增：新增 SSM 架构整合 Sa-Token 简单示例。 	**[重要]**
-- 
Gitee


From c508e99281430d5c631d1b138bf6ee7b2f1672f8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 07:48:52 +0800
Subject: [PATCH 043/172] =?UTF-8?q?sa-token-bom=20=E8=A1=A5=E5=85=A8?=
 =?UTF-8?q?=E7=BC=BA=E5=A4=B1=E4=BE=9D=E8=B5=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-bom/pom.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sa-token-bom/pom.xml b/sa-token-bom/pom.xml
index 872a1252..a47f6ee2 100644
--- a/sa-token-bom/pom.xml
+++ b/sa-token-bom/pom.xml
@@ -99,6 +99,11 @@
                 <artifactId>sa-token-dubbo</artifactId>
                 <version>${revision}</version>
             </dependency>
+            <dependency>
+                <groupId>cn.dev33</groupId>
+                <artifactId>sa-token-dubbo3</artifactId>
+                <version>${revision}</version>
+            </dependency>
             <dependency>
                 <groupId>cn.dev33</groupId>
                 <artifactId>sa-token-grpc</artifactId>
@@ -139,6 +144,11 @@
                 <artifactId>sa-token-redisx</artifactId>
                 <version>${revision}</version>
             </dependency>
+            <dependency>
+                <groupId>cn.dev33</groupId>
+                <artifactId>sa-token-hutool-timed-cache</artifactId>
+                <version>${revision}</version>
+            </dependency>
             <dependency>
                 <groupId>cn.dev33</groupId>
                 <artifactId>sa-token-dialect-thymeleaf</artifactId>
-- 
Gitee


From adb600d643193cb4cdbce0e7f31cf9e767c627e9 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 09:21:11 +0800
Subject: [PATCH 044/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20token=20=E8=AF=BB?=
 =?UTF-8?q?=E5=8F=96=E7=AD=96=E7=95=A5=EF=BC=8C=E7=A9=BA=E5=AD=97=E7=AC=A6?=
 =?UTF-8?q?=E4=B8=B2=E5=B0=86=E8=A7=86=E4=B8=BA=E6=B2=A1=E6=9C=89=E6=8F=90?=
 =?UTF-8?q?=E4=BA=A4token?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/stp/StpLogic.java        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 971f5ad5..8925c56d 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -334,15 +334,15 @@ public class StpLogic {
 			tokenValue = String.valueOf(storage.get(splicingKeyJustCreatedSave()));
 		}
 		// 2. 再尝试从 请求体 里面读取
-		if(tokenValue == null && config.getIsReadBody()){
+		if(SaFoxUtil.isEmpty(tokenValue) && config.getIsReadBody()){
 			tokenValue = request.getParam(keyTokenName);
 		}
 		// 3. 再尝试从 header 头里读取
-		if(tokenValue == null && config.getIsReadHeader()){
+		if(SaFoxUtil.isEmpty(tokenValue) && config.getIsReadHeader()){
 			tokenValue = request.getHeader(keyTokenName);
 		}
 		// 4. 最后尝试从 cookie 里读取
-		if(tokenValue == null && config.getIsReadCookie()){
+		if(SaFoxUtil.isEmpty(tokenValue) && config.getIsReadCookie()){
 			tokenValue = request.getCookieValue(keyTokenName);
 		}
 		
-- 
Gitee


From f612c87e3accca12f6781fb3a34787968a5fb415 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 09:41:06 +0800
Subject: [PATCH 045/172] =?UTF-8?q?@SaCheckOr=E6=B3=A8=E8=A7=A3=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E8=A1=A5=E5=85=A8@SaCheckHttpDigest=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../cn/dev33/satoken/annotation/SaCheckOr.java  | 11 +++++++++--
 .../cn/dev33/satoken/strategy/SaStrategy.java   | 17 ++++++++++++++---
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
index 921dd386..8652619b 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
@@ -61,11 +61,18 @@ public @interface SaCheckOr {
     SaCheckSafe[] safe() default {};
 
     /**
-     * 设定 @SaCheckBasic，参考 {@link SaCheckHttpBasic}
+     * 设定 @SaCheckHttpBasic，参考 {@link SaCheckHttpBasic}
      *
      * @return /
      */
-    SaCheckHttpBasic[] basic() default {};
+    SaCheckHttpBasic[] httpBasic() default {};
+
+    /**
+     * 设定 @SaCheckBasic，参考 {@link SaCheckHttpDigest}
+     *
+     * @return /
+     */
+    SaCheckHttpDigest[] httpDigest() default {};
 
     /**
      * 设定 @SaCheckDisable，参考 {@link SaCheckDisable}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
index cb1e47c2..df89ae7e 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
@@ -17,10 +17,10 @@ package cn.dev33.satoken.strategy;
 
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.annotation.*;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.exception.RequestPathInvalidException;
 import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.fun.strategy.*;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
 import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.stp.StpLogic;
@@ -265,8 +265,8 @@ public final class SaStrategy {
 		}
 
 		// 6、校验注解：@SaCheckBasic
-		SaCheckHttpBasic[] checkBasicArray = at.basic();
-		for (SaCheckHttpBasic item : checkBasicArray) {
+		SaCheckHttpBasic[] checkHttpBasicArray = at.httpBasic();
+		for (SaCheckHttpBasic item : checkHttpBasicArray) {
 			try {
 				SaHttpBasicUtil.check(item.realm(), item.account());
 				return;
@@ -275,6 +275,17 @@ public final class SaStrategy {
 			}
 		}
 
+		// 7、校验注解：@SaCheckDigest
+		SaCheckHttpDigest[] checkHttpDigestArray = at.httpDigest();
+		for (SaCheckHttpDigest item : checkHttpDigestArray) {
+			try {
+				SaHttpDigestUtil.checkByAnnotation(item);
+				return;
+			} catch (SaTokenException e) {
+				errorList.add(e);
+			}
+		}
+
 		// 如果执行到这里，有两种可能：
 		//		可能 1. SaCheckOr 注解上不包含任何注解校验，此时 errorList 里面一个异常都没有，我们直接跳过即可
 		//		可能 2. 所有注解校验都通过不了，此时 errorList 里面会有多个异常，我们随便抛出一个即可
-- 
Gitee


From ea546c7adbd8fdaf4ac4d10d3ac9ffb4835a2417 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 09:44:05 +0800
Subject: [PATCH 046/172] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md |  2 ++
 sa-token-doc/use/at-check.md    | 16 ++++++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 021d860a..726414a5 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -18,6 +18,8 @@
 	- 移除：移除 SaSignConfig 的 isCheckNonce 配置项。 **[不向下兼容]**
 	- 新增：SaSignTemplate#checkRequest 增加“可指定参与签名参数”的功能。
 	- 重构：将部分加密算法设置为过期。
+	- 重构：优化 token 读取策略，空字符串将视为没有提交token。
+	- 修复：sa-token-bom 补全缺失依赖。
 - sa-token-sso：
 	- 优化：SSO 模式三，API 调用签名校验时，限定参与签名的参数列表，更安全。
 	- 新增：新增 autoRenewTimeout 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
diff --git a/sa-token-doc/use/at-check.md b/sa-token-doc/use/at-check.md
index 2f0e6ef4..0f921043 100644
--- a/sa-token-doc/use/at-check.md
+++ b/sa-token-doc/use/at-check.md
@@ -11,7 +11,8 @@
 - `@SaCheckRole("admin")`: 角色校验 —— 必须具有指定角色标识才能进入该方法。
 - `@SaCheckPermission("user:add")`: 权限校验 —— 必须具有指定权限才能进入该方法。
 - `@SaCheckSafe`: 二级认证校验 —— 必须二级认证之后才能进入该方法。
-- `@SaCheckBasic`: HttpBasic校验 —— 只有通过 Basic 认证后才能进入该方法。
+- `@SaCheckHttpBasic`: HttpBasic校验 —— 只有通过 HttpBasic 认证后才能进入该方法。
+- `@SaCheckHttpDigest`: HttpDigest校验 —— 只有通过 HttpDigest 认证后才能进入该方法。
 - `@SaIgnore`：忽略校验 —— 表示被修饰的方法或类无需进行注解鉴权和路由拦截器鉴权。
 - `@SaCheckDisable("comment")`：账号服务封禁校验 —— 校验当前账号指定服务是否被封禁。
 
@@ -70,8 +71,15 @@ public String add() {
 	return "用户增加";
 }
 
-// Http Basic 校验：只有通过 Basic 认证后才能进入该方法 
-@SaCheckBasic(account = "sa:123456")
+// Http Basic 校验：只有通过 Http Basic 认证后才能进入该方法 
+@SaCheckHttpBasic(account = "sa:123456")
+@RequestMapping("add")
+public String add() {
+	return "用户增加";
+}
+
+// Http Digest 校验：只有通过 Http Digest 认证后才能进入该方法 
+@SaCheckHttpDigest(value = "sa:123456")
 @RequestMapping("add")
 public String add() {
 	return "用户增加";
@@ -162,7 +170,7 @@ public class TestController {
 		role = @SaCheckRole("admin"),
 		permission = @SaCheckPermission("user.add"),
 		safe = @SaCheckSafe("update-password"),
-		basic = @SaCheckBasic(account = "sa:123456"),
+		httpBasic = @SaCheckHttpBasic(account = "sa:123456"),
 		disable = @SaCheckDisable("submit-orders")
 )
 @RequestMapping("test")
-- 
Gitee


From 6d4496897d711e063ee78abc1f43e9a99b1effc3 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 10:55:47 +0800
Subject: [PATCH 047/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=EF=BC=9A=E4=BA=8C?=
 =?UTF-8?q?=E7=BA=A7=E8=AE=A4=E8=AF=81=E6=A0=A1=E9=AA=8C=E4=B9=8B=E5=89=8D?=
 =?UTF-8?q?=E5=BF=85=E9=A1=BB=E5=85=88=E9=80=9A=E8=BF=87=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E8=AE=A4=E8=AF=81=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../main/java/cn/dev33/satoken/stp/StpLogic.java | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 8925c56d..1389bd23 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -2672,7 +2672,13 @@ public class StpLogic {
 			return false;
 		}
 		
-		// 2、如果缓存中可以查询出指定的键值，则代表已认证，否则视为未认证
+		// 2、如果此 token 不处于登录状态，也将其视为未认证
+		Object loginId = getLoginIdNotHandle(tokenValue);
+		if( ! isValidLoginId(loginId) ) {
+			return false;
+		}
+
+		// 3、如果缓存中可以查询出指定的键值，则代表已认证，否则视为未认证
 		String value = getSaTokenDao().get(splicingKeySafe(tokenValue, service));
 		return !(SaFoxUtil.isEmpty(value));
 	}
@@ -2690,8 +2696,14 @@ public class StpLogic {
 	 * @param service 业务标识  
 	 */
 	public void checkSafe(String service) {
+		// 1、必须先通过登录校验
+		checkLogin();
+
+		// 2、再进行二级认证校验
+		// 		如果缓存中可以查询出指定的键值，则代表已认证，否则视为未认证
 		String tokenValue = getTokenValue();
-		if ( ! isSafe(tokenValue, service)) {
+		String value = getSaTokenDao().get(splicingKeySafe(tokenValue, service));
+		if(SaFoxUtil.isEmpty(value)) {
 			throw new NotSafeException(loginType, tokenValue, service).setCode(SaErrorCode.CODE_11071);
 		}
 	}
-- 
Gitee


From c5c3253171a862cd8ef24564e059a929b7843871 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 12:40:42 +0800
Subject: [PATCH 048/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=88=9B=E5=BB=BA?=
 =?UTF-8?q?=E5=8C=BF=E5=90=8D=20token-session=20=E4=B8=8D=E8=83=BD?=
 =?UTF-8?q?=E6=8C=81=E4=B9=85=E5=8C=96=E5=AD=98=E5=82=A8=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/stp/StpLogic.java   | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 1389bd23..3a900a99 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -1295,7 +1295,6 @@ public class StpLogic {
 		if(SaFoxUtil.isEmpty(tokenValue)) {
 			throw new SaTokenException("Token-Session 获取失败：token 不能为空");
 		}
-		// todo 待优化
 		return getSessionBySessionId(splicingKeyTokenSession(tokenValue), isCreate, null, session -> {
 			// 这里是该 Token-Session 首次创建时才会被执行的方法：
 			// 		设定这个 SaSession 的各种基础信息：类型、账号体系、Token 值
@@ -1408,7 +1407,14 @@ public class StpLogic {
 			setTokenValue(tokenValue);
 
 			// 返回其 Token-Session 对象
-			return getTokenSessionByToken(tokenValue, isCreate);
+			final String finalTokenValue = tokenValue;
+			return getSessionBySessionId(splicingKeyTokenSession(tokenValue), isCreate, getConfigOrGlobal().getTimeout(), session -> {
+				// 这里是该 Anon-Token-Session 首次创建时才会被执行的方法：
+				// 		设定这个 SaSession 的各种基础信息：类型、账号体系、Token 值
+				session.setType(SaTokenConsts.SESSION_TYPE__TOKEN);
+				session.setLoginType(getLoginType());
+				session.setToken(finalTokenValue);
+			});
 		}
 		else {
 			return null;
-- 
Gitee


From b2416ae43d5a5cf1e6b5ca06f33c195499df1b69 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 13:08:52 +0800
Subject: [PATCH 049/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8Djwt=E9=83=A8=E5=88=86?=
 =?UTF-8?q?=E6=A8=A1=E5=BC=8F=E4=B8=8D=E8=83=BD=E6=AD=A3=E7=A1=AE=E5=88=9B?=
 =?UTF-8?q?=E5=BB=BA=20token-session=20=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/jwt/StpLogicJwtForMixin.java      | 36 ++++++++++++++++---
 .../satoken/jwt/StpLogicJwtForStateless.java  |  4 +--
 .../java/com/pj/test/JwtForMixinTest.java     |  2 +-
 3 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForMixin.java b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForMixin.java
index 54bf771f..11713d46 100644
--- a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForMixin.java
+++ b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForMixin.java
@@ -22,11 +22,15 @@ import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.exception.ApiDisabledException;
 import cn.dev33.satoken.exception.NotLoginException;
+import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.jwt.error.SaJwtErrorCode;
 import cn.dev33.satoken.jwt.exception.SaJwtException;
+import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.stp.SaTokenInfo;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaFoxUtil;
+import cn.dev33.satoken.util.SaTokenConsts;
 
 /**
  * Sa-Token 整合 jwt -- Mixin 混入模式
@@ -211,13 +215,37 @@ public class StpLogicJwtForMixin extends StpLogic {
  	// ------------------- 过期时间相关 -------------------  
 
  	/**
- 	 * 获取当前登录者的 token 剩余有效时间 (单位: 秒)
+ 	 * 获取指定 token 剩余有效时间 (单位: 秒)
  	 */
 	@Override
- 	public long getTokenTimeout() {
- 		return SaJwtUtil.getTimeout(getTokenValue(), loginType, jwtSecretKey());
+ 	public long getTokenTimeout(String tokenValue) {
+ 		return SaJwtUtil.getTimeout(tokenValue, loginType, jwtSecretKey());
  	}
- 	
+
+
+	// ------------------- Token-Session 相关 -------------------
+
+	/**
+	 * 获取指定 token 的 Token-Session，如果该 SaSession 尚未创建，isCreate代表是否新建并返回
+	 *
+	 * @param tokenValue token值
+	 * @param isCreate 是否新建
+	 * @return session对象
+	 */
+	public SaSession getTokenSessionByToken(String tokenValue, boolean isCreate) {
+		if(SaFoxUtil.isEmpty(tokenValue)) {
+			throw new SaTokenException("Token-Session 获取失败：token 不能为空");
+		}
+		long timeout = getTokenTimeout(tokenValue);
+		return getSessionBySessionId(splicingKeyTokenSession(tokenValue), isCreate, timeout, session -> {
+			// 这里是该 Token-Session 首次创建时才会被执行的方法：
+			// 		设定这个 SaSession 的各种基础信息：类型、账号体系、Token 值
+			session.setType(SaTokenConsts.SESSION_TYPE__TOKEN);
+			session.setLoginType(getLoginType());
+			session.setToken(tokenValue);
+		});
+	}
+
 
 	// ------------------- 会话管理 -------------------  
 
diff --git a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForStateless.java b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForStateless.java
index 42aeffbe..b12d14b2 100644
--- a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForStateless.java
+++ b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/StpLogicJwtForStateless.java
@@ -181,10 +181,10 @@ public class StpLogicJwtForStateless extends StpLogic {
  	// ------------------- 过期时间相关 -------------------  
 
  	/**
- 	 * 获取当前登录者的 token 剩余有效时间 (单位: 秒)
+ 	 * 获取指定 token 剩余有效时间 (单位: 秒)
  	 */
 	@Override
- 	public long getTokenTimeout() {
+ 	public long getTokenTimeout(String tokenValue) {
  		return SaJwtUtil.getTimeout(getTokenValue(), loginType, jwtSecretKey());
  	}
  	
diff --git a/sa-token-test/sa-token-jwt-test/src/test/java/com/pj/test/JwtForMixinTest.java b/sa-token-test/sa-token-jwt-test/src/test/java/com/pj/test/JwtForMixinTest.java
index fab48928..917f9762 100644
--- a/sa-token-test/sa-token-jwt-test/src/test/java/com/pj/test/JwtForMixinTest.java
+++ b/sa-token-test/sa-token-jwt-test/src/test/java/com/pj/test/JwtForMixinTest.java
@@ -193,7 +193,7 @@ public class JwtForMixinTest {
     	SaSession session = dao.getSession("satoken:login:token-session:" + token);
     	Assertions.assertNull(session);
     	
-    	// 调用一次就存在了 
+    	// 调用一次就存在了
     	StpUtil.getTokenSession();
     	Assertions.assertNotNull(StpUtil.stpLogic.getTokenSession(false));
     	SaSession session2 = dao.getSession("satoken:login:token-session:" + token);
-- 
Gitee


From bdac07d7a0c31ff8232279eed69274dace56cc85 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 13:11:27 +0800
Subject: [PATCH 050/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=20update-log?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 726414a5..c3bac2f5 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -20,6 +20,7 @@
 	- 重构：将部分加密算法设置为过期。
 	- 重构：优化 token 读取策略，空字符串将视为没有提交token。
 	- 修复：sa-token-bom 补全缺失依赖。
+	- 优化：二级认证校验之前必须先通过登录认证校验。
 - sa-token-sso：
 	- 优化：SSO 模式三，API 调用签名校验时，限定参与签名的参数列表，更安全。
 	- 新增：新增 autoRenewTimeout 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
-- 
Gitee


From b4baa4229f9827190f7ff2c67e59a2a4dcd0ebbb Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 14:32:45 +0800
Subject: [PATCH 051/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8Deff=E4=B8=BAnull?=
 =?UTF-8?q?=E6=97=B6=E6=8A=A5=E7=A9=BA=E6=8C=87=E9=92=88=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-plugin/sa-token-temp-jwt/pom.xml                   | 6 ++++++
 .../src/main/java/cn/dev33/satoken/temp/jwt/SaJwtUtil.java  | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-temp-jwt/pom.xml b/sa-token-plugin/sa-token-temp-jwt/pom.xml
index 204c0a8f..58c64275 100644
--- a/sa-token-plugin/sa-token-temp-jwt/pom.xml
+++ b/sa-token-plugin/sa-token-temp-jwt/pom.xml
@@ -27,6 +27,12 @@
 			<groupId>io.jsonwebtoken</groupId>
 			<artifactId>jjwt</artifactId>
         </dependency>
+        <!-- 不加这个报 java.lang.NoClassDefFoundError: javax/xml/bind/DatatypeConverter -->
+        <dependency>
+            <groupId>javax.xml.bind</groupId>
+            <artifactId>jaxb-api</artifactId>
+            <version>2.3.1</version>
+        </dependency>
 	</dependencies>
 
 </project>
diff --git a/sa-token-plugin/sa-token-temp-jwt/src/main/java/cn/dev33/satoken/temp/jwt/SaJwtUtil.java b/sa-token-plugin/sa-token-temp-jwt/src/main/java/cn/dev33/satoken/temp/jwt/SaJwtUtil.java
index 88dac617..2866318b 100644
--- a/sa-token-plugin/sa-token-temp-jwt/src/main/java/cn/dev33/satoken/temp/jwt/SaJwtUtil.java
+++ b/sa-token-plugin/sa-token-temp-jwt/src/main/java/cn/dev33/satoken/temp/jwt/SaJwtUtil.java
@@ -99,7 +99,7 @@ public class SaJwtUtil {
     	
     	// 验证是否超时 
     	Long eff = claims.get(KEY_EFF, Long.class);
-    	if((eff == null || eff < System.currentTimeMillis()) && eff != NEVER_EXPIRE) {
+    	if(eff == null || (eff < System.currentTimeMillis() && eff != NEVER_EXPIRE)) {
     		throw new SaTokenException("token 已超时，无法解析：" + jwtToken).setCode(SaTempJwtErrorCode.CODE_30303);
     	}
     	
-- 
Gitee


From 535c8e972f573f80778b7e5ad7ab3fac76c4618c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 16:16:52 +0800
Subject: [PATCH 052/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20StpUtil.getLoginId?=
 =?UTF-8?q?(T=20defaultValue)=20=E4=BC=A0=E5=85=A5=20null=20=E6=97=B6?=
 =?UTF-8?q?=E6=97=A0=E6=B3=95=E6=AD=A3=E7=A1=AE=E8=BF=94=E5=9B=9E=E5=80=BC?=
 =?UTF-8?q?=E7=9A=84bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/stp/StpLogic.java   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 3a900a99..0d5a5977 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -994,12 +994,12 @@ public class StpLogic {
 		if(loginId == null) {
 			return defaultValue;
 		}
-        // 3、loginId 不为 null，则开始尝试类型转换
-        if (defaultValue == null) {
-			return null;
-        }
+		// 3、loginId 不为 null，则开始尝试类型转换
+		if(defaultValue == null) {
+			return (T) loginId;
+		}
 		return (T) SaFoxUtil.getValueByType(loginId, defaultValue.getClass());
- 	}
+	}
  	
  	/** 
 	 * 获取当前会话账号id, 如果未登录，则返回null
-- 
Gitee


From c3bd2018a2dfeb637b4ad31514a45dd02cf2d723 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 16:24:40 +0800
Subject: [PATCH 053/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=20update-log?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index c3bac2f5..31214867 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -21,6 +21,7 @@
 	- 重构：优化 token 读取策略，空字符串将视为没有提交token。
 	- 修复：sa-token-bom 补全缺失依赖。
 	- 优化：二级认证校验之前必须先通过登录认证校验。
+	- 修复：修复 StpUtil.getLoginId(T defaultValue) 传入 null 时无法正确返回值的bug。
 - sa-token-sso：
 	- 优化：SSO 模式三，API 调用签名校验时，限定参与签名的参数列表，更安全。
 	- 新增：新增 autoRenewTimeout 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
-- 
Gitee


From 89a69e5624e8758aad6d68d5c50bb3604aeb482e Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 10 May 2024 16:32:36 +0800
Subject: [PATCH 054/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E9=97=AE=E7=AD=94Q?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-questions.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/sa-token-doc/sso/sso-questions.md b/sa-token-doc/sso/sso-questions.md
index cbd73f4a..b83c387e 100644
--- a/sa-token-doc/sso/sso-questions.md
+++ b/sa-token-doc/sso/sso-questions.md
@@ -6,6 +6,7 @@ SSO 集成常见问题整理
 
 --- 
 
+
 ### 问：在模式一与模式二中，Client端 必须通过 Alone-Redis 插件来访问 Redis 吗？
 答：不必须，只是推荐，权限缓存与业务缓存分离后会减少 `SSO-Redis` 的访问压力，且可以避免多个 `Client端` 的缓存读写冲突。
 
@@ -186,6 +187,27 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 更多登录姿势可以参考 [[何时引导用户去登录]](/sso/sso-custom-login) 给出的建议进行设计。
 
 
+
+### 问：sa-token.sso-server.allow-url 配置项可以做成从数据库读取的吗？
+可以，自定义 `SaSsoServerTemplate` 实现类，重写 `getAllowUrl` 方法即可：
+``` java
+/**
+ * 重写 SaSsoServerTemplate 部分方法，增强功能 
+ */
+@Component
+public class CustomSaSsoServerTemplate extends SaSsoServerTemplate {
+	
+	// 重写 [获取授权回调地址] 方法，改为从数据库中读取 
+	@Override
+	public String getAllowUrl() {
+		String allowUrl = ""; // 改为从数据库读取 
+		return allowUrl;
+	}
+
+}
+```
+
+
 ### 问：如果 sso-client 端我没有集成 sa-token-sso，如何对接？
 需要手动调用 http 请求来对接 sso-server 开放的接口，参考示例：
 [sa-token-demo-sso3-client-nosdk](https://gitee.com/dromara/sa-token/tree/master/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-nosdk)
-- 
Gitee


From 1ab5bbe3d60660da87b3648ca5883df0899c1e0e Mon Sep 17 00:00:00 2001
From: noear <noear@live.cn>
Date: Sat, 11 May 2024 13:45:40 +0800
Subject: [PATCH 055/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20solon=20=E7=9A=84?=
 =?UTF-8?q?=E9=80=82=E9=85=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../solon/oauth2/SaOAuth2AutoConfigure.java   | 10 +++----
 .../satoken/solon/sso/SaSsoAutoConfigure.java | 26 +++++++++----------
 2 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
index 42c3cc3e..0b01e86e 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
@@ -24,7 +24,6 @@ import org.noear.solon.annotation.Condition;
 import org.noear.solon.annotation.Configuration;
 import org.noear.solon.annotation.Inject;
 import org.noear.solon.core.AppContext;
-import org.noear.solon.core.bean.InitializingBean;
 
 /**
  * @author noear
@@ -33,12 +32,9 @@ import org.noear.solon.core.bean.InitializingBean;
 
 @Condition(onClass = SaOAuth2Manager.class)
 @Configuration
-public class SaOAuth2AutoConfigure implements InitializingBean {
-    @Inject
-    private AppContext appContext;
-
-    @Override
-    public void afterInjection() throws Throwable {
+public class SaOAuth2AutoConfigure {
+    @Bean
+    public void init(AppContext appContext) throws Throwable {
         appContext.subBeansOfType(SaOAuth2Template.class, bean -> {
             SaOAuth2Util.saOAuth2Template = bean;
         });
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/sso/SaSsoAutoConfigure.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/sso/SaSsoAutoConfigure.java
index 4b40bada..171ddfc0 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/sso/SaSsoAutoConfigure.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/sso/SaSsoAutoConfigure.java
@@ -36,39 +36,37 @@ import org.noear.solon.core.bean.InitializingBean;
 
 @Condition(onClass = SaSsoManager.class)
 @Configuration
-public class SaSsoAutoConfigure implements InitializingBean {
-    @Inject
-    private AppContext appContext;
-
-    @Override
-    public void afterInjection() throws Throwable {
-        appContext.subBeansOfType(SaSsoServerTemplate.class, bean->{
+public class SaSsoAutoConfigure {
+    @Bean
+    public void init(AppContext appContext) throws Throwable {
+        appContext.subBeansOfType(SaSsoServerTemplate.class, bean -> {
             SaSsoServerProcessor.instance.ssoServerTemplate = bean;
         });
-        appContext.subBeansOfType(SaSsoClientTemplate.class, bean->{
+        appContext.subBeansOfType(SaSsoClientTemplate.class, bean -> {
             SaSsoClientProcessor.instance.ssoClientTemplate = bean;
         });
 
-        appContext.subBeansOfType(SaSsoServerConfig.class, bean->{
+        appContext.subBeansOfType(SaSsoServerConfig.class, bean -> {
             SaSsoManager.setServerConfig(bean);
         });
-        appContext.subBeansOfType(SaSsoClientConfig.class, bean->{
+        appContext.subBeansOfType(SaSsoClientConfig.class, bean -> {
             SaSsoManager.setClientConfig(bean);
         });
     }
 
     /**
      * 获取 SSO Server 配置Bean
-     * */
+     */
     @Bean
-    public SaSsoServerConfig getConfig(@Inject(value = "${sa-token.sso-server}",required = false) SaSsoServerConfig ssoConfig) {
+    public SaSsoServerConfig getConfig(@Inject(value = "${sa-token.sso-server}", required = false) SaSsoServerConfig ssoConfig) {
         return ssoConfig;
     }
+
     /**
      * 获取 SSO Client 配置Bean
-     * */
+     */
     @Bean
-    public SaSsoClientConfig getClientConfig(@Inject(value = "${sa-token.sso-client}",required = false) SaSsoClientConfig ssoConfig) {
+    public SaSsoClientConfig getClientConfig(@Inject(value = "${sa-token.sso-client}", required = false) SaSsoClientConfig ssoConfig) {
         return ssoConfig;
     }
 }
\ No newline at end of file
-- 
Gitee


From e02445740540fee38671ba827a7eddd7ab1050be Mon Sep 17 00:00:00 2001
From: noear <noear@live.cn>
Date: Sat, 11 May 2024 13:46:16 +0800
Subject: [PATCH 056/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20solon=20=E7=9B=B8?=
 =?UTF-8?q?=E5=85=B3=E7=9A=84=20demo=20=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../sa-token-demo-solon-redisson/pom.xml       |  2 +-
 sa-token-demo/sa-token-demo-solon/pom.xml      |  2 +-
 .../sa-token-demo-sso-server-solon/pom.xml     |  3 +--
 .../src/main/java/com/pj/sso/SsoConfig.java    |  2 +-
 .../src/main/resources/app.yml                 |  2 +-
 .../sa-token-demo-sso1-client-solon/pom.xml    |  2 +-
 .../src/main/java/com/pj/SaConfig.java         |  2 +-
 .../src/main/resources/app.yml                 |  2 +-
 .../sa-token-demo-sso2-client-solon/pom.xml    |  2 +-
 .../src/main/java/com/pj/SaConfig.java         |  2 +-
 .../src/main/resources/app.yml                 |  4 ++--
 .../sa-token-demo-sso3-client-solon/pom.xml    | 18 ++++++++----------
 .../src/main/java/com/pj/SaConfig.java         |  2 +-
 .../src/main/resources/app.yml                 |  4 ++--
 14 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
index c08a7b8d..d60eb51e 100644
--- a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 
diff --git a/sa-token-demo/sa-token-demo-solon/pom.xml b/sa-token-demo/sa-token-demo-solon/pom.xml
index 01b44aa5..075101d1 100644
--- a/sa-token-demo/sa-token-demo-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
index a5df50ba..b08a1f46 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
@@ -10,14 +10,13 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
 		<sa-token.version>1.38.0</sa-token.version>
-		<solon.version>2.2.3</solon.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
index a2618dcc..0094cac4 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
@@ -21,7 +21,7 @@ public class SsoConfig {
      * 构建建 SaToken redis dao（如果不需要 redis；可以注释掉）
      * */
     @Bean
-    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.redis}") SaTokenDaoOfRedis saTokenDao) {
+    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.dao.redis}") SaTokenDaoOfRedis saTokenDao) {
         return saTokenDao;
     }
 
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
index 2fde61a4..af035ff6 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
@@ -26,7 +26,7 @@ sa-token:
         secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
         # ---- 除了以上配置项，你还需要为 Sa-Token 配置http请求处理器（文档有步骤说明） 
 
-sa-token: #名字可以随意取
+sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
         password: 123456
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
index b98ecd47..0437b6fe 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 	
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaConfig.java
index 7bdd8aba..6031f505 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaConfig.java
@@ -16,7 +16,7 @@ public class SaConfig {
      * 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
      * */
     @Bean
-    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.redis}") SaTokenDaoOfRedis saTokenDao) {
+    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.dao.redis}") SaTokenDaoOfRedis saTokenDao) {
         return saTokenDao;
     }
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
index 04730349..b0887401 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
@@ -12,7 +12,7 @@ sa-token:
         slo-url: http://sso.stp.com:9000/sso/signout
     
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
-sa-token: #名字可以随意取
+sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
         password: 123456
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
index 8ae7b7d4..a7dc10c9 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 	
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
index 7bdd8aba..6031f505 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
@@ -16,7 +16,7 @@ public class SaConfig {
      * 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
      * */
     @Bean
-    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.redis}") SaTokenDaoOfRedis saTokenDao) {
+    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.dao.redis}") SaTokenDaoOfRedis saTokenDao) {
         return saTokenDao;
     }
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
index 2a4e01ab..d509817c 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
@@ -1,6 +1,6 @@
 # 端口
 server:
-    port: 9001
+    port: 9002
 
 # sa-token配置 
 sa-token: 
@@ -13,7 +13,7 @@ sa-token:
         is-slo: true
     
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
-sa-token: #名字可以随意取
+sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
         password: 123456
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
index 2750f9cd..17b2d5c2 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
@@ -10,7 +10,7 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.4.0</version>
+		<version>2.7.0</version>
 		<relativePath/>
 	</parent>
 	
@@ -26,6 +26,12 @@
 			<groupId>org.noear</groupId>
 			<artifactId>solon-api</artifactId>
 		</dependency>
+
+		<!-- Http 请求工具 -->
+		<dependency>
+			<groupId>org.noear</groupId>
+			<artifactId>forest-solon-plugin</artifactId>
+		</dependency>
 		
 		<!-- Sa-Token 权限认证, 在线文档：https://sa-token.cc/ -->
 		<dependency>
@@ -47,15 +53,7 @@
 			<artifactId>sa-token-redisx</artifactId>
 			<version>${sa-token.version}</version>
 		</dependency>
-		
-		<!-- Http 请求工具 -->
-		<dependency>
-		    <groupId>com.dtflys.forest</groupId>
-		    <artifactId>forest-solon-plugin</artifactId>
-		    <version>1.5.29</version>
-		</dependency>
-        
-		
+
 	</dependencies>
 	
 	
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaConfig.java
index e02d3be5..590f69f1 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaConfig.java
@@ -16,7 +16,7 @@ public class SaConfig {
      * 构建建 SaToken redis dao（如果不需要 redis；可以注释掉）
      * */
     @Bean
-    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.redis}") SaTokenDaoOfRedis saTokenDao) {
+    public SaTokenDao saTokenDaoInit(@Inject("${sa-token.dao.redis}") SaTokenDaoOfRedis saTokenDao) {
         return saTokenDao;
     }
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
index dff9616b..b64d298c 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
@@ -1,6 +1,6 @@
 # 端口
 server:
-    port: 9001
+    port: 9003
 
 # sa-token配置 
 sa-token: 
@@ -23,7 +23,7 @@ sa-token:
 
 
 # 配置 Sa-Token Dao（此处与SSO-Server端连接不同的Redis）
-sa-token: #名字可以随意取
+sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
         password: 123456
-- 
Gitee


From 54114ebac6381461154758940958bf83cf8256c1 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 11 May 2024 15:37:02 +0800
Subject: [PATCH 057/172] =?UTF-8?q?=E5=8D=87=E7=BA=A7=E4=BC=98=E5=8C=96?=
 =?UTF-8?q?=E4=B8=80=E4=B8=8B=20solon=20=E7=9B=B8=E5=85=B3=E9=9B=86?=
 =?UTF-8?q?=E6=88=90=20demo?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-demo/sa-token-demo-solon/pom.xml     |   2 +-
 .../src/main/java/com/pj/SaTokenDemoApp.java  |  10 ++
 .../src/main/java/com/pj/SysUser.java         |  64 +++++++++++
 .../java/com/pj/satoken/SaTokenConfigure.java |  18 ++--
 .../sa-token-demo-sso-server-solon/pom.xml    |   3 +-
 .../src/main/java/com/pj/SaSsoServerApp.java  |   9 +-
 .../src/main/java/com/pj/sso/SsoConfig.java   |   7 +-
 .../src/main/resources/app.yml                |   2 +-
 .../src/main/java/com/pj/SaSso1ClientApp.java |  10 ++
 .../src/main/resources/app.yml                |   8 +-
 .../sa-token-demo-sso2-client-solon/pom.xml   |   7 ++
 .../src/main/java/com/pj/SaConfig.java        |  15 +++
 .../src/main/java/com/pj/SaSso2ClientApp.java |  11 +-
 .../src/main/resources/app.yml                |   9 +-
 .../src/main/java/com/pj/SaSso3ClientApp.java |  11 +-
 .../java/com/pj/sso/SaSsoAutoConfigure.java   | 100 +++++++++---------
 .../src/main/java/com/pj/sso/SsoConfig.java   |   4 +-
 .../src/main/resources/app.yml                |  15 +--
 .../cn/dev33/satoken/solon/XPluginImp.java    |  13 ++-
 19 files changed, 230 insertions(+), 88 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java

diff --git a/sa-token-demo/sa-token-demo-solon/pom.xml b/sa-token-demo/sa-token-demo-solon/pom.xml
index 075101d1..ecd93e43 100644
--- a/sa-token-demo/sa-token-demo-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon/pom.xml
@@ -40,7 +40,7 @@
             <artifactId>sa-token-solon-plugin</artifactId>
             <version>${sa-token.version}</version>
         </dependency>
-		
+
 		<!-- sa-token整合redis (使用jdk默认序列化方式) -->
 		<dependency>
             <groupId>cn.dev33</groupId>
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
index 8bc72dfa..5d7eefef 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
@@ -2,6 +2,8 @@ package com.pj;
 
 
 import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.session.SaSession;
+import cn.dev33.satoken.stp.StpUtil;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -16,5 +18,13 @@ public class SaTokenDemoApp {
 	public static void main(String[] args) {
 		Solon.start(SaTokenDemoApp.class, args);
 		System.out.println("\n启动成功：Sa-Token配置如下：" + SaManager.getConfig());
+
+		SaSession session = StpUtil.getSessionByLoginId(10001);
+		session.set("name", "zhang");
+		session.set("user", new SysUser(10001, "张三"));
+
+		session = StpUtil.getSessionByLoginId(10001);
+		System.out.println(session.get("name"));
+		System.out.println(session.get("user"));
 	}
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java
new file mode 100644
index 00000000..4d564ed5
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java
@@ -0,0 +1,64 @@
+package com.pj;
+
+/**
+ * @author click33
+ * @since 2024/5/11
+ */
+public class SysUser {
+
+    public int id;
+
+    public String name;
+
+    public SysUser() {
+    }
+    public SysUser(int id, String name) {
+        this.id = id;
+        this.name = name;
+    }
+
+
+    /**
+     * 获取
+     *
+     * @return id
+     */
+    public int getId() {
+        return this.id;
+    }
+
+    /**
+     * 设置
+     *
+     * @param id
+     */
+    public void setId(int id) {
+        this.id = id;
+    }
+
+    /**
+     * 获取
+     *
+     * @return name
+     */
+    public String getName() {
+        return this.name;
+    }
+
+    /**
+     * 设置
+     *
+     * @param name
+     */
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    @Override
+    public String toString() {
+        return "SysUser{" +
+                "id=" + id +
+                ", name='" + name + '\'' +
+                '}';
+    }
+}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 1ca07d17..43d278c5 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -1,15 +1,13 @@
 package com.pj.satoken;
 
 
+import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.dao.SaTokenDaoOfRedis;
 import cn.dev33.satoken.solon.integration.SaTokenInterceptor;
+import com.pj.util.AjaxJson;
 import org.noear.solon.annotation.Bean;
 import org.noear.solon.annotation.Configuration;
-
-import com.pj.util.AjaxJson;
-
-import cn.dev33.satoken.context.SaHolder;
 import org.noear.solon.annotation.Inject;
 
 
@@ -59,9 +57,11 @@ public class SaTokenConfigure {
 					;
 				});
 	}
-//如果需要 redis dao，加这段代表
-//	@Bean
-//	public SaTokenDao saTokenDaoInit(@Inject("${sa-token-dao.redis}") SaTokenDaoOfRedis saTokenDao) {
-//		return saTokenDao;
-//	}
+
+	//如果需要 redis dao，加这段代表
+	@Bean
+	public SaTokenDao saTokenDaoInit(@Inject("${sa-token-dao.redis}") SaTokenDaoOfRedis saTokenDao) {
+		return saTokenDao;
+	}
+
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
index b08a1f46..5c7d651c 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
@@ -17,6 +17,7 @@
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
 		<sa-token.version>1.38.0</sa-token.version>
+		<solon.version>2.7.0</solon.version>
 	</properties>
 
 	<dependencies>
@@ -48,7 +49,7 @@
 			<artifactId>sa-token-redisx</artifactId>
 			<version>${sa-token.version}</version>
 		</dependency>
-        
+
 		<!-- 视图引擎（在前后端不分离模式下提供视图支持） -->
 		<dependency>
 			<groupId>org.noear</groupId>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/SaSsoServerApp.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/SaSsoServerApp.java
index 82fae5d6..f10580bc 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/SaSsoServerApp.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/SaSsoServerApp.java
@@ -1,6 +1,7 @@
 package com.pj;
 
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -9,7 +10,13 @@ public class SaSsoServerApp {
 
 	public static void main(String[] args) {
 		Solon.start(SaSsoServerApp.class, args);
-		System.out.println("\n------ Sa-Token-SSO 统一认证中心启动成功 ");
+
+		System.out.println();
+		System.out.println("---------------------- Solon Sa-Token SSO 统一认证中心启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getServerConfig());
+		System.out.println("统一认证登录地址：http://sa-sso-server.com:9000/sso/auth");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 	
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
index 0094cac4..4d8ed39c 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/java/com/pj/sso/SsoConfig.java
@@ -44,12 +44,13 @@ public class SsoConfig {
             return SaResult.error("登录失败！");
         };
 
-        // 配置 Http 请求处理器 （在模式三的单点注销功能下用到，如不需要可以注释掉）
+        // 配置 Http 请求处理器
         ssoServer.sendHttp = url -> {
             try {
-                // 发起 http 请求
                 System.out.println("------ 发起请求：" + url);
-                return Forest.get(url).executeAsString();
+                String resStr = Forest.get(url).executeAsString();
+                System.out.println("------ 请求结果：" + resStr);
+                return resStr;
             } catch (Exception e) {
                 e.printStackTrace();
                 return null;
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
index af035ff6..e895bbae 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/src/main/resources/app.yml
@@ -29,7 +29,7 @@ sa-token:
 sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
-        password: 123456
+#        password: 123456
         db: 1
         maxTotal: 200
         
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaSso1ClientApp.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaSso1ClientApp.java
index c3718225..8678b265 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaSso1ClientApp.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/java/com/pj/SaSso1ClientApp.java
@@ -1,6 +1,7 @@
 package com.pj;
 
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -15,6 +16,15 @@ public class SaSso1ClientApp {
 	public static void main(String[] args) {
 		Solon.start(SaSso1ClientApp.class, args);
 		System.out.println("\nSa-Token SSO模式一 Client端启动成功");
+
+		System.out.println();
+		System.out.println("---------------------- Solon Sa-Token SSO 模式一 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://s1.stp.com:9001");
+		System.out.println("测试访问应用端二: http://s2.stp.com:9001");
+		System.out.println("测试访问应用端三: http://s3.stp.com:9001");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 	
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
index b0887401..d2bb8247 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/src/main/resources/app.yml
@@ -6,16 +6,14 @@ server:
 sa-token: 
     # SSO-相关配置
     sso-client:
-        # SSO-Server端-单点登录授权地址 
-        auth-url: http://sso.stp.com:9000/sso/auth
-        # SSO-Server端-单点注销地址
-        slo-url: http://sso.stp.com:9000/sso/signout
+        # SSO-Server端 - 主机地址
+        server-url: http://sso.stp.com:9000
     
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
 sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
-        password: 123456
+#        password: 123456
         db: 1
         maxTotal: 200
         
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
index a7dc10c9..66048e33 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
@@ -47,6 +47,13 @@
 			<artifactId>sa-token-redisx</artifactId>
 			<version>${sa-token.version}</version>
 		</dependency>
+
+		<!-- Http 请求工具 -->
+		<dependency>
+			<groupId>org.noear</groupId>
+			<artifactId>forest-solon-plugin</artifactId>
+		</dependency>
+
 	</dependencies>
 	
 	
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
index 6031f505..03b64a33 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaConfig.java
@@ -2,8 +2,11 @@ package com.pj;
 
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.dao.SaTokenDaoOfRedis;
+import cn.dev33.satoken.sso.config.SaSsoClientConfig;
+import com.dtflys.forest.Forest;
 import org.noear.solon.annotation.Bean;
 import org.noear.solon.annotation.Configuration;
+import org.noear.solon.annotation.Init;
 import org.noear.solon.annotation.Inject;
 
 /**
@@ -19,4 +22,16 @@ public class SaConfig {
     public SaTokenDao saTokenDaoInit(@Inject("${sa-token.dao.redis}") SaTokenDaoOfRedis saTokenDao) {
         return saTokenDao;
     }
+
+    @Bean
+    public void configSso(SaSsoClientConfig ssoClient) {
+        // 配置Http请求处理器
+        ssoClient.sendHttp = url -> {
+            System.out.println("------ 发起请求：" + url);
+            String resStr = Forest.get(url).executeAsString();
+            System.out.println("------ 请求结果：" + resStr);
+            return resStr;
+        };
+    }
+
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaSso2ClientApp.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaSso2ClientApp.java
index 8e04700f..a0ac5dfd 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaSso2ClientApp.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/SaSso2ClientApp.java
@@ -1,6 +1,7 @@
 package com.pj;
 
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -9,7 +10,15 @@ public class SaSso2ClientApp {
 
 	public static void main(String[] args) {
 		Solon.start(SaSso2ClientApp.class, args);
-		System.out.println("\nSa-Token SSO模式二 Client端启动成功");
+
+		System.out.println();
+		System.out.println("---------------------- Solon Sa-Token SSO 模式二 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9002");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9002");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9002");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 	
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
index d509817c..33875b88 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/resources/app.yml
@@ -6,17 +6,20 @@ server:
 sa-token: 
     # SSO-相关配置
     sso-client:
-        # SSO-Server端 统一认证地址 
-        auth-url: http://sa-sso-server.com:9000/sso/auth
+        # SSO-Server端 主机地址
+        server-url: http://sa-sso-server.com:9000
         # auth-url: http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
         # 是否打开单点注销接口
         is-slo: true
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
     
 # 配置 Sa-Token 单独使用的Redis连接 （此处需要和SSO-Server端连接同一个Redis）
 sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
-        password: 123456
+#        password: 123456
         db: 1
         maxTotal: 200
         
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
index f30e4a25..4f72b3e7 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
@@ -1,5 +1,6 @@
 package com.pj;
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -8,7 +9,15 @@ public class SaSso3ClientApp {
 
 	public static void main(String[] args) {
 		Solon.start(SaSso3ClientApp.class, args);
-		System.out.println("\nSa-Token SSO模式三 Client端启动成功");
+
+		System.out.println();
+		System.out.println("---------------------- Sa-Token SSO 模式三 Client 端启动成功 ----------------------");
+		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
+		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9003");
+		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9003");
+		System.out.println("测试访问应用端三: http://sa-sso-client3.com:9003");
+		System.out.println("测试前需要根据官网文档修改hosts文件，测试账号密码：sa / 123456");
+		System.out.println();
 	}
 
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java
index 2d625b4e..f7795635 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java
@@ -1,50 +1,50 @@
-package com.pj.sso;
-
-import cn.dev33.satoken.sso.SaSsoManager;
-import cn.dev33.satoken.sso.config.SaSsoClientConfig;
-import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
-import cn.dev33.satoken.sso.template.SaSsoClientTemplate;
-import org.noear.solon.annotation.Bean;
-import org.noear.solon.annotation.Condition;
-import org.noear.solon.annotation.Configuration;
-import org.noear.solon.annotation.Inject;
-
-/**
- * solon 的 sso 适配，在 cn.dev33:sa-token-solon-plugin:1.34.0 里还没有。（临时加这个类）
- *
- * //todo: 如果使用 org.noear:sa-token-solon-plugin:xxx ，则需要删掉这个类
- *
- * @author noear
- * @since 2.0
- */
-@Condition(onClass = SaSsoManager.class)
-@Configuration
-public class SaSsoAutoConfigure {
-    /**
-     * 获取 SSO 配置Bean
-     * */
-    @Bean
-    public SaSsoClientConfig getConfig(@Inject(value = "${sa-token.sso-client}",required = false) SaSsoClientConfig ssoConfig) {
-        return ssoConfig;
-    }
-
-    /**
-     * 注入 Sa-Token-SSO 配置Bean
-     *
-     * @param saSsoConfig 配置对象
-     */
-    @Bean
-    public void setSaSsoConfig(@Inject(required = false) SaSsoClientConfig saSsoConfig) {
-        SaSsoManager.setClientConfig(saSsoConfig);
-    }
-
-    /**
-     * 注入 Sa-Token-SSO 单点登录模块 Bean
-     *
-     * @param ssoClientTemplate ssoClientTemplate对象
-     */
-    @Bean
-    public void setSaSsoClientTemplate(@Inject(required = false) SaSsoClientTemplate ssoClientTemplate) {
-        SaSsoClientProcessor.instance.ssoClientTemplate = ssoClientTemplate;
-    }
-}
+//package com.pj.sso;
+//
+//import cn.dev33.satoken.sso.SaSsoManager;
+//import cn.dev33.satoken.sso.config.SaSsoClientConfig;
+//import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
+//import cn.dev33.satoken.sso.template.SaSsoClientTemplate;
+//import org.noear.solon.annotation.Bean;
+//import org.noear.solon.annotation.Condition;
+//import org.noear.solon.annotation.Configuration;
+//import org.noear.solon.annotation.Inject;
+//
+///**
+// * solon 的 sso 适配，在 cn.dev33:sa-token-solon-plugin:1.34.0 里还没有。（临时加这个类）
+// *
+// * //todo: 如果使用 org.noear:sa-token-solon-plugin:xxx ，则需要删掉这个类
+// *
+// * @author noear
+// * @since 2.0
+// */
+//@Condition(onClass = SaSsoManager.class)
+//@Configuration
+//public class SaSsoAutoConfigure {
+//    /**
+//     * 获取 SSO 配置Bean
+//     * */
+//    @Bean
+//    public SaSsoClientConfig getConfig(@Inject(value = "${sa-token.sso-client}",required = false) SaSsoClientConfig ssoConfig) {
+//        return ssoConfig;
+//    }
+//
+//    /**
+//     * 注入 Sa-Token-SSO 配置Bean
+//     *
+//     * @param saSsoConfig 配置对象
+//     */
+//    @Bean
+//    public void setSaSsoConfig(@Inject(required = false) SaSsoClientConfig saSsoConfig) {
+//        SaSsoManager.setClientConfig(saSsoConfig);
+//    }
+//
+//    /**
+//     * 注入 Sa-Token-SSO 单点登录模块 Bean
+//     *
+//     * @param ssoClientTemplate ssoClientTemplate对象
+//     */
+//    @Bean
+//    public void setSaSsoClientTemplate(@Inject(required = false) SaSsoClientTemplate ssoClientTemplate) {
+//        SaSsoClientProcessor.instance.ssoClientTemplate = ssoClientTemplate;
+//    }
+//}
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SsoConfig.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SsoConfig.java
index bb8a0a85..1f656d62 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SsoConfig.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SsoConfig.java
@@ -16,7 +16,9 @@ public class SsoConfig {
         // 配置Http请求处理器
         ssoClient.sendHttp = url -> {
             System.out.println("------ 发起请求：" + url);
-            return Forest.get(url).executeAsString();
+            String resStr = Forest.get(url).executeAsString();
+            System.out.println("------ 请求结果：" + resStr);
+            return resStr;
         };
     }
 }
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
index b64d298c..7bfeb9d3 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/resources/app.yml
@@ -6,27 +6,22 @@ server:
 sa-token: 
     # SSO-相关配置
     sso-client:
-        # SSO-Server端 统一认证地址 
-        auth-url: http://sa-sso-server.com:9000/sso/auth
+        # SSO-Server端 主机地址
+        server-url: http://sa-sso-server.com:9000
         # 使用Http请求校验ticket 
         is-http: true
-        # SSO-Server端 ticket校验地址 
-        check-ticket-url: http://sa-sso-server.com:9000/sso/checkTicket
         # 打开单点注销功能 
         is-slo: true
-        # 单点注销地址 
-        slo-url: http://sa-sso-server.com:9000/sso/signout
+    sign:
         # 接口调用秘钥 
-        secretkey: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
-        # SSO-Server端 查询userinfo地址 
-        userinfo-url: http://sa-sso-server.com:9000/sso/userinfo
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
 
 
 # 配置 Sa-Token Dao（此处与SSO-Server端连接不同的Redis）
 sa-token.dao: #名字可以随意取
     redis:
         server: "localhost:6379"
-        password: 123456
+#        password: 123456
         db: 2
         maxTotal: 200
         
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
index 1f8dc60d..4cd41f73 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
@@ -21,12 +21,15 @@ import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.context.second.SaTokenSecondContextCreator;
 import cn.dev33.satoken.dao.SaTokenDao;
+import cn.dev33.satoken.httpauth.digest.SaHttpDigestTemplate;
+import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
 import cn.dev33.satoken.json.SaJsonTemplate;
 import cn.dev33.satoken.listener.SaTokenEventCenter;
 import cn.dev33.satoken.listener.SaTokenListener;
 import cn.dev33.satoken.log.SaLog;
 import cn.dev33.satoken.same.SaSameTemplate;
 import cn.dev33.satoken.sign.SaSignTemplate;
+import cn.dev33.satoken.solon.json.SaJsonTemplateForSnack3;
 import cn.dev33.satoken.solon.model.SaContextForSolon;
 import cn.dev33.satoken.solon.oauth2.SaOAuth2AutoConfigure;
 import cn.dev33.satoken.solon.sso.SaSsoAutoConfigure;
@@ -64,6 +67,9 @@ public class XPluginImp implements Plugin {
         // 注入上下文Bean
         SaManager.setSaTokenContext(new SaContextForSolon());
 
+        // 注入JSON解析器Bean
+        SaManager.setSaJsonTemplate(new SaJsonTemplateForSnack3());
+
         //注入配置Bean
         SaTokenConfig saTokenConfig = Solon.cfg().getBean("sa-token", SaTokenConfig.class);
         if (saTokenConfig != null) {
@@ -89,7 +95,6 @@ public class XPluginImp implements Plugin {
             SaTokenEventCenter.registerListener(sl);
         });
 
-
         // 注入权限认证 Bean
         context.getBeanAsync(StpInterface.class, bean -> {
             SaManager.setStpInterface(bean);
@@ -115,6 +120,11 @@ public class XPluginImp implements Plugin {
             SaHttpBasicUtil.saHttpBasicTemplate = bean;
         });
 
+        // Sa-Token Http Digest 认证模块 Bean
+        context.getBeanAsync(SaHttpDigestTemplate.class, bean -> {
+            SaHttpDigestUtil.saHttpDigestTemplate = bean;
+        });
+
         // Sa-Token JSON 转换器 Bean
         context.getBeanAsync(SaJsonTemplate.class, bean -> {
             SaManager.setSaJsonTemplate(bean);
@@ -129,5 +139,6 @@ public class XPluginImp implements Plugin {
         context.getBeanAsync(StpLogic.class, bean -> {
             StpUtil.setStpLogic(bean);
         });
+
     }
 }
\ No newline at end of file
-- 
Gitee


From dd533fba8e47f5961b76b53db0ea468248e4f475 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 11 May 2024 15:56:56 +0800
Subject: [PATCH 058/172] =?UTF-8?q?/sso/logout=20=E6=8E=A5=E5=8F=A3=20self?=
 =?UTF-8?q?=20=E6=A0=BC=E5=BC=8F=E8=AE=BE=E7=BD=AE=E5=93=8D=E5=BA=94?=
 =?UTF-8?q?=E5=A4=B4=EF=BC=8C=E4=BB=A5=E9=80=82=E9=85=8D=20solon=20?=
 =?UTF-8?q?=E4=B8=8B=E9=9B=86=E6=88=90=20sso=20=E6=8F=92=E4=BB=B6=E5=8F=AF?=
 =?UTF-8?q?=E4=BB=A5=E6=AD=A3=E5=B8=B8=E8=B7=B3=E8=BD=AC=E8=B7=AF=E5=BE=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/SaSso3ClientApp.java |  2 +-
 .../java/com/pj/sso/SaSsoAutoConfigure.java   | 50 -------------------
 .../sso/processor/SaSsoProcessorHelper.java   |  1 +
 3 files changed, 2 insertions(+), 51 deletions(-)
 delete mode 100644 sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java

diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
index 4f72b3e7..b152c52f 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/SaSso3ClientApp.java
@@ -11,7 +11,7 @@ public class SaSso3ClientApp {
 		Solon.start(SaSso3ClientApp.class, args);
 
 		System.out.println();
-		System.out.println("---------------------- Sa-Token SSO 模式三 Client 端启动成功 ----------------------");
+		System.out.println("---------------------- Solon Sa-Token SSO 模式三 Client 端启动成功 ----------------------");
 		System.out.println("配置信息：" + SaSsoManager.getClientConfig());
 		System.out.println("测试访问应用端一: http://sa-sso-client1.com:9003");
 		System.out.println("测试访问应用端二: http://sa-sso-client2.com:9003");
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java
deleted file mode 100644
index f7795635..00000000
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/src/main/java/com/pj/sso/SaSsoAutoConfigure.java
+++ /dev/null
@@ -1,50 +0,0 @@
-//package com.pj.sso;
-//
-//import cn.dev33.satoken.sso.SaSsoManager;
-//import cn.dev33.satoken.sso.config.SaSsoClientConfig;
-//import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
-//import cn.dev33.satoken.sso.template.SaSsoClientTemplate;
-//import org.noear.solon.annotation.Bean;
-//import org.noear.solon.annotation.Condition;
-//import org.noear.solon.annotation.Configuration;
-//import org.noear.solon.annotation.Inject;
-//
-///**
-// * solon 的 sso 适配，在 cn.dev33:sa-token-solon-plugin:1.34.0 里还没有。（临时加这个类）
-// *
-// * //todo: 如果使用 org.noear:sa-token-solon-plugin:xxx ，则需要删掉这个类
-// *
-// * @author noear
-// * @since 2.0
-// */
-//@Condition(onClass = SaSsoManager.class)
-//@Configuration
-//public class SaSsoAutoConfigure {
-//    /**
-//     * 获取 SSO 配置Bean
-//     * */
-//    @Bean
-//    public SaSsoClientConfig getConfig(@Inject(value = "${sa-token.sso-client}",required = false) SaSsoClientConfig ssoConfig) {
-//        return ssoConfig;
-//    }
-//
-//    /**
-//     * 注入 Sa-Token-SSO 配置Bean
-//     *
-//     * @param saSsoConfig 配置对象
-//     */
-//    @Bean
-//    public void setSaSsoConfig(@Inject(required = false) SaSsoClientConfig saSsoConfig) {
-//        SaSsoManager.setClientConfig(saSsoConfig);
-//    }
-//
-//    /**
-//     * 注入 Sa-Token-SSO 单点登录模块 Bean
-//     *
-//     * @param ssoClientTemplate ssoClientTemplate对象
-//     */
-//    @Bean
-//    public void setSaSsoClientTemplate(@Inject(required = false) SaSsoClientTemplate ssoClientTemplate) {
-//        SaSsoClientProcessor.instance.ssoClientTemplate = ssoClientTemplate;
-//    }
-//}
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoProcessorHelper.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoProcessorHelper.java
index 0fafb624..5aff4582 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoProcessorHelper.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoProcessorHelper.java
@@ -47,6 +47,7 @@ public class SaSsoProcessorHelper {
 		String back = req.getParam(paramName.back);
 		if(SaFoxUtil.isNotEmpty(back)) {
 			if(back.equals(SaSsoConsts.SELF)) {
+				res.setHeader("Content-Type", "text/html; charset=utf-8");
 				return "<script>if(document.referrer != location.href){ location.replace(document.referrer || '/'); }</script>";
 			}
 			return res.redirect(back);
-- 
Gitee


From 4be4ee54c23db1d77b9a6166755d243e12aba079 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 11 May 2024 16:17:25 +0800
Subject: [PATCH 059/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86?=
 =?UTF-8?q?=E5=9C=BA=E6=99=AF=E4=B8=8B=E4=B8=8D=E8=83=BD=E6=AD=A3=E5=B8=B8?=
 =?UTF-8?q?=E5=88=9B=E5=BB=BA=20token-session=20=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 0d5a5977..db36ba9e 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -1198,6 +1198,9 @@ public class StpLogic {
 				// 如果是 Token-Session，则使用对用 token 的有效期，使 token 和 token-session 保持相同ttl，同步失效
 				if(SaTokenConsts.SESSION_TYPE__TOKEN.equals(session.getType())) {
 					timeout = getTokenTimeout(session.getToken());
+					if(timeout == SaTokenDao.NOT_VALUE_EXPIRE) {
+						timeout = getConfigOrGlobal().getTimeout();
+					}
 				} else {
 					// 否则使用全局配置的 timeout
 					timeout = getConfigOrGlobal().getTimeout();
-- 
Gitee


From 1850130e11603cde3cbdfd44ca0931c42ef47f21 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 11 May 2024 17:11:26 +0800
Subject: [PATCH 060/172] =?UTF-8?q?sa-token-sso=20model=20=E7=B1=BB?=
 =?UTF-8?q?=E5=A2=9E=E5=8A=A0=20implements=20Serializable=EF=BC=8C?=
 =?UTF-8?q?=E4=BB=A5=E4=BE=BF=E5=AE=8C=E6=88=90=E5=BA=8F=E5=88=97=E5=8C=96?=
 =?UTF-8?q?=E5=AD=98=E5=82=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../cn/dev33/satoken/sso/model/SaCheckTicketResult.java     | 6 +++++-
 .../java/cn/dev33/satoken/sso/model/SaSsoClientModel.java   | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java
index 890d203d..d859bd79 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaCheckTicketResult.java
@@ -17,13 +17,17 @@ package cn.dev33.satoken.sso.model;
 
 import cn.dev33.satoken.util.SaResult;
 
+import java.io.Serializable;
+
 /**
  * 校验 ticket 返回 loginId 等结果的参数封装
  *
  * @author click33
  * @since 1.38.0
  */
-public class SaCheckTicketResult {
+public class SaCheckTicketResult implements Serializable {
+
+    private static final long serialVersionUID = 1406115065849845073L;
 
     /** 账号id */
     public Object loginId;
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
index 81e51ca3..f6616971 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/model/SaSsoClientModel.java
@@ -18,13 +18,17 @@ package cn.dev33.satoken.sso.model;
 
 import cn.dev33.satoken.sso.util.SaSsoConsts;
 
+import java.io.Serializable;
+
 /**
  * Sa-Token SSO Model
  *
  * @author click33
  * @since 1.38.0
  */
-public class SaSsoClientModel {
+public class SaSsoClientModel implements Serializable {
+
+    private static final long serialVersionUID = 1406115065849845073L;
 
     /*
      * 只能记录模式三登录的 client 信息，模式一和模式二的信息即使记录上，也无法完成单点注销操作，遂不记录
-- 
Gitee


From 1c05958d51d6876154450e8e47f352e0cd620269 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 11 May 2024 17:11:41 +0800
Subject: [PATCH 061/172] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=20solon=20=E7=9B=B8?=
 =?UTF-8?q?=E5=85=B3=20demo=20=E6=A1=88=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/SaTokenDemoApp.java  | 10 ---
 .../src/main/java/com/pj/SysUser.java         | 64 -------------------
 .../src/main/resources/app.yml                |  2 +-
 3 files changed, 1 insertion(+), 75 deletions(-)
 delete mode 100644 sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java

diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
index 5d7eefef..8bc72dfa 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SaTokenDemoApp.java
@@ -2,8 +2,6 @@ package com.pj;
 
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.session.SaSession;
-import cn.dev33.satoken.stp.StpUtil;
 import org.noear.solon.Solon;
 import org.noear.solon.annotation.SolonMain;
 
@@ -18,13 +16,5 @@ public class SaTokenDemoApp {
 	public static void main(String[] args) {
 		Solon.start(SaTokenDemoApp.class, args);
 		System.out.println("\n启动成功：Sa-Token配置如下：" + SaManager.getConfig());
-
-		SaSession session = StpUtil.getSessionByLoginId(10001);
-		session.set("name", "zhang");
-		session.set("user", new SysUser(10001, "张三"));
-
-		session = StpUtil.getSessionByLoginId(10001);
-		System.out.println(session.get("name"));
-		System.out.println(session.get("user"));
 	}
 }
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java
deleted file mode 100644
index 4d564ed5..00000000
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/SysUser.java
+++ /dev/null
@@ -1,64 +0,0 @@
-package com.pj;
-
-/**
- * @author click33
- * @since 2024/5/11
- */
-public class SysUser {
-
-    public int id;
-
-    public String name;
-
-    public SysUser() {
-    }
-    public SysUser(int id, String name) {
-        this.id = id;
-        this.name = name;
-    }
-
-
-    /**
-     * 获取
-     *
-     * @return id
-     */
-    public int getId() {
-        return this.id;
-    }
-
-    /**
-     * 设置
-     *
-     * @param id
-     */
-    public void setId(int id) {
-        this.id = id;
-    }
-
-    /**
-     * 获取
-     *
-     * @return name
-     */
-    public String getName() {
-        return this.name;
-    }
-
-    /**
-     * 设置
-     *
-     * @param name
-     */
-    public void setName(String name) {
-        this.name = name;
-    }
-
-    @Override
-    public String toString() {
-        return "SysUser{" +
-                "id=" + id +
-                ", name='" + name + '\'' +
-                '}';
-    }
-}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/resources/app.yml b/sa-token-demo/sa-token-demo-solon/src/main/resources/app.yml
index 630631a7..e3ecff99 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/resources/app.yml
+++ b/sa-token-demo/sa-token-demo-solon/src/main/resources/app.yml
@@ -23,7 +23,7 @@ sa-token:
 sa-token-dao: #名字可以随意取
     redis:
         server: "localhost:6379"
-        password: 123456
+#        password: 123456
         db: 1
         maxTotal: 200
         
-- 
Gitee


From 1a62c391ea56d2decc84b4fcaf778e197c48f2c9 Mon Sep 17 00:00:00 2001
From: noear <noear@live.cn>
Date: Sat, 11 May 2024 17:39:58 +0800
Subject: [PATCH 062/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20solon=20=E7=9B=B8?=
 =?UTF-8?q?=E5=85=B3=E7=9A=84=20SaTokenDaoOfRedisJson=20=E5=BA=8F=E5=88=97?=
 =?UTF-8?q?=E5=8C=96=E5=A4=84=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../main/java/com/pj/satoken/SaTokenConfigure.java  |  3 ++-
 .../cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java | 13 ++-----------
 .../satoken/solon/dao/SaTokenDaoOfRedisJson.java    | 12 ++----------
 3 files changed, 6 insertions(+), 22 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 43d278c5..9951566e 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -4,6 +4,7 @@ package com.pj.satoken;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.dao.SaTokenDaoOfRedis;
+import cn.dev33.satoken.dao.SaTokenDaoOfRedisJson;
 import cn.dev33.satoken.solon.integration.SaTokenInterceptor;
 import com.pj.util.AjaxJson;
 import org.noear.solon.annotation.Bean;
@@ -60,7 +61,7 @@ public class SaTokenConfigure {
 
 	//如果需要 redis dao，加这段代表
 	@Bean
-	public SaTokenDao saTokenDaoInit(@Inject("${sa-token-dao.redis}") SaTokenDaoOfRedis saTokenDao) {
+	public SaTokenDao saTokenDaoInit(@Inject("${sa-token-dao.redis}") SaTokenDaoOfRedisJson saTokenDao) {
 		return saTokenDao;
 	}
 
diff --git a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
index 525bd81e..2fd2e21d 100644
--- a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
+++ b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
@@ -48,16 +48,6 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
 
     }
 
-    @Override
-    public SaSession getSession(String sessionId) {
-        Object obj = getObject(sessionId);
-        if (obj == null) {
-            return null;
-        }
-        return ONode.deserialize(obj.toString(), SaSessionForJson.class);
-    }
-
-
     /**
      * 获取Value，如无返空
      */
@@ -117,7 +107,8 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
      */
     @Override
     public Object getObject(String key) {
-        return get(key);
+        String value = get(key);
+        return ONode.deserialize(value);
     }
 
     /**
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
index 0d3c0c97..45ec4f94 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
@@ -49,15 +49,6 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
 
     }
 
-    @Override
-    public SaSession getSession(String sessionId) {
-        Object obj = getObject(sessionId);
-        if (obj == null) {
-            return null;
-        }
-        return ONode.deserialize(obj.toString(), SaSessionForJson.class);
-    }
-
 
     /**
      * 获取Value，如无返空
@@ -118,7 +109,8 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
      */
     @Override
     public Object getObject(String key) {
-        return get(key);
+        String value = get(key);
+        return ONode.deserialize(value);
     }
 
     /**
-- 
Gitee


From 81709bcef8ff917044bda1f0e8b88f71f7dcc9a9 Mon Sep 17 00:00:00 2001
From: noear <noear@live.cn>
Date: Sat, 11 May 2024 17:55:27 +0800
Subject: [PATCH 063/172] =?UTF-8?q?=E5=8F=96=E6=B6=88=20SaSessionForJson?=
 =?UTF-8?q?=20(=E5=8F=91=E7=8E=B0=E6=B2=A1=E5=BF=85=E8=A6=81=E4=BA=86)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java   | 2 ++
 .../main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java  | 2 +-
 .../main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java | 2 ++
 .../java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java | 3 +--
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
index ce38d570..680230f9 100644
--- a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
+++ b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
@@ -19,12 +19,14 @@ import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.util.SaFoxUtil;
 import org.noear.snack.ONode;
 
+//todo: 不能删；为保持与旧的序列化兼容
 /**
  * Snack3 定制版 SaSession，重写类型转换API
  * 
  * @author noear
  * @since 1.34.0
  */
+@Deprecated
 public class SaSessionForJson extends SaSession {
 
 	private static final long serialVersionUID = -7600983549653130681L;
diff --git a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
index 2fd2e21d..3644fc04 100644
--- a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
+++ b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaTokenDaoOfRedisJson.java
@@ -44,7 +44,7 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
         redisBucket = redisClient.getBucket();
 
         // 重写 SaSession 生成策略
-        SaStrategy.instance.createSession = (sessionId) -> new SaSessionForJson(sessionId);
+        //SaStrategy.instance.createSession = (sessionId) -> new SaSessionForJson(sessionId);
 
     }
 
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
index 4d2aa9ee..ced5e993 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
@@ -19,12 +19,14 @@ import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.util.SaFoxUtil;
 import org.noear.snack.ONode;
 
+//todo: 不能删；为保持与旧的序列化兼容
 /**
  * Snack3 定制版 SaSession，重写类型转换API
  * 
  * @author noear
  * @since 1.12
  */
+@Deprecated
 public class SaSessionForJson extends SaSession {
 
 	private static final long serialVersionUID = -7600983549653130681L;
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
index 45ec4f94..4b20b36a 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaTokenDaoOfRedisJson.java
@@ -45,8 +45,7 @@ public class SaTokenDaoOfRedisJson implements SaTokenDao {
         redisBucket = redisClient.getBucket();
 
         // 重写 SaSession 生成策略
-        SaStrategy.instance.createSession = (sessionId) -> new SaSessionForJson(sessionId);
-
+        //SaStrategy.instance.createSession = (sessionId) -> new SaSessionForJson(sessionId);
     }
 
 
-- 
Gitee


From 8f467bbc9c20035d48ffee772c452379fac36381 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 12 May 2024 08:59:02 +0800
Subject: [PATCH 064/172] =?UTF-8?q?StpUtil.getTokenSession()=20=E6=97=B6?=
 =?UTF-8?q?=E8=8B=A5=E6=9C=AA=E6=8F=90=E4=BE=9B=20token=20=E5=B0=86?=
 =?UTF-8?q?=E7=9B=B4=E6=8E=A5=E6=8A=9B=E5=87=BA=E5=BC=82=E5=B8=B8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/error/SaErrorCode.java     | 3 +++
 .../src/main/java/cn/dev33/satoken/stp/StpLogic.java          | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/error/SaErrorCode.java b/sa-token-core/src/main/java/cn/dev33/satoken/error/SaErrorCode.java
index a6e8cd8b..5449d952 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/error/SaErrorCode.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/error/SaErrorCode.java
@@ -125,6 +125,9 @@ public interface SaErrorCode {
 	/** 获取 SaSession 时提供的 SessionId 为空 */
 	int CODE_11072 = 11072;
 
+	/** 获取 Token-Session 时提供的 token 为空 */
+	int CODE_11073 = 11073;
+
 
 	// ------------ 
 	
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index db36ba9e..3b6b4da0 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -1296,7 +1296,7 @@ public class StpLogic {
 	 */
 	public SaSession getTokenSessionByToken(String tokenValue, boolean isCreate) {
 		if(SaFoxUtil.isEmpty(tokenValue)) {
-			throw new SaTokenException("Token-Session 获取失败：token 不能为空");
+			throw new SaTokenException("Token-Session 获取失败：token 为空").setCode(SaErrorCode.CODE_11073);
 		}
 		return getSessionBySessionId(splicingKeyTokenSession(tokenValue), isCreate, null, session -> {
 			// 这里是该 Token-Session 首次创建时才会被执行的方法：
@@ -1333,7 +1333,7 @@ public class StpLogic {
 		// 2、如果前端根本没有提供 Token ，则直接返回 null
 		String tokenValue = getTokenValue();
 		if(SaFoxUtil.isEmpty(tokenValue)) {
-			return null;
+			throw new SaTokenException("Token-Session 获取失败：token 为空").setCode(SaErrorCode.CODE_11073);
 		}
 
 		// 3、代码至此：tokenSessionCheckLogin 校验通过、且 Token 有值
-- 
Gitee


From 35cb81085ca039b73f8c8f008f8c46e1f2651e63 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 12 May 2024 12:40:05 +0800
Subject: [PATCH 065/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20sa-token-sso=20?=
 =?UTF-8?q?=E9=83=A8=E5=88=86=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/h5/H5Controller.java          |  2 +-
 .../src/main/java/com/pj/h5/H5Controller.java          |  2 +-
 sa-token-doc/doc.html                                  |  6 +++---
 sa-token-doc/sso/sso-h5.md                             |  2 +-
 .../satoken/sso/processor/SaSsoClientProcessor.java    | 10 +++++-----
 .../satoken/sso/processor/SaSsoServerProcessor.java    |  4 ++--
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/h5/H5Controller.java b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/h5/H5Controller.java
index c169b68a..8ef49dd1 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/h5/H5Controller.java
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/src/main/java/com/pj/h5/H5Controller.java
@@ -34,7 +34,7 @@ public class H5Controller implements Render {
 	// 根据ticket进行登录 
 	@Mapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoClientProcessor.instance.checkTicketByMode2Or3(ticket, "/sso/doLoginByTicket");
+		Object loginId = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
 		if(loginId != null) {
 			StpUtil.login(loginId);
 			return SaResult.data(StpUtil.getTokenValue());
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
index 64f72e13..73d7a158 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
@@ -33,7 +33,7 @@ public class H5Controller {
 	// 根据ticket进行登录 
 	@RequestMapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoClientProcessor.instance.checkTicketByMode2Or3(ticket, "/sso/doLoginByTicket");
+		Object loginId = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
 		if(loginId != null) {
 			StpUtil.login(loginId);
 			return SaResult.data(StpUtil.getTokenValue());
diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 965480b6..22e5ff9f 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -165,9 +165,9 @@
 		</script>
 		
 		<!--  -->
-		<script src="./static/docsify-plugin.js?v=6"></script>
-		<script src="./static/is-star-plugin.js?v=6"></script>
-		<script src="./static/is-fill-in-wj-plugin.js?v=6"></script>
+		<script src="./static/docsify-plugin.js?v=7"></script>
+		<script src="./static/is-star-plugin.js?v=7"></script>
+		<script src="./static/is-fill-in-wj-plugin.js?v=7"></script>
 		<script>
 			var saTokenTopVersion = '1.38.0';	// Sa-Token最新版本 
 			var name = '<img style="width: 60px; height: 60px; vertical-align: middle;" src="logo.png" alt="logo" /> ';
diff --git a/sa-token-doc/sso/sso-h5.md b/sa-token-doc/sso/sso-h5.md
index 22d8d8a3..021caf6c 100644
--- a/sa-token-doc/sso/sso-h5.md
+++ b/sa-token-doc/sso/sso-h5.md
@@ -30,7 +30,7 @@ public class H5Controller {
 	// 根据ticket进行登录 
 	@RequestMapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoClientProcessor.instance.checkTicketByMode2Or3(ticket, "/sso/doLoginByTicket");
+		Object loginId = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
 		if(loginId != null) {
 			StpUtil.login(loginId);
 			return SaResult.data(StpUtil.getTokenValue());
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
index aef2e26e..672415c5 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoClientProcessor.java
@@ -123,7 +123,7 @@ public class SaSsoClientProcessor {
 			return res.redirect(serverAuthUrl);
 		} else {
 			// 1、校验ticket，获取 loginId
-			SaCheckTicketResult ctr = checkTicketByMode2Or3(ticket, apiName.ssoLogin);
+			SaCheckTicketResult ctr = checkTicket(ticket, apiName.ssoLogin);
 
 			// 2、如果开发者自定义了ticket结果值处理函数，则使用自定义的函数
 			if(cfg.ticketResultHandle != null) {
@@ -193,7 +193,7 @@ public class SaSsoClientProcessor {
 		SaResult result = ssoClientTemplate.request(url);
 
 		// 校验响应状态码
-		if(SaResult.CODE_SUCCESS == result.getCode()) {
+		if(result.getCode() != null && SaResult.CODE_SUCCESS == result.getCode()) {
 			// 极端场景下，sso-server 中心的单点注销可能并不会通知到此 client 端，所以这里需要再补一刀
 			if(stpLogic.isLogin()) {
 				stpLogic.logout();
@@ -240,12 +240,12 @@ public class SaSsoClientProcessor {
 	// 工具方法
 
 	/**
-	 * 封装：校验ticket，取出loginId，如果 ticket 无效则抛出异常
+	 * 封装：校验ticket，取出loginId，如果 ticket 无效则抛出异常 （适用于模式二或模式三）
 	 * @param ticket ticket码
-	 * @param currUri 当前路由的uri，用于计算单点注销回调地址
+	 * @param currUri 当前路由的uri，用于计算单点注销回调地址 （如果是使用模式二，可以填写null）
 	 * @return loginId
 	 */
-	public SaCheckTicketResult checkTicketByMode2Or3(String ticket, String currUri) {
+	public SaCheckTicketResult checkTicket(String ticket, String currUri) {
 		SaSsoClientConfig cfg = ssoClientTemplate.getClientConfig();
 		ApiName apiName = ssoClientTemplate.apiName;
 		ParamName paramName = ssoClientTemplate.paramName;
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
index a17ff711..359092a8 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
@@ -220,8 +220,8 @@ public class SaSsoServerProcessor {
 			return ssoSignoutByUserVisit();
 		}
 
-		// SSO-Server端：单点注销 [Client调用式]  (带loginId参数 & isHttp=true)
-		if(cfg.getIsHttp() && cfg.getIsSlo() && req.hasParam(paramName.loginId)) {
+		// SSO-Server端：单点注销 [Client调用式]  (带loginId参数)
+		if(cfg.getIsSlo() && req.hasParam(paramName.loginId)) {
 			return ssoSignoutByClientHttp();
 		}
 
-- 
Gitee


From bd92fbbed964983d3b7ed0d72ee5320de5b0569d Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 12 May 2024 14:33:51 +0800
Subject: [PATCH 066/172] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?=E6=97=A5=E5=BF=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md | 56 ++++++++++++++++-----------------
 sa-token-doc/up/basic-auth.md   |  2 +-
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 31214867..cc7b9455 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -2,45 +2,45 @@
 
 ### v1.38.0 @2023-10-18
 - sa-token-core：
-	- 修复：修复 StpUtil.getSessionByLoginId(xx) 参数为 null 时创建无效 SaSession 的 bug。
-	- 优化：在 SpringBoot 3.x 版本下错误的引入依赖时将得到启动失败的提示。 （感谢`Uncarbon`提交的pr）
-	- 优化：进一步优化权限校验算法，hasXxx API 只会返回true或false，不再抛出异常。
-	- 重构：InvalidContextException 更名为 SaTokenContextException。 **[已做向下兼容处理]**
-	- 重构：彻底删除 NotPermissionException 异常中的 getCode() 方法。 **[过期API清理]**
-	- 重构：重构 SaTokenException 类方法 throwBy->notTrue、throwByNull->notEmpty。**[已做向下兼容处理]**
-	- 重构：StpUtil.getSessionBySessionId 提供的 SessionId 为空时将直接抛出异常，而不是再返回null。**[不向下兼容]**
-	- 新增：新增 Http Digest 认证模块简单实现。	**[重要]**
-	- 重构：更换 HttpBasic 认证模块包名。	**[已做向下兼容处理]**
+	- 修复：修复 `StpUtil.getSessionByLoginId(xx)` 参数为 null 时创建无效 `SaSession` 的 bug。
+	- 优化：在 `SpringBoot 3.x` 版本下错误的引入依赖时将得到启动失败的提示。 （感谢`Uncarbon`提交的pr）
+	- 优化：进一步优化权限校验算法，hasXxx API 只会返回 true 或 false，不再抛出异常。
+	- 重构：`InvalidContextException` 更名为 `SaTokenContextException`。 **[已做向下兼容处理]**
+	- 重构：彻底删除 `NotPermissionException` 异常中的 `getCode()` 方法。 **[过期API清理]**
+	- 重构：重构 `SaTokenException` 类方法 `throwBy-`>`notTrue`、`throwByNull-`>`notEmpty`。**[已做向下兼容处理]**
+	- 重构：`StpUtil.getSessionBySessionId` 提供的 `SessionId` 为空时将直接抛出异常，而不是再返回null。**[不向下兼容]**
+	- 新增：新增 `Http Digest` 认证模块简单实现。	**[重要]**
+	- 重构：更换 `HttpBasic` 认证模块包名。	**[已做向下兼容处理]**
 	- 新增：新增 `StpUtil.getLoginDeviceByToken(xxx)` 方法，用于获取任意 token 的登录设备类型。
 	- 新增：新增 `StpUtil.getTokenLastActiveTime()` 方法，获取当前 token 最后活跃时间。
-	- 修复：修复“当登录时指定 timeout 小于全局 timeout 时，Account-Session 有效期为全局 timeout”的问题。
-	- 优化：首次获取 Token-Session 时，其有效期将保持和 token 有效期相同，而不是再是全局 timeout 值。
-	- 移除：移除 SaSignConfig 的 isCheckNonce 配置项。 **[不向下兼容]**
-	- 新增：SaSignTemplate#checkRequest 增加“可指定参与签名参数”的功能。
+	- 修复：修复“当登录时指定 timeout 小于全局 timeout 时，`Account-Session` 有效期为全局 timeout”的问题。
+	- 优化：首次获取 `Token-Session` 时，其有效期将保持和 token 有效期相同，而不是再是全局 timeout 值。
+	- 移除：移除 `SaSignConfig` 的 `isCheckNonce` 配置项。 **[不向下兼容]**
+	- 新增：`SaSignTemplate#checkRequest` 增加“可指定参与签名参数”的功能。
 	- 重构：将部分加密算法设置为过期。
 	- 重构：优化 token 读取策略，空字符串将视为没有提交token。
-	- 修复：sa-token-bom 补全缺失依赖。
+	- 修复：`sa-token-bom` 补全缺失依赖。
 	- 优化：二级认证校验之前必须先通过登录认证校验。
-	- 修复：修复 StpUtil.getLoginId(T defaultValue) 传入 null 时无法正确返回值的bug。
+	- 修复：修复 `StpUtil.getLoginId(T defaultValue)` 传入 null 时无法正确返回值的bug。
 - sa-token-sso：
 	- 优化：SSO 模式三，API 调用签名校验时，限定参与签名的参数列表，更安全。
-	- 新增：新增 autoRenewTimeout 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
-	- 新增：SaSsoConfig 新增配置 isCheckSign（是否校验参数签名），方便本地开发时的调试。
-	- 新增：SaSsoConfig 新增配置 currSsoLogin，用于强制指定当前系统的 sso 登录地址。
-	- 重构：整体重构 sa-token-sso 模块，将 server 端和 client 端代码拆分。 **[重要]** **[不向下兼容]**
-	- 新增：SaSsoConfig 配置项 ssoLogoutCall 重命名为 currSsoLogoutCall。**[已做向下兼容处理]**
+	- 新增：新增 `autoRenewTimeout` 配置项：是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）
+	- 新增：`SaSsoConfig` 新增配置 `isCheckSign`（是否校验参数签名），方便本地开发时的调试。
+	- 新增：`SaSsoConfig` 新增配置 `currSsoLogin`，用于强制指定当前系统的 sso 登录地址。
+	- 重构：整体重构 `sa-token-sso` 模块，将 `server` 端和 `client` 端代码拆分。 **[重要]** **[不向下兼容]**
+	- 新增：`SaSsoConfig` 配置项 `ssoLogoutCall` 重命名为 `currSsoLogoutCall`。**[已做向下兼容处理]**
 	- 重构：模式三在校验 Ticket 时，也将强制校验签名才能调通请求。**[不向下兼容]**
-	- 新增：新增 maxRegClient 配置项，用于控制模式三下 client 注册数量。
-	- 新增：新增不同 SSO Client 配置不同 secret-key 的方案。 **[重要]**
+	- 新增：新增 `maxRegClient` 配置项，用于控制模式三下 client 注册数量。
+	- 新增：新增不同 SSO Client 配置不同 `secret-key` 的方案。 **[重要]**
 	- 重构：匿名 client 将不再能解析出所有应用的 ticket。**[不向下兼容]**
-	- 新增：新增 homeRoute 配置项：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由。
+	- 新增：新增 `homeRoute` 配置项：在 ``/sso/auth`` 登录后不指定 redirect 参数的情况下默认跳转的路由。
 	- 优化：优化登录有效期策略，SSO Client 端登录时将延续 SSO Server 端的会话剩余有效期。
 	- 新增：新增 `checkTicketAppendData` 策略函数，用于在校验 ticket 后，给 sso-client 端追加返回信息。
 	- 新增：SSO章节文档新增用户数据同步/迁移方案的建议。
-	- 修复：修复利用@字符可以绕过域名允许列表校验的漏洞。
-	- 修复：禁止 allow-url 配置项 * 符号出现在中间位置，因为这有可能导致校验被绕过。
+	- 修复：修复利用@字符可以绕过域名允许列表校验的漏洞。 **[漏洞修复]**
+	- 修复：禁止 `allow-url` 配置项 * 符号出现在中间位置，因为这有可能导致校验被绕过。 **[漏洞修复]**
 - 新增插件/示例：
-	- 新增：新增插件 sa-token-hutool-timed-cache，用于整合 Hutool 缓存插件 TimedCache。 **[重要]**
+	- 新增：新增插件 `sa-token-hutool-timed-cache`，用于整合 Hutool 缓存插件 TimedCache。 **[重要]**
 	- 新增：新增 SSM 架构整合 Sa-Token 简单示例。 	**[重要]**
 	- 新增：新增 beetl 整合 Sa-Token 简单示例。 	**[重要]**
 - 文档：
@@ -49,9 +49,9 @@
 - 其它：
 	- 优化：将跨域处理demo拆分为独立仓库。
 	- 优化：解决 springboot 集成 sa-token 后排除 jsckson 依赖无法成功启动的问题。
-	- 优化：解决 sa-token-jwt 模块重复设置 keyt 秘钥问题。（感谢`KonBAI`提交的pr）
+	- 优化：解决 `sa-token-jwt` 模块重复设置 keyt 秘钥问题。（感谢`KonBAI`提交的pr）
 	- 优化：jwt模式 token 过期后，抛出的异常描述是 token 已过期，而不再是 token 无效。
-	- 修复：补齐 sa-token-spring-aop 模块中遗漏监听的注解。
+	- 修复：补齐 `sa-token-spring-aop` 模块中遗漏监听的注解。
 
 
 ### v1.37.0 @2023-10-18
diff --git a/sa-token-doc/up/basic-auth.md b/sa-token-doc/up/basic-auth.md
index f28121ce..84db4319 100644
--- a/sa-token-doc/up/basic-auth.md
+++ b/sa-token-doc/up/basic-auth.md
@@ -114,7 +114,7 @@ http://sa:123456@127.0.0.1:8081/test/testDigest
 
 <a class="case-btn" href="https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/HttpBasicController.java"
 	target="_blank">
-	本章代码示例：Sa-Token Http Basic 认证 —— [ com.pj.cases.up.HttpBasicController.java ]
+	本章代码示例：Sa-Token Http Basic 认证 —— [ HttpBasicController.java ]
 </a>
 
 
-- 
Gitee


From 004a1b7ed9323df2eb767dcdcf1c917e4e1bdfb1 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 12 May 2024 15:59:03 +0800
Subject: [PATCH 067/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=E7=9B=AE=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/start/download.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sa-token-doc/start/download.md b/sa-token-doc/start/download.md
index 68636eef..5528080f 100644
--- a/sa-token-doc/start/download.md
+++ b/sa-token-doc/start/download.md
@@ -190,6 +190,7 @@ Maven依赖一直无法加载成功？[参考解决方案](https://sa-token.cc/d
 		├── sa-token-redis-fastjson               // [插件] Sa-Token 整合 Redis (使用 fastjson 序列化方式)
 		├── sa-token-redis-fastjson2              // [插件] Sa-Token 整合 Redis (使用 fastjson2 序列化方式)
 		├── sa-token-redisson-jackson             // [插件] Sa-Token 整合 Redisson (使用 jackson 序列化方式)
+		├── sa-token-hutool-timed-cache           // [插件] Sa-Token 整合 集成 hutool 框架的 Timed-Cache 缓存方案（基于内存）
 		├── sa-token-alone-redis                  // [插件] Sa-Token 独立 Redis 插件，实现 [ 权限缓存与业务缓存分离 ]
 		├── sa-token-redisx                       // [插件] Sa-Token 整合 Redis (中立 redisx)
 		├── sa-token-dubbo                        // [插件] Sa-Token 整合 dubbo 状态传递、rpc 鉴权
-- 
Gitee


From a86706b2c285fb6cdeb9dc64808b3b921b69b816 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 12 May 2024 17:09:59 +0800
Subject: [PATCH 068/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E7=BE=A4=E8=81=8A?=
 =?UTF-8?q?=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                       |  4 ++++
 sa-token-doc/more/join-group.md | 29 ++++++++++++++++++++++-------
 sa-token-doc/more/update-log.md |  2 +-
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 4848d217..403dd53a 100644
--- a/README.md
+++ b/README.md
@@ -190,10 +190,14 @@ Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权
 ### 交流群
 QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
 
+<!-- QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) -->
+
 微信交流群：
 
 <img src="https://oss.dev33.cn/sa-token/qr/wx-qr-m-400k.png" width="230px" title="微信群" />
 
+<!-- <img src="https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png" width="230px" title="微信群" /> -->
+
 (扫码添加微信，备注：sa-token，邀您加入群聊)
 
 <br>
diff --git a/sa-token-doc/more/join-group.md b/sa-token-doc/more/join-group.md
index 2c6625c8..514b49d6 100644
--- a/sa-token-doc/more/join-group.md
+++ b/sa-token-doc/more/join-group.md
@@ -10,10 +10,14 @@
 
 QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
 
+<!-- QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) -->
+
 ### 2、加入微信交流群：
 
 ![微信群](https://oss.dev33.cn/sa-token/wx-qr-300.png ':size=180')
 
+<!-- ![微信群](https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png ':size=175') -->
+
 （扫码添加微信，备注：sa，邀您加入群聊）
 
 <br>
@@ -25,17 +29,28 @@ QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k
 - 和众多大佬一起互相 (huá shuǐ) 交流 (mō yú)。
 
 
-### 3、招 QQ 群管理员：
+### 3、内部群：
+
+为感谢对 Sa-Token 生态做出贡献的同学，我们特创建了内部群：【Sa-Token 生态共享与合作】
 
-成为管理员的条件，以下任选其一即可：
+加入群聊条件，以下满足其一即可：
 - 写过5篇以上有关 Sa-Token 的原创博客。
-- 有开源项目集成了 Sa-Token，并在 [Awesome-Sa-Token](https://gitee.com/sa-token/awesome-sa-token) 完成提交。
 - 为 Sa-Token 开发过插件。
+- 有开源项目集成了 Sa-Token，并在 [Awesome-Sa-Token](https://gitee.com/sa-token/awesome-sa-token) 完成提交。
+- 有为 Sa-Token 录制过教程视频，发表在公共平台（总时长>30分钟，且播放量>2000）。
+- 其它一些您认为有对 Sa-Token 生态做出贡献的行为，可以直接联系我们，经内部投票评审通过即可加入（不要害羞，大胆联系我们哦 😊 ）
+
+加入群聊的好处：
+
+- 更及时的获知 Sa-Token 下一步更新计划。
+- 在 Sa-Token 遇到的任何疑问都可以当面与作者沟通，可协助解决问题。
+- 可提出未来版本更新需求，将具有更高的优先级进行评审与开发。
+
+QQ群聊号码：939849926 
+
+注：此为专属内部群聊，不满足上述条件的同学请勿过分申请打扰，谢谢合作。满足条件者可以在申请加入时备注上您的项目名称
+（例如：xx开源项目作者集成了 sa-token，申请加入群聊），如果字数太多无法写完，也可在开源交流群里@管理员协助交流。
 
-职责：
-- 维护Q群秩序、踢除与技术无关的广告、撤回不合适的信息等。
-- 能够一定程度上帮助群成员解决 Sa-Token 相关提问（不强制要求，有时间看见了答一下即可，平时可忙自己的事情）。
-- 成为管理员后可加入 Sa-Token 管理员专属内部群，更及时的获知 Sa-Token 下一步更新计划。
 
 
 
diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index cc7b9455..79cf89bb 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -1,6 +1,6 @@
 # 更新日志 
 
-### v1.38.0 @2023-10-18
+### v1.38.0 @2024-5-12
 - sa-token-core：
 	- 修复：修复 `StpUtil.getSessionByLoginId(xx)` 参数为 null 时创建无效 `SaSession` 的 bug。
 	- 优化：在 `SpringBoot 3.x` 版本下错误的引入依赖时将得到启动失败的提示。 （感谢`Uncarbon`提交的pr）
-- 
Gitee


From 2d4db297ac14acd862faad047ad10637daf2e739 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 13 May 2024 09:24:22 +0800
Subject: [PATCH 069/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86?=
 =?UTF-8?q?=E9=94=99=E5=88=AB=E5=AD=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/README.md          | 66 ++++++++++++++++++---------------
 sa-token-doc/more/update-log.md |  2 +-
 2 files changed, 38 insertions(+), 30 deletions(-)

diff --git a/sa-token-doc/README.md b/sa-token-doc/README.md
index 62a4c9b8..56105163 100644
--- a/sa-token-doc/README.md
+++ b/sa-token-doc/README.md
@@ -84,35 +84,43 @@ registry.addInterceptor(new SaInterceptor(handler -> {
 
 Sa-Token 目前主要五大功能模块：登录认证、权限认证、单点登录、OAuth2.0、微服务鉴权。
 
-- **登录认证** —— 单端登录、多端登录、同端互斥登录、七天内免登录
-- **权限认证** —— 权限认证、角色认证、会话二级认证
-- **Session会话** —— 全端共享Session、单端独享Session、自定义Session 
-- **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线
-- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁 
-- **持久层扩展** —— 可集成Redis、Memcached等专业缓存中间件，重启数据不丢失
-- **分布式会话** —— 提供jwt集成、共享数据中心两种分布式会话方案
-- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证
-- **单点登录** —— 内置三种单点登录模式：无论是否跨域、是否共享Redis，都可以搞定
-- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 
-- **二级认证** —— 在已登录的基础上再次认证，保证安全性 
-- **Basic认证** —— 一行代码接入 Http Basic 认证 
-- **独立Redis** —— 将权限缓存与业务缓存分离 
-- **临时Token认证** —— 解决短时间的Token授权问题
-- **模拟他人账号** —— 实时操作任意用户状态数据
-- **临时身份切换** —— 将会话身份临时切换为其它账号
-- **前后端分离** —— APP、小程序等不支持Cookie的终端
-- **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录
-- **多账号认证体系** —— 比如一个商城项目的user表和admin表分开鉴权
-- **Token风格定制** —— 内置六种Token风格，还可：自定义Token生成策略、自定义Token前缀
-- **注解式鉴权** —— 优雅的将鉴权与业务代码分离
-- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配restful模式
-- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签
-- **会话治理** —— 提供方便灵活的会话查询接口
-- **记住我模式** —— 适配[记住我]模式，重启浏览器免验证
-- **密码加密** —— 提供密码加密模块，可快速MD5、SHA1、SHA256、AES、RSA加密 
-- **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作
-- **开箱即用** —— 提供SpringMVC、WebFlux等常见web框架starter集成包，真正的开箱即用
-- **更多功能正在集成中...** —— 如有您有好想法或者建议，欢迎加群交流
+- **登录认证** —— 单端登录、多端登录、同端互斥登录、七天内免登录。
+- **权限认证** —— 权限认证、角色认证、会话二级认证。
+- **踢人下线** —— 根据账号id踢人下线、根据Token值踢人下线。
+- **注解式鉴权** —— 优雅的将鉴权与业务代码分离。
+- **路由拦截式鉴权** —— 根据路由拦截鉴权，可适配 restful 模式。
+- **Session会话** —— 全端共享Session,单端独享Session,自定义Session,方便的存取值。
+- **持久层扩展** —— 可集成 Redis，重启数据不丢失。
+- **前后台分离** —— APP、小程序等不支持 Cookie 的终端也可以轻松鉴权。
+- **Token风格定制** —— 内置六种 Token 风格，还可：自定义 Token 生成策略。
+- **记住我模式** —— 适配 [记住我] 模式，重启浏览器免验证。
+- **二级认证** —— 在已登录的基础上再次认证，保证安全性。 
+- **模拟他人账号** —— 实时操作任意用户状态数据。
+- **临时身份切换** —— 将会话身份临时切换为其它账号。
+- **同端互斥登录** —— 像QQ一样手机电脑同时在线，但是两个手机上互斥登录。
+- **账号封禁** —— 登录封禁、按照业务分类封禁、按照处罚阶梯封禁。
+- **密码加密** —— 提供基础加密算法，可快速 MD5、SHA1、SHA256、AES 加密。
+- **会话查询** —— 提供方便灵活的会话查询接口。
+- **Http Basic认证** —— 一行代码接入 Http Basic、Digest 认证。
+- **全局侦听器** —— 在用户登陆、注销、被踢下线等关键性操作时进行一些AOP操作。
+- **全局过滤器** —— 方便的处理跨域，全局设置安全响应头等操作。
+- **多账号体系认证** —— 一个系统多套账号分开鉴权（比如商城的 User 表和 Admin 表）
+- **单点登录** —— 内置三种单点登录模式：同域、跨域、同Redis、跨Redis、前后端分离等架构都可以搞定。
+- **单点注销** —— 任意子系统内发起注销，即可全端下线。
+- **OAuth2.0认证** —— 轻松搭建 OAuth2.0 服务，支持openid模式 。
+- **分布式会话** —— 提供共享数据中心分布式会话方案。
+- **微服务网关鉴权** —— 适配Gateway、ShenYu、Zuul等常见网关的路由拦截认证。
+- **RPC调用鉴权** —— 网关转发鉴权，RPC调用鉴权，让服务调用不再裸奔
+- **临时Token认证** —— 解决短时间的 Token 授权问题。
+- **独立Redis** —— 将权限缓存与业务缓存分离。
+- **Quick快速登录认证** —— 为项目零代码注入一个登录页面。
+- **标签方言** —— 提供 Thymeleaf 标签方言集成包，提供 beetl 集成示例。
+- **jwt集成** —— 提供三种模式的 jwt 集成方案，提供 token 扩展参数能力。
+- **RPC调用状态传递** —— 提供 dubbo、grpc 等集成包，在RPC调用时登录状态不丢失。
+- **参数签名** —— 提供跨系统API调用签名校验模块，防参数篡改，防请求重放。
+- **自动续签** —— 提供两种Token过期策略，灵活搭配使用，还可自动续签。
+- **开箱即用** —— 提供SpringMVC、WebFlux、Solon 等常见框架集成包，开箱即用。
+- **最新技术栈** —— 适配最新技术栈：支持 SpringBoot 3.x，jdk 17。
 
 功能结构图：
 
diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 79cf89bb..5149481c 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -48,7 +48,7 @@
 	- 新增过滤器执行顺序更改示例。
 - 其它：
 	- 优化：将跨域处理demo拆分为独立仓库。
-	- 优化：解决 springboot 集成 sa-token 后排除 jsckson 依赖无法成功启动的问题。
+	- 优化：解决 springboot 集成 sa-token 后排除 jackson 依赖无法成功启动的问题。
 	- 优化：解决 `sa-token-jwt` 模块重复设置 keyt 秘钥问题。（感谢`KonBAI`提交的pr）
 	- 优化：jwt模式 token 过期后，抛出的异常描述是 token 已过期，而不再是 token 无效。
 	- 修复：补齐 `sa-token-spring-aop` 模块中遗漏监听的注解。
-- 
Gitee


From 592cd795072ed0e051b0128dc6c77031b4f9236b Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 15 May 2024 15:05:51 +0800
Subject: [PATCH 070/172] =?UTF-8?q?=E6=9B=B4=E6=8D=A2qq=E7=BE=A4=E9=93=BE?=
 =?UTF-8?q?=E6=8E=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                       | 4 ++--
 sa-token-doc/more/join-group.md | 7 ++++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 403dd53a..1de42a1b 100644
--- a/README.md
+++ b/README.md
@@ -188,9 +188,9 @@ Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权
 
 
 ### 交流群
-QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
+<!-- QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)-->
 
-<!-- QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) -->
+QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) 
 
 微信交流群：
 
diff --git a/sa-token-doc/more/join-group.md b/sa-token-doc/more/join-group.md
index 514b49d6..732d3586 100644
--- a/sa-token-doc/more/join-group.md
+++ b/sa-token-doc/more/join-group.md
@@ -8,9 +8,10 @@
 
 <!-- ![QQ群](https://oss.dev33.cn/sa-token/qr/qq-group-5-gsa.png ':size=180') -->
 
-QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
-
-<!-- QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) -->
+<!-- QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
+ -->
+ 
+QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0)
 
 ### 2、加入微信交流群：
 
-- 
Gitee


From a0faf303d8a7fe6ceaef85f813df53f8a1d07901 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 16 May 2024 01:54:37 +0800
Subject: [PATCH 071/172] =?UTF-8?q?=E5=AE=98=E7=BD=91=E5=A2=9E=E5=8A=A0?=
 =?UTF-8?q?=E8=A7=86=E9=A2=91=E6=95=99=E7=A8=8B=E9=93=BE=E6=8E=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html   | 14 ++++++++++++++
 sa-token-doc/index.html | 14 ++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 22e5ff9f..fa455a59 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -101,6 +101,20 @@
 				<a class="wzi" href="index.html">首页</a>
 				<a class="wzi" href="doc.html">文档</a>
 				<a class="p-none wzi" href="#/more/link">案例</a>
+				<div class="zk-box">
+					<a class="wzi" href="javascript:;">
+						<span>视频 </span>
+						<span class="zk-icon"></span>
+					</a>
+					<div class="zk-context">
+						<div>
+							<a href="https://www.bilibili.com/video/BV1Zt421u7gk/" target="_blank">王清江唷（99集）</a>
+							<a href="https://www.bilibili.com/video/BV1kG411o7Ms/" target="_blank">筑梦信仰-joy（20集）</a>
+							<a href="https://www.bilibili.com/video/BV11u4y197JL/" target="_blank">达达-Java（26集）</a>
+							<a href="https://space.bilibili.com/473679148/video" target="_blank">晒太阳的盐（22集）</a>
+						</div>
+					</div>
+				</div>
 				<a class="p-none wzi" href="#/more/demand-commit">需求提交</a>
 				<!-- <a class="p-none wzi" href="#/more/blog">博客</a> -->
 				<a class="p-none wzi" href="#/more/join-group">加入讨论群</a>
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 589da8a9..bb798bc2 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -56,6 +56,20 @@
 					<a class="wzi" href="index.html">首页</a>
 					<a class="wzi" href="doc.html">文档</a>
 					<a class="p-none wzi" href="doc.html#/more/link">案例</a>
+					<div class="zk-box">
+						<a class="wzi" href="javascript:;">
+							<span>视频 </span>
+							<span class="zk-icon"></span>
+						</a>
+						<div class="zk-context">
+							<div>
+								<a href="https://www.bilibili.com/video/BV1Zt421u7gk/" target="_blank">王清江唷（99集）</a>
+								<a href="https://www.bilibili.com/video/BV1kG411o7Ms/" target="_blank">筑梦信仰-joy（20集）</a>
+								<a href="https://www.bilibili.com/video/BV11u4y197JL/" target="_blank">达达-Java（26集）</a>
+								<a href="https://space.bilibili.com/473679148/video" target="_blank">晒太阳的盐（22集）</a>
+							</div>
+						</div>
+					</div>
 					<a class="p-none wzi" href="doc.html#/more/demand-commit">需求提交</a>
 					<!-- <a class="p-none wzi" href="doc.html#/more/blog">博客</a> -->
 					<a class="p-none wzi" href="doc.html#/more/join-group">加入讨论群</a>
-- 
Gitee


From 40b01aba00112b76caba1989f42919f5fbe49c38 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 17 May 2024 11:41:42 +0800
Subject: [PATCH 072/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20=E5=89=8D=E5=90=8E?=
 =?UTF-8?q?=E7=AB=AF=E5=88=86=E7=A6=BB=E6=A8=A1=E5=BC=8F=E4=B8=8B=20?=
 =?UTF-8?q?=E9=9B=86=E6=88=90=20sso=20=E7=9A=84=20demo=20=E7=A4=BA?=
 =?UTF-8?q?=E4=BE=8B=E9=94=99=E8=AF=AF=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../sa-token-demo-sso-client-h5/index.html           |  2 +-
 .../sa-token-demo-sso-client-h5/sso-login.html       |  2 +-
 .../src/main/java/com/pj/h5/H5Controller.java        | 12 +++++-------
 sa-token-doc/sso/sso-h5.md                           | 11 ++++-------
 4 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/index.html b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/index.html
index 755f0e0e..6f251b54 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/index.html
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/index.html
@@ -15,7 +15,7 @@
 		<script type="text/javascript">
 		
 			// 后端接口地址 
-			var baseUrl = "http://sa-sso-client1.com:9001";
+			var baseUrl = "http://sa-sso-client1.com:9002";
 				
 			// 查询当前会话是否登录 
 			$.ajax({
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/sso-login.html b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/sso-login.html
index 3b18cdd3..a4655f85 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/sso-login.html
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-client-h5/sso-login.html
@@ -16,7 +16,7 @@
 		<script type="text/javascript">
 		
 			// 后端接口地址 
-			var baseUrl = "http://sa-sso-client1.com:9001";
+			var baseUrl = "http://sa-sso-client1.com:9002";
 			
 			var back = getParam('back', '/');
 			var ticket = getParam('ticket');
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
index 73d7a158..7db1f987 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/h5/H5Controller.java
@@ -1,5 +1,6 @@
 package com.pj.h5;
 
+import cn.dev33.satoken.sso.model.SaCheckTicketResult;
 import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
 import cn.dev33.satoken.sso.template.SaSsoUtil;
 import cn.dev33.satoken.stp.StpUtil;
@@ -30,15 +31,12 @@ public class H5Controller {
 		return SaResult.data(serverAuthUrl);
 	}
 	
-	// 根据ticket进行登录 
+	// 根据ticket进行登录
 	@RequestMapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
-		if(loginId != null) {
-			StpUtil.login(loginId);
-			return SaResult.data(StpUtil.getTokenValue());
-		}
-		return SaResult.error("无效ticket：" + ticket); 
+		SaCheckTicketResult ctr = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
+		StpUtil.login(ctr.loginId, ctr.remainSessionTimeout);
+		return SaResult.data(StpUtil.getTokenValue());
 	}
 
 	// 全局异常拦截 
diff --git a/sa-token-doc/sso/sso-h5.md b/sa-token-doc/sso/sso-h5.md
index 021caf6c..1aa5d6ba 100644
--- a/sa-token-doc/sso/sso-h5.md
+++ b/sa-token-doc/sso/sso-h5.md
@@ -27,15 +27,12 @@ public class H5Controller {
 		return SaResult.data(serverAuthUrl);
 	}
 	
-	// 根据ticket进行登录 
+	// 根据ticket进行登录
 	@RequestMapping("/sso/doLoginByTicket")
 	public SaResult doLoginByTicket(String ticket) {
-		Object loginId = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
-		if(loginId != null) {
-			StpUtil.login(loginId);
-			return SaResult.data(StpUtil.getTokenValue());
-		}
-		return SaResult.error("无效ticket：" + ticket); 
+		SaCheckTicketResult ctr = SaSsoClientProcessor.instance.checkTicket(ticket, "/sso/doLoginByTicket");
+		StpUtil.login(ctr.loginId, ctr.remainSessionTimeout);
+		return SaResult.data(StpUtil.getTokenValue());
 	}
 
 	// 全局异常拦截 
-- 
Gitee


From 131d163fa9142b210e491797088ebdb88987e9b5 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 25 May 2024 11:45:31 +0800
Subject: [PATCH 073/172] =?UTF-8?q?=E6=9B=B4=E6=8D=A2=E5=8A=A0=E7=BE=A4?=
 =?UTF-8?q?=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                       | 4 ++--
 sa-token-doc/more/join-group.md | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 1de42a1b..7ec1d0ff 100644
--- a/README.md
+++ b/README.md
@@ -194,9 +194,9 @@ QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0)
 
 微信交流群：
 
-<img src="https://oss.dev33.cn/sa-token/qr/wx-qr-m-400k.png" width="230px" title="微信群" />
+<!-- <img src="https://oss.dev33.cn/sa-token/qr/wx-qr-m-400k.png" width="230px" title="微信群" /> -->
 
-<!-- <img src="https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png" width="230px" title="微信群" /> -->
+<img src="https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png" width="230px" title="微信群" />
 
 (扫码添加微信，备注：sa-token，邀您加入群聊)
 
diff --git a/sa-token-doc/more/join-group.md b/sa-token-doc/more/join-group.md
index 732d3586..2ca7611a 100644
--- a/sa-token-doc/more/join-group.md
+++ b/sa-token-doc/more/join-group.md
@@ -15,9 +15,9 @@ QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0)
 
 ### 2、加入微信交流群：
 
-![微信群](https://oss.dev33.cn/sa-token/wx-qr-300.png ':size=180')
+<!-- ![微信群](https://oss.dev33.cn/sa-token/wx-qr-300.png ':size=180') -->
 
-<!-- ![微信群](https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png ':size=175') -->
+![微信群](https://oss.dev33.cn/sa-token/qr/i-wx-qr2.png ':size=175')
 
 （扫码添加微信，备注：sa，邀您加入群聊）
 
-- 
Gitee


From 3a81e5f5374055b8f14ea126d89c89dbe5369f13 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 27 May 2024 10:40:15 +0800
Subject: [PATCH 074/172] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E9=83=A8=E5=88=86?=
 =?UTF-8?q?=E9=94=99=E8=AF=AF=E6=8F=8F=E8=BF=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/use/config.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index d9dbc48c..613b875c 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -221,7 +221,7 @@ sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
 | ticketTimeout	| long		| 300		| ticket 有效期 （单位: 秒）														|
 | allowUrl		| String	| *			| 所有允许的授权回调地址，多个用逗号隔开（不在此列表中的URL将禁止下放ticket），参考：[SSO整合：配置域名校验](/sso/sso-check-domain)	|
 | homeRoute		| String	|  			| 主页路由：在 /sso/auth 登录后不指定 redirect 参数的情况下默认跳转的路由			|
-| isSlo			| Boolean	| false		| 是否打开单点注销功能															|
+| isSlo			| Boolean	| true		| 是否打开单点注销功能															|
 | isHttp		| Boolean	| false		| 是否打开模式三（此值为 true 时将使用 http 请求：校验 ticket 值、单点注销、获取 userinfo），参考：[详解](/use/config?id=配置项详解：isHttp) 	|
 | autoRenewTimeout	| Bolean	| false	| 是否在每次下发 ticket 时，自动续期 token 的有效期（根据全局 timeout 值）			|
 | maxRegClient	| int		| 32		| 在 Access-Session 上记录 Client 信息的最高数量（-1=无限），超过此值将进行自动清退处理，先进先出			|
-- 
Gitee


From fc6761e020d48b77efcd6d56c93f7f01ecc34e28 Mon Sep 17 00:00:00 2001
From: noear <noear@live.cn>
Date: Mon, 27 May 2024 22:08:10 +0800
Subject: [PATCH 075/172] =?UTF-8?q?=E8=B0=83=E6=95=B4=20sa-token-redisson-?=
 =?UTF-8?q?jackson2=20=E5=86=85=E7=9A=84=E7=89=88=E6=9C=AC=E4=BE=9D?=
 =?UTF-8?q?=E8=B5=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-plugin/sa-token-redisson-jackson2/pom.xml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sa-token-plugin/sa-token-redisson-jackson2/pom.xml b/sa-token-plugin/sa-token-redisson-jackson2/pom.xml
index 08b20901..fae05d9d 100644
--- a/sa-token-plugin/sa-token-redisson-jackson2/pom.xml
+++ b/sa-token-plugin/sa-token-redisson-jackson2/pom.xml
@@ -18,8 +18,8 @@
 
 	<!-- parent 里的版本适合与 springboot2 兼容；其它更新的框架里版本容易冲突 -->
 	<properties>
-		<redisson.version>3.23.5</redisson.version>
-		<jackson.version>2.15.2</jackson.version>
+		<redisson.version>3.27.2</redisson.version>
+		<jackson.version>2.17.0</jackson.version>
 	</properties>
 
 	<dependencies>
@@ -34,6 +34,7 @@
 		<dependency>
 			<groupId>org.redisson</groupId>
 			<artifactId>redisson</artifactId>
+			<version>${redisson.version}</version>
 			<exclusions>
 				<exclusion>
 					<groupId>org.yaml</groupId>
-- 
Gitee


From f082880568bdee41881bb10e296d264e9f639faa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9E=97=E9=92=9F=E4=B8=80=E5=85=AD?= <1477007136@qq.com>
Date: Thu, 6 Jun 2024 01:08:28 +0800
Subject: [PATCH 076/172] =?UTF-8?q?doc:=20=E5=A2=9E=E5=8A=A0=E4=BA=86=20Ko?=
 =?UTF-8?q?tlin=20=E7=A4=BA=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/start/webflux-example.md | 77 +++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/sa-token-doc/start/webflux-example.md b/sa-token-doc/start/webflux-example.md
index fa43e661..be2577ee 100644
--- a/sa-token-doc/start/webflux-example.md
+++ b/sa-token-doc/start/webflux-example.md
@@ -34,6 +34,13 @@
 // Sa-Token 权限认证（Reactor响应式集成），在线文档：https://sa-token.cc
 implementation 'cn.dev33:sa-token-reactor-spring-boot-starter:${sa.top.version}'
 ```
+
+<!-------- tab:Gradle (Kotlin) 方式 -------->
+注：如果你使用的是 `SpringBoot 3.x`，只需要将 `sa-token-reactor-spring-boot-starter` 修改为 `sa-token-reactor-spring-boot3-starter` 即可。
+``` gradle
+// Sa-Token 权限认证（Reactor响应式集成），在线文档：https://sa-token.cc
+implementation("cn.dev33:sa-token-reactor-spring-boot-starter:${sa.top.version}")
+```
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -43,6 +50,8 @@ implementation 'cn.dev33:sa-token-reactor-spring-boot-starter:${sa.top.version}'
 ### 3、创建启动类
 在项目中新建包 `com.pj` ，在此包内新建主类 `SaTokenDemoApplication.java`，输入以下代码：
 
+<!---------------------------- tabs:start ------------------------------>
+<!-------- tab:Java -------->
 ``` java
 @SpringBootApplication
 public class SaTokenDemoApplication {
@@ -53,8 +62,24 @@ public class SaTokenDemoApplication {
 }
 ```
 
+<!-------- tab:Kotlin -------->
+```kotlin
+@SpringBootApplication
+class SaTokenDemoApplication
+
+fun main(args: Array<String>) {
+    runApplication<SaTokenDemoApplication>(*args)
+    println(SaManager.getConfig())
+}
+```
+<!---------------------------- tabs:end ------------------------------>
+
+
 ### 4、创建全局过滤器
 新建`SaTokenConfigure.java`，注册 Sa-Token 的全局过滤器
+
+<!---------------------------- tabs:start ------------------------------>
+<!-------- tab:Java -------->
 ``` java
 /**
  * [Sa-Token 权限认证] 全局配置类 
@@ -85,10 +110,41 @@ public class SaTokenConfigure {
     }
 }
 ```
+
+<!-------- tab:Kotlin -------->
+```kotlin
+@Configuration
+class SaTokenConfigure {
+    /**
+     * 注册 [Sa-Token全局过滤器]
+     */
+    @Bean
+    fun saReactorFilter(): SaReactorFilter = SaReactorFilter()
+        // 指定 [拦截路由]（此处为拦截所有path）
+        .addInclude("/**")
+        // 指定 [放行路由]
+        .addExclude("/favicon.ico")
+        // 指定[认证函数]: 每次请求执行
+        .setAuth {
+            println("---------- sa全局认证")
+            // SaRouter.match("/test/test", SaFunction { StpUtil.checkLogin() })
+        }
+        // 指定[异常处理函数]：每次[认证函数]发生异常时执行此函数
+        .setError { e: Throwable ->
+            println("---------- sa全局异常 ")
+            SaResult.error(e.message)
+        }
+}
+```
+<!---------------------------- tabs:end ------------------------------>
+
 你只需要按照此格式复制代码即可，有关过滤器的详细用法，会在之后的章节详细介绍。
 
 
 ### 5、创建测试Controller
+
+<!---------------------------- tabs:start ------------------------------>
+<!-------- tab:Java -------->
 ``` java
 @RestController
 @RequestMapping("/user/")
@@ -114,6 +170,27 @@ public class UserController {
 }
 ```
 
+<!-------- tab:Kotlin -------->
+```kotlin
+@RestController
+@RequestMapping("/user/")
+class UserController {
+    
+    @RequestMapping("doLogin")
+    fun doLogin(username: String, password: String) =
+        // 此处仅作模拟示例，真实项目需要从数据库中查询数据进行比对
+        if ("zhang" == username && "123456" == password) {
+            StpUtil.login(10001)
+            "登录成功"
+        } else "登录失败"
+    
+    @RequestMapping("isLogin")
+    fun isLogin() = "当前会话是否登录：" + StpUtil.isLogin()
+    
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
 ### 6、运行
 启动代码，从浏览器依次访问上述测试接口：
 
-- 
Gitee


From 4c59ace69af970c9e5e47dd753b1d9e454758118 Mon Sep 17 00:00:00 2001
From: Jelex <fanguyinheng@foxmail.com>
Date: Fri, 7 Jun 2024 09:36:00 +0000
Subject: [PATCH 077/172] update sa-token-doc/sso/sso-check-domain.md.

Signed-off-by: Jelex <fanguyinheng@foxmail.com>
---
 sa-token-doc/sso/sso-check-domain.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/sso/sso-check-domain.md b/sa-token-doc/sso/sso-check-domain.md
index db82615d..1af4ea02 100644
--- a/sa-token-doc/sso/sso-check-domain.md
+++ b/sa-token-doc/sso/sso-check-domain.md
@@ -33,7 +33,7 @@ sa-token:
 <!------------- tab:properties 风格  ------------->
 ``` properties
 # 配置允许单点登录的 url 
-sa-token.sso.allow-url=http://sa-sso-client1.com:9001/sso/login
+sa-token.sso-server.allow-url=http://sa-sso-client1.com:9001/sso/login
 ```
 <!---------------------------- tabs:end ---------------------------->
 
-- 
Gitee


From dd61ddb0c406c27c3b727ed4c34c1f84a0338782 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 11 Jun 2024 06:26:48 +0800
Subject: [PATCH 078/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=88=97=E8=A1=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html                   | 21 ++++++++++++++++++---
 sa-token-doc/static/donate/donate-list.js | 14 ++++++++++++++
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index bb798bc2..0910c256 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -537,8 +537,11 @@
 						<a href="https://sohelp.net/" target="_blank" title="宁波互邦软件有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/ningbohubang.png">
 						</a>
-						<a href="http://www.zdzxtech.com/" target="_blank" title="武汉真道智享科技有限公司">
+						<!-- <a href="http://www.zdzxtech.com/" target="_blank" title="武汉真道智享科技有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/zhendaozhiting.jpeg">
+						</a> -->
+						<a href="https://yimei.liuxin.online/" target="_blank" title="逸玫工作室">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/yimei-black.png">
 						</a>
 					</div>
 					<div style="height: 10px; clear: both;"></div>
@@ -795,10 +798,22 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dy-java.png"
 								msg="DyJava是一款功能强大的抖音Java开发工具包">
 						</a>
-						<a href="https://dromara.org/zh/projects/" target="_blank">
+						
+						
+						<a href="https://gitee.com/dromara/MilvusPlus" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/MilvusPlus.jpg"
+								msg="MilvusPlus（简称 MP）是一个 Milvus 的操作工具，旨在简化与 Milvus 向量数据库的交互，为开发者提供类似 MyBatis-Plus 注解和方法调用风格的直观 API,提高效率而生。">
+						</a>
+						<a href="http://www.easy-query.com/easy-query-doc/" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/easy-query.png"
+								msg="java下唯一一款同时支持强类型对象关系查询和强类型SQL语法查询的ORM,拥有对象模型筛选、隐式子查询、隐式join、显式子查询、显式join,支持Java/Kotlin">
+						</a>
+						
+						
+						<!-- <a href="https://dromara.org/zh/projects/" target="_blank">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dromara.png"
 								msg="让每一位开源爱好者，体会到开源的快乐。">
-						</a>
+						</a> -->
 					</div>
 					<div style="height: 10px; clear: both;"></div>
 					<p>
diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index ec1252e2..d2088651 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1110,4 +1110,18 @@ var donateList = [
 		"msg": "感谢您的开源项目！",
 		"date": "2024-05-07"
 	},
+	{
+		"name": "INS6",
+		"link": "https://gitee.com/feiyuchuixue",
+		"money": 188.0,
+		"msg": '<a href="https://szadmin.cn/" target="_blank">感谢Sa-Token开源！Sz-Admin一个轻量化RBAC开源框架。</a>',
+		"date": "2024-06-05"
+	},
+	{
+		"name": "Zongyy",
+		"link": "https://gitee.com/zongyY11",
+		"money": 10.0,
+		"msg": "感谢您的开源项目！",
+		"date": "2024-06-05"
+	},
 ]
\ No newline at end of file
-- 
Gitee


From 9540df9e0168309f3b11b6060c59642365e678ce Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 11 Jun 2024 13:57:01 +0800
Subject: [PATCH 079/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=90=8D=E5=8D=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/static/donate/donate-list.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index d2088651..98803048 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1124,4 +1124,11 @@ var donateList = [
 		"msg": "感谢您的开源项目！",
 		"date": "2024-06-05"
 	},
+	{
+		"name": "驰骋BPM",
+		"link": "https://gitee.com/chichengsoft",
+		"money": 100.0,
+		"msg": '感谢开源, 欢迎下载：驰骋低代码BPM <a href="https://gitee.com/opencc/JFlow" target="_blank">https://gitee.com/opencc/JFlow</a>',
+		"date": "2024-06-11"
+	},
 ]
\ No newline at end of file
-- 
Gitee


From ec40d9cda63b22e85b0d427c48157850fdef7e62 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 11 Jun 2024 17:14:18 +0800
Subject: [PATCH 080/172] =?UTF-8?q?=E6=9B=B4=E6=8D=A2=E5=8F=8B=E8=81=94log?=
 =?UTF-8?q?o?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 0910c256..b58219bf 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -746,8 +746,8 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/yft-design.png"
 								msg="基于 Canvas 的开源版 创客贴 支持导出json，svg, image文件。">
 						</a>
-						<a href="https://gitee.com/dromara/spring-file-storage" target="_blank">
-							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/file4j.png"
+						<a href="https://gitee.com/dromara/x-file-storage" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/x-file-storage.svg"
 								msg="在 SpringBoot 中通过简单的方式将文件存储到 本地、阿里云 OSS、腾讯云 COS、七牛云 Kodo等">
 						</a>
 						<a href="https://wemq.nicholasld.cn/" target="_blank">
-- 
Gitee


From a4177c3c7cc310350a11bada8840c013c3dc8612 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 12 Jun 2024 17:48:31 +0800
Subject: [PATCH 081/172] =?UTF-8?q?=E5=88=A0=E9=99=A4=E4=B8=8D=E5=BF=85?=
 =?UTF-8?q?=E8=A6=81=E7=9A=84=E6=B3=A8=E9=87=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index b58219bf..bf768c52 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -920,19 +920,11 @@
 					<div class="ss-box">
 						<h3>联系我们</h3>
 						<ul class="list-unstyle">
-							<!-- <li>电话：<a href="tel:123;">123</a></li> -->
-							<!-- <li>QQ群 ：<a href="xxx" target="_blank">111</a></li> -->
 							<li>QQ群 ：<a href="doc.html#/more/join-group">点击加入</a></li>
 							<li>邮箱：<a href="javascript: alert('暂无');">暂无</a></li>
 							<li>联系：<a href="javascript: alert('暂无');">暂无</a></li>
 						</ul>
 					</div>
-					<!-- <div class="ss-box">
-						<h3 class="last">Dromara 知识星球</h3>
-						<div class="media-img padding-small-top" style="text-align: center;">
-							<img class="dro-qr" src="https://oss.dev33.cn/sa-token/dromara-xingqiu--sa-token.jpg" width="200" height="100" />
-						</div>
-					</div> -->
 					<div class="ss-box">
 						<h3 class="last" style="text-align: left; float: none; padding-left: 0px;">Sa-Token 公众号</h3>
 						<div class="media-img padding-small-top" style="text-align: left;">
-- 
Gitee


From f9114ab749f8a6aeccd0dd8242a1d314410d94e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E5=85=88=E7=94=9F?= <emailtome123456@163.com>
Date: Wed, 19 Jun 2024 15:22:51 +0800
Subject: [PATCH 082/172] =?UTF-8?q?=E7=89=88=E6=9C=AC=E6=9B=B4=E6=96=B0?=
 =?UTF-8?q?=E5=90=8E@SaCheckBasic=E6=9B=BF=E6=8D=A2=E4=B8=BA@SaCheckHttpBa?=
 =?UTF-8?q?sic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/test/AtController.java          | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-springboot-redisson/src/main/java/com/pj/test/AtController.java b/sa-token-demo/sa-token-demo-springboot-redisson/src/main/java/com/pj/test/AtController.java
index 3af4c603..92358348 100644
--- a/sa-token-demo/sa-token-demo-springboot-redisson/src/main/java/com/pj/test/AtController.java
+++ b/sa-token-demo/sa-token-demo-springboot-redisson/src/main/java/com/pj/test/AtController.java
@@ -1,14 +1,9 @@
 package com.pj.test;
 
+import cn.dev33.satoken.annotation.*;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
-import cn.dev33.satoken.annotation.SaCheckBasic;
-import cn.dev33.satoken.annotation.SaCheckLogin;
-import cn.dev33.satoken.annotation.SaCheckPermission;
-import cn.dev33.satoken.annotation.SaCheckRole;
-import cn.dev33.satoken.annotation.SaCheckSafe;
-import cn.dev33.satoken.annotation.SaMode;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 
@@ -71,7 +66,7 @@ public class AtController {
 	}
 	
 	// 通过Basic认证后才可以进入  ---- http://localhost:8081/at/checkBasic 
-	@SaCheckBasic(account = "sa:123456")
+	@SaCheckHttpBasic(account = "sa:123456")
 	@RequestMapping("checkBasic")
 	public SaResult checkBasic() {
 		return SaResult.ok();
-- 
Gitee


From a5d103e73bf8edb7715d83769fb9c9c278e1755c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E5=85=88=E7=94=9F?= <emailtome123456@163.com>
Date: Wed, 19 Jun 2024 15:27:27 +0800
Subject: [PATCH 083/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0demo-ssm=E9=87=8C?=
 =?UTF-8?q?=E9=9D=A2=E7=9A=84=E6=B3=A8=E8=A7=A3@SaCheckHttpBasic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/controller/AtController.java           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-demo/sa-token-demo-ssm/src/main/java/com/pj/controller/AtController.java b/sa-token-demo/sa-token-demo-ssm/src/main/java/com/pj/controller/AtController.java
index 88176cc0..ee0e9b36 100644
--- a/sa-token-demo/sa-token-demo-ssm/src/main/java/com/pj/controller/AtController.java
+++ b/sa-token-demo/sa-token-demo-ssm/src/main/java/com/pj/controller/AtController.java
@@ -65,7 +65,7 @@ public class AtController {
 	}
 	
 	// 通过Basic认证后才可以进入  ---- http://localhost:8080/sa_token_demo_ssm_war/at/checkBasic
-	@SaCheckBasic(account = "sa:123456")
+	@SaCheckHttpBasic(account = "sa:123456")
 	@RequestMapping("checkBasic")
 	public SaResult checkBasic() {
 		return SaResult.ok();
-- 
Gitee


From 1b5022cb4a77d0cfc25dccbc2ccfcb8d2161267a Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 20:30:13 +0800
Subject: [PATCH 084/172] test submit

---
 sa-token-doc/_sidebar.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index c75611db..c8675b92 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -120,5 +120,5 @@
 	
 
 
-<br/><br/><br/><br/><br/><br/><br/>
+<br/><br/><br/><br/><br/><br/><br/><br/>
 <p style="text-align: center;">----- 到底线了 -----</p>
\ No newline at end of file
-- 
Gitee


From 2c68248f7fe910d93062a97bfc3316f567214363 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 20:33:39 +0800
Subject: [PATCH 085/172] test submit

---
 sa-token-doc/_sidebar.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index c8675b92..c75611db 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -120,5 +120,5 @@
 	
 
 
-<br/><br/><br/><br/><br/><br/><br/><br/>
+<br/><br/><br/><br/><br/><br/><br/>
 <p style="text-align: center;">----- 到底线了 -----</p>
\ No newline at end of file
-- 
Gitee


From a113560019d5a4b1e5075871a10cffc72aa02305 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 20:47:26 +0800
Subject: [PATCH 086/172] =?UTF-8?q?=E4=BB=A3=E7=A0=81=E6=89=98=E7=AE=A1?=
 =?UTF-8?q?=E5=9C=B0=E5=9D=80=E5=B1=95=E7=A4=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/README.md b/README.md
index 7ec1d0ff..8ee0ded8 100644
--- a/README.md
+++ b/README.md
@@ -187,6 +187,14 @@ Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权
 - [[ Solon ]](https://gitee.com/noear/solon)：一个更现代感的应用开发框架：更快、更小、更自由。
 
 
+
+### 代码托管
+- Gitee：[https://gitee.com/dromara/sa-token](https://gitee.com/dromara/sa-token)
+- GitHub：[https://github.com/dromara/sa-token](https://github.com/dromara/sa-token)
+- GitCode：[https://gitcode.com/click33/sa-token](https://gitcode.com/click33/sa-token)
+
+
+
 ### 交流群
 <!-- QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)-->
 
-- 
Gitee


From f8585ae0011b54050de359c4095fa176e3604875 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 22:12:00 +0800
Subject: [PATCH 087/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=88=97=E8=A1=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/static/donate/donate-list.js | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 98803048..11eee7b5 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1131,4 +1131,25 @@ var donateList = [
 		"msg": '感谢开源, 欢迎下载：驰骋低代码BPM <a href="https://gitee.com/opencc/JFlow" target="_blank">https://gitee.com/opencc/JFlow</a>',
 		"date": "2024-06-11"
 	},
+	{
+		"name": "flydongdong",
+		"link": "https://gitee.com/flydongdong",
+		"money": 10.0,
+		"msg": '感谢您的开源项目！',
+		"date": "2024-06-18"
+	},
+	{
+		"name": "驰骋BPM",
+		"link": "https://gitee.com/chichengsoft",
+		"money": 100.0,
+		"msg": '感谢开源, 欢迎下载：驰骋低代码BPM <a href="https://gitee.com/opencc/JFlow" target="_blank">https://gitee.com/opencc/JFlow</a>',
+		"date": "2024-06-20"
+	},
+	{
+		"name": "Mall4j商城系统",
+		"link": "https://gitee.com/gz-yami_admin",
+		"money": 218.0,
+		"msg": '感谢开源！Mall4j商城系统： <a href="https://gitee.com/gz-yami/mall4j" target="_blank">https://gitee.com/gz-yami/mall4j</a>',
+		"date": "2024-06-21"
+	},
 ]
\ No newline at end of file
-- 
Gitee


From 591530be86ea40c025862aeb66cb538f7d58994f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 22:33:00 +0800
Subject: [PATCH 088/172] =?UTF-8?q?=E8=A1=A5=E5=85=A8=20dromara=20?=
 =?UTF-8?q?=E9=A1=B9=E7=9B=AE=E5=88=97=E8=A1=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index bf768c52..31b0ce2a 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -798,8 +798,6 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dy-java.png"
 								msg="DyJava是一款功能强大的抖音Java开发工具包">
 						</a>
-						
-						
 						<a href="https://gitee.com/dromara/MilvusPlus" target="_blank">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/MilvusPlus.jpg"
 								msg="MilvusPlus（简称 MP）是一个 Milvus 的操作工具，旨在简化与 Milvus 向量数据库的交互，为开发者提供类似 MyBatis-Plus 注解和方法调用风格的直观 API,提高效率而生。">
@@ -808,12 +806,18 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/easy-query.png"
 								msg="java下唯一一款同时支持强类型对象关系查询和强类型SQL语法查询的ORM,拥有对象模型筛选、隐式子查询、隐式join、显式子查询、显式join,支持Java/Kotlin">
 						</a>
-						
-						
-						<!-- <a href="https://dromara.org/zh/projects/" target="_blank">
+						<a href="https://gitee.com/dromara/orion-visor" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/orion-visor.png"
+								msg="一款高颜值、现代化的智能运维&轻量堡垒机平台。">
+						</a>
+						<a href="https://www.ujcms.com/" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/ujcms.png"
+								msg="Java开源网站内容管理系统(java cms)。使用SpringBoot、MyBatis、Vue3、ElementPlus、Vite、TypeScript等技术开发。">
+						</a>
+						<a href="https://dromara.org/zh/projects/" target="_blank">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/dromara.png"
 								msg="让每一位开源爱好者，体会到开源的快乐。">
-						</a> -->
+						</a>
 					</div>
 					<div style="height: 10px; clear: both;"></div>
 					<p>
-- 
Gitee


From 12642cb8fc9a307a7d61622e266d4f6f1a270c20 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 21 Jun 2024 22:41:22 +0800
Subject: [PATCH 089/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E5=88=97=E8=A1=A8=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/static/donate/donate-list.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 11eee7b5..81f2ca1b 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1142,7 +1142,7 @@ var donateList = [
 		"name": "驰骋BPM",
 		"link": "https://gitee.com/chichengsoft",
 		"money": 100.0,
-		"msg": '感谢开源, 欢迎下载：驰骋低代码BPM <a href="https://gitee.com/opencc/JFlow" target="_blank">https://gitee.com/opencc/JFlow</a>',
+		"msg": '感谢您的开源项目！欢迎了解驰骋BPM低代码. <a href="https://gitee.com/opencc/JFlow" target="_blank">https://gitee.com/opencc/JFlow</a>',
 		"date": "2024-06-20"
 	},
 	{
-- 
Gitee


From 428016c07285bd0925fbc2c633c2085735da6ea1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B7=B4=E6=8E=8C=E5=A4=A7=E5=8F=94?=
 <gtn1024o@outlook.com>
Date: Tue, 25 Jun 2024 12:32:02 +0000
Subject: [PATCH 090/172] =?UTF-8?q?!308=20=E5=A4=84=E7=90=86=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=20JWT=20=E6=97=B6=E7=9A=84=20JSONException=20*=20?=
 =?UTF-8?q?=E5=A4=84=E7=90=86=E8=A7=A3=E6=9E=90=20JWT=20=E6=97=B6=E7=9A=84?=
 =?UTF-8?q?=20JSONException?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
index a295a04b..90ad98ef 100644
--- a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
+++ b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
@@ -19,6 +19,7 @@ import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.jwt.error.SaJwtErrorCode;
 import cn.dev33.satoken.jwt.exception.SaJwtException;
 import cn.dev33.satoken.util.SaFoxUtil;
+import cn.hutool.json.JSONException;
 import cn.hutool.json.JSONObject;
 import cn.hutool.jwt.JWT;
 import cn.hutool.jwt.JWTException;
@@ -181,7 +182,7 @@ public class SaJwtTemplate {
     	JWT jwt;
     	try {
     		jwt = JWT.of(token);
-		} catch (JWTException e) {
+		} catch (JWTException | JSONException e) {
     		throw new SaJwtException("jwt 解析失败：" + token, e).setCode(SaJwtErrorCode.CODE_30201);
 		}
     	JSONObject payloads = jwt.getPayloads();
-- 
Gitee


From 637ca491ea4b7c8286a0e987e48e37a7f73e35b4 Mon Sep 17 00:00:00 2001
From: goodsWox <33800760+fooooxxxx@users.noreply.github.com>
Date: Fri, 12 Jul 2024 16:22:08 +0800
Subject: [PATCH 091/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20SaLoginModel=20?=
 =?UTF-8?q?=E7=9A=84=20timeout=20=E8=B6=85=E5=87=BA=E6=95=B4=E5=9E=8B?=
 =?UTF-8?q?=E8=8C=83=E5=9B=B4=E6=97=B6=E8=BF=94=E5=9B=9E=E8=B4=9F=E6=95=B0?=
 =?UTF-8?q?=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/stp/SaLoginModel.java | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
index b724837a..f865b869 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
@@ -15,14 +15,14 @@
  */
 package cn.dev33.satoken.stp;
 
-import java.util.LinkedHashMap;
-import java.util.Map;
-
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.util.SaTokenConsts;
 
+import java.util.LinkedHashMap;
+import java.util.Map;
+
 /**
  * 在调用 `StpUtil.login()` 时的 配置参数 Model，决定登录的一些细节行为 <br>
  *
@@ -300,6 +300,9 @@ public class SaLoginModel {
 		if(getTimeoutOrGlobalConfig() == SaTokenDao.NEVER_EXPIRE) {
 			return Integer.MAX_VALUE;
 		}
+		if (timeout > Integer.MAX_VALUE) {
+			return Integer.MAX_VALUE;
+		}
 		return (int)(long)timeout;
 	}
 
-- 
Gitee


From 1224397981e47829ac3009db5e049f83ff7f6bc2 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 20 Jul 2024 12:19:53 +0800
Subject: [PATCH 092/172] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=90=8D=E5=8D=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html                   |  3 +++
 sa-token-doc/more/sa-token-donate.md      |  9 +++++----
 sa-token-doc/static/donate/donate-list.js | 14 ++++++++++++++
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 31b0ce2a..172fe23c 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -543,6 +543,9 @@
 						<a href="https://yimei.liuxin.online/" target="_blank" title="逸玫工作室">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/yimei-black.png">
 						</a>
+						<a href="https://www.jcodeyun.com/" target="_blank" title="协卓云动（深圳）数字发展有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/xiezhuoyundong.png">
+						</a>
 					</div>
 					<div style="height: 10px; clear: both;"></div>
 					<p>
diff --git a/sa-token-doc/more/sa-token-donate.md b/sa-token-doc/more/sa-token-donate.md
index 5b63f43d..3a25c452 100644
--- a/sa-token-doc/more/sa-token-donate.md
+++ b/sa-token-doc/more/sa-token-donate.md
@@ -46,7 +46,7 @@ Sa-Token 采用 Apache-2.0 开源协议，**承诺框架本身与官网文档永
 
 
 
-### 商业赞助
+<!-- ### 商业赞助
 
 一次性赞助 200 元或以上，可帮助您的产品在 Sa-Token 交流群艾特全体成员推广一次。
 
@@ -54,9 +54,9 @@ Sa-Token 采用 Apache-2.0 开源协议，**承诺框架本身与官网文档永
 
 Sa-Token 目前总计18+微信交流群（每个群人数大约400以上，总计人数7000+），6个QQ交流群（2000人群和1000人群，总计人数8000+），大部分为 java 开发工程师，可有效推广您的产品。
 
-- 优先推广和程序员相关的互联网产品，比如：低代码开发平台、网课、开发软件、云服务器、个人博客等等，实体产品如键盘、显示器、耳机等等，如果是和程序员无关的产品，可酌情考虑是否推广。
+- 优先推广和程序员相关的互联网产品，比如：低代码开发平台、网课、开发软件、个人博客等等，如果是和程序员无关的产品，可酌情考虑是否推广。
 - 拒绝接受违反法律法规、以及灰色相关的产品推广，为避免不必要的麻烦，目前也拒绝推广IP代理、上网工具等等。
-- 为避免过多打扰群友，目前一天内至多在群里推广两次，超过次数的可顺延到第二天。
+- 为避免过多打扰群友，目前一天内至多在群里推广一次，超过次数的可顺延到第二天。
 
 有意见合作者可直接在 gitee 发起赞赏后，将您的产品信息发至 [ sa-pro 小助手 ] ，加好友链接点 [这里](http://sa-pro.dev33.cn/)，点击后往下拉有二维码，添加时请备注：Sa-Token 商业赞助。
 
@@ -73,5 +73,6 @@ xxx 商品名称
 - 1、目前不接受 Sa-Token 官网文档插入广告推广，只接受一次性商业赞助推广。
 - 2、助力开源项目：如果您要推广的是一个开源项目，赞助金额可打五折，即：赞助 100 元即可。
 - 3、如果你的开源项目集成了 Sa-Token，可以免费得到推广机会一次。**请大胆联系我们，不要害羞！**
+- 4、此为半公益性推广活动，旨在帮助一些开源项目和IT公司产品在起步阶段快速获取一些用户，我们不打算靠此长久盈利，因此针对同一个产品我们至多接受推广三次，超过三次不再接受推广。
 
-<button class="syzz-show-btn" onclick="showSyzz()">部分推广效果截图(点击查看)</button>
\ No newline at end of file
+<button class="syzz-show-btn" onclick="showSyzz()">部分推广效果截图(点击查看)</button> -->
\ No newline at end of file
diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 81f2ca1b..87ba9665 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1152,4 +1152,18 @@ var donateList = [
 		"msg": '感谢开源！Mall4j商城系统： <a href="https://gitee.com/gz-yami/mall4j" target="_blank">https://gitee.com/gz-yami/mall4j</a>',
 		"date": "2024-06-21"
 	},
+	{
+		"name": "FlyFlow",
+		"link": "https://gitee.com/junyue",
+		"money": 200.0,
+		"msg": '感谢开源！FlyFlow工作流： <a href="https://gitee.com/junyue/flyflow" target="_blank">https://gitee.com/junyue/flyflow</a>',
+		"date": "2024-06-25"
+	},
+	{
+		"name": "immortal",
+		"link": "https://gitee.com/immortal-wang",
+		"money": 10.0,
+		"msg": '感谢您的开源项目，内部项目鉴权框架参考了您的部分设计思想（用户会话和令牌会话）。',
+		"date": "2024-07-20"
+	},
 ]
\ No newline at end of file
-- 
Gitee


From ae67ad6a02aa3dbb75ea9c16da9bc4d7c18dc393 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 29 Jul 2024 00:43:55 +0800
Subject: [PATCH 093/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
 =?UTF-8?q?=E7=BB=93=E6=9E=84=E6=A0=B7=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html                         | 147 +++++++++++++++---
 sa-token-doc/fun/curr-domain.md               |   3 +-
 sa-token-doc/fun/exception-code.md            |   5 +-
 sa-token-doc/fun/issue-template.md            |   3 +-
 sa-token-doc/fun/session-model.md             |   1 +
 sa-token-doc/fun/token-timeout.md             |   1 +
 sa-token-doc/micro/import-intro.md            |   1 +
 sa-token-doc/micro/same-token.md              |   6 +-
 sa-token-doc/more/blog.md                     |  13 ++
 sa-token-doc/more/tj-gzh.md                   |  12 +-
 sa-token-doc/oauth2/oauth2-interworking.md    |  10 +-
 sa-token-doc/plugin/alone-redis.md            |   1 +
 sa-token-doc/plugin/api-sign.md               |   1 +
 sa-token-doc/plugin/jwt-extend.md             |   1 +
 sa-token-doc/plugin/temp-token.md             |   2 +-
 sa-token-doc/plugin/thymeleaf-extend.md       |   3 +-
 sa-token-doc/sso/sso-server.md                |  16 +-
 sa-token-doc/sso/sso-type1.md                 |   3 +-
 sa-token-doc/sso/sso-type2.md                 |   1 +
 sa-token-doc/sso/sso-type3.md                 |   3 +
 sa-token-doc/start/solon-example.md           |   4 +-
 sa-token-doc/start/webflux-example.md         |   5 +-
 sa-token-doc/static/doc.css                   | 146 ++++++++++++++---
 sa-token-doc/static/docsify-plugin.js         |  86 +++++-----
 ...ocsify-plugin-flexible-alerts.min-1.1.1.js |   9 ++
 .../static/docsify-plugins/progress.update.js |  76 +++++++++
 .../static/docsify-plugins/sub-nav-draw.js    |  56 +++++++
 sa-token-doc/static/index.css                 |   6 +-
 sa-token-doc/up/disable.md                    |   3 +-
 sa-token-doc/up/global-filter.md              |   8 +-
 sa-token-doc/up/safe-auth.md                  |  14 +-
 sa-token-doc/up/search-session.md             |   1 +
 sa-token-doc/up/token-prefix.md               |   9 +-
 sa-token-doc/up/token-style.md                |   3 +-
 sa-token-doc/use/jur-auth.md                  |  20 +--
 sa-token-doc/use/login-auth.md                |  16 +-
 sa-token-doc/use/route-check.md               |   9 +-
 sa-token-doc/use/session.md                   |   1 +
 38 files changed, 550 insertions(+), 155 deletions(-)
 create mode 100644 sa-token-doc/static/docsify-plugins/docsify-plugin-flexible-alerts.min-1.1.1.js
 create mode 100644 sa-token-doc/static/docsify-plugins/progress.update.js
 create mode 100644 sa-token-doc/static/docsify-plugins/sub-nav-draw.js

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index fa455a59..f1766711 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -151,21 +151,53 @@
 		</a> -->
 		
 		<div class="main-box">
+			<!-- 内容区 -->
 			<div id="app">加载中...</div>
+			
+			<!-- 右边盒子 -->
+			<div class="doc-right-bj-box">
+				<div class="doc-right-bj-box-title">目录</div>
+				<div class="doc-right-more-item">
+					
+					<!-- ad盒子 -->
+					<div class="ad-box">
+						
+						<div class="ad-title">
+							<span class="ad-tips">推广信息：</span>
+							<span class="ad-tips ad-close">关闭</span>
+						</div>
+						
+						<!-- ssp -->
+						<div class="top-ad-box" style="margin-bottom: 12px;">
+							<a href="http://sa-pro.dev33.cn?from=satop" target="_blank">
+								<img src="https://oss.dev33.cn/sa-token/ad/sa-sso-pro-s3.png" />
+							</a>
+						</div>
+						
+						<!-- 万维广告div -->
+						<div class="wwads-cn wwads-horizontal" data-id="88" style="min-height: 0px; border: 1px #eee solid; margin-bottom: 12px;"></div>
+						
+					</div>
+					
+					<!-- help 按钮 -->
+					<div class="help-btn">技术求助</div>
+					
+				</div>
+			</div>
 		</div>
 		
 		<!-- 万维广告div -->
-		<div style="position: fixed; right: 0; bottom: 0; z-index: 10000; border: 0px #aaa solid;">
+		<!-- <div style="position: fixed; right: 0; bottom: 0; z-index: 10000; border: 0px #aaa solid;">
 			<div class="wwads-cn wwads-vertical" data-id="88" style="max-width:150px"></div>
-		</div>
+		</div> -->
 		
 		<!-- 小助手div -->
-		<div class="p-none help-btn-box" style="position: fixed; right: 40px; bottom: 330px; z-index: 10000; border: 0px #aaa solid;">
+		<!-- <div class="p-none help-btn-box" style="position: fixed; right: 40px; bottom: 330px; z-index: 10000; border: 0px #aaa solid;">
 			<div class="help-tips" style="position: relative; left: -30px; top: -10px;"></div>
 			<div class="help-btn" style="width: 60px; height: 60px; text-align: center; border-radius: 50%; background-color: #42b983; cursor: pointer;">
 				<span style="font-size: 18px; color: #FFF; line-height: 60px;">Help</span>
 			</div>
-		</div>
+		</div> -->
 		
 		
 		<!-- UI逐渐显现 -->
@@ -178,6 +210,10 @@
 			}, 1);
 		</script>
 		
+		<!-- jqeury -->
+		<script src="static/jquery.min.js"></script>
+		<script src="static/layer-v3.1.1/layer.js"></script>
+		
 		<!--  -->
 		<script src="./static/docsify-plugin.js?v=7"></script>
 		<script src="./static/is-star-plugin.js?v=7"></script>
@@ -216,6 +252,28 @@
 					tabComments: true,      // 用注释来标注选项卡标题，例如：<!-- tab:SpringBoot  -->
 					tabHeadings: true       // 用标题+粗体来定制选项卡
 				},
+				// 阅读进度
+				progress: {
+					position: "top",
+					color: "var(--theme-color,#42b983)",
+					height: "3px",
+				},
+				// 信息提示框
+				'flexible-alerts': {
+					style: 'flat',  // 默认风格 callout=浅色，flat=深色 
+					note: {
+						label: {}
+					},
+					tip: {
+						label: {},
+					},
+					warning: {
+						label: {}
+					},
+					attention: {
+						label: {}
+					},
+				},
 				// 自定义插件 
 				plugins: [myDocsifyPlugin, window.isStarPlugin, window.isFillInWjPlugin],
 			}
@@ -229,32 +287,69 @@
 		<script src="static/prism/prism-yaml.min.js"></script>
 		<script src="static/prism/prism-properties.min.js"></script>
 		
+		<!-- 文档阅读进度条 -->
+		<!-- <script src="static/docsify-plugins/progress.update.js"></script> -->
+		
+		<!-- 右上角次级导航栏 -->
+		<script src="static/docsify-plugins/sub-nav-draw.js"></script>
+		
 		<!-- 搜索框 -->
 		<script src="static/search.min.js"></script>
 		<!-- 多 tab 切换 -->
 		<script src="static/docsify-tabs.min.js"></script>
 		<!-- img点击放大 -->
 		<script src="static/zoom-image.min.js"></script>
+		<!-- 好看的提示框 -->
+		<script src="static/docsify-plugins/docsify-plugin-flexible-alerts.min-1.1.1.js"></script>
 
 		<!-- sidebar折叠 -->
-		<!-- <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify-sidebar-collapse/dist/sidebar.min.css" />
-		<script src="//cdn.jsdelivr.net/npm/docsify-sidebar-collapse/dist/docsify-sidebar-collapse.min.js"></script> -->
+		<!-- <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/docsify-sidebar-collapse/dist/sidebar.min.css" />
+		<script src="https://cdn.jsdelivr.net/npm/docsify-sidebar-collapse/dist/docsify-sidebar-collapse.min.js"></script> -->
 
-		<!-- jqeury -->
-		<script src="static/jquery.min.js"></script>
-		<script src="static/layer-v3.1.1/layer.js"></script>
 		
 		<!-- 渲染赞助数据 -->
 		<script src="static/donate/donate-list.js"></script>
 		<script src="static/donate/donate-fun.js"></script>
 		
+		<!-- 广告盒子 -->
 		<script>
-			if(window.jQuery === undefined || window.Docsify === undefined) {
-				var str = 'CDN 加载失败，请打开备用地址：<a href="index-backup.html' + location.hash + '" target="_blank">index-backup.html</a>';
-				document.querySelector('#app').innerHTML = str;
-			}
+			(function(){
+				// 功能6：标题下面的广告
+				if($(window).width() >= 800) {
+					// 如果一天内用户点击过关闭广告，则不再展现
+					let allowJg = 1000 * 60 * 60 * 24 * 1;
+					// allowJg = 1000 * 10;
+					try{
+						const closeAdTime = localStorage.closeAdTime;
+						if(closeAdTime) {
+							// 点击广告关闭的时间，和当前时间的差距
+							const closeAdJg = new Date().getTime() - parseInt(closeAdTime);
+							
+							// 差距小于1天，不再展示 
+							if(closeAdJg < allowJg) {
+								console.log('not show ad ...');
+								$('.ad-box').remove();
+								return;
+							}
+						}
+					}catch(e){
+						console.error(e);
+					}
+					
+					// 添加关闭事件
+					$('.ad-close').click(function(){
+						console.log('关闭广告');
+						// $('.top-ad-box').slideUp(); // 折叠收起
+						layer.confirm('关闭后，一天内不再展现此信息', function(){
+							$(".ad-box").fadeOut(1000); // 淡出效果
+							layer.msg('关闭成功');
+							localStorage.closeAdTime = new Date().getTime();
+						})
+					})
+				}
+			})();
 		</script>
-
+		
 		<!-- 搜索引擎自动提交 -->
 		<script>
 			(function() {
@@ -316,17 +411,19 @@
 					offset: '10%',
 				})
 			})
-			try{
-				// 给个小提示
-				const index = layer.tips('框架技术支持，点此求助', '.help-tips', {
-					tips: [1, '#000'] ,//还可配置颜色
-					// time: 5000,
-				});
-				// 改为 fixed 定位，否则它会随着滚动条移动，样式就跑偏了
-				$('#layui-layer' + index).css('position', 'fixed');
-			}catch(e){
-				console.error(e);
-			}
+			// setTimeout(function(){
+			// 	try{
+			// 		// 给个小提示
+			// 		const index = layer.tips('框架技术支持，点此求助', '.help-btn', {
+			// 			tips: [1, '#000'] ,//还可配置颜色
+			// 			// time: 5000,
+			// 		});
+			// 		// 改为 fixed 定位，否则它会随着滚动条移动，样式就跑偏了
+			// 		$('#layui-layer' + index).css('position', 'fixed');
+			// 	}catch(e){
+			// 		console.error(e);
+			// 	}
+			// }, 500)
 
 		</script>
 		
diff --git a/sa-token-doc/fun/curr-domain.md b/sa-token-doc/fun/curr-domain.md
index 1a7c2184..33c6a8c9 100644
--- a/sa-token-doc/fun/curr-domain.md
+++ b/sa-token-doc/fun/curr-domain.md
@@ -58,7 +58,8 @@ public class CustomSaTokenContextForSpring extends SaTokenContextForSpring {
 
 其它逻辑保持不变，框架即可正确获取 uri 地址
 
-!> 注意：步骤一与步骤二需要同步存在，否则可能有前端假传 header 参数造成安全问题 
+> [!ATTENTION| label:风险警告] 
+> 注意：步骤一与步骤二需要同步存在，否则可能有前端假传 header 参数造成安全问题 
 
 
 ### 方案二：直接在yml中配置当前项目的网络访问地址
diff --git a/sa-token-doc/fun/exception-code.md b/sa-token-doc/fun/exception-code.md
index 0675dc1f..b86aeb9d 100644
--- a/sa-token-doc/fun/exception-code.md
+++ b/sa-token-doc/fun/exception-code.md
@@ -53,8 +53,6 @@ SaToken 中的所有异常都是继承于 `SaTokenException` 的，也就是说
 
 ### 异常细分状态码-参照表
 
-!> 部分插件因异常抛出点较少，暂未做状态码细分处理
-
 #### sa-token-code 核心包
 
 | code码值	| 含义									|
@@ -215,6 +213,9 @@ SaToken 中的所有异常都是继承于 `SaTokenException` 的，也就是说
 | 30303		| Token已超时							|
 
 
+> [!WARNING| label:注意] 
+> 部分插件因异常抛出点较少，暂未做状态码细分处理
+
 
 
 
diff --git a/sa-token-doc/fun/issue-template.md b/sa-token-doc/fun/issue-template.md
index ccd2de20..f703028b 100644
--- a/sa-token-doc/fun/issue-template.md
+++ b/sa-token-doc/fun/issue-template.md
@@ -2,8 +2,7 @@
 
 在线提问链接：[Gitee issue](https://gitee.com/dromara/sa-token/issues)、[GitHub issue](https://github.com/dromara/sa-token/issues)
 
-> 请在新建 issue 时，尽量复制模板格式进行提交
-> 
+> [!TIP| label:请在新建 issue 时，尽量复制模板格式进行提交] 
 > 1. 提交之前率先参考 <a href="#/more/common-questions" target="_blank">Sa-Token 常见问题解答</a> 以及善用 Gitee issues 搜索功能，查阅问题是否已有答案，已存在的 issue 就不要再重复提交了。
 > 2. 问题已得到处理的 issue 请大家及时手动关闭，如果超过24小时没有追问，我们将默认提交者已找到解决方案，关闭issue。
 > 3. 有时候 issue 提交之后，没有得到及时回复，大家可以加入QQ群@管理员寻求帮助。
diff --git a/sa-token-doc/fun/session-model.md b/sa-token-doc/fun/session-model.md
index 496ab6a4..a10f4062 100644
--- a/sa-token-doc/fun/session-model.md
+++ b/sa-token-doc/fun/session-model.md
@@ -42,6 +42,7 @@ session.set("name", "张三");
 
 随着业务推进，我们还可能会遇到一些需要数据隔离的场景：
 
+> [!NOTE| label:业务场景] 
 > 指定客户端超过两小时无操作就自动下线，如果两小时内有操作，就再续期两小时，直到新的两小时无操作 
 
 那么这种请求访问记录应该存储在哪里呢？放在 Account-Session 里吗？
diff --git a/sa-token-doc/fun/token-timeout.md b/sa-token-doc/fun/token-timeout.md
index 309110dd..978292be 100644
--- a/sa-token-doc/fun/token-timeout.md
+++ b/sa-token-doc/fun/token-timeout.md
@@ -25,6 +25,7 @@ sa-token.active-timeout=-1
 
 两者的区别，可以通过下面的例子体现：
 
+> [!TIP| label:场景示例] 
 > 1. 假设你到银行要存钱，首先就要办理一张卡 （要访问系统接口先登录）。
 > 2. 银行为你颁发一张储蓄卡（系统为你颁发一个Token），以后每次存取钱都要带上这张卡（后续每次访问系统都要提交 Token）。
 > 3. 银行为这张卡设定两个过期时间：
diff --git a/sa-token-doc/micro/import-intro.md b/sa-token-doc/micro/import-intro.md
index 96a13d89..6c3774a8 100644
--- a/sa-token-doc/micro/import-intro.md
+++ b/sa-token-doc/micro/import-intro.md
@@ -5,6 +5,7 @@
 
 虽然在 [开始] 章节已经说明了依赖引入规则，但是交流群里不少小伙伴提出bug解决到最后发现都是因为依赖引入错误导致的，此处再次重点强调一下：
 
+> [!TIP| style:callout] 
 > **在微服务架构中使用Sa-Token时，网关和内部服务要分开引入Sa-Token依赖（不要直接在顶级父pom中引入Sa-Token）**
 
 总体来讲，我们需要关注的依赖就是两个：`sa-token-spring-boot-starter` 和 `sa-token-reactor-spring-boot-starter`：
diff --git a/sa-token-doc/micro/same-token.md b/sa-token-doc/micro/same-token.md
index 63f70dba..ee43a605 100644
--- a/sa-token-doc/micro/same-token.md
+++ b/sa-token-doc/micro/same-token.md
@@ -147,7 +147,8 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 
 启动网关与子服务，访问测试：
 
-> 如果通过网关转发，可以正常访问，直接访问子服务会提示：`无效Same-Token：xxx`
+> [!WARNING| label:越过网关访问] 
+> 如果通过网关转发，可以正常访问。如果直接访问子服务会提示：`无效Same-Token：xxx`
 
 
 ### 三、服务间内部调用鉴权 
@@ -229,7 +230,8 @@ Same-Token 默认随 Sa-Token 数据一起保存在Redis中，理论上不会存
 ##### 2、如何主动刷新Same-Token，例如：五分钟、两小时刷新一次？
 Same-Token 刷新间隔越短，其安全性越高，每个Token的默认有效期为一天，在一天后再次获取会自动产生一个新的Token
 
-!> 需要注意的一点是：Same-Token默认的自刷新机制，并不能做到高并发可用，多个服务一起触发Token刷新可能会造成毫秒级的短暂服务失效，其只能适用于 项目开发阶段 或 低并发业务场景 
+> [!WARNING| label:注意点] 
+> 需要注意的一点是：Same-Token默认的自刷新机制，并不能做到高并发可用，多个服务一起触发Token刷新可能会造成毫秒级的短暂服务失效，其只能适用于 项目开发阶段 或 低并发业务场景 
 
 因此在微服务架构下，我们需要有专门的机制主动刷新Same-Token，保证其高可用
 
diff --git a/sa-token-doc/more/blog.md b/sa-token-doc/more/blog.md
index 33b67fe6..fd8c9a75 100644
--- a/sa-token-doc/more/blog.md
+++ b/sa-token-doc/more/blog.md
@@ -5,6 +5,19 @@
 
 --- 
 
+
+- [[ 公众号 ] 集成sa-token前后端分离部署配置corsFliter解决跨域失效的真正原因](https://mp.weixin.qq.com/s/bSS4vmKlKM7ov_CUkjxkBg) （2024-07-08）
+
+- [[ 公众号 ] sa-token前后端分离解决跨域的正确姿势](https://mp.weixin.qq.com/s/96WbWL28T5_-xzyCfJ7Stg) （2024-07-06）
+
+- [[ 公众号 ] 集成sa-token实现登录和RBAC权限控制](https://mp.weixin.qq.com/s/SREjXoyL9s1JfddQnU38yA) （2024-04-16）
+
+- [[ CSDN ] springboot整合Sa-Token实现登录认证和权限校验（万字长文）](https://blog.csdn.net/2301_78646673/article/details/136008153) （2024-03-31）
+
+- [[ CSDN ]【Sa-Token】9、Sa-Token实现在线用户管理功能](https://blog.csdn.net/qq_40065776/article/details/132180932) （2023-11-01）
+
+- [[ CSDN ]【Sa-Token】9、Sa-Token实现在线用户管理功能](https://blog.csdn.net/qq_40065776/article/details/132180932) （2023-11-01）
+
 - [[ CSDN ] 【Sa-Token】9、Sa-Token实现在线用户管理功能](https://blog.csdn.net/qq_40065776/article/details/132180932) （2023-08-09）
 
 - [[ CSDN ] 【RuoYi-Vue-Plus】学习笔记 31 - Sa-Token（五）登录验证拦截器之 Token 有效期及其续签（Sa-Token 源码）](https://blog.csdn.net/Michelle_Zhong/article/details/126071871) （2022-07-30）
diff --git a/sa-token-doc/more/tj-gzh.md b/sa-token-doc/more/tj-gzh.md
index 4f0973cb..dc3777e6 100644
--- a/sa-token-doc/more/tj-gzh.md
+++ b/sa-token-doc/more/tj-gzh.md
@@ -7,6 +7,11 @@
 
 <table class="gzh-table" style="text-align: center;">
     <tr>
+        <td>
+			<img src="https://mp.weixin.qq.com/mp/qrcode?scene=10000005&size=102&__biz=Mzg2Mzg0NjEwOA==&mid=2247485024&idx=1&sn=11883396c1844fd2c4bd208c299bb075&send_time="/>
+			<b>Java大飞哥</b>
+			<span>专注软件开发、技术架构设计、源码分享、JAVA技术。</span>
+		</td>
         <td>
 			<img src="https://mp.weixin.qq.com/mp/qrcode?scene=10000004&size=102&__biz=Mzg4Nzg2MjQzNg==&mid=2247484545&idx=1&sn=c6101effb31b639fe2699b56bcc090c7&send_time="/>
 			<b>小简聊开发</b>
@@ -27,7 +32,6 @@
 			<b>TJ君</b>
 			<span>一个励志推荐10000款开源项目与免费工具的程序猿</span>
 		</td>
-        <td>-</td>
     </tr>
     <tr>
         <td>
@@ -137,7 +141,7 @@
 			<span>推荐热门开源软件，介绍新开源项目，报导开源资讯！</span>
 		</td>
     </tr>
-    <!-- <tr>
+    <tr>
         <td>
 			<img src="https://mp.weixin.qq.com/mp/qrcode?scene=10000004&size=102&__biz=MzUzNTY2NjAzMg==&mid=2247484321&idx=1&sn=52e7e5e0dc03437e94908b6a67985500&send_time="/>
 			<b>Dromara开源组织</b>
@@ -220,10 +224,10 @@
 			<b>HelloGitHub</b>
 			<span>分享 GitHub 上有趣、入门级的开源项目。</span>
 		</td>
-	</tr> -->
+	</tr>
 </table>
 
 <br>
 
-感谢以上公众号对 Sa-Token 项目的推荐，如果您也是java公众号运营者，欢迎 [相互推荐](/more/tj-gzh-hz)
+感谢以上公众号对 Sa-Token 项目的推荐<!-- ，如果您也是java公众号运营者，欢迎 [相互推荐](/more/tj-gzh-hz) -->
 
diff --git a/sa-token-doc/oauth2/oauth2-interworking.md b/sa-token-doc/oauth2/oauth2-interworking.md
index 1eef4e5a..002ec431 100644
--- a/sa-token-doc/oauth2/oauth2-interworking.md
+++ b/sa-token-doc/oauth2/oauth2-interworking.md
@@ -51,11 +51,11 @@ StpUtil.login(uid, SaLoginConfig.setToken(access_token));
 ```
 
 
-### 注意点
-数据互通，让前端与后端的交互更加方便，一个 token 即可访问所有接口，但也一定程度上失去了OAuth2的 “不同 Client 不同权限” 的设计意义，
-同时也默认每个 Client 都拥有了账号的会话权限（access_token 与 satoken 为同一个）。
-
-应该根据自己的架构合理分析是否应该整合数据互通。
+> [!WARNING| label:注意点] 
+> 数据互通，让前端与后端的交互更加方便，一个 token 即可访问所有接口，但也一定程度上失去了OAuth2的 “不同 Client 不同权限” 的设计意义，
+> 同时也默认每个 Client 都拥有了账号的会话权限（access_token 与 satoken 为同一个）。
+> 
+> 应该根据自己的架构合理分析是否应该整合数据互通。
 
 
 
diff --git a/sa-token-doc/plugin/alone-redis.md b/sa-token-doc/plugin/alone-redis.md
index 05bdbb00..b1f4146c 100644
--- a/sa-token-doc/plugin/alone-redis.md
+++ b/sa-token-doc/plugin/alone-redis.md
@@ -3,6 +3,7 @@
 
 Sa-Token默认的Redis集成方式会把权限数据和业务缓存放在一起，但在部分场景下我们需要将他们彻底分离开来，比如：
 
+> [!NOTE| label:业务场景] 
 > 搭建两个Redis服务器，一个专门用来做业务缓存，另一台专门存放Sa-Token权限数据 
 
 
diff --git a/sa-token-doc/plugin/api-sign.md b/sa-token-doc/plugin/api-sign.md
index 375fbe8d..268b0a07 100644
--- a/sa-token-doc/plugin/api-sign.md
+++ b/sa-token-doc/plugin/api-sign.md
@@ -15,6 +15,7 @@ sa-token api-sign 模块将帮你轻松解决以上难题。*（此插件是内
 
 假设我们有如下业务需求：
 
+> [!NOTE| label:业务场景] 
 > 用户在 A 系统参与活动成功后，活动奖励以余额的形式下发到 B 系统。
 
 
diff --git a/sa-token-doc/plugin/jwt-extend.md b/sa-token-doc/plugin/jwt-extend.md
index 988dcd48..26345d58 100644
--- a/sa-token-doc/plugin/jwt-extend.md
+++ b/sa-token-doc/plugin/jwt-extend.md
@@ -25,6 +25,7 @@ implementation 'cn.dev33:sa-token-jwt:${sa.top.version}'
 <!---------------------------- tabs:end ---------------------------->
 
 
+> [!WARNING| label:版本兼容性] 
 > 1. 注意: sa-token-jwt 显式依赖 hutool-jwt 5.7.14 版本，保险起见：你的项目中要么不引入 hutool，要么引入版本 >= 5.7.14 的 hutool 版本。
 > 2. hutool 5.8.13 和 5.8.14 版本下会出现类型转换问题，[关联issue](https://gitee.com/dromara/sa-token/issues/I6L429)。
 
diff --git a/sa-token-doc/plugin/temp-token.md b/sa-token-doc/plugin/temp-token.md
index fbbac88e..c2f5f5ed 100644
--- a/sa-token-doc/plugin/temp-token.md
+++ b/sa-token-doc/plugin/temp-token.md
@@ -52,7 +52,7 @@ SaTempUtil.getTimeout(token);
 // 删除指定 token
 SaTempUtil.deleteToken(token);
 ```
-> 注意: SaTempUtil创建临时token后登陆的用户id与SaToken框架中StpUtil登陆的用户id并不关联,两者相互独立同时存在
+
 
 ### 集成jwt
 提到 [临时Token认证]，你是不是想到一个专门干这件事的框架？对，就是JWT！
diff --git a/sa-token-doc/plugin/thymeleaf-extend.md b/sa-token-doc/plugin/thymeleaf-extend.md
index c0392abd..973029c6 100644
--- a/sa-token-doc/plugin/thymeleaf-extend.md
+++ b/sa-token-doc/plugin/thymeleaf-extend.md
@@ -116,7 +116,8 @@ public class SaTokenConfigure{
 }
 ```
 
-!> 注意：如果`SaTokenConfigure`继承了`WebMvcConfigurer`等类，可能会造成循环依赖，如果遇到，请新建一个其他配置类完成此项配置
+> [!WARNING| label:注意] 
+> 如果`SaTokenConfigure`继承了`WebMvcConfigurer`等类，可能会造成循环依赖，如果遇到，请新建一个其他配置类完成此项配置
 
 
 然后我们就可以在页面上调用 StpLogic 的 API 了，例如：
diff --git a/sa-token-doc/sso/sso-server.md b/sa-token-doc/sso/sso-server.md
index 9193a8ab..381942c9 100644
--- a/sa-token-doc/sso/sso-server.md
+++ b/sa-token-doc/sso/sso-server.md
@@ -2,6 +2,7 @@
 
 在开始SSO三种模式的对接之前，我们必须先搭建一个 SSO-Server 认证中心 
 
+> [!TIP| label:demo | style:callout] 
 > 搭建示例在官方仓库的 `/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/`，如遇到难点可结合源码进行测试学习，demo里有制作好的登录页面 
 
 --- 
@@ -71,13 +72,14 @@ implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
 <!---------------------------- tabs:end ---------------------------->
 
 
-
-除了 `sa-token-spring-boot-starter` 和 `sa-token-sso` 以外，其它包都是可选的：
-- 在 SSO 模式三时 Redis 相关包是可选的  
-- 在前后端分离模式下可以删除 thymeleaf 相关包
-- 在不需要 SSO 模式三单点注销的情况下可以删除 http 工具包 
-
-建议先完整测试三种模式之后再对pom依赖进行酌情删减。
+> [!NOTE| label:引包简化] 
+> 除了 `sa-token-spring-boot-starter` 和 `sa-token-sso` 以外，其它包都是可选的：
+> 
+> - 在 SSO 模式三时 Redis 相关包是可选的  
+> - 在前后端分离模式下可以删除 thymeleaf 相关包
+> - 在不需要 SSO 模式三单点注销的情况下可以删除 http 工具包 
+> 
+> 建议先完整测试三种模式之后再对pom依赖进行酌情删减。
 
 
 ### 2、开放认证接口  
diff --git a/sa-token-doc/sso/sso-type1.md b/sa-token-doc/sso/sso-type1.md
index 2bac82ca..9c8a7334 100644
--- a/sa-token-doc/sso/sso-type1.md
+++ b/sa-token-doc/sso/sso-type1.md
@@ -261,8 +261,9 @@ public class SaSso1ClientApplication {
 
 ### 6、跨域模式下的解决方案 
 
-如上，我们使用简单的步骤实现了同域下的单点登录，聪明如你??，马上想到了这种模式有着一个不小的限制：
+如上，我们使用简单的步骤实现了同域下的单点登录，聪明如你😏，马上想到了这种模式有着一个不小的限制：
 
+> [!TIP| style:callout] 
 > 所有子系统的域名，必须同属一个父级域名
 
 如果我们的子系统在完全不同的域名下，我们又该怎么完成单点登录功能呢？
diff --git a/sa-token-doc/sso/sso-type2.md b/sa-token-doc/sso/sso-type2.md
index b19cb153..75ebb0eb 100644
--- a/sa-token-doc/sso/sso-type2.md
+++ b/sa-token-doc/sso/sso-type2.md
@@ -45,6 +45,7 @@
 
 ### 3、搭建 Client 端项目 
 
+> [!TIP| label:demo | style:callout] 
 > 搭建示例在官方仓库的 `/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/`，如遇到难点可结合源码进行测试学习
 
 #### 3.1、去除 SSO-Server 的 Cookie 作用域配置 
diff --git a/sa-token-doc/sso/sso-type3.md b/sa-token-doc/sso/sso-type3.md
index 4d9d0a5b..5bda5ce9 100644
--- a/sa-token-doc/sso/sso-type3.md
+++ b/sa-token-doc/sso/sso-type3.md
@@ -2,6 +2,7 @@
 
 如果既无法做到前端同域，也无法做到后端同Redis，那么可以使用模式三完成单点登录 
 
+> [!WARNING| label:小提示] 
 > 阅读本篇之前请务必先熟读SSO模式二！因为模式三仅仅属于模式二的一个特殊场景，熟读模式二有助于您快速理解本章内容
 
 
@@ -14,6 +15,7 @@
 
 所以模式三的主要目标：也就是在 模式二的基础上 解决上述 三个难题 
 
+> [!TIP| label:demo | style:callout] 
 > 模式三的 Demo 示例地址：`/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/` 
 > [源码链接](https://gitee.com/dromara/sa-token/tree/dev/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client)，如遇难点可参考示例 
 
@@ -43,6 +45,7 @@ sa-token.sso-client.is-http=true
 - [http://sa-sso-client2.com:9001/](http://sa-sso-client2.com:9001/)
 - [http://sa-sso-client3.com:9001/](http://sa-sso-client3.com:9001/)
 
+> [!WARNING| label:小提示] 
 > 注：如果已测试运行模式二，可先将Redis中的数据清空，以防旧数据对测试造成干扰
 
 
diff --git a/sa-token-doc/start/solon-example.md b/sa-token-doc/start/solon-example.md
index d374e02a..5f9def70 100644
--- a/sa-token-doc/start/solon-example.md
+++ b/sa-token-doc/start/solon-example.md
@@ -4,6 +4,7 @@
 
 整合示例在官方仓库的 `/sa-token-demo/sa-token-demo-solon` 文件夹下，如遇到难点可结合源码进行学习测试。
 
+> [!tip| label:Solon 是什么？] 
 > Solon 是一个高效的国产应用开发框架：更快、更小、更简单。
 > 
 > - 启动快 5 ～ 10 倍；
@@ -14,7 +15,6 @@
 > 
 > 详情可参考：[https://solon.noear.org/](https://solon.noear.org/)
 
-
 ---
 
 ### 1、创建项目
@@ -45,7 +45,7 @@ implementation 'cn.dev33:sa-token-solon-plugin:${sa.top.version}'
 
 
 
-Maven依赖一直无法加载成功？[参考解决方案](/doc.html#/start/maven-pull)
+Maven依赖一直无法加载成功？[参考解决方案](https://sa-token.cc/doc.html#/start/maven-pull)
 
 更多内测版本了解：[Sa-Token最新版本](https://gitee.com/dromara/sa-token/blob/dev/sa-token-doc/start/new-version.md)
 
diff --git a/sa-token-doc/start/webflux-example.md b/sa-token-doc/start/webflux-example.md
index be2577ee..32cfab59 100644
--- a/sa-token-doc/start/webflux-example.md
+++ b/sa-token-doc/start/webflux-example.md
@@ -5,7 +5,10 @@
 
 整合示例在官方仓库的`/sa-token-demo/sa-token-demo-webflux`文件夹下，如遇到难点可结合源码进行测试学习
 
-!> WebFlux 常用于微服务网关架构中，如果您的应用基于单体架构且非 Reactor 模型，可以先跳过本章 
+
+> [!WARNING| label:小提示 ] 
+> WebFlux 常用于微服务网关架构中，如果您的应用基于单体架构且非 Reactor 模型，可以先跳过本章  
+
 
 ---
 
diff --git a/sa-token-doc/static/doc.css b/sa-token-doc/static/doc.css
index 316f62ff..0e2362cd 100644
--- a/sa-token-doc/static/doc.css
+++ b/sa-token-doc/static/doc.css
@@ -5,18 +5,102 @@ body{font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu
 #main h2 {font-size: 1.6rem;}
 #main h3 {font-size: 1.25rem;}
 
-.main-box .markdown-section{ padding: 38px 20px; max-width: 70%; margin-left: 12%;}
+.main-box .markdown-section{ /* padding: 38px 20px; */ max-width: 100%; /* margin-left: 12%; */}
 .main-box .markdown-section h4{font-size: 1rem;}
 
+
+
+/* ------- 多设备适配 start ------- */
+.sub-nav-draw-box{ display: none; }
+body{
+	--doc-left-width: 300px;
+	--doc-context-width: 1000px;
+	--doc-right-width: 300px;
+}
+
+/* 大于 1100px，就显示左中右结构 */
+@media screen and (min-width: 1100px) {
+	.doc-right-bj-box{ display: block; }
+	.main-box .content{left: 0;}
+	.main-box .markdown-section{width: var(--doc-context-width); padding: 38px 20px; border: 0px green solid;}
+	.main-box .doc-right-bj-box{left: calc(50% + (var(--doc-context-width) / 2) + 10px);}
+	.main-box .sidebar-nav>ul>li>ul>li>.app-sub-sidebar{ 
+		position: fixed;
+		top: 120px;
+		left: calc(50% + (var(--doc-context-width) / 2) + 10px);
+		width: var(--doc-right-width) !important;
+		border: 0px #000 solid;
+		line-height: 1.4em;
+		width: calc(300px - 25px);
+		max-height: 50vh;
+		overflow: auto;
+	}
+	.main-box .sidebar{width: var(--doc-left-width);}
+	.main-box .sidebar-nav>ul>li>ul>li>.app-sub-sidebar::-webkit-scrollbar{ width: 0px; }
+	.main-box .sidebar-nav>ul>li>ul>li>.app-sub-sidebar li.active a{ color: #42B983; }
+	.main-box .sidebar-nav>ul>li>ul>li>.app-sub-sidebar li a{ font-size: 12px; color: #888; }
+	/* .main-box .app-sub-sidebar{display: none;} */
+}
+/* 小于 1100px时 */
+@media screen and (max-width: 1100px) {
+	.doc-right-bj-box{ display: none; }
+}
+
+
+
+/* 大于 1600px */
+@media screen and (min-width: 1600px) {
+	body{
+		--doc-left-width: 300px;
+		--doc-context-width: 1000px;
+		--doc-right-width: 300px;
+	}
+}
+/* 小于 1100px - 1600px 之间 */
+@media screen and (max-width: 1600px) {
+	body{
+		--doc-left-width: 200px;
+		--doc-context-width: calc( 100vw - 400px - 50px);
+		--doc-right-width: calc(200px - 20px);
+	}
+}
+/* 小于 1100px时 */
+@media screen and (max-width: 1100px) {
+	.doc-right-bj-box{ display: none; }
+}
+/* 小于 800px时 */
+/* @media screen and (max-width: 800px) {
+	.doc-right-bj-box{ display: none; }
+} */
+
+
 /* 媒体查询 */
 @media screen and (max-width: 800px) {
 	.nav-left .logo-box .logo-text,
 	.nav-left .logo-box sub{display: none;}
-	.main-box .markdown-section{max-width: 1000px; margin-left: auto; margin-top: 40px;}
+	/* .main-box .markdown-section{max-width: 1000px; margin-left: auto; margin-top: 40px;} */
 }
 /* 手机端不显示广告，和一些其它东西 */
 @media (max-width: 576px) {.wwads-cn,.p-none{display:none!important}} 
 
+/* ------- 多设备适配 end ------- */
+
+
+/* 右侧盒子 */
+.doc-right-bj-box{
+	width: var(--doc-right-width);
+	padding: 10px;
+	position: fixed;
+	margin-top: 10px;
+	top: 60px;
+	border: 0px #000 solid;
+	font-size: 12px;
+}
+.doc-right-bj-box-title{ font-size: 14px; color: #888; padding-bottom: 8px; border-bottom: 1px #aaa solid; }
+.doc-right-more-item{ position: absolute; border: 0px #000 solid; color: #000; width: 100%;}
+
+
+
 
 /* ------- 头部样式 ------- */
 .doc-header{position: fixed; top: 0; z-index: 1000; width: 100%; height: 60px; line-height: 60px;}
@@ -30,14 +114,14 @@ body{font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu
 .logo-box sub{margin-left: 5px; color: #666;}
 
 /* 右边导航 */
-.doc-header .nav-right{margin: 0;  float: right; padding-right: 4em; font-size: 15px;}
-.doc-header .nav-right>*{padding: 0px; margin: 0 15px;}
+.doc-header .nav-right{margin: 0;  float: right; padding-right: 3em; margin-right: 20px !important;}
+.doc-header .nav-right>*{padding: 0px; margin: 0 10px;}
 .doc-header .nav-right>*:last-child{position: relative; z-index: 1002;}
 .doc-header .nav-right>select{border-color: #999; color: #666; outline: 0; cursor: pointer; transition: all 0.2s; background-color: #FFF; border-width: 1px; outline: 0;}
 .doc-header .nav-right>select:hover{box-shadow: 0 0 10px #aaa;}
 
 .github-corner{z-index: 1001 !important;}
-.doc-header .nav-right .wzi{font-size: 15px; line-height: 61px; transition: color 0.2s; padding-bottom: 4px;}
+.doc-header .nav-right .wzi{font-size: 14px; line-height: 61px; transition: color 0.2s; padding-bottom: 4px;}
 .doc-header .nav-right .wzi:hover{border-bottom: 2px var(--a-color) solid;}
 
 .nav-right a{color: #34495E;}
@@ -74,10 +158,11 @@ body{font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu
 
 /* ------- 调整一下左侧树的字体样式 ------- */
 .main-box .sidebar{padding-top: 25px; margin-top: 60px;}
-.sidebar .sidebar-nav>ul>li>p{font-size: 1.2em; margin-top: 10px;}
-.sidebar .sidebar-nav>ul>li> strong{font-size: 1.2em; margin-top: 10px;}
+.sidebar .sidebar-nav>ul>li>p{/* font-size: 1.2em; */ margin-top: 10px;}
+.sidebar .sidebar-nav>ul>li> strong{/* font-size: 1.2em; */ margin-top: 10px;}
 /* .sidebar ul li a{color: #222;} */
-.sidebar .sidebar-nav>ul>li>ul>li>a{/* color: #222; */font-size: 16px; /* font-weight: 700; */}
+.sidebar .sidebar-nav>ul>li>ul>li>a{/* color: #222; */font-size: 14px; /* font-weight: 700; */}
+.main-box .sidebar-nav ul li{margin-top: 0; margin-bottom: 0;}
 .main-box .sidebar ul li a{color: #00323c;}
 
 /* 做到悬浮出现下划线的效果 */
@@ -89,11 +174,16 @@ body{font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu
 .main-box .sidebar li.active>a{border: 0px;}
 .main-box .sidebar li.active>a:after{content: ''; position: absolute; height: 30px; right: 0; border-right: 3px #42b983 solid;} */
 
+.sidebar .sidebar-nav>ul>li>ul>li.active-rep>a{ color: #42B983; font-weight: 700; }
+
+
 
 /* .main-box .sidebar .app-sub-sidebar li:before{float: none;} */
 
 /* ============== code代码样式优化 ================ */
 
+.main-box .markdown-section code, .main-box .markdown-section pre{background-color: rgba(0, 0, 0, 0.04);}
+
 /* 背景变黑 */
 .main-box [data-lang]{padding: 0px !important; border-radius: 2px;overflow-x: auto; overflow-y: hidden;}
 .main-box [v-pre] code{border: 0px red solid; border-radius: 0px; /* background-color: #282828; */ background-color: #191919; color: #FFF;}
@@ -330,30 +420,31 @@ body {
 }
 .main-box details p{padding: 0 14px;}
 
-/* 顶部广告 */
-#main .top-ad-box{padding: 0.5em 1em; font-size: 12px; margin-bottom: 30px; background-color: rgba(0, 0, 0, 0.04);}
-#main .top-ad-box a{border-bottom: 0px;}
-#main .top-ad-box a:hover{border-bottom: 0px;}
-#main .top-ad-box a img{border: 0px #ddd solid; width: 100%; /* max-height: 80px; */
- border-radius: 2px; transition: all 0.2s;}
-#main .top-ad-box a img:hover{box-shadow: 0 0 20px #ddd;}
-.ad-tips{color: #aaa;}
+/* 广告盒子 */
+.ad-title{ font-size: 14px; color: #aaa; padding-bottom: 8px; margin-bottom: 14px; border-bottom: 1px #aaa solid; }
+.ad-tips{margin-bottom: 5px;}
 .ad-close{float: right;}
 .ad-close:hover{cursor: pointer; text-decoration: underline; color: red;}
 
+.main-box .top-ad-box{font-size: 12px;}
+.main-box .top-ad-box a{border-bottom: 0px;}
+.main-box .top-ad-box a:hover{border-bottom: 0px;}
+.main-box .top-ad-box a img{border: 0px #ddd solid; width: 100%; /* max-height: 80px; */ border-radius: 2px; transition: all 0.2s;}
+.main-box .top-ad-box a img:hover{box-shadow: 0 0 20px #ddd;}
+
 
 /* 帮助按钮 */
-.help-btn{transition: all 0.2s;}
-.help-btn:hover{box-shadow: 0 0 30px #aaa !important;}
+.help-btn{transition: all 0.5s; text-align: center; border: 1px #42b983 solid; background-color: rgba(255, 255, 255, 0.5); cursor: pointer; font-size: 13px; color: #42b983; line-height: 40px;}
+.help-btn:hover{box-shadow: 0 0 20px #D1EEE1 !important;}
 .xiaozhushou-intro p{line-height: 16px;}
 
 /* 按钮发光动画 */
-.help-btn{animation: helpbtnanimation 3s infinite;}
+/* .help-btn{animation: helpbtnanimation 3s infinite;}
 @keyframes helpbtnanimation{
     0%{box-shadow: 0 0 1px #42B983;}
     50%{box-shadow: 0 0 20px #42B983;}
     100%{box-shadow: 0 0 20px #FFF;}
-}
+} */
 
 /* ********** 赞助者名单 ******** */
 .zanzhu-table{text-align: left;}
@@ -374,3 +465,18 @@ body {
 .ajax-layer-load.layui-layer-dialog{min-width: 0px !important; background-color: rgba(0,0,0,0.85);}
 .ajax-layer-load.layui-layer-dialog .layui-layer-content{padding: 10px 20px 10px 40px; color: #FFF;}
 .ajax-layer-load.layui-layer-dialog .layui-layer-content .layui-layer-ico{width: 20px; height: 20px; background-size: 20px 20px; top: 12px; }
+
+
+/* 万维广告 */
+.wwads-cn{margin-top: 0px !important;}
+.wwads-cn>a>img{width: 80px !important;}
+
+/* 提示框 */
+.main-box .alert{ border-radius: 0px !important; }
+/* .main-box .alert ul,.main-box .alert ol{ margin-top: -5px; margin-bottom: -10px; } */
+.main-box .alert.tip .title .icon.icon-tip{
+	background-image: url("data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 16 16' fill='%2301354d' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16zm.93-9.412-2.29.287-.082.38.45.083c.294.07.352.176.288.469l-.738 3.468c-.194.897.105 1.319.808 1.319.545 0 1.178-.252 1.465-.598l.088-.416c-.2.176-.492.246-.686.246-.275 0-.375-.193-.304-.533L8.93 6.588zM8 5.5a1 1 0 1 0 0-2 1 1 0 0 0 0 2z'/%3E%3C/svg%3E");
+}
+.main-box .alert.flat.note{background-color: #E8F4FF;}
+.main-box .alert.flat.tip{background-color: #F0F9EB;}
+.main-box .alert.flat.warning{background-color: #FDF6EC;}
\ No newline at end of file
diff --git a/sa-token-doc/static/docsify-plugin.js b/sa-token-doc/static/docsify-plugin.js
index 42f1c29c..8e7eb851 100644
--- a/sa-token-doc/static/docsify-plugin.js
+++ b/sa-token-doc/static/docsify-plugin.js
@@ -69,53 +69,55 @@ var myDocsifyPlugin = function(hook, vm) {
 		}
 		
 		// 功能6：标题下面的广告 
-		if(vm.route.path !== '/' && $(window).width() >= 800) {
-			var ad = `<p class="top-ad-box">
-				<span class="ad-tips">推广信息：</span>
-				<span class="ad-tips ad-close">关闭（一周内不再显示）</span>
-				<a href="http://sa-pro.dev33.cn?from=satop" target="_blank">
-					<img src="https://oss.dev33.cn/sa-token/ad/sa-sso-pro-x.png" />
-				</a>
-			</p>`;
+		// if(vm.route.path !== '/' && $(window).width() >= 800) {
+		// 	var ad = `<p class="top-ad-box">
+		// 		<span class="ad-tips">推广信息：</span>
+		// 		<span class="ad-tips ad-close">关闭</span>
+		// 		<a href="http://sa-pro.dev33.cn?from=satop" target="_blank">
+		// 			<img src="https://oss.dev33.cn/sa-token/ad/sa-sso-pro-s3.png" />
+		// 		</a>
+		// 	</p>`;
 				
-			// 没有下划线就先补个下划线
-			// if($('#main h1').next().prop('tagName') !== 'HR') {
-			// 	$('#main h1').after('<hr/>');
-			// }
+		// 	// 没有下划线就先补个下划线
+		// 	// if($('#main h1').next().prop('tagName') !== 'HR') {
+		// 	// 	$('#main h1').after('<hr/>');
+		// 	// }
 			
-			// 如果一周内用户点击过关闭广告，则不再展现
-			let allowJg = 1000 * 60 * 60 * 24 * 7;
-			// allowJg = 1000 * 10;
-			try{
-				const closeAdTime = localStorage.closeAdTime;
-				if(closeAdTime) {
-					// 点击广告关闭的时间，和当前时间的差距
-					const closeAdJg = new Date().getTime() - parseInt(closeAdTime);
+		// 	// 如果一周内用户点击过关闭广告，则不再展现
+		// 	let allowJg = 1000 * 60 * 60 * 24 * 7;
+		// 	// allowJg = 1000 * 10;
+		// 	try{
+		// 		const closeAdTime = localStorage.closeAdTime;
+		// 		if(closeAdTime) {
+		// 			// 点击广告关闭的时间，和当前时间的差距
+		// 			const closeAdJg = new Date().getTime() - parseInt(closeAdTime);
 					
-					// 差距小于七天，不再展示 
-					if(closeAdJg < allowJg) {
-						console.log('not show ad ...');
-						return;
-					}
-				}
-			}catch(e){
-				console.error(e);
-			}
+		// 			// 差距小于七天，不再展示 
+		// 			if(closeAdJg < allowJg) {
+		// 				console.log('not show ad ...');
+		// 				return;
+		// 			}
+		// 		}
+		// 	}catch(e){
+		// 		console.error(e);
+		// 	}
 			
 			
-			// 添加广告
-			$('#main h1').after(ad);
-			// 添加关闭事件
-			$('.top-ad-box .ad-close').click(function(){
-				console.log('关闭广告');
-				// $('.top-ad-box').slideUp(); // 折叠收起
-				layer.confirm('关闭后，一周内不再展现此信息', function(){
-					$(".top-ad-box").fadeOut(1000); // 淡出效果
-					layer.msg('关闭成功');
-					localStorage.closeAdTime = new Date().getTime();
-				})
-			})
-		}
+		// 	// 添加广告
+		// 	// $('#main h1').after(ad);
+		// 	$('.ssp-ad-box').append(ad)
+			
+		// 	// 添加关闭事件
+		// 	$('.top-ad-box .ad-close').click(function(){
+		// 		console.log('关闭广告');
+		// 		// $('.top-ad-box').slideUp(); // 折叠收起
+		// 		layer.confirm('关闭后，一周内不再展现此信息', function(){
+		// 			$(".top-ad-box").fadeOut(1000); // 淡出效果
+		// 			layer.msg('关闭成功');
+		// 			localStorage.closeAdTime = new Date().getTime();
+		// 		})
+		// 	})
+		// }
 		
 	});
 	
diff --git a/sa-token-doc/static/docsify-plugins/docsify-plugin-flexible-alerts.min-1.1.1.js b/sa-token-doc/static/docsify-plugins/docsify-plugin-flexible-alerts.min-1.1.1.js
new file mode 100644
index 00000000..2ebc3183
--- /dev/null
+++ b/sa-token-doc/static/docsify-plugins/docsify-plugin-flexible-alerts.min-1.1.1.js
@@ -0,0 +1,9 @@
+/*!
+ * docsify-plugin-flexible-alerts
+ * v1.1.1
+ * https://github.com/fzankl/docsify-plugin-flexible-alerts#readme
+ * (c) 2022 Fabian Zankl
+ * MIT license
+ */
+!function(){"use strict";function t(e){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},t(e)}!function(t,e){void 0===e&&(e={});var a=e.insertAt;if(t&&"undefined"!=typeof document){var o=document.head||document.getElementsByTagName("head")[0],l=document.createElement("style");l.type="text/css","top"===a&&o.firstChild?o.insertBefore(l,o.firstChild):o.appendChild(l),l.styleSheet?l.styleSheet.cssText=t:l.appendChild(document.createTextNode(t))}}(".alert{word-wrap:break-word;display:block;margin-bottom:1rem!important;padding:.75rem 1.25rem!important;position:relative;word-break:break-word}.alert>*{max-width:100%}.alert>:first-child{margin-top:0}.alert>:last-child{margin-bottom:0}.alert:before{content:unset!important}.alert+.alert{margin-top:-.25rem!important}.alert p{margin-bottom:.5rem;margin-top:.5rem}.alert .title{align-items:center;display:flex;flex-wrap:wrap;font-weight:600;margin:0}.icon{background-repeat:no-repeat;display:inline-block;height:16px;margin-right:.5rem;width:16px}.alert.callout{background:var(--background);border:1px solid #eee;border-left-width:.25rem;border-radius:.25rem}.alert.callout.note{border-left-color:#17a2b8!important}.alert.callout.note .title{color:#17a2b8}.alert.callout.note .icon-note{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 16 16' fill='%2317a2b8' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16zm.93-9.412-2.29.287-.082.38.45.083c.294.07.352.176.288.469l-.738 3.468c-.194.897.105 1.319.808 1.319.545 0 1.178-.252 1.465-.598l.088-.416c-.2.176-.492.246-.686.246-.275 0-.375-.193-.304-.533L8.93 6.588zM8 5.5a1 1 0 1 0 0-2 1 1 0 0 0 0 2z'/%3E%3C/svg%3E\")}.alert.callout.tip{border-left-color:#28a745!important}.alert.callout.tip .title{color:#28a745}.alert.callout.tip .icon-tip{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 352 512' fill='%2328a745' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M96.06 454.35c.01 6.29 1.87 12.45 5.36 17.69l17.09 25.69a31.99 31.99 0 0 0 26.64 14.28h61.71a31.99 31.99 0 0 0 26.64-14.28l17.09-25.69a31.989 31.989 0 0 0 5.36-17.69l.04-38.35H96.01l.05 38.35zM0 176c0 44.37 16.45 84.85 43.56 115.78 16.52 18.85 42.36 58.23 52.21 91.45.04.26.07.52.11.78h160.24c.04-.26.07-.51.11-.78 9.85-33.22 35.69-72.6 52.21-91.45C335.55 260.85 352 220.37 352 176 352 78.61 272.91-.3 175.45 0 73.44.31 0 82.97 0 176zm176-80c-44.11 0-80 35.89-80 80 0 8.84-7.16 16-16 16s-16-7.16-16-16c0-61.76 50.24-112 112-112 8.84 0 16 7.16 16 16s-7.16 16-16 16z'/%3E%3C/svg%3E\")}.alert.callout.warning{border-left-color:#f0ad4e!important}.alert.callout.warning .title{color:#f0ad4e}.alert.callout.warning .icon-warning{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 17 16' fill='%23f0ad4e' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8.982 1.566a1.13 1.13 0 0 0-1.96 0L.165 13.233c-.457.778.091 1.767.98 1.767h13.713c.889 0 1.438-.99.98-1.767L8.982 1.566zM8 5a.905.905 0 0 0-.9.995l.35 3.507a.552.552 0 0 0 1.1 0l.35-3.507A.905.905 0 0 0 8 5zm.002 6a1 1 0 1 0 0 2 1 1 0 0 0 0-2z'/%3E%3C/svg%3E\")}.alert.callout.attention{border-left-color:#dc3545!important}.alert.callout.attention .title{color:#dc3545}.alert.callout.attention .icon-attention{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 16 16' fill='%23dc3545' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8 15A7 7 0 1 0 8 1a7 7 0 0 0 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z'/%3E%3Cpath fill-rule='evenodd' d='M11.354 4.646a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708l6-6a.5.5 0 0 1 .708 0z'/%3E%3C/svg%3E\")}.alert.flat{background-color:#e2e3e5;border:1px solid #d6d8db;border-radius:.125rem;color:#383d41}.alert.flat.note{background-color:#cdeefd;border-color:#b4e6fc;color:#02587f}.alert.flat.note .title{color:#01354d}.alert.flat.note .icon-note{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 16 16' fill='%2301354d' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16zm.93-9.412-2.29.287-.082.38.45.083c.294.07.352.176.288.469l-.738 3.468c-.194.897.105 1.319.808 1.319.545 0 1.178-.252 1.465-.598l.088-.416c-.2.176-.492.246-.686.246-.275 0-.375-.193-.304-.533L8.93 6.588zM8 5.5a1 1 0 1 0 0-2 1 1 0 0 0 0 2z'/%3E%3C/svg%3E\")}.alert.flat.tip{background-color:#dbefdc;border-color:#c9e7cb;color:#285b2a}.alert.flat.tip .title{color:#18381a}.alert.flat.tip .icon-tip{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 352 512' fill='%2318381a' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M96.06 454.35c.01 6.29 1.87 12.45 5.36 17.69l17.09 25.69a31.99 31.99 0 0 0 26.64 14.28h61.71a31.99 31.99 0 0 0 26.64-14.28l17.09-25.69a31.989 31.989 0 0 0 5.36-17.69l.04-38.35H96.01l.05 38.35zM0 176c0 44.37 16.45 84.85 43.56 115.78 16.52 18.85 42.36 58.23 52.21 91.45.04.26.07.52.11.78h160.24c.04-.26.07-.51.11-.78 9.85-33.22 35.69-72.6 52.21-91.45C335.55 260.85 352 220.37 352 176 352 78.61 272.91-.3 175.45 0 73.44.31 0 82.97 0 176zm176-80c-44.11 0-80 35.89-80 80 0 8.84-7.16 16-16 16s-16-7.16-16-16c0-61.76 50.24-112 112-112 8.84 0 16 7.16 16 16s-7.16 16-16 16z'/%3E%3C/svg%3E\")}.alert.flat.warning{background-color:#ffddd3;border-color:#ffc9ba;color:#852d12}.alert.flat.warning .title{color:#581e0c}.alert.flat.warning .icon-warning{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 17 16' fill='%23581e0c' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8.982 1.566a1.13 1.13 0 0 0-1.96 0L.165 13.233c-.457.778.091 1.767.98 1.767h13.713c.889 0 1.438-.99.98-1.767L8.982 1.566zM8 5a.905.905 0 0 0-.9.995l.35 3.507a.552.552 0 0 0 1.1 0l.35-3.507A.905.905 0 0 0 8 5zm.002 6a1 1 0 1 0 0 2 1 1 0 0 0 0-2z'/%3E%3C/svg%3E\")}.alert.flat.attention{background-color:#fdd9d7;border-color:#fcc2bf;color:#7f231c}.alert.flat.attention .title{color:#551713}.alert.flat.attention .icon-attention{background-image:url(\"data:image/svg+xml;charset=utf-8,%3Csvg width='1em' height='1em' viewBox='0 0 16 16' fill='%23551713' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' d='M8 15A7 7 0 1 0 8 1a7 7 0 0 0 0 14zm0 1A8 8 0 1 0 8 0a8 8 0 0 0 0 16z'/%3E%3Cpath fill-rule='evenodd' d='M11.354 4.646a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708l6-6a.5.5 0 0 1 .708 0z'/%3E%3C/svg%3E\")}"),function(){var e={style:"callout",note:{label:"Note",icon:"icon-note",className:"note"},tip:{label:"Tip",icon:"icon-tip",className:"tip"},warning:{label:"Warning",icon:"icon-warning",className:"warning"},attention:{label:"Attention",icon:"icon-attention",className:"attention"},typeMappings:{info:"note",danger:"attention"}};function a(t,e){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:0;for(var l in e)try{e[l].constructor===Object&&o<1?t[l]=a(t[l],e[l],o+1):t[l]=e[l]}catch(a){t[l]=e[l]}return t}window.$docsify=window.$docsify||{},window.$docsify.plugins=[].concat((function(o,l){var r=a(e,l.config["flexible-alerts"]||l.config.flexibleAlerts),i=function(t,e,a,o){var l=(t||"").match(new RegExp("".concat(e,":(([\\s\\w\\u00A0-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFEF-]*))")));return l?o?o(l[1]):l[1]:o?o(a):a};o.afterEach((function(e,a){a(e.replace(/<\s*blockquote[^>]*>[\s]+?(?:<p>)?\[!(\w*)((?:\|[\w*:[\s\w\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF-]*)*?)\]([\s\S]*?)(?:<\/p>)?<\s*\/\s*blockquote>/g,(function(e,a,o,n){!r[a.toLowerCase()]&&r.typeMappings[a.toLowerCase()]&&(a=r.typeMappings[a.toLowerCase()]);var c=r[a.toLowerCase()];if(!c)return e;var d=i(o,"style",r.style),s=i(o,"iconVisibility","visible",(function(t){return"hidden"!==t})),g=i(o,"labelVisibility","visible",(function(t){return"hidden"!==t})),m=i(o,"label",c.label),u=i(o,"icon",c.icon),f=i(o,"className",c.className);if("object"===t(m)){var p=Object.keys(m).filter((function(t){return l.route.path.indexOf(t)>-1}));p&&p.length>0?m=m[p[0]]:(g=!1,s=!1)}var w='<span class="icon '.concat(u,'"></span>'),h='<p class="title">'.concat(s?w:"").concat(g?m:"","</p>");return'<div class="alert '.concat(d," ").concat(f,'">\n            ').concat(s||g?h:"","\n            <p>").concat(n,"</p>\n          </div>")})))}))}),window.$docsify.plugins)}()}();
+//# sourceMappingURL=docsify-plugin-flexible-alerts.min.js.map
\ No newline at end of file
diff --git a/sa-token-doc/static/docsify-plugins/progress.update.js b/sa-token-doc/static/docsify-plugins/progress.update.js
new file mode 100644
index 00000000..f29b8189
--- /dev/null
+++ b/sa-token-doc/static/docsify-plugins/progress.update.js
@@ -0,0 +1,76 @@
+// 显示文档阅读进度的进度条 
+// 
+// 修改于：https://github.com/HerbertHe/docsify-progress
+// 
+// 1、将最外层盒子的 z-index 值从 999 修改为 9999999999
+
+function plugin(hook, vm) {
+    let marginTop
+    hook.mounted(function () {
+        const content = document.getElementsByClassName("content")[0]
+        marginTop = parseFloat(
+            window.getComputedStyle(content).paddingTop.replace("px", "")
+        )
+
+        let insertDOM = `
+        <div style="position: fixed; width: 100%; z-index: 9999999999; height: ${
+            window.$docsify["progress"].height
+        };
+        ${
+            window.$docsify["progress"].position === "top"
+                ? "top: 0;"
+                : "bottom: 0;"
+        }">
+            <div id="progress-display" style="background-color: ${
+                window.$docsify["progress"].color
+            }; width: 0; border-radius: 2px; height: ${
+            window.$docsify["progress"].height
+        }; transition: width 0.3s;"></div>
+        </div>
+        `
+        const mainDOM = document.getElementsByTagName("body")[0]
+        mainDOM.innerHTML = mainDOM.innerHTML + insertDOM
+
+        function switcher() {
+            const body = document.getElementsByTagName("body")[0]
+            if (!body.classList.contains("close")) {
+                body.classList.add("close")
+            } else {
+                body.classList.remove("close")
+            }
+        }
+
+        const btn = document.querySelector("div.sidebar-toggle-button")
+        btn.addEventListener("click", function (e) {
+            e.stopPropagation()
+            switcher()
+        })
+    })
+    hook.ready(function () {
+        window.addEventListener("scroll", function (e) {
+            let totalHeight =
+                marginTop +
+                parseFloat(
+                    window
+                        .getComputedStyle(document.getElementById("main"))
+                        .height.replace("px", "")
+                )
+            let scrollTop =
+                document.body.scrollTop + document.documentElement.scrollTop
+            let remain = totalHeight - document.body.offsetHeight
+            document.getElementById("progress-display").style.width =
+                Math.ceil((scrollTop / remain) * 100) + "%"
+        })
+    })
+}
+
+// Docsify plugin options
+window.$docsify["progress"] = Object.assign(
+    {
+        position: "top",
+        color: "var(--theme-color,#42b983)",
+        height: "3px",
+    },
+    window.$docsify["progress"]
+)
+window.$docsify.plugins = [].concat(plugin, window.$docsify.plugins)
\ No newline at end of file
diff --git a/sa-token-doc/static/docsify-plugins/sub-nav-draw.js b/sa-token-doc/static/docsify-plugins/sub-nav-draw.js
new file mode 100644
index 00000000..4d347278
--- /dev/null
+++ b/sa-token-doc/static/docsify-plugins/sub-nav-draw.js
@@ -0,0 +1,56 @@
+// 提取次级导航栏显示到右上角 
+// 
+
+// 是否都开右边菜单
+let isOpenRightSubTitle = false;
+
+		// 重新定位 active-rep 对应的菜单 
+function positioningVmActiveRep(vm) {
+	const vmPath = '#' + vm.route.path;
+	$('.sidebar-nav>ul>li>ul>li>a').each(function(item) {
+		if($(this).attr('href') === vmPath) {
+			// $(this).parent().attr('active-rep', true);
+			$(this).parent().addClass('active-rep')
+			// console.log($(this));
+		}
+	})
+}
+
+function subNavDraw(hook, vm) {
+	
+    // 钩子函数：每次路由切换时数据全部加载完成后调用，没有参数。
+    hook.doneEach(function () {
+		// 只在宽屏下展现，太小的屏幕不展现 
+		if(document.body.clientWidth < 1100) {
+			isOpenRightSubTitle = false;
+			return;
+		} else {
+			isOpenRightSubTitle = true;
+		}
+		
+		// 修改高度 
+		const $dom = $('.app-sub-sidebar');
+		$('.doc-right-more-item').css({ top: ($dom.height() + 80) + 'px' })
+		
+		// 重新定位 active-rep 对应的菜单 
+		positioningVmActiveRep(vm);
+    })
+	
+	
+	// 钩子函数：初始化并第一次加载完成数据后调用，没有参数。
+	hook.ready(function () {
+		
+	})
+	
+	
+}
+
+window.$docsify.plugins = [].concat(subNavDraw, window.$docsify.plugins)
+
+// 滚动时设置一下左侧滚动条高度，不要超出可视区域 
+$(document).scroll(function(){
+	if(isOpenRightSubTitle) {
+		const offsetTop = $('.active-rep').get(0).offsetTop;
+		$('.sidebar').scrollTop(offsetTop - ($('.sidebar').height() / 2))
+	}
+})
diff --git a/sa-token-doc/static/index.css b/sa-token-doc/static/index.css
index 08cfc6bc..9cc634e0 100644
--- a/sa-token-doc/static/index.css
+++ b/sa-token-doc/static/index.css
@@ -23,13 +23,13 @@ body{font-size: 16px; color: #34495E; font-family: "Source Sans Pro","Helvetica
 .logo-box .logo-text {display: inline-block; margin: 0; padding: 0; padding-left: 5px; vertical-align: middle; font-size: 22px;/* font-weight: 700; */}
 
 /* 右边导航 */
-.doc-header .nav-right{margin: 0;  float: right; line-height: 60px; padding-right: 4em; white-space: nowrap; font-size: 15px; }
-.doc-header .nav-right>*{padding: 0px; margin: 0 14px;}
+.doc-header .nav-right{margin: 0;  float: right; line-height: 60px; padding-right: 4em; white-space: nowrap; }
+.doc-header .nav-right>*{padding: 0px; margin: 0 9px;}
 .doc-header .nav-right>*:last-child{position: relative; z-index: 1002; }
 
 .nav-right a{color: #34495E; text-decoration: none; transition: all 0.2s;}
 .nav-right a:hover{color: #42B983;}
-.doc-header .nav-right .wzi{font-size: 15px; line-height: 61px; transition: color 0.2s; padding-bottom: 4px;}
+.doc-header .nav-right .wzi{font-size: 14px; line-height: 61px; transition: color 0.2s; padding-bottom: 4px;}
 .doc-header .nav-right .wzi:hover{border-bottom: 2px #42B983 solid;}
 
 /* 小章鱼 */
diff --git a/sa-token-doc/up/disable.md b/sa-token-doc/up/disable.md
index 7ff979aa..8cb74138 100644
--- a/sa-token-doc/up/disable.md
+++ b/sa-token-doc/up/disable.md
@@ -37,7 +37,8 @@ StpUtil.checkDisable(10001);
 StpUtil.login(10001); 
 ```
 
-!> 旧版本在 `StpUtil.login()` 时会自动校验账号是否被封禁，v1.31.0 之后将 校验封禁 和 登录 两个动作分离成两个方法，不再自动校验，请注意其中的逻辑更改。
+> [!ATTENTION| label:升级注意：] 
+> 旧版本在 `StpUtil.login()` 时会自动校验账号是否被封禁，v1.31.0 之后将 校验封禁 和 登录 两个动作分离成两个方法，不再自动校验，请注意其中的逻辑更改。
 
 此模块所有方法：
 ``` java
diff --git a/sa-token-doc/up/global-filter.md b/sa-token-doc/up/global-filter.md
index 25b42ccf..3ee24375 100644
--- a/sa-token-doc/up/global-filter.md
+++ b/sa-token-doc/up/global-filter.md
@@ -73,10 +73,10 @@ public class SaTokenConfigure {
 }
 ```
 
-##### 注意事项：
-- 在`[认证函数]`里，你可以写和拦截器里一致的代码，进行路由匹配鉴权，参考：[路由拦截鉴权](/use/route-check)。
-- 由于过滤器中抛出的异常不进入全局异常处理，所以你必须提供`[异常处理函数]`来处理`[认证函数]`里抛出的异常。
-- 在`[异常处理函数]`里的返回值，将作为字符串输出到前端，如果需要定制化返回数据，请注意其中的格式转换。
+> [!WARNING| label:注意事项：] 
+> - 在`[认证函数]`里，你可以写和拦截器里一致的代码，进行路由匹配鉴权，参考：[路由拦截鉴权](/use/route-check)。
+> - 由于过滤器中抛出的异常不进入全局异常处理，所以你必须提供`[异常处理函数]`来处理`[认证函数]`里抛出的异常。
+> - 在`[异常处理函数]`里的返回值，将作为字符串输出到前端，如果需要定制化返回数据，请注意其中的格式转换。
 
 改写 `setError` 函数的响应格式示例：
 ``` java
diff --git a/sa-token-doc/up/safe-auth.md b/sa-token-doc/up/safe-auth.md
index 6d6d740b..0f678f9e 100644
--- a/sa-token-doc/up/safe-auth.md
+++ b/sa-token-doc/up/safe-auth.md
@@ -69,13 +69,13 @@ public SaResult openSafe(String password) {
 }
 ```
 
-调用步骤：
-1. 前端调用 `deleteProject` 接口，尝试删除仓库。
-2. 后端校验会话尚未完成二级认证，返回： `仓库删除失败，请完成二级认证后再次访问接口`。
-3. 前端将信息提示给用户，用户输入密码，调用 `openSafe` 接口。
-4. 后端比对用户输入的密码，完成二级认证，有效期为：120秒。
-5. 前端在 120 秒内再次调用 `deleteProject` 接口，尝试删除仓库。
-6. 后端校验会话已完成二级认证，返回：`仓库删除成功`。
+> [!NOTE| label:调用步骤：] 
+> 1. 前端调用 `deleteProject` 接口，尝试删除仓库。
+> 2. 后端校验会话尚未完成二级认证，返回： `仓库删除失败，请完成二级认证后再次访问接口`。
+> 3. 前端将信息提示给用户，用户输入密码，调用 `openSafe` 接口。
+> 4. 后端比对用户输入的密码，完成二级认证，有效期为：120秒。
+> 5. 前端在 120 秒内再次调用 `deleteProject` 接口，尝试删除仓库。
+> 6. 后端校验会话已完成二级认证，返回：`仓库删除成功`。
 
 
 ### 指定业务标识进行二级认证
diff --git a/sa-token-doc/up/search-session.md b/sa-token-doc/up/search-session.md
index 9032eed2..b47c3ba5 100644
--- a/sa-token-doc/up/search-session.md
+++ b/sa-token-doc/up/search-session.md
@@ -83,6 +83,7 @@ for (String sessionId : sessionIdList) {
 请根据业务实际水平合理调用API。
 
 
+> [!WARNING| label:注意] 
 > 基于活动 Token 的统计方式会比实际情况略有延迟，如果需要精确统计实时在线用户信息建议采用 WebSocket。
 
 
diff --git a/sa-token-doc/up/token-prefix.md b/sa-token-doc/up/token-prefix.md
index c75c4dae..67f25980 100644
--- a/sa-token-doc/up/token-prefix.md
+++ b/sa-token-doc/up/token-prefix.md
@@ -32,9 +32,8 @@ sa-token.token-prefix=Bearer
 此时 Sa-Token 便可在读取 Token 时裁剪掉 `Bearer`，成功获取`xxxx-xxxx-xxxx-xxxx`。
 
 
-### 注意点
-
-1. Token前缀  与 Token值 之间必须有一个空格。
-2. 一旦配置了 Token前缀，则前端提交 `Token` 时，必须带有前缀，否则会导致框架无法读取 Token。
-3. 由于`Cookie`中无法存储空格字符，也就意味配置 Token 前缀后，Cookie 鉴权方式将会失效，此时只能将 Token 提交到`header`里进行传输。
+> [!WARNING| label:注意点] 
+> 1. Token前缀  与 Token值 之间必须有一个空格。
+> 2. 一旦配置了 Token前缀，则前端提交 `Token` 时，必须带有前缀，否则会导致框架无法读取 Token。
+> 3. 由于`Cookie`中无法存储空格字符，所以配置 Token 前缀后，Cookie 模式将会失效，此时只能将 Token 提交到`header`里进行传输。
 
diff --git a/sa-token-doc/up/token-style.md b/sa-token-doc/up/token-style.md
index 459ad571..6593756a 100644
--- a/sa-token-doc/up/token-style.md
+++ b/sa-token-doc/up/token-style.md
@@ -63,5 +63,6 @@ public class SaTokenConfigure {
 gfuPSwZsnUhwgz08GTCH4wOgasWtc3odP4HLwXJ7NDGOximTvT4OlW19zeLH
 ```
 
-!> **更改了 token 生成策略但是不生效？**<br> 把 Redis 中的旧数据清除掉再试试
+> [!WARNING| label:更改了 token 生成策略但是不生效？] 
+> 把 Redis 中的旧数据清除掉再试试
 
diff --git a/sa-token-doc/use/jur-auth.md b/sa-token-doc/use/jur-auth.md
index e1639eec..c9f4c3b4 100644
--- a/sa-token-doc/use/jur-auth.md
+++ b/sa-token-doc/use/jur-auth.md
@@ -71,7 +71,7 @@ public class StpInterfaceImpl implements StpInterface {
 
 可参考代码：[码云：StpInterfaceImpl.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpInterfaceImpl.java)
 
-> 有同学会产生疑问：我实现了此接口，但是程序启动时好像并没有执行，是不是我写错了？
+> [!TIP| label:有同学会产生疑问：我实现了此接口，但是程序启动时好像并没有执行，是不是我写错了？] 
 > 答：不执行是正常现象，程序启动时不会执行这个接口的方法，在每次调用鉴权代码时，才会执行到此。
 
 
@@ -162,7 +162,8 @@ StpUtil.hasPermission("index.css");       // false
 StpUtil.hasPermission("index.html");      // false
 ```
 
-!> 上帝权限：当一个账号拥有 `"*"` 权限时，他可以验证通过任何权限码 （角色认证同理）
+> [!WARNING| label:上帝权限] 
+> 当一个账号拥有 `"*"` 权限时，他可以验证通过任何权限码 （角色认证同理）
 
 
 ### 7、如何把权限精确到按钮级？
@@ -176,19 +177,18 @@ StpUtil.hasPermission("index.html");      // false
 2. 前端将权限码集合保存在`localStorage`或其它全局状态管理对象中。
 3. 在需要权限控制的按钮上，使用 js 进行逻辑判断，例如在`Vue`框架中我们可以使用如下写法：
 ``` js
+// `arr`是当前用户拥有的权限码数组
+// `user.delete`是显示按钮需要拥有的权限码
+// `删除按钮`是用户拥有权限码才可以看到的内容。
 <button v-if="arr.indexOf('user.delete') > -1">删除按钮</button>
 ```
-其中：`arr`是当前用户拥有的权限码数组，`user.delete`是显示按钮需要拥有的权限码，`删除按钮`是用户拥有权限码才可以看到的内容。
 
+以上写法只为提供一个参考示例，不同框架有不同写法，大家可根据项目技术栈灵活封装进行调用。
 
-注意：以上写法只为提供一个参考示例，不同框架有不同写法，大家可根据项目技术栈灵活封装进行调用。
 
-
-### 8、前端有了鉴权后端还需要鉴权吗？
-**需要！**
-
-前端的鉴权只是一个辅助功能，对于专业人员这些限制都是可以轻松绕过的，
-为保证服务器安全，**无论前端是否进行了权限校验，后端接口都需要对会话请求再次进行权限校验！**
+> [!ATTENTION| label:前端有了鉴权后端还需要鉴权吗？] 
+> **需要！** <br>
+> 前端的鉴权只是一个辅助功能，对于专业人员这些限制都是可以轻松绕过的，为保证服务器安全：**无论前端是否进行了权限校验，后端接口都需要对会话请求再次进行权限校验！**
 
 
 
diff --git a/sa-token-doc/use/login-auth.md b/sa-token-doc/use/login-auth.md
index 36efa67f..484848d8 100644
--- a/sa-token-doc/use/login-auth.md
+++ b/sa-token-doc/use/login-auth.md
@@ -32,13 +32,13 @@ StpUtil.login(Object id);
 ```
 
 只此一句代码，便可以使会话登录成功，实际上，Sa-Token 在背后做了大量的工作，包括但不限于：
-
+ 
 1. 检查此账号是否之前已有登录；
 2. 为账号生成 `Token` 凭证与 `Session` 会话；
 3. 记录 Token 活跃时间；
 4. 通知全局侦听器，xx 账号登录成功；
 5. 将 `Token` 注入到请求上下文；
-6. 等等其它工作……
+6. 等等其它工作…… 
 
 你暂时不需要完整了解整个登录过程，你只需要记住关键一点：`Sa-Token 为这个账号创建了一个Token凭证，且通过 Cookie 上下文返回给了前端`。
 
@@ -61,12 +61,16 @@ public SaResult doLogin(String name, String pwd) {
 如果你对以上代码阅读没有压力，你可能会注意到略显奇怪的一点：此处仅仅做了会话登录，但并没有主动向前端返回 token 信息。
 是因为不需要吗？严格来讲是需要的，只不过 `StpUtil.login(id)` 方法利用了 Cookie 自动注入的特性，省略了你手写返回 token 的代码。
 
-如果你对 Cookie 功能还不太了解，也不用担心，我们会在之后的 [ 前后端分离 ] 章节中详细的阐述 Cookie 功能，现在你只需要了解最基本的两点：
 
-- Cookie 可以从后端控制往浏览器中写入 token 值。
-- Cookie 会在前端每次发起请求时自动提交 token 值。
+> [!TIP| label:Cookie 是什么？] 
+> 如果你对 Cookie 功能还不太了解，也不用担心，我们会在之后的 [ 前后端分离 ] 章节中详细的阐述 Cookie 功能，现在你只需要了解最基本的两点：
+> 
+> - Cookie 可以从后端控制往浏览器中写入 token 值。
+> - Cookie 会在前端每次发起请求时自动提交 token 值。
+> 
+> 因此，在 Cookie 功能的加持下，我们可以仅靠 `StpUtil.login(id)` 一句代码就完成登录认证。
+
 
-因此，在 Cookie 功能的加持下，我们可以仅靠 `StpUtil.login(id)` 一句代码就完成登录认证。
 
 除了登录方法，我们还需要：
 
diff --git a/sa-token-doc/use/route-check.md b/sa-token-doc/use/route-check.md
index d986c1b6..59a0d62c 100644
--- a/sa-token-doc/use/route-check.md
+++ b/sa-token-doc/use/route-check.md
@@ -3,6 +3,7 @@
 --- 
 
 假设我们有如下需求：
+> [!INFO| label:需求场景] 
 > 项目中所有接口均需要登录认证，只有 “登录接口” 本身对外开放
 
 我们怎么实现呢？给每个接口加上鉴权注解？手写全局拦截器？似乎都不是非常方便。
@@ -28,7 +29,8 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 ```
 以上代码，我们注册了一个基于 `StpUtil.checkLogin()` 的登录校验拦截器，并且排除了`/user/doLogin`接口用来开放登录（除了`/user/doLogin`以外的所有接口都需要登录才能访问）。
 
-!> `SaInterceptor` 是新版本提供的拦截器，点此 [查看旧版本代码迁移示例](https://blog.csdn.net/shengzhang_/article/details/126458949)。
+> [!WARNING| label:版本升级] 
+> `SaInterceptor` 是新版本提供的拦截器，点此 [查看旧版本代码迁移示例](https://blog.csdn.net/shengzhang_/article/details/126458949)。
 
 ### 2、校验函数详解  
 自定义认证规则：`new SaInterceptor(handle -> StpUtil.checkLogin())` 是最简单的写法，代表只进行登录校验功能。
@@ -215,7 +217,10 @@ public SaResult getList() {
 
 请求将会跳过拦截器的校验，直接进入 Controller 的方法中。
 
-**注意点：此注解的忽略效果只针对 SaInterceptor拦截器 和 AOP注解鉴权 生效，对自定义拦截器与过滤器不生效。**
+> [!WARNING| label:注意点] 
+> 注解 `@SaIgnore` 的忽略效果只针对 SaInterceptor拦截器 和 AOP注解鉴权 生效，对自定义拦截器与过滤器不生效。
+
+
 
 
 ### 7、关闭注解校验
diff --git a/sa-token-doc/use/session.md b/sa-token-doc/use/session.md
index ca5af13c..dead0342 100644
--- a/sa-token-doc/use/session.md
+++ b/sa-token-doc/use/session.md
@@ -20,6 +20,7 @@ SysUser user = (SysUser) StpUtil.getSession().get("user");
 - `Token-Session`: 指的是框架为每个 token 分配的 Session  
 - `Custom-Session`: 指的是以一个 特定的值 作为SessionId，来分配的 Session 
 
+> [!TIP| style:callout] 
 > 有关 Account-Session 与 Token-Session 的详细区别，可参考：[Session模型详解](/fun/session-model)
 
 
-- 
Gitee


From d62cdc79e0ceb6459b4dbf9862a76b3300f72faf Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 30 Jul 2024 12:48:27 +0800
Subject: [PATCH 094/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/index.html         |  3 ++-
 sa-token-doc/more/join-group.md | 15 ++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 172fe23c..313edb37 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -190,7 +190,8 @@
 						</div>
 					</div>
 					<div class="re-text">
-						<span>有了Sa-Token，你所有的权限认证问题，都不再是问题！</span>
+						<!-- <span>有了Sa-Token，你所有的权限认证问题，都不再是问题！</span> -->
+						<span>Sa-Token 可以帮你轻松解决大多数权限认证问题！</span>
 						<a href="https://oss.dev33.cn/sa-token/art/sa-token-js4.png" target="_blank">点击查看功能结构图</a>
 					</div>
 				</div>
diff --git a/sa-token-doc/more/join-group.md b/sa-token-doc/more/join-group.md
index 2ca7611a..0d37b8ba 100644
--- a/sa-token-doc/more/join-group.md
+++ b/sa-token-doc/more/join-group.md
@@ -30,7 +30,20 @@ QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0)
 - 和众多大佬一起互相 (huá shuǐ) 交流 (mō yú)。
 
 
-### 3、内部群：
+### 3、群规（碎碎念）：
+有同学质问我们，我加了群，为什么被踢了？我们很少踢人，一般只有严重违反群规了我们才会选择踢人。
+- 不要在群里发擦边图、视频。轻度我们会警告，重度我们会选择移出群聊。
+- 不要在群里聊代理、魔法上网等话题，如有需求请各自互相私聊，不要在群里聊。
+- 不要发和程序员无关的广告，和程序员有关的比如开源项目、IT网站等我们一般不管。
+
+请体谅我们，我们拉一个群也不容易，辛辛苦苦几个月才能拉满一个500人群，结果因为一些违规消息就导致封群，很难受的！
+
+被踢了还能再次加群吗？可以，只要你想加，并保证不再发布违规消息，就可以在被踢7天之后再次申请加群。
+
+
+
+
+### 4、内部群：
 
 为感谢对 Sa-Token 生态做出贡献的同学，我们特创建了内部群：【Sa-Token 生态共享与合作】
 
-- 
Gitee


From 93a03c92e32b3905129d045f4358b8c0de8be9a7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 30 Jul 2024 15:29:05 +0800
Subject: [PATCH 095/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=83=A8=E5=88=86?=
 =?UTF-8?q?=E5=9C=BA=E6=99=AF=E4=B8=8B=E6=96=87=E6=A1=A3=E5=8F=B3=E4=BE=A7?=
 =?UTF-8?q?=E7=9B=AE=E5=BD=95=E9=AB=98=E5=BA=A6=E4=B8=8D=E8=83=BD=E6=AD=A3?=
 =?UTF-8?q?=E7=A1=AE=E8=AF=BB=E5=8F=96=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/static/docsify-plugins/sub-nav-draw.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sa-token-doc/static/docsify-plugins/sub-nav-draw.js b/sa-token-doc/static/docsify-plugins/sub-nav-draw.js
index 4d347278..617d0b56 100644
--- a/sa-token-doc/static/docsify-plugins/sub-nav-draw.js
+++ b/sa-token-doc/static/docsify-plugins/sub-nav-draw.js
@@ -30,7 +30,8 @@ function subNavDraw(hook, vm) {
 		
 		// 修改高度 
 		const $dom = $('.app-sub-sidebar');
-		$('.doc-right-more-item').css({ top: ($dom.height() + 80) + 'px' })
+		console.log($dom, $dom.height());
+		$('.doc-right-more-item').css({ top: (($dom.height() ?? 0) + 80) + 'px' })
 		
 		// 重新定位 active-rep 对应的菜单 
 		positioningVmActiveRep(vm);
-- 
Gitee


From bb8a206deafa2f446a5b6744c14876af3aa173f2 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 31 Jul 2024 17:40:48 +0800
Subject: [PATCH 096/172] =?UTF-8?q?=E6=96=87=E6=A1=A3=E6=96=B0=E5=A2=9E?=
 =?UTF-8?q?=E6=95=B0=E6=8D=AE=E7=BB=93=E6=9E=84=E8=AF=B4=E6=98=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md           |   1 +
 sa-token-doc/fun/data-structure.md | 362 +++++++++++++++++++++++++++++
 sa-token-doc/static/doc.css        |  17 +-
 3 files changed, 378 insertions(+), 2 deletions(-)
 create mode 100644 sa-token-doc/fun/data-structure.md

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index c75611db..33726fd6 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -107,6 +107,7 @@
 	- [数据读写三大作用域](/fun/three-scope)  
 	- [TokenInfo参数详解](/fun/token-info)
 	- [异常细分状态码](/fun/exception-code)
+	- [数据结构](/fun/data-structure)
 	- [参考：把权限放在缓存里](/fun/jur-cache)
 	- [参考：把路由拦截鉴权动态化](/fun/dynamic-router-check)
 	- [解决反向代理 uri 丢失的问题](/fun/curr-domain)
diff --git a/sa-token-doc/fun/data-structure.md b/sa-token-doc/fun/data-structure.md
new file mode 100644
index 00000000..a74bafcf
--- /dev/null
+++ b/sa-token-doc/fun/data-structure.md
@@ -0,0 +1,362 @@
+# 数据结构
+
+
+## 1、登录会话
+
+### 1.1、token -> loginId 映射
+
+``` js
+{tokenName}:{loginType}:token:{tokenValue}
+```
+
+<details>
+<summary>详细</summary>
+
+key 示例 （ttl 为 timeout 有效期值 ）
+``` js
+satoken:login:token:47ab0105-2be1-400c-b517-82f81a0cfcf8
+```
+
+
+正常 value 格式
+``` js
+10001    loginId，登录id，一般为账号id 
+```
+
+异常 value 格式
+``` js
+-1       未能从请求中读取到有效 token
+-2       已读取到 token，但是 token 无效
+-3       已读取到 token，但是 token 已经过期 (详)
+-4       已读取到 token，但是 token 已被顶下线
+-5       已读取到 token，但是 token 已被踢下线
+-6       已读取到 token，但是 token 已被冻结
+-7       未按照指定前缀提交 token
+```
+
+</details>
+
+
+### 1.2、active-timeout
+
+``` js
+{tokenName}:{loginType}:last-active:{tokenValue}
+```
+
+<details>
+<summary>详细</summary>
+
+key 示例 （key 的 ttl 为 timeout 有效期值 ）
+``` js
+satoken:login:last-active:06d1f12b-614e-4c00-8d8e-c07fef5f4aa9
+```
+
+value 格式 
+```
+1722334954193          // 单值时：此 token 最后访问日期
+1722334954193, 1200    // 双值时：此 token 最后访问日期，此 token 指定的动态 active-timeout 值 
+```
+
+active-timeout 判断方式：
+``` js
+当前时间 - token 最后访问时间 > active-timeout
+返回 true： 此 token 已冻结 
+返回 false：此 token 未冻结 
+```
+
+</details>
+
+
+
+### 1.3、SaSession
+
+``` js
+{tokenName}:{loginType}:session:{loginId}         // Account-Session
+{tokenName}:{loginType}:token-session:{loginId}   // Token-Session
+{tokenName}:custom:session:{sessionId}            // Custom-Session
+```
+
+<details>
+<summary>详细</summary>
+
+key 示例 
+``` js
+// Account-Session
+satoken:login:session:1000001
+
+// Token-Session
+satoken:login:session:47ab0105-2be1-400c-b517-82f81a0cfcf8
+
+// Custom-Session
+satoken:custom:session:role-1001
+```
+
+value 格式 
+
+``` js
+{
+  "@class": "cn.dev33.satoken.dao.SaSessionForJacksonCustomized",    // java calss 信息
+  "id": "satoken:login:session:10001",    // sessionId
+  "type": "Account-Session",    // session类型：Account-Session / Token-Session / Custom-Session
+  "loginType": "login",     // 账号类型 
+  "loginId": [    // 对应登录id 值（Account-Session才会有值）
+    "java.lang.Long",
+    10001
+  ],    
+  "token": null,    // 对应 token 值 （Token-Session才会有值）
+  "createTime": 1722334954145,    // 此 session 创建时间，13位时间戳 
+  "dataMap": {    // 此 session 挂载数据 
+    "@class": "java.util.concurrent.ConcurrentHashMap", 
+    "name": "张三"    // 此 session 挂载数据 详情
+	// 更多值 ...
+  },
+  "tokenSignList": [    // 客户端 token 信息列表（Account-Session才会有值）
+    "java.util.Vector",
+    [
+      {
+        "@class": "cn.dev33.satoken.session.TokenSign",
+        "value": "06d1f12b-614e-4c00-8d8e-c07fef5f4aa9",    // 客户端 token 值
+        "device": "default-device",     // 登录设备
+        "tag": null    // 挂载自定义值 
+      }
+    ]
+  ]
+}
+```
+
+</details>
+
+
+### 1.4、二级认证
+``` js
+{tokenName}:{loginType}:safe:{service}:{tokenValue}
+```
+value 为常亮值：`SAFE_AUTH_SAVE_VALUE`
+
+
+### 1.5、账号服务封禁
+``` js
+{tokenName}:{loginType}:disable:{service}:{loginId}
+```
+value 为封禁等级，int类型 
+
+
+### 1.6、其它
+SaApplication 全局变量
+``` js
+{tokenName}:var:{变量名}
+```
+
+本次请求新创建 token，存储 key 
+``` js
+JUST_CREATED_
+```
+
+本次请求新创建 token，存储 key （无前缀方式）
+``` js
+JUST_CREATED_NOT_PREFIX_
+```
+
+临时身份切换，使用的key
+``` js
+SWITCH_TO_SAVE_KEY_{loginType}
+```
+
+
+## 2、SSO 单点登录
+
+### 2.1、ticket -> loginId 映射
+``` js
+{tokenName}:ticket:{ticket}
+```
+值为 loginId
+
+
+### 2.2、ticket -> client 映射
+``` js
+{tokenName}:ticket-client:{ticket}
+```
+值为 client
+
+
+### 2.3、loginId -> ticket 映射（loginId 反查 ticket）
+``` js
+{tokenName}:id-ticket:{id}
+```
+值为 ticket
+
+
+
+## 3、OAuth2 统一认证 
+
+### 3.1、Code 授权码
+``` js
+{tokenName}:oauth2:code:{code}
+```
+
+<details>
+<summary>详细</summary>
+
+值为 CodeModel
+
+``` js
+{
+  "@class": "cn.dev33.satoken.oauth2.model.CodeModel",    // java class 信息
+  "code": "AbRVp2HrgyklE0BXYWszskGJWAGY7xhGu6Zaco4zJECzGYagCCFWj0jOlHza",    // code值
+  "scope": "",    // 所申请权限列表，多个用逗号隔开
+  "loginId": "10001",    // 对应的loginId
+  "redirectUri": "",    // 重定向地址
+}
+```
+
+</details>
+
+clientId + loginId 反查 code
+``` js
+{tokenName}:oauth2:code-index:{clientId}:{loginId}
+```
+
+
+
+### 3.2、Access-Token 资源令牌
+``` js
+{tokenName}:oauth2:access-token:{accessToken}
+```
+
+<details>
+<summary>详细</summary>
+
+值为 AccessTokenModel
+
+``` js
+{
+  "@class": "cn.dev33.satoken.oauth2.model.AccessTokenModel",    // java class 信息
+  "accessToken": "CqRVp2HrgyklE0BXYWszskGJWAGY7xhGu9Zaco4zJECzGYagCCFWj0jOlHoU",    // 资源令牌值
+  "refreshToken": "EAubykIqRLwbvvi0wfZqnWxoC1bLhPguIfTqX3S1aoTe6pCLKsV9jU3OEI8U",    // 刷新令牌值
+  "expiresTime": 1722422031510,    // 资源令牌到期时间
+  "refreshExpiresTime": 1725006831511,    // 刷新令牌到期时间
+  "clientId": "1001",    // 对应的应用id
+  "loginId": "10001",    // 对应的loginId
+  "openid": "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__",    // 对应的 openid
+  "scope": "",    // 所具有的权限列表，多个用逗号隔开
+  "expiresIn": 7199,    // 资源令牌剩余有效时间，单位秒
+  "refreshExpiresIn": 2592000    // 刷新令牌剩余有效时间，单位秒
+}
+```
+
+</details>
+
+clientId + loginId 反查 Access-Token
+``` js
+{tokenName}:oauth2:access-token-index:{clientId}:{loginId}
+```
+
+
+### 3.3、Refresh-Token 资源令牌
+``` js
+{tokenName}:oauth2:refresh-token:{refreshToken}
+```
+
+<details>
+<summary>详细</summary>
+
+值为 RefreshTokenModel
+
+``` js
+{
+  "@class": "cn.dev33.satoken.oauth2.model.RefreshTokenModel",    // java class 信息
+  "refreshToken": "EAubykIqRLwbvvi0wfZqnWxoC1bLhPguIfTqX3S1aoTe6pCLKsV9jU3OEI8U",    // 刷新令牌值
+  "expiresTime": 1725006831511,   // 刷新令牌到期时间
+  "clientId": "1001",    // 对应的应用id
+  "scope": "",    // 所具有的权限列表，多个用逗号隔开
+  "loginId": "10001",    // 对应的loginId
+  "openid": "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__",    // 对应的 openid
+  "expiresIn": 2591999    // 刷新令牌剩余有效时间，单位秒
+}
+```
+
+</details>
+
+clientId + loginId 反查 Refresh-Token
+``` js
+{tokenName}:oauth2:refresh-token-index:{clientId}:{loginId}
+```
+
+
+### 3.4、Client-Token 应用令牌
+``` js
+{tokenName}:oauth2:client-token:{clientToken}
+```
+
+<details>
+<summary>详细</summary>
+
+值为 ClientTokenModel
+
+``` js
+{
+  "@class": "cn.dev33.satoken.oauth2.model.ClientTokenModel",    // java class 信息
+  "clientToken": "fWQjBKxprSslmYFLbzen0oa95rOvqnqYKZW3sD8mzamNbabG8b6MPKPP5uCu",    // 应用令牌值 
+  "expiresTime": 1722425237153,    // 应用令牌到期时间
+  "clientId": "1001",    // 对应的应用id
+  "scope": null,    // 所具有的权限列表，多个用逗号隔开
+  "expiresIn": 7200    // 应用令牌剩余有效时间，单位秒
+}
+```
+
+</details>
+
+clientId 反查 Client-Token
+``` js
+{tokenName}:oauth2:client-token-index:{clientId}
+```
+
+Past-Token 次级应用令牌索引
+``` js
+{tokenName}:oauth2:past-token-index:{clientId}
+```
+
+### 3.5、用户授权记录
+``` js
+{tokenName}:oauth2:grant-scope:{clientId}:{loginId}
+```
+值为 scope 列表，多个用逗号隔开 
+
+
+
+
+## 4、插件
+
+### 4.1、临时 token 会话 
+``` js
+{tokenName}:temp-token:{service}:{token}
+```
+
+
+### 4.2、 Same-Token 
+
+Same-Token 
+``` js
+{tokenName}:var:same-token
+```
+
+Past-Same-Token 
+``` js
+{tokenName}:var:past-same-token
+```
+
+
+### 4.3、Sign 签名
+
+随机字符串
+``` js
+{tokenName}:sign:nonce:{32位随机字符}
+```
+
+
+
+
+
+
+
+
diff --git a/sa-token-doc/static/doc.css b/sa-token-doc/static/doc.css
index 0e2362cd..7806a12d 100644
--- a/sa-token-doc/static/doc.css
+++ b/sa-token-doc/static/doc.css
@@ -409,15 +409,28 @@ body {
 
 /* -------------  details标签 ------------- */
 .main-box details{
-	border: 1px #c4e5b5 solid;
+	border: 1px #42B983 solid;
+	background-color: #f4fdef;
+	overflow: hidden;
+	max-height: 44px;
+	/* transition: all 1s; */
+}
+.main-box details[open]{ /* max-height: 1000px; */ overflow: auto; animation: slideDown 0.4s linear both;}
+@keyframes slideDown {
+    0% { max-height: 44px; overflow: hidden; }
+    99% { max-height: 1000px; overflow: hidden; }
+    100% { max-height: 1000px; overflow: auto; }
 }
 .main-box details summary{
 	padding: 11px 14px;
 	background-color: #f4fdef;
 	color: #01a252;
-	
 	cursor: pointer;
 }
+.main-box details pre{
+	margin-left: 1em;
+	margin-right: 14px;
+}
 .main-box details p{padding: 0 14px;}
 
 /* 广告盒子 */
-- 
Gitee


From 968c5ea1b6db5e93e9cfd9c79b6d201e34bbe6d6 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 31 Jul 2024 23:54:46 +0800
Subject: [PATCH 097/172] =?UTF-8?q?SSO=20=E8=AE=A4=E8=AF=81=E4=B8=AD?=
 =?UTF-8?q?=E5=BF=83=E5=A2=9E=E5=8A=A0=E5=B9=B3=E5=8F=B0=E4=B8=AD=E5=BF=83?=
 =?UTF-8?q?=E8=B7=B3=E8=BD=AC=E6=A8=A1=E5=BC=8F=20demo?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../main/java/com/pj/home/HomeController.java | 36 +++++++++++++++++++
 .../src/main/resources/application.yml        |  2 --
 2 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/home/HomeController.java

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/home/HomeController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/home/HomeController.java
new file mode 100644
index 00000000..1be7c1d2
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/home/HomeController.java
@@ -0,0 +1,36 @@
+package com.pj.home;
+
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.stp.StpUtil;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * SSO 平台中心模式示例，跳连接进入子系统
+ */
+@RestController
+public class HomeController {
+
+    // 平台化首页
+    @RequestMapping("/home")
+    public Object index() {
+        // 如果未登录，则先去登录
+        if(!StpUtil.isLogin()) {
+            return SaHolder.getResponse().redirect("/sso/auth");
+        }
+
+        // 拼接各个子系统的地址，格式形如：/sso/auth?redirect=${子系统首页}/sso/login?back=${子系统首页}
+        String link1 = "/sso/auth?redirect=http://sa-sso-client1.com:9003/sso/login?back=http://sa-sso-client1.com:9003/";
+        String link2 = "/sso/auth?redirect=http://sa-sso-client2.com:9003/sso/login?back=http://sa-sso-client2.com:9003/";
+        String link3 = "/sso/auth?redirect=http://sa-sso-client3.com:9003/sso/login?back=http://sa-sso-client3.com:9003/";
+
+        // 组织网页结构返回到前端
+        String title = "<h2>SSO 平台首页</h2>";
+        String client1 = "<p><a href='" + link1 + "' target='_blank'> 进入Client1系统 </a></p>";
+        String client2 = "<p><a href='" + link2 + "' target='_blank'> 进入Client2系统 </a></p>";
+        String client3 = "<p><a href='" + link3 + "' target='_blank'> 进入Client3系统 </a></p>";
+
+        return title + client1 + client2 + client3;
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
index b5426f8f..f0c2c6f8 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/src/main/resources/application.yml
@@ -6,8 +6,6 @@ server:
 sa-token:
     # sso-client 相关配置
     sso-client:
-        # client 标识
-        client: sso-client3
         # sso-server 端主机地址
         server-url: http://sa-sso-server.com:9000
         # 使用 Http 请求校验ticket (模式三)
-- 
Gitee


From 004babd8bb14a996776f1f9d638e751eb2852439 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 1 Aug 2024 00:58:48 +0800
Subject: [PATCH 098/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=20sso=20=E6=A8=A1?=
 =?UTF-8?q?=E5=BC=8F=E4=B8=89=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-type3.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sa-token-doc/sso/sso-type3.md b/sa-token-doc/sso/sso-type3.md
index 5bda5ce9..39fe8c4a 100644
--- a/sa-token-doc/sso/sso-type3.md
+++ b/sa-token-doc/sso/sso-type3.md
@@ -83,6 +83,17 @@ public SaResult getData(String apiType, String loginId) {
 }
 ```
 
+> [!WARNING| label:小提示] 
+> 如果配置了 “不同 client 不同秘钥” 模式，则需要将上述的： <br>
+> &emsp;&emsp;SaSignUtil.checkRequest(SaHolder.getRequest());  <br>
+> 
+> 改为以下方式： <br>
+> &emsp;&emsp;String client = SaHolder.getRequest().getHeader("client"); <br>
+> &emsp;&emsp;SaSsoServerProcessor.instance.ssoServerTemplate.getSignTemplate(client).checkRequest(SaHolder.getRequest()); <br>
+> 
+> 如果没有配置 “不同 client 不同秘钥” 模式，则请忽略本条提示。
+
+
 #### 3.2、在 Client 端调用此接口查询数据
 
 在 `SsoClientController` 中新增接口 
-- 
Gitee


From ba79154dc85ab5a286ae27707ef93730ccf7cab9 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 1 Aug 2024 01:59:57 +0800
Subject: [PATCH 099/172] =?UTF-8?q?=E4=B8=8D=E5=90=8C=20client=20=E4=B8=8D?=
 =?UTF-8?q?=E5=90=8C=E7=99=BB=E5=BD=95=E9=A1=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-custom-login.md | 54 ++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/sa-token-doc/sso/sso-custom-login.md b/sa-token-doc/sso/sso-custom-login.md
index 95638d58..22118142 100644
--- a/sa-token-doc/sso/sso-custom-login.md
+++ b/sa-token-doc/sso/sso-custom-login.md
@@ -114,3 +114,57 @@ public SaResult ss(String name, String pwd) {
 
 答：直接在前端更改点击按钮时 Ajax 的请求地址即可 
 
+
+### 4、不同 client 不同登录页
+
+如果你的不同应用覆盖的用户群体差异极大，此时你可能想针对不同的应用跳转到不同的登录页，让每个应用的用户在登录时能够看到当前应用的专属信息，怎么做呢？
+
+首先，你需要在每个 sso-client 端配置上不同的 client 标识：
+
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token:
+    sso-client:
+        # 当前 client 标识
+        client: sso-client-shop
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 当前 client 标识
+sa-token.sso-client.client=sso-client-shop
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+然后在 `sso-server` 的 `configSso` 方法里 `notLoginView` 函数中根据 client 值，返回不同的登录视图
+
+``` java
+// 配置SSO相关参数 
+@Autowired
+private void configSso(SaSsoServerConfig ssoServer) {
+	
+	// 配置：未登录时返回的View 
+	ssoServer.notLoginView = () -> {
+
+		String client = SaHolder.getRequest().getParam("client");
+		if("sso-client-shop".equals(client)) {
+			return new ModelAndView("sa-shop-login.html");
+		}
+		if("sso-client-video".equals(client)) {
+			return new ModelAndView("sa-video-login.html");
+		}
+		// 更多 ... 
+		
+		// 都不匹配，返回一个默认的 
+		return new ModelAndView("sa-login.html");
+	};
+	
+	// ... 
+	
+}
+```
+
+
+
-- 
Gitee


From 1298012bcbafd5b54cff77ea360aa99847d5f2fa Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 2 Aug 2024 02:13:53 +0800
Subject: [PATCH 100/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20sa-token-quick-log?=
 =?UTF-8?q?in=20=E6=8F=92=E4=BB=B6=E6=97=A0=E6=B3=95=E6=AD=A3=E5=B8=B8?=
 =?UTF-8?q?=E6=8B=A6=E6=88=AA=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-custom-login.md           |  2 +-
 sa-token-doc/sso/sso-home-jump.md              |  2 +-
 .../dev33/satoken/quick/SaQuickRegister.java   | 18 +++++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/sa-token-doc/sso/sso-custom-login.md b/sa-token-doc/sso/sso-custom-login.md
index 22118142..c01b95a9 100644
--- a/sa-token-doc/sso/sso-custom-login.md
+++ b/sa-token-doc/sso/sso-custom-login.md
@@ -138,7 +138,7 @@ sa-token.sso-client.client=sso-client-shop
 <!---------------------------- tabs:end ---------------------------->
 
 
-然后在 `sso-server` 的 `configSso` 方法里 `notLoginView` 函数中根据 client 值，返回不同的登录视图
+然后在 `sso-server` 里为每个系统开发不同的登录页，并在 `configSso` 方法里 `notLoginView` 函数中根据 client 值，返回不同的登录视图：
 
 ``` java
 // 配置SSO相关参数 
diff --git a/sa-token-doc/sso/sso-home-jump.md b/sa-token-doc/sso/sso-home-jump.md
index a8c6e405..87b24cc3 100644
--- a/sa-token-doc/sso/sso-home-jump.md
+++ b/sa-token-doc/sso/sso-home-jump.md
@@ -75,7 +75,7 @@ public Object ssoRequest() {
 	if(req.isPath("/sso/auth") && req.hasParam("redirect") == false && StpUtil.isLogin()) {
 		return SaHolder.getResponse().redirect("/home");
 	}
-	return SaSsoServerProcessor.instance.serverDister();
+	return SaSsoServerProcessor.instance.dister();
 }
 ```
 
diff --git a/sa-token-plugin/sa-token-quick-login/src/main/java/cn/dev33/satoken/quick/SaQuickRegister.java b/sa-token-plugin/sa-token-quick-login/src/main/java/cn/dev33/satoken/quick/SaQuickRegister.java
index ee334337..5b1ccb13 100644
--- a/sa-token-plugin/sa-token-quick-login/src/main/java/cn/dev33/satoken/quick/SaQuickRegister.java
+++ b/sa-token-plugin/sa-token-quick-login/src/main/java/cn/dev33/satoken/quick/SaQuickRegister.java
@@ -15,17 +15,17 @@
  */
 package cn.dev33.satoken.quick;
 
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.core.annotation.Order;
-
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.filter.SaServletFilter;
 import cn.dev33.satoken.quick.config.SaQuickConfig;
 import cn.dev33.satoken.router.SaRouter;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaTokenConsts;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
 
 /**
  * Quick Login 相关 Bean 注册
@@ -66,13 +66,13 @@ public class SaQuickRegister {
 			.addInclude("/**")
 
 			// 排除掉登录相关接口，不需要鉴权的
-			.addExclude("/favicon.ico", "/saLogin", "/doLogin", "/sa-res/**").
+			.addExclude("/favicon.ico", "/saLogin", "/doLogin", "/sa-res/**")
 
 			// 认证函数: 每次请求执行
-			setAuth(obj -> {
+			.setAuth(obj -> {
 				SaRouter
-					.match(SaQuickManager.getConfig().getInclude().split(","))
-					.notMatch(SaQuickManager.getConfig().getExclude().split(","))
+					.match(SaFoxUtil.convertStringToList(SaQuickManager.getConfig().getInclude()))
+					.notMatch(SaFoxUtil.convertStringToList(SaQuickManager.getConfig().getExclude()))
 					.check(r -> {
 						// 未登录时直接转发到login.html页面 
 						if (SaQuickManager.getConfig().getAuth() && ! StpUtil.isLogin()) {
-- 
Gitee


From ebe405fe8b372e1c26afb183b332bc0afd87c7ce Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 2 Aug 2024 02:19:27 +0800
Subject: [PATCH 101/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20OAuth2=20=E6=A8=A1?=
 =?UTF-8?q?=E5=9D=97=20checkClientToken=20=E6=96=B9=E6=B3=95=E5=BC=82?=
 =?UTF-8?q?=E5=B8=B8=E6=8F=90=E7=A4=BA=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
index 62dc1ebb..2add96c5 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
@@ -89,7 +89,7 @@ public class SaOAuth2Template {
 	 */
 	public ClientTokenModel checkClientToken(String clientToken) {
 		ClientTokenModel ct = getClientToken(clientToken);
-		SaOAuth2Exception.throwBy(ct == null, "无效：client_token" + ct, SaOAuth2ErrorCode.CODE_30107);
+		SaOAuth2Exception.throwBy(ct == null, "无效：client_token" + clientToken, SaOAuth2ErrorCode.CODE_30107);
 		return ct;
 	}
 	/**
-- 
Gitee


From dab9e156735379198feb38a40e414c70906b2656 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 2 Aug 2024 02:48:10 +0800
Subject: [PATCH 102/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20sso-server=20?=
 =?UTF-8?q?=E5=89=8D=E5=90=8E=E7=AB=AF=E5=88=86=E7=A6=BB=20demo=20?=
 =?UTF-8?q?=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/h5/CorsFilter.java       | 15 ++++-----------
 .../src/main/java/com/pj/h5/H5Controller.java     |  2 +-
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/CorsFilter.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/CorsFilter.java
index f705fecf..eea8a54c 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/CorsFilter.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/CorsFilter.java
@@ -1,18 +1,12 @@
 package com.pj.h5;
 
-import java.io.IOException;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
 
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
+import javax.servlet.*;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-
-import org.springframework.core.annotation.Order;
-import org.springframework.stereotype.Component;
+import java.io.IOException;
 
 /**
  * 跨域过滤器 
@@ -46,7 +40,6 @@ public class CorsFilter implements Filter {
 			return;
 		}
 
-		// System.out.println("*********************************过滤器被使用**************************");
 		chain.doFilter(req, res);
 	}
 
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
index 22602555..e26fa93f 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
@@ -23,7 +23,7 @@ public class H5Controller {
 	 * 获取 redirectUrl 
 	 */
 	@RequestMapping("/sso/getRedirectUrl")
-	private Object getRedirectUrl(String redirect, String mode, String client) {
+	public SaResult getRedirectUrl(String redirect, String mode, String client) {
 		// 未登录情况下，返回 code=401 
 		if(StpUtil.isLogin() == false) {
 			return SaResult.code(401);
-- 
Gitee


From a3746878de35c40c34537d3771abf0934ddc323b Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 2 Aug 2024 03:17:09 +0800
Subject: [PATCH 103/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20sso-server=20?=
 =?UTF-8?q?=E5=89=8D=E5=90=8E=E7=AB=AF=E5=88=86=E7=A6=BB=E6=97=B6=E7=9A=84?=
 =?UTF-8?q?=E8=B7=B3=E8=BD=AC=E6=B5=81=E7=A8=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../sa-token-demo-sso/sa-token-demo-sso-server-h5/login.js | 2 +-
 .../src/main/java/com/pj/h5/H5Controller.java              | 7 ++++---
 .../src/main/resources/application.yml                     | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server-h5/login.js b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server-h5/login.js
index 6d4f803f..fbe230be 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server-h5/login.js
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server-h5/login.js
@@ -50,7 +50,7 @@ var pData = {
 sa.ajax("/sso/getRedirectUrl", pData, function(res) {
 	if(res.code == 200) {
 		// 已登录，并且redirect地址有效，开始跳转  
-		location.href = decodeURIComponent(res.data);
+		location.href = res.data;
 	} else if(res.code == 401) {
 		console.log('未登录');
 	} else {
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
index e26fa93f..cdd858b5 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/src/main/java/com/pj/h5/H5Controller.java
@@ -28,13 +28,14 @@ public class H5Controller {
 		if(StpUtil.isLogin() == false) {
 			return SaResult.code(401);
 		}
-		// 已登录情况下，构建 redirectUrl 
+		// 已登录情况下，构建 redirectUrl
+		redirect = SaFoxUtil.decoderUrl(redirect);
 		if(SaSsoConsts.MODE_SIMPLE.equals(mode)) {
 			// 模式一 
-			SaSsoUtil.checkRedirectUrl(SaFoxUtil.decoderUrl(redirect));
+			SaSsoUtil.checkRedirectUrl(redirect);
 			return SaResult.data(redirect);
 		} else {
-			// 模式二或模式三 
+			// 模式二或模式三
 			String redirectUrl = SaSsoUtil.buildRedirectUrl(StpUtil.getLoginId(), client, redirect);
 			return SaResult.data(redirectUrl);
 		}
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
index 8ce56dd6..c38d41ba 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/resources/application.yml
@@ -8,7 +8,7 @@ sa-token:
     sso-client:
         # SSO-Server 端主机地址
         server-url: http://sa-sso-server.com:9000
-        # 前后端分离时用这个
+        # 前后端分离时打开这个
         # auth-url: http://127.0.0.1:8848/sa-token-demo-sso-server-h5/sso-auth.html
     sign:
         # API 接口调用秘钥
-- 
Gitee


From 834e1d5b34e832169172618ac869f66df984a55e Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 3 Aug 2024 18:50:11 +0800
Subject: [PATCH 104/172] =?UTF-8?q?=E9=87=8D=E6=9E=84=E6=B3=A8=E8=A7=A3?=
 =?UTF-8?q?=E9=89=B4=E6=9D=83=E5=BA=95=E5=B1=82=EF=BC=8C=E5=8F=AF=E4=BB=A5?=
 =?UTF-8?q?=E6=96=B9=E4=BE=BF=E7=9A=84=E8=87=AA=E5=AE=9A=E4=B9=89=E6=B3=A8?=
 =?UTF-8?q?=E8=A7=A3=E4=BA=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dev33/satoken/annotation/SaCheckOr.java   |   8 +-
 .../dev33/satoken/basic/SaBasicTemplate.java  |  99 --------
 .../cn/dev33/satoken/basic/SaBasicUtil.java   |  70 -----
 ...on.java => NotHttpBasicAuthException.java} |   4 +-
 .../fun/strategy/SaGetAnnotationFunction.java |   2 +-
 .../httpauth/basic/SaHttpBasicTemplate.java   |   4 +-
 .../httpauth/digest/SaHttpDigestTemplate.java |   5 +
 .../httpauth/digest/SaHttpDigestUtil.java     |   5 +
 .../satoken/listener/SaTokenEventCenter.java  |  11 +
 .../satoken/listener/SaTokenListener.java     |   7 +
 .../listener/SaTokenListenerForLog.java       |  16 +-
 .../java/cn/dev33/satoken/stp/StpLogic.java   | 153 +++++------
 .../cn/dev33/satoken/strategy/SaStrategy.java | 240 ------------------
 .../java/com/pj/SaTokenCaseApplication.java   |   3 +-
 .../com/pj/cases/test/TestController.java     |   7 +-
 .../java/com/pj/current/GlobalException.java  |   6 +-
 .../java/com/pj/satoken/SaTokenConfigure.java |   7 +-
 .../SaUserCheckLogin.java                     |  10 +-
 .../SaUserCheckPermission.java                |  35 ++-
 .../SaUserCheckRole.java                      |  13 +-
 sa-token-doc/_sidebar.md                      |   1 +
 sa-token-doc/up/many-account.md               |   7 +-
 sa-token-doc/use/at-check.md                  |  12 +-
 .../cn/dev33/satoken/spring/SaBeanInject.java |  18 +-
 .../satoken/interceptor/SaInterceptor.java    |  15 +-
 .../integrate/configure/HandlerException.java |   6 +-
 26 files changed, 207 insertions(+), 557 deletions(-)
 delete mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicTemplate.java
 delete mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicUtil.java
 rename sa-token-core/src/main/java/cn/dev33/satoken/exception/{NotBasicAuthException.java => NotHttpBasicAuthException.java} (90%)
 rename sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/{at => custom_annotation}/SaUserCheckLogin.java (71%)
 rename sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/{at => custom_annotation}/SaUserCheckPermission.java (54%)
 rename sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/{at => custom_annotation}/SaUserCheckRole.java (72%)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
index 8652619b..5e2ce739 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckOr.java
@@ -40,18 +40,18 @@ public @interface SaCheckOr {
     SaCheckLogin[] login() default {};
 
     /**
-     * 设定 @SaCheckPermission，参考 {@link SaCheckPermission}
+     * 设定 @SaCheckRole，参考 {@link SaCheckRole}
      *
      * @return /
      */
-    SaCheckPermission[] permission() default {};
+    SaCheckRole[] role() default {};
 
     /**
-     * 设定 @SaCheckRole，参考 {@link SaCheckRole}
+     * 设定 @SaCheckPermission，参考 {@link SaCheckPermission}
      *
      * @return /
      */
-    SaCheckRole[] role() default {};
+    SaCheckPermission[] permission() default {};
 
     /**
      * 设定 @SaCheckSafe，参考 {@link SaCheckSafe}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicTemplate.java b/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicTemplate.java
deleted file mode 100644
index e899154b..00000000
--- a/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicTemplate.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.basic;
-
-import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.context.SaHolder;
-import cn.dev33.satoken.error.SaErrorCode;
-import cn.dev33.satoken.exception.NotBasicAuthException;
-import cn.dev33.satoken.secure.SaBase64Util;
-import cn.dev33.satoken.util.SaFoxUtil;
-
-/**
- * <h2> 已更换至包：cn.dev33.satoken.httpauth.basic </h2>
- * <h2> 已更换名称：SaHttpBasicTemplate </h2>
- *
- * Sa-Token Http Basic 认证模块
- *
- * @author click33
- * @since 1.26.0
- */
-@Deprecated
-public class SaBasicTemplate {
-	
-	/**
-	 * 默认的 Realm 领域名称
-	 */
-	public static final String DEFAULT_REALM = "Sa-Token";
-
-	/**
-	 * 在校验失败时，设置响应头，并抛出异常
-	 * @param realm 领域 
-	 */
-	public void throwNotBasicAuthException(String realm) {
-		SaHolder.getResponse().setStatus(401).setHeader("WWW-Authenticate", "Basic Realm=" + realm);
-		throw new NotBasicAuthException().setCode(SaErrorCode.CODE_10311);
-	}
-
-	/**
-	 * 获取浏览器提交的 Basic 参数 （裁剪掉前缀并解码）
-	 * @return 值
-	 */
-	public String getAuthorizationValue() {
-		
-		// 获取前端提交的请求头 Authorization 参数
-		String authorization = SaHolder.getRequest().getHeader("Authorization");
-		
-		// 如果不是以 Basic 作为前缀，则视为无效 
-		if(authorization == null || ! authorization.startsWith("Basic ")) {
-			return null;
-		}
-		
-		// 裁剪前缀并解码 
-		return SaBase64Util.decode(authorization.substring(6));
-	}
-	
-	/**
-	 * 对当前会话进行 Basic 校验（使用全局配置的账号密码），校验不通过则抛出异常  
-	 */
-	public void check() {
-		check(DEFAULT_REALM, SaManager.getConfig().getBasic());
-	}
-
-	/**
-	 * 对当前会话进行 Basic 校验（手动设置账号密码），校验不通过则抛出异常  
-	 * @param account 账号（格式为 user:password）
-	 */
-	public void check(String account) {
-		check(DEFAULT_REALM, account);
-	}
-
-	/**
-	 * 对当前会话进行 Basic 校验（手动设置 Realm 和 账号密码），校验不通过则抛出异常 
-	 * @param realm 领域 
-	 * @param account 账号（格式为 user:password）
-	 */
-	public void check(String realm, String account) {
-		if(SaFoxUtil.isEmpty(account)) {
-			account = SaManager.getConfig().getBasic();
-		}
-		String authorization = getAuthorizationValue();
-		if(SaFoxUtil.isEmpty(authorization) || ! authorization.equals(account)) {
-			throwNotBasicAuthException(realm);
-		}
-	}
-
-}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicUtil.java
deleted file mode 100644
index 28295422..00000000
--- a/sa-token-core/src/main/java/cn/dev33/satoken/basic/SaBasicUtil.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.basic;
-
-/**
- * <h2> 已更换至包：cn.dev33.satoken.httpauth.basic </h2>
- * <h2> 已更换名称：SaHttpBasicUtil </h2>
- *
- * Sa-Token Http Basic 认证模块，Util 工具类
- *
- * @author click33
- * @since 1.26.0
- */
-@Deprecated
-public class SaBasicUtil {
-
-	private SaBasicUtil() {
-	}
-	
-	/**
-	 * 底层使用的 SaBasicTemplate 对象
-	 */
-	public static SaBasicTemplate saBasicTemplate = new SaBasicTemplate();
-
-	/**
-	 * 获取浏览器提交的 Basic 参数 （裁剪掉前缀并解码）
-	 * @return 值
-	 */
-	public static String getAuthorizationValue() {
-		return saBasicTemplate.getAuthorizationValue();
-	}
-	
-	/**
-	 * 对当前会话进行 Basic 校验（使用全局配置的账号密码），校验不通过则抛出异常  
-	 */
-	public static void check() {
-		saBasicTemplate.check();
-	}
-
-	/**
-	 * 对当前会话进行 Basic 校验（手动设置账号密码），校验不通过则抛出异常  
-	 * @param account 账号（格式为 user:password）
-	 */
-	public static void check(String account) {
-		saBasicTemplate.check(account);
-	}
-
-	/**
-	 * 对当前会话进行 Basic 校验（手动设置 Realm 和 账号密码），校验不通过则抛出异常 
-	 * @param realm 领域 
-	 * @param account 账号（格式为 user:password）
-	 */
-	public static void check(String realm, String account) {
-		saBasicTemplate.check(realm, account);
-	}
-
-}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/exception/NotBasicAuthException.java b/sa-token-core/src/main/java/cn/dev33/satoken/exception/NotHttpBasicAuthException.java
similarity index 90%
rename from sa-token-core/src/main/java/cn/dev33/satoken/exception/NotBasicAuthException.java
rename to sa-token-core/src/main/java/cn/dev33/satoken/exception/NotHttpBasicAuthException.java
index 862c8986..4a5defd9 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/exception/NotBasicAuthException.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/exception/NotHttpBasicAuthException.java
@@ -21,7 +21,7 @@ package cn.dev33.satoken.exception;
  * @author click33
  * @since 1.26.0
  */
-public class NotBasicAuthException extends SaTokenException {
+public class NotHttpBasicAuthException extends SaTokenException {
 
 	/**
 	 * 序列化版本号
@@ -34,7 +34,7 @@ public class NotBasicAuthException extends SaTokenException {
 	/**
 	 * 一个异常：代表会话未通过 Http Basic 认证 
 	 */
-	public NotBasicAuthException() {
+	public NotHttpBasicAuthException() {
 		super(BE_MESSAGE);
 	}
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaGetAnnotationFunction.java b/sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaGetAnnotationFunction.java
index 6908b639..61282633 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaGetAnnotationFunction.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaGetAnnotationFunction.java
@@ -29,6 +29,6 @@ import java.util.function.BiFunction;
  * @since 1.35.0
  */
 @FunctionalInterface
-public interface SaGetAnnotationFunction extends BiFunction<AnnotatedElement, Class<? extends Annotation> , Annotation> {
+public interface SaGetAnnotationFunction extends BiFunction<AnnotatedElement, Class<? extends Annotation>, Annotation> {
 
 }
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/basic/SaHttpBasicTemplate.java b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/basic/SaHttpBasicTemplate.java
index 4f7449bd..90f8553c 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/basic/SaHttpBasicTemplate.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/basic/SaHttpBasicTemplate.java
@@ -18,7 +18,7 @@ package cn.dev33.satoken.httpauth.basic;
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.error.SaErrorCode;
-import cn.dev33.satoken.exception.NotBasicAuthException;
+import cn.dev33.satoken.exception.NotHttpBasicAuthException;
 import cn.dev33.satoken.secure.SaBase64Util;
 import cn.dev33.satoken.util.SaFoxUtil;
 
@@ -41,7 +41,7 @@ public class SaHttpBasicTemplate {
 	 */
 	public void throwNotBasicAuthException(String realm) {
 		SaHolder.getResponse().setStatus(401).setHeader("WWW-Authenticate", "Basic Realm=" + realm);
-		throw new NotBasicAuthException().setCode(SaErrorCode.CODE_10311);
+		throw new NotHttpBasicAuthException().setCode(SaErrorCode.CODE_10311);
 	}
 
 	/**
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestTemplate.java b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestTemplate.java
index f7ed69d3..a16d2bf5 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestTemplate.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestTemplate.java
@@ -263,11 +263,16 @@ public class SaHttpDigestTemplate {
         check(arr[0], arr[1]);
     }
 
+
+
+    // ----------------- 过期方法 -----------------
+
     /**
      * 根据注解 ( @SaCheckHttpDigest ) 鉴权
      *
      * @param at 注解对象
      */
+    @Deprecated
     public void checkByAnnotation(SaCheckHttpDigest at) {
 
         // 如果配置了 value，则以 value 优先
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestUtil.java
index 70a0df46..d3000554 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/httpauth/digest/SaHttpDigestUtil.java
@@ -90,11 +90,16 @@ public class SaHttpDigestUtil {
 		saHttpDigestTemplate.check();
 	}
 
+
+
+	// ----------------- 过期方法 -----------------
+
 	/**
 	 * 根据注解 ( @SaCheckHttpDigest ) 鉴权
 	 *
 	 * @param at 注解对象
 	 */
+	@Deprecated
 	public static void checkByAnnotation(SaCheckHttpDigest at) {
 		saHttpDigestTemplate.checkByAnnotation(at);
 	}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
index e5036e64..29ed5d89 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
@@ -18,6 +18,7 @@ package cn.dev33.satoken.listener;
 import java.util.ArrayList;
 import java.util.List;
 
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.error.SaErrorCode;
 import cn.dev33.satoken.exception.SaTokenException;
@@ -287,6 +288,16 @@ public class SaTokenEventCenter {
 		}
 	}
 
+	/**
+	 * 事件发布：有新的注解处理器载入到框架中
+	 * @param handler 注解处理器
+	 */
+	public static void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+		for (SaTokenListener listener : listenerList) {
+			listener.doRegisterAnnotationHandler(handler);
+		}
+	}
+
 	/**
 	 * 事件发布：有新的 StpLogic 载入到框架中
 	 * @param stpLogic / 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
index 4de64e2e..6a4e3564 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
@@ -15,6 +15,7 @@
  */
 package cn.dev33.satoken.listener;
 
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.StpLogic;
@@ -125,6 +126,12 @@ public interface SaTokenListener {
 	 */
 	default void doRegisterComponent(String compName, Object compObj) {}
 
+	/**
+	 * 注册了自定义注解处理器
+	 * @param handler 注解处理器
+	 */
+	default void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {}
+
 	/**
 	 * StpLogic 对象替换 
 	 * @param stpLogic / 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
index 53a15b43..7bb32ef4 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
@@ -15,13 +15,14 @@
  */
 package cn.dev33.satoken.listener;
 
-import static cn.dev33.satoken.SaManager.log;
-
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.util.SaFoxUtil;
 
+import static cn.dev33.satoken.SaManager.log;
+
 /**
  * Sa-Token 侦听器的一个实现：Log 打印
  * 
@@ -130,6 +131,17 @@ public class SaTokenListenerForLog implements SaTokenListener {
 		log.info("全局组件 {} 载入成功: {}", compName, canonicalName);
 	}
 
+	/**
+	 * 注册了自定义注解处理器
+	 * @param handler 注解处理器
+	 */
+	@Override
+	public void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+		if(handler != null) {
+			log.info("注解扩展 @{} (处理器: {})", handler.getHandlerAnnotationClass().getSimpleName(), handler.getClass().getCanonicalName());
+		}
+	}
+
 	/**
 	 * StpLogic 对象替换 
 	 * @param stpLogic / 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 3b6b4da0..1c071119 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -2233,79 +2233,6 @@ public class StpLogic {
 	public List<String> searchTokenSessionId(String keyword, int start, int size, boolean sortType) {
 		return getSaTokenDao().searchData(splicingKeyTokenSession(""), keyword, start, size, sortType);
 	}
-	
-
-	// ------------------- 注解鉴权 -------------------  
-
-	/**
-	 * 根据注解 ( @SaCheckLogin ) 鉴权
-	 *
-	 * @param at 注解对象 
-	 */
-	public void checkByAnnotation(SaCheckLogin at) {
-		this.checkLogin();
-	}
-
-	/**
-	 * 根据注解 ( @SaCheckRole ) 鉴权
-	 *
-	 * @param at 注解对象 
-	 */
-	public void checkByAnnotation(SaCheckRole at) {
-		String[] roleArray = at.value();
-		if(at.mode() == SaMode.AND) {
-			this.checkRoleAnd(roleArray);	
-		} else {
-			this.checkRoleOr(roleArray);	
-		}
-	}
-	
-	/**
-	 * 根据注解 ( @SaCheckPermission ) 鉴权
-	 *
-	 * @param at 注解对象 
-	 */
-	public void checkByAnnotation(SaCheckPermission at) {
-		String[] permissionArray = at.value();
-		try {
-			if(at.mode() == SaMode.AND) {
-				this.checkPermissionAnd(permissionArray);	
-			} else {
-				this.checkPermissionOr(permissionArray);	
-			}
-		} catch (NotPermissionException e) {
-			// 权限认证校验未通过，再开始角色认证校验
-			for (String role : at.orRole()) {
-				String[] rArr = SaFoxUtil.convertStringToArray(role);
-				// 某一项 role 认证通过，则可以提前退出了，代表通过
-				if (hasRoleAnd(rArr)) {
-					return;
-				}
-			}
-			throw e;
-		}
-	}
-
-	/**
-	 * 根据注解 ( @SaCheckSafe ) 鉴权
-	 *
-	 * @param at 注解对象 
-	 */
-	public void checkByAnnotation(SaCheckSafe at) {
-		this.checkSafe(at.value());
-	}
-
-	/**
-	 * 根据注解 ( @SaCheckDisable ) 鉴权
-	 *
-	 * @param at 注解对象
-	 */
-	public void checkByAnnotation(SaCheckDisable at) {
-		Object loginId = getLoginId();
-		for (String service : at.value()) {
-			this.checkDisableLevel(loginId, service, at.level());
-		}
-	}
 
 
 	// ------------------- 账号封禁 -------------------  
@@ -2937,4 +2864,84 @@ public class StpLogic {
 		return false;
 	}
 
+
+
+	// ------------------- 过期方法 -------------------
+
+	/**
+	 * 根据注解 ( @SaCheckLogin ) 鉴权
+	 *
+	 * @param at 注解对象
+	 */
+	@Deprecated
+	public void checkByAnnotation(SaCheckLogin at) {
+		this.checkLogin();
+	}
+
+	/**
+	 * 根据注解 ( @SaCheckRole ) 鉴权
+	 *
+	 * @param at 注解对象
+	 */
+	@Deprecated
+	public void checkByAnnotation(SaCheckRole at) {
+		String[] roleArray = at.value();
+		if(at.mode() == SaMode.AND) {
+			this.checkRoleAnd(roleArray);
+		} else {
+			this.checkRoleOr(roleArray);
+		}
+	}
+
+	/**
+	 * 根据注解 ( @SaCheckPermission ) 鉴权
+	 *
+	 * @param at 注解对象
+	 */
+	@Deprecated
+	public void checkByAnnotation(SaCheckPermission at) {
+		String[] permissionArray = at.value();
+		try {
+			if(at.mode() == SaMode.AND) {
+				this.checkPermissionAnd(permissionArray);
+			} else {
+				this.checkPermissionOr(permissionArray);
+			}
+		} catch (NotPermissionException e) {
+			// 权限认证校验未通过，再开始角色认证校验
+			for (String role : at.orRole()) {
+				String[] rArr = SaFoxUtil.convertStringToArray(role);
+				// 某一项 role 认证通过，则可以提前退出了，代表通过
+				if (hasRoleAnd(rArr)) {
+					return;
+				}
+			}
+			throw e;
+		}
+	}
+
+	/**
+	 * 根据注解 ( @SaCheckSafe ) 鉴权
+	 *
+	 * @param at 注解对象
+	 */
+	@Deprecated
+	public void checkByAnnotation(SaCheckSafe at) {
+		this.checkSafe(at.value());
+	}
+
+	/**
+	 * 根据注解 ( @SaCheckDisable ) 鉴权
+	 *
+	 * @param at 注解对象
+	 */
+	@Deprecated
+	public void checkByAnnotation(SaCheckDisable at) {
+		Object loginId = getLoginId();
+		for (String service : at.value()) {
+			this.checkDisableLevel(loginId, service, at.level());
+		}
+	}
+
+
 }
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
index df89ae7e..3e12c8dd 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java
@@ -16,19 +16,14 @@
 package cn.dev33.satoken.strategy;
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.annotation.*;
 import cn.dev33.satoken.exception.RequestPathInvalidException;
 import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.fun.strategy.*;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
-import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
 import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaTokenConsts;
 
-import java.util.ArrayList;
-import java.util.List;
 import java.util.UUID;
 
 /**
@@ -133,185 +128,6 @@ public final class SaStrategy {
 		return false;
 	};
 
-	/**
-	 * 对一个 [Method] 对象进行注解校验 （注解鉴权内部实现）
-	 */
-	public SaCheckMethodAnnotationFunction checkMethodAnnotation = (method) -> {
-
-		// 先校验 Method 所属 Class 上的注解
-		instance.checkElementAnnotation.accept(method.getDeclaringClass());
-
-		// 再校验 Method 上的注解
-		instance.checkElementAnnotation.accept(method);
-	};
-
-	/**
-	 * 对一个 [元素] 对象进行注解校验 （注解鉴权内部实现）
-	 */
-	public SaCheckElementAnnotationFunction checkElementAnnotation = (element) -> {
-
-		// 校验 @SaCheckLogin 注解
-		SaCheckLogin checkLogin = (SaCheckLogin) SaStrategy.instance.getAnnotation.apply(element, SaCheckLogin.class);
-		if(checkLogin != null) {
-			SaManager.getStpLogic(checkLogin.type(), false).checkByAnnotation(checkLogin);
-		}
-
-		// 校验 @SaCheckRole 注解
-		SaCheckRole checkRole = (SaCheckRole) SaStrategy.instance.getAnnotation.apply(element, SaCheckRole.class);
-		if(checkRole != null) {
-			SaManager.getStpLogic(checkRole.type(), false).checkByAnnotation(checkRole);
-		}
-
-		// 校验 @SaCheckPermission 注解
-		SaCheckPermission checkPermission = (SaCheckPermission) SaStrategy.instance.getAnnotation.apply(element, SaCheckPermission.class);
-		if(checkPermission != null) {
-			SaManager.getStpLogic(checkPermission.type(), false).checkByAnnotation(checkPermission);
-		}
-
-		// 校验 @SaCheckSafe 注解
-		SaCheckSafe checkSafe = (SaCheckSafe) SaStrategy.instance.getAnnotation.apply(element, SaCheckSafe.class);
-		if(checkSafe != null) {
-			SaManager.getStpLogic(checkSafe.type(), false).checkByAnnotation(checkSafe);
-		}
-
-		// 校验 @SaCheckDisable 注解
-		SaCheckDisable checkDisable = (SaCheckDisable) SaStrategy.instance.getAnnotation.apply(element, SaCheckDisable.class);
-		if(checkDisable != null) {
-			SaManager.getStpLogic(checkDisable.type(), false).checkByAnnotation(checkDisable);
-		}
-
-		// 校验 @SaCheckHttpBasic 注解
-		SaCheckHttpBasic checkHttpBasic = (SaCheckHttpBasic) SaStrategy.instance.getAnnotation.apply(element, SaCheckHttpBasic.class);
-		if(checkHttpBasic != null) {
-			SaHttpBasicUtil.check(checkHttpBasic.realm(), checkHttpBasic.account());
-		}
-
-		// 校验 @SaCheckHttpDigest 注解
-		SaCheckHttpDigest checkHttpDigest = (SaCheckHttpDigest) SaStrategy.instance.getAnnotation.apply(element, SaCheckHttpDigest.class);
-		if(checkHttpDigest != null) {
-			SaHttpDigestUtil.checkByAnnotation(checkHttpDigest);
-		}
-
-		// 校验 @SaCheckOr 注解
-		SaCheckOr checkOr = (SaCheckOr) SaStrategy.instance.getAnnotation.apply(element, SaCheckOr.class);
-		if(checkOr != null) {
-			SaStrategy.instance.checkOrAnnotation.accept(checkOr);
-		}
-	};
-
-	/**
-	 * 对一个 @SaCheckOr 进行注解校验
-	 */
-	public SaCheckOrAnnotationFunction checkOrAnnotation = (at) -> {
-
-		// 记录校验过程中所有的异常
-		List<SaTokenException> errorList = new ArrayList<>();
-
-		// 逐个开始校验 >>>
-
-		// 1、校验注解：@SaCheckLogin
-		SaCheckLogin[] checkLoginArray = at.login();
-		for (SaCheckLogin item : checkLoginArray) {
-			try {
-				SaManager.getStpLogic(item.type(), false).checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 2、校验注解：@SaCheckRole
-		SaCheckRole[] checkRoleArray = at.role();
-		for (SaCheckRole item : checkRoleArray) {
-			try {
-				SaManager.getStpLogic(item.type(), false).checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 3、校验注解：@SaCheckPermission
-		SaCheckPermission[] checkPermissionArray = at.permission();
-		for (SaCheckPermission item : checkPermissionArray) {
-			try {
-				SaManager.getStpLogic(item.type(), false).checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 4、校验注解：@SaCheckSafe
-		SaCheckSafe[] checkSafeArray = at.safe();
-		for (SaCheckSafe item : checkSafeArray) {
-			try {
-				SaManager.getStpLogic(item.type(), false).checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 5、校验注解：@SaCheckDisable
-		SaCheckDisable[] checkDisableArray = at.disable();
-		for (SaCheckDisable item : checkDisableArray) {
-			try {
-				SaManager.getStpLogic(item.type(), false).checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 6、校验注解：@SaCheckBasic
-		SaCheckHttpBasic[] checkHttpBasicArray = at.httpBasic();
-		for (SaCheckHttpBasic item : checkHttpBasicArray) {
-			try {
-				SaHttpBasicUtil.check(item.realm(), item.account());
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 7、校验注解：@SaCheckDigest
-		SaCheckHttpDigest[] checkHttpDigestArray = at.httpDigest();
-		for (SaCheckHttpDigest item : checkHttpDigestArray) {
-			try {
-				SaHttpDigestUtil.checkByAnnotation(item);
-				return;
-			} catch (SaTokenException e) {
-				errorList.add(e);
-			}
-		}
-
-		// 如果执行到这里，有两种可能：
-		//		可能 1. SaCheckOr 注解上不包含任何注解校验，此时 errorList 里面一个异常都没有，我们直接跳过即可
-		//		可能 2. 所有注解校验都通过不了，此时 errorList 里面会有多个异常，我们随便抛出一个即可
-		if(errorList.size() == 0) {
-			// return;
-		} else {
-			throw errorList.get(0);
-		}
-	};
-
-	/**
-	 * 从元素上获取注解
-	 */
-	public SaGetAnnotationFunction getAnnotation = (element, annotationClass)->{
-		// 默认使用jdk的注解处理器
-		return element.getAnnotation(annotationClass);
-	};
-
-	/**
-	 * 判断一个 Method 或其所属 Class 是否包含指定注解
-	 */
-	public SaIsAnnotationPresentFunction isAnnotationPresent = (method, annotationClass) -> {
-		return instance.getAnnotation.apply(method, annotationClass) != null ||
-				instance.getAnnotation.apply(method.getDeclaringClass(), annotationClass) != null;
-	};
-
 	/**
 	 * 生成唯一式 token 的算法
 	 */
@@ -427,62 +243,6 @@ public final class SaStrategy {
 		return this;
 	}
 
-	/**
-	 * 对一个 [Method] 对象进行注解校验 （注解鉴权内部实现）
-	 *
-	 * @param checkMethodAnnotation /
-	 * @return /
-	 */
-	public SaStrategy setCheckMethodAnnotation(SaCheckMethodAnnotationFunction checkMethodAnnotation) {
-		this.checkMethodAnnotation = checkMethodAnnotation;
-		return this;
-	}
-
-	/**
-	 * 对一个 [元素] 对象进行注解校验 （注解鉴权内部实现）
-	 *
-	 * @param checkElementAnnotation /
-	 * @return /
-	 */
-	public SaStrategy setCheckElementAnnotation(SaCheckElementAnnotationFunction checkElementAnnotation) {
-		this.checkElementAnnotation = checkElementAnnotation;
-		return this;
-	}
-
-	/**
-	 * 对一个 @SaCheckOr 进行注解校验
-	 * <p> 参数 [SaCheckOr 注解的实例]
-	 *
-	 * @param checkOrAnnotation /
-	 * @return /
-	 */
-	public SaStrategy setCheckOrAnnotation(SaCheckOrAnnotationFunction checkOrAnnotation) {
-		this.checkOrAnnotation = checkOrAnnotation;
-		return this;
-	}
-
-	/**
-	 * 从元素上获取注解
-	 *
-	 * @param getAnnotation /
-	 * @return /
-	 */
-	public SaStrategy setGetAnnotation(SaGetAnnotationFunction getAnnotation) {
-		this.getAnnotation = getAnnotation;
-		return this;
-	}
-
-	/**
-	 * 判断一个 Method 或其所属 Class 是否包含指定注解
-	 *
-	 * @param isAnnotationPresent /
-	 * @return /
-	 */
-	public SaStrategy setIsAnnotationPresent(SaIsAnnotationPresentFunction isAnnotationPresent) {
-		this.isAnnotationPresent = isAnnotationPresent;
-		return this;
-	}
-
 	/**
 	 * 生成唯一式 token 的算法
 	 *
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/SaTokenCaseApplication.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/SaTokenCaseApplication.java
index 025814fc..9f7d5050 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/SaTokenCaseApplication.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/SaTokenCaseApplication.java
@@ -1,10 +1,9 @@
 package com.pj;
 
+import cn.dev33.satoken.SaManager;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
-import cn.dev33.satoken.SaManager;
-
 /**
  * Sa-Token 示例 
  * @author click33
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
index 16204f3a..da5aa8eb 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
@@ -1,10 +1,9 @@
 package com.pj.cases.test;
 
+import cn.dev33.satoken.util.SaResult;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
-import cn.dev33.satoken.util.SaResult;
-
 /**
  * 测试专用 Controller 
  * @author click33
@@ -17,14 +16,14 @@ public class TestController {
 	// 测试   浏览器访问： http://localhost:8081/test/test
 	@RequestMapping("test")
 	public SaResult test() {
-		System.out.println("------------进来了"); 
+		System.out.println("------------进来了");
 		return SaResult.ok(); 
 	}
 	
 	// 测试   浏览器访问： http://localhost:8081/test/test2
 	@RequestMapping("test2")
 	public SaResult test2() {
-		System.out.println("------------进来了"); 
+		System.out.println("------------进来了");
 		return SaResult.ok();
 	}
 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/current/GlobalException.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/current/GlobalException.java
index fd1f2697..593da152 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/current/GlobalException.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/current/GlobalException.java
@@ -4,7 +4,7 @@ import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 
 import cn.dev33.satoken.exception.DisableServiceException;
-import cn.dev33.satoken.exception.NotBasicAuthException;
+import cn.dev33.satoken.exception.NotHttpBasicAuthException;
 import cn.dev33.satoken.exception.NotLoginException;
 import cn.dev33.satoken.exception.NotPermissionException;
 import cn.dev33.satoken.exception.NotRoleException;
@@ -57,8 +57,8 @@ public class GlobalException {
 	}
 
 	// 拦截：Http Basic 校验失败异常 
-	@ExceptionHandler(NotBasicAuthException.class)
-	public SaResult handlerException(NotBasicAuthException e) {
+	@ExceptionHandler(NotHttpBasicAuthException.class)
+	public SaResult handlerException(NotHttpBasicAuthException e) {
 		e.printStackTrace(); 
 		return SaResult.error(e.getMessage());
 	}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 95940185..643a14b7 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -5,6 +5,7 @@ import cn.dev33.satoken.filter.SaServletFilter;
 import cn.dev33.satoken.interceptor.SaInterceptor;
 import cn.dev33.satoken.router.SaRouter;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.context.annotation.Bean;
@@ -117,9 +118,9 @@ public class SaTokenConfigure implements WebMvcConfigurer {
     @PostConstruct
     public void rewriteSaStrategy() {
     	// 重写Sa-Token的注解处理器，增加注解合并功能 
-    	SaStrategy.instance.getAnnotation = (element, annotationClass) -> {
-    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass);
-    	};
+//    	SaAnnotationStrategy.instance.getAnnotation = (element, annotationClass) -> {
+//    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass);
+//    	};
     }
     
 }
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckLogin.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckLogin.java
similarity index 71%
rename from sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckLogin.java
rename to sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckLogin.java
index 5c623667..9495168b 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckLogin.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckLogin.java
@@ -1,20 +1,16 @@
-package com.pj.satoken.at;
+package com.pj.satoken.custom_annotation;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import cn.dev33.satoken.annotation.SaCheckLogin;
-import com.pj.satoken.StpUserUtil;
-
 /**
  * 登录认证(User版)：只有登录之后才能进入该方法 
- * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
- * @author click33
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上）
  *
+ * @author click33
  */
-@SaCheckLogin(type = StpUserUtil.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
 @Target({ ElementType.METHOD, ElementType.TYPE})
 public @interface SaUserCheckLogin {
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckPermission.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckPermission.java
similarity index 54%
rename from sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckPermission.java
rename to sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckPermission.java
index 22938622..eb980411 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckPermission.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckPermission.java
@@ -1,23 +1,19 @@
-package com.pj.satoken.at;
+package com.pj.satoken.custom_annotation;
+
+import cn.dev33.satoken.annotation.SaMode;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import com.pj.satoken.StpUserUtil;
-import org.springframework.core.annotation.AliasFor;
-
-import cn.dev33.satoken.annotation.SaCheckPermission;
-import cn.dev33.satoken.annotation.SaMode;
-
 /**
  * 权限认证(User版)：必须具有指定权限才能进入该方法 
- * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上）
+ *
  * @author click33
  *
  */
-@SaCheckPermission(type = StpUserUtil.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
 @Target({ ElementType.METHOD, ElementType.TYPE})
 public @interface SaUserCheckPermission {
@@ -26,14 +22,29 @@ public @interface SaUserCheckPermission {
 	 * 需要校验的权限码
 	 * @return 需要校验的权限码
 	 */
-	@AliasFor(annotation = SaCheckPermission.class)
 	String [] value() default {};
 
 	/**
 	 * 验证模式：AND | OR，默认AND
 	 * @return 验证模式
 	 */
-	@AliasFor(annotation = SaCheckPermission.class)
 	SaMode mode() default SaMode.AND;
-	
+
+	/**
+	 * 在权限校验不通过时的次要选择，两者只要其一校验成功即可通过校验
+	 *
+	 * <p>
+	 * 	例1：@SaCheckPermission(value="user-add", orRole="admin")，
+	 * 	代表本次请求只要具有 user-add权限 或 admin角色 其一即可通过校验。
+	 * </p>
+	 *
+	 * <p>
+	 * 	例2： orRole = {"admin", "manager", "staff"}，具有三个角色其一即可。 <br>
+	 * 	例3： orRole = {"admin, manager, staff"}，必须三个角色同时具备。
+	 * </p>
+	 *
+	 * @return /
+	 */
+	String[] orRole() default {};
+
 }
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckRole.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckRole.java
similarity index 72%
rename from sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckRole.java
rename to sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckRole.java
index 66e1f6d0..c3e06bac 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at/SaUserCheckRole.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckRole.java
@@ -1,23 +1,18 @@
-package com.pj.satoken.at;
+package com.pj.satoken.custom_annotation;
+
+import cn.dev33.satoken.annotation.SaMode;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import com.pj.satoken.StpUserUtil;
-import org.springframework.core.annotation.AliasFor;
-
-import cn.dev33.satoken.annotation.SaCheckRole;
-import cn.dev33.satoken.annotation.SaMode;
-
 /**
  * 角色认证(User版)：必须具有指定角色标识才能进入该方法 
  * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
  * @author click33
  *
  */
-@SaCheckRole(type = StpUserUtil.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
 @Target({ ElementType.METHOD, ElementType.TYPE})
 public @interface SaUserCheckRole {
@@ -26,14 +21,12 @@ public @interface SaUserCheckRole {
 	 * 需要校验的角色标识
 	 * @return 需要校验的角色标识
 	 */
-	@AliasFor(annotation = SaCheckRole.class)
 	String [] value() default {};
 
 	/**
 	 * 验证模式：AND | OR，默认AND
 	 * @return 验证模式
 	 */
-	@AliasFor(annotation = SaCheckRole.class)
 	SaMode mode() default SaMode.AND;
 	
 }
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 33726fd6..33e2f4aa 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -108,6 +108,7 @@
 	- [TokenInfo参数详解](/fun/token-info)
 	- [异常细分状态码](/fun/exception-code)
 	- [数据结构](/fun/data-structure)
+	- [自定义注解](/fun/custom-annotations)
 	- [参考：把权限放在缓存里](/fun/jur-cache)
 	- [参考：把路由拦截鉴权动态化](/fun/dynamic-router-check)
 	- [解决反向代理 uri 丢失的问题](/fun/curr-domain)
diff --git a/sa-token-doc/up/many-account.md b/sa-token-doc/up/many-account.md
index 6879e15f..f3271716 100644
--- a/sa-token-doc/up/many-account.md
+++ b/sa-token-doc/up/many-account.md
@@ -184,8 +184,11 @@ public String info() {
 }
 ```
 
-注：其它注解 `@SaCheckRole("xxx")`、`@SaCheckPermission("xxx")`同理，
-完整示例参考：[码云：自定义注解](https://gitee.com/dromara/sa-token/tree/dev/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/at)。
+注：其它注解 `@SaCheckRole("xxx")`、`@SaCheckPermission("xxx")`同理， 完整示例参考 Gitee 代码：
+[注解合并](https://gitee.com/dromara/sa-token/tree/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation)。
+
+> [!TIP| label:自定义注解方案] 
+> 除了注解合并方案，这里还有一份自定义注解方案，参考：[自定义注解](/fun/custom-annotations)
 
 
 
diff --git a/sa-token-doc/use/at-check.md b/sa-token-doc/use/at-check.md
index 0f921043..745e62fd 100644
--- a/sa-token-doc/use/at-check.md
+++ b/sa-token-doc/use/at-check.md
@@ -213,10 +213,16 @@ public SaResult test() {
 
 
 
-### 7、在业务逻辑层使用注解鉴权
-疑问：我能否将注解写在其它架构层呢，比如业务逻辑层？
+### 7、扩展阅读
 
-使用拦截器模式，只能在`Controller层`进行注解鉴权，如需在任意层级使用注解鉴权，请参考：[AOP注解鉴权](/plugin/aop-at)
+- 在业务逻辑层使用鉴权注解：[AOP注解鉴权](/plugin/aop-at)
+
+- 制作自定义鉴权注解注入到框架：[自定义注解](/fun/custom-annotations)
+
+
+<!-- 疑问：我能否将注解写在其它架构层呢，比如业务逻辑层？
+
+使用拦截器模式，只能在`Controller层`进行注解鉴权，如需在任意层级使用注解鉴权，请参考：[AOP注解鉴权](/plugin/aop-at) -->
 
 
 ---
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
index 308d6b25..69d4777e 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.spring;
 
 import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.context.SaTokenContext;
 import cn.dev33.satoken.context.second.SaTokenSecondContextCreator;
@@ -34,6 +35,7 @@ import cn.dev33.satoken.spring.pathmatch.SaPathMatcherHolder;
 import cn.dev33.satoken.stp.StpInterface;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import cn.dev33.satoken.temp.SaTempInterface;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -118,6 +120,18 @@ public class SaBeanInject {
 		SaTokenEventCenter.registerListenerList(listenerList);
 	}
 
+	/**
+	 * 注入自定义注解处理器
+	 *
+	 * @param handlerList 自定义注解处理器集合
+	 */
+	@Autowired(required = false)
+	public void setSaAnnotationHandler(List<SaAnnotationAbstractHandler<?>> handlerList) {
+		for (SaAnnotationAbstractHandler<?> handler : handlerList) {
+			SaAnnotationStrategy.instance.registerAnnotationHandler(handler);
+		}
+	}
+
 	/**
 	 * 注入临时令牌验证模块 Bean
 	 * 
@@ -149,12 +163,12 @@ public class SaBeanInject {
 	}
 
 	/**
-	 * 注入 Sa-Token Digest Basic 认证模块
+	 * 注入 Sa-Token Http Digest 认证模块
 	 *
 	 * @param saHttpDigestTemplate saHttpDigestTemplate 对象
 	 */
 	@Autowired(required = false)
-	public void setSaHttpBasicTemplate(SaHttpDigestTemplate saHttpDigestTemplate) {
+	public void setSaHttpDigestTemplate(SaHttpDigestTemplate saHttpDigestTemplate) {
 		SaHttpDigestUtil.saHttpDigestTemplate = saHttpDigestTemplate;
 	}
 
diff --git a/sa-token-starter/sa-token-spring-boot-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java b/sa-token-starter/sa-token-spring-boot-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
index 78840ddd..5cf3bebd 100644
--- a/sa-token-starter/sa-token-spring-boot-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
+++ b/sa-token-starter/sa-token-spring-boot-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
@@ -15,11 +15,10 @@
  */
 package cn.dev33.satoken.interceptor;
 
-import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.exception.BackResultException;
 import cn.dev33.satoken.exception.StopMatchException;
 import cn.dev33.satoken.fun.SaParamFunction;
-import cn.dev33.satoken.strategy.SaStrategy;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.HandlerInterceptor;
 
@@ -95,18 +94,8 @@ public class SaInterceptor implements HandlerInterceptor {
 
 			// 这里必须确保 handler 是 HandlerMethod 类型时，才能进行注解鉴权
 			if(isAnnotation && handler instanceof HandlerMethod) {
-				
-				// 获取此请求对应的 Method 处理函数 
 				Method method = ((HandlerMethod) handler).getMethod();
-
-				// 如果此 Method 或其所属 Class 标注了 @SaIgnore，则忽略掉鉴权
-				if(SaStrategy.instance.isAnnotationPresent.apply(method, SaIgnore.class)) {
-					// 注意这里直接就退出整个鉴权了，最底部的 auth.run() 路由拦截鉴权也被跳出了
-					return true;
-				}
-
-				// 执行注解鉴权
-				SaStrategy.instance.checkMethodAnnotation.accept(method);
+				SaAnnotationStrategy.instance.checkMethodAnnotation.accept(method);
 			}
 			
 			// Auth 路由拦截鉴权校验
diff --git a/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/HandlerException.java b/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/HandlerException.java
index a5811e8c..946303ac 100644
--- a/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/HandlerException.java
+++ b/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/HandlerException.java
@@ -19,7 +19,7 @@ import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 
 import cn.dev33.satoken.exception.DisableServiceException;
-import cn.dev33.satoken.exception.NotBasicAuthException;
+import cn.dev33.satoken.exception.NotHttpBasicAuthException;
 import cn.dev33.satoken.exception.NotLoginException;
 import cn.dev33.satoken.exception.NotPermissionException;
 import cn.dev33.satoken.exception.NotRoleException;
@@ -66,8 +66,8 @@ public class HandlerException {
 	}
 
 	// Http Basic 校验失败，code=903
-	@ExceptionHandler(NotBasicAuthException.class)
-	public SaResult handlerNotBasicAuthException(NotBasicAuthException e) {
+	@ExceptionHandler(NotHttpBasicAuthException.class)
+	public SaResult handlerNotBasicAuthException(NotHttpBasicAuthException e) {
 		return SaResult.error().setCode(903);
 	}
 
-- 
Gitee


From cd0c20793a577cdcdbf91127355f9bfda92b367d Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 3 Aug 2024 19:08:51 +0800
Subject: [PATCH 105/172] =?UTF-8?q?SaAnnotationAbstractHandler=20=E7=94=B1?=
 =?UTF-8?q?=E6=8A=BD=E8=B1=A1=E7=B1=BB=E6=94=B9=E4=B8=BA=E6=8E=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../handler/SaAnnotationAbstractHandler.java  |  52 +++++
 .../handler/SaCheckDisableHandler.java        |  51 +++++
 .../handler/SaCheckHttpBasicHandler.java      |  45 ++++
 .../handler/SaCheckHttpDigestHandler.java     |  64 ++++++
 .../handler/SaCheckLoginHandler.java          |  48 +++++
 .../annotation/handler/SaCheckOrHandler.java  |  87 ++++++++
 .../handler/SaCheckPermissionHandler.java     |  68 ++++++
 .../handler/SaCheckRoleHandler.java           |  54 +++++
 .../handler/SaCheckSafeHandler.java           |  48 +++++
 .../annotation/handler/SaIgnoreHandler.java   |  45 ++++
 .../strategy/SaAnnotationStrategy.java        | 124 +++++++++++
 .../com/pj/cases/test/TestController.java     |   2 +
 .../custom_annotation/CheckAccount.java       |  33 +++
 .../custom_annotation/SaUserCheckSafe.java    |  28 +++
 .../handler/CheckAccountHandler.java          |  42 ++++
 .../handler/SaUserCheckLoginHandler.java      |  29 +++
 .../handler/SaUserCheckPermissionHandler.java |  29 +++
 .../handler/SaUserCheckRoleHandler.java       |  29 +++
 .../handler/SaUserCheckSafeHandler.java       |  29 +++
 .../merge_annotation/SaUserCheckLogin.java    |  22 ++
 .../SaUserCheckPermission.java                |  56 +++++
 .../merge_annotation/SaUserCheckRole.java     |  38 ++++
 .../merge_annotation/SaUserCheckSafe.java     |  31 +++
 sa-token-doc/fun/custom-annotations.md        | 199 ++++++++++++++++++
 24 files changed, 1253 insertions(+)
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
 create mode 100644 sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckSafe.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckLogin.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckPermission.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckRole.java
 create mode 100644 sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckSafe.java
 create mode 100644 sa-token-doc/fun/custom-annotations.md

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
new file mode 100644
index 00000000..b9d8b4ba
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 所有注解处理器的父接口
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public interface SaAnnotationAbstractHandler<T extends Annotation> {
+
+    /**
+     * 获取所要处理的注解类型
+     * @return /
+     */
+    Class<T> getHandlerAnnotationClass();
+
+    /**
+     * 所需要执行的校验方法
+     * @param at 注解对象
+     * @param element 被标注的注解的元素引用（类或方法）
+     */
+    @SuppressWarnings("unchecked")
+    default void check(Annotation at, AnnotatedElement element) {
+        checkMethod((T) at, element);
+    }
+
+    /**
+     * 所需要执行的校验方法（转换类型后）
+     * @param at 注解对象
+     * @param element 被标注的注解的元素引用（类或方法）
+     */
+    void checkMethod(T at, AnnotatedElement element);
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
new file mode 100644
index 00000000..4f613612
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.SaCheckDisable;
+import cn.dev33.satoken.stp.StpLogic;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckDisable 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckDisableHandler implements SaAnnotationAbstractHandler<SaCheckDisable> {
+
+    @Override
+    public Class<SaCheckDisable> getHandlerAnnotationClass() {
+        return SaCheckDisable.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckDisable at, AnnotatedElement element) {
+        _checkMethod(at.type(), at.value(), at.level());
+    }
+
+    public static void _checkMethod(String type, String[] value, int level) {
+        StpLogic stpLogic = SaManager.getStpLogic(type, false);
+
+        Object loginId = stpLogic.getLoginId();
+        for (String service : value) {
+            stpLogic.checkDisableLevel(loginId, service, level);
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
new file mode 100644
index 00000000..52734d50
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.annotation.SaCheckHttpBasic;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckHttpBasic 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckHttpBasicHandler implements SaAnnotationAbstractHandler<SaCheckHttpBasic> {
+
+    @Override
+    public Class<SaCheckHttpBasic> getHandlerAnnotationClass() {
+        return SaCheckHttpBasic.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckHttpBasic at, AnnotatedElement element) {
+        _checkMethod(at.realm(), at.account());
+    }
+
+    public static void _checkMethod(String realm, String account) {
+        SaHttpBasicUtil.check(realm, account);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
new file mode 100644
index 00000000..58d7971f
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.annotation.SaCheckHttpDigest;
+import cn.dev33.satoken.exception.SaTokenException;
+import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckHttpDigest 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckHttpDigestHandler implements SaAnnotationAbstractHandler<SaCheckHttpDigest> {
+
+    @Override
+    public Class<SaCheckHttpDigest> getHandlerAnnotationClass() {
+        return SaCheckHttpDigest.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckHttpDigest at, AnnotatedElement element) {
+        _checkMethod(at.username(), at.password(), at.realm(), at.value());
+    }
+
+    public static void _checkMethod(String username, String password, String realm, String value) {
+        // 如果配置了 value，则以 value 优先
+        if(SaFoxUtil.isNotEmpty(value)){
+            String[] arr = value.split(":");
+            if(arr.length != 2){
+                throw new SaTokenException("注解参数配置错误，格式应如：username:password");
+            }
+            SaHttpDigestUtil.check(arr[0], arr[1]);
+            return;
+        }
+
+        // 如果配置了 username，则分别获取参数
+        if(SaFoxUtil.isNotEmpty(username)){
+            SaHttpDigestUtil.check(username, password, realm);
+            return;
+        }
+
+        // 都没有配置，则根据全局配置参数进行校验
+        SaHttpDigestUtil.check();
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
new file mode 100644
index 00000000..feb4dc33
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.SaCheckLogin;
+import cn.dev33.satoken.stp.StpLogic;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckLogin 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckLoginHandler implements SaAnnotationAbstractHandler<SaCheckLogin> {
+
+    @Override
+    public Class<SaCheckLogin> getHandlerAnnotationClass() {
+        return SaCheckLogin.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckLogin at, AnnotatedElement element) {
+        _checkMethod(at.type());
+    }
+
+    public static void _checkMethod(String type) {
+        StpLogic stpLogic = SaManager.getStpLogic(type, false);
+
+        stpLogic.checkLogin();
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
new file mode 100644
index 00000000..8448b110
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.annotation.*;
+import cn.dev33.satoken.exception.SaTokenException;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.AnnotatedElement;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * 注解 SaCheckOr 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckOrHandler implements SaAnnotationAbstractHandler<SaCheckOr> {
+
+    @Override
+    public Class<SaCheckOr> getHandlerAnnotationClass() {
+        return SaCheckOr.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckOr at, AnnotatedElement element) {
+        _checkMethod(at.login(), at.role(), at.permission(), at.safe(), at.httpBasic(), at.httpDigest(), at.disable(), element);
+    }
+
+    public static void _checkMethod(
+            SaCheckLogin[] login,
+            SaCheckRole[] role,
+            SaCheckPermission[] permission,
+            SaCheckSafe[] safe,
+            SaCheckHttpBasic[] httpBasic,
+            SaCheckHttpDigest[] httpDigest,
+            SaCheckDisable[] disable,
+            AnnotatedElement element
+    ) {
+        // 先把所有注解塞到一个 list 里
+        List<Annotation> annotationList = new ArrayList<>();
+        annotationList.addAll(Arrays.asList(login));
+        annotationList.addAll(Arrays.asList(role));
+        annotationList.addAll(Arrays.asList(permission));
+        annotationList.addAll(Arrays.asList(safe));
+        annotationList.addAll(Arrays.asList(disable));
+        annotationList.addAll(Arrays.asList(httpBasic));
+        annotationList.addAll(Arrays.asList(httpDigest));
+
+        // 如果 atList 为空，说明 SaCheckOr 上不包含任何注解校验，我们直接跳过即可
+        if(annotationList.isEmpty()) {
+            return;
+        }
+
+        // 逐个开始校验 >>>
+        List<SaTokenException> errorList = new ArrayList<>();
+        for (Annotation item : annotationList) {
+            try {
+                SaAnnotationStrategy.instance.annotationHandlerMap.get(item.annotationType()).check(item, element);
+                // 只要有一个校验通过，就可以直接返回了
+                return;
+            } catch (SaTokenException e) {
+                errorList.add(e);
+            }
+        }
+
+        // 执行至此，说明所有注解校验都通过不了，此时 errorList 里面会有多个异常，我们随便抛出一个即可
+        throw errorList.get(0);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
new file mode 100644
index 00000000..b2e18b7e
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import cn.dev33.satoken.annotation.SaMode;
+import cn.dev33.satoken.exception.NotPermissionException;
+import cn.dev33.satoken.stp.StpLogic;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckPermission 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckPermissionHandler implements SaAnnotationAbstractHandler<SaCheckPermission> {
+
+    @Override
+    public Class<SaCheckPermission> getHandlerAnnotationClass() {
+        return SaCheckPermission.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckPermission at, AnnotatedElement element) {
+        _checkMethod(at.type(), at.value(), at.mode(), at.orRole());
+    }
+
+    public static void _checkMethod(String type, String[] value, SaMode mode, String[] orRole) {
+        StpLogic stpLogic = SaManager.getStpLogic(type, false);
+
+        String[] permissionArray = value;
+        try {
+            if(mode == SaMode.AND) {
+                stpLogic.checkPermissionAnd(permissionArray);
+            } else {
+                stpLogic.checkPermissionOr(permissionArray);
+            }
+        } catch (NotPermissionException e) {
+            // 权限认证校验未通过，再开始角色认证校验
+            for (String role : orRole) {
+                String[] rArr = SaFoxUtil.convertStringToArray(role);
+                // 某一项 role 认证通过，则可以提前退出了，代表通过
+                if (stpLogic.hasRoleAnd(rArr)) {
+                    return;
+                }
+            }
+            throw e;
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
new file mode 100644
index 00000000..24787e30
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.SaCheckRole;
+import cn.dev33.satoken.annotation.SaMode;
+import cn.dev33.satoken.stp.StpLogic;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckRole 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckRoleHandler implements SaAnnotationAbstractHandler<SaCheckRole> {
+
+    @Override
+    public Class<SaCheckRole> getHandlerAnnotationClass() {
+        return SaCheckRole.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckRole at, AnnotatedElement element) {
+        _checkMethod(at.type(), at.value(), at.mode());
+    }
+
+    public static void _checkMethod(String type, String[] value, SaMode mode) {
+        StpLogic stpLogic = SaManager.getStpLogic(type, false);
+
+        String[] roleArray = value;
+        if(mode == SaMode.AND) {
+            stpLogic.checkRoleAnd(roleArray);
+        } else {
+            stpLogic.checkRoleOr(roleArray);
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
new file mode 100644
index 00000000..8f6ca9b0
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.annotation.SaCheckSafe;
+import cn.dev33.satoken.stp.StpLogic;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaCheckSafe 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaCheckSafeHandler implements SaAnnotationAbstractHandler<SaCheckSafe> {
+
+    @Override
+    public Class<SaCheckSafe> getHandlerAnnotationClass() {
+        return SaCheckSafe.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckSafe at, AnnotatedElement element) {
+        _checkMethod(at.type(), at.value());
+    }
+
+    public static void _checkMethod(String type, String value) {
+        StpLogic stpLogic = SaManager.getStpLogic(type, false);
+
+        stpLogic.checkSafe(value);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
new file mode 100644
index 00000000..cbc86067
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.annotation.handler;
+
+import cn.dev33.satoken.annotation.SaIgnore;
+import cn.dev33.satoken.router.SaRouter;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaIgnore 的处理器
+ *
+ * @author click33
+ * @since 2024/8/2
+ */
+public class SaIgnoreHandler implements SaAnnotationAbstractHandler<SaIgnore> {
+
+    @Override
+    public Class<SaIgnore> getHandlerAnnotationClass() {
+        return SaIgnore.class;
+    }
+
+    @Override
+    public void checkMethod(SaIgnore at, AnnotatedElement element) {
+        _checkMethod();
+    }
+
+    public static void _checkMethod() {
+        SaRouter.stop();
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
new file mode 100644
index 00000000..12f24050
--- /dev/null
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.strategy;
+
+import cn.dev33.satoken.annotation.*;
+import cn.dev33.satoken.annotation.handler.*;
+import cn.dev33.satoken.fun.strategy.SaCheckMethodAnnotationFunction;
+import cn.dev33.satoken.fun.strategy.SaGetAnnotationFunction;
+import cn.dev33.satoken.listener.SaTokenEventCenter;
+
+import java.lang.annotation.Annotation;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Sa-Token 注解鉴权相关策略
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public final class SaAnnotationStrategy {
+
+	private SaAnnotationStrategy() {
+		registerDefaultAnnotationHandler();
+	}
+
+	/**
+	 * 全局单例引用
+	 */
+	public static final SaAnnotationStrategy instance = new SaAnnotationStrategy();
+
+
+	// ----------------------- 所有策略
+
+	/**
+	 * 注解处理器集合
+	 */
+	public Map<Class<?>, SaAnnotationAbstractHandler<?>> annotationHandlerMap = new LinkedHashMap<>();
+
+	/**
+	 * 注册所有默认的注解处理器
+	 */
+	public void registerDefaultAnnotationHandler() {
+		annotationHandlerMap.put(SaIgnore.class, new SaIgnoreHandler());
+		annotationHandlerMap.put(SaCheckLogin.class, new SaCheckLoginHandler());
+		annotationHandlerMap.put(SaCheckRole.class, new SaCheckRoleHandler());
+		annotationHandlerMap.put(SaCheckPermission.class, new SaCheckPermissionHandler());
+		annotationHandlerMap.put(SaCheckSafe.class, new SaCheckSafeHandler());
+		annotationHandlerMap.put(SaCheckDisable.class, new SaCheckDisableHandler());
+		annotationHandlerMap.put(SaCheckHttpBasic.class, new SaCheckHttpBasicHandler());
+		annotationHandlerMap.put(SaCheckHttpDigest.class, new SaCheckHttpDigestHandler());
+		annotationHandlerMap.put(SaCheckOr.class, new SaCheckOrHandler());
+	}
+
+	/**
+	 * 注册一个注解处理器
+	 */
+	public void registerAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+		annotationHandlerMap.put(handler.getHandlerAnnotationClass(), handler);
+		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+	}
+
+	/**
+	 * 注册一个注解处理器，到首位
+	 */
+	public void registerAnnotationHandlerToFirst(SaAnnotationAbstractHandler<?> handler) {
+		Map<Class<?>, SaAnnotationAbstractHandler<?>> newMap = new LinkedHashMap<>();
+		newMap.put(handler.getHandlerAnnotationClass(), handler);
+		newMap.putAll(annotationHandlerMap);
+		this.annotationHandlerMap = newMap;
+		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+	}
+
+	/**
+	 * 移除一个注解处理器
+	 */
+	public void removeAnnotationHandler(Class<?> cls) {
+		annotationHandlerMap.remove(cls);
+	}
+
+	/**
+	 * 对一个 [Method] 对象进行注解校验 （注解鉴权内部实现）
+	 */
+	@SuppressWarnings("unchecked")
+	public SaCheckMethodAnnotationFunction checkMethodAnnotation = (method) -> {
+		// 遍历所有的注解处理器，检查此 method 是否具有这些指定的注解
+		for (Map.Entry<Class<?>, SaAnnotationAbstractHandler<?>> entry: annotationHandlerMap.entrySet()) {
+
+			// 先校验 Method 所属 Class 上的注解
+			Annotation classTakeAnnotation = instance.getAnnotation.apply(method.getDeclaringClass(), (Class<Annotation>)entry.getKey());
+			if(classTakeAnnotation != null) {
+				entry.getValue().check(classTakeAnnotation, method.getDeclaringClass());
+			}
+
+			// 再校验 Method 上的注解
+			Annotation methodTakeAnnotation = instance.getAnnotation.apply(method, (Class<Annotation>)entry.getKey());
+			if(methodTakeAnnotation != null) {
+				entry.getValue().check(methodTakeAnnotation, method);
+			}
+		}
+	};
+
+	/**
+	 * 从元素上获取注解
+	 */
+	public SaGetAnnotationFunction getAnnotation = (element, annotationClass)->{
+		// 默认使用jdk的注解处理器
+		return element.getAnnotation(annotationClass);
+	};
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
index da5aa8eb..a4ea6f76 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
@@ -1,6 +1,7 @@
 package com.pj.cases.test;
 
 import cn.dev33.satoken.util.SaResult;
+import com.pj.satoken.custom_annotation.CheckAccount;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -15,6 +16,7 @@ public class TestController {
 
 	// 测试   浏览器访问： http://localhost:8081/test/test
 	@RequestMapping("test")
+	@CheckAccount(name = "sa", pwd = "123456")
 	public SaResult test() {
 		System.out.println("------------进来了");
 		return SaResult.ok(); 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
new file mode 100644
index 00000000..2c01a5ae
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
@@ -0,0 +1,33 @@
+package com.pj.satoken.custom_annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 账号校验：在标注一个方法上时，要求前端必须提交相应的账号密码参数才能访问方法。
+ *
+ * @author click33
+ *
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface CheckAccount {
+
+    /**
+     * 需要校验的账号
+     *
+     * @return /
+     */
+    String name();
+
+    /**
+     * 需要校验的密码
+     *
+     * @return /
+     */
+    String pwd();
+
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckSafe.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckSafe.java
new file mode 100644
index 00000000..49e2da67
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/SaUserCheckSafe.java
@@ -0,0 +1,28 @@
+package com.pj.satoken.custom_annotation;
+
+import cn.dev33.satoken.util.SaTokenConsts;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 二级认证校验(User版)：客户端必须完成二级认证之后，才能进入该方法，否则将被抛出异常。
+ *
+ * <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）。
+ *
+ * @author click33
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE })
+public @interface SaUserCheckSafe {
+
+	/**
+	 * 要校验的服务
+	 *
+	 * @return /
+	 */
+	String value() default SaTokenConsts.DEFAULT_SAFE_AUTH_SERVICE;
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
new file mode 100644
index 00000000..5d5e4a60
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
@@ -0,0 +1,42 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.exception.SaTokenException;
+import com.pj.satoken.custom_annotation.CheckAccount;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 CheckAccount 的处理器
+ *
+ * @author click33
+ *
+ */
+@Component
+public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAccount> {
+
+    // 指定这个处理器要处理哪个注解
+    @Override
+    public Class<CheckAccount> getHandlerAnnotationClass() {
+        return CheckAccount.class;
+    }
+
+    // 每次请求校验注解时，会执行的方法
+    @Override
+    public void checkMethod(CheckAccount at, AnnotatedElement element) {
+        // 获取前端请求提交的参数
+        String name = SaHolder.getRequest().getParamNotNull("name");
+        String pwd = SaHolder.getRequest().getParamNotNull("pwd");
+
+        // 与注解中指定的值相比较
+        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {
+            // 校验通过，什么也不做
+        } else {
+            // 校验不通过，则抛出异常
+            throw new SaTokenException("账号或密码错误，未通过校验");
+        }
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
new file mode 100644
index 00000000..31f0b139
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
@@ -0,0 +1,29 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaCheckLoginHandler;
+import com.pj.satoken.StpUserUtil;
+import com.pj.satoken.custom_annotation.SaUserCheckLogin;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaUserCheckLogin 的处理器
+ *
+ * @author click33
+ */
+@Component
+public class SaUserCheckLoginHandler implements SaAnnotationAbstractHandler<SaUserCheckLogin> {
+
+    @Override
+    public Class<SaUserCheckLogin> getHandlerAnnotationClass() {
+        return SaUserCheckLogin.class;
+    }
+
+    @Override
+    public void checkMethod(SaUserCheckLogin at, AnnotatedElement element) {
+        SaCheckLoginHandler._checkMethod(StpUserUtil.TYPE);
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
new file mode 100644
index 00000000..6b1f1d8f
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
@@ -0,0 +1,29 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaCheckPermissionHandler;
+import com.pj.satoken.StpUserUtil;
+import com.pj.satoken.custom_annotation.SaUserCheckPermission;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaUserCheckPermission 的处理器
+ *
+ * @author click33
+ */
+@Component
+public class SaUserCheckPermissionHandler implements SaAnnotationAbstractHandler<SaUserCheckPermission> {
+
+    @Override
+    public Class<SaUserCheckPermission> getHandlerAnnotationClass() {
+        return SaUserCheckPermission.class;
+    }
+
+    @Override
+    public void checkMethod(SaUserCheckPermission at, AnnotatedElement element) {
+        SaCheckPermissionHandler._checkMethod(StpUserUtil.TYPE, at.value(), at.mode(), at.orRole());
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
new file mode 100644
index 00000000..51cbbe76
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
@@ -0,0 +1,29 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaCheckRoleHandler;
+import com.pj.satoken.StpUserUtil;
+import com.pj.satoken.custom_annotation.SaUserCheckRole;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaUserCheckRole 的处理器
+ *
+ * @author click33
+ */
+@Component
+public class SaUserCheckRoleHandler implements SaAnnotationAbstractHandler<SaUserCheckRole> {
+
+    @Override
+    public Class<SaUserCheckRole> getHandlerAnnotationClass() {
+        return SaUserCheckRole.class;
+    }
+
+    @Override
+    public void checkMethod(SaUserCheckRole at, AnnotatedElement element) {
+        SaCheckRoleHandler._checkMethod(StpUserUtil.TYPE, at.value(), at.mode());
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
new file mode 100644
index 00000000..9f78ccfc
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
@@ -0,0 +1,29 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaCheckSafeHandler;
+import com.pj.satoken.StpUserUtil;
+import com.pj.satoken.custom_annotation.SaUserCheckSafe;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.AnnotatedElement;
+
+/**
+ * 注解 SaUserCheckPermission 的处理器
+ *
+ * @author click33
+ */
+@Component
+public class SaUserCheckSafeHandler implements SaAnnotationAbstractHandler<SaUserCheckSafe> {
+
+    @Override
+    public Class<SaUserCheckSafe> getHandlerAnnotationClass() {
+        return SaUserCheckSafe.class;
+    }
+
+    @Override
+    public void checkMethod(SaUserCheckSafe at, AnnotatedElement element) {
+        SaCheckSafeHandler._checkMethod(StpUserUtil.TYPE, at.value());
+    }
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckLogin.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckLogin.java
new file mode 100644
index 00000000..45e60c5f
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckLogin.java
@@ -0,0 +1,22 @@
+package com.pj.satoken.merge_annotation;
+
+import cn.dev33.satoken.annotation.SaCheckLogin;
+import com.pj.satoken.StpUserUtil;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 登录认证(User版)：只有登录之后才能进入该方法 
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
+ * @author click33
+ *
+ */
+@SaCheckLogin(type = StpUserUtil.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface SaUserCheckLogin {
+	
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckPermission.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckPermission.java
new file mode 100644
index 00000000..641f23c6
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckPermission.java
@@ -0,0 +1,56 @@
+package com.pj.satoken.merge_annotation;
+
+import cn.dev33.satoken.annotation.SaCheckPermission;
+import cn.dev33.satoken.annotation.SaMode;
+import com.pj.satoken.StpUserUtil;
+import org.springframework.core.annotation.AliasFor;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 权限认证(User版)：必须具有指定权限才能进入该方法 
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
+ * @author click33
+ *
+ */
+@SaCheckPermission(type = StpUserUtil.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface SaUserCheckPermission {
+
+	/**
+	 * 需要校验的权限码
+	 * @return 需要校验的权限码
+	 */
+	@AliasFor(annotation = SaCheckPermission.class)
+	String [] value() default {};
+
+	/**
+	 * 验证模式：AND | OR，默认AND
+	 * @return 验证模式
+	 */
+	@AliasFor(annotation = SaCheckPermission.class)
+	SaMode mode() default SaMode.AND;
+
+	/**
+	 * 在权限校验不通过时的次要选择，两者只要其一校验成功即可通过校验
+	 *
+	 * <p>
+	 * 	例1：@SaCheckPermission(value="user-add", orRole="admin")，
+	 * 	代表本次请求只要具有 user-add权限 或 admin角色 其一即可通过校验。
+	 * </p>
+	 *
+	 * <p>
+	 * 	例2： orRole = {"admin", "manager", "staff"}，具有三个角色其一即可。 <br>
+	 * 	例3： orRole = {"admin, manager, staff"}，必须三个角色同时具备。
+	 * </p>
+	 *
+	 * @return /
+	 */
+	@AliasFor(annotation = SaCheckPermission.class)
+	String[] orRole() default {};
+
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckRole.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckRole.java
new file mode 100644
index 00000000..ff81b676
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckRole.java
@@ -0,0 +1,38 @@
+package com.pj.satoken.merge_annotation;
+
+import cn.dev33.satoken.annotation.SaCheckRole;
+import cn.dev33.satoken.annotation.SaMode;
+import com.pj.satoken.StpUserUtil;
+import org.springframework.core.annotation.AliasFor;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 角色认证(User版)：必须具有指定角色标识才能进入该方法 
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
+ * @author click33
+ *
+ */
+@SaCheckRole(type = StpUserUtil.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface SaUserCheckRole {
+
+	/**
+	 * 需要校验的角色标识
+	 * @return 需要校验的角色标识
+	 */
+	@AliasFor(annotation = SaCheckRole.class)
+	String [] value() default {};
+
+	/**
+	 * 验证模式：AND | OR，默认AND
+	 * @return 验证模式
+	 */
+	@AliasFor(annotation = SaCheckRole.class)
+	SaMode mode() default SaMode.AND;
+	
+}
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckSafe.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckSafe.java
new file mode 100644
index 00000000..60bd4e56
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/merge_annotation/SaUserCheckSafe.java
@@ -0,0 +1,31 @@
+package com.pj.satoken.merge_annotation;
+
+import cn.dev33.satoken.annotation.SaCheckSafe;
+import cn.dev33.satoken.util.SaTokenConsts;
+import com.pj.satoken.StpUserUtil;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 二级认证校验(User版)：客户端必须完成二级认证之后，才能进入该方法，否则将被抛出异常。
+ *
+ * <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）。
+ *
+ * @author click33
+ */
+@SaCheckSafe(type = StpUserUtil.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE })
+public @interface SaUserCheckSafe {
+
+	/**
+	 * 要校验的服务
+	 *
+	 * @return /
+	 */
+	String value() default SaTokenConsts.DEFAULT_SAFE_AUTH_SERVICE;
+
+}
diff --git a/sa-token-doc/fun/custom-annotations.md b/sa-token-doc/fun/custom-annotations.md
new file mode 100644
index 00000000..c992517d
--- /dev/null
+++ b/sa-token-doc/fun/custom-annotations.md
@@ -0,0 +1,199 @@
+# 自定义注解
+
+如果框架内置的注解无法满足你的业务需求，你还可以自定义注解注入到框架中。
+
+---
+
+### 1、自定义注解
+
+假设有以下业务需求
+
+> [!INFO| label:需求场景] 
+> 自定义一个注解 `@CheckAccount`，具有 `name`、`pwd` 两个字段，在标注一个方法上时，要求前端必须提交相应的账号密码参数才能访问方法。
+
+
+#### 1.1、第一步，创建一个注解
+
+``` java
+/**
+ * 账号校验：在标注一个方法上时，要求前端必须提交相应的账号密码参数才能访问方法。
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface CheckAccount {
+
+    /**
+     * 需要校验的账号
+     */
+    String name();
+
+    /**
+     * 需要校验的密码
+     */
+    String pwd();
+
+}
+```
+
+#### 1.2、第二步，创建注解处理器 
+
+实现 `SaAnnotationAbstractHandler` 接口，指定泛型为刚才自定义的注解 
+
+``` java
+/**
+ * 注解 CheckAccount 的处理器
+ */
+@Component
+public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAccount> {
+
+    // 指定这个处理器要处理哪个注解
+    @Override
+    public Class<CheckAccount> getHandlerAnnotationClass() {
+        return CheckAccount.class;
+    }
+
+    // 每次请求校验注解时，会执行的方法
+    @Override
+    public void checkMethod(CheckAccount at, AnnotatedElement element) {
+        // 获取前端请求提交的参数
+        String name = SaHolder.getRequest().getParamNotNull("name");
+        String pwd = SaHolder.getRequest().getParamNotNull("pwd");
+
+        // 与注解中指定的值相比较
+        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {
+            // 校验通过，什么也不做
+        } else {
+            // 校验不通过，则抛出异常
+            throw new SaTokenException("账号或密码错误，未通过校验");
+        }
+    }
+
+}
+```
+
+参考上述代码，实现类上指定了 `@Component` 注解，使其可以在 ioc 环境下（如 Spring）被自动扫描注册 Sa-Token 中，
+如果你的项目属于非 ioc 环境，则需要手动将其注册到 Sa-Token 框架中：
+``` java
+SaAnnotationStrategy.instance.registerAnnotationHandler(new CheckAccountHandler());
+```
+
+#### 1.3、测试自定义的注解
+
+我们在一个请求接口上指定这个注解，来测试一下效果 
+
+``` java
+@RestController
+@RequestMapping("/test/")
+public class TestController {
+
+	@RequestMapping("test")
+	@CheckAccount(name = "sa", pwd = "123456")
+	public SaResult test() {
+		System.out.println("------------进来了");
+		return SaResult.ok(); 
+	}
+	
+}
+```
+
+启动项目，使用浏览器访问此接口。
+
+先来个错误的账号密码访问测试一下：[http://localhost:8081/test/test?name=sa&pwd=123](http://localhost:8081/test/test?name=sa&pwd=123)
+
+返回结果：
+
+``` js
+{
+  "code": 500,
+  "msg": "账号或密码错误，未通过校验",
+  "data": null
+}
+```
+
+使用正确账号密码测试访问：[http://localhost:8081/test/test?name=sa&pwd=123456](http://localhost:8081/test/test?name=sa&pwd=123456)
+
+返回结果：
+
+``` js
+{
+  "code": 200,
+  "msg": "ok",
+  "data": null
+}
+```
+
+
+
+### 2、使用自定义注解优化多账号鉴权
+
+在之前的 [ 多账号鉴权 ] 章节，我们介绍了利用 “spring 注解处理器” 达到注解合并的目的，从而简化多账号体系下的注解鉴权写法。
+
+此种方案比较简单，但是也有一些缺点。
+- 1、强依赖 Spring，无法在非 Spring 环境中使用。
+- 2、注解递归检查可能会造成一些性能下降。
+- 3、扩展性较低，只能略微简化框架内置好的注解写法，无法灵活扩展功能。
+
+此处我们再演示一种方案，使用自定义注解的方式达到相同的目的。
+
+
+#### 2.1、首先定义注解
+
+``` java
+/**
+ * 登录认证(User版)：只有登录之后才能进入该方法 
+ * <p> 可标注在函数、类上（效果等同于标注在此类的所有方法上） 
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface SaUserCheckLogin {
+	
+}
+```
+
+#### 2.2、定义注解处理器
+``` java
+/**
+ * 注解 SaUserCheckLogin 的处理器
+ */
+@Component
+public class SaUserCheckLoginHandler implements SaAnnotationAbstractHandler<SaUserCheckLogin> {
+
+    @Override
+    public Class<SaUserCheckLogin> getHandlerAnnotationClass() {
+        return SaUserCheckLogin.class;
+    }
+
+    @Override
+    public void checkMethod(SaUserCheckLogin at, AnnotatedElement element) {
+        SaCheckLoginHandler._checkMethod(StpUserUtil.TYPE);
+    }
+
+}
+```
+
+#### 2.3、使用新注解
+接下来就可以使用我们的自定义注解了：
+
+``` java
+// 使用 @SaUserCheckLogin 的效果等同于使用：@SaCheckLogin(type = "user")
+@SaUserCheckLogin
+@RequestMapping("info")
+public String info() {
+    return "查询用户信息";
+}
+```
+
+注：其它注解 `@SaCheckRole("xxx")`、`@SaCheckPermission("xxx")` 同理， 完整示例参考 Gitee 代码：
+[自定义注解](https://gitee.com/dromara/sa-token/tree/master/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation)。
+
+
+
+
+
+
+
+
+
+
+
+
-- 
Gitee


From c38eb0c68c3d28d53ddb657ef9d7d7b9168f4106 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 3 Aug 2024 19:22:21 +0800
Subject: [PATCH 106/172] =?UTF-8?q?=E6=B3=A8=E8=A7=A3=E5=A4=84=E7=90=86?=
 =?UTF-8?q?=E5=99=A8=E4=BC=A0=E9=80=92=E5=8F=82=E6=95=B0=E6=94=B9=E4=B8=BA?=
 =?UTF-8?q?=20Method?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../handler/SaAnnotationAbstractHandler.java         | 12 ++++++------
 .../annotation/handler/SaCheckDisableHandler.java    |  4 ++--
 .../annotation/handler/SaCheckHttpBasicHandler.java  |  4 ++--
 .../annotation/handler/SaCheckHttpDigestHandler.java |  4 ++--
 .../annotation/handler/SaCheckLoginHandler.java      |  4 ++--
 .../satoken/annotation/handler/SaCheckOrHandler.java | 10 +++++-----
 .../annotation/handler/SaCheckPermissionHandler.java |  4 ++--
 .../annotation/handler/SaCheckRoleHandler.java       |  4 ++--
 .../annotation/handler/SaCheckSafeHandler.java       |  4 ++--
 .../satoken/annotation/handler/SaIgnoreHandler.java  |  4 ++--
 .../dev33/satoken/strategy/SaAnnotationStrategy.java |  2 +-
 .../main/java/com/pj/cases/test/TestController.java  |  2 --
 .../main/java/com/pj/satoken/SaTokenConfigure.java   |  7 +++----
 .../handler/CheckAccountHandler.java                 |  4 ++--
 .../handler/SaUserCheckLoginHandler.java             |  4 ++--
 .../handler/SaUserCheckPermissionHandler.java        |  4 ++--
 .../handler/SaUserCheckRoleHandler.java              |  4 ++--
 .../handler/SaUserCheckSafeHandler.java              |  4 ++--
 18 files changed, 41 insertions(+), 44 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
index b9d8b4ba..8db94fc9 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.annotation.handler;
 
 import java.lang.annotation.Annotation;
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 所有注解处理器的父接口
@@ -35,18 +35,18 @@ public interface SaAnnotationAbstractHandler<T extends Annotation> {
     /**
      * 所需要执行的校验方法
      * @param at 注解对象
-     * @param element 被标注的注解的元素引用（类或方法）
+     * @param method 被标注的注解的方法引用
      */
     @SuppressWarnings("unchecked")
-    default void check(Annotation at, AnnotatedElement element) {
-        checkMethod((T) at, element);
+    default void check(Annotation at, Method method) {
+        checkMethod((T) at, method);
     }
 
     /**
      * 所需要执行的校验方法（转换类型后）
      * @param at 注解对象
-     * @param element 被标注的注解的元素引用（类或方法）
+     * @param method 被标注的注解的方法引用
      */
-    void checkMethod(T at, AnnotatedElement element);
+    void checkMethod(T at, Method method);
 
 }
\ No newline at end of file
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
index 4f613612..67817621 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
@@ -19,7 +19,7 @@ import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.annotation.SaCheckDisable;
 import cn.dev33.satoken.stp.StpLogic;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckDisable 的处理器
@@ -35,7 +35,7 @@ public class SaCheckDisableHandler implements SaAnnotationAbstractHandler<SaChec
     }
 
     @Override
-    public void checkMethod(SaCheckDisable at, AnnotatedElement element) {
+    public void checkMethod(SaCheckDisable at, Method method) {
         _checkMethod(at.type(), at.value(), at.level());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
index 52734d50..2c809b60 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
@@ -18,7 +18,7 @@ package cn.dev33.satoken.annotation.handler;
 import cn.dev33.satoken.annotation.SaCheckHttpBasic;
 import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckHttpBasic 的处理器
@@ -34,7 +34,7 @@ public class SaCheckHttpBasicHandler implements SaAnnotationAbstractHandler<SaCh
     }
 
     @Override
-    public void checkMethod(SaCheckHttpBasic at, AnnotatedElement element) {
+    public void checkMethod(SaCheckHttpBasic at, Method method) {
         _checkMethod(at.realm(), at.account());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
index 58d7971f..1a688492 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
@@ -20,7 +20,7 @@ import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
 import cn.dev33.satoken.util.SaFoxUtil;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckHttpDigest 的处理器
@@ -36,7 +36,7 @@ public class SaCheckHttpDigestHandler implements SaAnnotationAbstractHandler<SaC
     }
 
     @Override
-    public void checkMethod(SaCheckHttpDigest at, AnnotatedElement element) {
+    public void checkMethod(SaCheckHttpDigest at, Method method) {
         _checkMethod(at.username(), at.password(), at.realm(), at.value());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
index feb4dc33..ab83f39e 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
@@ -19,7 +19,7 @@ import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.stp.StpLogic;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckLogin 的处理器
@@ -35,7 +35,7 @@ public class SaCheckLoginHandler implements SaAnnotationAbstractHandler<SaCheckL
     }
 
     @Override
-    public void checkMethod(SaCheckLogin at, AnnotatedElement element) {
+    public void checkMethod(SaCheckLogin at, Method method) {
         _checkMethod(at.type());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
index 8448b110..3aafbfb5 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
@@ -20,7 +20,7 @@ import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 
 import java.lang.annotation.Annotation;
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -39,8 +39,8 @@ public class SaCheckOrHandler implements SaAnnotationAbstractHandler<SaCheckOr>
     }
 
     @Override
-    public void checkMethod(SaCheckOr at, AnnotatedElement element) {
-        _checkMethod(at.login(), at.role(), at.permission(), at.safe(), at.httpBasic(), at.httpDigest(), at.disable(), element);
+    public void checkMethod(SaCheckOr at, Method method) {
+        _checkMethod(at.login(), at.role(), at.permission(), at.safe(), at.httpBasic(), at.httpDigest(), at.disable(), method);
     }
 
     public static void _checkMethod(
@@ -51,7 +51,7 @@ public class SaCheckOrHandler implements SaAnnotationAbstractHandler<SaCheckOr>
             SaCheckHttpBasic[] httpBasic,
             SaCheckHttpDigest[] httpDigest,
             SaCheckDisable[] disable,
-            AnnotatedElement element
+            Method method
     ) {
         // 先把所有注解塞到一个 list 里
         List<Annotation> annotationList = new ArrayList<>();
@@ -72,7 +72,7 @@ public class SaCheckOrHandler implements SaAnnotationAbstractHandler<SaCheckOr>
         List<SaTokenException> errorList = new ArrayList<>();
         for (Annotation item : annotationList) {
             try {
-                SaAnnotationStrategy.instance.annotationHandlerMap.get(item.annotationType()).check(item, element);
+                SaAnnotationStrategy.instance.annotationHandlerMap.get(item.annotationType()).check(item, method);
                 // 只要有一个校验通过，就可以直接返回了
                 return;
             } catch (SaTokenException e) {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
index b2e18b7e..64e79b01 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
@@ -22,7 +22,7 @@ import cn.dev33.satoken.exception.NotPermissionException;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.util.SaFoxUtil;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckPermission 的处理器
@@ -38,7 +38,7 @@ public class SaCheckPermissionHandler implements SaAnnotationAbstractHandler<SaC
     }
 
     @Override
-    public void checkMethod(SaCheckPermission at, AnnotatedElement element) {
+    public void checkMethod(SaCheckPermission at, Method method) {
         _checkMethod(at.type(), at.value(), at.mode(), at.orRole());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
index 24787e30..e5c88b14 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
@@ -20,7 +20,7 @@ import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
 import cn.dev33.satoken.stp.StpLogic;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckRole 的处理器
@@ -36,7 +36,7 @@ public class SaCheckRoleHandler implements SaAnnotationAbstractHandler<SaCheckRo
     }
 
     @Override
-    public void checkMethod(SaCheckRole at, AnnotatedElement element) {
+    public void checkMethod(SaCheckRole at, Method method) {
         _checkMethod(at.type(), at.value(), at.mode());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
index 8f6ca9b0..b07358b1 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
@@ -19,7 +19,7 @@ import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.annotation.SaCheckSafe;
 import cn.dev33.satoken.stp.StpLogic;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaCheckSafe 的处理器
@@ -35,7 +35,7 @@ public class SaCheckSafeHandler implements SaAnnotationAbstractHandler<SaCheckSa
     }
 
     @Override
-    public void checkMethod(SaCheckSafe at, AnnotatedElement element) {
+    public void checkMethod(SaCheckSafe at, Method method) {
         _checkMethod(at.type(), at.value());
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
index cbc86067..93319cd4 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
@@ -18,7 +18,7 @@ package cn.dev33.satoken.annotation.handler;
 import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.router.SaRouter;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaIgnore 的处理器
@@ -34,7 +34,7 @@ public class SaIgnoreHandler implements SaAnnotationAbstractHandler<SaIgnore> {
     }
 
     @Override
-    public void checkMethod(SaIgnore at, AnnotatedElement element) {
+    public void checkMethod(SaIgnore at, Method method) {
         _checkMethod();
     }
 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
index 12f24050..ad5cee77 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
@@ -102,7 +102,7 @@ public final class SaAnnotationStrategy {
 			// 先校验 Method 所属 Class 上的注解
 			Annotation classTakeAnnotation = instance.getAnnotation.apply(method.getDeclaringClass(), (Class<Annotation>)entry.getKey());
 			if(classTakeAnnotation != null) {
-				entry.getValue().check(classTakeAnnotation, method.getDeclaringClass());
+				entry.getValue().check(classTakeAnnotation, method);
 			}
 
 			// 再校验 Method 上的注解
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
index a4ea6f76..da5aa8eb 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/test/TestController.java
@@ -1,7 +1,6 @@
 package com.pj.cases.test;
 
 import cn.dev33.satoken.util.SaResult;
-import com.pj.satoken.custom_annotation.CheckAccount;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -16,7 +15,6 @@ public class TestController {
 
 	// 测试   浏览器访问： http://localhost:8081/test/test
 	@RequestMapping("test")
-	@CheckAccount(name = "sa", pwd = "123456")
 	public SaResult test() {
 		System.out.println("------------进来了");
 		return SaResult.ok(); 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 643a14b7..33b25a27 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -6,7 +6,6 @@ import cn.dev33.satoken.interceptor.SaInterceptor;
 import cn.dev33.satoken.router.SaRouter;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.strategy.SaAnnotationStrategy;
-import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -118,9 +117,9 @@ public class SaTokenConfigure implements WebMvcConfigurer {
     @PostConstruct
     public void rewriteSaStrategy() {
     	// 重写Sa-Token的注解处理器，增加注解合并功能 
-//    	SaAnnotationStrategy.instance.getAnnotation = (element, annotationClass) -> {
-//    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass);
-//    	};
+    	SaAnnotationStrategy.instance.getAnnotation = (element, annotationClass) -> {
+    		return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass);
+    	};
     }
     
 }
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
index 5d5e4a60..96cb659e 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
@@ -6,7 +6,7 @@ import cn.dev33.satoken.exception.SaTokenException;
 import com.pj.satoken.custom_annotation.CheckAccount;
 import org.springframework.stereotype.Component;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 CheckAccount 的处理器
@@ -25,7 +25,7 @@ public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAcc
 
     // 每次请求校验注解时，会执行的方法
     @Override
-    public void checkMethod(CheckAccount at, AnnotatedElement element) {
+    public void checkMethod(CheckAccount at, Method method) {
         // 获取前端请求提交的参数
         String name = SaHolder.getRequest().getParamNotNull("name");
         String pwd = SaHolder.getRequest().getParamNotNull("pwd");
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
index 31f0b139..46401f9e 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
@@ -6,7 +6,7 @@ import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckLogin;
 import org.springframework.stereotype.Component;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaUserCheckLogin 的处理器
@@ -22,7 +22,7 @@ public class SaUserCheckLoginHandler implements SaAnnotationAbstractHandler<SaUs
     }
 
     @Override
-    public void checkMethod(SaUserCheckLogin at, AnnotatedElement element) {
+    public void checkMethod(SaUserCheckLogin at, Method method) {
         SaCheckLoginHandler._checkMethod(StpUserUtil.TYPE);
     }
 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
index 6b1f1d8f..9759d884 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
@@ -6,7 +6,7 @@ import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckPermission;
 import org.springframework.stereotype.Component;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaUserCheckPermission 的处理器
@@ -22,7 +22,7 @@ public class SaUserCheckPermissionHandler implements SaAnnotationAbstractHandler
     }
 
     @Override
-    public void checkMethod(SaUserCheckPermission at, AnnotatedElement element) {
+    public void checkMethod(SaUserCheckPermission at, Method method) {
         SaCheckPermissionHandler._checkMethod(StpUserUtil.TYPE, at.value(), at.mode(), at.orRole());
     }
 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
index 51cbbe76..633a756b 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
@@ -6,7 +6,7 @@ import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckRole;
 import org.springframework.stereotype.Component;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaUserCheckRole 的处理器
@@ -22,7 +22,7 @@ public class SaUserCheckRoleHandler implements SaAnnotationAbstractHandler<SaUse
     }
 
     @Override
-    public void checkMethod(SaUserCheckRole at, AnnotatedElement element) {
+    public void checkMethod(SaUserCheckRole at, Method method) {
         SaCheckRoleHandler._checkMethod(StpUserUtil.TYPE, at.value(), at.mode());
     }
 
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
index 9f78ccfc..8c046506 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
@@ -6,7 +6,7 @@ import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckSafe;
 import org.springframework.stereotype.Component;
 
-import java.lang.reflect.AnnotatedElement;
+import java.lang.reflect.Method;
 
 /**
  * 注解 SaUserCheckPermission 的处理器
@@ -22,7 +22,7 @@ public class SaUserCheckSafeHandler implements SaAnnotationAbstractHandler<SaUse
     }
 
     @Override
-    public void checkMethod(SaUserCheckSafe at, AnnotatedElement element) {
+    public void checkMethod(SaUserCheckSafe at, Method method) {
         SaCheckSafeHandler._checkMethod(StpUserUtil.TYPE, at.value());
     }
 
-- 
Gitee


From aa2e9a5c50d5ac935a54ac40744e187f690881f8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 4 Aug 2024 01:11:40 +0800
Subject: [PATCH 107/172] =?UTF-8?q?=E4=BD=BF=20sa-token-spring-aop=20?=
 =?UTF-8?q?=E6=8F=92=E4=BB=B6=E6=94=AF=E6=8C=81=E8=87=AA=E5=AE=9A=E4=B9=89?=
 =?UTF-8?q?=E6=B3=A8=E8=A7=A3=E9=89=B4=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-demo/sa-token-demo-case/pom.xml      |  2 +-
 .../com/pj/cases/up/SecureController.java     | 38 +++----
 .../java/com/pj/satoken/SaTokenConfigure.java | 20 ++--
 .../aop/SaAopPointcutAdvisorBeanRegister.java | 98 ++++++++++++++++++
 .../SaAroundAnnotationMethodInterceptor.java  | 45 +++++++++
 .../SaAroundAnnotationPointcutAdvisor.java    | 28 ++++++
 .../cn/dev33/satoken/aop/SaCheckAspect.java   | 99 -------------------
 .../main/resources/META-INF/spring.factories  |  3 +-
 ...ot.autoconfigure.AutoConfiguration.imports |  2 +-
 9 files changed, 204 insertions(+), 131 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
 create mode 100644 sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationMethodInterceptor.java
 create mode 100644 sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationPointcutAdvisor.java
 delete mode 100644 sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java

diff --git a/sa-token-demo/sa-token-demo-case/pom.xml b/sa-token-demo/sa-token-demo-case/pom.xml
index c8972fea..dbb0fd82 100644
--- a/sa-token-demo/sa-token-demo-case/pom.xml
+++ b/sa-token-demo/sa-token-demo-case/pom.xml
@@ -51,7 +51,7 @@
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-pool2</artifactId>
         </dependency>
-        
+
 		<!-- @ConfigurationProperties -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SecureController.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SecureController.java
index 96762b7c..a4ec5761 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SecureController.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/cases/up/SecureController.java
@@ -51,25 +51,25 @@ public class SecureController {
 	}
 
 	// RSA加密   ---- http://localhost:8081/secure/rsa
-	@RequestMapping("rsa")
-	public SaResult rsa() {
-		// 定义私钥和公钥 
-		String privateKey = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAO+wmt01pwm9lHMdq7A8gkEigk0XKMfjv+4IjAFhWCSiTeP7dtlnceFJbkWxvbc7Qo3fCOpwmfcskwUc3VSgyiJkNJDs9ivPbvlt8IU2bZ+PBDxYxSCJFrgouVOpAr8ar/b6gNuYTi1vt3FkGtSjACFb002/68RKUTye8/tdcVilAgMBAAECgYA1COmrSqTUJeuD8Su9ChZ0HROhxR8T45PjMmbwIz7ilDsR1+E7R4VOKPZKW4Kz2VvnklMhtJqMs4MwXWunvxAaUFzQTTg2Fu/WU8Y9ha14OaWZABfChMZlpkmpJW9arKmI22ZuxCEsFGxghTiJQ3tK8npj5IZq5vk+6mFHQ6aJAQJBAPghz91Dpuj+0bOUfOUmzi22obWCBncAD/0CqCLnJlpfOoa9bOcXSusGuSPuKy5KiGyblHMgKI6bq7gcM2DWrGUCQQD3SkOcmia2s/6i7DUEzMKaB0bkkX4Ela/xrfV+A3GzTPv9bIBamu0VIHznuiZbeNeyw7sVo4/GTItq/zn2QJdBAkEA8xHsVoyXTVeShaDIWJKTFyT5dJ1TR++/udKIcuiNIap34tZdgGPI+EM1yoTduBM7YWlnGwA9urW0mj7F9e9WIQJAFjxqSfmeg40512KP/ed/lCQVXtYqU7U2BfBTg8pBfhLtEcOg4wTNTroGITwe2NjL5HovJ2n2sqkNXEio6Ji0QQJAFLW1Kt80qypMqot+mHhS+0KfdOpaKeMWMSR4Ij5VfE63WzETEeWAMQESxzhavN1WOTb3/p6icgcVbgPQBaWhGg==";
-		String publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDvsJrdNacJvZRzHauwPIJBIoJNFyjH47/uCIwBYVgkok3j+3bZZ3HhSW5Fsb23O0KN3wjqcJn3LJMFHN1UoMoiZDSQ7PYrz275bfCFNm2fjwQ8WMUgiRa4KLlTqQK/Gq/2+oDbmE4tb7dxZBrUowAhW9NNv+vESlE8nvP7XXFYpQIDAQAB";
-
-		// 文本
-		String text = "Sa-Token 一个轻量级java权限认证框架";
-
-		// 使用公钥加密
-		String ciphertext = SaSecureUtil.rsaEncryptByPublic(publicKey, text);
-		System.out.println("公钥加密后：" + ciphertext);
-
-		// 使用私钥解密
-		String text2 = SaSecureUtil.rsaDecryptByPrivate(privateKey, ciphertext);
-		System.out.println("私钥解密后：" + text2); 
-
-		return SaResult.ok();
-	}
+//	@RequestMapping("rsa")
+//	public SaResult rsa() {
+//		// 定义私钥和公钥
+//		String privateKey = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAO+wmt01pwm9lHMdq7A8gkEigk0XKMfjv+4IjAFhWCSiTeP7dtlnceFJbkWxvbc7Qo3fCOpwmfcskwUc3VSgyiJkNJDs9ivPbvlt8IU2bZ+PBDxYxSCJFrgouVOpAr8ar/b6gNuYTi1vt3FkGtSjACFb002/68RKUTye8/tdcVilAgMBAAECgYA1COmrSqTUJeuD8Su9ChZ0HROhxR8T45PjMmbwIz7ilDsR1+E7R4VOKPZKW4Kz2VvnklMhtJqMs4MwXWunvxAaUFzQTTg2Fu/WU8Y9ha14OaWZABfChMZlpkmpJW9arKmI22ZuxCEsFGxghTiJQ3tK8npj5IZq5vk+6mFHQ6aJAQJBAPghz91Dpuj+0bOUfOUmzi22obWCBncAD/0CqCLnJlpfOoa9bOcXSusGuSPuKy5KiGyblHMgKI6bq7gcM2DWrGUCQQD3SkOcmia2s/6i7DUEzMKaB0bkkX4Ela/xrfV+A3GzTPv9bIBamu0VIHznuiZbeNeyw7sVo4/GTItq/zn2QJdBAkEA8xHsVoyXTVeShaDIWJKTFyT5dJ1TR++/udKIcuiNIap34tZdgGPI+EM1yoTduBM7YWlnGwA9urW0mj7F9e9WIQJAFjxqSfmeg40512KP/ed/lCQVXtYqU7U2BfBTg8pBfhLtEcOg4wTNTroGITwe2NjL5HovJ2n2sqkNXEio6Ji0QQJAFLW1Kt80qypMqot+mHhS+0KfdOpaKeMWMSR4Ij5VfE63WzETEeWAMQESxzhavN1WOTb3/p6icgcVbgPQBaWhGg==";
+//		String publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDvsJrdNacJvZRzHauwPIJBIoJNFyjH47/uCIwBYVgkok3j+3bZZ3HhSW5Fsb23O0KN3wjqcJn3LJMFHN1UoMoiZDSQ7PYrz275bfCFNm2fjwQ8WMUgiRa4KLlTqQK/Gq/2+oDbmE4tb7dxZBrUowAhW9NNv+vESlE8nvP7XXFYpQIDAQAB";
+//
+//		// 文本
+//		String text = "Sa-Token 一个轻量级java权限认证框架";
+//
+//		// 使用公钥加密
+//		String ciphertext = SaSecureUtil.rsaEncryptByPublic(publicKey, text);
+//		System.out.println("公钥加密后：" + ciphertext);
+//
+//		// 使用私钥解密
+//		String text2 = SaSecureUtil.rsaDecryptByPrivate(privateKey, ciphertext);
+//		System.out.println("私钥解密后：" + text2);
+//
+//		return SaResult.ok();
+//	}
 
 	// Base64 编码   ---- http://localhost:8081/secure/base64
 	@RequestMapping("base64")
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
index 33b25a27..76be8691 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -32,14 +32,14 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 		// 注册 Sa-Token 拦截器打开注解鉴权功能 
 		registry.addInterceptor(new SaInterceptor(handle -> {
 			// SaManager.getLog().debug("----- 请求path={}  提交token={}", SaHolder.getRequest().getRequestPath(), StpUtil.getTokenValue());
-			
+
 			// 指定一条 match 规则
             SaRouter
-                .match("/user/**")    // 拦截的 path 列表，可以写多个 
-                .notMatch("/user/doLogin", "/user/doLogin2")     // 排除掉的 path 列表，可以写多个 
-                .check(r -> StpUtil.checkLogin());        // 要执行的校验动作，可以写完整的 lambda 表达式 
+                .match("/user/**")    // 拦截的 path 列表，可以写多个
+                .notMatch("/user/doLogin", "/user/doLogin2")     // 排除掉的 path 列表，可以写多个
+                .check(r -> StpUtil.checkLogin());        // 要执行的校验动作，可以写完整的 lambda 表达式
 
-            // 权限校验 -- 不同模块认证不同权限 
+            // 权限校验 -- 不同模块认证不同权限
             SaRouter.match("/admin/**", r -> StpUtil.checkPermission("admin"));
             SaRouter.match("/goods/**", r -> StpUtil.checkPermission("goods"));
             SaRouter.match("/orders/**", r -> StpUtil.checkPermission("orders"));
@@ -49,16 +49,16 @@ public class SaTokenConfigure implements WebMvcConfigurer {
 			// 甚至你可以随意的写一个打印语句
 			SaRouter.match("/router/print", r -> System.out.println("----啦啦啦----"));
 
-			// 写一个完整的 lambda 
+			// 写一个完整的 lambda
 			SaRouter.match("/router/print2", r -> {
 				System.out.println("----啦啦啦2----");
-				// ... 其它代码 
+				// ... 其它代码
 			});
-			
+
 			/*
-			 * 相关路由都定义在 com.pj.cases.use.RouterCheckController 中 
+			 * 相关路由都定义在 com.pj.cases.use.RouterCheckController 中
 			 */
-			
+
 		})).addPathPatterns("/**");
 		
 	}
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
new file mode 100644
index 00000000..d379ebdd
--- /dev/null
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
@@ -0,0 +1,98 @@
+package cn.dev33.satoken.aop;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
+import org.springframework.aop.aspectj.AspectJExpressionPointcut;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Sa-Token AOP 环绕切入 Bean 注册
+ * <p>
+ *    参考资料：<br>
+ *    https://www.jb51.net/program/297714rev.htm    <br>
+ *    https://www.bilibili.com/video/BV1WZ421W7Qx   <br>
+ *    https://blog.csdn.net/Tomwildboar/article/details/139199801   <br>
+ * </p>
+ *
+ * @author click33
+ * @since 2024/8/3
+ */
+@Configuration
+public class SaAopPointcutAdvisorBeanRegister {
+
+    /**
+     * Advisor 静态全局引用
+     */
+    public static SaAroundAnnotationPointcutAdvisor saAroundAnnoAdvisor;
+
+    @Bean
+    public SaAroundAnnotationPointcutAdvisor saAroundAnnotationHandlePointcutAdvisor (List<SaAnnotationAbstractHandler<?>> handlerList) {
+        SaAroundAnnotationPointcutAdvisor advisor = new SaAroundAnnotationPointcutAdvisor();
+
+        // 定义切入规则
+        AspectJExpressionPointcut pointcut = new AspectJExpressionPointcut();
+        String expression = calcExpression(handlerList);
+        pointcut.setExpression(expression);
+        advisor.setPointcut(pointcut);
+
+        // 定义执行的方法 
+        advisor.setAdvice(new SaAroundAnnotationMethodInterceptor());
+
+        // 保存全局引用
+        SaAopPointcutAdvisorBeanRegister.saAroundAnnoAdvisor = advisor;
+        return advisor;
+    }
+
+    /**
+     * 计算切入表达式
+     * @param appendHandlerList 追加的 SaAnnotationAbstractHandler 处理器
+     * @return /
+     */
+    public static String calcExpression(List<SaAnnotationAbstractHandler<?>> appendHandlerList) {
+
+        // 框架内置的
+        List<Class<?>> list = new ArrayList<>(SaAnnotationStrategy.instance.annotationHandlerMap.keySet());
+
+        // 额外追加的
+        if(appendHandlerList != null) {
+            for (SaAnnotationAbstractHandler<?> handler : appendHandlerList) {
+                Class<?> cls = handler.getHandlerAnnotationClass();
+                if(!list.contains(cls)) {
+                    list.add(handler.getHandlerAnnotationClass());
+                }
+            }
+        }
+
+        // 计算
+        return calcClassListExpression(list);
+    }
+
+    /**
+     * 计算 class 列表的切入表达式，
+     * 最终样例形如：
+     <pre>
+         public static final String POINTCUT_SIGN =
+         "@within(cn.dev33.satoken.annotation.SaCheckLogin) || @annotation(cn.dev33.satoken.annotation.SaCheckLogin) || "
+         + "@within(cn.dev33.satoken.annotation.SaCheckRole) || @annotation(cn.dev33.satoken.annotation.SaCheckRole) || "
+         + "@within(cn.dev33.satoken.annotation.SaCheckPermission) || @annotation(cn.dev33.satoken.annotation.SaCheckPermission)";
+     </pre>
+     * @param list /
+     * @return /
+     */
+    public static String calcClassListExpression(List<Class<?>> list) {
+        String pointcutExpression = "";
+        for (Class<?> cls : list) {
+            if(!pointcutExpression.isEmpty()) {
+                pointcutExpression += " || ";
+            }
+            pointcutExpression += "@within(" + cls.getName() + ") || @annotation(" + cls.getName() + ")";
+        }
+        return pointcutExpression;
+    }
+
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationMethodInterceptor.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationMethodInterceptor.java
new file mode 100644
index 00000000..44d84449
--- /dev/null
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationMethodInterceptor.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.aop;
+
+import cn.dev33.satoken.exception.StopMatchException;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
+import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
+
+import java.lang.reflect.Method;
+
+/**
+ * Sa-Token 注解方法拦截器 AOP环绕切入
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaAroundAnnotationMethodInterceptor implements MethodInterceptor {
+
+    @Override
+    public Object invoke(MethodInvocation invocation) throws Throwable {
+        // 注解鉴权
+        try{
+            Method method = invocation.getMethod();
+            SaAnnotationStrategy.instance.checkMethodAnnotation.accept(method);
+        } catch (StopMatchException ignored) {
+        }
+        // 执行原有防范
+        return invocation.proceed();
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationPointcutAdvisor.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationPointcutAdvisor.java
new file mode 100644
index 00000000..0f108fec
--- /dev/null
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAroundAnnotationPointcutAdvisor.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.aop;
+
+import org.springframework.aop.support.DefaultPointcutAdvisor;
+
+/**
+ * Sa-Token 注解方法 Advisor AOP环绕切入
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaAroundAnnotationPointcutAdvisor extends DefaultPointcutAdvisor {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java
deleted file mode 100644
index 8d4a0e7e..00000000
--- a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaCheckAspect.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.aop;
-
-import java.lang.reflect.Method;
-
-import org.aspectj.lang.ProceedingJoinPoint;
-import org.aspectj.lang.annotation.Around;
-import org.aspectj.lang.annotation.Aspect;
-import org.aspectj.lang.annotation.Pointcut;
-import org.aspectj.lang.reflect.MethodSignature;
-import org.springframework.core.annotation.Order;
-import org.springframework.stereotype.Component;
-
-import cn.dev33.satoken.annotation.SaIgnore;
-import cn.dev33.satoken.strategy.SaStrategy;
-import cn.dev33.satoken.util.SaTokenConsts;
-
-/**
- * Sa-Token 基于 Spring Aop 的注解鉴权
- *
- * <p>
- *     注意：在打开 注解鉴权 时，AOP 模式与拦截器模式不可同时使用，否则会出现在 Controller 层重复鉴权两次的问题
- * </p>
- * 
- * @author click33
- * @since 1.19.0
- */
-@Aspect
-@Component
-@Order(SaTokenConsts.ASSEMBLY_ORDER)
-public class SaCheckAspect {
-	
-	/**
-	 * 构建
-	 */
-	public SaCheckAspect() {
-	}
-
-	/**
-	 * 定义AOP签名 (切入所有使用 Sa-Token 鉴权注解的方法)
-	 */
-	public static final String POINTCUT_SIGN = 
-			"@within(cn.dev33.satoken.annotation.SaCheckLogin) || @annotation(cn.dev33.satoken.annotation.SaCheckLogin) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckRole) || @annotation(cn.dev33.satoken.annotation.SaCheckRole) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckPermission) || @annotation(cn.dev33.satoken.annotation.SaCheckPermission) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckSafe) || @annotation(cn.dev33.satoken.annotation.SaCheckSafe) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckDisable) || @annotation(cn.dev33.satoken.annotation.SaCheckDisable) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckHttpDigest) || @annotation(cn.dev33.satoken.annotation.SaCheckHttpDigest) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckOr) || @annotation(cn.dev33.satoken.annotation.SaCheckOr) || "
-			+ "@within(cn.dev33.satoken.annotation.SaCheckHttpBasic) || @annotation(cn.dev33.satoken.annotation.SaCheckHttpBasic)";
-
-	/**
-	 * 声明AOP签名
-	 */
-	@Pointcut(POINTCUT_SIGN)
-	public void pointcut() {
-	}
-
-	/**
-	 * 环绕切入
-	 * 
-	 * @param joinPoint 切面对象
-	 * @return 底层方法执行后的返回值
-	 * @throws Throwable 底层方法抛出的异常
-	 */
-	@Around("pointcut()")
-	public Object around(ProceedingJoinPoint joinPoint) throws Throwable {
-		
-		// 获取对应的 Method 处理函数 
-		MethodSignature signature = (MethodSignature) joinPoint.getSignature();
-		Method method = signature.getMethod();
-		
-		// 如果此 Method 或其所属 Class 标注了 @SaIgnore，则忽略掉鉴权 
-		if(SaStrategy.instance.isAnnotationPresent.apply(method, SaIgnore.class)) {
-			// ... 
-		} else {
-			// 注解鉴权 
-			SaStrategy.instance.checkMethodAnnotation.accept(method);
-		}
-
-		// 执行原有逻辑
-		return joinPoint.proceed();
-	}
-
-}
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring.factories b/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring.factories
index 9c26ddee..b4ad11e6 100644
--- a/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring.factories
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring.factories
@@ -1 +1,2 @@
-org.springframework.boot.autoconfigure.EnableAutoConfiguration=cn.dev33.satoken.aop.SaCheckAspect
\ No newline at end of file
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+cn.dev33.satoken.aop.SaAopPointcutAdvisorBeanRegister
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
index 9579b4e2..ac290259 100644
--- a/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
@@ -1 +1 @@
-cn.dev33.satoken.aop.SaCheckAspect
\ No newline at end of file
+cn.dev33.satoken.aop.SaAopPointcutAdvisorBeanRegister
\ No newline at end of file
-- 
Gitee


From 16b1e4f99c321382247a438923c0f5df39e3cec5 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 4 Aug 2024 01:41:17 +0800
Subject: [PATCH 108/172] jfinal and jboot plugin update

---
 .../java/cn/dev33/satoken/jboot/SaAnnotationInterceptor.java  | 4 ++--
 .../java/cn/dev33/satoken/jfinal/SaAnnotationInterceptor.java | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sa-token-starter/sa-token-jboot-plugin/src/main/java/cn/dev33/satoken/jboot/SaAnnotationInterceptor.java b/sa-token-starter/sa-token-jboot-plugin/src/main/java/cn/dev33/satoken/jboot/SaAnnotationInterceptor.java
index 4b5185d0..c0cc73d2 100644
--- a/sa-token-starter/sa-token-jboot-plugin/src/main/java/cn/dev33/satoken/jboot/SaAnnotationInterceptor.java
+++ b/sa-token-starter/sa-token-jboot-plugin/src/main/java/cn/dev33/satoken/jboot/SaAnnotationInterceptor.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.jboot;
 
-import cn.dev33.satoken.strategy.SaStrategy;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import com.jfinal.aop.Interceptor;
 import com.jfinal.aop.Invocation;
 
@@ -25,7 +25,7 @@ import com.jfinal.aop.Invocation;
 public class SaAnnotationInterceptor implements Interceptor {
     @Override
     public void intercept(Invocation invocation) {
-        SaStrategy.instance.checkMethodAnnotation.accept((invocation.getMethod()));
+        SaAnnotationStrategy.instance.checkMethodAnnotation.accept((invocation.getMethod()));
         invocation.invoke();
     }
 }
diff --git a/sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaAnnotationInterceptor.java b/sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaAnnotationInterceptor.java
index 39f79cd5..a371caf8 100644
--- a/sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaAnnotationInterceptor.java
+++ b/sa-token-starter/sa-token-jfinal-plugin/src/main/java/cn/dev33/satoken/jfinal/SaAnnotationInterceptor.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.jfinal;
 
-import cn.dev33.satoken.strategy.SaStrategy;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import com.jfinal.aop.Interceptor;
 import com.jfinal.aop.Invocation;
 
@@ -25,7 +25,7 @@ import com.jfinal.aop.Invocation;
 public class SaAnnotationInterceptor implements Interceptor {
     @Override
     public void intercept(Invocation invocation) {
-        SaStrategy.instance.checkMethodAnnotation.accept((invocation.getMethod()));
+        SaAnnotationStrategy.instance.checkMethodAnnotation.accept((invocation.getMethod()));
         invocation.invoke();
     }
 }
-- 
Gitee


From f926a3f136f89599ecfe402a395bf08aee2929ca Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 4 Aug 2024 01:42:30 +0800
Subject: [PATCH 109/172] =?UTF-8?q?sa-token-solon-plugin=20=E9=80=82?=
 =?UTF-8?q?=E9=85=8D=E8=87=AA=E5=AE=9A=E4=B9=89=E6=B3=A8=E8=A7=A3=E6=89=A9?=
 =?UTF-8?q?=E5=B1=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../strategy/SaAnnotationStrategy.java        |  9 ++++
 .../custom_annotation/CheckAccount.java       | 33 +++++++++++++++
 .../handler/CheckAccountHandler.java          | 42 +++++++++++++++++++
 .../satoken/oauth2/logic/SaOAuth2Handle.java  | 10 ++---
 .../cn/dev33/satoken/solon/XPluginImp.java    | 11 ++++-
 .../solon/integration/SaTokenFilter.java      | 14 +++----
 .../solon/integration/SaTokenInterceptor.java | 16 +++----
 .../satoken/interceptor/SaInterceptor.java    | 24 +++--------
 8 files changed, 114 insertions(+), 45 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
 create mode 100644 sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
index ad5cee77..9c8b88ba 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
@@ -19,6 +19,7 @@ import cn.dev33.satoken.annotation.*;
 import cn.dev33.satoken.annotation.handler.*;
 import cn.dev33.satoken.fun.strategy.SaCheckMethodAnnotationFunction;
 import cn.dev33.satoken.fun.strategy.SaGetAnnotationFunction;
+import cn.dev33.satoken.fun.strategy.SaIsAnnotationPresentFunction;
 import cn.dev33.satoken.listener.SaTokenEventCenter;
 
 import java.lang.annotation.Annotation;
@@ -121,4 +122,12 @@ public final class SaAnnotationStrategy {
 		return element.getAnnotation(annotationClass);
 	};
 
+	/**
+	 * 判断一个 Method 或其所属 Class 是否包含指定注解
+	 */
+	public SaIsAnnotationPresentFunction isAnnotationPresent = (method, annotationClass) -> {
+		return instance.getAnnotation.apply(method, annotationClass) != null ||
+				instance.getAnnotation.apply(method.getDeclaringClass(), annotationClass) != null;
+	};
+
 }
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
new file mode 100644
index 00000000..2c01a5ae
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/CheckAccount.java
@@ -0,0 +1,33 @@
+package com.pj.satoken.custom_annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 账号校验：在标注一个方法上时，要求前端必须提交相应的账号密码参数才能访问方法。
+ *
+ * @author click33
+ *
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.METHOD, ElementType.TYPE})
+public @interface CheckAccount {
+
+    /**
+     * 需要校验的账号
+     *
+     * @return /
+     */
+    String name();
+
+    /**
+     * 需要校验的密码
+     *
+     * @return /
+     */
+    String pwd();
+
+
+}
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
new file mode 100644
index 00000000..f7f9c6e6
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
@@ -0,0 +1,42 @@
+package com.pj.satoken.custom_annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.exception.SaTokenException;
+import com.pj.satoken.custom_annotation.CheckAccount;
+import org.noear.solon.annotation.Component;
+
+import java.lang.reflect.Method;
+
+/**
+ * 注解 CheckAccount 的处理器
+ *
+ * @author click33
+ *
+ */
+@Component
+public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAccount> {
+
+    // 指定这个处理器要处理哪个注解
+    @Override
+    public Class<CheckAccount> getHandlerAnnotationClass() {
+        return CheckAccount.class;
+    }
+
+    // 每次请求校验注解时，会执行的方法
+    @Override
+    public void checkMethod(CheckAccount at, Method method) {
+        // 获取前端请求提交的参数
+        String name = SaHolder.getRequest().getParamNotNull("name");
+        String pwd = SaHolder.getRequest().getParamNotNull("pwd");
+
+        // 与注解中指定的值相比较
+        if(name.equals(at.name()) && pwd.equals(at.pwd()) ) {
+            // 校验通过，什么也不做
+        } else {
+            // 校验不通过，则抛出异常
+            throw new SaTokenException("账号或密码错误，未通过校验");
+        }
+    }
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
index 99403d0d..559a38b9 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
@@ -15,10 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.logic;
 
-import cn.dev33.satoken.basic.SaBasicUtil;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
@@ -27,11 +27,7 @@ import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.Api;
 import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.ResponseType;
-import cn.dev33.satoken.oauth2.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.model.CodeModel;
-import cn.dev33.satoken.oauth2.model.RequestAuthModel;
-import cn.dev33.satoken.oauth2.model.SaClientModel;
+import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -179,7 +175,7 @@ public class SaOAuth2Handle {
 	 */
 	public static Object token(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
 		// 获取参数
-		String authorizationValue = SaBasicUtil.getAuthorizationValue();
+		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
 		String clientId;
 		String clientSecret;
 		// gitlab回调token接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
index 4cd41f73..bbff6026 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
@@ -16,11 +16,12 @@
 package cn.dev33.satoken.solon;
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicTemplate;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
+import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.context.second.SaTokenSecondContextCreator;
 import cn.dev33.satoken.dao.SaTokenDao;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicTemplate;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.httpauth.digest.SaHttpDigestTemplate;
 import cn.dev33.satoken.httpauth.digest.SaHttpDigestUtil;
 import cn.dev33.satoken.json.SaJsonTemplate;
@@ -36,6 +37,7 @@ import cn.dev33.satoken.solon.sso.SaSsoAutoConfigure;
 import cn.dev33.satoken.stp.StpInterface;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import cn.dev33.satoken.temp.SaTempInterface;
 import org.noear.solon.Solon;
 import org.noear.solon.core.AppContext;
@@ -95,6 +97,11 @@ public class XPluginImp implements Plugin {
             SaTokenEventCenter.registerListener(sl);
         });
 
+        // 注入自定义注解处理器 Bean （可以有多个）
+        context.subBeansOfType(SaAnnotationAbstractHandler.class, sl -> {
+            SaAnnotationStrategy.instance.registerAnnotationHandler(sl);
+        });
+
         // 注入权限认证 Bean
         context.getBeanAsync(StpInterface.class, bean -> {
             SaManager.setStpInterface(bean);
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenFilter.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenFilter.java
index 9efb5189..b833788d 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenFilter.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenFilter.java
@@ -23,6 +23,7 @@ import cn.dev33.satoken.filter.SaFilterAuthStrategy;
 import cn.dev33.satoken.filter.SaFilterErrorStrategy;
 import cn.dev33.satoken.filter.SaFilter;
 import cn.dev33.satoken.router.SaRouter;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import cn.dev33.satoken.strategy.SaStrategy;
 import org.noear.solon.Solon;
 import org.noear.solon.core.handle.*;
@@ -202,16 +203,13 @@ public class SaTokenFilter implements SaFilter, Filter { //之所以改名，为
 	private boolean authAnno(Action action) {
 		//2.验证注解处理
 		if (isAnnotation && action != null) {
-			// 获取此请求对应的 Method 处理函数
-			Method method = action.method().getMethod();
-
-			// 如果此 Method 或其所属 Class 标注了 @SaIgnore，则忽略掉鉴权
-			if (SaStrategy.instance.isAnnotationPresent.apply(method, SaIgnore.class)) {
+			// 注解校验
+			try{
+				Method method = action.method().getMethod();
+				SaAnnotationStrategy.instance.checkMethodAnnotation.accept(method);
+			} catch (StopMatchException ignored) {
 				return false;
 			}
-
-			// 注解校验
-			SaStrategy.instance.checkMethodAnnotation.accept(method);
 		}
 
 		return true;
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenInterceptor.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenInterceptor.java
index 5c74b370..62460cd7 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenInterceptor.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/integration/SaTokenInterceptor.java
@@ -15,7 +15,6 @@
  */
 package cn.dev33.satoken.solon.integration;
 
-import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.exception.BackResultException;
 import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.exception.StopMatchException;
@@ -23,7 +22,7 @@ import cn.dev33.satoken.filter.SaFilter;
 import cn.dev33.satoken.filter.SaFilterAuthStrategy;
 import cn.dev33.satoken.filter.SaFilterErrorStrategy;
 import cn.dev33.satoken.router.SaRouter;
-import cn.dev33.satoken.strategy.SaStrategy;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import org.noear.solon.core.handle.*;
 import org.noear.solon.core.route.RouterInterceptor;
 import org.noear.solon.core.route.RouterInterceptorChain;
@@ -237,16 +236,13 @@ public class SaTokenInterceptor implements SaFilter, RouterInterceptor {
 	private boolean authAnno(Action action) {
 		//2.验证注解处理
 		if (isAnnotation && action != null) {
-			// 获取此请求对应的 Method 处理函数
-			Method method = action.method().getMethod();
-
-			// 如果此 Method 或其所属 Class 标注了 @SaIgnore，则忽略掉鉴权
-			if (SaStrategy.instance.isAnnotationPresent.apply(method, SaIgnore.class)) {
+			// 注解校验
+			try{
+				Method method = action.method().getMethod();
+				SaAnnotationStrategy.instance.checkMethodAnnotation.accept(method);
+			} catch (StopMatchException ignored) {
 				return false;
 			}
-
-			// 注解校验
-			SaStrategy.instance.checkMethodAnnotation.accept(method);
 		}
 
 		return true;
diff --git a/sa-token-starter/sa-token-spring-boot3-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java b/sa-token-starter/sa-token-spring-boot3-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
index e6c0fc13..f42e892a 100644
--- a/sa-token-starter/sa-token-spring-boot3-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
+++ b/sa-token-starter/sa-token-spring-boot3-starter/src/main/java/cn/dev33/satoken/interceptor/SaInterceptor.java
@@ -15,18 +15,16 @@
  */
 package cn.dev33.satoken.interceptor;
 
-import java.lang.reflect.Method;
-
-import org.springframework.web.method.HandlerMethod;
-import org.springframework.web.servlet.HandlerInterceptor;
-
-import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.exception.BackResultException;
 import cn.dev33.satoken.exception.StopMatchException;
 import cn.dev33.satoken.fun.SaParamFunction;
-import cn.dev33.satoken.strategy.SaStrategy;
+import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import java.lang.reflect.Method;
 
 /**
  * Sa-Token 综合拦截器，提供注解鉴权和路由拦截鉴权能力 
@@ -96,18 +94,8 @@ public class SaInterceptor implements HandlerInterceptor {
 
 			// 这里必须确保 handler 是 HandlerMethod 类型时，才能进行注解鉴权
 			if(isAnnotation && handler instanceof HandlerMethod) {
-				
-				// 获取此请求对应的 Method 处理函数 
 				Method method = ((HandlerMethod) handler).getMethod();
-
-				// 如果此 Method 或其所属 Class 标注了 @SaIgnore，则忽略掉鉴权 
-				if(SaStrategy.instance.isAnnotationPresent.apply(method, SaIgnore.class)) {
-					// 注意这里直接就退出整个鉴权了，最底部的 auth.run() 路由拦截鉴权也被跳出了
-					return true;
-				}
-
-				// 注解校验 
-				SaStrategy.instance.checkMethodAnnotation.accept(method);
+				SaAnnotationStrategy.instance.checkMethodAnnotation.accept(method);
 			}
 			
 			// Auth 校验  
-- 
Gitee


From aefcdf12d45dd69f5518426c1bd95bb74629b2e4 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 5 Aug 2024 15:50:53 +0800
Subject: [PATCH 110/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3=20?=
 =?UTF-8?q?[=E5=B0=86=E6=9D=83=E9=99=90=E6=95=B0=E6=8D=AE=E6=94=BE?=
 =?UTF-8?q?=E5=9C=A8=E7=BC=93=E5=AD=98=E9=87=8C]=20=E7=A4=BA=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/fun/jur-cache.md | 65 ++++++++++++++++++++---------------
 1 file changed, 37 insertions(+), 28 deletions(-)

diff --git a/sa-token-doc/fun/jur-cache.md b/sa-token-doc/fun/jur-cache.md
index b1c1d765..6f12ad23 100644
--- a/sa-token-doc/fun/jur-cache.md
+++ b/sa-token-doc/fun/jur-cache.md
@@ -11,34 +11,43 @@
 @Component  
 public class StpInterfaceImpl implements StpInterface {
     
-	// 返回一个账号所拥有的权限码集合 
-    @Override
-    public List<String> getPermissionList(Object loginId, String loginType) {
-    	
-    	// 1. 声明权限码集合
-    	List<String> permissionList = new ArrayList<>();
-    	
-    	// 2. 遍历角色列表，查询拥有的权限码 
-    	for (String roleId : getRoleList(loginId, loginType)) {
-    		SaSession roleSession = SaSessionCustomUtil.getSessionById("role-" + roleId);
-    		List<String> list = roleSession.get("Permission_List", () -> {
-    			return ...;	 // 从数据库查询这个角色所拥有的权限列表  
-    		});
-    		permissionList.addAll(list);
-    	}
-    	
-    	// 3. 返回权限码集合
-    	return permissionList;
-    }
-	
-    // 返回一个账号所拥有的角色标识集合 
-    @Override
-    public List<String> getRoleList(Object loginId, String loginType) {
-    	SaSession session = StpUtil.getSessionByLoginId(loginId);
-    	return session.get("Role_List", () -> {
-    		return ...; // 从数据库查询这个账号id拥有的角色列表 
-    	});
-    }
+	// 返回一个账号所拥有的权限码集合
+	@Override
+	@SuppressWarnings("unchecked")
+	public List<String> getPermissionList(Object loginId, String loginType) {
+
+		// 1. 声明权限码集合
+		List<String> list = new ArrayList<>();
+
+		// 2. 遍历角色列表，查询拥有的权限码
+		for (String roleId : getRoleList(loginId, loginType)) {
+			List<String> permissionList = (List<String>)SaManager.getSaTokenDao().getObject("satoken:role-find-permission:" + roleId);
+			if(permissionList == null) {
+				// 从数据库查询这个角色 id 所拥有的权限列表
+				permissionList = ...
+				// 查好后，set 到缓存中
+				SaManager.getSaTokenDao().setObject("satoken:role-find-permission:" + roleId, permissionList, 60 * 60 * 24 * 30);
+			}
+			list.addAll(permissionList);
+		}
+
+		// 3. 返回权限码集合
+		return list;
+	}
+
+	// 返回一个账号所拥有的角色标识集合
+	@Override
+	@SuppressWarnings("unchecked")
+	public List<String> getRoleList(Object loginId, String loginType) {
+		List<String> roleList = (List<String>)SaManager.getSaTokenDao().getObject("satoken:loginId-find-role:" + loginId);
+		if(roleList == null) {
+			// 从数据库查询这个账号id拥有的角色列表，
+			roleList = ... 
+			// 查好后，set 到缓存中
+			SaManager.getSaTokenDao().setObject("satoken:loginId-find-role:" + loginId, roleList, 60 * 60 * 24 * 30);
+		}
+		return roleList;
+	}
 	
 }
 ```
-- 
Gitee


From 036e10ef79274cb1e9434d20087fd8dfad6e3e6f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 8 Aug 2024 06:52:24 +0800
Subject: [PATCH 111/172] =?UTF-8?q?=E6=96=87=E6=A1=A3=E6=96=B0=E5=A2=9E=20?=
 =?UTF-8?q?Sa-Token=20=E4=B8=8E=20Shiro=20=E5=8A=9F=E8=83=BD=E4=BB=A3?=
 =?UTF-8?q?=E7=A0=81=E5=AE=9E=E7=8E=B0=E5=AF=B9=E6=AF=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md                      |    1 +
 sa-token-doc/doc.html                         |    2 +-
 .../fun/auth-framework-function-test.md       | 1107 +++++++++++++++++
 3 files changed, 1109 insertions(+), 1 deletion(-)
 create mode 100644 sa-token-doc/fun/auth-framework-function-test.md

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 33e2f4aa..e07e2cc9 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -115,6 +115,7 @@
 	- [解决跨域问题](/fun/cors-filter)
 	- [技术选型：SSO 与 OAuth2 对比](/fun/sso-vs-oauth2)
 	<!-- - [框架源码所有技术栈](/fun/tech-stack) -->
+	- [从 Shiro、SpringSecurity、JWT 迁移](/fun/auth-framework-function-test)
 	- [issue 提问模板](/fun/issue-template)
 	- [为Sa-Token贡献代码](/fun/git-pr)
 	- [Sa-Token开源大事记](/fun/timeline)
diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index f1766711..e64e6fa6 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -247,7 +247,7 @@
 				// tab选项卡
 				tabs: {
 					persist    : true,      // 是否在刷新页面时重置选项卡
-					sync       : true,      // 页面上的多个tab是否同步切换
+					sync       : false,      // 页面上的多个tab是否同步切换
 					theme      : 'classic', // 主题：'classic', 'material', false
 					tabComments: true,      // 用注释来标注选项卡标题，例如：<!-- tab:SpringBoot  -->
 					tabHeadings: true       // 用标题+粗体来定制选项卡
diff --git a/sa-token-doc/fun/auth-framework-function-test.md b/sa-token-doc/fun/auth-framework-function-test.md
new file mode 100644
index 00000000..3aa9a700
--- /dev/null
+++ b/sa-token-doc/fun/auth-framework-function-test.md
@@ -0,0 +1,1107 @@
+# Java 权限认证框架功能 测试 / 对比 / 迁移。
+
+对比以下框架的常见功能，为项目技术栈迁移提供代码示例
+
+- Sa-Token
+- Apache Shiro
+- Spring Security
+- JWT
+
+
+> [!TIP| label:注意事项] 
+> - 因个人精力&能力有限，本篇只展示部分常见功能的对比，也欢迎大家一起贡献案例，提交pr。
+> - 代码案例仓库：[https://gitee.com/sa-tokens/auth-framework-function-test](https://gitee.com/sa-tokens/auth-framework-function-test)
+> - 注：本篇主要展示一些常见功能不同框架的实现差异，而非每个框架的所含功能点对比。
+ 
+
+--- 
+
+
+
+### 登录 & 注销 & 查询会话状态
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+测试 Controller 
+``` java 
+@RestController
+@RequestMapping("/acc/")
+public class LoginController {
+	
+	@Autowired
+	SysUserDao sysUserDao;
+		
+	// 测试登录  ---- http://localhost:8081/acc/doLogin?username=zhang&password=123456
+	@RequestMapping("doLogin")
+	public AjaxJson doLogin(String username, String password) {
+		// 校验
+		SysUser user = sysUserDao.findByUsername(username);
+		if(user == null) {
+			return AjaxJson.getError("用户不存在");
+		}
+		if(!user.getPassword().equals(password)) {
+			return AjaxJson.getError("密码错误");
+		}
+		// 登录
+		StpUtil.login(user.getId());
+		StpUtil.getSession().set("user", user);
+		return AjaxJson.getSuccess("登录成功");
+	}
+	
+	// 查询登录状态  ---- http://localhost:8081/acc/isLogin
+	@RequestMapping("isLogin")
+	public AjaxJson isLogin() {
+		if(StpUtil.isLogin()) {
+			return AjaxJson.getSuccess("已登录，账号id：" + StpUtil.getLoginId());
+		}
+		return AjaxJson.getError("未登录");
+	}
+
+	// 测试注销  ---- http://localhost:8081/acc/logout
+	@RequestMapping("logout")
+	public AjaxJson logout() {
+		StpUtil.logout();
+		return AjaxJson.getSuccess("注销成功");
+	}
+
+}
+```
+
+<!------------- tab:Shiro ------------->
+自定义 Realm 
+``` java
+public class MyRealm extends AuthorizingRealm {
+
+    @Autowired
+    private SysUserDao sysUserDao;
+
+    // 加载用户信息
+    @Override
+    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
+        String username = (String)token.getPrincipal();
+        SysUser sysUser = sysUserDao.findByUsername(username);
+        if(sysUser == null){
+            return null;
+        }
+        return new SimpleAuthenticationInfo(
+                sysUser,
+                sysUser.getPassword(),
+                getName()
+        );
+    }
+	
+    // 加载权限信息
+    @Override
+    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+        return null;
+    }
+
+}
+```
+
+Shiro 配置类
+``` java
+@Configuration
+public class ShiroConfigure {
+
+    @Bean
+    public MyRealm myRealm() {
+        return new MyRealm();
+    }
+
+    @Bean
+    public DefaultWebSecurityManager securityManager() {
+        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
+        manager.setRealm(myRealm());
+        return manager;
+    }
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
+        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
+        bean.setSecurityManager(securityManager());
+        return bean;
+    }
+
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/acc/")
+public class LoginController {
+
+	// 测试登录  ---- http://localhost:8082/acc/doLogin?username=zhang&password=123456
+	@RequestMapping("doLogin")
+	public AjaxJson doLogin(String username, String password) {
+		Subject subject = SecurityUtils.getSubject();
+		try {
+			subject.login(new UsernamePasswordToken(username, password));
+			return AjaxJson.getSuccess("登录成功!");
+		} catch (AuthenticationException e) {
+			e.printStackTrace();
+			return AjaxJson.getError(e.getMessage());
+		}
+	}
+
+	// 查询登录状态  ---- http://localhost:8082/acc/isLogin
+	@RequestMapping("isLogin")
+	public AjaxJson isLogin() {
+		Subject subject = SecurityUtils.getSubject();
+		if(subject.isAuthenticated()) {
+			SysUser sysUser = (SysUser)subject.getPrincipal();
+			return AjaxJson.getSuccess("已登录，账号id：" + sysUser.getId());
+		}
+		return AjaxJson.getError("未登录");
+	}
+
+	// 测试注销  ---- http://localhost:8082/acc/logout
+	@RequestMapping("logout")
+	public AjaxJson logout() {
+		SecurityUtils.getSubject().logout();
+		return AjaxJson.getSuccess("注销成功");
+	}
+
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 账号密码登录（加盐 MD5）
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+测试 Controller 
+``` java 
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password) {
+	// 校验
+	SysUser user = sysUserDao.findByUsername(username);
+	if(user == null) {
+		return AjaxJson.getError("用户不存在");
+	}
+	String salt = "abc";
+	if(!user.getPassword().equals(SaSecureUtil.md5(salt + password))) {
+		return AjaxJson.getError("密码错误");
+	}
+	// 登录
+	StpUtil.login(user.getId());
+	StpUtil.getSession().set("user", user);
+	return AjaxJson.getSuccess("登录成功");
+}
+```
+
+<!------------- tab:Shiro ------------->
+自定义 Realm Bean 设定密码凭证器
+``` java
+@Bean
+public MyRealm myRealm() {
+	MyRealm realm = new MyRealm();
+	// 设定凭证匹配器
+	HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
+	credentialsMatcher.setHashAlgorithmName("md5");
+	realm.setCredentialsMatcher(credentialsMatcher);
+	// 返回
+	return realm;
+}
+```
+
+自定义 Realm 实现类 doGetAuthenticationInfo 方法返回 slat 信息
+``` java
+// 加载用户信息
+@Override
+protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
+	String username = (String)token.getPrincipal();
+	SysUser sysUser = sysUserDao.findByUsername(username);
+	if(sysUser == null){
+		return null;
+	}
+
+	return new SimpleAuthenticationInfo(
+			sysUser,
+			sysUser.getPassword(),
+			ByteSource.Util.bytes("abc"), // 指定 slat 信息 
+			getName()
+	);
+}
+```
+
+登录代码照旧 
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 从上下文获取当前登录 User 信息
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+``` java
+// 从上下文获取当前登录 User 信息 
+@RequestMapping("getCurrUser")
+public AjaxJson getCurrUser() {
+	return AjaxJson.getSuccess()
+			.set("id", StpUtil.getLoginId())
+			.set("user", StpUtil.getSession().get("user"));
+}
+```
+
+<!------------- tab:Shiro ------------->
+
+``` java
+// 从上下文获取当前登录 User 信息 
+@RequestMapping("getCurrUser")
+public AjaxJson getCurrUser() {
+	Subject subject = SecurityUtils.getSubject();
+	SysUser sysUser = (SysUser)subject.getPrincipal();
+	return AjaxJson.getSuccess()
+			.set("id", sysUser.getId())
+			.set("user", sysUser);
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 从 session 上存取值
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+``` java
+// 测试从 session 上存取值 
+@RequestMapping("testSession")
+public AjaxJson test() {
+	SaSession session = StpUtil.getSession();
+
+	System.out.println("从 session 上取值：" + session.get("name"));
+	session.set("name", "zhang");
+	System.out.println("从 session 上取值：" + session.get("name"));
+
+	return AjaxJson.getSuccess();
+}
+```
+
+<!------------- tab:Shiro ------------->
+
+``` java
+// 测试从 session 上存取值 
+@RequestMapping("testSession")
+public AjaxJson test() {
+	Subject subject = SecurityUtils.getSubject();
+	Session session = subject.getSession();
+
+	System.out.println("从 session 上取值：" + session.getAttribute("name"));
+	session.setAttribute("name", "zhang");
+	System.out.println("从 session 上取值：" + session.getAttribute("name"));
+
+	return AjaxJson.getSuccess();
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+
+
+
+### 角色认证 & 权限认证
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+自定义 StpInterface 实现类 
+
+``` java
+@Component
+public class StpInterfaceImpl implements StpInterface {
+
+	// 加载角色信息
+	@Override
+	public List<String> getPermissionList(Object loginId, String loginType) {
+		return Arrays.asList("admin", "super-admin", "ceo");
+	}
+
+	// 加载权限信息
+	@Override
+	public List<String> getRoleList(Object loginId, String loginType) {
+		return Arrays.asList("user:add", "user:delete", "user:update");
+	}
+
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/jur/")
+public class JurController {
+
+	// 角色判断  ---- http://localhost:8082/jur/assertRole
+	@RequestMapping("assertRole")
+	public AjaxJson assertRole() {
+		// is 模式，返回 true 或 false
+		System.out.println("单个权限判断：" + StpUtil.hasRole("admin"));
+		System.out.println("多个权限判断(and)：" + StpUtil.hasRoleAnd("admin", "dev-admin"));
+		System.out.println("多个权限判断(or)：" + StpUtil.hasRoleOr("admin", "dev-admin"));
+
+		// check 模式，无角色时抛出异常
+		StpUtil.checkRole("admin");  // 单个 check
+		StpUtil.checkRoleAnd("admin", "dev-admin"); // 多个 check (and)
+		StpUtil.checkRoleOr("admin", "dev-admin"); // 多个 check (or)
+
+		return AjaxJson.getSuccess();
+	}
+
+	// 权限判断  ---- http://localhost:8082/jur/assertPermission
+	@RequestMapping("assertPermission")
+	public AjaxJson assertPermission() {
+		// is 模式，返回 true 或 false
+		System.out.println("单个权限判断：" + StpUtil.hasPermission("user:add"));
+		System.out.println("多个权限判断(and)：" + StpUtil.hasPermissionAnd("user:add", "user:delete22"));
+		System.out.println("多个权限判断(or)：" + StpUtil.hasPermissionOr("user:add", "user:delete22"));
+
+		// check 模式，无权限时抛出异常
+		StpUtil.checkPermission("user:add");  // 单个 check
+		StpUtil.checkPermissionAnd("user:add", "user:delete22"); // 多个 check (and)
+		StpUtil.checkPermissionOr("user:add", "user:delete22"); // 多个 check (or)
+
+		return AjaxJson.getSuccess();
+	}
+
+}
+```
+
+
+<!------------- tab:Shiro ------------->
+
+自定义 Realm 里重写方法 doGetAuthorizationInfo
+
+``` java
+@Override
+protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+	SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
+	// 加载角色信息
+	authorizationInfo.addRoles(Arrays.asList("admin", "super-admin", "ceo"));
+	// 加载权限信息
+	authorizationInfo.addStringPermissions(Arrays.asList("user:add", "user:delete", "user:update"));
+	return authorizationInfo;
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/jur/")
+public class JurController {
+
+	// 角色判断 
+	@RequestMapping("assertRole")
+	public AjaxJson assertRole() {
+		Subject subject = SecurityUtils.getSubject();
+
+		// is 模式，返回 true 或 false
+		System.out.println("单个权限判断：" + subject.hasRole("admin"));
+		System.out.println("多个权限判断(and)：" + subject.hasAllRoles(Arrays.asList("admin", "dev-admin")));
+		System.out.println("多个权限判断(or)：" + (subject.hasRole("admin") || subject.hasRole("dev-admin")));
+
+		// check 模式，无角色时抛出异常
+		subject.checkRole("admin");  // 单个 check
+		subject.checkRoles("admin", "dev-admin"); // 多个 check (and)
+
+		return AjaxJson.getSuccess();
+	}
+
+	// 权限判断 
+	@RequestMapping("assertPermission")
+	public AjaxJson assertPermission() {
+		Subject subject = SecurityUtils.getSubject();
+
+		// is 模式，返回 true 或 false
+		System.out.println("单个权限判断：" + subject.isPermitted("user:add"));
+		System.out.println("多个权限判断(and)：" + subject.isPermittedAll("user:add", "user:delete22"));
+		System.out.println("多个权限判断(or)：" + (subject.isPermitted("user:add") || subject.isPermitted("user:delete22")));
+
+		// check 模式，无权限时抛出异常
+		subject.checkPermission("user:add");  // 单个 check
+		subject.checkPermissions("user:add", "user:delete22"); // 多个 check (and)
+
+		return AjaxJson.getSuccess();
+	}
+
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+
+### 注解鉴权
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+SaTokenConfigure 配置注解拦截器
+``` java
+@Configuration
+public class SaTokenConfigure implements WebMvcConfigurer {
+	@Override
+	public void addInterceptors(InterceptorRegistry registry) {
+		registry.addInterceptor(new SaInterceptor()).addPathPatterns("/**");
+	}
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/at-check/")
+public class AtCheckController {
+
+    // 登录校验 
+    @SaCheckLogin
+    @RequestMapping("checkLogin")
+    public AjaxJson checkLogin() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 角色校验 
+    @SaCheckRole("admin")
+    @RequestMapping("checkRole")
+    public AjaxJson checkRole() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 权限校验 
+    @SaCheckPermission("user:add")
+    @RequestMapping("checkPermission")
+    public AjaxJson checkPermission() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 忽略认证校验 
+    @SaIgnore
+    @SaCheckLogin
+    @RequestMapping("ignoreCheck")
+    public AjaxJson ignoreCheck() {
+        return AjaxJson.getSuccess();
+    }
+
+}
+```
+
+
+<!------------- tab:Shiro ------------->
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/at-check/")
+public class AtCheckController {
+
+    // 登录校验 
+    @RequiresAuthentication
+    @RequestMapping("checkLogin")
+    public AjaxJson checkLogin() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 角色校验  
+    @RequiresRoles("admin")
+    @RequestMapping("checkRole")
+    public AjaxJson checkRole() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 权限校验 
+    @RequiresPermissions("user:add")
+    @RequestMapping("checkPermission")
+    public AjaxJson checkPermission() {
+        return AjaxJson.getSuccess();
+    }
+
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 路由拦截鉴权
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+SaTokenConfigure 配置 
+``` java
+@Override
+public void addInterceptors(InterceptorRegistry registry) {
+	// 注册 Sa-Token 拦截器打开注解鉴权功能 
+	registry.addInterceptor(new SaInterceptor(handle -> {
+		SaRouter.match("/route-check/getInfo1").stop(); // 不拦截
+		SaRouter.match("/route-check/getInfo2").check(r -> StpUtil.checkLogin()); // 需要登录
+		SaRouter.match("/route-check/getInfo3").check(r -> StpUtil.checkRole("admin2")); // 需要角色
+		SaRouter.match("/route-check/getInfo4").check(r -> StpUtil.checkPermission("user:add3")); // 需要权限
+	})).addPathPatterns("/**");
+}
+```
+
+鉴权未通过时处理方案 
+``` java
+@RestControllerAdvice
+public class GlobalException {
+
+	@ExceptionHandler(NotLoginException.class)
+	public AjaxJson handlerException(NotLoginException e) {
+		return AjaxJson.get(401, "未登录");
+	}
+
+	@ExceptionHandler(NotRoleException.class)
+	public AjaxJson handlerException(NotRoleException e) {
+		return AjaxJson.get(403, "缺少角色：" + e.getRole());
+	}
+
+	@ExceptionHandler(NotPermissionException.class)
+	public AjaxJson handlerException(NotPermissionException e) {
+		return AjaxJson.get(403, "缺少权限：" + e.getPermission());
+	}
+
+}
+```
+
+<!------------- tab:Shiro ------------->
+
+过滤器配置 
+``` java
+@Bean
+public ShiroFilterFactoryBean shiroFilterFactoryBean() {
+	ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
+	bean.setSecurityManager(securityManager());
+
+	// 路由拦截鉴权
+	Map<String,String> filterMap = new LinkedHashMap<>();
+	filterMap.put("/route-check/getInfo", "anon"); // 不拦截
+	filterMap.put("/route-check/getInfo2", "authc"); // 需要登录
+	filterMap.put("/route-check/getInfo3", "perms[admin2]"); // 需要角色
+	filterMap.put("/route-check/getInfo4", "perms[user:add3]"); // 需要权限
+	bean.setFilterChainDefinitionMap(filterMap);
+	bean.setLoginUrl("/401");  // 未登录时跳转的 url
+	bean.setUnauthorizedUrl("/403");  // 未授权时跳转的 url
+
+	return bean;
+}
+```
+
+鉴权未通过时处理方案 
+``` java
+@RestController
+public class ShiroErrorController {
+
+    @RequestMapping("/401")
+    public Object error401(HttpServletRequest request, HttpServletResponse response) {
+        response.setStatus(200);
+        return AjaxJson.get(401, "not login");
+    }
+
+    @RequestMapping("/403")
+    public Object error403(HttpServletRequest request, HttpServletResponse response) {
+        response.setStatus(200);
+        return AjaxJson.get(403, "鉴权未通过");
+    }
+
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 和 Thymeleaf 集成
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+pom.xml 依赖 
+``` xml
+<!-- 在 thymeleaf 标签中使用 Sa-Token -->
+<dependency>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-dialect-thymeleaf</artifactId>
+	<version>${sa-token.version}</version>
+</dependency>
+```
+
+SaTokenConfigure 增加配置 Sa-Token 标签方言对象 
+
+``` java
+// Sa-Token 标签方言 (Thymeleaf版)
+@Bean
+public SaTokenDialect getSaTokenDialect() {
+	return new SaTokenDialect();
+}
+```
+
+新建 ThymeleafConfigure 注入全局变量
+``` java
+@Configuration
+public class ThymeleafConfigure {
+    // 为 Thymeleaf 注入全局变量，以便在页面中调用 Sa-Token 的方法
+    @Autowired
+    public void configureThymeleafStaticVars(ThymeleafViewResolver viewResolver) {
+        viewResolver.addStaticVariable("stp", StpUtil.stpLogic);
+    }
+}
+```
+
+新建 Controller 
+``` java
+@Controller
+public class HomeController {
+    @RequestMapping("/")
+    public Object index(HttpServletRequest request) {
+        request.setAttribute("isLogin", StpUtil.isLogin());
+        return new ModelAndView("index.html");
+    }
+}
+```
+	
+新建 templates/index.html
+``` html
+<!DOCTYPE html>
+<html lang="zh" xmlns:sa="http://www.thymeleaf.org/extras/sa-token">
+<head>
+    <title>Sa-Token 集成 Thymeleaf 标签方言</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
+</head>
+<body>
+<div class="view-box" style="padding: 30px;">
+    <h2>Sa-Token 集成 Thymeleaf 标签方言 —— 测试页面</h2>
+    <p>当前是否登录：<span th:text="${stp.isLogin()}"></span></p>
+    <p>
+        <a href="login" target="_blank">登录</a>
+        <a href="logout" target="_blank">注销</a>
+    </p>
+
+    <p>登录之后才能显示：<span sa:login>value</span></p>
+    <p>不登录才能显示：<span sa:notLogin>value</span></p>
+
+    <p>具有角色 admin 才能显示：<span sa:hasRole="admin">value</span></p>
+    <p>同时具备多个角色才能显示：<span sa:hasRoleAnd="admin, ceo, cto">value</span></p>
+    <p>只要具有其中一个角色就能显示：<span sa:hasRoleOr="admin, ceo, cto">value</span></p>
+    <p>不具有角色 admin 才能显示：<span sa:notRole="admin">value</span></p>
+
+    <p>具有权限 user-add 才能显示：<span sa:hasPermission="user-add">value</span></p>
+    <p>同时具备多个权限才能显示：<span sa:hasPermissionAnd="user-add, user-delete, user-get">value</span></p>
+    <p>只要具有其中一个权限就能显示：<span sa:hasPermissionOr="user-add, user-delete, user-get">value</span></p>
+    <p>不具有权限 user-add 才能显示：<span sa:notPermission="user-add">value</span></p>
+
+    <p th:if="${stp.isLogin()}">
+        从SaSession中取值：
+        <span th:text="${stp.getSession().get('name', '')}"></span>
+    </p>
+
+</div>
+</body>
+</html>
+```
+
+
+<!------------- tab:Shiro ------------->
+
+pom.xml 依赖 
+``` xml
+<!-- Shiro 整合 Thymeleaf 依赖 -->
+<dependency>
+	<groupId>com.github.theborakompanioni</groupId>
+	<artifactId>thymeleaf-extras-shiro</artifactId>
+	<version>2.1.0</version>
+</dependency>
+```
+
+ShiroConfigure 增加配置 Shiro 方言对象 
+``` java
+@Bean
+public ShiroDialect shiroDialect() {
+	return new ShiroDialect();
+}
+```
+
+新建 Controller 
+``` java
+@Controller
+public class HomeController {
+    @RequestMapping("/")
+    public Object index(HttpServletRequest request) {
+        Subject subject = SecurityUtils.getSubject();
+        request.setAttribute("isLogin", subject.isAuthenticated());
+        return new ModelAndView("index.html");
+    }
+}
+```
+
+新建 templates/index.html
+
+``` html
+<!DOCTYPE html>
+<html lang="zh" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">
+<head>
+    <title>Shiro 集成 Thymeleaf 标签方言</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
+</head>
+<body>
+<div class="view-box" style="padding: 30px;">
+    <h2>Shiro 集成 Thymeleaf 标签方言 —— 测试页面</h2>
+    <p>当前是否登录：<span th:text="${isLogin}"></span></p>
+    <p>
+        <a href="/acc/doLogin?username=zhang&password=123456" target="_blank">登录</a>
+        <a href="/acc/logout" target="_blank">注销</a>
+    </p>
+    <p>登录之后才能显示：<span shiro:authenticated>value</span></p>
+    <p>不登录才能显示：<span shiro:guest >value</span></p>
+
+    <p>具有角色 admin 才能显示：<span shiro:hasRole="admin">value</span></p>
+    <p>同时具备多个角色才能显示：<span shiro:hasAllRoles="admin, ceo, cto">value</span></p>
+    <p>只要具有其中一个角色就能显示：<span shiro:hasAnyRoles="admin, ceo, cto">value</span></p>
+    <p>不具有角色 admin 才能显示：<span shiro:lacksRole="admin">value</span></p>
+
+    <p>具有权限 user-add 才能显示：<span shiro:hasPermission="user-add">value</span></p>
+    <p>同时具备多个权限才能显示：<span shiro:hasAllPermissions="user-add, user-delete, user-get">value</span></p>
+    <p>只要具有其中一个权限就能显示：<span shiro:hasAnyPermissions="user-add, user-delete, user-get">value</span></p>
+    <p>不具有权限 user-add 才能显示：<span shiro:lacksPermission="user-add">value</span></p>
+
+    <p shiro:authenticated>
+      当前登录账号：<span shiro:principal></span>
+    </p>
+
+</div>
+</body>
+</html>
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 前后端分离
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+1、在登录时，将 token 信息返回到前端 
+``` java
+// 测试登录 
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password) {
+	// 校验
+	SysUser user = sysUserDao.findByUsername(username);
+	// user 信息校验代码不再赘述 ... 
+	
+	// 登录
+	StpUtil.login(user.getId());
+	StpUtil.getSession().set("user", user);
+	return AjaxJson.getSuccess("登录成功").set("satoken", StpUtil.getTokenValue());  // 关键代码 
+}
+```
+
+2、前端改造
+- 1、在登录请求时，将返回的 token 保存到本地 `localStorage.setItem('satoken', res.satoken)`。
+- 2、在后续每次请求中，读取本地保存的 satoken 塞到请求 header 中
+
+``` js
+const header = {};
+if(localStorage.satoken) {
+	header.satoken = localStorage.satoken;
+}
+// 后续提交请求...
+```
+
+
+<!------------- tab:Shiro ------------->
+
+1、自定义 SessionManager，从请求 header 里读取前端提交的 token
+``` java
+public class MySessionManager extends DefaultWebSessionManager {
+
+    private static final String TOKEN = "token";
+
+    private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request";
+
+    public MySessionManager() {
+        super();
+    }
+
+    @Override
+    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
+        String id = WebUtils.toHttp(request).getHeader(TOKEN);
+        // 如果请求头中有 token 则其值为sessionId
+        if (!StringUtils.isEmpty(id)) {
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
+            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+            return id;
+        } else {
+            //否则按默认规则从cookie取sessionId
+            return super.getSessionId(request, response);
+        }
+    }
+}
+```
+
+2、注入到 SecurityManager 中 
+``` java
+@Configuration
+public class ShiroConfigure {
+
+	// 省略其它次要代码 ... 
+
+    @Bean
+    public DefaultWebSecurityManager securityManager() {
+        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
+        manager.setRealm(myRealm());
+        manager.setSessionManager(sessionManager());
+        return manager;
+    }
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
+        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
+        bean.setSecurityManager(securityManager());
+        return bean;
+    }
+
+    // 自定义sessionManager
+    @Bean
+    public SessionManager sessionManager() {
+        MySessionManager mySessionManager = new MySessionManager();
+        return mySessionManager;
+    }
+}
+```
+
+3、测试 Controller，登录时将 token 信息返回到前端 
+``` java
+// 测试登录 
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password) {
+	Subject subject = SecurityUtils.getSubject();
+	try {
+		subject.login(new UsernamePasswordToken(username, password));
+		String token = subject.getSession().getId().toString();    // 关键代码
+		return AjaxJson.getSuccess("登录成功!").set("token", token);    // 关键代码
+	} catch (AuthenticationException e) {
+		e.printStackTrace();
+		return AjaxJson.getError(e.getMessage());
+	}
+}
+```
+
+4、前端改造
+- 1、在登录请求时，将返回的 token 保存到本地 `localStorage.setItem('token', res.token)`。
+- 2、在后续每次请求中，读取本地保存的 token 塞到请求 header 中
+
+``` js
+const header = {};
+if(localStorage.token) {
+	header.token = localStorage.token;
+}
+// 后续提交请求...
+```
+
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 集成 Redis
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+pom.xml 引入依赖
+``` xml
+<!-- Sa-Token整合 Redis (使用jackson序列化方式) -->
+<dependency>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-redis-jackson</artifactId>
+	<version>${sa-token.version}</version>
+</dependency>
+
+<!-- 提供Redis连接池 -->
+<dependency>
+	<groupId>org.apache.commons</groupId>
+	<artifactId>commons-pool2</artifactId>
+</dependency>
+```
+
+application.yml 新增连接配置 
+``` yaml
+spring:
+    data:
+        # redis配置
+        redis:
+            # Redis数据库索引（默认为0）
+            database: 1
+            # Redis服务器地址
+            host: 127.0.0.1
+            # Redis服务器连接端口
+            port: 6379
+            # Redis服务器连接密码（默认为空）
+            password:
+            # 连接超时时间
+            timeout: 10s
+            lettuce:
+                pool:
+                    # 连接池最大连接数
+                    max-active: 200
+                    # 连接池最大阻塞等待时间（使用负值表示没有限制）
+                    max-wait: -1ms
+                    # 连接池中的最大空闲连接
+                    max-idle: 10
+                    # 连接池中的最小空闲连接
+                    min-idle: 0
+```
+
+其它代码照旧
+
+
+<!------------- tab:Shiro ------------->
+pom.xml 引入依赖 
+
+``` xml
+<!-- Shiro 集成 Redis -->
+<dependency>
+	<groupId>org.crazycake</groupId>
+	<artifactId>shiro-redis</artifactId>
+	<version>3.3.1</version>
+</dependency>
+```
+
+application.yml 新增连接配置 
+``` yaml
+
+spring:
+    redis:
+        shiro:
+            # Redis服务器地址
+            host: 127.0.0.1:6379
+            # Redis服务器连接密码（默认为空）
+            password:
+            # Redis数据库索引（默认为0）
+            database: 2
+            # 连接超时时间
+            timeout: 1800
+        
+```
+
+
+ShiroConfigure 注入相关 Bean 
+``` java
+@Configuration
+public class ShiroConfigure {
+
+    // 自定义 securityManager
+    @Bean
+    public DefaultWebSecurityManager securityManager() {
+        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
+        // manager.setRealm(myRealm());
+
+        // 自定义session管理 使用redis
+        manager.setSessionManager(sessionManager());
+        // 自定义缓存实现 使用redis
+        manager.setCacheManager(cacheManager());
+
+        return manager;
+    }
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
+        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
+        bean.setSecurityManager(securityManager());
+        return bean;
+    }
+
+    // -------- 以下为 shiro redis 相关 --------
+
+    // Shiro redis 连接信息
+    @Value("${spring.redis.shiro.host}")
+    private String host;
+    @Value("${spring.redis.shiro.database}")
+    private int database;
+    @Value("${spring.redis.shiro.timeout}")
+    private int timeout;
+    @Value("${spring.redis.shiro.password}")
+    private String password;
+
+    /**
+     * 配置shiro redisManager
+     */
+    public RedisManager redisManager() {
+        RedisManager redisManager = new RedisManager();
+        redisManager.setHost(host);
+        if(StringUtils.hasText(password)){
+            redisManager.setPassword(password);
+        }
+        redisManager.setDatabase(database);
+        redisManager.setTimeout(timeout);
+        return redisManager;
+    }
+
+    /**
+     * cacheManager 缓存 redis 实现
+     */
+    @Bean
+    public RedisCacheManager cacheManager() {
+        RedisCacheManager redisCacheManager = new RedisCacheManager();
+        redisCacheManager.setRedisManager(redisManager());
+        return redisCacheManager;
+    }
+
+    /**
+     * RedisSessionDAO redis 实现
+     */
+    @Bean
+    public RedisSessionDAO redisSessionDAO() {
+        RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
+        redisSessionDAO.setRedisManager(redisManager());
+        return redisSessionDAO;
+    }
+
+    // 自定义sessionManager
+    @Bean
+    public SessionManager sessionManager() {
+        MySessionManager mySessionManager = new MySessionManager();
+        mySessionManager.setSessionDAO(redisSessionDAO());
+        return mySessionManager;
+    }
+
+}
+```
+
+SysUser 实体类要实现 Serializable 接口
+``` java
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SysUser implements Serializable {
+	// ... 
+}
+```
+
+其它代码照旧 
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+
+
+
+
+
+
+
+
-- 
Gitee


From 2d5478ef7fdd85d5d5921592e0fb4ecd1580ef58 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 11 Aug 2024 04:09:21 +0800
Subject: [PATCH 112/172] =?UTF-8?q?=E6=96=87=E6=A1=A3=E4=B8=8E=E6=96=B0?=
 =?UTF-8?q?=E5=A2=9E=20SpringSecurity=20=E5=8A=9F=E8=83=BD=E4=BB=A3?=
 =?UTF-8?q?=E7=A0=81=E5=AE=9E=E7=8E=B0=E5=AF=B9=E6=AF=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../fun/auth-framework-function-test.md       | 803 +++++++++++++++++-
 1 file changed, 758 insertions(+), 45 deletions(-)

diff --git a/sa-token-doc/fun/auth-framework-function-test.md b/sa-token-doc/fun/auth-framework-function-test.md
index 3aa9a700..c319abd3 100644
--- a/sa-token-doc/fun/auth-framework-function-test.md
+++ b/sa-token-doc/fun/auth-framework-function-test.md
@@ -17,8 +17,46 @@
 --- 
 
 
+### 依赖引入
 
-### 登录 & 注销 & 查询会话状态
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+``` xml
+<!-- Sa-Token 权限认证, 在线文档：https://sa-token.cc/ -->
+<dependency>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-spring-boot3-starter</artifactId>
+	<version>1.38.0</version>
+</dependency>
+```
+
+<!------------- tab:Shiro ------------->
+``` xml
+<!-- Shiro 安全控制 -->
+<dependency>
+	<groupId>org.apache.shiro</groupId>
+	<artifactId>shiro-spring-boot-web-starter</artifactId>
+	<version>1.13.0</version>
+</dependency>
+```
+
+<!------------- tab:SpringSecurity ------------->
+``` xml
+<!-- SpringSecurity -->
+<dependency>
+	<groupId>org.springframework.boot</groupId>
+	<artifactId>spring-boot-starter-security</artifactId>
+	<version>3.3.2</version>
+</dependency>
+```
+SpringBoot 项目下一般不用特别指定 SpringSecurity 版本号
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 会话登录 & 会话状态查询
 
 <!------------------------------ tabs:start ------------------------------>
 <!------------- tab:Sa-Token ------------->
@@ -32,7 +70,7 @@ public class LoginController {
 	@Autowired
 	SysUserDao sysUserDao;
 		
-	// 测试登录  ---- http://localhost:8081/acc/doLogin?username=zhang&password=123456
+	// 测试登录 
 	@RequestMapping("doLogin")
 	public AjaxJson doLogin(String username, String password) {
 		// 校验
@@ -49,7 +87,7 @@ public class LoginController {
 		return AjaxJson.getSuccess("登录成功");
 	}
 	
-	// 查询登录状态  ---- http://localhost:8081/acc/isLogin
+	// 查询登录状态 
 	@RequestMapping("isLogin")
 	public AjaxJson isLogin() {
 		if(StpUtil.isLogin()) {
@@ -58,13 +96,6 @@ public class LoginController {
 		return AjaxJson.getError("未登录");
 	}
 
-	// 测试注销  ---- http://localhost:8081/acc/logout
-	@RequestMapping("logout")
-	public AjaxJson logout() {
-		StpUtil.logout();
-		return AjaxJson.getSuccess("注销成功");
-	}
-
 }
 ```
 
@@ -157,21 +188,211 @@ public class LoginController {
 		return AjaxJson.getError("未登录");
 	}
 
-	// 测试注销  ---- http://localhost:8082/acc/logout
-	@RequestMapping("logout")
-	public AjaxJson logout() {
-		SecurityUtils.getSubject().logout();
-		return AjaxJson.getSuccess("注销成功");
+}
+```
+
+<!------------- tab:SpringSecurity ------------->
+
+定义 SpringSecurity 配置类
+``` java
+@Configuration
+public class SpringSecurityConfigure {
+
+    /**
+     * Spring Security的核心过滤器链配置
+     */
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
+        // 定义安全请求拦截规则
+        httpSecurity.authorizeHttpRequests(router -> {
+            router
+                    // 放行接口
+                    .requestMatchers("/acc/doLogin", "/acc/isLogin").permitAll()
+
+					// 所有请求都需要认证
+                    .anyRequest().authenticated(); 
+                    ;
+                });
+
+        // 默认的表单登录
+        httpSecurity.formLogin(withDefaults());
+
+        // 是否启用 csrf 防御
+        httpSecurity.csrf( csrf -> csrf.disable() );
+
+        // 一些安全相关的全局响应头
+        httpSecurity.headers(httpSecurityHeadersConfigurer -> {
+            httpSecurityHeadersConfigurer.cacheControl(HeadersConfigurer.CacheControlConfig::disable);
+            httpSecurityHeadersConfigurer.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable);
+        });
+		
+        return httpSecurity.build();
+    }
+
+    /**
+     * Spring Security 认证管理器
+     */
+    @Bean
+    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
+        return config.getAuthenticationManager();
+    }
+
+}
+```
+
+定义 SpringSecurity UserDetails 管理器
+``` java
+/**
+ * 自定义 SpringSecurity UserDetails 管理器
+ *
+ * @author click33
+ * @since 2024/8/8
+ */
+@Component
+public class CustomUserDetailsManager implements UserDetailsManager {
+
+    @Autowired
+    SysUserDao sysUserDao;
+
+    @Override
+    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+        SysUser sysUser = sysUserDao.findByUsername(username);
+        if(sysUser == null){
+            throw new UsernameNotFoundException("用户不存在");
+        }
+        return User.withUsername(sysUser.getUsername())
+                .password("{noop}" + sysUser.getPassword())
+                .build();
+    }
+
+    @Override
+    public void createUser(UserDetails user) {
+
+    }
+
+    @Override
+    public void updateUser(UserDetails user) {
+
+    }
+
+    @Override
+    public void deleteUser(String username) {
+
+    }
+
+    @Override
+    public void changePassword(String oldPassword, String newPassword) {
+
+    }
+
+    @Override
+    public boolean userExists(String username) {
+        return false;
+    }
+
+}
+```
+
+测试 Controller 
+
+``` java
+@RestController
+@RequestMapping("/acc/")
+public class LoginController {
+
+	@Autowired
+	AuthenticationManager authenticationManager;
+
+	@Autowired
+	SysUserDao sysUserDao;
+
+	// 测试登录  ---- http://localhost:8083/acc/doLogin?username=zhang&password=123456
+	@RequestMapping("doLogin")
+	public AjaxJson doLogin(String username, String password, HttpServletRequest request) {
+		try {
+			// 验证账号密码
+			UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(username, password);
+			usernamePasswordAuthenticationToken.setDetails(sysUserDao.findByUsername(username));
+			Authentication authentication = authenticationManager.authenticate(usernamePasswordAuthenticationToken);
+			// 存入上下文
+			SecurityContextHolder.getContext().setAuthentication(authentication);
+			request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
+			// 返回
+			return AjaxJson.getSuccess("登录成功!");
+		} catch (Exception e) {
+			e.printStackTrace();
+			return AjaxJson.getError(e.getMessage());
+		}
+	}
+
+	// 查询登录状态  ---- http://localhost:8083/acc/isLogin
+	@RequestMapping("isLogin")
+	public AjaxJson isLogin() {
+		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+		return AjaxJson.getSuccess("是否登录：" + !(authentication instanceof AnonymousAuthenticationToken))
+				.set("principal", authentication.getPrincipal())
+				.set("details", authentication.getDetails());
 	}
 
 }
+
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 会话注销
+
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+``` java 
+@RequestMapping("logout")
+public AjaxJson logout() {
+	StpUtil.logout();
+	return AjaxJson.getSuccess("注销成功");
+}
+```
+
+<!------------- tab:Shiro ------------->
+
+``` java
+@RequestMapping("logout")
+public AjaxJson logout() {
+	SecurityUtils.getSubject().logout();
+	return AjaxJson.getSuccess("注销成功");
+}
+```
+
+<!------------- tab:SpringSecurity ------------->
+``` java
+@Bean
+public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
+	
+	// 其它配置 ...
+	
+	// 注销相关配置
+	httpSecurity.logout(logout -> {
+		logout.logoutUrl("/acc/logout");
+		logout.logoutSuccessHandler((request, response, authentication) -> {
+			response.setStatus(200);
+			response.setCharacterEncoding("UTF-8");
+			response.setContentType("application/json; charset=utf-8");
+			String jsonStr = new ObjectMapper().writeValueAsString(AjaxJson.getSuccess("注销成功!"));
+			response.getWriter().write(jsonStr);
+		});
+	});
+
+	return httpSecurity.build();
+}
 ```
 
 <!---------------------------- tabs:end ------------------------------>
 
 
 
-### 账号密码登录（加盐 MD5）
+### 账号密码登录（MD5 加 salt）
 
 <!------------------------------ tabs:start ------------------------------>
 <!------------- tab:Sa-Token ------------->
@@ -233,6 +454,44 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
 
 登录代码照旧 
 
+<!------------- tab:SpringSecurity ------------->
+
+CustomUserDetailsManager 的 loadUserByUsername 指定 MD5 算法
+
+``` java
+@Override
+public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+	SysUser sysUser = sysUserDao.findByUsername(username);
+	if(sysUser == null){
+		throw new UsernameNotFoundException("用户不存在");
+	}
+	return User.withUsername(sysUser.getUsername())
+			.password("{MD5}" + sysUser.getPassword())
+			.build();
+}
+```
+
+登录时指定 salt 
+
+``` java
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password, HttpServletRequest request) {
+	try {
+		// 验证账号密码
+		String salt = "abc";
+		UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(username, salt + password);
+		// 其它代码照旧 ... 
+		
+		// 返回
+		return AjaxJson.getSuccess("登录成功!");
+	} catch (Exception e) {
+		e.printStackTrace();
+		return AjaxJson.getError(e.getMessage());
+	}
+}
+```
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -264,15 +523,32 @@ public AjaxJson getCurrUser() {
 }
 ```
 
+<!------------- tab:SpringSecurity ------------->
+``` java
+// 从上下文获取当前登录 User 信息 
+@RequestMapping("getCurrUser")
+public AjaxJson getCurrUser() {
+	Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+	if(!(authentication instanceof AnonymousAuthenticationToken)) {
+		SysUser sysUser = (SysUser)authentication.getDetails();
+		return AjaxJson.getSuccess()
+						.set("id", sysUser.getId())
+						.set("user", sysUser);
+	}
+	return AjaxJson.getError("未登录");
+}
+```
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
 
-### 从 session 上存取值
+### 从会话上下文上存取值
 <!------------------------------ tabs:start ------------------------------>
 <!------------- tab:Sa-Token ------------->
 ``` java
-// 测试从 session 上存取值 
+// 测试从从会话上下文存取值 
 @RequestMapping("testSession")
 public AjaxJson test() {
 	SaSession session = StpUtil.getSession();
@@ -288,7 +564,7 @@ public AjaxJson test() {
 <!------------- tab:Shiro ------------->
 
 ``` java
-// 测试从 session 上存取值 
+// 测试从从会话上下文存取值
 @RequestMapping("testSession")
 public AjaxJson test() {
 	Subject subject = SecurityUtils.getSubject();
@@ -302,6 +578,23 @@ public AjaxJson test() {
 }
 ```
 
+<!------------- tab:SpringSecurity ------------->
+
+``` java
+// 测试从从会话上下文存取值
+@RequestMapping("testSession")
+public AjaxJson testSession(HttpServletRequest request) {
+	HttpSession session = request.getSession();
+
+	System.out.println("从 session 上取值：" + session.getAttribute("name"));
+	session.setAttribute("name", "zhang");
+	System.out.println("从 session 上取值：" + session.getAttribute("name"));
+	return AjaxJson.getSuccess();
+}
+```
+
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -345,9 +638,9 @@ public class JurController {
 	@RequestMapping("assertRole")
 	public AjaxJson assertRole() {
 		// is 模式，返回 true 或 false
-		System.out.println("单个权限判断：" + StpUtil.hasRole("admin"));
-		System.out.println("多个权限判断(and)：" + StpUtil.hasRoleAnd("admin", "dev-admin"));
-		System.out.println("多个权限判断(or)：" + StpUtil.hasRoleOr("admin", "dev-admin"));
+		System.out.println("单个角色判断：" + StpUtil.hasRole("admin"));
+		System.out.println("多个角色判断(and)：" + StpUtil.hasRoleAnd("admin", "dev-admin"));
+		System.out.println("多个角色判断(or)：" + StpUtil.hasRoleOr("admin", "dev-admin"));
 
 		// check 模式，无角色时抛出异常
 		StpUtil.checkRole("admin");  // 单个 check
@@ -405,9 +698,9 @@ public class JurController {
 		Subject subject = SecurityUtils.getSubject();
 
 		// is 模式，返回 true 或 false
-		System.out.println("单个权限判断：" + subject.hasRole("admin"));
-		System.out.println("多个权限判断(and)：" + subject.hasAllRoles(Arrays.asList("admin", "dev-admin")));
-		System.out.println("多个权限判断(or)：" + (subject.hasRole("admin") || subject.hasRole("dev-admin")));
+		System.out.println("单个角色判断：" + subject.hasRole("admin"));
+		System.out.println("多个角色判断(and)：" + subject.hasAllRoles(Arrays.asList("admin", "dev-admin")));
+		System.out.println("多个角色判断(or)：" + (subject.hasRole("admin") || subject.hasRole("dev-admin")));
 
 		// check 模式，无角色时抛出异常
 		subject.checkRole("admin");  // 单个 check
@@ -436,6 +729,58 @@ public class JurController {
 }
 ```
 
+<!------------- tab:SpringSecurity ------------->
+
+CustomUserDetailsManager 的 loadUserByUsername 里返回用户的 角色 或 权限 信息
+``` java
+@Override
+public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+	SysUser sysUser = sysUserDao.findByUsername(username);
+	if(sysUser == null){
+		throw new UsernameNotFoundException("用户不存在");
+	}
+
+    // 不可以同时返回 roles 和 authorities，因为会相互覆盖，SpringSecurity 源码有bug
+	return User.withUsername(sysUser.getUsername())
+			.password("{noop}" + sysUser.getPassword())
+			// .roles("admin", "super-admin", "ceo")
+			.authorities("user:add", "user:delete", "user:update")
+			.build();
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/jur/")
+public class JurController {
+
+	// 角色判断  
+	@RequestMapping("assertRole")
+	public AjaxJson assertRole() {
+		SecurityExpressionRoot securityExpressionRoot = new SecurityExpressionRoot(SecurityContextHolder.getContext().getAuthentication()) {};
+
+		System.out.println("单个角色判断：" + securityExpressionRoot.hasRole("admin"));
+		System.out.println("多个角色判断(and)：" + (securityExpressionRoot.hasRole("admin") && securityExpressionRoot.hasRole("dev-admin")));
+		System.out.println("多个角色判断(or)：" + securityExpressionRoot.hasAnyRole("admin", "dev-admin"));
+
+		return AjaxJson.getSuccess();
+	}
+
+	// 权限判断 
+	@RequestMapping("assertPermission")
+	public AjaxJson assertPermission() {
+		SecurityExpressionRoot securityExpressionRoot = new SecurityExpressionRoot(SecurityContextHolder.getContext().getAuthentication()) {};
+
+		System.out.println("单个权限判断：" + securityExpressionRoot.hasAuthority("user:add"));
+		System.out.println("多个权限判断(and)：" + (securityExpressionRoot.hasAuthority("user:add") && securityExpressionRoot.hasAuthority("user:delete2")));
+		System.out.println("多个权限判断(or)：" + securityExpressionRoot.hasAnyAuthority("user:add", "user:delete2"));
+
+		return AjaxJson.getSuccess();
+	}
+
+}
+```
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -528,6 +873,48 @@ public class AtCheckController {
 }
 ```
 
+<!------------- tab:SpringSecurity ------------->
+
+`SpringSecurityConfigure` 配置类加上 `@EnableMethodSecurity` 注解
+``` java
+@Configuration
+@EnableMethodSecurity
+public class SpringSecurityConfigure {
+	// ...
+}
+```
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/at-check/")
+public class AtCheckController {
+
+    // 登录校验  
+    @PreAuthorize("isAuthenticated()")
+    @RequestMapping("checkLogin")
+    public AjaxJson checkLogin() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 角色校验  
+    @PreAuthorize("hasRole('admin')")
+    @RequestMapping("checkRole")
+    public AjaxJson checkRole() {
+        return AjaxJson.getSuccess();
+    }
+
+    // 权限校验 
+    @PreAuthorize("hasAuthority('user:add')")
+    @RequestMapping("checkPermission")
+    public AjaxJson checkPermission() {
+        return AjaxJson.getSuccess();
+    }
+
+}
+```
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -550,7 +937,58 @@ public void addInterceptors(InterceptorRegistry registry) {
 }
 ```
 
-鉴权未通过时处理方案 
+<!------------- tab:Shiro ------------->
+
+过滤器配置 
+``` java
+@Bean
+public ShiroFilterFactoryBean shiroFilterFactoryBean() {
+	ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
+	bean.setSecurityManager(securityManager());
+
+	// 路由拦截鉴权
+	Map<String,String> filterMap = new LinkedHashMap<>();
+	filterMap.put("/route-check/getInfo", "anon"); // 不拦截
+	filterMap.put("/route-check/getInfo2", "authc"); // 需要登录
+	filterMap.put("/route-check/getInfo3", "perms[admin2]"); // 需要角色
+	filterMap.put("/route-check/getInfo4", "perms[user:add3]"); // 需要权限
+	bean.setFilterChainDefinitionMap(filterMap);
+	bean.setLoginUrl("/401");  // 未登录时跳转的 url
+	bean.setUnauthorizedUrl("/403");  // 未授权时跳转的 url
+
+	return bean;
+}
+```
+
+<!------------- tab:SpringSecurity ------------->
+SpringSecurityConfigure 配置 
+
+``` java
+@Bean
+public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
+	// 定义安全请求拦截规则
+	httpSecurity.authorizeHttpRequests(router -> {
+		router
+			.requestMatchers("/route-check/getInfo1").permitAll()    // 不拦截
+			.requestMatchers("/route-check/getInfo2").authenticated()    // 需要登录
+			.requestMatchers("/route-check/getInfo3").hasRole("admin")    // 需要 admin 角色
+			.requestMatchers("/route-check/getInfo4").hasAuthority("user:add")    // 需要 user:add 权限
+			.anyRequest().permitAll(); // 所有请求都放行
+		});
+
+	return httpSecurity.build();
+}
+```
+
+<!---------------------------- tabs:end ------------------------------>
+
+
+
+### 鉴权未通过的处理方案
+<!------------------------------ tabs:start ------------------------------>
+<!------------- tab:Sa-Token ------------->
+
+定义全局异常处理类 
 ``` java
 @RestControllerAdvice
 public class GlobalException {
@@ -580,15 +1018,9 @@ public class GlobalException {
 @Bean
 public ShiroFilterFactoryBean shiroFilterFactoryBean() {
 	ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
-	bean.setSecurityManager(securityManager());
-
-	// 路由拦截鉴权
-	Map<String,String> filterMap = new LinkedHashMap<>();
-	filterMap.put("/route-check/getInfo", "anon"); // 不拦截
-	filterMap.put("/route-check/getInfo2", "authc"); // 需要登录
-	filterMap.put("/route-check/getInfo3", "perms[admin2]"); // 需要角色
-	filterMap.put("/route-check/getInfo4", "perms[user:add3]"); // 需要权限
-	bean.setFilterChainDefinitionMap(filterMap);
+	
+	// ... 
+	
 	bean.setLoginUrl("/401");  // 未登录时跳转的 url
 	bean.setUnauthorizedUrl("/403");  // 未授权时跳转的 url
 
@@ -596,7 +1028,7 @@ public ShiroFilterFactoryBean shiroFilterFactoryBean() {
 }
 ```
 
-鉴权未通过时处理方案 
+定义路由 
 ``` java
 @RestController
 public class ShiroErrorController {
@@ -616,6 +1048,66 @@ public class ShiroErrorController {
 }
 ```
 
+<!------------- tab:SpringSecurity ------------->
+
+实现 `AccessDeniedHandler`, `AuthenticationEntryPoint` 接口
+
+``` java
+@Component
+public class CustomAccessDeniedHandler implements AccessDeniedHandler, AuthenticationEntryPoint, Serializable {
+
+    // 未登录异常
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
+        //验证为未登陆状态会进入此方法，认证错误
+        response.setStatus(401);
+        response.setCharacterEncoding("UTF-8");
+        response.setContentType("application/json; charset=utf-8");
+        PrintWriter printWriter = response.getWriter();
+        String body = "请先进行登录";
+        printWriter.write(body);
+        printWriter.flush();
+    }
+
+    // 权限不足
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
+        // 登陆状态下，权限不足执行该方法
+        response.setStatus(200);
+        response.setCharacterEncoding("UTF-8");
+        response.setContentType("application/json; charset=utf-8");
+        PrintWriter printWriter = response.getWriter();
+        String body = "权限不足";
+        printWriter.write(body);
+        printWriter.flush();
+    }
+}
+```
+
+注入 `SecurityFilterChain`
+
+``` java
+// 未登录处理逻辑、权限不足处理逻辑
+@Autowired
+private CustomAccessDeniedHandler accessDeniedHandler;
+
+@Bean
+public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
+	
+	// 异常处理
+	httpSecurity.exceptionHandling(httpSecurityExceptionHandlingConfigurer -> {
+		// 权限不足处理方案
+		httpSecurityExceptionHandlingConfigurer.accessDeniedHandler(accessDeniedHandler);
+		// 未登录 处理逻辑
+		httpSecurityExceptionHandlingConfigurer.authenticationEntryPoint(accessDeniedHandler);
+	});
+
+	return httpSecurity.build();
+}
+```
+
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -625,7 +1117,7 @@ public class ShiroErrorController {
 <!------------------------------ tabs:start ------------------------------>
 <!------------- tab:Sa-Token ------------->
 
-pom.xml 依赖 
+`pom.xml` 依赖 
 ``` xml
 <!-- 在 thymeleaf 标签中使用 Sa-Token -->
 <dependency>
@@ -635,7 +1127,7 @@ pom.xml 依赖
 </dependency>
 ```
 
-SaTokenConfigure 增加配置 Sa-Token 标签方言对象 
+`SaTokenConfigure` 增加配置 `Sa-Token` 标签方言对象 
 
 ``` java
 // Sa-Token 标签方言 (Thymeleaf版)
@@ -645,7 +1137,7 @@ public SaTokenDialect getSaTokenDialect() {
 }
 ```
 
-新建 ThymeleafConfigure 注入全局变量
+新建 `ThymeleafConfigure` 注入全局变量
 ``` java
 @Configuration
 public class ThymeleafConfigure {
@@ -657,7 +1149,7 @@ public class ThymeleafConfigure {
 }
 ```
 
-新建 Controller 
+新建 `Controller` 
 ``` java
 @Controller
 public class HomeController {
@@ -669,7 +1161,7 @@ public class HomeController {
 }
 ```
 	
-新建 templates/index.html
+新建 `templates/index.html`
 ``` html
 <!DOCTYPE html>
 <html lang="zh" xmlns:sa="http://www.thymeleaf.org/extras/sa-token">
@@ -713,7 +1205,7 @@ public class HomeController {
 
 <!------------- tab:Shiro ------------->
 
-pom.xml 依赖 
+`pom.xml` 依赖 
 ``` xml
 <!-- Shiro 整合 Thymeleaf 依赖 -->
 <dependency>
@@ -723,7 +1215,7 @@ pom.xml 依赖
 </dependency>
 ```
 
-ShiroConfigure 增加配置 Shiro 方言对象 
+`ShiroConfigure` 增加配置 `Shiro` 方言对象 
 ``` java
 @Bean
 public ShiroDialect shiroDialect() {
@@ -731,7 +1223,7 @@ public ShiroDialect shiroDialect() {
 }
 ```
 
-新建 Controller 
+新建 `Controller` 
 ``` java
 @Controller
 public class HomeController {
@@ -744,7 +1236,7 @@ public class HomeController {
 }
 ```
 
-新建 templates/index.html
+新建 `templates/index.html`
 
 ``` html
 <!DOCTYPE html>
@@ -784,6 +1276,75 @@ public class HomeController {
 </html>
 ```
 
+<!------------- tab:SpringSecurity ------------->
+
+`pom.xml` 引入依赖 
+``` xml
+<!-- SpringSecurity 整合 Thymeleaf 依赖 -->
+<dependency>
+	<groupId>org.thymeleaf.extras</groupId>
+	<artifactId>thymeleaf-extras-springsecurity6</artifactId>
+	<version>3.1.2.RELEASE</version>
+</dependency>
+```
+		
+新建 `Controller` 
+``` java
+@RestController
+public class HomeController {
+    // 首页  
+    @RequestMapping("/")
+    public Object index(HttpServletRequest request) {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        request.setAttribute("isLogin", !(authentication instanceof AnonymousAuthenticationToken));
+        return new ModelAndView("index.html");
+    }
+}
+```
+
+新建 `templates/index.html`
+
+``` html
+<!DOCTYPE html>
+<html lang="zh" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity6">
+<head>
+    <title>Shiro 集成 Thymeleaf 标签方言</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
+</head>
+<body>
+<div class="view-box" style="padding: 30px;">
+    <h2>Shiro 集成 Thymeleaf 标签方言 —— 测试页面</h2>
+    <p>当前是否登录：<span th:text="${isLogin}"></span></p>
+
+    <p>
+        <a href="/acc/doLogin?username=zhang&password=123456" target="_blank">登录</a>
+        <a href="/acc/logout" target="_blank">注销</a>
+    </p>
+    <p>登录之后才能显示：<span sec:authorize="isAuthenticated()">value</span></p>
+    <p>不登录才能显示：<span sec:authorize="!isAuthenticated()" >value</span></p>
+
+    <p>具有角色 admin 才能显示：<span sec:authorize="hasRole('admin')">value</span></p>
+    <p>同时具备多个角色才能显示：<span sec:authorize="hasRole('admin') && hasRole('ceo') && hasRole('cto')">value</span></p>
+    <p>只要具有其中一个角色就能显示：<span sec:authorize="hasAnyRole('admin', 'ceo', 'cto')">value</span></p>
+    <p>不具有角色 admin 才能显示：<span sec:authorize="!hasRole('admin')">value</span></p>
+
+    <p>具有权限 user-add 才能显示：<span sec:authorize="hasAuthority('user-add')">value</span></p>
+    <p>同时具备多个权限才能显示：<span sec:authorize="hasAuthority('user-add') && hasAuthority('user-delete') && hasAuthority('user-get')">value</span></p>
+    <p>只要具有其中一个权限就能显示：<span sec:authorize="hasAnyAuthority('user-add', 'user-delete', 'user-get')">value</span></p>
+    <p>不具有权限 user-add 才能显示：<span sec:authorize="!hasAuthority('user-add')">value</span></p>
+
+    <p sec:authorize="isAuthenticated()">
+        当前登录账号：<span sec:authentication="details"></span>
+    </p>
+
+</div>
+</body>
+</html>
+```
+
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -912,6 +1473,10 @@ if(localStorage.token) {
 ```
 
 
+<!------------- tab:SpringSecurity ------------->
+见下方 “集成 Redis” 部分，同时做到：集成 Redis + 前后端分离。
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -1093,6 +1658,154 @@ public class SysUser implements Serializable {
 
 其它代码照旧 
 
+
+<!------------- tab:SpringSecurity ------------->
+
+（结合上部分，同时做到集成 Redis + 前后端分离）
+
+1、`pom.xml` 引入依赖 
+``` xml
+<!-- HttpSession 存储到 Redis -->
+<dependency>
+	<groupId>org.springframework.session</groupId>
+	<artifactId>spring-session-data-redis</artifactId>
+</dependency>
+<dependency>
+	<groupId>org.springframework.boot</groupId>
+	<artifactId>spring-boot-starter-data-redis</artifactId>
+</dependency>
+```
+
+2、`yml` 增加配置
+``` yml
+spring:
+    session:
+        store-type: redis
+        timeout: 8H
+        redis:
+            namespace: spring:session
+
+    data:
+        # redis配置
+        redis:
+            # Redis数据库索引（默认为0）
+            database: 3
+            # Redis服务器地址
+            host: 127.0.0.1
+            # Redis服务器连接端口
+            port: 6379
+            # Redis服务器连接密码（默认为空）
+            password:
+            # 连接超时时间
+            timeout: 10s
+            lettuce:
+                pool:
+                    # 连接池最大连接数
+                    max-active: 200
+                    # 连接池最大阻塞等待时间（使用负值表示没有限制）
+                    max-wait: -1ms
+                    # 连接池中的最大空闲连接
+                    max-idle: 10
+                    # 连接池中的最小空闲连接
+                    min-idle: 0
+```
+
+3、在 `CustomAccessDeniedHandler` 自定义认证异常处理类中，返回 `json` 格式数据
+
+``` java
+@Component
+public class CustomAccessDeniedHandler implements AccessDeniedHandler, AuthenticationEntryPoint, Serializable {
+
+    // 未登录异常
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
+        //验证为未登陆状态会进入此方法，认证错误
+        response.setStatus(401);
+        response.setCharacterEncoding("UTF-8");
+        response.setContentType("application/json; charset=utf-8");
+        PrintWriter printWriter = response.getWriter();
+        String body = new ObjectMapper().writeValueAsString(AjaxJson.get(401, "请先进行登录"));
+        printWriter.write(body);
+        printWriter.flush();
+    }
+
+    // 权限不足
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException {
+        // 登陆状态下，权限不足执行该方法
+        response.setStatus(200);
+        response.setCharacterEncoding("UTF-8");
+        response.setContentType("application/json; charset=utf-8");
+        PrintWriter printWriter = response.getWriter();
+        String body = new ObjectMapper().writeValueAsString(AjaxJson.get(403, "权限不足"));
+        printWriter.write(body);
+        printWriter.flush();
+    }
+    
+}
+```
+
+4、别忘了注入到 `SecurityFilterChain` 过滤器链 
+``` java
+ // 异常处理
+httpSecurity.exceptionHandling(httpSecurityExceptionHandlingConfigurer -> {
+	// 权限不足处理方案
+	httpSecurityExceptionHandlingConfigurer.accessDeniedHandler(accessDeniedHandler);
+	// 未登录 处理逻辑
+	httpSecurityExceptionHandlingConfigurer.authenticationEntryPoint(accessDeniedHandler);
+});
+```
+
+5、在登录时，返回对应 token 信息
+``` java
+// 测试登录 
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password, HttpServletRequest request) {
+	try {
+		// 验证账号密码
+		UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(username, password);
+		usernamePasswordAuthenticationToken.setDetails(sysUserDao.findByUsername(username));
+		Authentication authentication = authenticationManager.authenticate(usernamePasswordAuthenticationToken);
+		// 存入上下文
+		SecurityContextHolder.getContext().setAuthentication(authentication);
+		request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
+		// 返回
+		String token = request.getSession().getId();
+		return AjaxJson.getSuccess("登录成功!").set("token", token);
+	} catch (Exception e) {
+		e.printStackTrace();
+		return AjaxJson.getError(e.getMessage());
+	}
+}
+```
+
+6、前端改造
+- 1、在登录请求时，将返回的 token 保存到本地 `localStorage.setItem('token', res.token)`。
+- 2、在后续每次请求中，读取本地保存的 token 塞到请求 header 中
+
+``` js
+const header = {};
+if(localStorage.token) {
+	header.token = localStorage.token;
+}
+// 后续提交请求...
+```
+
+7、新建 `HttpSessionConfigure` 配置重写 `HttpSessionId` 读取策略，改为从 `header` 头读取 `token` 参数作为 `SessionId`
+``` java
+@Configuration
+public class HttpSessionConfigure {
+    // HttpSession 读取策略，从 header 头读取 token 参数作为 session id
+    @Bean
+    public HeaderHttpSessionIdResolver httpSessionStrategy() {
+        System.out.println("----------------- 自定义 HttpSession Id 读取方式");
+        return new HeaderHttpSessionIdResolver("token");
+    }
+}
+```
+
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
-- 
Gitee


From 101a577ded0137d80196591ac222f6ea8f118810 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 11 Aug 2024 06:22:11 +0800
Subject: [PATCH 113/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20JWT=20=E5=8A=9F?=
 =?UTF-8?q?=E8=83=BD=E4=BB=A3=E7=A0=81=E5=AF=B9=E6=AF=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../fun/auth-framework-function-test.md       | 135 ++++++++++++++++++
 1 file changed, 135 insertions(+)

diff --git a/sa-token-doc/fun/auth-framework-function-test.md b/sa-token-doc/fun/auth-framework-function-test.md
index c319abd3..daa644df 100644
--- a/sa-token-doc/fun/auth-framework-function-test.md
+++ b/sa-token-doc/fun/auth-framework-function-test.md
@@ -52,6 +52,17 @@
 ```
 SpringBoot 项目下一般不用特别指定 SpringSecurity 版本号
 
+<!------------- tab:JWT ------------->
+``` xml
+<!-- Hutool 工具类框架，其中包含 jwt 实现 -->
+<dependency>
+	<groupId>cn.hutool</groupId>
+	<artifactId>hutool-all</artifactId>
+	<version>5.8.29</version>
+</dependency>
+```
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -338,6 +349,52 @@ public class LoginController {
 
 ```
 
+<!------------- tab:JWT ------------->
+
+测试 Controller 
+``` java
+@RestController
+@RequestMapping("/acc/")
+public class LoginController {
+
+	@Autowired
+	SysUserDao sysUserDao;
+
+	// 测试登录 
+	@RequestMapping("doLogin")
+	public AjaxJson doLogin(String username, String password) {
+		// 校验
+		SysUser user = sysUserDao.findByUsername(username);
+		if(user == null) {
+			return AjaxJson.getError("用户不存在");
+		}
+		if(!user.getPassword().equals(password)) {
+			return AjaxJson.getError("密码错误");
+		}
+		// 登录
+		String token = JwtUtil.createToken(user.getId(), user, 60 * 60 * 2);
+		return AjaxJson.getSuccess("登录成功").set("token", token);
+	}
+
+	// 查询登录状态 
+	@RequestMapping("isLogin")
+	public AjaxJson isLogin(HttpServletRequest request) {
+		try{
+			String token = request.getHeader("token");
+			JWT jwt = JwtUtil.parseToken(token);
+			return AjaxJson.getSuccess("已登录")
+					.set("id", jwt.getPayload("userId"))
+					.set("user", jwt.getPayload("user"));
+		} catch (Exception e) {
+			e.printStackTrace();
+			return AjaxJson.getError("未登录");
+		}
+	}
+
+}
+```
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -388,6 +445,9 @@ public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws
 }
 ```
 
+<!------------- tab:JWT ------------->
+JWT 无法注销已经颁发的 token 。
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -492,6 +552,26 @@ public AjaxJson doLogin(String username, String password, HttpServletRequest req
 ```
 
 
+<!------------- tab:JWT ------------->
+测试 Controller 
+``` java 
+@RequestMapping("doLogin")
+public AjaxJson doLogin(String username, String password) {
+	// 校验
+	SysUser user = sysUserDao.findByUsername(username);
+	if(user == null) {
+		return AjaxJson.getError("用户不存在");
+	}
+	String salt = "abc";
+	if(!user.getPassword().equals(SecureUtil.md5(salt + password))) {
+		return AjaxJson.getError("密码错误");
+	}
+	// 登录
+	String token = JwtUtil.createToken(user.getId(), user, 60 * 60 * 2);
+	return AjaxJson.getSuccess("登录成功").set("token", token);
+}
+```
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -539,6 +619,22 @@ public AjaxJson getCurrUser() {
 }
 ```
 
+<!------------- tab:JWT ------------->
+``` java
+// 从上下文获取当前登录 User 信息 
+@RequestMapping("getCurrUser")
+public AjaxJson getCurrUser(HttpServletRequest request) {
+	try{
+		String token = request.getHeader("token");
+		JWT jwt = JwtUtil.parseToken(token);
+		SysUser sysUser = jwt.getPayloads().get("user", SysUser.class);
+		return AjaxJson.getSuccessData(sysUser);
+	} catch (Exception e) {
+		e.printStackTrace();
+		return AjaxJson.getError("未登录");
+	}
+}
+```
 
 <!---------------------------- tabs:end ------------------------------>
 
@@ -593,6 +689,8 @@ public AjaxJson testSession(HttpServletRequest request) {
 }
 ```
 
+<!------------- tab:JWT ------------->
+无
 
 
 <!---------------------------- tabs:end ------------------------------>
@@ -781,6 +879,10 @@ public class JurController {
 
 }
 ```
+
+<!------------- tab:JWT ------------->
+无
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -914,6 +1016,9 @@ public class AtCheckController {
 }
 ```
 
+<!------------- tab:JWT ------------->
+无
+
 
 <!---------------------------- tabs:end ------------------------------>
 
@@ -980,6 +1085,9 @@ public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws
 }
 ```
 
+<!------------- tab:JWT ------------->
+无
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -1106,6 +1214,25 @@ public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws
 }
 ```
 
+<!------------- tab:JWT ------------->
+使用 `try-catch` 捕获，或定义全局异常处理
+``` java
+@RestControllerAdvice
+public class GlobalException {
+	// 全局异常拦截（拦截项目中的所有异常）
+	@ExceptionHandler
+	public AjaxJson handlerException(Exception e, HttpServletRequest request, HttpServletResponse response) {
+
+		// 打印堆栈，以供调试
+		System.out.println("全局异常---------------");
+		e.printStackTrace();
+
+		// 返回给前端
+		return AjaxJson.getError(e.getMessage());
+	}
+}
+```
+
 
 
 <!---------------------------- tabs:end ------------------------------>
@@ -1343,6 +1470,8 @@ public class HomeController {
 </html>
 ```
 
+<!------------- tab:JWT ------------->
+无
 
 
 <!---------------------------- tabs:end ------------------------------>
@@ -1477,6 +1606,10 @@ if(localStorage.token) {
 见下方 “集成 Redis” 部分，同时做到：集成 Redis + 前后端分离。
 
 
+<!------------- tab:JWT ------------->
+`JWT` 不依赖 `Cookie` 保存/传输 token，因此无需特殊定制即可原生支持前后端分离模式。
+
+
 <!---------------------------- tabs:end ------------------------------>
 
 
@@ -1805,6 +1938,8 @@ public class HttpSessionConfigure {
 ```
 
 
+<!------------- tab:JWT ------------->
+无
 
 <!---------------------------- tabs:end ------------------------------>
 
-- 
Gitee


From eeed140424d42890f50dea449c33970c8767c3c5 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 12 Aug 2024 07:05:43 +0800
Subject: [PATCH 114/172] =?UTF-8?q?=E9=87=8D=E6=9E=84=20sa-token-oauth2?=
 =?UTF-8?q?=EF=BC=9A=E6=8F=90=E5=8F=96=E6=95=B0=E6=8D=AE=E5=8A=A0=E8=BD=BD?=
 =?UTF-8?q?=E5=99=A8=20Bean=EF=BC=8C=E6=8F=90=E4=BE=9B=E6=9B=B4=E6=96=B9?=
 =?UTF-8?q?=E4=BE=BF=E7=9A=84=E8=87=AA=E5=AE=9A=E4=B9=89=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E5=8A=A0=E8=BD=BD=E6=96=B9=E6=A1=88=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../sa-token-demo-oauth2-server/pom.xml       |   4 +-
 ...eImpl.java => SaOAuth2DataLoaderImpl.java} |  16 +-
 .../pj/oauth2/SaOAuth2ServerController.java   |  21 +-
 .../dev33/satoken/oauth2/SaOAuth2Manager.java |  20 +
 .../{logic => consts}/SaOAuth2Consts.java     |   4 +-
 .../oauth2/dataloader/SaOAuth2DataLoader.java |  51 ++
 .../SaOAuth2DataLoaderDefaultImpl.java        |  28 +
 .../SaOAuth2ServerProcessor.java}             | 708 +++++++++---------
 .../{logic => template}/SaOAuth2Template.java |  23 +-
 .../{logic => template}/SaOAuth2Util.java     |  74 +-
 .../solon/oauth2/SaOAuth2AutoConfigure.java   |   4 +-
 .../spring/oauth2/SaOAuth2BeanInject.java     |  30 +-
 .../spring/oauth2/SaOAuth2BeanRegister.java   |   4 +-
 .../configure/inject/MySaOAuth2Template.java  |   2 +-
 14 files changed, 547 insertions(+), 442 deletions(-)
 rename sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/{SaOAuth2TemplateImpl.java => SaOAuth2DataLoaderImpl.java} (76%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{logic => consts}/SaOAuth2Consts.java (97%)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{logic/SaOAuth2Handle.java => processor/SaOAuth2ServerProcessor.java} (75%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{logic => template}/SaOAuth2Template.java (98%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{logic => template}/SaOAuth2Util.java (72%)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
index 0363705c..045c07a6 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
@@ -60,11 +60,11 @@
 		</dependency>
 		
 		<!-- 热刷新 -->
-		<dependency>
+		<!--<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-devtools</artifactId>
 			<scope>provided</scope>
-		</dependency>
+		</dependency>-->
         
 		<!-- ConfigurationProperties -->
         <dependency>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2TemplateImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
similarity index 76%
rename from sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2TemplateImpl.java
rename to sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 758b4090..78080fbd 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2TemplateImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -1,18 +1,18 @@
 package com.pj.oauth2;
 
-import org.springframework.stereotype.Component;
-
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Template;
+import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.model.SaClientModel;
+import org.springframework.stereotype.Component;
 
 /**
- * Sa-Token OAuth2.0 整合实现 
+ * Sa-Token OAuth2：自定义数据加载器
+ *
  * @author click33
  */
 @Component
-public class SaOAuth2TemplateImpl extends SaOAuth2Template {
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	
-	// 根据 id 获取 Client 信息 
+	// 根据 client_id 获取 Client 信息
 	@Override
 	public SaClientModel getClientModel(String clientId) {
 		// 此为模拟数据，真实环境需要从数据库查询 
@@ -33,7 +33,5 @@ public class SaOAuth2TemplateImpl extends SaOAuth2Template {
 		// 此为模拟数据，真实环境需要从数据库查询 
 		return "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__";
 	}
-	
-	// -------------- 其它需要重写的函数 
-	
+
 }
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 7f49f746..16771edd 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -1,21 +1,20 @@
 package com.pj.oauth2;
 
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.Map;
-
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
+import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaResult;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
 
-import cn.dev33.satoken.context.SaHolder;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Handle;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Util;
-import cn.dev33.satoken.stp.StpUtil;
-import cn.dev33.satoken.util.SaResult;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
 /**
  * Sa-OAuth2 Server端 控制器
@@ -29,7 +28,7 @@ public class SaOAuth2ServerController {
 	@RequestMapping("/oauth2/*")
 	public Object request() {
 		System.out.println("------- 进入请求: " + SaHolder.getRequest().getUrl());
-		return SaOAuth2Handle.serverRequest();
+		return SaOAuth2ServerProcessor.instance.dister();
 	}
 	
 	// Sa-OAuth2 定制化配置 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 4796a686..05d206ff 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -16,6 +16,8 @@
 package cn.dev33.satoken.oauth2;
 
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoaderDefaultImpl;
 
 /**
  * Sa-Token-OAuth2 模块 总控类
@@ -44,4 +46,22 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.config = config;
 	}
 
+	/**
+	 * OAuth2 数据加载器 Bean
+	 */
+	private static volatile SaOAuth2DataLoader dataLoader;
+	public static SaOAuth2DataLoader getDataLoader() {
+		if (dataLoader == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (dataLoader == null) {
+					setDataLoader(new SaOAuth2DataLoaderDefaultImpl());
+				}
+			}
+		}
+		return dataLoader;
+	}
+	public static void setDataLoader(SaOAuth2DataLoader dataLoader) {
+		SaOAuth2Manager.dataLoader = dataLoader;
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
similarity index 97%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Consts.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index e1ee9bb7..22a189bc 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -13,10 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.logic;
+package cn.dev33.satoken.oauth2.consts;
 
 /**
- * Sa-Token-OAuth2 所有常量
+ * Sa-Token OAuth2 所有常量
  *
  * @author click33
  * @since 1.23.0
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java
new file mode 100644
index 00000000..5b94679c
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.dataloader;
+
+import cn.dev33.satoken.oauth2.model.SaClientModel;
+
+/**
+ * Sa-Token OAuth2 数据加载器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2DataLoader {
+
+    /**
+     * 根据 id 获取 Client 信息
+     *
+     * @param clientId 应用id
+     * @return ClientModel
+     */
+    default SaClientModel getClientModel(String clientId) {
+        return null;
+    }
+
+    /**
+     * 根据ClientId 和 LoginId 获取openid
+     *
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @return 此账号在此Client下的openid
+     */
+    default String getOpenid(String clientId, Object loginId) {
+        return null;
+    }
+
+
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java
new file mode 100644
index 00000000..deedbf9b
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.dataloader;
+
+/**
+ * Sa-Token OAuth2 数据加载器 默认实现类
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2DataLoaderDefaultImpl implements SaOAuth2DataLoader{
+
+    // be empty of
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
similarity index 75%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 559a38b9..1447e7be 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -1,348 +1,360 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.oauth2.logic;
-
-import cn.dev33.satoken.context.SaHolder;
-import cn.dev33.satoken.context.model.SaRequest;
-import cn.dev33.satoken.context.model.SaResponse;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
-import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.Api;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.GrantType;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.Param;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.ResponseType;
-import cn.dev33.satoken.oauth2.model.*;
-import cn.dev33.satoken.stp.StpUtil;
-import cn.dev33.satoken.util.SaFoxUtil;
-import cn.dev33.satoken.util.SaResult;
-
-/**
- * Sa-Token-OAuth2 请求处理类封装
- *
- * @author click33
- * @since 1.23.0
- */
-public class SaOAuth2Handle {
-
-	/**
-	 * 处理Server端请求， 路由分发
-	 * @return 处理结果
-	 */
-	public static Object serverRequest() {
-
-		// 获取变量
-		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
-
-		// ------------------ 路由分发 ------------------
-
-		// 模式一：Code授权码
-		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.code)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsCode() && (cm.isCode || cm.isAutoMode)) {
-				return authorize(req, res, cfg);
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
-		}
-		
-		// Code授权码 获取 Access-Token
-		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.authorization_code)) {
-			return token(req, res, cfg);
-		}
-
-		// Refresh-Token 刷新 Access-Token
-		if(req.isPath(Api.refresh) && req.isParam(Param.grant_type, GrantType.refresh_token)) {
-			return refreshToken(req);
-		}
-
-		// 回收 Access-Token
-		if(req.isPath(Api.revoke)) {
-			return revokeToken(req);
-		}
-
-		// doLogin 登录接口
-		if(req.isPath(Api.doLogin)) {
-			return doLogin(req, res, cfg);
-		}
-
-		// doConfirm 确认授权接口
-		if(req.isPath(Api.doConfirm)) {
-			return doConfirm(req);
-		}
-
-		// 模式二：隐藏式
-		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.token)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsImplicit() && (cm.isImplicit || cm.isAutoMode)) {
-				return authorize(req, res, cfg);
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30132);
-		}
-
-		// 模式三：密码式
-		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.password)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsPassword() && (cm.isPassword || cm.isAutoMode)) {
-				return password(req, res, cfg);
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30133);
-		}
-
-		// 模式四：凭证式
-		if(req.isPath(Api.client_token) && req.isParam(Param.grant_type, GrantType.client_credentials)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsClient() && (cm.isClient || cm.isAutoMode)) {
-				return clientToken(req, res, cfg);
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30134);
-		}
-
-		// 默认返回
-		return SaOAuth2Consts.NOT_HANDLE;
-	}
-
-	/**
-	 * 模式一：Code授权码 / 模式二：隐藏式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
-	 * @return 处理结果
-	 */
-	public static Object authorize(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-		
-		// 1、如果尚未登录, 则先去登录
-		if( ! StpUtil.isLogin()) {
-			return cfg.getNotLoginView().get();
-		}
-
-		// 2、构建请求Model
-		RequestAuthModel ra = SaOAuth2Util.generateRequestAuth(req, StpUtil.getLoginId());
-
-		// 3、校验：重定向域名是否合法
-		SaOAuth2Util.checkRightUrl(ra.clientId, ra.redirectUri);
-
-		// 4、校验：此次申请的Scope，该Client是否已经签约
-		SaOAuth2Util.checkContract(ra.clientId, ra.scope);
-
-		// 5、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
-		boolean isGrant = SaOAuth2Util.isGrant(ra.loginId, ra.clientId, ra.scope);
-		if( ! isGrant) {
-			return cfg.getConfirmView().apply(ra.clientId, ra.scope);
-		}
-
-		// 6、判断授权类型
-		// 如果是 授权码式，则：开始重定向授权，下放code
-		if(ResponseType.code.equals(ra.responseType)) {
-			CodeModel codeModel = SaOAuth2Util.generateCode(ra);
-			String redirectUri = SaOAuth2Util.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
-			return res.redirect(redirectUri);
-		}
-		
-		// 如果是 隐藏式，则：开始重定向授权，下放 token
-		if(ResponseType.token.equals(ra.responseType)) {
-			AccessTokenModel at = SaOAuth2Util.generateAccessToken(ra, false);
-			String redirectUri = SaOAuth2Util.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
-			return res.redirect(redirectUri);
-		}
-
-		// 默认返回
-		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
-	}
-
-	/**
-	 * Code授权码 获取 Access-Token
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
-	 * @return 处理结果
-	 */
-	public static Object token(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-		// 获取参数
-		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
-		String clientId;
-		String clientSecret;
-		// gitlab回调token接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
-		if(SaFoxUtil.isEmpty(authorizationValue)){
-			clientId = req.getParamNotNull(Param.client_id);
-			clientSecret = req.getParamNotNull(Param.client_secret);
-		} else {
-			String[] clientIdAndSecret = authorizationValue.split(":");
-			clientId = clientIdAndSecret[0];
-			clientSecret = clientIdAndSecret[1];
-		}
-
-		String code = req.getParamNotNull(Param.code);
-		String redirectUri = req.getParam(Param.redirect_uri);
-
-		// 校验参数
-		SaOAuth2Util.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
-
-		// 构建 Access-Token
-		AccessTokenModel token = SaOAuth2Util.generateAccessToken(code);
-
-		// 返回
-		return SaResult.data(token.toLineMap());
-	}
-
-	/**
-	 * Refresh-Token 刷新 Access-Token
-	 * @param req 请求对象
-	 * @return 处理结果
-	 */
-	public static Object refreshToken(SaRequest req) {
-		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
-		String refreshToken = req.getParamNotNull(Param.refresh_token);
-
-		// 校验参数
-		SaOAuth2Util.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
-
-		// 获取新Token返回
-		Object data = SaOAuth2Util.refreshAccessToken(refreshToken).toLineMap();
-		return SaResult.data(data);
-	}
-
-	/**
-	 * 回收 Access-Token
-	 * @param req 请求对象
-	 * @return 处理结果
-	 */
-	public static Object revokeToken(SaRequest req) {
-		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
-		String accessToken = req.getParamNotNull(Param.access_token);
-
-		// 如果 Access-Token 不存在，直接返回
-		if(SaOAuth2Util.getAccessToken(accessToken) == null) {
-			return SaResult.ok("access_token不存在：" + accessToken);
-		}
-
-		// 校验参数
-		SaOAuth2Util.checkAccessTokenParam(clientId, clientSecret, accessToken);
-
-		// 回收 Access-Token
-		SaOAuth2Util.revokeAccessToken(accessToken);
-		return SaResult.ok();
-	}
-
-	/**
-	 * doLogin 登录接口
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
-	 * @return 处理结果
-	 */
-	public static Object doLogin(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-		return cfg.getDoLoginHandle().apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
-	}
-
-	/**
-	 * doConfirm 确认授权接口
-	 * @param req 请求对象
-	 * @return 处理结果
-	 */
-	public static Object doConfirm(SaRequest req) {
-		String clientId = req.getParamNotNull(Param.client_id);
-		String scope = req.getParamNotNull(Param.scope);
-		Object loginId = StpUtil.getLoginId();
-		SaOAuth2Util.saveGrantScope(clientId, loginId, scope);
-		return SaResult.ok();
-	}
-
-	/**
-	 * 模式三：密码式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
-	 * @return 处理结果
-	 */
-	public static Object password(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-
-		// 1、获取请求参数
-		String username = req.getParamNotNull(Param.username);
-		String password = req.getParamNotNull(Param.password);
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
-		String scope = req.getParam(Param.scope, "");
-
-		// 2、校验 ClientScope 和 scope 
-		SaOAuth2Util.checkClientSecretAndScope(clientId, clientSecret, scope);
-
-		// 3、防止因前端误传token造成逻辑干扰
-		// SaHolder.getStorage().set(StpUtil.stpLogic.splicingKeyJustCreatedSave(), "no-token");
-
-		// 3、调用API 开始登录，如果没能成功登录，则直接退出
-		Object retObj = cfg.getDoLoginHandle().apply(username, password);
-		if( ! StpUtil.isLogin()) {
-			return retObj;
-		}
-
-		// 4、构建 ra对象
-		RequestAuthModel ra = new RequestAuthModel();
-		ra.clientId = clientId;
-		ra.loginId = StpUtil.getLoginId();
-		ra.scope = scope;
-
-		// 5、生成 Access-Token
-		AccessTokenModel at = SaOAuth2Util.generateAccessToken(ra, true);
-
-		// 6、返回 Access-Token
-		return SaResult.data(at.toLineMap());
-	}
-
-	/**
-	 * 模式四：凭证式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
-	 * @return 处理结果
-	 */
-	public static Object clientToken(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-
-		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
-		String scope = req.getParam(Param.scope);
-
-		//校验 ClientScope
-		SaOAuth2Util.checkContract(clientId, scope);
-
-		// 校验 ClientSecret
-		SaOAuth2Util.checkClientSecret(clientId, clientSecret);
-
-		// 返回 Client-Token
-		ClientTokenModel ct = SaOAuth2Util.generateClientToken(clientId, scope);
-
-		// 返回 Client-Token
-		return SaResult.data(ct.toLineMap());
-	}
-
-	/**
-	 * 根据当前请求提交的 client_id 参数获取 SaClientModel 对象 
-	 * @return / 
-	 */
-	public static SaClientModel currClientModel() {
-		String clientId = SaHolder.getRequest().getParam(Param.client_id);
-		return SaOAuth2Util.checkClientModel(clientId);
-	}
-	
-}
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.processor;
+
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.context.model.SaResponse;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.model.*;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
+import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaFoxUtil;
+import cn.dev33.satoken.util.SaResult;
+
+/**
+ * Sa-Token OAuth2 请求处理器
+ *
+ * @author click33
+ * @since 1.23.0
+ */
+public class SaOAuth2ServerProcessor {
+
+	/**
+	 * 全局默认实例
+	 */
+	public static SaOAuth2ServerProcessor instance = new SaOAuth2ServerProcessor();
+
+	/**
+	 * 底层 SaOAuth2Template 对象
+	 */
+	public SaOAuth2Template oauth2Template =  new SaOAuth2Template();
+
+	/**
+	 * 处理 Server 端请求， 路由分发
+	 * @return 处理结果
+	 */
+	public Object dister() {
+
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+
+		// ------------------ 路由分发 ------------------
+
+		// 模式一：Code授权码
+		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.code)) {
+			SaClientModel cm = currClientModel();
+			if(cfg.getIsCode() && (cm.isCode || cm.isAutoMode)) {
+				return authorize(req, res, cfg);
+			}
+			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+		}
+		
+		// Code授权码 获取 Access-Token
+		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.authorization_code)) {
+			return token(req, res, cfg);
+		}
+
+		// Refresh-Token 刷新 Access-Token
+		if(req.isPath(Api.refresh) && req.isParam(Param.grant_type, GrantType.refresh_token)) {
+			return refreshToken(req);
+		}
+
+		// 回收 Access-Token
+		if(req.isPath(Api.revoke)) {
+			return revokeToken(req);
+		}
+
+		// doLogin 登录接口
+		if(req.isPath(Api.doLogin)) {
+			return doLogin(req, res, cfg);
+		}
+
+		// doConfirm 确认授权接口
+		if(req.isPath(Api.doConfirm)) {
+			return doConfirm(req);
+		}
+
+		// 模式二：隐藏式
+		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.token)) {
+			SaClientModel cm = currClientModel();
+			if(cfg.getIsImplicit() && (cm.isImplicit || cm.isAutoMode)) {
+				return authorize(req, res, cfg);
+			}
+			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30132);
+		}
+
+		// 模式三：密码式
+		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.password)) {
+			SaClientModel cm = currClientModel();
+			if(cfg.getIsPassword() && (cm.isPassword || cm.isAutoMode)) {
+				return password(req, res, cfg);
+			}
+			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30133);
+		}
+
+		// 模式四：凭证式
+		if(req.isPath(Api.client_token) && req.isParam(Param.grant_type, GrantType.client_credentials)) {
+			SaClientModel cm = currClientModel();
+			if(cfg.getIsClient() && (cm.isClient || cm.isAutoMode)) {
+				return clientToken(req, res, cfg);
+			}
+			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30134);
+		}
+
+		// 默认返回
+		return SaOAuth2Consts.NOT_HANDLE;
+	}
+
+	/**
+	 * 模式一：Code授权码 / 模式二：隐藏式
+	 * @param req 请求对象
+	 * @param res 响应对象
+	 * @param cfg 配置对象
+	 * @return 处理结果
+	 */
+	public Object authorize(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+		
+		// 1、如果尚未登录, 则先去登录
+		if( ! StpUtil.isLogin()) {
+			return cfg.getNotLoginView().get();
+		}
+
+		// 2、构建请求Model
+		RequestAuthModel ra = oauth2Template.generateRequestAuth(req, StpUtil.getLoginId());
+
+		// 3、校验：重定向域名是否合法
+		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
+
+		// 4、校验：此次申请的Scope，该Client是否已经签约
+		oauth2Template.checkContract(ra.clientId, ra.scope);
+
+		// 5、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
+		boolean isGrant = oauth2Template.isGrant(ra.loginId, ra.clientId, ra.scope);
+		if( ! isGrant) {
+			return cfg.getConfirmView().apply(ra.clientId, ra.scope);
+		}
+
+		// 6、判断授权类型
+		// 如果是 授权码式，则：开始重定向授权，下放code
+		if(ResponseType.code.equals(ra.responseType)) {
+			CodeModel codeModel = oauth2Template.generateCode(ra);
+			String redirectUri = oauth2Template.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
+			return res.redirect(redirectUri);
+		}
+		
+		// 如果是 隐藏式，则：开始重定向授权，下放 token
+		if(ResponseType.token.equals(ra.responseType)) {
+			AccessTokenModel at = oauth2Template.generateAccessToken(ra, false);
+			String redirectUri = oauth2Template.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
+			return res.redirect(redirectUri);
+		}
+
+		// 默认返回
+		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
+	}
+
+	/**
+	 * Code授权码 获取 Access-Token
+	 * @param req 请求对象
+	 * @param res 响应对象
+	 * @param cfg 配置对象
+	 * @return 处理结果
+	 */
+	public Object token(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+		// 获取参数
+		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
+		String clientId;
+		String clientSecret;
+		// gitlab回调token接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
+		if(SaFoxUtil.isEmpty(authorizationValue)){
+			clientId = req.getParamNotNull(Param.client_id);
+			clientSecret = req.getParamNotNull(Param.client_secret);
+		} else {
+			String[] clientIdAndSecret = authorizationValue.split(":");
+			clientId = clientIdAndSecret[0];
+			clientSecret = clientIdAndSecret[1];
+		}
+
+		String code = req.getParamNotNull(Param.code);
+		String redirectUri = req.getParam(Param.redirect_uri);
+
+		// 校验参数
+		oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
+
+		// 构建 Access-Token
+		AccessTokenModel token = oauth2Template.generateAccessToken(code);
+
+		// 返回
+		return SaResult.data(token.toLineMap());
+	}
+
+	/**
+	 * Refresh-Token 刷新 Access-Token
+	 * @param req 请求对象
+	 * @return 处理结果
+	 */
+	public Object refreshToken(SaRequest req) {
+		// 获取参数
+		String clientId = req.getParamNotNull(Param.client_id);
+		String clientSecret = req.getParamNotNull(Param.client_secret);
+		String refreshToken = req.getParamNotNull(Param.refresh_token);
+
+		// 校验参数
+		oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
+
+		// 获取新Token返回
+		Object data = oauth2Template.refreshAccessToken(refreshToken).toLineMap();
+		return SaResult.data(data);
+	}
+
+	/**
+	 * 回收 Access-Token
+	 * @param req 请求对象
+	 * @return 处理结果
+	 */
+	public Object revokeToken(SaRequest req) {
+		// 获取参数
+		String clientId = req.getParamNotNull(Param.client_id);
+		String clientSecret = req.getParamNotNull(Param.client_secret);
+		String accessToken = req.getParamNotNull(Param.access_token);
+
+		// 如果 Access-Token 不存在，直接返回
+		if(oauth2Template.getAccessToken(accessToken) == null) {
+			return SaResult.ok("access_token不存在：" + accessToken);
+		}
+
+		// 校验参数
+		oauth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
+
+		// 回收 Access-Token
+		oauth2Template.revokeAccessToken(accessToken);
+		return SaResult.ok();
+	}
+
+	/**
+	 * doLogin 登录接口
+	 * @param req 请求对象
+	 * @param res 响应对象
+	 * @param cfg 配置对象
+	 * @return 处理结果
+	 */
+	public Object doLogin(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+		return cfg.getDoLoginHandle().apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
+	}
+
+	/**
+	 * doConfirm 确认授权接口
+	 * @param req 请求对象
+	 * @return 处理结果
+	 */
+	public Object doConfirm(SaRequest req) {
+		String clientId = req.getParamNotNull(Param.client_id);
+		String scope = req.getParamNotNull(Param.scope);
+		Object loginId = StpUtil.getLoginId();
+		oauth2Template.saveGrantScope(clientId, loginId, scope);
+		return SaResult.ok();
+	}
+
+	/**
+	 * 模式三：密码式
+	 * @param req 请求对象
+	 * @param res 响应对象
+	 * @param cfg 配置对象
+	 * @return 处理结果
+	 */
+	public Object password(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+
+		// 1、获取请求参数
+		String username = req.getParamNotNull(Param.username);
+		String password = req.getParamNotNull(Param.password);
+		String clientId = req.getParamNotNull(Param.client_id);
+		String clientSecret = req.getParamNotNull(Param.client_secret);
+		String scope = req.getParam(Param.scope, "");
+
+		// 2、校验 ClientScope 和 scope 
+		oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scope);
+
+		// 3、防止因前端误传token造成逻辑干扰
+		// SaHolder.getStorage().set(StpUtil.stpLogic.splicingKeyJustCreatedSave(), "no-token");
+
+		// 3、调用API 开始登录，如果没能成功登录，则直接退出
+		Object retObj = cfg.getDoLoginHandle().apply(username, password);
+		if( ! StpUtil.isLogin()) {
+			return retObj;
+		}
+
+		// 4、构建 ra对象
+		RequestAuthModel ra = new RequestAuthModel();
+		ra.clientId = clientId;
+		ra.loginId = StpUtil.getLoginId();
+		ra.scope = scope;
+
+		// 5、生成 Access-Token
+		AccessTokenModel at = oauth2Template.generateAccessToken(ra, true);
+
+		// 6、返回 Access-Token
+		return SaResult.data(at.toLineMap());
+	}
+
+	/**
+	 * 模式四：凭证式
+	 * @param req 请求对象
+	 * @param res 响应对象
+	 * @param cfg 配置对象
+	 * @return 处理结果
+	 */
+	public Object clientToken(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+
+		// 获取参数
+		String clientId = req.getParamNotNull(Param.client_id);
+		String clientSecret = req.getParamNotNull(Param.client_secret);
+		String scope = req.getParam(Param.scope);
+
+		//校验 ClientScope
+		oauth2Template.checkContract(clientId, scope);
+
+		// 校验 ClientSecret
+		oauth2Template.checkClientSecret(clientId, clientSecret);
+
+		// 返回 Client-Token
+		ClientTokenModel ct = oauth2Template.generateClientToken(clientId, scope);
+
+		// 返回 Client-Token
+		return SaResult.data(ct.toLineMap());
+	}
+
+	/**
+	 * 根据当前请求提交的 client_id 参数获取 SaClientModel 对象 
+	 * @return / 
+	 */
+	public SaClientModel currClientModel() {
+		String clientId = SaHolder.getRequest().getParam(Param.client_id);
+		return oauth2Template.checkClientModel(clientId);
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
similarity index 98%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 2add96c5..f411e6aa 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -13,25 +13,20 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.logic;
-
-import java.util.List;
+package cn.dev33.satoken.oauth2.template;
 
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Consts.Param;
-import cn.dev33.satoken.oauth2.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.model.CodeModel;
-import cn.dev33.satoken.oauth2.model.RefreshTokenModel;
-import cn.dev33.satoken.oauth2.model.RequestAuthModel;
-import cn.dev33.satoken.oauth2.model.SaClientModel;
+import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
+import java.util.List;
+
 /**
  * Sa-Token-OAuth2 模块 代码实现
  *
@@ -40,15 +35,17 @@ import cn.dev33.satoken.util.SaFoxUtil;
  */
 public class SaOAuth2Template {
 
-	// ------------------- 获取数据 (开发者必须重写的函数)
+	// ------------------- 数据加载
+
 	/**
 	 * 根据id获取Client信息
 	 * @param clientId 应用id
 	 * @return ClientModel
 	 */
 	public SaClientModel getClientModel(String clientId) {
-		return null;
+		return SaOAuth2Manager.getDataLoader().getClientModel(clientId);
 	}
+
 	/**
 	 * 根据ClientId 和 LoginId 获取openid
 	 * @param clientId 应用id
@@ -56,7 +53,7 @@ public class SaOAuth2Template {
 	 * @return 此账号在此Client下的openid
 	 */
 	public String getOpenid(String clientId, Object loginId) {
-		return null;
+		return SaOAuth2Manager.getDataLoader().getOpenid(clientId, loginId);
 	}
 
 	// ------------------- 资源校验API
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
similarity index 72%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Util.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 856900d7..25bbfc41 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -13,15 +13,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.logic;
+package cn.dev33.satoken.oauth2.template;
 
 import cn.dev33.satoken.context.model.SaRequest;
-import cn.dev33.satoken.oauth2.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.model.CodeModel;
-import cn.dev33.satoken.oauth2.model.RefreshTokenModel;
-import cn.dev33.satoken.oauth2.model.RequestAuthModel;
-import cn.dev33.satoken.oauth2.model.SaClientModel;
+import cn.dev33.satoken.oauth2.model.*;
+import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
 /**
  * Sa-Token-OAuth2 模块 工具类
@@ -30,12 +26,6 @@ import cn.dev33.satoken.oauth2.model.SaClientModel;
  * @since 1.23.0
  */
 public class SaOAuth2Util {
-
-	/**
-	 * 模板代码对象 
-	 */
-	public static SaOAuth2Template saOAuth2Template = new SaOAuth2Template();
-
 	
 	// ------------------- 资源校验API  
 	
@@ -45,7 +35,7 @@ public class SaOAuth2Util {
 	 * @return ClientModel 
 	 */
 	public static SaClientModel checkClientModel(String clientId) {
-		return saOAuth2Template.checkClientModel(clientId);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientModel(clientId);
 	}
 	
 	/**
@@ -54,7 +44,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static AccessTokenModel checkAccessToken(String accessToken) {
-		return saOAuth2Template.checkAccessToken(accessToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkAccessToken(accessToken);
 	}
 	
 	/**
@@ -63,7 +53,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static ClientTokenModel checkClientToken(String clientToken) {
-		return saOAuth2Template.checkClientToken(clientToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientToken(clientToken);
 	}
 	
 	/**
@@ -72,7 +62,7 @@ public class SaOAuth2Util {
 	 * @return LoginId 
 	 */
 	public static Object getLoginIdByAccessToken(String accessToken) {
-		return saOAuth2Template.getLoginIdByAccessToken(accessToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getLoginIdByAccessToken(accessToken);
 	}
 	
 	/**
@@ -81,7 +71,7 @@ public class SaOAuth2Util {
 	 * @param scopes 需要校验的权限列表 
 	 */
 	public static void checkScope(String accessToken, String... scopes) {
-		saOAuth2Template.checkScope(accessToken, scopes);
+		SaOAuth2ServerProcessor.instance.oauth2Template.checkScope(accessToken, scopes);
 	}
 	
 	/**
@@ -90,7 +80,7 @@ public class SaOAuth2Util {
 	 * @param scopes 需要校验的权限列表
 	 */
 	public static void checkClientTokenScope(String clientToken, String... scopes) {
-		saOAuth2Template.checkClientTokenScope(clientToken, scopes);
+		SaOAuth2ServerProcessor.instance.oauth2Template.checkClientTokenScope(clientToken, scopes);
 	}
 
 	// ------------------- generate 构建数据 
@@ -102,7 +92,7 @@ public class SaOAuth2Util {
 	 * @return RequestAuthModel对象 
 	 */
 	public static RequestAuthModel generateRequestAuth(SaRequest req, Object loginId) {
-		return saOAuth2Template.generateRequestAuth(req, loginId);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateRequestAuth(req, loginId);
 	}
 	
 	/**
@@ -111,7 +101,7 @@ public class SaOAuth2Util {
 	 * @return 授权码Model
 	 */
 	public static CodeModel generateCode(RequestAuthModel ra) {
-		return saOAuth2Template.generateCode(ra);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateCode(ra);
 	}
 	
 	/**
@@ -120,7 +110,7 @@ public class SaOAuth2Util {
 	 * @return AccessToken Model
 	 */
 	public static AccessTokenModel generateAccessToken(String code) {
-		return saOAuth2Template.generateAccessToken(code);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateAccessToken(code);
 	}
 
 	/**
@@ -129,7 +119,7 @@ public class SaOAuth2Util {
 	 * @return 新的 Access-Token 
 	 */
 	public static AccessTokenModel refreshAccessToken(String refreshToken) {
-		return saOAuth2Template.refreshAccessToken(refreshToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.refreshAccessToken(refreshToken);
 	}
 
 	/**
@@ -139,7 +129,7 @@ public class SaOAuth2Util {
 	 * @return Access-Token Model 
 	 */
 	public static AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt) {
-		return saOAuth2Template.generateAccessToken(ra, isCreateRt);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateAccessToken(ra, isCreateRt);
 	}
 	
 	/**
@@ -149,7 +139,7 @@ public class SaOAuth2Util {
 	 * @return Client-Token Model 
 	 */
 	public static ClientTokenModel generateClientToken(String clientId, String scope) {
-		return saOAuth2Template.generateClientToken(clientId, scope);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateClientToken(clientId, scope);
 	}
 	
 	/**
@@ -160,7 +150,7 @@ public class SaOAuth2Util {
 	 * @return 构建完毕的URL 
 	 */
 	public static String buildRedirectUri(String redirectUri, String code, String state) {
-		return saOAuth2Template.buildRedirectUri(redirectUri, code, state);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.buildRedirectUri(redirectUri, code, state);
 	}
 
 	/**
@@ -171,7 +161,7 @@ public class SaOAuth2Util {
 	 * @return 构建完毕的URL 
 	 */
 	public static String buildImplicitRedirectUri(String redirectUri, String token, String state) {
-		return saOAuth2Template.buildImplicitRedirectUri(redirectUri, token, state);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.buildImplicitRedirectUri(redirectUri, token, state);
 	}
 	
 	/**
@@ -179,7 +169,7 @@ public class SaOAuth2Util {
 	 * @param accessToken Access-Token值 
 	 */
 	public static void revokeAccessToken(String accessToken) {
-		saOAuth2Template.revokeAccessToken(accessToken);
+		SaOAuth2ServerProcessor.instance.oauth2Template.revokeAccessToken(accessToken);
 	}
 	
 	// ------------------- 数据校验 
@@ -192,7 +182,7 @@ public class SaOAuth2Util {
 	 * @return 是否已经授权
 	 */
 	public static boolean isGrant(Object loginId, String clientId, String scope) {
-		return saOAuth2Template.isGrant(loginId, clientId, scope);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.isGrant(loginId, clientId, scope);
 	}
 	
 	/**
@@ -201,7 +191,7 @@ public class SaOAuth2Util {
 	 * @param scope 权限(多个用逗号隔开) 
 	 */
 	public static void checkContract(String clientId, String scope) {
-		saOAuth2Template.checkContract(clientId, scope);
+		SaOAuth2ServerProcessor.instance.oauth2Template.checkContract(clientId, scope);
 	}
 	
 	/**
@@ -210,7 +200,7 @@ public class SaOAuth2Util {
 	 * @param url 指定url
 	 */
 	public static void checkRightUrl(String clientId, String url) {
-		saOAuth2Template.checkRightUrl(clientId, url);
+		SaOAuth2ServerProcessor.instance.oauth2Template.checkRightUrl(clientId, url);
 	}
 	
 	/**
@@ -220,7 +210,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象 
 	 */
 	public static SaClientModel checkClientSecret(String clientId, String clientSecret) {
-		return saOAuth2Template.checkClientSecret(clientId, clientSecret);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientSecret(clientId, clientSecret);
 	}
 	
 	/**
@@ -231,7 +221,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象
 	 */
 	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, String scopes) {
-		return saOAuth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
 	}
 	
 	/**
@@ -243,7 +233,7 @@ public class SaOAuth2Util {
 	 * @return CodeModel对象 
 	 */
 	public static CodeModel checkGainTokenParam(String code, String clientId, String clientSecret, String redirectUri) {
-		return saOAuth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
 	}
 
 	/**
@@ -254,7 +244,7 @@ public class SaOAuth2Util {
 	 * @return CodeModel对象 
 	 */
 	public static RefreshTokenModel checkRefreshTokenParam(String clientId, String clientSecret, String refreshToken) {
-		return saOAuth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
 	}
 	
 	/**
@@ -265,7 +255,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象 
 	 */
 	public static AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
-		return saOAuth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
 	}
 	
 	// ------------------- save 数据 
@@ -277,7 +267,7 @@ public class SaOAuth2Util {
 	 * @param scope 权限列表(多个逗号隔开) 
 	 */
 	public static void saveGrantScope(String clientId, Object loginId, String scope) {
-		saOAuth2Template.saveGrantScope(clientId, loginId, scope);
+		SaOAuth2ServerProcessor.instance.oauth2Template.saveGrantScope(clientId, loginId, scope);
 	}
 	
 	
@@ -289,7 +279,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static CodeModel getCode(String code) {
-		return saOAuth2Template.getCode(code);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getCode(code);
 	}
 
 	/**
@@ -298,7 +288,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static AccessTokenModel getAccessToken(String accessToken) {
-		return saOAuth2Template.getAccessToken(accessToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getAccessToken(accessToken);
 	}
 	
 	/**
@@ -307,7 +297,7 @@ public class SaOAuth2Util {
 	 * @return . 
 	 */
 	public static RefreshTokenModel getRefreshToken(String refreshToken) {
-		return saOAuth2Template.getRefreshToken(refreshToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getRefreshToken(refreshToken);
 	}
 	
 	/**
@@ -316,7 +306,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static ClientTokenModel getClientToken(String clientToken) {
-		return saOAuth2Template.getClientToken(clientToken);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getClientToken(clientToken);
 	}
 	
 	/**
@@ -326,7 +316,7 @@ public class SaOAuth2Util {
 	 * @return 权限 
 	 */
 	public static String getGrantScope(String clientId, Object loginId) {
-		return saOAuth2Template.getGrantScope(clientId, loginId);
+		return SaOAuth2ServerProcessor.instance.oauth2Template.getGrantScope(clientId, loginId);
 	}
 
 }
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
index 0b01e86e..5c7626c5 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
@@ -17,8 +17,8 @@ package cn.dev33.satoken.solon.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Template;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Util;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import org.noear.solon.annotation.Bean;
 import org.noear.solon.annotation.Condition;
 import org.noear.solon.annotation.Configuration;
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index e7629909..a7aa8b24 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -15,18 +15,18 @@
  */
 package cn.dev33.satoken.spring.oauth2;
 
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 
-import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Template;
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Util;
 
-/*
-	小提示：如果你在 idea 中运行源码时出现异常：java: 程序包cn.dev33.satoken.oauth2不存在。
-			在项目根目录进入 cmd，执行 mvn package 即可解决
- */
+// 小提示：如果你在 idea 中运行源码时出现异常：java: 程序包cn.dev33.satoken.oauth2不存在。
+// 在项目根目录进入 cmd，执行 mvn package 即可解决
+
 
 /**
  * 注入 Sa-Token-OAuth2 所需要的组件
@@ -54,7 +54,17 @@ public class SaOAuth2BeanInject {
 	 */
 	@Autowired(required = false)
 	public void setSaOAuth2Interface(SaOAuth2Template saOAuth2Template) {
-		SaOAuth2Util.saOAuth2Template = saOAuth2Template;
+		SaOAuth2ServerProcessor.instance.oauth2Template = saOAuth2Template;
 	}
-	
+
+	/**
+	 * 注入 OAuth2 数据加载器
+	 *
+	 * @param dataLoader /
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2Interface(SaOAuth2DataLoader dataLoader) {
+		SaOAuth2Manager.setDataLoader(dataLoader);
+	}
+
 }
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
index 26ce74cb..2a4a5ed7 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
@@ -31,7 +31,7 @@ import org.springframework.context.annotation.Bean;
 public class SaOAuth2BeanRegister {
 
 	/**
-	 * 获取 OAuth2 配置对象
+	 * 获取 OAuth2 配置 Bean
 	 *
 	 * @return 配置对象 
 	 */
@@ -40,5 +40,5 @@ public class SaOAuth2BeanRegister {
 	public SaOAuth2Config getSaOAuth2Config() {
 		return new SaOAuth2Config();
 	}
-	
+
 }
diff --git a/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/inject/MySaOAuth2Template.java b/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/inject/MySaOAuth2Template.java
index a08c90a5..9324cd39 100644
--- a/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/inject/MySaOAuth2Template.java
+++ b/sa-token-test/sa-token-springboot-test/src/test/java/cn/dev33/satoken/integrate/configure/inject/MySaOAuth2Template.java
@@ -17,7 +17,7 @@ package cn.dev33.satoken.integrate.configure.inject;
 
 import org.springframework.stereotype.Component;
 
-import cn.dev33.satoken.oauth2.logic.SaOAuth2Template;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 
 /**
  * 自定义 Sa-OAuth2 模板方法 
-- 
Gitee


From 6c0d856cb8f9b5c775dca2694d5f64983c9d08f9 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 12 Aug 2024 07:36:43 +0800
Subject: [PATCH 115/172] =?UTF-8?q?sa-token-oauth2=20=E9=80=82=E9=85=8D?=
 =?UTF-8?q?=E6=8B=86=E5=88=86=E5=BC=8F=E8=B7=AF=E7=94=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../processor/SaOAuth2ServerProcessor.java    | 91 +++++++++++--------
 1 file changed, 52 insertions(+), 39 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 1447e7be..f0268130 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -21,14 +21,14 @@ import cn.dev33.satoken.context.model.SaResponse;
 import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaFoxUtil;
@@ -69,41 +69,41 @@ public class SaOAuth2ServerProcessor {
 		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.code)) {
 			SaClientModel cm = currClientModel();
 			if(cfg.getIsCode() && (cm.isCode || cm.isAutoMode)) {
-				return authorize(req, res, cfg);
+				return authorize();
 			}
 			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
 		}
 		
 		// Code授权码 获取 Access-Token
 		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.authorization_code)) {
-			return token(req, res, cfg);
+			return token();
 		}
 
 		// Refresh-Token 刷新 Access-Token
 		if(req.isPath(Api.refresh) && req.isParam(Param.grant_type, GrantType.refresh_token)) {
-			return refreshToken(req);
+			return refreshToken();
 		}
 
 		// 回收 Access-Token
 		if(req.isPath(Api.revoke)) {
-			return revokeToken(req);
+			return revokeToken();
 		}
 
 		// doLogin 登录接口
 		if(req.isPath(Api.doLogin)) {
-			return doLogin(req, res, cfg);
+			return doLogin();
 		}
 
 		// doConfirm 确认授权接口
 		if(req.isPath(Api.doConfirm)) {
-			return doConfirm(req);
+			return doConfirm();
 		}
 
 		// 模式二：隐藏式
 		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.token)) {
 			SaClientModel cm = currClientModel();
 			if(cfg.getIsImplicit() && (cm.isImplicit || cm.isAutoMode)) {
-				return authorize(req, res, cfg);
+				return authorize();
 			}
 			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30132);
 		}
@@ -112,7 +112,7 @@ public class SaOAuth2ServerProcessor {
 		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.password)) {
 			SaClientModel cm = currClientModel();
 			if(cfg.getIsPassword() && (cm.isPassword || cm.isAutoMode)) {
-				return password(req, res, cfg);
+				return password();
 			}
 			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30133);
 		}
@@ -121,7 +121,7 @@ public class SaOAuth2ServerProcessor {
 		if(req.isPath(Api.client_token) && req.isParam(Param.grant_type, GrantType.client_credentials)) {
 			SaClientModel cm = currClientModel();
 			if(cfg.getIsClient() && (cm.isClient || cm.isAutoMode)) {
-				return clientToken(req, res, cfg);
+				return clientToken();
 			}
 			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30134);
 		}
@@ -132,13 +132,14 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * 模式一：Code授权码 / 模式二：隐藏式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
 	 * @return 处理结果
 	 */
-	public Object authorize(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
-		
+	public Object authorize() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+
 		// 1、如果尚未登录, 则先去登录
 		if( ! StpUtil.isLogin()) {
 			return cfg.getNotLoginView().get();
@@ -180,12 +181,14 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * Code授权码 获取 Access-Token
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
 	 * @return 处理结果
 	 */
-	public Object token(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+	public Object token() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+
 		// 获取参数
 		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
 		String clientId;
@@ -215,10 +218,12 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * Refresh-Token 刷新 Access-Token
-	 * @param req 请求对象
 	 * @return 处理结果
 	 */
-	public Object refreshToken(SaRequest req) {
+	public Object refreshToken() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+
 		// 获取参数
 		String clientId = req.getParamNotNull(Param.client_id);
 		String clientSecret = req.getParamNotNull(Param.client_secret);
@@ -234,10 +239,12 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * 回收 Access-Token
-	 * @param req 请求对象
 	 * @return 处理结果
 	 */
-	public Object revokeToken(SaRequest req) {
+	public Object revokeToken() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+
 		// 获取参数
 		String clientId = req.getParamNotNull(Param.client_id);
 		String clientSecret = req.getParamNotNull(Param.client_secret);
@@ -258,21 +265,25 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * doLogin 登录接口
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
 	 * @return 处理结果
 	 */
-	public Object doLogin(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+	public Object doLogin() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+
 		return cfg.getDoLoginHandle().apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
 	}
 
 	/**
 	 * doConfirm 确认授权接口
-	 * @param req 请求对象
 	 * @return 处理结果
 	 */
-	public Object doConfirm(SaRequest req) {
+	public Object doConfirm() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+
 		String clientId = req.getParamNotNull(Param.client_id);
 		String scope = req.getParamNotNull(Param.scope);
 		Object loginId = StpUtil.getLoginId();
@@ -282,12 +293,13 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * 模式三：密码式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
 	 * @return 处理结果
 	 */
-	public Object password(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+	public Object password() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 1、获取请求参数
 		String username = req.getParamNotNull(Param.username);
@@ -323,12 +335,13 @@ public class SaOAuth2ServerProcessor {
 
 	/**
 	 * 模式四：凭证式
-	 * @param req 请求对象
-	 * @param res 响应对象
-	 * @param cfg 配置对象
 	 * @return 处理结果
 	 */
-	public Object clientToken(SaRequest req, SaResponse res, SaOAuth2Config cfg) {
+	public Object clientToken() {
+		// 获取变量
+		SaRequest req = SaHolder.getRequest();
+		SaResponse res = SaHolder.getResponse();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 获取参数
 		String clientId = req.getParamNotNull(Param.client_id);
-- 
Gitee


From b1e2e8a526244498568e2306bfe45b7f9218e3e0 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 12 Aug 2024 07:56:29 +0800
Subject: [PATCH 116/172] =?UTF-8?q?sa-token-oauth2=20=E9=80=82=E9=85=8D?=
 =?UTF-8?q?=E5=A4=9A=E8=B4=A6=E5=8F=B7=E6=A8=A1=E5=BC=8F=EF=BC=8C=E5=85=81?=
 =?UTF-8?q?=E8=AE=B8=E9=87=8D=E5=86=99=E4=BD=BF=E7=94=A8=E7=9A=84=E4=BC=9A?=
 =?UTF-8?q?=E8=AF=9D=20StpLogic?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../processor/SaOAuth2ServerProcessor.java    | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index f0268130..17abf829 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -30,6 +30,7 @@ import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
+import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -141,12 +142,12 @@ public class SaOAuth2ServerProcessor {
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 1、如果尚未登录, 则先去登录
-		if( ! StpUtil.isLogin()) {
+		if( ! getStpLogic().isLogin()) {
 			return cfg.getNotLoginView().get();
 		}
 
 		// 2、构建请求Model
-		RequestAuthModel ra = oauth2Template.generateRequestAuth(req, StpUtil.getLoginId());
+		RequestAuthModel ra = oauth2Template.generateRequestAuth(req, getStpLogic().getLoginId());
 
 		// 3、校验：重定向域名是否合法
 		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
@@ -286,7 +287,7 @@ public class SaOAuth2ServerProcessor {
 
 		String clientId = req.getParamNotNull(Param.client_id);
 		String scope = req.getParamNotNull(Param.scope);
-		Object loginId = StpUtil.getLoginId();
+		Object loginId = getStpLogic().getLoginId();
 		oauth2Template.saveGrantScope(clientId, loginId, scope);
 		return SaResult.ok();
 	}
@@ -298,7 +299,6 @@ public class SaOAuth2ServerProcessor {
 	public Object password() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 1、获取请求参数
@@ -312,18 +312,18 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scope);
 
 		// 3、防止因前端误传token造成逻辑干扰
-		// SaHolder.getStorage().set(StpUtil.stpLogic.splicingKeyJustCreatedSave(), "no-token");
+		// SaHolder.getStorage().set(getStpLogic().stpLogic.splicingKeyJustCreatedSave(), "no-token");
 
 		// 3、调用API 开始登录，如果没能成功登录，则直接退出
 		Object retObj = cfg.getDoLoginHandle().apply(username, password);
-		if( ! StpUtil.isLogin()) {
+		if( ! getStpLogic().isLogin()) {
 			return retObj;
 		}
 
 		// 4、构建 ra对象
 		RequestAuthModel ra = new RequestAuthModel();
 		ra.clientId = clientId;
-		ra.loginId = StpUtil.getLoginId();
+		ra.loginId = getStpLogic().getLoginId();
 		ra.scope = scope;
 
 		// 5、生成 Access-Token
@@ -369,5 +369,14 @@ public class SaOAuth2ServerProcessor {
 		String clientId = SaHolder.getRequest().getParam(Param.client_id);
 		return oauth2Template.checkClientModel(clientId);
 	}
-	
+
+	/**
+	 * 获取底层使用的会话对象
+	 *
+	 * @return /
+	 */
+	public StpLogic getStpLogic() {
+		return StpUtil.stpLogic;
+	}
+
 }
-- 
Gitee


From ae87b11d43b37a7c68824f6a4887ab2eda46fed9 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 13 Aug 2024 15:04:39 +0800
Subject: [PATCH 117/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20SaOAuth2DataResolv?=
 =?UTF-8?q?er=20=E6=95=B0=E6=8D=AE=E8=A7=A3=E6=9E=90=E5=99=A8=EF=BC=8C?=
 =?UTF-8?q?=E8=B4=9F=E8=B4=A3=20Web=20=E4=BA=A4=E4=BA=92=E5=B1=82=E9=9D=A2?=
 =?UTF-8?q?=E7=9A=84=E6=95=B0=E6=8D=AE=E8=BF=9B=E5=87=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/util/SaResult.java  | 45 ++++++++++-
 .../pj/oauth2/SaOAuthClientController.java    | 51 ++++++-------
 .../sa-token-demo-oauth2-server/pom.xml       |  2 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  2 +-
 .../pj/oauth2/SaOAuth2ServerController.java   |  3 +-
 .../dev33/satoken/oauth2/SaOAuth2Manager.java | 24 +++++-
 .../satoken/oauth2/consts/SaOAuth2Consts.java | 17 ++++-
 .../loader}/SaOAuth2DataLoader.java           |  2 +-
 .../SaOAuth2DataLoaderDefaultImpl.java        |  2 +-
 .../data/resolver/SaOAuth2DataResolver.java   | 76 +++++++++++++++++++
 .../SaOAuth2DataResolverDefaultImpl.java      | 68 +++++++++++++++++
 .../processor/SaOAuth2ServerProcessor.java    | 33 ++++----
 .../spring/oauth2/SaOAuth2BeanInject.java     |  2 +-
 13 files changed, 270 insertions(+), 57 deletions(-)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{dataloader => data/loader}/SaOAuth2DataLoader.java (96%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{dataloader => data/loader}/SaOAuth2DataLoaderDefaultImpl.java (94%)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
index 1cf36e2f..4d70c980 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
@@ -15,6 +15,8 @@
  */
 package cn.dev33.satoken.util;
 
+import cn.dev33.satoken.SaManager;
+
 import java.io.Serializable;
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -150,7 +152,42 @@ public class SaResult extends LinkedHashMap<String, Object> implements Serializa
 		}
 		return this;
 	}
-	
+
+	/**
+	 * 写入一个 json 字符串, 连缀风格
+	 * @param jsonString json 字符串
+	 * @return 对象自身
+	 */
+	public SaResult setJsonString(String jsonString) {
+		Map<String, Object> map = SaManager.getSaJsonTemplate().parseJsonToMap(jsonString);
+		return setMap(map);
+	}
+
+	/**
+	 * 移除默认属性（code、msg、data）, 连缀风格
+	 * @return 对象自身
+	 */
+	public SaResult removeDefaultFields() {
+		this.remove("code");
+		this.remove("msg");
+		this.remove("data");
+		return this;
+	}
+
+	/**
+	 * 移除非默认属性（code、msg、data）, 连缀风格
+	 * @return 对象自身
+	 */
+	public SaResult removeNonDefaultFields() {
+		for (String key : this.keySet()) {
+			if("code".equals(key) || "msg".equals(key) || "data".equals(key)) {
+				continue;
+			}
+			this.remove(key);
+		}
+		return this;
+	}
+
 	
 	// ============================  静态方法快速构建  ==================================
 	
@@ -180,7 +217,11 @@ public class SaResult extends LinkedHashMap<String, Object> implements Serializa
 	public static SaResult get(int code, String msg, Object data) {
 		return new SaResult(code, msg, data);
 	}
-	
+
+	// 构建一个空的
+	public static SaResult empty() {
+		return new SaResult();
+	}
 	
 	/* (non-Javadoc)
 	 * @see java.lang.Object#toString()
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
index 284901f0..cd7337e6 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
@@ -1,17 +1,15 @@
 package com.pj.oauth2;
 
-import javax.servlet.http.HttpServletRequest;
-
+import cn.dev33.satoken.stp.StpUtil;
+import cn.dev33.satoken.util.SaResult;
+import com.ejlchina.okhttps.OkHttps;
+import com.pj.utils.SoMap;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
 
-import com.ejlchina.okhttps.OkHttps;
-import com.pj.utils.SoMap;
-
-import cn.dev33.satoken.stp.StpUtil;
-import cn.dev33.satoken.util.SaResult;
+import javax.servlet.http.HttpServletRequest;
 
 /**
  * Sa-OAuth2 Client端 控制器 
@@ -21,9 +19,9 @@ import cn.dev33.satoken.util.SaResult;
 public class SaOAuthClientController {
 
 	// 相关参数配置 
-	private String clientId = "1001";								// 应用id 
-	private String clientSecret = "aaaa-bbbb-cccc-dddd-eeee";		// 应用秘钥 
-	private String serverUrl = "http://sa-oauth-server.com:8001";	// 服务端接口 
+	private final String clientId = "1001";								// 应用id
+	private final String clientSecret = "aaaa-bbbb-cccc-dddd-eeee";		// 应用秘钥
+	private final String serverUrl = "http://sa-oauth-server.com:8001";	// 服务端接口
 	
 	// 进入首页 
 	@RequestMapping("/")
@@ -52,14 +50,13 @@ public class SaOAuthClientController {
 			return SaResult.error(so.getString("msg"));
 		}
 
-		// 根据openid获取其对应的userId  
-		SoMap data = so.getMap("data");
-		long uid = getUserIdByOpenid(data.getString("openid"));
-		data.set("uid", uid);
+		// 根据openid获取其对应的userId
+		long uid = getUserIdByOpenid(so.getString("openid"));
+		so.set("uid", uid);
 		
 		// 返回相关参数 
 		StpUtil.login(uid);
-		return SaResult.data(data);
+		return SaResult.data(so);
 	}
 	
 	// 根据 Refresh-Token 去刷新 Access-Token 
@@ -82,9 +79,8 @@ public class SaOAuthClientController {
 			return SaResult.error(so.getString("msg"));
 		}
 
-		// 返回相关参数 (data=新的Access-Token )
-		SoMap data = so.getMap("data");
-		return SaResult.data(data);
+		// 返回相关参数
+		return SaResult.data(so);
 	}
 	
 	// 模式三：密码式-授权登录
@@ -108,14 +104,13 @@ public class SaOAuthClientController {
 			return SaResult.error(so.getString("msg"));
 		}
 
-		// 根据openid获取其对应的userId  
-		SoMap data = so.getMap("data");
-		long uid = getUserIdByOpenid(data.getString("openid"));
-		data.set("uid", uid);
+		// 根据openid获取其对应的userId
+		long uid = getUserIdByOpenid(so.getString("openid"));
+		so.set("uid", uid);
 		
 		// 返回相关参数 
 		StpUtil.login(uid);
-		return SaResult.data(data);
+		return SaResult.data(so);
 	}
 	
 	// 模式四：获取应用的 Client-Token 
@@ -137,9 +132,8 @@ public class SaOAuthClientController {
 			return SaResult.error(so.getString("msg"));
 		}
 
-		// 返回相关参数 (data=新的Client-Token ) 
-		SoMap data = so.getMap("data");
-		return SaResult.data(data);
+		// 返回相关参数
+		return SaResult.data(so);
 	}
 	
 	// 注销登录 
@@ -166,9 +160,8 @@ public class SaOAuthClientController {
 			return SaResult.error(so.getString("msg"));
 		}
 
-		// 返回相关参数 (data=获取到的资源 ) 
-		SoMap data = so.getMap("data");
-		return SaResult.data(data);
+		// 返回相关参数 (data=获取到的资源 )
+		return SaResult.data(so);
 	}
 	
 	// 全局异常拦截 
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
index 045c07a6..a9599fba 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
@@ -58,7 +58,7 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
 		</dependency>
-		
+
 		<!-- 热刷新 -->
 		<!--<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 78080fbd..4aa10f07 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -1,6 +1,6 @@
 package com.pj.oauth2;
 
-import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.model.SaClientModel;
 import org.springframework.stereotype.Component;
 
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 16771edd..f83a61c9 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -80,12 +80,13 @@ public class SaOAuth2ServerController {
 		
 		// 模拟账号信息 （真实环境需要查询数据库获取信息）
 		Map<String, Object> map = new LinkedHashMap<String, Object>();
+		map.put("userId", "10008");
 		map.put("nickname", "shengzhang_");
 		map.put("avatar", "http://xxx.com/1.jpg");
 		map.put("age", "18");
 		map.put("sex", "男");
 		map.put("address", "山东省 青岛市 城阳区");
-		return SaResult.data(map);
+		return SaResult.ok().setMap(map);
 	}
 	
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 05d206ff..70ebddcc 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -16,8 +16,10 @@
 package cn.dev33.satoken.oauth2;
 
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
-import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoaderDefaultImpl;
+import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoaderDefaultImpl;
+import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
+import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolverDefaultImpl;
 
 /**
  * Sa-Token-OAuth2 模块 总控类
@@ -64,4 +66,22 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.dataLoader = dataLoader;
 	}
 
+	/**
+	 * OAuth2 数据解析器 Bean
+	 */
+	private static volatile SaOAuth2DataResolver dataResolver;
+	public static SaOAuth2DataResolver getDataResolver() {
+		if (dataResolver == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (dataResolver == null) {
+					setDataResolver(new SaOAuth2DataResolverDefaultImpl());
+				}
+			}
+		}
+		return dataResolver;
+	}
+	public static void setDataResolver(SaOAuth2DataResolver dataResolver) {
+		SaOAuth2Manager.dataResolver = dataResolver;
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index 22a189bc..82d31df6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -77,7 +77,22 @@ public class SaOAuth2Consts {
 		public static String client_credentials = "client_credentials";
 		public static String implicit = "implicit";
 	}
-	
+
+	/**
+	 * 所有 token 类型
+	 */
+	public static final class TokenType {
+		// 全小写
+		public static String basic = "basic";
+		public static String digest = "digest";
+		public static String bearer = "bearer";
+
+		// 首字母大写
+		public static String Basic = "Basic";
+		public static String Digest = "Digest";
+		public static String Bearer = "Bearer";
+	}
+
 	/** 表示OK的返回结果 */
 	public static final String OK = "ok";
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
similarity index 96%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index 5b94679c..ab890941 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.dataloader;
+package cn.dev33.satoken.oauth2.data.loader;
 
 import cn.dev33.satoken.oauth2.model.SaClientModel;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoaderDefaultImpl.java
similarity index 94%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoaderDefaultImpl.java
index deedbf9b..a97f927e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dataloader/SaOAuth2DataLoaderDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoaderDefaultImpl.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.dataloader;
+package cn.dev33.satoken.oauth2.data.loader;
 
 /**
  * Sa-Token OAuth2 数据加载器 默认实现类
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
new file mode 100644
index 00000000..6d2f5a8e
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.resolver;
+
+import cn.dev33.satoken.oauth2.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.model.ClientTokenModel;
+import cn.dev33.satoken.util.SaResult;
+
+import java.util.Map;
+
+/**
+ * Sa-Token OAuth2 数据解析器，负责 Web 交互层面的数据进出：
+ *  <p>1、从请求中按照指定格式读取数据</p>
+ *  <p>2、构建数据输出格式</p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2DataResolver {
+
+
+    /**
+     * 构建返回值: 获取 token
+     * @param at token信息
+     * @return /
+     */
+    Map<String, Object> buildTokenReturnValue(AccessTokenModel at);
+
+    /**
+     * 构建返回值: RefreshToken 刷新 Access-Token
+     * @param at token信息
+     * @return /
+     */
+    default Map<String, Object> buildRefreshTokenReturnValue(AccessTokenModel at) {
+        return buildTokenReturnValue(at);
+    }
+
+    /**
+     * 构建返回值: 回收 Access-Token
+     * @return /
+     */
+    default Map<String, Object> buildRevokeTokenReturnValue() {
+        return SaResult.ok();
+    }
+
+    /**
+     * 构建返回值: password 模式认证 获取 token
+     * @param at token信息
+     * @return /
+     */
+    default Map<String, Object> buildPasswordReturnValue(AccessTokenModel at) {
+        return buildTokenReturnValue(at);
+    }
+
+    /**
+     * 构建返回值: 凭证式 模式认证 获取 token
+     * @param ct token信息
+     */
+    Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct);
+
+
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
new file mode 100644
index 00000000..79502123
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.resolver;
+
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
+import cn.dev33.satoken.oauth2.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.model.ClientTokenModel;
+import cn.dev33.satoken.util.SaResult;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Sa-Token OAuth2 数据解析器，负责 Web 交互层面的数据进出：
+ *  <p>1、从请求中按照指定格式读取数据</p>
+ *  <p>2、构建数据输出格式</p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
+
+    /**
+     * 构建返回值: 获取 token
+     */
+    public Map<String, Object> buildTokenReturnValue(AccessTokenModel at) {
+        Map<String, Object> map = new LinkedHashMap<>();
+        map.put("token_type", TokenType.bearer);
+        map.put("access_token", at.accessToken);
+        map.put("refresh_token", at.refreshToken);
+        map.put("expires_in", at.getExpiresIn());
+        map.put("refresh_expires_in", at.getRefreshExpiresIn());
+        map.put("client_id", at.clientId);
+        map.put("scope", at.scope);
+        map.put("openid", at.openid);
+        return SaResult.ok().setMap(map);
+    }
+
+    /**
+     * 构建返回值: password 模式认证 获取 token
+     */
+    @Override
+    public Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct) {
+        Map<String, Object> map = new LinkedHashMap<>();
+        map.put("client_token", ct.clientToken);
+        map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
+        map.put("expires_in", ct.getExpiresIn());
+        map.put("client_id", ct.clientId);
+        map.put("scope", ct.scope);
+        return SaResult.ok().setMap(map);
+    }
+
+
+}
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 17abf829..6b19c80f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -61,7 +61,6 @@ public class SaOAuth2ServerProcessor {
 
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// ------------------ 路由分发 ------------------
@@ -187,14 +186,13 @@ public class SaOAuth2ServerProcessor {
 	public Object token() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 获取参数
 		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
 		String clientId;
 		String clientSecret;
-		// gitlab回调token接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
+
+		// gitlab 回调 token 接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
 		if(SaFoxUtil.isEmpty(authorizationValue)){
 			clientId = req.getParamNotNull(Param.client_id);
 			clientSecret = req.getParamNotNull(Param.client_secret);
@@ -211,10 +209,10 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
 
 		// 构建 Access-Token
-		AccessTokenModel token = oauth2Template.generateAccessToken(code);
+		AccessTokenModel accessTokenModel = oauth2Template.generateAccessToken(code);
 
 		// 返回
-		return SaResult.data(token.toLineMap());
+		return SaOAuth2Manager.getDataResolver().buildTokenReturnValue(accessTokenModel);
 	}
 
 	/**
@@ -233,9 +231,11 @@ public class SaOAuth2ServerProcessor {
 		// 校验参数
 		oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
 
-		// 获取新Token返回
-		Object data = oauth2Template.refreshAccessToken(refreshToken).toLineMap();
-		return SaResult.data(data);
+		// 获取新 Access-Token
+		AccessTokenModel accessTokenModel = oauth2Template.refreshAccessToken(refreshToken);
+
+		// 返回
+		return SaOAuth2Manager.getDataResolver().buildRefreshTokenReturnValue(accessTokenModel);
 	}
 
 	/**
@@ -261,7 +261,9 @@ public class SaOAuth2ServerProcessor {
 
 		// 回收 Access-Token
 		oauth2Template.revokeAccessToken(accessToken);
-		return SaResult.ok();
+
+		// 返回
+		return SaOAuth2Manager.getDataResolver().buildRevokeTokenReturnValue();
 	}
 
 	/**
@@ -271,7 +273,6 @@ public class SaOAuth2ServerProcessor {
 	public Object doLogin() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		return cfg.getDoLoginHandle().apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
@@ -330,7 +331,7 @@ public class SaOAuth2ServerProcessor {
 		AccessTokenModel at = oauth2Template.generateAccessToken(ra, true);
 
 		// 6、返回 Access-Token
-		return SaResult.data(at.toLineMap());
+		return SaOAuth2Manager.getDataResolver().buildPasswordReturnValue(at);
 	}
 
 	/**
@@ -340,8 +341,6 @@ public class SaOAuth2ServerProcessor {
 	public Object clientToken() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaResponse res = SaHolder.getResponse();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// 获取参数
 		String clientId = req.getParamNotNull(Param.client_id);
@@ -354,11 +353,11 @@ public class SaOAuth2ServerProcessor {
 		// 校验 ClientSecret
 		oauth2Template.checkClientSecret(clientId, clientSecret);
 
-		// 返回 Client-Token
+		// 生成
 		ClientTokenModel ct = oauth2Template.generateClientToken(clientId, scope);
 
-		// 返回 Client-Token
-		return SaResult.data(ct.toLineMap());
+		// 返回
+		return SaOAuth2Manager.getDataResolver().buildClientTokenReturnValue(ct);
 	}
 
 	/**
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index a7aa8b24..0f4e1767 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -17,7 +17,7 @@ package cn.dev33.satoken.spring.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
-import cn.dev33.satoken.oauth2.dataloader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import org.springframework.beans.factory.annotation.Autowired;
-- 
Gitee


From 61c1ed221b701e0397b1ca4657121a75992414cb Mon Sep 17 00:00:00 2001
From: goodsWox <33800760+fooooxxxx@users.noreply.github.com>
Date: Wed, 14 Aug 2024 09:46:06 +0800
Subject: [PATCH 118/172] =?UTF-8?q?squash!=20=E4=BF=AE=E5=A4=8D=20SaLoginM?=
 =?UTF-8?q?odel=20=E7=9A=84=20timeout=20=E8=B6=85=E5=87=BA=E6=95=B4?=
 =?UTF-8?q?=E5=9E=8B=E8=8C=83=E5=9B=B4=E6=97=B6=E8=BF=94=E5=9B=9E=E8=B4=9F?=
 =?UTF-8?q?=E6=95=B0=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/dev33/satoken/stp/SaLoginModel.java    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
index f865b869..db019fed 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/SaLoginModel.java
@@ -15,14 +15,14 @@
  */
 package cn.dev33.satoken.stp;
 
+import java.util.LinkedHashMap;
+import java.util.Map;
+
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.dao.SaTokenDao;
 import cn.dev33.satoken.util.SaTokenConsts;
 
-import java.util.LinkedHashMap;
-import java.util.Map;
-
 /**
  * 在调用 `StpUtil.login()` 时的 配置参数 Model，决定登录的一些细节行为 <br>
  *
-- 
Gitee


From 890da5d934bb9731cef68bd10a5b24a981a9b27a Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 14 Aug 2024 11:33:54 +0800
Subject: [PATCH 119/172] =?UTF-8?q?=E6=9B=B4=E6=8D=A2Q=E7=BE=A4=E9=93=BE?=
 =?UTF-8?q?=E6=8E=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                       | 2 +-
 sa-token-doc/more/join-group.md | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 8ee0ded8..76aa9a4f 100644
--- a/README.md
+++ b/README.md
@@ -198,7 +198,7 @@ Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权
 ### 交流群
 <!-- QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)-->
 
-QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) 
+QQ交流群：823181187 [点击加入](https://qm.qq.com/q/EBIJVZBVGE) 
 
 微信交流群：
 
diff --git a/sa-token-doc/more/join-group.md b/sa-token-doc/more/join-group.md
index 0d37b8ba..1c02eed7 100644
--- a/sa-token-doc/more/join-group.md
+++ b/sa-token-doc/more/join-group.md
@@ -11,7 +11,8 @@
 <!-- QQ交流群：685792424 [点击加入](http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=Y05Ld4125W92YSwZ0gA8e3RhG9Q4Vsfx&authKey=IomXuIuhP9g8G7l%2ByfkrRsS7i%2Fna0lIBpkTXxx%2BQEaz0NNEyJq00kgeiC4dUyNLS&noverify=0&group_code=685792424)
  -->
  
-QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0)
+<!-- QQ交流群：936523917 [点击加入](https://qm.qq.com/q/xfoMJA5Az0) -->
+QQ交流群：823181187 [点击加入](https://qm.qq.com/q/EBIJVZBVGE) 
 
 ### 2、加入微信交流群：
 
-- 
Gitee


From 47cf8939cba08c378e8dcb3bb9bf3e592ba3aaea Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 14 Aug 2024 13:27:35 +0800
Subject: [PATCH 120/172] =?UTF-8?q?=E6=9B=B4=E6=94=B9=20sa-token-oauth2=20?=
 =?UTF-8?q?=E5=AE=9E=E4=BD=93=E7=B1=BB=E7=9B=B8=E5=85=B3=E5=8C=85=E4=BD=8D?=
 =?UTF-8?q?=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../cn/dev33/satoken/session/SaSession.java   |  16 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |   7 +-
 .../data/loader/SaOAuth2DataLoader.java       |   2 +-
 .../{ => data}/model/AccessTokenModel.java    |   2 +-
 .../{ => data}/model/ClientTokenModel.java    | 192 +++++++++---------
 .../oauth2/{ => data}/model/CodeModel.java    |   2 +-
 .../{ => data}/model/RefreshTokenModel.java   | 150 +++++++-------
 .../{ => data}/model/RequestAuthModel.java    |   2 +-
 .../{ => data}/model/SaClientModel.java       |   2 +-
 .../data/resolver/SaOAuth2DataResolver.java   |   4 +-
 .../SaOAuth2DataResolverDefaultImpl.java      |   4 +-
 .../processor/SaOAuth2ServerProcessor.java    |   2 +-
 .../oauth2/template/SaOAuth2Template.java     |   2 +-
 .../satoken/oauth2/template/SaOAuth2Util.java |   2 +-
 14 files changed, 202 insertions(+), 187 deletions(-)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/AccessTokenModel.java (98%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/ClientTokenModel.java (94%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/CodeModel.java (98%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/RefreshTokenModel.java (93%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/RequestAuthModel.java (98%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/{ => data}/model/SaClientModel.java (99%)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/session/SaSession.java b/sa-token-core/src/main/java/cn/dev33/satoken/session/SaSession.java
index 83d8bc2e..8e7f3e6f 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/session/SaSession.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/session/SaSession.java
@@ -96,7 +96,7 @@ public class SaSession implements SaSetValueInterface, Serializable {
 	/**
 	 * 所有挂载数据
 	 */
-	private final Map<String, Object> dataMap = new ConcurrentHashMap<>();
+	private Map<String, Object> dataMap = new ConcurrentHashMap<>();
 
 
 	// ----------------------- 构建相关
@@ -522,14 +522,26 @@ public class SaSession implements SaSetValueInterface, Serializable {
 		return dataMap;
 	}
 
+	/**
+	 * 设置数据挂载集合 (改变底层对象引用，将 dataMap 整个对象替换)
+	 * @param dataMap 数据集合
+	 *
+	 * @return 对象自身
+	 */
+	public SaSession setDataMap(Map<String, Object> dataMap) {
+		this.dataMap = dataMap;
+		return this;
+	}
+
 	/**
 	 * 写入数据集合 (不改变底层对象引用，只将此 dataMap 所有数据进行替换)
 	 * @param dataMap 数据集合 
 	 */
-	public void refreshDataMap(Map<String, Object> dataMap) {
+	public SaSession refreshDataMap(Map<String, Object> dataMap) {
 		this.dataMap.clear();
 		this.dataMap.putAll(dataMap);
 		this.update();
+		return this;
 	}
 
 	//
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 4aa10f07..626381f3 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -1,7 +1,8 @@
 package com.pj.oauth2;
 
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
-import cn.dev33.satoken.oauth2.model.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.secure.SaSecureUtil;
 import org.springframework.stereotype.Component;
 
 /**
@@ -31,7 +32,9 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	@Override
 	public String getOpenid(String clientId, Object loginId) {
 		// 此为模拟数据，真实环境需要从数据库查询 
-		return "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__";
+//		return "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__";
+		String prefix = "grSwoIN0MC1ewxHXvfCW3BothWDZMMtx";
+		return SaSecureUtil.md5(prefix + "_" + clientId + "_" + loginId);
 	}
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index ab890941..c9c5f75e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.oauth2.data.loader;
 
-import cn.dev33.satoken.oauth2.model.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.SaClientModel;
 
 /**
  * Sa-Token OAuth2 数据加载器
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/AccessTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
similarity index 98%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/AccessTokenModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
index 13e1726f..5ae94487 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/AccessTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.model;
+package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 import java.util.LinkedHashMap;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/ClientTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
similarity index 94%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/ClientTokenModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
index a24a83a9..012e7556 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/ClientTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
@@ -1,96 +1,96 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.oauth2.model;
-
-import java.io.Serializable;
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-/**
- * Model: Client-Token
- *
- * @author click33
- * @since 1.23.0
- */
-public class ClientTokenModel implements Serializable {
-
-	private static final long serialVersionUID = -6541180061782004705L;
-
-	/**
-	 * Client-Token 值
-	 */
-	public String clientToken;
-	
-	/**
-	 * Client-Token 到期时间 
-	 */
-	public long expiresTime;
-
-	/**
-	 * 应用id 
-	 */
-	public String clientId;
-
-	/**
-	 * 授权范围
-	 */
-	public String scope;  
-
-	public ClientTokenModel() {}
-	
-	/**
-	 * 构建一个 
-	 * @param accessToken accessToken
-	 * @param clientId 应用id 
-	 * @param scope 请求授权范围 
-	 */
-	public ClientTokenModel(String accessToken, String clientId, String scope) {
-		super();
-		this.clientToken = accessToken;
-		this.clientId = clientId;
-		this.scope = scope;
-	}
-	
-	@Override
-	public String toString() {
-		return "ClientTokenModel [clientToken=" + clientToken + ", expiresTime=" + expiresTime + ", clientId="
-				+ clientId + ", scope=" + scope + "]";
-	}
-	
-	/**
-	 * 获取：此 Client-Token 的剩余有效期（秒）
-	 * @return see note 
-	 */
-	public long getExpiresIn() {
-		long s = (expiresTime - System.currentTimeMillis()) / 1000;
-		return s < 1 ? -2 : s;
-	}
-	
-	/**
-	 * 将所有属性转换为下划线形式的Map 
-	 * @return 属性转Map 
-	 */
-	public Map<String, Object> toLineMap() {
-		Map<String, Object> map = new LinkedHashMap<>();
-		map.put("client_token", clientToken);
-		map.put("expires_in", getExpiresIn());
-		map.put("client_id", clientId);
-		map.put("scope", scope);	
-		return map;
-	}
-	
-	
-}
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.model;
+
+import java.io.Serializable;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Model: Client-Token
+ *
+ * @author click33
+ * @since 1.23.0
+ */
+public class ClientTokenModel implements Serializable {
+
+	private static final long serialVersionUID = -6541180061782004705L;
+
+	/**
+	 * Client-Token 值
+	 */
+	public String clientToken;
+	
+	/**
+	 * Client-Token 到期时间 
+	 */
+	public long expiresTime;
+
+	/**
+	 * 应用id 
+	 */
+	public String clientId;
+
+	/**
+	 * 授权范围
+	 */
+	public String scope;  
+
+	public ClientTokenModel() {}
+	
+	/**
+	 * 构建一个 
+	 * @param accessToken accessToken
+	 * @param clientId 应用id 
+	 * @param scope 请求授权范围 
+	 */
+	public ClientTokenModel(String accessToken, String clientId, String scope) {
+		super();
+		this.clientToken = accessToken;
+		this.clientId = clientId;
+		this.scope = scope;
+	}
+	
+	@Override
+	public String toString() {
+		return "ClientTokenModel [clientToken=" + clientToken + ", expiresTime=" + expiresTime + ", clientId="
+				+ clientId + ", scope=" + scope + "]";
+	}
+	
+	/**
+	 * 获取：此 Client-Token 的剩余有效期（秒）
+	 * @return see note 
+	 */
+	public long getExpiresIn() {
+		long s = (expiresTime - System.currentTimeMillis()) / 1000;
+		return s < 1 ? -2 : s;
+	}
+	
+	/**
+	 * 将所有属性转换为下划线形式的Map 
+	 * @return 属性转Map 
+	 */
+	public Map<String, Object> toLineMap() {
+		Map<String, Object> map = new LinkedHashMap<>();
+		map.put("client_token", clientToken);
+		map.put("expires_in", getExpiresIn());
+		map.put("client_id", clientId);
+		map.put("scope", scope);	
+		return map;
+	}
+	
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/CodeModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
similarity index 98%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/CodeModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
index 17f517d5..1e0a4918 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/CodeModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.model;
+package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RefreshTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
similarity index 93%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RefreshTokenModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
index d120a358..ae60d9f2 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RefreshTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
@@ -1,75 +1,75 @@
-/*
- * Copyright 2020-2099 sa-token.cc
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package cn.dev33.satoken.oauth2.model;
-
-import java.io.Serializable;
-
-/**
- * Model: Refresh-Token
- *
- * @author click33
- * @since 1.23.0
- */
-public class RefreshTokenModel implements Serializable {
-
-	private static final long serialVersionUID = -6541180061782004705L;
- 
-	/**
-	 * Refresh-Token 值
-	 */
-	public String refreshToken;
-
-	/**
-	 * Refresh-Token 到期时间 
-	 */
-	public long expiresTime;
-	
-	/**
-	 * 应用id 
-	 */
-	public String clientId;
-	
-	/**
-	 * 授权范围
-	 */
-	public String scope;
-
-	/**
-	 * 对应账号id 
-	 */
-	public Object loginId;
-
-	/**
-	 * 对应账号id 
-	 */
-	public String openid;
-
-	@Override
-	public String toString() {
-		return "RefreshTokenModel [refreshToken=" + refreshToken + ", expiresTime=" + expiresTime
-				+ ", clientId=" + clientId + ", scope=" + scope + ", loginId=" + loginId + ", openid=" + openid + "]";
-	}
-
-	/**
-	 * 获取：此 Refresh-Token 的剩余有效期（秒）
-	 * @return see note 
-	 */
-	public long getExpiresIn() {
-		long s = (expiresTime - System.currentTimeMillis()) / 1000;
-		return s < 1 ? -2 : s;
-	}
-	
-}
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.model;
+
+import java.io.Serializable;
+
+/**
+ * Model: Refresh-Token
+ *
+ * @author click33
+ * @since 1.23.0
+ */
+public class RefreshTokenModel implements Serializable {
+
+	private static final long serialVersionUID = -6541180061782004705L;
+ 
+	/**
+	 * Refresh-Token 值
+	 */
+	public String refreshToken;
+
+	/**
+	 * Refresh-Token 到期时间 
+	 */
+	public long expiresTime;
+	
+	/**
+	 * 应用id 
+	 */
+	public String clientId;
+	
+	/**
+	 * 授权范围
+	 */
+	public String scope;
+
+	/**
+	 * 对应账号id 
+	 */
+	public Object loginId;
+
+	/**
+	 * 对应账号id 
+	 */
+	public String openid;
+
+	@Override
+	public String toString() {
+		return "RefreshTokenModel [refreshToken=" + refreshToken + ", expiresTime=" + expiresTime
+				+ ", clientId=" + clientId + ", scope=" + scope + ", loginId=" + loginId + ", openid=" + openid + "]";
+	}
+
+	/**
+	 * 获取：此 Refresh-Token 的剩余有效期（秒）
+	 * @return see note 
+	 */
+	public long getExpiresIn() {
+		long s = (expiresTime - System.currentTimeMillis()) / 1000;
+		return s < 1 ? -2 : s;
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RequestAuthModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
similarity index 98%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RequestAuthModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
index 8c266e2e..3ee815ec 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/RequestAuthModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.model;
+package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
similarity index 99%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/SaClientModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
index f0a5ba3d..f7023eca 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/model/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.model;
+package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 6d2f5a8e..67d8da7f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -15,8 +15,8 @@
  */
 package cn.dev33.satoken.oauth2.data.resolver;
 
-import cn.dev33.satoken.oauth2.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.Map;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 79502123..b4df5ee1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -16,8 +16,8 @@
 package cn.dev33.satoken.oauth2.data.resolver;
 
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
-import cn.dev33.satoken.oauth2.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.LinkedHashMap;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 6b19c80f..af51d95f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -26,9 +26,9 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
+import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index f411e6aa..9d26c40d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -19,9 +19,9 @@ import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
+import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.model.*;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 25bbfc41..d40000e0 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.oauth2.template;
 
 import cn.dev33.satoken.context.model.SaRequest;
-import cn.dev33.satoken.oauth2.model.*;
+import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
 /**
-- 
Gitee


From 15e2d9f66880977779d3d150f5c258726bfa9444 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 14 Aug 2024 18:11:20 +0800
Subject: [PATCH 121/172] =?UTF-8?q?=E5=B0=86=20scope=20=E5=AD=97=E6=AE=B5?=
 =?UTF-8?q?=E6=94=B9=E4=B8=BA=20List=20=E7=B1=BB=E5=9E=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/util/SaFoxUtil.java |  3 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  4 +-
 .../pj/oauth2/SaOAuth2ServerController.java   | 36 ++++---
 .../dev33/satoken/oauth2/SaOAuth2Manager.java | 20 ++++
 .../satoken/oauth2/config/SaOAuth2Config.java | 59 ++---------
 .../data/convert/SaOAuth2DataConverter.java   | 49 +++++++++
 .../SaOAuth2DataConverterDefaultImpl.java     | 64 ++++++++++++
 .../oauth2/data/model/AccessTokenModel.java   | 91 +++++++++++++++--
 .../oauth2/data/model/ClientTokenModel.java   | 18 ++--
 .../satoken/oauth2/data/model/CodeModel.java  | 69 +++++--------
 .../oauth2/data/model/RefreshTokenModel.java  | 59 ++++++++++-
 .../oauth2/data/model/RequestAuthModel.java   | 17 ++--
 .../oauth2/data/model/SaClientModel.java      | 27 ++---
 .../SaOAuth2DataResolverDefaultImpl.java      |  5 +-
 .../function/SaOAuth2ConfirmViewFunction.java | 34 +++++++
 .../SaOAuth2DoLoginHandleFunction.java        | 33 +++++++
 .../SaOAuth2NotLoginViewFunction.java         | 33 +++++++
 .../processor/SaOAuth2ServerProcessor.java    | 29 +++---
 .../oauth2/template/SaOAuth2Template.java     | 99 ++++++++++---------
 .../satoken/oauth2/template/SaOAuth2Util.java | 32 +++---
 20 files changed, 544 insertions(+), 237 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2ConfirmViewFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2DoLoginHandleFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2NotLoginViewFunction.java

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
index a28a1072..530e1fbd 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
@@ -29,7 +29,6 @@ import java.time.ZonedDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.*;
 import java.util.concurrent.ThreadLocalRandom;
-import java.util.regex.Pattern;
 
 /**
  * Sa-Token 内部工具类
@@ -563,7 +562,7 @@ public class SaFoxUtil {
 	 * @return 字符串
 	 */
 	public static String convertListToString(List<?> list) {
-		if(list == null || list.size() == 0) {
+		if(list == null || list.isEmpty()) {
 			return "";
 		}
 		StringBuilder str = new StringBuilder();
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 626381f3..468d9bcd 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -5,6 +5,8 @@ import cn.dev33.satoken.oauth2.data.model.SaClientModel;
 import cn.dev33.satoken.secure.SaSecureUtil;
 import org.springframework.stereotype.Component;
 
+import java.util.Arrays;
+
 /**
  * Sa-Token OAuth2：自定义数据加载器
  *
@@ -22,7 +24,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientId("1001")
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
 					.setAllowUrl("*")
-					.setContractScope("userinfo")
+					.setContractScopes(Arrays.asList("userinfo"))
 					.setIsAutoMode(true);
 		}
 		return null;
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index f83a61c9..03fbbf60 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -34,27 +34,25 @@ public class SaOAuth2ServerController {
 	// Sa-OAuth2 定制化配置 
 	@Autowired
 	public void setSaOAuth2Config(SaOAuth2Config cfg) {
-		cfg.
-			// 未登录的视图 
-			setNotLoginView(()->{
-				return new ModelAndView("login.html");	
-			}).
+		// 未登录的视图
+		cfg.notLoginView = ()->{
+			return new ModelAndView("login.html");
+		};
 			// 登录处理函数 
-			setDoLoginHandle((name, pwd) -> {
-				if("sa".equals(name) && "123456".equals(pwd)) {
-					StpUtil.login(10001);
-					return SaResult.ok();
-				}
-				return SaResult.error("账号名或密码错误");
-			}).
+		cfg.doLoginHandle = (name, pwd) -> {
+			if("sa".equals(name) && "123456".equals(pwd)) {
+				StpUtil.login(10001);
+				return SaResult.ok();
+			}
+			return SaResult.error("账号名或密码错误");
+		};
 			// 授权确认视图 
-			setConfirmView((clientId, scope)->{
-				Map<String, Object> map = new HashMap<>();
-				map.put("clientId", clientId);
-				map.put("scope", scope);
-				return new ModelAndView("confirm.html", map); 
-			})
-			;
+		cfg.confirmView = (clientId, scope)->{
+			Map<String, Object> map = new HashMap<>();
+			map.put("clientId", clientId);
+			map.put("scope", scope);
+			return new ModelAndView("confirm.html", map);
+		};
 	}
 
 	// 全局异常拦截  
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 70ebddcc..88b07412 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -16,6 +16,8 @@
 package cn.dev33.satoken.oauth2;
 
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
+import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverterDefaultImpl;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoaderDefaultImpl;
 import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
@@ -84,4 +86,22 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.dataResolver = dataResolver;
 	}
 
+	/**
+	 * OAuth2 数据格式转换器
+	 */
+	private static volatile SaOAuth2DataConverter dataConverter;
+	public static SaOAuth2DataConverter getDataConverter() {
+		if (dataConverter == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (dataConverter == null) {
+					setDataConverter(new SaOAuth2DataConverterDefaultImpl());
+				}
+			}
+		}
+		return dataConverter;
+	}
+	public static void setDataConverter(SaOAuth2DataConverter dataConverter) {
+		SaOAuth2Manager.dataConverter = dataConverter;
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
index 4511f226..7478d63b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
@@ -15,11 +15,12 @@
  */
 package cn.dev33.satoken.oauth2.config;
 
+import cn.dev33.satoken.oauth2.function.SaOAuth2ConfirmViewFunction;
+import cn.dev33.satoken.oauth2.function.SaOAuth2DoLoginHandleFunction;
+import cn.dev33.satoken.oauth2.function.SaOAuth2NotLoginViewFunction;
 import cn.dev33.satoken.util.SaResult;
 
 import java.io.Serializable;
-import java.util.function.BiFunction;
-import java.util.function.Supplier;
 
 /**
  * Sa-Token-OAuth2 配置类 Model
@@ -218,65 +219,17 @@ public class SaOAuth2Config implements Serializable {
 	/**
 	 * OAuth-Server端：未登录时返回的View 
 	 */
-	public Supplier<Object> notLoginView = () -> "当前会话在OAuth-Server认证中心尚未登录";
+	public SaOAuth2NotLoginViewFunction notLoginView = () -> "当前会话在OAuth-Server认证中心尚未登录";
 
 	/**
 	 * OAuth-Server端：确认授权时返回的View 
 	 */
-	public BiFunction<String, String, Object> confirmView = (clientId, scope) -> "本次操作需要用户授权";
+	public SaOAuth2ConfirmViewFunction confirmView = (clientId, scopes) -> "本次操作需要用户授权";
 
 	/**
 	 * OAuth-Server端：登录函数 
 	 */
-	public BiFunction<String, String, Object> doLoginHandle = (name, pwd) -> SaResult.error();
-
-	/**
-	 * @param notLoginView OAuth-Server端：未登录时返回的View 
-	 * @return 对象自身
-	 */
-	public SaOAuth2Config setNotLoginView(Supplier<Object> notLoginView) {
-		this.notLoginView = notLoginView;
-		return this;
-	}
-
-	/**
-	 * @return 函数 OAuth-Server端：未登录时返回的View
-	 */
-	public Supplier<Object> getNotLoginView() {
-		return notLoginView;
-	}
-
-	/**
-	 * @param confirmView OAuth-Server端：确认授权时返回的View 
-	 * @return 对象自身
-	 */
-	public SaOAuth2Config setConfirmView(BiFunction<String, String, Object> confirmView) {
-		this.confirmView = confirmView;
-		return this;
-	}
-
-	/**
-	 * @return 函数 OAuth-Server端：确认授权时返回的View
-	 */
-	public BiFunction<String, String, Object> getConfirmView() {
-		return confirmView;
-	}
-
-	/**
-	 * @param doLoginHandle OAuth-Server端：登录函数 
-	 * @return 对象自身
-	 */
-	public SaOAuth2Config setDoLoginHandle(BiFunction<String, String, Object> doLoginHandle) {
-		this.doLoginHandle = doLoginHandle;
-		return this;
-	}
-
-	/**
-	 * @return 函数 OAuth-Server端：登录函数
-	 */
-	public BiFunction<String, String, Object> getDoLoginHandle() {
-		return doLoginHandle;
-	}
+	public SaOAuth2DoLoginHandleFunction doLoginHandle = (name, pwd) -> SaResult.error();
 
 	@Override
 	public String toString() {
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
new file mode 100644
index 00000000..9a9e953b
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.convert;
+
+import java.util.List;
+
+/**
+ * Sa-Token OAuth2 数据格式转换器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2DataConverter {
+
+    /**
+     * 转换 scope 数据格式：String -> List
+     * @param scopeString /
+     * @return /
+     */
+    List<String> convertScopeStringToList(String scopeString);
+
+    /**
+     * 转换 scope 数据格式：List -> String
+     * @param scopeList /
+     * @return /
+     */
+    String convertScopeListToString(List<String> scopeList);
+
+    /**
+     * 转换 AllowUrl 数据格式：String -> List
+     * @param allowUrl /
+     * @return /
+     */
+    List<String> convertAllowUrlStringToList(String allowUrl);
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
new file mode 100644
index 00000000..aa818ac2
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.convert;
+
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * Sa-Token OAuth2 数据格式转换器，默认实现类
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
+
+    /**
+     * 转换 scope 数据格式：String -> List
+     */
+    @Override
+    public List<String> convertScopeStringToList(String scopeString) {
+        if(SaFoxUtil.isEmpty(scopeString)) {
+            return Collections.emptyList();
+        }
+        // 兼容以下三种分隔符：空格、逗号、%20
+        scopeString = scopeString.replaceAll(" ", ",");
+        scopeString = scopeString.replaceAll("%20", ",");
+        return SaFoxUtil.convertStringToList(scopeString);
+    }
+
+    /**
+     * 转换 scope 数据格式：List -> String
+     */
+    @Override
+    public String convertScopeListToString(List<String> scopeList) {
+        return SaFoxUtil.convertListToString(scopeList);
+    }
+
+    /**
+     * 转换 AllowUrl 数据格式：String -> List
+     */
+    @Override
+    public List<String> convertAllowUrlStringToList(String allowUrl) {
+        if(SaFoxUtil.isEmpty(allowUrl)) {
+            return Collections.emptyList();
+        }
+        return SaFoxUtil.convertStringToList(allowUrl);
+    }
+}
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
index 5ae94487..d16974f6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
@@ -17,6 +17,7 @@ package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 /**
@@ -67,31 +68,106 @@ public class AccessTokenModel implements Serializable {
 	/**
 	 * 授权范围
 	 */
-	public String scope;  
+	public List<String> scopes;
 
 	public AccessTokenModel() {}
+
 	/**
 	 * 构建一个 
 	 * @param accessToken accessToken
 	 * @param clientId 应用id 
-	 * @param scope 请求授权范围 
+	 * @param scopes 请求授权范围
 	 * @param loginId 对应的账号id 
 	 */
-	public AccessTokenModel(String accessToken, String clientId, Object loginId, String scope) {
+	public AccessTokenModel(String accessToken, String clientId, Object loginId, List<String> scopes) {
 		super();
 		this.accessToken = accessToken;
 		this.clientId = clientId;
 		this.loginId = loginId;
-		this.scope = scope;
+		this.scopes = scopes;
 	}
-	
+
+
+	public String getAccessToken() {
+		return accessToken;
+	}
+
+	public AccessTokenModel setAccessToken(String accessToken) {
+		this.accessToken = accessToken;
+		return this;
+	}
+
+	public String getRefreshToken() {
+		return refreshToken;
+	}
+
+	public AccessTokenModel setRefreshToken(String refreshToken) {
+		this.refreshToken = refreshToken;
+		return this;
+	}
+
+	public long getExpiresTime() {
+		return expiresTime;
+	}
+
+	public AccessTokenModel setExpiresTime(long expiresTime) {
+		this.expiresTime = expiresTime;
+		return this;
+	}
+
+	public long getRefreshExpiresTime() {
+		return refreshExpiresTime;
+	}
+
+	public AccessTokenModel setRefreshExpiresTime(long refreshExpiresTime) {
+		this.refreshExpiresTime = refreshExpiresTime;
+		return this;
+	}
+
+	public String getClientId() {
+		return clientId;
+	}
+
+	public AccessTokenModel setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	public Object getLoginId() {
+		return loginId;
+	}
+
+	public AccessTokenModel setLoginId(Object loginId) {
+		this.loginId = loginId;
+		return this;
+	}
+
+	public String getOpenid() {
+		return openid;
+	}
+
+	public AccessTokenModel setOpenid(String openid) {
+		this.openid = openid;
+		return this;
+	}
+
+	public List<String> getScopes() {
+		return scopes;
+	}
+
+	public AccessTokenModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
+		return this;
+	}
+
 	@Override
 	public String toString() {
 		return "AccessTokenModel [accessToken=" + accessToken + ", refreshToken=" + refreshToken
 				+ ", accessTokenTimeout=" + expiresTime + ", refreshTokenTimeout=" + refreshExpiresTime
-				+ ", clientId=" + clientId + ", scope=" + scope + ", openid=" + openid + "]";
+				+ ", clientId=" + clientId + ", scopes=" + scopes + ", openid=" + openid + "]";
 	}
 
+	// 追加只读属性
 
 	/**
 	 * 获取：此 Access-Token 的剩余有效期（秒）
@@ -115,6 +191,7 @@ public class AccessTokenModel implements Serializable {
 	 * 将所有属性转换为下划线形式的Map 
 	 * @return 属性转Map
 	 */
+	@Deprecated
 	public Map<String, Object> toLineMap() {
 		Map<String, Object> map = new LinkedHashMap<>();
 		map.put("access_token", accessToken);
@@ -122,7 +199,7 @@ public class AccessTokenModel implements Serializable {
 		map.put("expires_in", getExpiresIn());
 		map.put("refresh_expires_in", getRefreshExpiresIn());
 		map.put("client_id", clientId);
-		map.put("scope", scope);
+		map.put("scopes", scopes);
 		map.put("openid", openid);
 		return map;
 	}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
index 012e7556..ab781719 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
@@ -17,6 +17,7 @@ package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 /**
@@ -47,7 +48,7 @@ public class ClientTokenModel implements Serializable {
 	/**
 	 * 授权范围
 	 */
-	public String scope;  
+	public List<String> scopes;
 
 	public ClientTokenModel() {}
 	
@@ -55,19 +56,19 @@ public class ClientTokenModel implements Serializable {
 	 * 构建一个 
 	 * @param accessToken accessToken
 	 * @param clientId 应用id 
-	 * @param scope 请求授权范围 
+	 * @param scopes 请求授权范围
 	 */
-	public ClientTokenModel(String accessToken, String clientId, String scope) {
+	public ClientTokenModel(String accessToken, String clientId, List<String> scopes) {
 		super();
 		this.clientToken = accessToken;
 		this.clientId = clientId;
-		this.scope = scope;
+		this.scopes = scopes;
 	}
 	
 	@Override
 	public String toString() {
 		return "ClientTokenModel [clientToken=" + clientToken + ", expiresTime=" + expiresTime + ", clientId="
-				+ clientId + ", scope=" + scope + "]";
+				+ clientId + ", scopes=" + scopes + "]";
 	}
 	
 	/**
@@ -80,15 +81,16 @@ public class ClientTokenModel implements Serializable {
 	}
 	
 	/**
-	 * 将所有属性转换为下划线形式的Map 
-	 * @return 属性转Map 
+	 * 将所有属性转换为下划线形式的Map
+	 * @return 属性转Map
 	 */
+	@Deprecated
 	public Map<String, Object> toLineMap() {
 		Map<String, Object> map = new LinkedHashMap<>();
 		map.put("client_token", clientToken);
 		map.put("expires_in", getExpiresIn());
 		map.put("client_id", clientId);
-		map.put("scope", scope);	
+		map.put("scopes", scopes);
 		return map;
 	}
 	
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
index 1e0a4918..57653f27 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/CodeModel.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
+import java.util.List;
 
 /**
  * Model: 授权码
@@ -40,7 +41,7 @@ public class CodeModel implements Serializable {
 	/**
 	 * 授权范围
 	 */
-	public String scope;
+	public List<String> scopes;
 
 	/**
 	 * 对应账号id 
@@ -62,93 +63,67 @@ public class CodeModel implements Serializable {
 	 * 构建一个 
 	 * @param code 授权码 
 	 * @param clientId 应用id 
-	 * @param scope 请求授权范围 
+	 * @param scopes 请求授权范围
 	 * @param loginId 对应的账号id 
 	 * @param redirectUri 重定向地址 
 	 */
-	public CodeModel(String code, String clientId, String scope, Object loginId, String redirectUri) {
+	public CodeModel(String code, String clientId, List<String> scopes, Object loginId, String redirectUri) {
 		super();
 		this.code = code;
 		this.clientId = clientId;
-		this.scope = scope;
+		this.scopes = scopes;
 		this.loginId = loginId;
 		this.redirectUri = redirectUri;
 	}
 
-	
-	/**
-	 * @return code
-	 */
 	public String getCode() {
 		return code;
 	}
 
-	/**
-	 * @param code 要设置的 code
-	 */
-	public void setCode(String code) {
+	public CodeModel setCode(String code) {
 		this.code = code;
+		return this;
 	}
 
-	/**
-	 * @return clientId
-	 */
 	public String getClientId() {
 		return clientId;
 	}
 
-	/**
-	 * @param clientId 要设置的 clientId
-	 */
-	public void setClientId(String clientId) {
+	public CodeModel setClientId(String clientId) {
 		this.clientId = clientId;
+		return this;
 	}
 
-	/**
-	 * @return scope
-	 */
-	public String getScope() {
-		return scope;
+	public List<String> getScopes() {
+		return scopes;
 	}
 
-	/**
-	 * @param scope 要设置的 scope
-	 */
-	public void setScope(String scope) {
-		this.scope = scope;
+	public CodeModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
+		return this;
 	}
 
-	/**
-	 * @return loginId
-	 */
 	public Object getLoginId() {
 		return loginId;
 	}
 
-	/**
-	 * @param loginId 要设置的 loginId
-	 */
-	public void setLoginId(Object loginId) {
+	public CodeModel setLoginId(Object loginId) {
 		this.loginId = loginId;
+		return this;
 	}
-	
-	/**
-	 * @return redirectUri
-	 */
+
 	public String getRedirectUri() {
 		return redirectUri;
 	}
-	
-	/**
-	 * @param redirectUri 要设置的 redirectUri
-	 */
-	public void setRedirectUri(String redirectUri) {
+
+	public CodeModel setRedirectUri(String redirectUri) {
 		this.redirectUri = redirectUri;
+		return this;
 	}
-	
+
 	@Override
 	public String toString() {
-		return "CodeModel [code=" + code + ", clientId=" + clientId + ", scope=" + scope + ", loginId=" + loginId
+		return "CodeModel [code=" + code + ", clientId=" + clientId + ", scopes=" + scopes + ", loginId=" + loginId
 				+ ", redirectUri=" + redirectUri + "]";
 	}
 	
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
index ae60d9f2..7f036358 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
+import java.util.List;
 
 /**
  * Model: Refresh-Token
@@ -45,7 +46,7 @@ public class RefreshTokenModel implements Serializable {
 	/**
 	 * 授权范围
 	 */
-	public String scope;
+	public List<String> scopes;
 
 	/**
 	 * 对应账号id 
@@ -57,10 +58,64 @@ public class RefreshTokenModel implements Serializable {
 	 */
 	public String openid;
 
+	public String getRefreshToken() {
+		return refreshToken;
+	}
+
+	public RefreshTokenModel setRefreshToken(String refreshToken) {
+		this.refreshToken = refreshToken;
+		return this;
+	}
+
+	public long getExpiresTime() {
+		return expiresTime;
+	}
+
+	public RefreshTokenModel setExpiresTime(long expiresTime) {
+		this.expiresTime = expiresTime;
+		return this;
+	}
+
+	public String getClientId() {
+		return clientId;
+	}
+
+	public RefreshTokenModel setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	public List<String> getScopes() {
+		return scopes;
+	}
+
+	public RefreshTokenModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
+		return this;
+	}
+
+	public Object getLoginId() {
+		return loginId;
+	}
+
+	public RefreshTokenModel setLoginId(Object loginId) {
+		this.loginId = loginId;
+		return this;
+	}
+
+	public String getOpenid() {
+		return openid;
+	}
+
+	public RefreshTokenModel setOpenid(String openid) {
+		this.openid = openid;
+		return this;
+	}
+
 	@Override
 	public String toString() {
 		return "RefreshTokenModel [refreshToken=" + refreshToken + ", expiresTime=" + expiresTime
-				+ ", clientId=" + clientId + ", scope=" + scope + ", loginId=" + loginId + ", openid=" + openid + "]";
+				+ ", clientId=" + clientId + ", scopes=" + scopes + ", loginId=" + loginId + ", openid=" + openid + "]";
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
index 3ee815ec..c6d6d3d4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
+import java.util.List;
 
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
@@ -39,7 +40,7 @@ public class RequestAuthModel implements Serializable {
 	/**
 	 * 授权范围
 	 */
-	public String scope;
+	public List<String> scopes;
 	
 	/**
 	 * 对应的账号id 
@@ -79,18 +80,18 @@ public class RequestAuthModel implements Serializable {
 	}
 
 	/**
-	 * @return scope
+	 * @return scopes
 	 */
-	public String getScope() {
-		return scope;
+	public List<String> getScopes() {
+		return scopes;
 	}
 
 	/**
-	 * @param scope 要设置的 scope
+	 * @param scopes 要设置的 scopes
 	 * @return 对象自身
 	 */
-	public RequestAuthModel setScope(String scope) {
-		this.scope = scope;
+	public RequestAuthModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
 		return this;
 	}
 
@@ -166,7 +167,7 @@ public class RequestAuthModel implements Serializable {
 		if(SaFoxUtil.isEmpty(clientId)) {
 			throw new SaOAuth2Exception("client_id 不可为空").setCode(SaOAuth2ErrorCode.CODE_30101);
 		}
-		if(SaFoxUtil.isEmpty(scope)) {
+		if(SaFoxUtil.isEmpty(scopes)) {
 			throw new SaOAuth2Exception("scope 不可为空").setCode(SaOAuth2ErrorCode.CODE_30102);
 		}
 		if(SaFoxUtil.isEmpty(redirectUri)) {
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
index f7023eca..8c944ba4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
@@ -15,11 +15,12 @@
  */
 package cn.dev33.satoken.oauth2.data.model;
 
-import java.io.Serializable;
-
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
 
+import java.io.Serializable;
+import java.util.List;
+
 /**
  * Client应用信息 Model
  *
@@ -43,7 +44,7 @@ public class SaClientModel implements Serializable {
 	/**
 	 * 应用签约的所有权限, 多个用逗号隔开 
 	 */
-	public String contractScope;
+	public List<String> contractScopes;
 	
 	/**
 	 * 应用允许授权的所有URL, 多个用逗号隔开 
@@ -93,11 +94,11 @@ public class SaClientModel implements Serializable {
 		this.clientTokenTimeout = config.getClientTokenTimeout();
 		this.pastClientTokenTimeout = config.getPastClientTokenTimeout();
 	}
-	public SaClientModel(String clientId, String clientSecret, String contractScope, String allowUrl) {
+	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, String allowUrl) {
 		super();
 		this.clientId = clientId;
 		this.clientSecret = clientSecret;
-		this.contractScope = contractScope;
+		this.contractScopes = contractScopes;
 		this.allowUrl = allowUrl;
 	}
 
@@ -134,18 +135,18 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @return 应用签约的所有权限, 多个用逗号隔开
+	 * @return 应用签约的所有权限
 	 */
-	public String getContractScope() {
-		return contractScope;
+	public List<String> getContractScopes() {
+		return contractScopes;
 	}
 
 	/**
-	 * @param contractScope 应用签约的所有权限, 多个用逗号隔开
+	 * @param contractScopes 应用签约的所有权限, 多个用逗号隔开
 	 * @return 对象自身 
 	 */
-	public SaClientModel setContractScope(String contractScope) {
-		this.contractScope = contractScope;
+	public SaClientModel setContractScopes(List<String> contractScopes) {
+		this.contractScopes = contractScopes;
 		return this;
 	}
 
@@ -329,8 +330,8 @@ public class SaClientModel implements Serializable {
 	// 
 	@Override
 	public String toString() {
-		return "SaClientModel [clientId=" + clientId + ", clientSecret=" + clientSecret + ", contractScope="
-				+ contractScope + ", allowUrl=" + allowUrl + ", isCode=" + isCode + ", isImplicit=" + isImplicit
+		return "SaClientModel [clientId=" + clientId + ", clientSecret=" + clientSecret + ", contractScopes="
+				+ contractScopes + ", allowUrl=" + allowUrl + ", isCode=" + isCode + ", isImplicit=" + isImplicit
 				+ ", isPassword=" + isPassword + ", isClient=" + isClient + ", isAutoMode=" + isAutoMode
 				+ ", isNewRefresh=" + isNewRefresh + ", accessTokenTimeout=" + accessTokenTimeout
 				+ ", refreshTokenTimeout=" + refreshTokenTimeout + ", clientTokenTimeout=" + clientTokenTimeout
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index b4df5ee1..1d437eb7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -15,6 +15,7 @@
  */
 package cn.dev33.satoken.oauth2.data.resolver;
 
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
@@ -44,7 +45,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("expires_in", at.getExpiresIn());
         map.put("refresh_expires_in", at.getRefreshExpiresIn());
         map.put("client_id", at.clientId);
-        map.put("scope", at.scope);
+        map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(at.scopes));
         map.put("openid", at.openid);
         return SaResult.ok().setMap(map);
     }
@@ -59,7 +60,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
         map.put("expires_in", ct.getExpiresIn());
         map.put("client_id", ct.clientId);
-        map.put("scope", ct.scope);
+        map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(ct.scopes));
         return SaResult.ok().setMap(map);
     }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2ConfirmViewFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2ConfirmViewFunction.java
new file mode 100644
index 00000000..6f38bcec
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2ConfirmViewFunction.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function;
+
+
+import java.util.List;
+import java.util.function.BiFunction;
+
+/**
+ * 函数式接口：OAuth-Server端 确认授权时返回的View
+ *
+ * <p>  参数：无  </p>
+ * <p>  返回：view 视图  </p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2ConfirmViewFunction extends BiFunction<String, List<String>, Object> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2DoLoginHandleFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2DoLoginHandleFunction.java
new file mode 100644
index 00000000..af699821
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2DoLoginHandleFunction.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function;
+
+
+import java.util.function.BiFunction;
+
+/**
+ * 函数式接口：登录函数
+ *
+ * <p>  参数：name, pwd  </p>
+ * <p>  返回：认证返回结果  </p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2DoLoginHandleFunction extends BiFunction<String, String, Object> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2NotLoginViewFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2NotLoginViewFunction.java
new file mode 100644
index 00000000..baf29c89
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/SaOAuth2NotLoginViewFunction.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function;
+
+
+import java.util.function.Supplier;
+
+/**
+ * 函数式接口：OAuth-Server端 未登录时返回的View
+ *
+ * <p>  参数：clientId, scope  </p>
+ * <p>  返回：view 视图  </p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2NotLoginViewFunction extends Supplier<Object> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index af51d95f..f732d813 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -35,6 +35,8 @@ import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
+import java.util.List;
+
 /**
  * Sa-Token OAuth2 请求处理器
  *
@@ -142,7 +144,7 @@ public class SaOAuth2ServerProcessor {
 
 		// 1、如果尚未登录, 则先去登录
 		if( ! getStpLogic().isLogin()) {
-			return cfg.getNotLoginView().get();
+			return cfg.notLoginView.get();
 		}
 
 		// 2、构建请求Model
@@ -152,12 +154,12 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
 
 		// 4、校验：此次申请的Scope，该Client是否已经签约
-		oauth2Template.checkContract(ra.clientId, ra.scope);
+		oauth2Template.checkContract(ra.clientId, ra.scopes);
 
 		// 5、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
-		boolean isGrant = oauth2Template.isGrant(ra.loginId, ra.clientId, ra.scope);
+		boolean isGrant = oauth2Template.isGrant(ra.loginId, ra.clientId, ra.scopes);
 		if( ! isGrant) {
-			return cfg.getConfirmView().apply(ra.clientId, ra.scope);
+			return cfg.confirmView.apply(ra.clientId, ra.scopes);
 		}
 
 		// 6、判断授权类型
@@ -275,7 +277,7 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
-		return cfg.getDoLoginHandle().apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
+		return cfg.doLoginHandle.apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
 	}
 
 	/**
@@ -288,8 +290,9 @@ public class SaOAuth2ServerProcessor {
 
 		String clientId = req.getParamNotNull(Param.client_id);
 		String scope = req.getParamNotNull(Param.scope);
+		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 		Object loginId = getStpLogic().getLoginId();
-		oauth2Template.saveGrantScope(clientId, loginId, scope);
+		oauth2Template.saveGrantScope(clientId, loginId, scopes);
 		return SaResult.ok();
 	}
 
@@ -308,15 +311,16 @@ public class SaOAuth2ServerProcessor {
 		String clientId = req.getParamNotNull(Param.client_id);
 		String clientSecret = req.getParamNotNull(Param.client_secret);
 		String scope = req.getParam(Param.scope, "");
+		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 
 		// 2、校验 ClientScope 和 scope 
-		oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scope);
+		oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
 
 		// 3、防止因前端误传token造成逻辑干扰
 		// SaHolder.getStorage().set(getStpLogic().stpLogic.splicingKeyJustCreatedSave(), "no-token");
 
 		// 3、调用API 开始登录，如果没能成功登录，则直接退出
-		Object retObj = cfg.getDoLoginHandle().apply(username, password);
+		Object retObj = cfg.doLoginHandle.apply(username, password);
 		if( ! getStpLogic().isLogin()) {
 			return retObj;
 		}
@@ -325,7 +329,7 @@ public class SaOAuth2ServerProcessor {
 		RequestAuthModel ra = new RequestAuthModel();
 		ra.clientId = clientId;
 		ra.loginId = getStpLogic().getLoginId();
-		ra.scope = scope;
+		ra.scopes = scopes;
 
 		// 5、生成 Access-Token
 		AccessTokenModel at = oauth2Template.generateAccessToken(ra, true);
@@ -345,16 +349,17 @@ public class SaOAuth2ServerProcessor {
 		// 获取参数
 		String clientId = req.getParamNotNull(Param.client_id);
 		String clientSecret = req.getParamNotNull(Param.client_secret);
-		String scope = req.getParam(Param.scope);
+		String scope = req.getParam(Param.scope, "");
+		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 
 		//校验 ClientScope
-		oauth2Template.checkContract(clientId, scope);
+		oauth2Template.checkContract(clientId, scopes);
 
 		// 校验 ClientSecret
 		oauth2Template.checkClientSecret(clientId, clientSecret);
 
 		// 生成
-		ClientTokenModel ct = oauth2Template.generateClientToken(clientId, scope);
+		ClientTokenModel ct = oauth2Template.generateClientToken(clientId, scopes);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildClientTokenReturnValue(ct);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 9d26c40d..8baff752 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -25,6 +25,7 @@ import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
+import java.util.HashSet;
 import java.util.List;
 
 /**
@@ -107,7 +108,7 @@ public class SaOAuth2Template {
 			return;
 		}
 		AccessTokenModel at = checkAccessToken(accessToken);
-		List<String> scopeList = SaFoxUtil.convertStringToList(at.scope);
+		List<String> scopeList = at.scopes;
 		for (String scope : scopes) {
 			SaOAuth2Exception.throwBy( ! scopeList.contains(scope), "该 Access-Token 不具备 Scope：" + scope, SaOAuth2ErrorCode.CODE_30108);
 		}
@@ -122,7 +123,7 @@ public class SaOAuth2Template {
 			return;
 		}
 		ClientTokenModel ct = checkClientToken(clientToken);
-		List<String> scopeList = SaFoxUtil.convertStringToList(ct.scope);
+		List<String> scopeList = ct.scopes;
 		for (String scope : scopes) {
 			SaOAuth2Exception.throwBy( ! scopeList.contains(scope), "该 Client-Token 不具备 Scope：" + scope, SaOAuth2ErrorCode.CODE_30109);
 		}
@@ -141,7 +142,9 @@ public class SaOAuth2Template {
 		ra.responseType = req.getParamNotNull(Param.response_type);
 		ra.redirectUri = req.getParamNotNull(Param.redirect_uri);
 		ra.state = req.getParam(Param.state);
-		ra.scope = req.getParam(Param.scope, "");
+		// 数据解析
+		String scope = req.getParam(Param.scope, "");
+		ra.scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 		ra.loginId = loginId;
 		return ra;
 	}
@@ -156,8 +159,8 @@ public class SaOAuth2Template {
 		deleteCode(getCodeValue(ra.clientId, ra.loginId));
 
 		// 生成新Code
-		String code = randomCode(ra.clientId, ra.loginId, ra.scope);
-		CodeModel cm = new CodeModel(code, ra.clientId, ra.scope, ra.loginId, ra.redirectUri);
+		String code = randomCode(ra.clientId, ra.loginId, ra.scopes);
+		CodeModel cm = new CodeModel(code, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
 
 		// 保存新Code
 		saveCode(cm);
@@ -250,8 +253,8 @@ public class SaOAuth2Template {
 		}
 
 		// 2、生成 新Access-Token
-		String newAtValue = randomAccessToken(ra.clientId, ra.loginId, ra.scope);
-		AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scope);
+		String newAtValue = randomAccessToken(ra.clientId, ra.loginId, ra.scopes);
+		AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
 		at.openid = getOpenid(ra.clientId, ra.loginId);
 		at.expiresTime = System.currentTimeMillis() + (checkClientModel(ra.clientId).getAccessTokenTimeout() * 1000);
 
@@ -272,10 +275,10 @@ public class SaOAuth2Template {
 	/**
 	 * 构建Model：Client-Token
 	 * @param clientId 应用id
-	 * @param scope 授权范围
+	 * @param scopes 授权范围
 	 * @return Client-Token Model
 	 */
-	public ClientTokenModel generateClientToken(String clientId, String scope) {
+	public ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
 		// 1、删掉旧 Past-Token
 		deleteClientToken(getPastTokenValue(clientId));
 
@@ -291,7 +294,7 @@ public class SaOAuth2Template {
 		}
 
 		// 3、生成新Client-Token
-		ClientTokenModel ct = new ClientTokenModel(randomClientToken(clientId, scope), clientId, scope);
+		ClientTokenModel ct = new ClientTokenModel(randomClientToken(clientId, scopes), clientId, scopes);
 		ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
 
 		// 3、保存新Client-Token 
@@ -356,23 +359,21 @@ public class SaOAuth2Template {
 	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
 	 * @param loginId 账号id
 	 * @param clientId 应用id
-	 * @param scope 权限
+	 * @param scopes 权限
 	 * @return 是否已经授权
 	 */
-	public boolean isGrant(Object loginId, String clientId, String scope) {
-		List<String> grantScopeList = SaFoxUtil.convertStringToList(getGrantScope(clientId, loginId));
-		List<String> scopeList = SaFoxUtil.convertStringToList(scope);
-		return scopeList.size() == 0 || grantScopeList.containsAll(scopeList);
+	public boolean isGrant(Object loginId, String clientId, List<String> scopes) {
+		List<String> grantScopeList = getGrantScope(clientId, loginId);
+        return scopes.isEmpty() || new HashSet<>(grantScopeList).containsAll(scopes);
 	}
 	/**
 	 * 校验：该Client是否签约了指定的Scope
 	 * @param clientId 应用id
-	 * @param scope 权限(多个用逗号隔开)
+	 * @param scopes 权限(多个用逗号隔开)
 	 */
-	public void checkContract(String clientId, String scope) {
-		List<String> clientScopeList = SaFoxUtil.convertStringToList(checkClientModel(clientId).contractScope);
-		List<String> scopelist = SaFoxUtil.convertStringToList(scope);
-		if( ! clientScopeList.containsAll(scopelist)) {
+	public void checkContract(String clientId, List<String> scopes) {
+		List<String> clientScopeList = checkClientModel(clientId).contractScopes;
+        if( ! new HashSet<>(clientScopeList).containsAll(scopes)) {
 			throw new SaOAuth2Exception("请求的Scope暂未签约").setCode(SaOAuth2ErrorCode.CODE_30112);
 		}
 	}
@@ -394,7 +395,8 @@ public class SaOAuth2Template {
 		}
 
 		// 3、是否在[允许地址列表]之中
-		List<String> allowList = SaFoxUtil.convertStringToList(checkClientModel(clientId).allowUrl);
+		SaClientModel clientModel = checkClientModel(clientId);
+		List<String> allowList = SaOAuth2Manager.getDataConverter().convertAllowUrlStringToList(clientModel.allowUrl);
 		if( ! SaStrategy.instance.hasElement.apply(allowList, url)) {
 			throw new SaOAuth2Exception("非法redirect_url：" + url).setCode(SaOAuth2ErrorCode.CODE_30114);
 		}
@@ -415,16 +417,15 @@ public class SaOAuth2Template {
 	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes 
 	 * @param clientId 应用id
 	 * @param clientSecret 秘钥
-	 * @param scopes 权限（多个用逗号隔开）
+	 * @param scopes 权限
 	 * @return SaClientModel对象
 	 */
-	public SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, String scopes) {
+	public SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
 		// 先校验 clientSecret
 		SaClientModel cm = checkClientSecret(clientId, clientSecret);
 		// 再校验 是否签约 
-		List<String> clientScopeList = SaFoxUtil.convertStringToList(cm.contractScope);
-		List<String> scopelist = SaFoxUtil.convertStringToList(scopes);
-		if( ! clientScopeList.containsAll(scopelist)) {
+		List<String> clientScopeList = cm.contractScopes;
+        if( ! new HashSet<>(clientScopeList).containsAll(scopes)) {
 			throw new SaOAuth2Exception("请求的Scope暂未签约").setCode(SaOAuth2ErrorCode.CODE_30116);
 		}
 		// 返回数据
@@ -504,11 +505,11 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel convertCodeToAccessToken(CodeModel cm) {
 		AccessTokenModel at = new AccessTokenModel();
-		at.accessToken = randomAccessToken(cm.clientId, cm.loginId, cm.scope);
+		at.accessToken = randomAccessToken(cm.clientId, cm.loginId, cm.scopes);
 		// at.refreshToken = randomRefreshToken(cm.clientId, cm.loginId, cm.scope);
 		at.clientId = cm.clientId;
 		at.loginId = cm.loginId;
-		at.scope = cm.scope;
+		at.scopes = cm.scopes;
 		at.openid = getOpenid(cm.clientId, cm.loginId);
 		at.expiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getAccessTokenTimeout() * 1000);
 		// at.refreshExpiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getRefreshTokenTimeout() * 1000);
@@ -521,10 +522,10 @@ public class SaOAuth2Template {
 	 */
 	public RefreshTokenModel convertAccessTokenToRefreshToken(AccessTokenModel at) {
 		RefreshTokenModel rt = new RefreshTokenModel();
-		rt.refreshToken = randomRefreshToken(at.clientId, at.loginId, at.scope);
+		rt.refreshToken = randomRefreshToken(at.clientId, at.loginId, at.scopes);
 		rt.clientId = at.clientId;
 		rt.loginId = at.loginId;
-		rt.scope = at.scope;
+		rt.scopes = at.scopes;
 		rt.openid = at.openid;
 		rt.expiresTime = System.currentTimeMillis() + (checkClientModel(at.clientId).getRefreshTokenTimeout() * 1000);
 		// 改变at属性
@@ -539,11 +540,11 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel convertRefreshTokenToAccessToken(RefreshTokenModel rt) {
 		AccessTokenModel at = new AccessTokenModel();
-		at.accessToken = randomAccessToken(rt.clientId, rt.loginId, rt.scope);
+		at.accessToken = randomAccessToken(rt.clientId, rt.loginId, rt.scopes);
 		at.refreshToken = rt.refreshToken;
 		at.clientId = rt.clientId;
 		at.loginId = rt.loginId;
-		at.scope = rt.scope;
+		at.scopes = rt.scopes;
 		at.openid = rt.openid;
 		at.expiresTime = System.currentTimeMillis() + (checkClientModel(rt.clientId).getAccessTokenTimeout() * 1000);
 		at.refreshExpiresTime = rt.expiresTime;
@@ -556,10 +557,10 @@ public class SaOAuth2Template {
 	 */
 	public RefreshTokenModel convertRefreshTokenToRefreshToken(RefreshTokenModel rt) {
 		RefreshTokenModel newRt = new RefreshTokenModel();
-		newRt.refreshToken = randomRefreshToken(rt.clientId, rt.loginId, rt.scope);
+		newRt.refreshToken = randomRefreshToken(rt.clientId, rt.loginId, rt.scopes);
 		newRt.expiresTime = System.currentTimeMillis() + (checkClientModel(rt.clientId).getRefreshTokenTimeout() * 1000);
 		newRt.clientId = rt.clientId;
-		newRt.scope = rt.scope;
+		newRt.scopes = rt.scopes;
 		newRt.loginId = rt.loginId;
 		newRt.openid = rt.openid;
 		return newRt;
@@ -665,12 +666,13 @@ public class SaOAuth2Template {
 	 * 持久化：用户授权记录
 	 * @param clientId 应用id
 	 * @param loginId 账号id
-	 * @param scope 权限列表(多个逗号隔开)
+	 * @param scopes 权限列表
 	 */
-	public void saveGrantScope(String clientId, Object loginId, String scope) {
-		if( ! SaFoxUtil.isEmpty(scope)) {
+	public void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
+		if( ! SaFoxUtil.isEmpty(scopes)) {
 			long ttl = checkClientModel(clientId).getAccessTokenTimeout();
-			SaManager.getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), scope, ttl);
+			String value = SaOAuth2Manager.getDataConverter().convertScopeListToString(scopes);
+			SaManager.getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), value, ttl);
 		}
 	}
 
@@ -768,8 +770,9 @@ public class SaOAuth2Template {
 	 * @param loginId 账号id
 	 * @return 权限
 	 */
-	public String getGrantScope(String clientId, Object loginId) {
-		return SaManager.getSaTokenDao().get(splicingGrantScopeKey(clientId, loginId));
+	public List<String> getGrantScope(String clientId, Object loginId) {
+		String value = SaManager.getSaTokenDao().get(splicingGrantScopeKey(clientId, loginId));
+		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(value);
 	}
 
 	// ------------------- delete数据
@@ -861,39 +864,39 @@ public class SaOAuth2Template {
 	 * 随机一个 Code
 	 * @param clientId 应用id
 	 * @param loginId 账号id
-	 * @param scope 权限
+	 * @param scopes 权限
 	 * @return Code
 	 */
-	public String randomCode(String clientId, Object loginId, String scope) {
+	public String randomCode(String clientId, Object loginId, List<String> scopes) {
 		return SaFoxUtil.getRandomString(60);
 	}
 	/**
 	 * 随机一个 Access-Token
 	 * @param clientId 应用id
 	 * @param loginId 账号id
-	 * @param scope 权限
+	 * @param scopes 权限
 	 * @return Access-Token
 	 */
-	public String randomAccessToken(String clientId, Object loginId, String scope) {
+	public String randomAccessToken(String clientId, Object loginId, List<String> scopes) {
 		return SaFoxUtil.getRandomString(60);
 	}
 	/**
 	 * 随机一个 Refresh-Token
 	 * @param clientId 应用id
 	 * @param loginId 账号id
-	 * @param scope 权限
+	 * @param scopes 权限
 	 * @return Refresh-Token
 	 */
-	public String randomRefreshToken(String clientId, Object loginId, String scope) {
+	public String randomRefreshToken(String clientId, Object loginId, List<String> scopes) {
 		return SaFoxUtil.getRandomString(60);
 	}
 	/**
 	 * 随机一个 Client-Token
 	 * @param clientId 应用id
-	 * @param scope 权限
+	 * @param scopes 权限
 	 * @return Client-Token
 	 */
-	public String randomClientToken(String clientId, String scope) {
+	public String randomClientToken(String clientId, List<String> scopes) {
 		return SaFoxUtil.getRandomString(60);
 	}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index d40000e0..d7886714 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -19,6 +19,8 @@ import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
+import java.util.List;
+
 /**
  * Sa-Token-OAuth2 模块 工具类
  *
@@ -135,11 +137,11 @@ public class SaOAuth2Util {
 	/**
 	 * 构建Model：Client-Token 
 	 * @param clientId 应用id 
-	 * @param scope 授权范围 
+	 * @param scopes 授权范围
 	 * @return Client-Token Model 
 	 */
-	public static ClientTokenModel generateClientToken(String clientId, String scope) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateClientToken(clientId, scope);
+	public static ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
+		return SaOAuth2ServerProcessor.instance.oauth2Template.generateClientToken(clientId, scopes);
 	}
 	
 	/**
@@ -178,20 +180,20 @@ public class SaOAuth2Util {
 	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope 
 	 * @param loginId 账号id 
 	 * @param clientId 应用id 
-	 * @param scope 权限 
+	 * @param scopes 权限
 	 * @return 是否已经授权
 	 */
-	public static boolean isGrant(Object loginId, String clientId, String scope) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.isGrant(loginId, clientId, scope);
+	public static boolean isGrant(Object loginId, String clientId, List<String> scopes) {
+		return SaOAuth2ServerProcessor.instance.oauth2Template.isGrant(loginId, clientId, scopes);
 	}
 	
 	/**
 	 * 校验：该Client是否签约了指定的Scope 
 	 * @param clientId 应用id
-	 * @param scope 权限(多个用逗号隔开) 
+	 * @param scopes 权限(多个用逗号隔开)
 	 */
-	public static void checkContract(String clientId, String scope) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.checkContract(clientId, scope);
+	public static void checkContract(String clientId, List<String> scopes) {
+		SaOAuth2ServerProcessor.instance.oauth2Template.checkContract(clientId, scopes);
 	}
 	
 	/**
@@ -217,10 +219,10 @@ public class SaOAuth2Util {
 	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes 
 	 * @param clientId 应用id
 	 * @param clientSecret 秘钥
-	 * @param scopes 权限（多个用逗号隔开）
+	 * @param scopes 权限
 	 * @return SaClientModel对象
 	 */
-	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, String scopes) {
+	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
 		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
 	}
 	
@@ -264,10 +266,10 @@ public class SaOAuth2Util {
 	 * 持久化：用户授权记录 
 	 * @param clientId 应用id 
 	 * @param loginId 账号id 
-	 * @param scope 权限列表(多个逗号隔开) 
+	 * @param scopes 权限列表
 	 */
-	public static void saveGrantScope(String clientId, Object loginId, String scope) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.saveGrantScope(clientId, loginId, scope);
+	public static void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
+		SaOAuth2ServerProcessor.instance.oauth2Template.saveGrantScope(clientId, loginId, scopes);
 	}
 	
 	
@@ -315,7 +317,7 @@ public class SaOAuth2Util {
 	 * @param loginId 账号id 
 	 * @return 权限 
 	 */
-	public static String getGrantScope(String clientId, Object loginId) {
+	public static List<String> getGrantScope(String clientId, Object loginId) {
 		return SaOAuth2ServerProcessor.instance.oauth2Template.getGrantScope(clientId, loginId);
 	}
 
-- 
Gitee


From 12c645aaedcfcdd6cfbc4a8c921ae83eec50cbe3 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 15 Aug 2024 19:49:10 +0800
Subject: [PATCH 122/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20Chat2DB=20?=
 =?UTF-8?q?=E5=8F=8B=E8=81=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md               | 1 +
 sa-token-doc/index.html | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 76aa9a4f..5badb14f 100644
--- a/README.md
+++ b/README.md
@@ -185,6 +185,7 @@ Sa-Token-OAuth2 模块分为四种授权模式，解决不同场景下的授权
 - [[ hippo4j ]](https://gitee.com/agentart/hippo4j)：强大的动态线程池框架，附带监控报警功能。
 - [[ hertzbeat ]](https://gitee.com/dromara/hertzbeat)：易用友好的开源实时监控告警系统，无需Agent，高性能集群，强大自定义监控能力。
 - [[ Solon ]](https://gitee.com/noear/solon)：一个更现代感的应用开发框架：更快、更小、更自由。
+- [[ Chat2DB ]](https://github.com/chat2db/Chat2DB)：一个AI驱动的数据库管理和BI工具，支持Mysql、pg、Oracle、Redis等22种数据库的管理。
 
 
 
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 313edb37..223373b8 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -897,6 +897,10 @@
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/hertzbeat-brand.svg"
 								msg="易用友好的云监控系统">
 						</a>
+						<a href="https://chat2db-ai.com" target="_blank">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/link/chat2db.png"
+								msg="一个AI驱动的数据库管理和BI工具，支持Mysql、pg、Oracle、Redis等22种数据库的管理。">
+						</a>
 					</div>
 					<div style="height: 10px; clear: both;"></div>
 				</div>
-- 
Gitee


From 7f745a7ba4720bf613db80853d60792052909866 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 16 Aug 2024 18:50:10 +0800
Subject: [PATCH 123/172] =?UTF-8?q?=E5=85=BC=E5=AE=B9=E4=BB=8E=20basic=20a?=
 =?UTF-8?q?uth=20=E8=AF=B7=E6=B1=82=E5=A4=B4=E4=B8=AD=E8=AF=BB=E5=8F=96=20?=
 =?UTF-8?q?client=20=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../SaOAuth2DataConverterDefaultImpl.java     |  1 +
 .../model/other/ClientIdAndSecretModel.java   | 87 +++++++++++++++++++
 .../data/resolver/SaOAuth2DataResolver.java   | 10 +++
 .../SaOAuth2DataResolverDefaultImpl.java      | 37 ++++++++
 .../processor/SaOAuth2ServerProcessor.java    | 45 ++++------
 5 files changed, 154 insertions(+), 26 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index aa818ac2..523e3f9e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -60,5 +60,6 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         }
         return SaFoxUtil.convertStringToList(allowUrl);
     }
+
 }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java
new file mode 100644
index 00000000..b5180f3f
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.model.other;
+
+import java.io.Serializable;
+
+/**
+ * Client 的 id 和 secret
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class ClientIdAndSecretModel implements Serializable {
+
+	private static final long serialVersionUID = -6541180061782004705L;
+
+	/**
+	 * 应用id
+	 */
+	public String clientId;
+
+	/**
+	 * 应用秘钥
+	 */
+	public String clientSecret;
+
+	public ClientIdAndSecretModel() {
+	}
+	public ClientIdAndSecretModel(String clientId, String clientSecret) {
+		super();
+		this.clientId = clientId;
+		this.clientSecret = clientSecret;
+	}
+
+	/**
+	 * @return 应用id
+	 */
+	public String getClientId() {
+		return clientId;
+	}
+
+	/**
+	 * @param clientId 应用id 
+	 * @return 对象自身 
+	 */
+	public ClientIdAndSecretModel setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	/**
+	 * @return 应用秘钥 
+	 */
+	public String getClientSecret() {
+		return clientSecret;
+	}
+
+	/**
+	 * @param clientSecret 应用秘钥 
+	 * @return 对象自身 
+	 */
+	public ClientIdAndSecretModel setClientSecret(String clientSecret) {
+		this.clientSecret = clientSecret;
+		return this;
+	}
+
+	@Override
+	public String toString() {
+		return "ClientIdAndSecretModel{" +
+				"clientId='" + clientId + '\'' +
+				", clientSecret='" + clientSecret + '\'' +
+				'}';
+	}
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 67d8da7f..7b6ff223 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -15,8 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.data.resolver;
 
+import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.Map;
@@ -31,6 +33,14 @@ import java.util.Map;
  */
 public interface SaOAuth2DataResolver {
 
+    /**
+     * 数据读取：从请求对象中读取 ClientId、Secret
+     *
+     * @param request /
+     * @return /
+     */
+    ClientIdAndSecretModel readClientIdAndSecret(SaRequest request);
+
 
     /**
      * 构建返回值: 获取 token
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 1d437eb7..cd7641a2 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -15,10 +15,16 @@
  */
 package cn.dev33.satoken.oauth2.data.resolver;
 
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.LinkedHashMap;
@@ -34,6 +40,37 @@ import java.util.Map;
  */
 public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
 
+
+    /**
+     * 数据读取：从请求对象中读取 ClientId、Secret，如果获取不到则抛出异常
+     *
+     * @param request /
+     * @return /
+     */
+    @Override
+    public ClientIdAndSecretModel readClientIdAndSecret(SaRequest request) {
+        // 优先从请求参数中获取
+        String clientId = request.getParam(SaOAuth2Consts.Param.client_id);
+        String clientSecret = request.getParam(SaOAuth2Consts.Param.client_secret);
+        if(SaFoxUtil.isNotEmpty(clientId)) {
+            return new ClientIdAndSecretModel(clientId, clientSecret);
+        }
+
+        // 如果请求参数中没有提供 client_id 参数，则尝试从 base auth 中获取
+        String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
+        if(SaFoxUtil.isNotEmpty(authorizationValue)) {
+            String[] arr = authorizationValue.split(":");
+            clientId = arr[0];
+            if(arr.length > 1) {
+                clientSecret = arr[1];
+            }
+            return new ClientIdAndSecretModel(clientId, clientSecret);
+        }
+
+        // 如果都没有提供，则抛出异常
+        throw new SaOAuth2Exception("请提供 client 信息");
+    }
+
     /**
      * 构建返回值: 获取 token
      */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index f732d813..fccf246d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -18,7 +18,6 @@ package cn.dev33.satoken.oauth2.processor;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
-import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
@@ -27,12 +26,12 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
 import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
-import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.List;
@@ -190,20 +189,9 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 
 		// 获取参数
-		String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
-		String clientId;
-		String clientSecret;
-
-		// gitlab 回调 token 接口时,按照的是标准的oauth2协议的basic请求头,basic中会包含client_id和client_secret的信息
-		if(SaFoxUtil.isEmpty(authorizationValue)){
-			clientId = req.getParamNotNull(Param.client_id);
-			clientSecret = req.getParamNotNull(Param.client_secret);
-		} else {
-			String[] clientIdAndSecret = authorizationValue.split(":");
-			clientId = clientIdAndSecret[0];
-			clientSecret = clientIdAndSecret[1];
-		}
-
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		String clientId = clientIdAndSecret.clientId;
+		String clientSecret = clientIdAndSecret.clientSecret;
 		String code = req.getParamNotNull(Param.code);
 		String redirectUri = req.getParam(Param.redirect_uri);
 
@@ -226,8 +214,10 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 
 		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
+
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		String clientId = clientIdAndSecret.clientId;
+		String clientSecret = clientIdAndSecret.clientSecret;
 		String refreshToken = req.getParamNotNull(Param.refresh_token);
 
 		// 校验参数
@@ -249,8 +239,9 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 
 		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		String clientId = clientIdAndSecret.clientId;
+		String clientSecret = clientIdAndSecret.clientSecret;
 		String accessToken = req.getParamNotNull(Param.access_token);
 
 		// 如果 Access-Token 不存在，直接返回
@@ -308,8 +299,9 @@ public class SaOAuth2ServerProcessor {
 		// 1、获取请求参数
 		String username = req.getParamNotNull(Param.username);
 		String password = req.getParamNotNull(Param.password);
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		String clientId = clientIdAndSecret.clientId;
+		String clientSecret = clientIdAndSecret.clientSecret;
 		String scope = req.getParam(Param.scope, "");
 		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 
@@ -347,8 +339,9 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 
 		// 获取参数
-		String clientId = req.getParamNotNull(Param.client_id);
-		String clientSecret = req.getParamNotNull(Param.client_secret);
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		String clientId = clientIdAndSecret.clientId;
+		String clientSecret = clientIdAndSecret.clientSecret;
 		String scope = req.getParam(Param.scope, "");
 		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 
@@ -370,8 +363,8 @@ public class SaOAuth2ServerProcessor {
 	 * @return / 
 	 */
 	public SaClientModel currClientModel() {
-		String clientId = SaHolder.getRequest().getParam(Param.client_id);
-		return oauth2Template.checkClientModel(clientId);
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(SaHolder.getRequest());
+		return oauth2Template.checkClientModel(clientIdAndSecret.clientId);
 	}
 
 	/**
-- 
Gitee


From c485eba134e1c85803fd7185863aa77fc74433ea Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 16 Aug 2024 21:07:13 +0800
Subject: [PATCH 124/172] =?UTF-8?q?sa-token-oauth2=20redirect=5Furl=20?=
 =?UTF-8?q?=E5=8F=82=E6=95=B0=E6=A0=A1=E9=AA=8C=E5=A2=9E=E5=8A=A0=E8=A7=84?=
 =?UTF-8?q?=E5=88=99=EF=BC=9A=E4=B8=8D=E5=85=81=E8=AE=B8=E5=87=BA=E7=8E=B0?=
 =?UTF-8?q?@=E5=AD=97=E7=AC=A6=E3=80=81*=E9=80=9A=E9=85=8D=E7=AC=A6?=
 =?UTF-8?q?=E5=8F=AA=E8=83=BD=E5=87=BA=E7=8E=B0=E5=9C=A8=E6=9C=80=E5=90=8E?=
 =?UTF-8?q?=E4=B8=80=E4=BD=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../oauth2/template/SaOAuth2Template.java     | 74 ++++++++++++++++++-
 1 file changed, 72 insertions(+), 2 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 8baff752..cf9e1bd1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -394,13 +394,83 @@ public class SaOAuth2Template {
 			url = url.substring(0, qIndex);
 		}
 
-		// 3、是否在[允许地址列表]之中
+		// 3、不允许出现@字符
+		if(url.contains("@")) {
+			//  为什么不允许出现 @ 字符呢，因为这有可能导致 redirect_url 参数绕过 AllowUrl 列表的校验
+			//
+			//  举个例子 SaClientModel 配置：
+			//       allow-url=http://sa-oauth-client.com*
+			//
+			//  开发者原意是为了允许 sa-oauth-client.com 下的所有地址都可以下放 code
+			//
+			//  但是如果攻击者精心构建一个url：
+			// 	     http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com@sa-token.cc
+			//
+			//  那么这个url就会绕过 allow-url 的校验，code 被下发到了第三方服务器地址：
+			//       http://sa-token.cc/?code=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
+			//
+			//  造成了 code 参数劫持
+			//  所以此处需要禁止在 url 中出现 @ 字符
+			//
+			//  这么一刀切的做法，可能会导致一些特殊的正常url也无法通过校验，例如：
+			//       http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com/@getInfo
+			//
+			//  但是为了安全起见，这么做还是有必要的
+			throw new SaOAuth2Exception("无效 redirect_url（不允许出现@字符）：" + url);
+		}
+
+		// 4、是否在[允许地址列表]之中
 		SaClientModel clientModel = checkClientModel(clientId);
 		List<String> allowList = SaOAuth2Manager.getDataConverter().convertAllowUrlStringToList(clientModel.allowUrl);
+		checkAllowUrlList(allowList);
 		if( ! SaStrategy.instance.hasElement.apply(allowList, url)) {
-			throw new SaOAuth2Exception("非法redirect_url：" + url).setCode(SaOAuth2ErrorCode.CODE_30114);
+			throw new SaOAuth2Exception("非法 redirect_url: " + url).setCode(SaOAuth2ErrorCode.CODE_30114);
 		}
 	}
+
+	/**
+	 * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
+	 * @param allowUrlList 待校验的 allow-url 地址列表
+	 */
+	public void checkAllowUrlList(List<String> allowUrlList){
+		checkAllowUrlListStaticMethod(allowUrlList);
+	}
+
+	/**
+	 * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
+	 * @param allowUrlList 待校验的 allow-url 地址列表
+	 */
+	public static void checkAllowUrlListStaticMethod(List<String> allowUrlList){
+		for (String url : allowUrlList) {
+			int index = url.indexOf("*");
+			// 如果配置了 * 字符，则必须出现在最后一位，否则属于无效配置项
+			if(index != -1 && index != url.length() - 1) {
+				//  为什么不允许 * 字符出现在中间位置呢，因为这有可能导致 redirect 参数绕过 allow-url 列表的校验
+				//
+				//  举个例子 SaClientModel 配置：
+				//      allow-url=http://*.sa-oauth-client.com/
+				//
+				//  开发者原意是为了允许 sa-oauth-client.com 下的所有子域名都可以下放 ticket
+				//      例如：http://shop.sa-oauth-client.com/
+				//
+				//  但是如果攻击者精心构建一个url：
+				//       http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-token.cc/a.sa-oauth-client.com/
+				//
+				//  那么这个 url 就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
+				//       http://sa-token.cc/a.sa-oauth-client.com/?code=v2KKMUFK7dDsMMzXLQ3aWGsyGUjrA0dBB2jeOWrpCnC8b5ScmXXQSv20mIwPK7Cx
+				//
+				//  造成了 ticket 参数劫持
+				//  所以此处需要禁止 allow-url 配置项的中间位置出现 * 字符（出现在末尾是没有问题的）
+				//
+				//  这么一刀切的做法，可能会导致正常场景下的子域名url也无法通过校验，例如：
+				//       http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://shop.sa-oauth2-client.com/
+				//
+				//  但是为了安全起见，这么做还是有必要的
+				throw new SaOAuth2Exception("无效的 allow-url 配置（*通配符只允许出现在最后一位）：" + url);
+			}
+		}
+	}
+
 	/**
 	 * 校验：clientId 与 clientSecret 是否正确
 	 * @param clientId 应用id
-- 
Gitee


From a2289dc6a1c6bce4532f1f33a6d67e4764f8e168 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 16 Aug 2024 23:25:27 +0800
Subject: [PATCH 125/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E4=B8=8D=E5=87=86?=
 =?UTF-8?q?=E7=A1=AE=E7=9A=84=E6=B3=A8=E9=87=8A=E4=BF=A1=E6=81=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/plugin/api-sign.md                               | 2 +-
 .../cn/dev33/satoken/sso/template/SaSsoServerTemplate.java    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sa-token-doc/plugin/api-sign.md b/sa-token-doc/plugin/api-sign.md
index 268b0a07..0267f3e6 100644
--- a/sa-token-doc/plugin/api-sign.md
+++ b/sa-token-doc/plugin/api-sign.md
@@ -223,7 +223,7 @@ public SaResult addMoney(long userId, long money, String nonce, String sign) {
 long userId = 10001;
 long money = 1000;
 String nonce = SaFoxUtil.getRandomString(32); // 随机32位字符串
-long timestamp = System.currentTimeMillis(); // 随机32位字符串
+long timestamp = System.currentTimeMillis(); // 系统当前时间戳 
 String secretKey = "xxxxxxxxxxxxxxxxxxxx";
 
 // 计算 sign 参数
diff --git a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
index d5367e17..29101235 100644
--- a/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
+++ b/sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
@@ -276,7 +276,7 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
             //       http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-sso-client1.com@sa-token.cc
             //
             //  那么这个url就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
-            //       https://sa-token.cc/?ticket=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
+            //       http://sa-token.cc/?ticket=i8vDfbpqBViMe01QoLY1kHROJWYvv9plBtvTZ6kk77KK0e0U4Xj99NPfSZEYjRul
             //
             //  造成了ticket 参数劫持
             //  所以此处需要禁止在 url 中出现 @ 字符
@@ -327,7 +327,7 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
                 //       http://sa-sso-server.com:9000/sso/auth?redirect=http://sa-token.cc/a.sa-sso-client1.com/sso/login
                 //
                 //  那么这个 url 就会绕过 allow-url 的校验，ticket 被下发到了第三方服务器地址：
-                //       https://sa-token.cc/a.sa-sso-client1.com/sso/login?ticket=v2KKMUFK7dDsMMzXLQ3aWGsyGUjrA0dBB2jeOWrpCnC8b5ScmXXQSv20mIwPK7Cx
+                //       http://sa-token.cc/a.sa-sso-client1.com/sso/login?ticket=v2KKMUFK7dDsMMzXLQ3aWGsyGUjrA0dBB2jeOWrpCnC8b5ScmXXQSv20mIwPK7Cx
                 //
                 //  造成了 ticket 参数劫持
                 //  所以此处需要禁止 allow-url 配置项的中间位置出现 * 字符（出现在末尾是没有问题的）
-- 
Gitee


From 0b3781d3862ce23fef6449bc7fbe5b260a24462c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 17 Aug 2024 13:03:01 +0800
Subject: [PATCH 126/172] =?UTF-8?q?=E5=B8=B8=E8=A7=81=E9=94=99=E8=AF=AF?=
 =?UTF-8?q?=E6=96=B0=E5=A2=9EQA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-questions.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/sa-token-doc/sso/sso-questions.md b/sa-token-doc/sso/sso-questions.md
index b83c387e..618f0bda 100644
--- a/sa-token-doc/sso/sso-questions.md
+++ b/sa-token-doc/sso/sso-questions.md
@@ -58,6 +58,32 @@ public class SaSsoServerApplication {
 解决方案：在 sso-client 也新建上这个类，而且包名需要与 sso-server 端的一致（直接从 sso-server 把实体类复制过来就好了）
 
 
+
+### 在测试模式一时，出现一些难以理解的现象 
+
+测试模式一时，三种异常现象：
+
+1、在 sso-client 端点击登录，可以成功跳转到 sso-server 端，登录后可以跳回 sso-client 端，但显示 sso-client 端未登录	
+- 原因：sso-server 后端没有配置 sa-token.cookie.domain 值。
+
+2、在 sso-client 端点击登录，可以成功跳转到 sso-server 端，登录页面刷新一下，并没有跳转回 sso-client 端，依然提示让你登录
+- 可能1：sso-server 后端配置了错误的 sa-token.cookie.domain 值。	
+- 可能2：sso-server 后端没有打开 sa-token.is-read-cookie 值。（测试模式二三时发生这种现象，有时候也是因为这个）
+
+3、在 sso-client 端点击登录，页面只是闪了一下，肉眼没有观察到页面跳转，页面也没有显示登录上。
+
+原因：sso-server 的页面存储了不带 . 的有效 Cookie，为什么会这样：常常是因为测试模式二三后，没有清除redis记录或者浏览器记录，直接再开始测试模式一，
+模式二三登录成功后遗留的有效cookie，影响了模式一的行为逻辑。
+
+解决方案：
+- 1、手动清空 redis里的所有数据，
+- 2、或者手动清空 sso-server 域名下的所有 Cookie 
+- 3、换一个新的干净浏览器来测试。
+	
+	
+
+
+
 ### 问：模式三配置一堆 xxx-url ，有办法简化一下吗？
 可以使用 `sa-token.sso.server-url` 来简化：
 
-- 
Gitee


From a55396087c13558ab51d7d8367d6e306e3dabd13 Mon Sep 17 00:00:00 2001
From: zhongjun <zhongjun96@aliyun.com>
Date: Sat, 17 Aug 2024 15:26:26 +0800
Subject: [PATCH 127/172] Update config.md

---
 sa-token-doc/use/config.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index 613b875c..0e80c9cb 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -121,7 +121,7 @@ public class SaTokenConfigure {
 | activeTimeout			| long		| -1		| Token 最低活跃频率（单位：秒），如果 token 超过此时间没有访问系统就会被冻结，默认-1 代表不限制，永不冻结（例如可以设置为1800代表30分钟内无操作就冻结） 	[参考：token有效期详解](/fun/token-timeout)													|
 | dynamicActiveTimeout	| Boolean	| false		| 是否启用动态 activeTimeout 功能，如不需要请设置为 false，节省缓存请求次数	|
 | isConcurrent			| Boolean	| true		| 是否允许同一账号并发登录 （为 true 时允许一起登录，为 false 时新登录挤掉旧登录）															|
-| isShare				| Boolean	| true		| 在多人登录同一账号时，是否共用一个 token （为 true 时所有登录共用一个 token，为 false 时每次登录新建一个 token） 	|
+| isShare				| Boolean	| true		| 在多人登录同一账号时，是否共用一个 token （为 true 时所有登录共用一个 token，为 false 时每次登录新建一个 token，login 时提供了 Extra 数据后，即使配置了为 true 也不能复用旧 Token，必须创建新 Token） 	|
 | maxLoginCount			| int		| 12		| 同一账号最大登录数量，-1代表不限 （只有在 `isConcurrent=true`，`isShare=false` 时此配置才有效），[详解](/use/config?id=配置项详解：maxlogincount)	|
 | maxTryTimes			| int		| 12		| 在每次创建 Token 时的最高循环次数，用于保证 Token 唯一性（-1=不循环重试，直接使用）			|
 | isReadBody			| Boolean	| true		| 是否尝试从 请求体 里读取 Token														|
-- 
Gitee


From b4c06f22657e78cac7e16282d316ab414b8efe0c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 17 Aug 2024 18:29:54 +0800
Subject: [PATCH 128/172] =?UTF-8?q?=E6=8A=BD=E7=A6=BB=20SaOAuth2Dao=20?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=EF=BC=8C=E8=B4=9F=E8=B4=A3=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E6=8C=81=E4=B9=85?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dev33/satoken/oauth2/SaOAuth2Manager.java |  20 +
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java | 484 +++++++++++++++++
 .../oauth2/dao/SaOAuth2DaoDefaultImpl.java    |  26 +
 .../satoken/oauth2/scope/CommonScope.java     |  44 ++
 .../oauth2/template/SaOAuth2Template.java     | 498 +++---------------
 .../satoken/oauth2/template/SaOAuth2Util.java |  11 +-
 6 files changed, 662 insertions(+), 421 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2DaoDefaultImpl.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 88b07412..1110aae4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -16,6 +16,8 @@
 package cn.dev33.satoken.oauth2;
 
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
+import cn.dev33.satoken.oauth2.dao.SaOAuth2DaoDefaultImpl;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverterDefaultImpl;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
@@ -104,4 +106,22 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.dataConverter = dataConverter;
 	}
 
+	/**
+	 * OAuth2 数据持久 Bean
+	 */
+	private static volatile SaOAuth2Dao dao;
+	public static SaOAuth2Dao getDao() {
+		if (dao == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (dao == null) {
+					setDao(new SaOAuth2DaoDefaultImpl());
+				}
+			}
+		}
+		return dao;
+	}
+	public static void setDao(SaOAuth2Dao dao) {
+		SaOAuth2Manager.dao = dao;
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
new file mode 100644
index 00000000..209f8a55
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -0,0 +1,484 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.dao;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.config.SaTokenConfig;
+import cn.dev33.satoken.dao.SaTokenDao;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.util.List;
+
+/**
+ * Sa-Token OAuth2 数据持久层
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2Dao {
+
+	// ------------------- save 数据
+
+	/**
+	 * 持久化：Code-Model
+	 * @param c .
+	 */
+	default void saveCode(CodeModel c) {
+		if(c == null) {
+			return;
+		}
+		getSaTokenDao().setObject(splicingCodeSaveKey(c.code), c, SaOAuth2Manager.getConfig().getCodeTimeout());
+	}
+
+	/**
+	 * 持久化：Code-索引
+	 * @param c .
+	 */
+	default void saveCodeIndex(CodeModel c) {
+		if(c == null) {
+			return;
+		}
+		getSaTokenDao().set(splicingCodeIndexKey(c.clientId, c.loginId), c.code, SaOAuth2Manager.getConfig().getCodeTimeout());
+	}
+
+	/**
+	 * 持久化：AccessToken-Model
+	 * @param at .
+	 */
+	default void saveAccessToken(AccessTokenModel at) {
+		if(at == null) {
+			return;
+		}
+		getSaTokenDao().setObject(splicingAccessTokenSaveKey(at.accessToken), at, at.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：AccessToken-索引
+	 * @param at .
+	 */
+	default void saveAccessTokenIndex(AccessTokenModel at) {
+		if(at == null) {
+			return;
+		}
+		getSaTokenDao().set(splicingAccessTokenIndexKey(at.clientId, at.loginId), at.accessToken, at.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：RefreshToken-Model
+	 * @param rt .
+	 */
+	default void saveRefreshToken(RefreshTokenModel rt) {
+		if(rt == null) {
+			return;
+		}
+		getSaTokenDao().setObject(splicingRefreshTokenSaveKey(rt.refreshToken), rt, rt.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：RefreshToken-索引
+	 * @param rt .
+	 */
+	default void saveRefreshTokenIndex(RefreshTokenModel rt) {
+		if(rt == null) {
+			return;
+		}
+		getSaTokenDao().set(splicingRefreshTokenIndexKey(rt.clientId, rt.loginId), rt.refreshToken, rt.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：ClientToken-Model
+	 * @param ct .
+	 */
+	default void saveClientToken(ClientTokenModel ct) {
+		if(ct == null) {
+			return;
+		}
+		getSaTokenDao().setObject(splicingClientTokenSaveKey(ct.clientToken), ct, ct.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：ClientToken-索引
+	 * @param ct .
+	 */
+	default void saveClientTokenIndex(ClientTokenModel ct) {
+		if(ct == null) {
+			return;
+		}
+		getSaTokenDao().set(splicingClientTokenIndexKey(ct.clientId), ct.clientToken, ct.getExpiresIn());
+	}
+
+	/**
+	 * 持久化：Past-Token-索引
+	 * @param ct /
+	 */
+	default void savePastTokenIndex(ClientTokenModel ct) {
+		if(ct == null) {
+			return;
+		}
+		long ttl = ct.getExpiresIn();
+		// TODO PastToken ttl 是否有必要单独配置个字段？
+//		SaClientModel cm = checkClientModel(ct.clientId);
+//		if (cm.getPastClientTokenTimeout() != -1) {
+//			ttl = cm.getPastClientTokenTimeout();
+//		}
+		getSaTokenDao().set(splicingPastTokenIndexKey(ct.clientId), ct.clientToken, ttl);
+	}
+
+	/**
+	 * 持久化：用户授权记录
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @param scopes 权限列表
+	 */
+	default void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
+		if( ! SaFoxUtil.isEmpty(scopes)) {
+			// TODO ttl 计算规则优化
+			long ttl = SaOAuth2Manager.getConfig().getAccessTokenTimeout();
+			// long ttl = checkClientModel(clientId).getAccessTokenTimeout();
+			String value = SaOAuth2Manager.getDataConverter().convertScopeListToString(scopes);
+			getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), value, ttl);
+		}
+	}
+
+
+	// ------------------- delete数据
+
+	/**
+	 * 删除：Code
+	 * @param code 值
+	 */
+	default void deleteCode(String code) {
+		if(code != null) {
+			getSaTokenDao().deleteObject(splicingCodeSaveKey(code));
+		}
+	}
+
+	/**
+	 * 删除：Code索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 */
+	default void deleteCodeIndex(String clientId, Object loginId) {
+		getSaTokenDao().delete(splicingCodeIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 删除：Access-Token
+	 * @param accessToken 值
+	 */
+	default void deleteAccessToken(String accessToken) {
+		if(accessToken != null) {
+			getSaTokenDao().deleteObject(splicingAccessTokenSaveKey(accessToken));
+		}
+	}
+
+	/**
+	 * 删除：Access-Token索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 */
+	default void deleteAccessTokenIndex(String clientId, Object loginId) {
+		getSaTokenDao().delete(splicingAccessTokenIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 删除：Refresh-Token
+	 * @param refreshToken 值
+	 */
+	default void deleteRefreshToken(String refreshToken) {
+		if(refreshToken != null) {
+			getSaTokenDao().deleteObject(splicingRefreshTokenSaveKey(refreshToken));
+		}
+	}
+
+	/**
+	 * 删除：Refresh-Token索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 */
+	default void deleteRefreshTokenIndex(String clientId, Object loginId) {
+		getSaTokenDao().delete(splicingRefreshTokenIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 删除：Client-Token
+	 * @param clientToken 值
+	 */
+	default void deleteClientToken(String clientToken) {
+		if(clientToken != null) {
+			getSaTokenDao().deleteObject(splicingClientTokenSaveKey(clientToken));
+		}
+	}
+
+	/**
+	 * 删除：Client-Token索引
+	 * @param clientId 应用id
+	 */
+	default void deleteClientTokenIndex(String clientId) {
+		getSaTokenDao().delete(splicingClientTokenIndexKey(clientId));
+	}
+
+	/**
+	 * 删除：Past-Token索引
+	 * @param clientId 应用id
+	 */
+	default void deletePastTokenIndex(String clientId) {
+		getSaTokenDao().delete(splicingPastTokenIndexKey(clientId));
+	}
+
+	/**
+	 * 删除：用户授权记录
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 */
+	default void deleteGrantScope(String clientId, Object loginId) {
+		getSaTokenDao().delete(splicingGrantScopeKey(clientId, loginId));
+	}
+
+
+	// ------------------- get 数据
+
+	/**
+	 * 获取：Code Model
+	 * @param code .
+	 * @return .
+	 */
+	default CodeModel getCode(String code) {
+		if(code == null) {
+			return null;
+		}
+		return (CodeModel)getSaTokenDao().getObject(splicingCodeSaveKey(code));
+	}
+
+	/**
+	 * 获取：Code Value
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return .
+	 */
+	default String getCodeValue(String clientId, Object loginId) {
+		return getSaTokenDao().get(splicingCodeIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 获取：Access-Token Model
+	 * @param accessToken .
+	 * @return .
+	 */
+	default AccessTokenModel getAccessToken(String accessToken) {
+		if(accessToken == null) {
+			return null;
+		}
+		return (AccessTokenModel)getSaTokenDao().getObject(splicingAccessTokenSaveKey(accessToken));
+	}
+
+	/**
+	 * 获取：Access-Token Value
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return .
+	 */
+	default String getAccessTokenValue(String clientId, Object loginId) {
+		return getSaTokenDao().get(splicingAccessTokenIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 获取：Refresh-Token Model
+	 * @param refreshToken .
+	 * @return .
+	 */
+	default RefreshTokenModel getRefreshToken(String refreshToken) {
+		if(refreshToken == null) {
+			return null;
+		}
+		return (RefreshTokenModel)getSaTokenDao().getObject(splicingRefreshTokenSaveKey(refreshToken));
+	}
+
+	/**
+	 * 获取：Refresh-Token Value
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return .
+	 */
+	default String getRefreshTokenValue(String clientId, Object loginId) {
+		return getSaTokenDao().get(splicingRefreshTokenIndexKey(clientId, loginId));
+	}
+
+	/**
+	 * 获取：Client-Token Model
+	 * @param clientToken .
+	 * @return .
+	 */
+	default ClientTokenModel getClientToken(String clientToken) {
+		if(clientToken == null) {
+			return null;
+		}
+		return (ClientTokenModel)getSaTokenDao().getObject(splicingClientTokenSaveKey(clientToken));
+	}
+
+	/**
+	 * 获取：Client-Token Value
+	 * @param clientId 应用id
+	 * @return .
+	 */
+	default String getClientTokenValue(String clientId) {
+		return getSaTokenDao().get(splicingClientTokenIndexKey(clientId));
+	}
+
+	/**
+	 * 获取：Past-Token Value
+	 * @param clientId 应用id
+	 * @return .
+	 */
+	default String getPastTokenValue(String clientId) {
+		return getSaTokenDao().get(splicingPastTokenIndexKey(clientId));
+	}
+
+	/**
+	 * 获取：用户授权记录
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return 权限
+	 */
+	default List<String> getGrantScope(String clientId, Object loginId) {
+		String value = getSaTokenDao().get(splicingGrantScopeKey(clientId, loginId));
+		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(value);
+	}
+
+
+	// ------------------- 拼接key
+
+	/**
+	 * 拼接key：Code持久化
+	 * @param code 授权码
+	 * @return key
+	 */
+	default String splicingCodeSaveKey(String code) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:code:" + code;
+	}
+
+	/**
+	 * 拼接key：Code索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return key
+	 */
+	default String splicingCodeIndexKey(String clientId, Object loginId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:code-index:" + clientId + ":" + loginId;
+	}
+
+	/**
+	 * 拼接key：Access-Token持久化
+	 * @param accessToken accessToken
+	 * @return key
+	 */
+	default String splicingAccessTokenSaveKey(String accessToken) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:access-token:" + accessToken;
+	}
+
+	/**
+	 * 拼接key：Access-Token索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return key
+	 */
+	default String splicingAccessTokenIndexKey(String clientId, Object loginId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:access-token-index:" + clientId + ":" + loginId;
+	}
+
+	/**
+	 * 拼接key：Refresh-Token持久化
+	 * @param refreshToken refreshToken
+	 * @return key
+	 */
+	default String splicingRefreshTokenSaveKey(String refreshToken) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:refresh-token:" + refreshToken;
+	}
+
+	/**
+	 * 拼接key：Refresh-Token索引
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return key
+	 */
+	default String splicingRefreshTokenIndexKey(String clientId, Object loginId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:refresh-token-index:" + clientId + ":" + loginId;
+	}
+
+	/**
+	 * 拼接key：Client-Token持久化
+	 * @param clientToken clientToken
+	 * @return key
+	 */
+	default String splicingClientTokenSaveKey(String clientToken) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:client-token:" + clientToken;
+	}
+
+	/**
+	 * 拼接key：Client-Token 索引
+	 * @param clientId clientId
+	 * @return key
+	 */
+	default String splicingClientTokenIndexKey(String clientId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:client-token-index:" + clientId;
+	}
+
+	/**
+	 * 拼接key：Past-Token 索引
+	 * @param clientId clientId
+	 * @return key
+	 */
+	default String splicingPastTokenIndexKey(String clientId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:past-token-index:" + clientId;
+	}
+
+	/**
+	 * 拼接key：用户授权记录
+	 * @param clientId 应用id
+	 * @param loginId 账号id
+	 * @return key
+	 */
+	default String splicingGrantScopeKey(String clientId, Object loginId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:grant-scope:" + clientId + ":" + loginId;
+	}
+
+
+	// -------- bean 对象代理
+
+	/**
+	 * 获取使用的 getSaTokenDao 实例
+	 * 
+	 * @return /
+	 */
+	default SaTokenDao getSaTokenDao() {
+		return SaManager.getSaTokenDao();
+	}
+
+	/**
+	 * 获取使用的 SaTokenConfig 实例
+	 *
+	 * @return /
+	 */
+	default SaTokenConfig getSaTokenConfig() {
+		return SaManager.getConfig();
+	}
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2DaoDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2DaoDefaultImpl.java
new file mode 100644
index 00000000..0ebd09f2
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2DaoDefaultImpl.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.dao;
+
+/**
+ * Sa-Token OAuth2 数据持久层，默认实现
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2DaoDefaultImpl implements SaOAuth2Dao {
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java
new file mode 100644
index 00000000..e64892db
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.scope;
+
+/**
+ * OAuth2 常见权限定义
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public final class CommonScope {
+
+    private CommonScope() {
+    }
+
+    /**
+     * 获取 openid
+     */
+    public static final String OPENID = "openid";
+
+    /**
+     * 获取用户信息
+     */
+    public static final String USERINFO = "userinfo";
+
+    /**
+     * 获取 id_token
+     */
+    public static final String OIDC = "oidc";
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index cf9e1bd1..df9fc99f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -15,10 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.template;
 
-import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
+import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
@@ -76,7 +76,7 @@ public class SaOAuth2Template {
 	 * @return .
 	 */
 	public AccessTokenModel checkAccessToken(String accessToken) {
-		AccessTokenModel at = getAccessToken(accessToken);
+		AccessTokenModel at = SaOAuth2Manager.getDao().getAccessToken(accessToken);
 		SaOAuth2Exception.throwBy(at == null, "无效access_token：" + accessToken, SaOAuth2ErrorCode.CODE_30106);
 		return at;
 	}
@@ -86,7 +86,7 @@ public class SaOAuth2Template {
 	 * @return .
 	 */
 	public ClientTokenModel checkClientToken(String clientToken) {
-		ClientTokenModel ct = getClientToken(clientToken);
+		ClientTokenModel ct = SaOAuth2Manager.getDao().getClientToken(clientToken);
 		SaOAuth2Exception.throwBy(ct == null, "无效：client_token" + clientToken, SaOAuth2ErrorCode.CODE_30107);
 		return ct;
 	}
@@ -155,16 +155,19 @@ public class SaOAuth2Template {
 	 */
 	public CodeModel generateCode(RequestAuthModel ra) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 删除旧Code
-		deleteCode(getCodeValue(ra.clientId, ra.loginId));
+		String oldCodeValue = SaOAuth2Manager.getDao().getCodeValue(ra.clientId, ra.loginId);
+		dao.deleteCode(oldCodeValue);
 
 		// 生成新Code
-		String code = randomCode(ra.clientId, ra.loginId, ra.scopes);
-		CodeModel cm = new CodeModel(code, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
+		String codeValue = randomCode(ra.clientId, ra.loginId, ra.scopes);
+		CodeModel cm = new CodeModel(codeValue, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
 
 		// 保存新Code
-		saveCode(cm);
-		saveCodeIndex(cm);
+		dao.saveCode(cm);
+		dao.saveCodeIndex(cm);
 
 		// 返回
 		return cm;
@@ -176,13 +179,15 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel generateAccessToken(String code) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 1、先校验
-		CodeModel cm = getCode(code);
+		CodeModel cm = dao.getCode(code);
 		SaOAuth2Exception.throwBy(cm == null, "无效code", SaOAuth2ErrorCode.CODE_30110);
 
 		// 2、删除旧Token
-		deleteAccessToken(getAccessTokenValue(cm.clientId, cm.loginId));
-		deleteRefreshToken(getRefreshTokenValue(cm.clientId, cm.loginId));
+		dao.deleteAccessToken(dao.getAccessTokenValue(cm.clientId, cm.loginId));
+		dao.deleteRefreshToken(dao.getRefreshTokenValue(cm.clientId, cm.loginId));
 
 		// 3、生成token
 		AccessTokenModel at = convertCodeToAccessToken(cm);
@@ -191,14 +196,14 @@ public class SaOAuth2Template {
 		at.refreshExpiresTime = rt.expiresTime;
 
 		// 4、保存token
-		saveAccessToken(at);
-		saveAccessTokenIndex(at);
-		saveRefreshToken(rt);
-		saveRefreshTokenIndex(rt);
+		dao.saveAccessToken(at);
+		dao.saveAccessTokenIndex(at);
+		dao.saveRefreshToken(rt);
+		dao.saveRefreshTokenIndex(rt);
 
 		// 5、删除此Code
-		deleteCode(code);
-		deleteCodeIndex(cm.clientId, cm.loginId);
+		dao.deleteCode(code);
+		dao.deleteCodeIndex(cm.clientId, cm.loginId);
 
 		// 6、返回 Access-Token
 		return at;
@@ -210,30 +215,32 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel refreshAccessToken(String refreshToken) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 获取 Refresh-Token 信息
-		RefreshTokenModel rt = getRefreshToken(refreshToken);
+		RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
 		SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30111);
 		
 		// 如果配置了[每次刷新产生新的Refresh-Token]
 		if(checkClientModel(rt.clientId).getIsNewRefresh()) {
 			// 删除旧 Refresh-Token
-			deleteRefreshToken(rt.refreshToken);
+			dao.deleteRefreshToken(rt.refreshToken);
 
 			// 创建并保持新的 Refresh-Token
 			rt = convertRefreshTokenToRefreshToken(rt);
-			saveRefreshToken(rt);
-			saveRefreshTokenIndex(rt);
+			dao.saveRefreshToken(rt);
+			dao.saveRefreshTokenIndex(rt);
 		}
 
 		// 删除旧 Access-Token
-		deleteAccessToken(getAccessTokenValue(rt.clientId, rt.loginId));
+		dao.deleteAccessToken(dao.getAccessTokenValue(rt.clientId, rt.loginId));
 
 		// 生成新 Access-Token
 		AccessTokenModel at = convertRefreshTokenToAccessToken(rt);
 
 		// 保存新 Access-Token
-		saveAccessToken(at);
-		saveAccessTokenIndex(at);
+		dao.saveAccessToken(at);
+		dao.saveAccessTokenIndex(at);
 
 		// 返回新 Access-Token
 		return at;
@@ -246,10 +253,12 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 1、删除 旧Token
-		deleteAccessToken(getAccessTokenValue(ra.clientId, ra.loginId));
+		dao.deleteAccessToken(dao.getAccessTokenValue(ra.clientId, ra.loginId));
 		if(isCreateRt) {
-			deleteRefreshToken(getRefreshTokenValue(ra.clientId, ra.loginId));
+			dao.deleteRefreshToken(dao.getRefreshTokenValue(ra.clientId, ra.loginId));
 		}
 
 		// 2、生成 新Access-Token
@@ -261,13 +270,13 @@ public class SaOAuth2Template {
 		// 3、生成&保存 Refresh-Token
 		if(isCreateRt) {
 			RefreshTokenModel rt = convertAccessTokenToRefreshToken(at);
-			saveRefreshToken(rt);
-			saveRefreshTokenIndex(rt);
+			dao.saveRefreshToken(rt);
+			dao.saveRefreshTokenIndex(rt);
 		}
 
 		// 5、保存 新Access-Token
-		saveAccessToken(at);
-		saveAccessTokenIndex(at);
+		dao.saveAccessToken(at);
+		dao.saveAccessTokenIndex(at);
 
 		// 6、返回 新Access-Token
 		return at;
@@ -279,18 +288,21 @@ public class SaOAuth2Template {
 	 * @return Client-Token Model
 	 */
 	public ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
+
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 1、删掉旧 Past-Token
-		deleteClientToken(getPastTokenValue(clientId));
+		dao.deleteClientToken(dao.getPastTokenValue(clientId));
 
 		// 2、将旧Client-Token 标记为新 Past-Token
-		ClientTokenModel oldCt = getClientToken(getClientTokenValue(clientId));
-		savePastTokenIndex(oldCt);
-		
+		ClientTokenModel oldCt = dao.getClientToken(dao.getClientTokenValue(clientId));
+		dao.savePastTokenIndex(oldCt);
+
 		// 2.5、如果配置了 PastClientToken 的 ttl ，则需要更新一下 
 		SaClientModel cm = checkClientModel(clientId);
 		if(oldCt != null && cm.getPastClientTokenTimeout() != -1) {
 			oldCt.expiresTime = System.currentTimeMillis() + (cm.getPastClientTokenTimeout() * 1000);
-			saveClientToken(oldCt);
+			dao.saveClientToken(oldCt);
 		}
 
 		// 3、生成新Client-Token
@@ -298,8 +310,8 @@ public class SaOAuth2Template {
 		ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
 
 		// 3、保存新Client-Token 
-		saveClientToken(ct);
-		saveClientTokenIndex(ct);
+		dao.saveClientToken(ct);
+		dao.saveClientTokenIndex(ct);
 
 		// 4、返回
 		return ct;
@@ -338,20 +350,22 @@ public class SaOAuth2Template {
 	 */
 	public void revokeAccessToken(String accessToken) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 如果查不到任何东西, 直接返回
-		AccessTokenModel at = getAccessToken(accessToken);
+		AccessTokenModel at = dao.getAccessToken(accessToken);
 		if(at == null) {
 			return;
 		}
 
 		// 删除 Access-Token
-		deleteAccessToken(accessToken);
-		deleteAccessTokenIndex(at.clientId, at.loginId);
+		dao.deleteAccessToken(accessToken);
+		dao.deleteAccessTokenIndex(at.clientId, at.loginId);
 
 		// 删除对应的 Refresh-Token
-		String refreshToken = getRefreshTokenValue(at.clientId, at.loginId);
-		deleteRefreshToken(refreshToken);
-		deleteRefreshTokenIndex(at.clientId, at.loginId);
+		String refreshToken = dao.getRefreshTokenValue(at.clientId, at.loginId);
+		dao.deleteRefreshToken(refreshToken);
+		dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
 	}
 
 	// ------------------- check 数据校验
@@ -363,7 +377,8 @@ public class SaOAuth2Template {
 	 * @return 是否已经授权
 	 */
 	public boolean isGrant(Object loginId, String clientId, List<String> scopes) {
-		List<String> grantScopeList = getGrantScope(clientId, loginId);
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+		List<String> grantScopeList = dao.getGrantScope(clientId, loginId);
         return scopes.isEmpty() || new HashSet<>(grantScopeList).containsAll(scopes);
 	}
 	/**
@@ -511,8 +526,10 @@ public class SaOAuth2Template {
 	 */
 	public CodeModel checkGainTokenParam(String code, String clientId, String clientSecret, String redirectUri) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 校验：Code是否存在
-		CodeModel cm = getCode(code);
+		CodeModel cm = dao.getCode(code);
 		SaOAuth2Exception.throwBy(cm == null, "无效code: " + code, SaOAuth2ErrorCode.CODE_30117);
 
 		// 校验：ClientId是否一致
@@ -539,8 +556,10 @@ public class SaOAuth2Template {
 	 */
 	public RefreshTokenModel checkRefreshTokenParam(String clientId, String clientSecret, String refreshToken) {
 
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
 		// 校验：Refresh-Token是否存在
-		RefreshTokenModel rt = getRefreshToken(refreshToken);
+		RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
 		SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30121);
 
 		// 校验：ClientId是否一致
@@ -636,299 +655,6 @@ public class SaOAuth2Template {
 		return newRt;
 	}
 
-	// ------------------- save 数据
-	/**
-	 * 持久化：Code-Model
-	 * @param c .
-	 */
-	public void saveCode(CodeModel c) {
-		if(c == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().setObject(splicingCodeSaveKey(c.code), c, SaOAuth2Manager.getConfig().getCodeTimeout());
-	}
-	/**
-	 * 持久化：Code-索引
-	 * @param c .
-	 */
-	public void saveCodeIndex(CodeModel c) {
-		if(c == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().set(splicingCodeIndexKey(c.clientId, c.loginId), c.code, SaOAuth2Manager.getConfig().getCodeTimeout());
-	}
-	/**
-	 * 持久化：AccessToken-Model
-	 * @param at .
-	 */
-	public void saveAccessToken(AccessTokenModel at) {
-		if(at == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().setObject(splicingAccessTokenSaveKey(at.accessToken), at, at.getExpiresIn());
-	}
-	/**
-	 * 持久化：AccessToken-索引
-	 * @param at .
-	 */
-	public void saveAccessTokenIndex(AccessTokenModel at) {
-		if(at == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().set(splicingAccessTokenIndexKey(at.clientId, at.loginId), at.accessToken, at.getExpiresIn());
-	}
-	/**
-	 * 持久化：RefreshToken-Model
-	 * @param rt .
-	 */
-	public void saveRefreshToken(RefreshTokenModel rt) {
-		if(rt == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().setObject(splicingRefreshTokenSaveKey(rt.refreshToken), rt, rt.getExpiresIn());
-	}
-	/**
-	 * 持久化：RefreshToken-索引
-	 * @param rt .
-	 */
-	public void saveRefreshTokenIndex(RefreshTokenModel rt) {
-		if(rt == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().set(splicingRefreshTokenIndexKey(rt.clientId, rt.loginId), rt.refreshToken, rt.getExpiresIn());
-	}
-	/**
-	 * 持久化：ClientToken-Model
-	 * @param ct .
-	 */
-	public void saveClientToken(ClientTokenModel ct) {
-		if(ct == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().setObject(splicingClientTokenSaveKey(ct.clientToken), ct, ct.getExpiresIn());
-	}
-	/**
-	 * 持久化：ClientToken-索引
-	 * @param ct .
-	 */
-	public void saveClientTokenIndex(ClientTokenModel ct) {
-		if(ct == null) {
-			return;
-		}
-		SaManager.getSaTokenDao().set(splicingClientTokenIndexKey(ct.clientId), ct.clientToken, ct.getExpiresIn());
-	}
-	/**
-	 * 持久化：Past-Token-索引
-	 * @param ct .
-	 */
-	public void savePastTokenIndex(ClientTokenModel ct) {
-		if(ct == null) {
-			return;
-		}
-		long ttl = ct.getExpiresIn();
-		SaClientModel cm = checkClientModel(ct.clientId);
-		if (cm.getPastClientTokenTimeout() != -1) {
-			ttl = cm.getPastClientTokenTimeout();
-		}
-		SaManager.getSaTokenDao().set(splicingPastTokenIndexKey(ct.clientId), ct.clientToken, ttl);
-	}
-	/**
-	 * 持久化：用户授权记录
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @param scopes 权限列表
-	 */
-	public void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
-		if( ! SaFoxUtil.isEmpty(scopes)) {
-			long ttl = checkClientModel(clientId).getAccessTokenTimeout();
-			String value = SaOAuth2Manager.getDataConverter().convertScopeListToString(scopes);
-			SaManager.getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), value, ttl);
-		}
-	}
-
-	// ------------------- get 数据
-	/**
-	 * 获取：Code Model
-	 * @param code .
-	 * @return .
-	 */
-	public CodeModel getCode(String code) {
-		if(code == null) {
-			return null;
-		}
-		return (CodeModel)SaManager.getSaTokenDao().getObject(splicingCodeSaveKey(code));
-	}
-	/**
-	 * 获取：Code Value
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return .
-	 */
-	public String getCodeValue(String clientId, Object loginId) {
-		return SaManager.getSaTokenDao().get(splicingCodeIndexKey(clientId, loginId));
-	}
-	/**
-	 * 获取：Access-Token Model
-	 * @param accessToken .
-	 * @return .
-	 */
-	public AccessTokenModel getAccessToken(String accessToken) {
-		if(accessToken == null) {
-			return null;
-		}
-		return (AccessTokenModel)SaManager.getSaTokenDao().getObject(splicingAccessTokenSaveKey(accessToken));
-	}
-	/**
-	 * 获取：Access-Token Value
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return .
-	 */
-	public String getAccessTokenValue(String clientId, Object loginId) {
-		return SaManager.getSaTokenDao().get(splicingAccessTokenIndexKey(clientId, loginId));
-	}
-	/**
-	 * 获取：Refresh-Token Model
-	 * @param refreshToken .
-	 * @return .
-	 */
-	public RefreshTokenModel getRefreshToken(String refreshToken) {
-		if(refreshToken == null) {
-			return null;
-		}
-		return (RefreshTokenModel)SaManager.getSaTokenDao().getObject(splicingRefreshTokenSaveKey(refreshToken));
-	}
-	/**
-	 * 获取：Refresh-Token Value
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return .
-	 */
-	public String getRefreshTokenValue(String clientId, Object loginId) {
-		return SaManager.getSaTokenDao().get(splicingRefreshTokenIndexKey(clientId, loginId));
-	}
-	/**
-	 * 获取：Client-Token Model
-	 * @param clientToken .
-	 * @return .
-	 */
-	public ClientTokenModel getClientToken(String clientToken) {
-		if(clientToken == null) {
-			return null;
-		}
-		return (ClientTokenModel)SaManager.getSaTokenDao().getObject(splicingClientTokenSaveKey(clientToken));
-	}
-	/**
-	 * 获取：Client-Token Value
-	 * @param clientId 应用id
-	 * @return .
-	 */
-	public String getClientTokenValue(String clientId) {
-		return SaManager.getSaTokenDao().get(splicingClientTokenIndexKey(clientId));
-	}
-	/**
-	 * 获取：Past-Token Value
-	 * @param clientId 应用id
-	 * @return .
-	 */
-	public String getPastTokenValue(String clientId) {
-		return SaManager.getSaTokenDao().get(splicingPastTokenIndexKey(clientId));
-	}
-	/**
-	 * 获取：用户授权记录
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return 权限
-	 */
-	public List<String> getGrantScope(String clientId, Object loginId) {
-		String value = SaManager.getSaTokenDao().get(splicingGrantScopeKey(clientId, loginId));
-		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(value);
-	}
-
-	// ------------------- delete数据
-	/**
-	 * 删除：Code
-	 * @param code 值
-	 */
-	public void deleteCode(String code) {
-		if(code != null) {
-			SaManager.getSaTokenDao().deleteObject(splicingCodeSaveKey(code));
-		}
-	}
-	/**
-	 * 删除：Code索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 */
-	public void deleteCodeIndex(String clientId, Object loginId) {
-		SaManager.getSaTokenDao().delete(splicingCodeIndexKey(clientId, loginId));
-	}
-	/**
-	 * 删除：Access-Token
-	 * @param accessToken 值
-	 */
-	public void deleteAccessToken(String accessToken) {
-		if(accessToken != null) {
-			SaManager.getSaTokenDao().deleteObject(splicingAccessTokenSaveKey(accessToken));
-		}
-	}
-	/**
-	 * 删除：Access-Token索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 */
-	public void deleteAccessTokenIndex(String clientId, Object loginId) {
-		SaManager.getSaTokenDao().delete(splicingAccessTokenIndexKey(clientId, loginId));
-	}
-	/**
-	 * 删除：Refresh-Token
-	 * @param refreshToken 值
-	 */
-	public void deleteRefreshToken(String refreshToken) {
-		if(refreshToken != null) {
-			SaManager.getSaTokenDao().deleteObject(splicingRefreshTokenSaveKey(refreshToken));
-		}
-	}
-	/**
-	 * 删除：Refresh-Token索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 */
-	public void deleteRefreshTokenIndex(String clientId, Object loginId) {
-		SaManager.getSaTokenDao().delete(splicingRefreshTokenIndexKey(clientId, loginId));
-	}
-	/**
-	 * 删除：Client-Token
-	 * @param clientToken 值
-	 */
-	public void deleteClientToken(String clientToken) {
-		if(clientToken != null) {
-			SaManager.getSaTokenDao().deleteObject(splicingClientTokenSaveKey(clientToken));
-		}
-	}
-	/**
-	 * 删除：Client-Token索引
-	 * @param clientId 应用id
-	 */
-	public void deleteClientTokenIndex(String clientId) {
-		SaManager.getSaTokenDao().delete(splicingClientTokenIndexKey(clientId));
-	}
-	/**
-	 * 删除：Past-Token索引
-	 * @param clientId 应用id
-	 */
-	public void deletePastTokenIndex(String clientId) {
-		SaManager.getSaTokenDao().delete(splicingPastTokenIndexKey(clientId));
-	}
-	/**
-	 * 删除：用户授权记录
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 */
-	public void deleteGrantScope(String clientId, Object loginId) {
-		SaManager.getSaTokenDao().delete(splicingGrantScopeKey(clientId, loginId));
-	}
-
 	// ------------------- Random数据
 	/**
 	 * 随机一个 Code
@@ -970,90 +696,30 @@ public class SaOAuth2Template {
 		return SaFoxUtil.getRandomString(60);
 	}
 
-	// ------------------- 拼接key
-	/**
-	 * 拼接key：Code持久化
-	 * @param code 授权码
-	 * @return key
-	 */
-	public String splicingCodeSaveKey(String code) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:code:" + code;
-	}
-	/**
-	 * 拼接key：Code索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return key
-	 */
-	public String splicingCodeIndexKey(String clientId, Object loginId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:code-index:" + clientId + ":" + loginId;
-	}
-	/**
-	 * 拼接key：Access-Token持久化
-	 * @param accessToken accessToken
-	 * @return key
-	 */
-	public String splicingAccessTokenSaveKey(String accessToken) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:access-token:" + accessToken;
-	}
-	/**
-	 * 拼接key：Access-Token索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return key
-	 */
-	public String splicingAccessTokenIndexKey(String clientId, Object loginId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:access-token-index:" + clientId + ":" + loginId;
-	}
-	/**
-	 * 拼接key：Refresh-Token持久化
-	 * @param refreshToken refreshToken
-	 * @return key
-	 */
-	public String splicingRefreshTokenSaveKey(String refreshToken) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:refresh-token:" + refreshToken;
-	}
-	/**
-	 * 拼接key：Refresh-Token索引
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return key
-	 */
-	public String splicingRefreshTokenIndexKey(String clientId, Object loginId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:refresh-token-index:" + clientId + ":" + loginId;
-	}
-	/**
-	 * 拼接key：Client-Token持久化
-	 * @param clientToken clientToken
-	 * @return key
-	 */
-	public String splicingClientTokenSaveKey(String clientToken) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:client-token:" + clientToken;
-	}
-	/**
-	 * 拼接key：Client-Token 索引
-	 * @param clientId clientId
-	 * @return key
-	 */
-	public String splicingClientTokenIndexKey(String clientId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:client-token-index:" + clientId;
-	}
+
+	// ------------------- 包装其它 bean 的方法
+
 	/**
-	 * 拼接key：Past-Token 索引
-	 * @param clientId clientId
-	 * @return key
+	 * 获取：Access-Token Model
+	 * @param accessToken /
+	 * @return /
 	 */
-	public String splicingPastTokenIndexKey(String clientId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:past-token-index:" + clientId;
+	public AccessTokenModel getAccessToken(String accessToken) {
+		return SaOAuth2Manager.getDao().getAccessToken(accessToken);
 	}
+
 	/**
-	 * 拼接key：用户授权记录
+	 * 持久化：用户授权记录
 	 * @param clientId 应用id
 	 * @param loginId 账号id
-	 * @return key
+	 * @param scopes 权限列表
 	 */
-	public String splicingGrantScopeKey(String clientId, Object loginId) {
-		return SaManager.getConfig().getTokenName() + ":oauth2:grant-scope:" + clientId + ":" + loginId;
+	public void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
+		SaOAuth2Manager.getDao().saveGrantScope(clientId, loginId, scopes);
 	}
 
+
+
+
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index d7886714..beb1b3ac 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.template;
 
 import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
@@ -281,7 +282,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static CodeModel getCode(String code) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getCode(code);
+		return SaOAuth2Manager.getDao().getCode(code);
 	}
 
 	/**
@@ -290,7 +291,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static AccessTokenModel getAccessToken(String accessToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getAccessToken(accessToken);
+		return SaOAuth2Manager.getDao().getAccessToken(accessToken);
 	}
 	
 	/**
@@ -299,7 +300,7 @@ public class SaOAuth2Util {
 	 * @return . 
 	 */
 	public static RefreshTokenModel getRefreshToken(String refreshToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getRefreshToken(refreshToken);
+		return SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
 	}
 	
 	/**
@@ -308,7 +309,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static ClientTokenModel getClientToken(String clientToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getClientToken(clientToken);
+		return SaOAuth2Manager.getDao().getClientToken(clientToken);
 	}
 	
 	/**
@@ -318,7 +319,7 @@ public class SaOAuth2Util {
 	 * @return 权限 
 	 */
 	public static List<String> getGrantScope(String clientId, Object loginId) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getGrantScope(clientId, loginId);
+		return SaOAuth2Manager.getDao().getGrantScope(clientId, loginId);
 	}
 
 }
-- 
Gitee


From 2b46d27b877039d85f7e89e12e17646ae0da4bb2 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 09:53:44 +0800
Subject: [PATCH 129/172] =?UTF-8?q?=E6=8A=BD=E5=8F=96=E6=95=B0=E6=8D=AE?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E5=99=A8=E6=8E=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dev33/satoken/oauth2/SaOAuth2Manager.java |  22 +-
 .../data/convert/SaOAuth2DataConverter.java   |  33 ++
 .../SaOAuth2DataConverterDefaultImpl.java     |  82 +++++
 .../data/generate/SaOAuth2DataGenerate.java   |  96 +++++
 .../SaOAuth2DataGenerateDefaultImpl.java      | 274 +++++++++++++++
 .../data/loader/SaOAuth2DataLoader.java       |  63 ++++
 .../SaOAuth2DataResolverDefaultImpl.java      |   1 +
 .../processor/SaOAuth2ServerProcessor.java    |  18 +-
 .../oauth2/template/SaOAuth2Template.java     | 328 ------------------
 .../satoken/oauth2/template/SaOAuth2Util.java |  77 ----
 10 files changed, 579 insertions(+), 415 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 1110aae4..0d9d1790 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -20,6 +20,8 @@ import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2DaoDefaultImpl;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverterDefaultImpl;
+import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
+import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerateDefaultImpl;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoaderDefaultImpl;
 import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
@@ -89,7 +91,7 @@ public class SaOAuth2Manager {
 	}
 
 	/**
-	 * OAuth2 数据格式转换器
+	 * OAuth2 数据格式转换器 Bean
 	 */
 	private static volatile SaOAuth2DataConverter dataConverter;
 	public static SaOAuth2DataConverter getDataConverter() {
@@ -106,6 +108,24 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.dataConverter = dataConverter;
 	}
 
+	/**
+	 * OAuth2 数据构建器 Bean
+	 */
+	private static volatile SaOAuth2DataGenerate dataGenerate;
+	public static SaOAuth2DataGenerate getDataGenerate() {
+		if (dataGenerate == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (dataGenerate == null) {
+					setDataGenerate(new SaOAuth2DataGenerateDefaultImpl());
+				}
+			}
+		}
+		return dataGenerate;
+	}
+	public static void setDataGenerate(SaOAuth2DataGenerate dataGenerate) {
+		SaOAuth2Manager.dataGenerate = dataGenerate;
+	}
+
 	/**
 	 * OAuth2 数据持久 Bean
 	 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
index 9a9e953b..fddeb33a 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
@@ -15,6 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.data.convert;
 
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+
 import java.util.List;
 
 /**
@@ -46,4 +50,33 @@ public interface SaOAuth2DataConverter {
      */
     List<String> convertAllowUrlStringToList(String allowUrl);
 
+
+    /**
+     * 将 Code 转换为 Access-Token
+     * @param cm CodeModel对象
+     * @return AccessToken对象
+     */
+    AccessTokenModel convertCodeToAccessToken(CodeModel cm);
+
+    /**
+     * 将 Access-Token 转换为 Refresh-Token
+     * @param at /
+     * @return /
+     */
+    RefreshTokenModel convertAccessTokenToRefreshToken(AccessTokenModel at);
+
+    /**
+     * 将 Refresh-Token 转换为 Access-Token
+     * @param rt /
+     * @return /
+     */
+    AccessTokenModel convertRefreshTokenToAccessToken(RefreshTokenModel rt);
+
+    /**
+     * 根据 Refresh-Token 创建一个新的 Refresh-Token
+     * @param rt /
+     * @return /
+     */
+    RefreshTokenModel convertRefreshTokenToRefreshToken(RefreshTokenModel rt);
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 523e3f9e..74570f11 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -15,6 +15,11 @@
  */
 package cn.dev33.satoken.oauth2.data.convert;
 
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+import cn.dev33.satoken.oauth2.data.model.SaClientModel;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.Collections;
@@ -61,5 +66,82 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         return SaFoxUtil.convertStringToList(allowUrl);
     }
 
+    /**
+     * 将 Code 转换为 Access-Token
+     */
+    @Override
+    public AccessTokenModel convertCodeToAccessToken(CodeModel cm) {
+        AccessTokenModel at = new AccessTokenModel();
+        at.accessToken = SaOAuth2Manager.getDataLoader().randomAccessToken(cm.clientId, cm.loginId, cm.scopes);
+        // at.refreshToken = randomRefreshToken(cm.clientId, cm.loginId, cm.scope);
+        at.clientId = cm.clientId;
+        at.loginId = cm.loginId;
+        at.scopes = cm.scopes;
+        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(cm.clientId, cm.loginId);
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(cm.clientId);
+        at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
+        // at.refreshExpiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getRefreshTokenTimeout() * 1000);
+        return at;
+    }
+
+    /**
+     * 将 Access-Token 转换为 Refresh-Token
+     * @param at .
+     * @return .
+     */
+    @Override
+    public RefreshTokenModel convertAccessTokenToRefreshToken(AccessTokenModel at) {
+        RefreshTokenModel rt = new RefreshTokenModel();
+        rt.refreshToken = SaOAuth2Manager.getDataLoader().randomRefreshToken(at.clientId, at.loginId, at.scopes);
+        rt.clientId = at.clientId;
+        rt.loginId = at.loginId;
+        rt.scopes = at.scopes;
+        rt.openid = at.openid;
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(at.clientId);
+        rt.expiresTime = System.currentTimeMillis() + (clientModel.getRefreshTokenTimeout() * 1000);
+        // 改变at属性
+        at.refreshToken = rt.refreshToken;
+        at.refreshExpiresTime = rt.expiresTime;
+        return rt;
+    }
+
+    /**
+     * 将 Refresh-Token 转换为 Access-Token
+     * @param rt .
+     * @return .
+     */
+    @Override
+    public AccessTokenModel convertRefreshTokenToAccessToken(RefreshTokenModel rt) {
+        AccessTokenModel at = new AccessTokenModel();
+        at.accessToken = SaOAuth2Manager.getDataLoader().randomAccessToken(rt.clientId, rt.loginId, rt.scopes);
+        at.refreshToken = rt.refreshToken;
+        at.clientId = rt.clientId;
+        at.loginId = rt.loginId;
+        at.scopes = rt.scopes;
+        at.openid = rt.openid;
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
+        at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
+        at.refreshExpiresTime = rt.expiresTime;
+        return at;
+    }
+
+    /**
+     * 根据 Refresh-Token 创建一个新的 Refresh-Token
+     * @param rt .
+     * @return .
+     */
+    @Override
+    public RefreshTokenModel convertRefreshTokenToRefreshToken(RefreshTokenModel rt) {
+        RefreshTokenModel newRt = new RefreshTokenModel();
+        newRt.refreshToken = SaOAuth2Manager.getDataLoader().randomRefreshToken(rt.clientId, rt.loginId, rt.scopes);
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
+        newRt.expiresTime = System.currentTimeMillis() + (clientModel.getRefreshTokenTimeout() * 1000);
+        newRt.clientId = rt.clientId;
+        newRt.scopes = rt.scopes;
+        newRt.loginId = rt.loginId;
+        newRt.openid = rt.openid;
+        return newRt;
+    }
+
 }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
new file mode 100644
index 00000000..92a89010
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.generate;
+
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RequestAuthModel;
+
+import java.util.List;
+
+/**
+ * Sa-Token OAuth2 数据构建器，负责相关 Model 数据构建
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2DataGenerate {
+
+    // ------------------- generate 构建数据
+
+    /**
+     * 构建Model：Code授权码
+     * @param ra 请求参数Model
+     * @return 授权码Model
+     */
+    public CodeModel generateCode(RequestAuthModel ra);
+
+    /**
+     * 构建Model：Access-Token
+     * @param code 授权码Model
+     * @return AccessToken Model
+     */
+    public AccessTokenModel generateAccessToken(String code);
+
+    /**
+     * 刷新Model：根据 Refresh-Token 生成一个新的 Access-Token
+     * @param refreshToken Refresh-Token值
+     * @return 新的 Access-Token
+     */
+    public AccessTokenModel refreshAccessToken(String refreshToken);
+
+    /**
+     * 构建Model：Access-Token (根据RequestAuthModel构建，用于隐藏式 and 密码式)
+     * @param ra 请求参数Model
+     * @param isCreateRt 是否生成对应的Refresh-Token
+     * @return Access-Token Model
+     */
+    public AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt);
+
+    /**
+     * 构建Model：Client-Token
+     * @param clientId 应用id
+     * @param scopes 授权范围
+     * @return Client-Token Model
+     */
+    public ClientTokenModel generateClientToken(String clientId, List<String> scopes);
+
+    /**
+     * 构建URL：下放Code URL (Authorization Code 授权码)
+     * @param redirectUri 下放地址
+     * @param code code参数
+     * @param state state参数
+     * @return 构建完毕的URL
+     */
+    public String buildRedirectUri(String redirectUri, String code, String state);
+
+    /**
+     * 构建URL：下放Access-Token URL （implicit 隐藏式）
+     * @param redirectUri 下放地址
+     * @param token token
+     * @param state state参数
+     * @return 构建完毕的URL
+     */
+    public String buildImplicitRedirectUri(String redirectUri, String token, String state);
+
+    /**
+     * 回收 Access-Token
+     * @param accessToken Access-Token值
+     */
+    public void revokeAccessToken(String accessToken);
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
new file mode 100644
index 00000000..b4a114a3
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -0,0 +1,274 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.generate;
+
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
+import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.util.List;
+
+/**
+ * Sa-Token OAuth2 数据构建器，默认实现类
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
+    // ------------------- generate 构建数据
+
+    /**
+     * 构建Model：Code授权码
+     * @param ra 请求参数Model
+     * @return 授权码Model
+     */
+    @Override
+    public CodeModel generateCode(RequestAuthModel ra) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 删除旧Code
+        dao.deleteCode(dao.getCodeValue(ra.clientId, ra.loginId));
+
+        // 生成新Code
+        String codeValue = SaOAuth2Manager.getDataLoader().randomCode(ra.clientId, ra.loginId, ra.scopes);
+        CodeModel cm = new CodeModel(codeValue, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
+
+        // 保存新Code
+        dao.saveCode(cm);
+        dao.saveCodeIndex(cm);
+
+        // 返回
+        return cm;
+    }
+
+    /**
+     * 构建Model：Access-Token
+     * @param code 授权码Model
+     * @return AccessToken Model
+     */
+    @Override
+    public AccessTokenModel generateAccessToken(String code) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 1、先校验
+        CodeModel cm = dao.getCode(code);
+        SaOAuth2Exception.throwBy(cm == null, "无效code", SaOAuth2ErrorCode.CODE_30110);
+
+        // 2、删除旧Token
+        dao.deleteAccessToken(dao.getAccessTokenValue(cm.clientId, cm.loginId));
+        dao.deleteRefreshToken(dao.getRefreshTokenValue(cm.clientId, cm.loginId));
+
+        // 3、生成token
+        AccessTokenModel at = SaOAuth2Manager.getDataConverter().convertCodeToAccessToken(cm);
+        RefreshTokenModel rt = SaOAuth2Manager.getDataConverter().convertAccessTokenToRefreshToken(at);
+        at.refreshToken = rt.refreshToken;
+        at.refreshExpiresTime = rt.expiresTime;
+
+        // 4、保存token
+        dao.saveAccessToken(at);
+        dao.saveAccessTokenIndex(at);
+        dao.saveRefreshToken(rt);
+        dao.saveRefreshTokenIndex(rt);
+
+        // 5、删除此Code
+        dao.deleteCode(code);
+        dao.deleteCodeIndex(cm.clientId, cm.loginId);
+
+        // 6、返回 Access-Token
+        return at;
+    }
+
+    /**
+     * 刷新Model：根据 Refresh-Token 生成一个新的 Access-Token
+     * @param refreshToken Refresh-Token值
+     * @return 新的 Access-Token
+     */
+    @Override
+    public AccessTokenModel refreshAccessToken(String refreshToken) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 获取 Refresh-Token 信息
+        RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
+        SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30111);
+
+        // 如果配置了[每次刷新产生新的Refresh-Token]
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
+        if(clientModel.getIsNewRefresh()) {
+            // 删除旧 Refresh-Token
+            dao.deleteRefreshToken(rt.refreshToken);
+
+            // 创建并保持新的 Refresh-Token
+            rt = SaOAuth2Manager.getDataConverter().convertRefreshTokenToRefreshToken(rt);
+            dao.saveRefreshToken(rt);
+            dao.saveRefreshTokenIndex(rt);
+        }
+
+        // 删除旧 Access-Token
+        dao.deleteAccessToken(dao.getAccessTokenValue(rt.clientId, rt.loginId));
+
+        // 生成新 Access-Token
+        AccessTokenModel at = SaOAuth2Manager.getDataConverter().convertRefreshTokenToAccessToken(rt);
+
+        // 保存新 Access-Token
+        dao.saveAccessToken(at);
+        dao.saveAccessTokenIndex(at);
+
+        // 返回新 Access-Token
+        return at;
+    }
+
+    /**
+     * 构建Model：Access-Token (根据RequestAuthModel构建，用于隐藏式 and 密码式)
+     * @param ra 请求参数Model
+     * @param isCreateRt 是否生成对应的Refresh-Token
+     * @return Access-Token Model
+     */
+    @Override
+    public AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 1、删除 旧Token
+        dao.deleteAccessToken(dao.getAccessTokenValue(ra.clientId, ra.loginId));
+        if(isCreateRt) {
+            dao.deleteRefreshToken(dao.getRefreshTokenValue(ra.clientId, ra.loginId));
+        }
+
+        // 2、生成 新Access-Token
+        String newAtValue = SaOAuth2Manager.getDataLoader().randomAccessToken(ra.clientId, ra.loginId, ra.scopes);
+        AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
+        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(ra.clientId, ra.loginId);
+        SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(ra.clientId);
+        at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
+
+        // 3、生成&保存 Refresh-Token
+        if(isCreateRt) {
+            RefreshTokenModel rt = SaOAuth2Manager.getDataConverter().convertAccessTokenToRefreshToken(at);
+            dao.saveRefreshToken(rt);
+            dao.saveRefreshTokenIndex(rt);
+        }
+
+        // 5、保存 新Access-Token
+        dao.saveAccessToken(at);
+        dao.saveAccessTokenIndex(at);
+
+        // 6、返回 新Access-Token
+        return at;
+    }
+
+    /**
+     * 构建Model：Client-Token
+     * @param clientId 应用id
+     * @param scopes 授权范围
+     * @return Client-Token Model
+     */
+    @Override
+    public ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 1、删掉旧 Past-Token
+        dao.deleteClientToken(dao.getPastTokenValue(clientId));
+
+        // 2、将旧Client-Token 标记为新 Past-Token
+        ClientTokenModel oldCt = dao.getClientToken(dao.getClientTokenValue(clientId));
+        dao.savePastTokenIndex(oldCt);
+
+        // 2.5、如果配置了 PastClientToken 的 ttl ，则需要更新一下
+        SaClientModel cm = SaOAuth2Manager.getDataLoader().getClientModelNotNull(clientId);
+        if(oldCt != null && cm.getPastClientTokenTimeout() != -1) {
+            oldCt.expiresTime = System.currentTimeMillis() + (cm.getPastClientTokenTimeout() * 1000);
+            dao.saveClientToken(oldCt);
+        }
+
+        // 3、生成新Client-Token
+        ClientTokenModel ct = new ClientTokenModel(SaOAuth2Manager.getDataLoader().randomClientToken(clientId, scopes), clientId, scopes);
+        ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
+
+        // 3、保存新Client-Token
+        dao.saveClientToken(ct);
+        dao.saveClientTokenIndex(ct);
+
+        // 4、返回
+        return ct;
+    }
+
+    /**
+     * 构建URL：下放Code URL (Authorization Code 授权码)
+     * @param redirectUri 下放地址
+     * @param code code参数
+     * @param state state参数
+     * @return 构建完毕的URL
+     */
+    @Override
+    public String buildRedirectUri(String redirectUri, String code, String state) {
+        String url = SaFoxUtil.joinParam(redirectUri, SaOAuth2Consts.Param.code, code);
+        if( ! SaFoxUtil.isEmpty(state)) {
+            url = SaFoxUtil.joinParam(url, SaOAuth2Consts.Param.state, state);
+        }
+        return url;
+    }
+
+    /**
+     * 构建URL：下放Access-Token URL （implicit 隐藏式）
+     * @param redirectUri 下放地址
+     * @param token token
+     * @param state state参数
+     * @return 构建完毕的URL
+     */
+    @Override
+    public String buildImplicitRedirectUri(String redirectUri, String token, String state) {
+        String url = SaFoxUtil.joinSharpParam(redirectUri, SaOAuth2Consts.Param.token, token);
+        if( ! SaFoxUtil.isEmpty(state)) {
+            url = SaFoxUtil.joinSharpParam(url, SaOAuth2Consts.Param.state, state);
+        }
+        return url;
+    }
+
+    /**
+     * 回收 Access-Token
+     * @param accessToken Access-Token值
+     */
+    @Override
+    public void revokeAccessToken(String accessToken) {
+
+        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+        // 如果查不到任何东西, 直接返回
+        AccessTokenModel at = dao.getAccessToken(accessToken);
+        if(at == null) {
+            return;
+        }
+
+        // 删除 Access-Token
+        dao.deleteAccessToken(accessToken);
+        dao.deleteAccessTokenIndex(at.clientId, at.loginId);
+
+        // 删除对应的 Refresh-Token
+        String refreshToken = dao.getRefreshTokenValue(at.clientId, at.loginId);
+        dao.deleteRefreshToken(refreshToken);
+        dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
+    }
+
+}
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index c9c5f75e..a94ee43c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -16,6 +16,10 @@
 package cn.dev33.satoken.oauth2.data.loader;
 
 import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.util.List;
 
 /**
  * Sa-Token OAuth2 数据加载器
@@ -47,5 +51,64 @@ public interface SaOAuth2DataLoader {
     }
 
 
+    /**
+     * 根据 id 获取 Client 信息，不允许为 null
+     *
+     * @param clientId 应用id
+     * @return ClientModel
+     */
+    default SaClientModel getClientModelNotNull(String clientId) {
+        SaClientModel clientModel = getClientModel(clientId);
+        if(clientModel == null) {
+            throw new SaOAuth2Exception("未找到对应的 Client 信息");
+        }
+        return clientModel;
+    }
+
+
+    // ------------------- 创建对应 token 的算法
+
+    /**
+     * 随机一个 Code
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return Code
+     */
+    default String randomCode(String clientId, Object loginId, List<String> scopes) {
+        return SaFoxUtil.getRandomString(60);
+    }
+
+    /**
+     * 随机一个 Access-Token
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return Access-Token
+     */
+    default String randomAccessToken(String clientId, Object loginId, List<String> scopes) {
+        return SaFoxUtil.getRandomString(60);
+    }
+
+    /**
+     * 随机一个 Refresh-Token
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return Refresh-Token
+     */
+    default String randomRefreshToken(String clientId, Object loginId, List<String> scopes) {
+        return SaFoxUtil.getRandomString(60);
+    }
+
+    /**
+     * 随机一个 Client-Token
+     * @param clientId 应用id
+     * @param scopes 权限
+     * @return Client-Token
+     */
+    default String randomClientToken(String clientId, List<String> scopes) {
+        return SaFoxUtil.getRandomString(60);
+    }
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index cd7641a2..b8c5286c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -74,6 +74,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     /**
      * 构建返回值: 获取 token
      */
+    @Override
     public Map<String, Object> buildTokenReturnValue(AccessTokenModel at) {
         Map<String, Object> map = new LinkedHashMap<>();
         map.put("token_type", TokenType.bearer);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index fccf246d..1a70e1c4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -164,15 +164,15 @@ public class SaOAuth2ServerProcessor {
 		// 6、判断授权类型
 		// 如果是 授权码式，则：开始重定向授权，下放code
 		if(ResponseType.code.equals(ra.responseType)) {
-			CodeModel codeModel = oauth2Template.generateCode(ra);
-			String redirectUri = oauth2Template.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
+			CodeModel codeModel = SaOAuth2Manager.getDataGenerate().generateCode(ra);
+			String redirectUri = SaOAuth2Manager.getDataGenerate().buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
 			return res.redirect(redirectUri);
 		}
 		
 		// 如果是 隐藏式，则：开始重定向授权，下放 token
 		if(ResponseType.token.equals(ra.responseType)) {
-			AccessTokenModel at = oauth2Template.generateAccessToken(ra, false);
-			String redirectUri = oauth2Template.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
+			AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, false);
+			String redirectUri = SaOAuth2Manager.getDataGenerate().buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
 			return res.redirect(redirectUri);
 		}
 
@@ -199,7 +199,7 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
 
 		// 构建 Access-Token
-		AccessTokenModel accessTokenModel = oauth2Template.generateAccessToken(code);
+		AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().generateAccessToken(code);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildTokenReturnValue(accessTokenModel);
@@ -224,7 +224,7 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
 
 		// 获取新 Access-Token
-		AccessTokenModel accessTokenModel = oauth2Template.refreshAccessToken(refreshToken);
+		AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().refreshAccessToken(refreshToken);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildRefreshTokenReturnValue(accessTokenModel);
@@ -253,7 +253,7 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
 
 		// 回收 Access-Token
-		oauth2Template.revokeAccessToken(accessToken);
+		SaOAuth2Manager.getDataGenerate().revokeAccessToken(accessToken);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildRevokeTokenReturnValue();
@@ -324,7 +324,7 @@ public class SaOAuth2ServerProcessor {
 		ra.scopes = scopes;
 
 		// 5、生成 Access-Token
-		AccessTokenModel at = oauth2Template.generateAccessToken(ra, true);
+		AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
 
 		// 6、返回 Access-Token
 		return SaOAuth2Manager.getDataResolver().buildPasswordReturnValue(at);
@@ -352,7 +352,7 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkClientSecret(clientId, clientSecret);
 
 		// 生成
-		ClientTokenModel ct = oauth2Template.generateClientToken(clientId, scopes);
+		ClientTokenModel ct = SaOAuth2Manager.getDataGenerate().generateClientToken(clientId, scopes);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildClientTokenReturnValue(ct);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index df9fc99f..dda7398e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -148,225 +148,6 @@ public class SaOAuth2Template {
 		ra.loginId = loginId;
 		return ra;
 	}
-	/**
-	 * 构建Model：Code授权码
-	 * @param ra 请求参数Model
-	 * @return 授权码Model
-	 */
-	public CodeModel generateCode(RequestAuthModel ra) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 删除旧Code
-		String oldCodeValue = SaOAuth2Manager.getDao().getCodeValue(ra.clientId, ra.loginId);
-		dao.deleteCode(oldCodeValue);
-
-		// 生成新Code
-		String codeValue = randomCode(ra.clientId, ra.loginId, ra.scopes);
-		CodeModel cm = new CodeModel(codeValue, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
-
-		// 保存新Code
-		dao.saveCode(cm);
-		dao.saveCodeIndex(cm);
-
-		// 返回
-		return cm;
-	}
-	/**
-	 * 构建Model：Access-Token
-	 * @param code 授权码Model
-	 * @return AccessToken Model
-	 */
-	public AccessTokenModel generateAccessToken(String code) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 1、先校验
-		CodeModel cm = dao.getCode(code);
-		SaOAuth2Exception.throwBy(cm == null, "无效code", SaOAuth2ErrorCode.CODE_30110);
-
-		// 2、删除旧Token
-		dao.deleteAccessToken(dao.getAccessTokenValue(cm.clientId, cm.loginId));
-		dao.deleteRefreshToken(dao.getRefreshTokenValue(cm.clientId, cm.loginId));
-
-		// 3、生成token
-		AccessTokenModel at = convertCodeToAccessToken(cm);
-		RefreshTokenModel rt = convertAccessTokenToRefreshToken(at);
-		at.refreshToken = rt.refreshToken;
-		at.refreshExpiresTime = rt.expiresTime;
-
-		// 4、保存token
-		dao.saveAccessToken(at);
-		dao.saveAccessTokenIndex(at);
-		dao.saveRefreshToken(rt);
-		dao.saveRefreshTokenIndex(rt);
-
-		// 5、删除此Code
-		dao.deleteCode(code);
-		dao.deleteCodeIndex(cm.clientId, cm.loginId);
-
-		// 6、返回 Access-Token
-		return at;
-	}
-	/**
-	 * 刷新Model：根据 Refresh-Token 生成一个新的 Access-Token
-	 * @param refreshToken Refresh-Token值
-	 * @return 新的 Access-Token
-	 */
-	public AccessTokenModel refreshAccessToken(String refreshToken) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 获取 Refresh-Token 信息
-		RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
-		SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30111);
-		
-		// 如果配置了[每次刷新产生新的Refresh-Token]
-		if(checkClientModel(rt.clientId).getIsNewRefresh()) {
-			// 删除旧 Refresh-Token
-			dao.deleteRefreshToken(rt.refreshToken);
-
-			// 创建并保持新的 Refresh-Token
-			rt = convertRefreshTokenToRefreshToken(rt);
-			dao.saveRefreshToken(rt);
-			dao.saveRefreshTokenIndex(rt);
-		}
-
-		// 删除旧 Access-Token
-		dao.deleteAccessToken(dao.getAccessTokenValue(rt.clientId, rt.loginId));
-
-		// 生成新 Access-Token
-		AccessTokenModel at = convertRefreshTokenToAccessToken(rt);
-
-		// 保存新 Access-Token
-		dao.saveAccessToken(at);
-		dao.saveAccessTokenIndex(at);
-
-		// 返回新 Access-Token
-		return at;
-	}
-	/**
-	 * 构建Model：Access-Token (根据RequestAuthModel构建，用于隐藏式 and 密码式)
-	 * @param ra 请求参数Model
-	 * @param isCreateRt 是否生成对应的Refresh-Token
-	 * @return Access-Token Model
-	 */
-	public AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 1、删除 旧Token
-		dao.deleteAccessToken(dao.getAccessTokenValue(ra.clientId, ra.loginId));
-		if(isCreateRt) {
-			dao.deleteRefreshToken(dao.getRefreshTokenValue(ra.clientId, ra.loginId));
-		}
-
-		// 2、生成 新Access-Token
-		String newAtValue = randomAccessToken(ra.clientId, ra.loginId, ra.scopes);
-		AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
-		at.openid = getOpenid(ra.clientId, ra.loginId);
-		at.expiresTime = System.currentTimeMillis() + (checkClientModel(ra.clientId).getAccessTokenTimeout() * 1000);
-
-		// 3、生成&保存 Refresh-Token
-		if(isCreateRt) {
-			RefreshTokenModel rt = convertAccessTokenToRefreshToken(at);
-			dao.saveRefreshToken(rt);
-			dao.saveRefreshTokenIndex(rt);
-		}
-
-		// 5、保存 新Access-Token
-		dao.saveAccessToken(at);
-		dao.saveAccessTokenIndex(at);
-
-		// 6、返回 新Access-Token
-		return at;
-	}
-	/**
-	 * 构建Model：Client-Token
-	 * @param clientId 应用id
-	 * @param scopes 授权范围
-	 * @return Client-Token Model
-	 */
-	public ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 1、删掉旧 Past-Token
-		dao.deleteClientToken(dao.getPastTokenValue(clientId));
-
-		// 2、将旧Client-Token 标记为新 Past-Token
-		ClientTokenModel oldCt = dao.getClientToken(dao.getClientTokenValue(clientId));
-		dao.savePastTokenIndex(oldCt);
-
-		// 2.5、如果配置了 PastClientToken 的 ttl ，则需要更新一下 
-		SaClientModel cm = checkClientModel(clientId);
-		if(oldCt != null && cm.getPastClientTokenTimeout() != -1) {
-			oldCt.expiresTime = System.currentTimeMillis() + (cm.getPastClientTokenTimeout() * 1000);
-			dao.saveClientToken(oldCt);
-		}
-
-		// 3、生成新Client-Token
-		ClientTokenModel ct = new ClientTokenModel(randomClientToken(clientId, scopes), clientId, scopes);
-		ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
-
-		// 3、保存新Client-Token 
-		dao.saveClientToken(ct);
-		dao.saveClientTokenIndex(ct);
-
-		// 4、返回
-		return ct;
-	}
-	/**
-	 * 构建URL：下放Code URL (Authorization Code 授权码)
-	 * @param redirectUri 下放地址
-	 * @param code code参数
-	 * @param state state参数
-	 * @return 构建完毕的URL
-	 */
-	public String buildRedirectUri(String redirectUri, String code, String state) {
-		String url = SaFoxUtil.joinParam(redirectUri, Param.code, code);
-		if( ! SaFoxUtil.isEmpty(state)) {
-			url = SaFoxUtil.joinParam(url, Param.state, state);
-		}
-		return url;
-	}
-	/**
-	 * 构建URL：下放Access-Token URL （implicit 隐藏式）
-	 * @param redirectUri 下放地址
-	 * @param token token
-	 * @param state state参数
-	 * @return 构建完毕的URL
-	 */
-	public String buildImplicitRedirectUri(String redirectUri, String token, String state) {
-		String url = SaFoxUtil.joinSharpParam(redirectUri, Param.token, token);
-		if( ! SaFoxUtil.isEmpty(state)) {
-			url = SaFoxUtil.joinSharpParam(url, Param.state, state);
-		}
-		return url;
-	}
-	/**
-	 * 回收 Access-Token
-	 * @param accessToken Access-Token值
-	 */
-	public void revokeAccessToken(String accessToken) {
-
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-		// 如果查不到任何东西, 直接返回
-		AccessTokenModel at = dao.getAccessToken(accessToken);
-		if(at == null) {
-			return;
-		}
-
-		// 删除 Access-Token
-		dao.deleteAccessToken(accessToken);
-		dao.deleteAccessTokenIndex(at.clientId, at.loginId);
-
-		// 删除对应的 Refresh-Token
-		String refreshToken = dao.getRefreshTokenValue(at.clientId, at.loginId);
-		dao.deleteRefreshToken(refreshToken);
-		dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
-	}
 
 	// ------------------- check 数据校验
 	/**
@@ -586,115 +367,6 @@ public class SaOAuth2Template {
 		return at;
 	}
 
-	// ------------------- convert 数据转换
-	/**
-	 * 将 Code 转换为 Access-Token
-	 * @param cm CodeModel对象
-	 * @return AccessToken对象
-	 */
-	public AccessTokenModel convertCodeToAccessToken(CodeModel cm) {
-		AccessTokenModel at = new AccessTokenModel();
-		at.accessToken = randomAccessToken(cm.clientId, cm.loginId, cm.scopes);
-		// at.refreshToken = randomRefreshToken(cm.clientId, cm.loginId, cm.scope);
-		at.clientId = cm.clientId;
-		at.loginId = cm.loginId;
-		at.scopes = cm.scopes;
-		at.openid = getOpenid(cm.clientId, cm.loginId);
-		at.expiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getAccessTokenTimeout() * 1000);
-		// at.refreshExpiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getRefreshTokenTimeout() * 1000);
-		return at;
-	}
-	/**
-	 * 将 Access-Token 转换为 Refresh-Token
-	 * @param at .
-	 * @return .
-	 */
-	public RefreshTokenModel convertAccessTokenToRefreshToken(AccessTokenModel at) {
-		RefreshTokenModel rt = new RefreshTokenModel();
-		rt.refreshToken = randomRefreshToken(at.clientId, at.loginId, at.scopes);
-		rt.clientId = at.clientId;
-		rt.loginId = at.loginId;
-		rt.scopes = at.scopes;
-		rt.openid = at.openid;
-		rt.expiresTime = System.currentTimeMillis() + (checkClientModel(at.clientId).getRefreshTokenTimeout() * 1000);
-		// 改变at属性
-		at.refreshToken = rt.refreshToken;
-		at.refreshExpiresTime = rt.expiresTime;
-		return rt;
-	}
-	/**
-	 * 将 Refresh-Token 转换为 Access-Token
-	 * @param rt .
-	 * @return .
-	 */
-	public AccessTokenModel convertRefreshTokenToAccessToken(RefreshTokenModel rt) {
-		AccessTokenModel at = new AccessTokenModel();
-		at.accessToken = randomAccessToken(rt.clientId, rt.loginId, rt.scopes);
-		at.refreshToken = rt.refreshToken;
-		at.clientId = rt.clientId;
-		at.loginId = rt.loginId;
-		at.scopes = rt.scopes;
-		at.openid = rt.openid;
-		at.expiresTime = System.currentTimeMillis() + (checkClientModel(rt.clientId).getAccessTokenTimeout() * 1000);
-		at.refreshExpiresTime = rt.expiresTime;
-		return at;
-	}
-	/**
-	 * 根据 Refresh-Token 创建一个新的 Refresh-Token
-	 * @param rt .
-	 * @return .
-	 */
-	public RefreshTokenModel convertRefreshTokenToRefreshToken(RefreshTokenModel rt) {
-		RefreshTokenModel newRt = new RefreshTokenModel();
-		newRt.refreshToken = randomRefreshToken(rt.clientId, rt.loginId, rt.scopes);
-		newRt.expiresTime = System.currentTimeMillis() + (checkClientModel(rt.clientId).getRefreshTokenTimeout() * 1000);
-		newRt.clientId = rt.clientId;
-		newRt.scopes = rt.scopes;
-		newRt.loginId = rt.loginId;
-		newRt.openid = rt.openid;
-		return newRt;
-	}
-
-	// ------------------- Random数据
-	/**
-	 * 随机一个 Code
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @param scopes 权限
-	 * @return Code
-	 */
-	public String randomCode(String clientId, Object loginId, List<String> scopes) {
-		return SaFoxUtil.getRandomString(60);
-	}
-	/**
-	 * 随机一个 Access-Token
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @param scopes 权限
-	 * @return Access-Token
-	 */
-	public String randomAccessToken(String clientId, Object loginId, List<String> scopes) {
-		return SaFoxUtil.getRandomString(60);
-	}
-	/**
-	 * 随机一个 Refresh-Token
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @param scopes 权限
-	 * @return Refresh-Token
-	 */
-	public String randomRefreshToken(String clientId, Object loginId, List<String> scopes) {
-		return SaFoxUtil.getRandomString(60);
-	}
-	/**
-	 * 随机一个 Client-Token
-	 * @param clientId 应用id
-	 * @param scopes 权限
-	 * @return Client-Token
-	 */
-	public String randomClientToken(String clientId, List<String> scopes) {
-		return SaFoxUtil.getRandomString(60);
-	}
 
 
 	// ------------------- 包装其它 bean 的方法
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index beb1b3ac..44478769 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -97,84 +97,7 @@ public class SaOAuth2Util {
 	public static RequestAuthModel generateRequestAuth(SaRequest req, Object loginId) {
 		return SaOAuth2ServerProcessor.instance.oauth2Template.generateRequestAuth(req, loginId);
 	}
-	
-	/**
-	 * 构建Model：Code授权码 
-	 * @param ra 请求参数Model 
-	 * @return 授权码Model
-	 */
-	public static CodeModel generateCode(RequestAuthModel ra) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateCode(ra);
-	}
-	
-	/**
-	 * 构建Model：Access-Token  
-	 * @param code 授权码Model
-	 * @return AccessToken Model
-	 */
-	public static AccessTokenModel generateAccessToken(String code) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateAccessToken(code);
-	}
 
-	/**
-	 * 刷新Model：根据 Refresh-Token 生成一个新的 Access-Token 
-	 * @param refreshToken Refresh-Token值 
-	 * @return 新的 Access-Token 
-	 */
-	public static AccessTokenModel refreshAccessToken(String refreshToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.refreshAccessToken(refreshToken);
-	}
-
-	/**
-	 * 构建Model：Access-Token (根据RequestAuthModel构建，用于隐藏式 and 密码式) 
-	 * @param ra 请求参数Model 
-	 * @param isCreateRt 是否生成对应的Refresh-Token 
-	 * @return Access-Token Model 
-	 */
-	public static AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateAccessToken(ra, isCreateRt);
-	}
-	
-	/**
-	 * 构建Model：Client-Token 
-	 * @param clientId 应用id 
-	 * @param scopes 授权范围
-	 * @return Client-Token Model 
-	 */
-	public static ClientTokenModel generateClientToken(String clientId, List<String> scopes) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateClientToken(clientId, scopes);
-	}
-	
-	/**
-	 * 构建URL：下放Code URL (Authorization Code 授权码)
-	 * @param redirectUri 下放地址 
-	 * @param code code参数
-	 * @param state state参数 
-	 * @return 构建完毕的URL 
-	 */
-	public static String buildRedirectUri(String redirectUri, String code, String state) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.buildRedirectUri(redirectUri, code, state);
-	}
-
-	/**
-	 * 构建URL：下放Access-Token URL （implicit 隐藏式）
-	 * @param redirectUri 下放地址 
-	 * @param token token
-	 * @param state state参数 
-	 * @return 构建完毕的URL 
-	 */
-	public static String buildImplicitRedirectUri(String redirectUri, String token, String state) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.buildImplicitRedirectUri(redirectUri, token, state);
-	}
-	
-	/**
-	 * 回收 Access-Token 
-	 * @param accessToken Access-Token值 
-	 */
-	public static void revokeAccessToken(String accessToken) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.revokeAccessToken(accessToken);
-	}
-	
 	// ------------------- 数据校验 
 	
 	/**
-- 
Gitee


From 281985bfdbe477b2f7bc2359e164430c1f22f8fd Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 18:08:46 +0800
Subject: [PATCH 130/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E8=87=AA=E5=AE=9A?=
 =?UTF-8?q?=E4=B9=89=20scope=20=E5=A4=84=E7=90=86=E5=99=A8=E6=94=AF?=
 =?UTF-8?q?=E6=8C=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../pj/oauth2/SaOAuthClientController.java    | 22 +++--
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  2 +-
 .../SaOAuth2DataConverterDefaultImpl.java     |  3 -
 .../SaOAuth2DataGenerateDefaultImpl.java      |  8 +-
 .../oauth2/data/model/AccessTokenModel.java   |  1 +
 .../strategy/SaScopeWorkFunction.java         | 34 +++++++
 .../processor/SaOAuth2ServerProcessor.java    | 11 ++-
 .../scope/handler/OpenIdScopeHandler.java     | 45 +++++++++
 .../handler/SaOAuth2ScopeAbstractHandler.java | 44 +++++++++
 .../oauth2/strategy/SaOAuth2Strategy.java     | 94 +++++++++++++++++++
 .../oauth2/template/SaOAuth2Template.java     | 10 --
 11 files changed, 244 insertions(+), 30 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
index cd7337e6..77240d0a 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
@@ -3,6 +3,8 @@ package com.pj.oauth2;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 import com.ejlchina.okhttps.OkHttps;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.pj.utils.SoMap;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -32,7 +34,7 @@ public class SaOAuthClientController {
 	
 	// 根据Code码进行登录，获取 Access-Token 和 openid  
 	@RequestMapping("/codeLogin")
-	public SaResult codeLogin(String code) {
+	public SaResult codeLogin(String code) throws JsonProcessingException {
 		// 调用Server端接口，获取 Access-Token 以及其他信息 
 		String str = OkHttps.sync(serverUrl + "/oauth2/token")
 				.addBodyPara("grant_type", "authorization_code")
@@ -43,7 +45,7 @@ public class SaOAuthClientController {
 				.getBody()
 				.toString();
 		SoMap so = SoMap.getSoMap().setJsonString(str);
-		System.out.println("返回结果: " + so);
+		System.out.println("返回结果: " + new ObjectMapper().writeValueAsString(so));
 		
 		// code不等于200  代表请求失败 
 		if(so.getInt("code") != 200) {
@@ -61,7 +63,7 @@ public class SaOAuthClientController {
 	
 	// 根据 Refresh-Token 去刷新 Access-Token 
 	@RequestMapping("/refresh")
-	public SaResult refresh(String refreshToken) {
+	public SaResult refresh(String refreshToken) throws JsonProcessingException {
 		// 调用Server端接口，通过 Refresh-Token 刷新出一个新的 Access-Token 
 		String str = OkHttps.sync(serverUrl + "/oauth2/refresh")
 				.addBodyPara("grant_type", "refresh_token")
@@ -72,7 +74,7 @@ public class SaOAuthClientController {
 				.getBody()
 				.toString();
 		SoMap so = SoMap.getSoMap().setJsonString(str);
-		System.out.println("返回结果: " + so);
+		System.out.println("返回结果: " + new ObjectMapper().writeValueAsString(so));
 		
 		// code不等于200  代表请求失败 
 		if(so.getInt("code") != 200) {
@@ -85,7 +87,7 @@ public class SaOAuthClientController {
 	
 	// 模式三：密码式-授权登录
 	@RequestMapping("/passwordLogin")
-	public SaResult passwordLogin(String username, String password) {
+	public SaResult passwordLogin(String username, String password) throws JsonProcessingException {
 		// 模式三：密码式-授权登录
 		String str = OkHttps.sync(serverUrl + "/oauth2/token")
 				.addBodyPara("grant_type", "password")
@@ -97,7 +99,7 @@ public class SaOAuthClientController {
 				.getBody()
 				.toString();
 		SoMap so = SoMap.getSoMap().setJsonString(str);
-		System.out.println("返回结果: " + so);
+		System.out.println("返回结果: " + new ObjectMapper().writeValueAsString(so));
 		
 		// code不等于200  代表请求失败 
 		if(so.getInt("code") != 200) {
@@ -115,7 +117,7 @@ public class SaOAuthClientController {
 	
 	// 模式四：获取应用的 Client-Token 
 	@RequestMapping("/clientToken")
-	public SaResult clientToken() {
+	public SaResult clientToken() throws JsonProcessingException {
 		// 调用Server端接口
 		String str = OkHttps.sync(serverUrl + "/oauth2/client_token")
 				.addBodyPara("grant_type", "client_credentials")
@@ -125,7 +127,7 @@ public class SaOAuthClientController {
 				.getBody()
 				.toString();
 		SoMap so = SoMap.getSoMap().setJsonString(str);
-		System.out.println("返回结果: " + so);
+		System.out.println("返回结果: " + new ObjectMapper().writeValueAsString(so));
 		
 		// code不等于200  代表请求失败 
 		if(so.getInt("code") != 200) {
@@ -145,7 +147,7 @@ public class SaOAuthClientController {
 
 	// 根据 Access-Token 置换相关的资源: 获取账号昵称、头像、性别等信息 
 	@RequestMapping("/getUserinfo")
-	public SaResult getUserinfo(String accessToken) {
+	public SaResult getUserinfo(String accessToken) throws JsonProcessingException {
 		// 调用Server端接口，查询开放的资源 
 		String str = OkHttps.sync(serverUrl + "/oauth2/userinfo")
 				.addBodyPara("access_token", accessToken)
@@ -153,7 +155,7 @@ public class SaOAuthClientController {
 				.getBody()
 				.toString();
 		SoMap so = SoMap.getSoMap().setJsonString(str);
-		System.out.println("返回结果: " + so);
+		System.out.println("返回结果: " + new ObjectMapper().writeValueAsString(so));
 		
 		// code不等于200  代表请求失败 
 		if(so.getInt("code") != 200) {
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 468d9bcd..61eba47b 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -24,7 +24,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientId("1001")
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
 					.setAllowUrl("*")
-					.setContractScopes(Arrays.asList("userinfo"))
+					.setContractScopes(Arrays.asList("userinfo", "openid"))
 					.setIsAutoMode(true);
 		}
 		return null;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 74570f11..e886b125 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -73,14 +73,11 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     public AccessTokenModel convertCodeToAccessToken(CodeModel cm) {
         AccessTokenModel at = new AccessTokenModel();
         at.accessToken = SaOAuth2Manager.getDataLoader().randomAccessToken(cm.clientId, cm.loginId, cm.scopes);
-        // at.refreshToken = randomRefreshToken(cm.clientId, cm.loginId, cm.scope);
         at.clientId = cm.clientId;
         at.loginId = cm.loginId;
         at.scopes = cm.scopes;
-        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(cm.clientId, cm.loginId);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(cm.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
-        // at.refreshExpiresTime = System.currentTimeMillis() + (checkClientModel(cm.clientId).getRefreshTokenTimeout() * 1000);
         return at;
     }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index b4a114a3..51c53c6c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -18,9 +18,11 @@ package cn.dev33.satoken.oauth2.data.generate;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
+import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.List;
@@ -68,6 +70,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
     public AccessTokenModel generateAccessToken(String code) {
 
         SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+        SaOAuth2DataConverter dataConverter = SaOAuth2Manager.getDataConverter();
 
         // 1、先校验
         CodeModel cm = dao.getCode(code);
@@ -78,8 +81,9 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         dao.deleteRefreshToken(dao.getRefreshTokenValue(cm.clientId, cm.loginId));
 
         // 3、生成token
-        AccessTokenModel at = SaOAuth2Manager.getDataConverter().convertCodeToAccessToken(cm);
-        RefreshTokenModel rt = SaOAuth2Manager.getDataConverter().convertAccessTokenToRefreshToken(at);
+        AccessTokenModel at = dataConverter.convertCodeToAccessToken(cm);
+        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
+        RefreshTokenModel rt = dataConverter.convertAccessTokenToRefreshToken(at);
         at.refreshToken = rt.refreshToken;
         at.refreshExpiresTime = rt.expiresTime;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
index d16974f6..ff54085e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java
new file mode 100644
index 00000000..8068f266
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+
+import java.util.function.Consumer;
+
+/**
+ * 函数式接口：AccessTokenModel 加工
+ *
+ * <p>  参数：AccessTokenModel </p>
+ * <p>  返回：无  </p>
+ *
+ * @author click33
+ * @since 1.35.0
+ */
+@FunctionalInterface
+public interface SaScopeWorkFunction extends Consumer<AccessTokenModel> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 1a70e1c4..ab19bfec 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -25,6 +25,7 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
+import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
 import cn.dev33.satoken.oauth2.data.model.*;
 import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
@@ -140,6 +141,7 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
 
 		// 1、如果尚未登录, 则先去登录
 		if( ! getStpLogic().isLogin()) {
@@ -161,18 +163,19 @@ public class SaOAuth2ServerProcessor {
 			return cfg.confirmView.apply(ra.clientId, ra.scopes);
 		}
 
+
 		// 6、判断授权类型
 		// 如果是 授权码式，则：开始重定向授权，下放code
 		if(ResponseType.code.equals(ra.responseType)) {
-			CodeModel codeModel = SaOAuth2Manager.getDataGenerate().generateCode(ra);
-			String redirectUri = SaOAuth2Manager.getDataGenerate().buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
+			CodeModel codeModel = dataGenerate.generateCode(ra);
+			String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
 			return res.redirect(redirectUri);
 		}
 		
 		// 如果是 隐藏式，则：开始重定向授权，下放 token
 		if(ResponseType.token.equals(ra.responseType)) {
-			AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, false);
-			String redirectUri = SaOAuth2Manager.getDataGenerate().buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
+			AccessTokenModel at = dataGenerate.generateAccessToken(ra, false);
+			String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
 			return res.redirect(redirectUri);
 		}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
new file mode 100644
index 00000000..02d096d8
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.scope.handler;
+
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.scope.CommonScope;
+
+/**
+ * 所有OAuth2 权限处理器的父接口
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class OpenIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
+
+    /**
+     * 获取所要处理的权限
+     */
+    public String getHandlerScope() {
+        return CommonScope.OPENID;
+    }
+
+    /**
+     * 所需要执行的方法
+     */
+    public void work(AccessTokenModel at) {
+        System.out.println("追加 openid " + at.accessToken);
+        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(at.clientId, at.loginId);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
new file mode 100644
index 00000000..f802eeb8
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.scope.handler;
+
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+
+/**
+ * 所有OAuth2 权限处理器的父接口
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2ScopeAbstractHandler {
+
+    /**
+     * 获取所要处理的权限
+     *
+     * @return /
+     */
+    String getHandlerScope();
+
+    /**
+     * 所需要执行的方法
+     *
+     * @param at /
+     */
+    default void work(AccessTokenModel at) {
+
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
new file mode 100644
index 00000000..cdbb5ad3
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.strategy;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.oauth2.function.strategy.SaScopeWorkFunction;
+import cn.dev33.satoken.oauth2.scope.CommonScope;
+import cn.dev33.satoken.oauth2.scope.handler.OpenIdScopeHandler;
+import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeAbstractHandler;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Sa-Token OAuth2 相关策略
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public final class SaOAuth2Strategy {
+
+	private SaOAuth2Strategy() {
+		registerDefaultScopeHandler();
+	}
+
+	/**
+	 * 全局单例引用
+	 */
+	public static final SaOAuth2Strategy instance = new SaOAuth2Strategy();
+
+
+	// ----------------------- 所有策略
+
+	/**
+	 * 权限处理器集合
+	 */
+	public Map<String, SaOAuth2ScopeAbstractHandler> scopeHandlerMap = new LinkedHashMap<>();
+
+	/**
+	 * 注册所有默认的权限处理器
+	 */
+	public void registerDefaultScopeHandler() {
+		scopeHandlerMap.put(CommonScope.OPENID, new OpenIdScopeHandler());
+	}
+
+	/**
+	 * 注册一个权限处理器
+	 */
+	public void registerScopeHandler(SaOAuth2ScopeAbstractHandler handler) {
+		scopeHandlerMap.put(handler.getHandlerScope(), handler);
+		// TODO 优化日志输出
+		SaManager.getLog().info("新增权限处理器：" + handler.getHandlerScope());
+//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+	}
+
+	/**
+	 * 移除一个权限处理器
+	 */
+	public void removeScopeHandler(String scope) {
+		scopeHandlerMap.remove(scope);
+	}
+
+	/**
+	 * 根据 scope 信息对一个 AccessTokenModel 进行加工处理
+	 */
+	public SaScopeWorkFunction workAccessTokenByScope = (at) -> {
+		System.out.println("增强：" + at.accessToken);
+		System.out.println("权限：" + at.scopes);
+		// 遍历所有的权限处理器，如果此 AccessToken 具有这些权限，则开始加工
+		if(at.scopes != null && !at.scopes.isEmpty()) {
+			for (Map.Entry<String, SaOAuth2ScopeAbstractHandler> entry: scopeHandlerMap.entrySet()) {
+				if(at.scopes.contains(entry.getKey())) {
+					entry.getValue().work(at);
+				}
+			}
+		}
+
+	};
+
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index dda7398e..90af6f8c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -47,16 +47,6 @@ public class SaOAuth2Template {
 		return SaOAuth2Manager.getDataLoader().getClientModel(clientId);
 	}
 
-	/**
-	 * 根据ClientId 和 LoginId 获取openid
-	 * @param clientId 应用id
-	 * @param loginId 账号id
-	 * @return 此账号在此Client下的openid
-	 */
-	public String getOpenid(String clientId, Object loginId) {
-		return SaOAuth2Manager.getDataLoader().getOpenid(clientId, loginId);
-	}
-
 	// ------------------- 资源校验API
 	/**
 	 * 根据id获取Client信息, 如果Client为空，则抛出异常
-- 
Gitee


From 1ee13401921d12f866db7dc246cce0ba6f92b6dc Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 18:41:22 +0800
Subject: [PATCH 131/172] =?UTF-8?q?token=E5=88=9B=E5=BB=BA=E6=8A=BD?=
 =?UTF-8?q?=E7=A6=BB=E5=88=B0=E5=85=A8=E5=B1=80=E7=AD=96=E7=95=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../SaOAuth2DataConverterDefaultImpl.java     |  9 ++--
 .../data/generate/SaOAuth2DataGenerate.java   |  3 ++
 .../SaOAuth2DataGenerateDefaultImpl.java      |  7 +--
 .../data/loader/SaOAuth2DataLoader.java       | 44 -------------------
 .../oauth2/data/model/ClientTokenModel.java   |  6 +--
 ...aOAuth2CreateAccessTokenValueFunction.java | 38 ++++++++++++++++
 ...aOAuth2CreateClientTokenValueFunction.java | 37 ++++++++++++++++
 .../SaOAuth2CreateCodeValueFunction.java      | 38 ++++++++++++++++
 ...OAuth2CreateRefreshTokenValueFunction.java | 38 ++++++++++++++++
 .../oauth2/strategy/SaOAuth2Strategy.java     | 38 ++++++++++++++--
 10 files changed, 200 insertions(+), 58 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateAccessTokenValueFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateClientTokenValueFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateCodeValueFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateRefreshTokenValueFunction.java

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index e886b125..337ed1d4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -20,6 +20,7 @@ import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.Collections;
@@ -72,7 +73,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public AccessTokenModel convertCodeToAccessToken(CodeModel cm) {
         AccessTokenModel at = new AccessTokenModel();
-        at.accessToken = SaOAuth2Manager.getDataLoader().randomAccessToken(cm.clientId, cm.loginId, cm.scopes);
+        at.accessToken = SaOAuth2Strategy.instance.createAccessToken.execute(cm.clientId, cm.loginId, cm.scopes);
         at.clientId = cm.clientId;
         at.loginId = cm.loginId;
         at.scopes = cm.scopes;
@@ -89,7 +90,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public RefreshTokenModel convertAccessTokenToRefreshToken(AccessTokenModel at) {
         RefreshTokenModel rt = new RefreshTokenModel();
-        rt.refreshToken = SaOAuth2Manager.getDataLoader().randomRefreshToken(at.clientId, at.loginId, at.scopes);
+        rt.refreshToken = SaOAuth2Strategy.instance.createRefreshToken.execute(at.clientId, at.loginId, at.scopes);
         rt.clientId = at.clientId;
         rt.loginId = at.loginId;
         rt.scopes = at.scopes;
@@ -110,7 +111,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public AccessTokenModel convertRefreshTokenToAccessToken(RefreshTokenModel rt) {
         AccessTokenModel at = new AccessTokenModel();
-        at.accessToken = SaOAuth2Manager.getDataLoader().randomAccessToken(rt.clientId, rt.loginId, rt.scopes);
+        at.accessToken = SaOAuth2Strategy.instance.createAccessToken.execute(rt.clientId, rt.loginId, rt.scopes);
         at.refreshToken = rt.refreshToken;
         at.clientId = rt.clientId;
         at.loginId = rt.loginId;
@@ -130,7 +131,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public RefreshTokenModel convertRefreshTokenToRefreshToken(RefreshTokenModel rt) {
         RefreshTokenModel newRt = new RefreshTokenModel();
-        newRt.refreshToken = SaOAuth2Manager.getDataLoader().randomRefreshToken(rt.clientId, rt.loginId, rt.scopes);
+        newRt.refreshToken = SaOAuth2Strategy.instance.createRefreshToken.execute(rt.clientId, rt.loginId, rt.scopes);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
         newRt.expiresTime = System.currentTimeMillis() + (clientModel.getRefreshTokenTimeout() * 1000);
         newRt.clientId = rt.clientId;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
index 92a89010..d309b70e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -19,6 +19,7 @@ import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RequestAuthModel;
+import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.List;
 
@@ -93,4 +94,6 @@ public interface SaOAuth2DataGenerate {
      */
     public void revokeAccessToken(String accessToken);
 
+
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 51c53c6c..b8f5c4f7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -50,7 +50,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         dao.deleteCode(dao.getCodeValue(ra.clientId, ra.loginId));
 
         // 生成新Code
-        String codeValue = SaOAuth2Manager.getDataLoader().randomCode(ra.clientId, ra.loginId, ra.scopes);
+        String codeValue = SaOAuth2Strategy.instance.createCodeValue.execute(ra.clientId, ra.loginId, ra.scopes);
         CodeModel cm = new CodeModel(codeValue, ra.clientId, ra.scopes, ra.loginId, ra.redirectUri);
 
         // 保存新Code
@@ -159,7 +159,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         }
 
         // 2、生成 新Access-Token
-        String newAtValue = SaOAuth2Manager.getDataLoader().randomAccessToken(ra.clientId, ra.loginId, ra.scopes);
+        String newAtValue = SaOAuth2Strategy.instance.createAccessToken.execute(ra.clientId, ra.loginId, ra.scopes);
         AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
         at.openid = SaOAuth2Manager.getDataLoader().getOpenid(ra.clientId, ra.loginId);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(ra.clientId);
@@ -206,7 +206,8 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         }
 
         // 3、生成新Client-Token
-        ClientTokenModel ct = new ClientTokenModel(SaOAuth2Manager.getDataLoader().randomClientToken(clientId, scopes), clientId, scopes);
+        String clientTokenValue = SaOAuth2Strategy.instance.createClientToken.execute(clientId, scopes);
+        ClientTokenModel ct = new ClientTokenModel(clientTokenValue, clientId, scopes);
         ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
 
         // 3、保存新Client-Token
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index a94ee43c..13f9ca53 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -66,49 +66,5 @@ public interface SaOAuth2DataLoader {
     }
 
 
-    // ------------------- 创建对应 token 的算法
-
-    /**
-     * 随机一个 Code
-     * @param clientId 应用id
-     * @param loginId 账号id
-     * @param scopes 权限
-     * @return Code
-     */
-    default String randomCode(String clientId, Object loginId, List<String> scopes) {
-        return SaFoxUtil.getRandomString(60);
-    }
-
-    /**
-     * 随机一个 Access-Token
-     * @param clientId 应用id
-     * @param loginId 账号id
-     * @param scopes 权限
-     * @return Access-Token
-     */
-    default String randomAccessToken(String clientId, Object loginId, List<String> scopes) {
-        return SaFoxUtil.getRandomString(60);
-    }
-
-    /**
-     * 随机一个 Refresh-Token
-     * @param clientId 应用id
-     * @param loginId 账号id
-     * @param scopes 权限
-     * @return Refresh-Token
-     */
-    default String randomRefreshToken(String clientId, Object loginId, List<String> scopes) {
-        return SaFoxUtil.getRandomString(60);
-    }
-
-    /**
-     * 随机一个 Client-Token
-     * @param clientId 应用id
-     * @param scopes 权限
-     * @return Client-Token
-     */
-    default String randomClientToken(String clientId, List<String> scopes) {
-        return SaFoxUtil.getRandomString(60);
-    }
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
index ab781719..ca0ce0fa 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
@@ -54,13 +54,13 @@ public class ClientTokenModel implements Serializable {
 	
 	/**
 	 * 构建一个 
-	 * @param accessToken accessToken
+	 * @param clientToken clientToken
 	 * @param clientId 应用id 
 	 * @param scopes 请求授权范围
 	 */
-	public ClientTokenModel(String accessToken, String clientId, List<String> scopes) {
+	public ClientTokenModel(String clientToken, String clientId, List<String> scopes) {
 		super();
-		this.clientToken = accessToken;
+		this.clientToken = clientToken;
 		this.clientId = clientId;
 		this.scopes = scopes;
 	}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateAccessTokenValueFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateAccessTokenValueFunction.java
new file mode 100644
index 00000000..c4bfd5e1
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateAccessTokenValueFunction.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import java.util.List;
+
+/**
+ * 函数式接口：创建一个 AccessToken value
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2CreateAccessTokenValueFunction {
+
+    /**
+     * 创建一个 AccessToken value
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return AccessToken value
+     */
+    String execute(String clientId, Object loginId, List<String> scopes);
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateClientTokenValueFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateClientTokenValueFunction.java
new file mode 100644
index 00000000..ffe5db46
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateClientTokenValueFunction.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import java.util.List;
+
+/**
+ * 函数式接口：创建一个 ClientToken value
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2CreateClientTokenValueFunction {
+
+    /**
+     * 创建一个 ClientToken value
+     * @param clientId 应用id
+     * @param scopes 权限
+     * @return ClientToken value
+     */
+    String execute(String clientId, List<String> scopes);
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateCodeValueFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateCodeValueFunction.java
new file mode 100644
index 00000000..0e1648e3
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateCodeValueFunction.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import java.util.List;
+
+/**
+ * 函数式接口：创建一个 code value
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2CreateCodeValueFunction {
+
+    /**
+     * 创建一个 code value
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return code value
+     */
+    String execute(String clientId, Object loginId, List<String> scopes);
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateRefreshTokenValueFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateRefreshTokenValueFunction.java
new file mode 100644
index 00000000..814d860b
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2CreateRefreshTokenValueFunction.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import java.util.List;
+
+/**
+ * 函数式接口：创建一个 RefreshToken value
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2CreateRefreshTokenValueFunction {
+
+    /**
+     * 创建一个 RefreshToken value
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @param scopes 权限
+     * @return RefreshToken value
+     */
+    String execute(String clientId, Object loginId, List<String> scopes);
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index cdbb5ad3..18287065 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -16,10 +16,11 @@
 package cn.dev33.satoken.oauth2.strategy;
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.oauth2.function.strategy.SaScopeWorkFunction;
+import cn.dev33.satoken.oauth2.function.strategy.*;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 import cn.dev33.satoken.oauth2.scope.handler.OpenIdScopeHandler;
 import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeAbstractHandler;
+import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -41,8 +42,7 @@ public final class SaOAuth2Strategy {
 	 */
 	public static final SaOAuth2Strategy instance = new SaOAuth2Strategy();
 
-
-	// ----------------------- 所有策略
+	// 权限处理器
 
 	/**
 	 * 权限处理器集合
@@ -63,7 +63,7 @@ public final class SaOAuth2Strategy {
 		scopeHandlerMap.put(handler.getHandlerScope(), handler);
 		// TODO 优化日志输出
 		SaManager.getLog().info("新增权限处理器：" + handler.getHandlerScope());
-//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+		//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
 	}
 
 	/**
@@ -73,6 +73,9 @@ public final class SaOAuth2Strategy {
 		scopeHandlerMap.remove(scope);
 	}
 
+
+	// ----------------------- 所有策略
+
 	/**
 	 * 根据 scope 信息对一个 AccessTokenModel 进行加工处理
 	 */
@@ -90,5 +93,32 @@ public final class SaOAuth2Strategy {
 
 	};
 
+	/**
+	 * 创建一个 code value
+	 */
+	public SaOAuth2CreateCodeValueFunction createCodeValue = (clientId, loginId, scopes) -> {
+		return SaFoxUtil.getRandomString(60);
+	};
+
+	/**
+	 * 创建一个 AccessToken value
+	 */
+	public SaOAuth2CreateAccessTokenValueFunction createAccessToken = (clientId, loginId, scopes) -> {
+		return SaFoxUtil.getRandomString(60);
+	};
+
+	/**
+	 * 创建一个 RefreshToken value
+	 */
+	public SaOAuth2CreateRefreshTokenValueFunction createRefreshToken = (clientId, loginId, scopes) -> {
+		return SaFoxUtil.getRandomString(60);
+	};
+
+	/**
+	 * 创建一个 ClientToken value
+	 */
+	public SaOAuth2CreateClientTokenValueFunction createClientToken = (clientId, scopes) -> {
+		return SaFoxUtil.getRandomString(60);
+	};
 
 }
-- 
Gitee


From c03bccd9562edb1ae4cf02fa647972c41916db2c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 19:06:36 +0800
Subject: [PATCH 132/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20ClientToken=20?=
 =?UTF-8?q?=E4=B8=8E=E8=87=AA=E5=AE=9A=E4=B9=89=E6=9D=83=E9=99=90=E7=9A=84?=
 =?UTF-8?q?=E5=AF=B9=E6=8E=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../SaOAuth2DataGenerateDefaultImpl.java      |  5 +--
 ...SaOAuth2ScopeWorkAccessTokenFunction.java} |  4 +--
 .../SaOAuth2ScopeWorkClientTokenFunction.java | 34 +++++++++++++++++++
 .../scope/handler/OpenIdScopeHandler.java     | 14 +++++---
 .../handler/SaOAuth2ScopeAbstractHandler.java | 14 +++++---
 .../oauth2/strategy/SaOAuth2Strategy.java     | 25 ++++++++++----
 6 files changed, 76 insertions(+), 20 deletions(-)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/{SaScopeWorkFunction.java => SaOAuth2ScopeWorkAccessTokenFunction.java} (89%)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkClientTokenFunction.java

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index b8f5c4f7..a7582102 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -82,10 +82,10 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
 
         // 3、生成token
         AccessTokenModel at = dataConverter.convertCodeToAccessToken(cm);
-        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
         RefreshTokenModel rt = dataConverter.convertAccessTokenToRefreshToken(at);
         at.refreshToken = rt.refreshToken;
         at.refreshExpiresTime = rt.expiresTime;
+        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
 
         // 4、保存token
         dao.saveAccessToken(at);
@@ -205,10 +205,11 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
             dao.saveClientToken(oldCt);
         }
 
-        // 3、生成新Client-Token
+        // 3、生成新 Client-Token
         String clientTokenValue = SaOAuth2Strategy.instance.createClientToken.execute(clientId, scopes);
         ClientTokenModel ct = new ClientTokenModel(clientTokenValue, clientId, scopes);
         ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
+        SaOAuth2Strategy.instance.workClientTokenByScope.accept(ct);
 
         // 3、保存新Client-Token
         dao.saveClientToken(ct);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkAccessTokenFunction.java
similarity index 89%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkAccessTokenFunction.java
index 8068f266..96e997fa 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaScopeWorkFunction.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkAccessTokenFunction.java
@@ -26,9 +26,9 @@ import java.util.function.Consumer;
  * <p>  返回：无  </p>
  *
  * @author click33
- * @since 1.35.0
+ * @since 1.39.0
  */
 @FunctionalInterface
-public interface SaScopeWorkFunction extends Consumer<AccessTokenModel> {
+public interface SaOAuth2ScopeWorkAccessTokenFunction extends Consumer<AccessTokenModel> {
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkClientTokenFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkClientTokenFunction.java
new file mode 100644
index 00000000..6193da52
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2ScopeWorkClientTokenFunction.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+
+import java.util.function.Consumer;
+
+/**
+ * 函数式接口：ClientTokenModel 加工
+ *
+ * <p>  参数：ClientTokenModel </p>
+ * <p>  返回：无  </p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2ScopeWorkClientTokenFunction extends Consumer<ClientTokenModel> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
index 02d096d8..00da76b0 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
@@ -17,10 +17,11 @@ package cn.dev33.satoken.oauth2.scope.handler;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 
 /**
- * 所有OAuth2 权限处理器的父接口
+ * OpenId 权限处理器
  *
  * @author click33
  * @since 1.39.0
@@ -34,12 +35,15 @@ public class OpenIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
         return CommonScope.OPENID;
     }
 
-    /**
-     * 所需要执行的方法
-     */
-    public void work(AccessTokenModel at) {
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
         System.out.println("追加 openid " + at.accessToken);
         at.openid = SaOAuth2Manager.getDataLoader().getOpenid(at.clientId, at.loginId);
     }
 
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+
+    }
+
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
index f802eeb8..32aa8110 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
@@ -16,9 +16,10 @@
 package cn.dev33.satoken.oauth2.scope.handler;
 
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 
 /**
- * 所有OAuth2 权限处理器的父接口
+ * 所有 OAuth2 权限处理器的父接口
  *
  * @author click33
  * @since 1.39.0
@@ -33,12 +34,17 @@ public interface SaOAuth2ScopeAbstractHandler {
     String getHandlerScope();
 
     /**
-     * 所需要执行的方法
+     * 当构建的 AccessToken 具有此权限时，所需要执行的方法
      *
      * @param at /
      */
-    default void work(AccessTokenModel at) {
+    void workAccessToken(AccessTokenModel at);
 
-    }
+    /**
+     * 当构建的 ClientToken 具有此权限时，所需要执行的方法
+     *
+     * @param ct /
+     */
+    void workClientToken(ClientTokenModel ct);
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index 18287065..ce0144f1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -79,18 +79,29 @@ public final class SaOAuth2Strategy {
 	/**
 	 * 根据 scope 信息对一个 AccessTokenModel 进行加工处理
 	 */
-	public SaScopeWorkFunction workAccessTokenByScope = (at) -> {
-		System.out.println("增强：" + at.accessToken);
-		System.out.println("权限：" + at.scopes);
-		// 遍历所有的权限处理器，如果此 AccessToken 具有这些权限，则开始加工
+	public SaOAuth2ScopeWorkAccessTokenFunction workAccessTokenByScope = (at) -> {
 		if(at.scopes != null && !at.scopes.isEmpty()) {
-			for (Map.Entry<String, SaOAuth2ScopeAbstractHandler> entry: scopeHandlerMap.entrySet()) {
-				if(at.scopes.contains(entry.getKey())) {
-					entry.getValue().work(at);
+			for (String scope : at.scopes) {
+				SaOAuth2ScopeAbstractHandler handler = scopeHandlerMap.get(scope);
+				if(handler != null) {
+					handler.workAccessToken(at);
 				}
 			}
 		}
+	};
 
+	/**
+	 * 根据 scope 信息对一个 ClientTokenModel 进行加工处理
+	 */
+	public SaOAuth2ScopeWorkClientTokenFunction workClientTokenByScope = (ct) -> {
+		if(ct.scopes != null && !ct.scopes.isEmpty()) {
+			for (String scope : ct.scopes) {
+				SaOAuth2ScopeAbstractHandler handler = scopeHandlerMap.get(scope);
+				if(handler != null) {
+					handler.workClientToken(ct);
+				}
+			}
+		}
 	};
 
 	/**
-- 
Gitee


From f0c2949539993a787b393a98027132ac8902d637 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 20:22:20 +0800
Subject: [PATCH 133/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E8=87=AA=E5=AE=9A?=
 =?UTF-8?q?=E4=B9=89=20scope=20=E6=97=B6=E7=9A=84=E6=89=A9=E5=B1=95?=
 =?UTF-8?q?=E5=8F=82=E6=95=B0=E5=A4=84=E7=90=86=E9=80=BB=E8=BE=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  2 +-
 .../satoken/oauth2/consts/SaOAuth2Consts.java |  9 ++
 .../SaOAuth2DataConverterDefaultImpl.java     | 12 +--
 .../data/generate/SaOAuth2DataGenerate.java   |  5 +-
 .../SaOAuth2DataGenerateDefaultImpl.java      |  6 +-
 .../data/loader/SaOAuth2DataLoader.java       |  5 +-
 .../oauth2/data/model/AccessTokenModel.java   | 55 +++++-------
 .../oauth2/data/model/ClientTokenModel.java   | 84 ++++++++++++++-----
 .../oauth2/data/model/RefreshTokenModel.java  | 28 ++++---
 .../model/{ => loader}/SaClientModel.java     |  2 +-
 .../ClientIdAndSecretModel.java               |  2 +-
 .../model/{ => request}/RequestAuthModel.java |  4 +-
 .../data/resolver/SaOAuth2DataResolver.java   | 11 ++-
 .../SaOAuth2DataResolverDefaultImpl.java      | 26 +++++-
 .../processor/SaOAuth2ServerProcessor.java    | 12 ++-
 .../satoken/oauth2/scope/CommonScope.java     |  4 +-
 .../scope/handler/OidcScopeHandler.java       | 44 ++++++++++
 .../scope/handler/OpenIdScopeHandler.java     |  9 +-
 .../scope/handler/UserIdScopeHandler.java     | 45 ++++++++++
 .../oauth2/strategy/SaOAuth2Strategy.java     |  4 +
 .../oauth2/template/SaOAuth2Template.java     | 22 +----
 .../satoken/oauth2/template/SaOAuth2Util.java | 18 ++--
 22 files changed, 267 insertions(+), 142 deletions(-)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/{ => loader}/SaClientModel.java (99%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/{other => request}/ClientIdAndSecretModel.java (97%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/{ => request}/RequestAuthModel.java (97%)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 61eba47b..af90c631 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -1,7 +1,7 @@
 package com.pj.oauth2;
 
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
-import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.secure.SaSecureUtil;
 import org.springframework.stereotype.Component;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index 82d31df6..6337cefc 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -93,6 +93,15 @@ public class SaOAuth2Consts {
 		public static String Bearer = "Bearer";
 	}
 
+	/**
+	 * 扩展字段
+	 */
+	public static final class ExtraField {
+		public static String openid = "openid";
+		public static String userid = "userid";
+		public static String id_token = "id_token";
+	}
+
 	/** 表示OK的返回结果 */
 	public static final String OK = "ok";
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 337ed1d4..37ec58b3 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -19,11 +19,12 @@ import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
-import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.List;
 
 /**
@@ -79,6 +80,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         at.scopes = cm.scopes;
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(cm.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
+        at.extraData = new LinkedHashMap<>();
         return at;
     }
 
@@ -94,10 +96,10 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         rt.clientId = at.clientId;
         rt.loginId = at.loginId;
         rt.scopes = at.scopes;
-        rt.openid = at.openid;
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(at.clientId);
         rt.expiresTime = System.currentTimeMillis() + (clientModel.getRefreshTokenTimeout() * 1000);
-        // 改变at属性
+        rt.extraData = new LinkedHashMap<>(at.extraData);
+        // 改变 at 属性
         at.refreshToken = rt.refreshToken;
         at.refreshExpiresTime = rt.expiresTime;
         return rt;
@@ -116,7 +118,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         at.clientId = rt.clientId;
         at.loginId = rt.loginId;
         at.scopes = rt.scopes;
-        at.openid = rt.openid;
+        at.extraData = new LinkedHashMap<>(rt.extraData);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
         at.refreshExpiresTime = rt.expiresTime;
@@ -137,7 +139,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         newRt.clientId = rt.clientId;
         newRt.scopes = rt.scopes;
         newRt.loginId = rt.loginId;
-        newRt.openid = rt.openid;
+        newRt.extraData = new LinkedHashMap<>(rt.extraData);
         return newRt;
     }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
index d309b70e..a4a1670b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -18,8 +18,7 @@ package cn.dev33.satoken.oauth2.data.generate;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
-import cn.dev33.satoken.oauth2.data.model.RequestAuthModel;
-import cn.dev33.satoken.util.SaFoxUtil;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 
 import java.util.List;
 
@@ -31,8 +30,6 @@ import java.util.List;
  */
 public interface SaOAuth2DataGenerate {
 
-    // ------------------- generate 构建数据
-
     /**
      * 构建Model：Code授权码
      * @param ra 请求参数Model
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index a7582102..a88b6b7a 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -20,6 +20,8 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
@@ -34,7 +36,6 @@ import java.util.List;
  * @since 1.39.0
  */
 public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
-    // ------------------- generate 构建数据
 
     /**
      * 构建Model：Code授权码
@@ -161,7 +162,8 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         // 2、生成 新Access-Token
         String newAtValue = SaOAuth2Strategy.instance.createAccessToken.execute(ra.clientId, ra.loginId, ra.scopes);
         AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
-        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(ra.clientId, ra.loginId);
+        // TODO 此处的 openid 应该怎么加载？
+        // at.openid = SaOAuth2Manager.getDataLoader().getOpenid(ra.clientId, ra.loginId);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(ra.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index 13f9ca53..4e262395 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -15,11 +15,8 @@
  */
 package cn.dev33.satoken.oauth2.data.loader;
 
-import cn.dev33.satoken.oauth2.data.model.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.util.SaFoxUtil;
-
-import java.util.List;
 
 /**
  * Sa-Token OAuth2 数据加载器
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
index ff54085e..83325e81 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
@@ -16,8 +16,6 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -60,17 +58,19 @@ public class AccessTokenModel implements Serializable {
 	 * 账号id 
 	 */
 	public Object loginId;
-	
-	/**
-	 * 开放账号id 
-	 */
-	public String openid;
 
 	/**
 	 * 授权范围
 	 */
 	public List<String> scopes;
 
+	/**
+	 * 扩展数据
+	 */
+	public Map<String, Object> extraData;
+
+
+
 	public AccessTokenModel() {}
 
 	/**
@@ -143,21 +143,21 @@ public class AccessTokenModel implements Serializable {
 		return this;
 	}
 
-	public String getOpenid() {
-		return openid;
+	public List<String> getScopes() {
+		return scopes;
 	}
 
-	public AccessTokenModel setOpenid(String openid) {
-		this.openid = openid;
+	public AccessTokenModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
 		return this;
 	}
 
-	public List<String> getScopes() {
-		return scopes;
+	public Map<String, Object> getExtraData() {
+		return extraData;
 	}
 
-	public AccessTokenModel setScopes(List<String> scopes) {
-		this.scopes = scopes;
+	public AccessTokenModel setExtraData(Map<String, Object> extraData) {
+		this.extraData = extraData;
 		return this;
 	}
 
@@ -165,14 +165,14 @@ public class AccessTokenModel implements Serializable {
 	public String toString() {
 		return "AccessTokenModel [accessToken=" + accessToken + ", refreshToken=" + refreshToken
 				+ ", accessTokenTimeout=" + expiresTime + ", refreshTokenTimeout=" + refreshExpiresTime
-				+ ", clientId=" + clientId + ", scopes=" + scopes + ", openid=" + openid + "]";
+				+ ", clientId=" + clientId + ", scopes=" + scopes + ", extraData=" + extraData + "]";
 	}
 
 	// 追加只读属性
 
 	/**
 	 * 获取：此 Access-Token 的剩余有效期（秒）
-	 * @return see note 
+	 * @return /
 	 */
 	public long getExpiresIn() {
 		long s = (expiresTime - System.currentTimeMillis()) / 1000;
@@ -181,28 +181,11 @@ public class AccessTokenModel implements Serializable {
 
 	/**
 	 * 获取：此 Refresh-Token 的剩余有效期（秒）
-	 * @return see note 
+	 * @return /
 	 */
 	public long getRefreshExpiresIn() {
 		long s = (refreshExpiresTime - System.currentTimeMillis()) / 1000;
 		return s < 1 ? -2 : s;
 	}
-	
-	/**
-	 * 将所有属性转换为下划线形式的Map 
-	 * @return 属性转Map
-	 */
-	@Deprecated
-	public Map<String, Object> toLineMap() {
-		Map<String, Object> map = new LinkedHashMap<>();
-		map.put("access_token", accessToken);
-		map.put("refresh_token", refreshToken);
-		map.put("expires_in", getExpiresIn());
-		map.put("refresh_expires_in", getRefreshExpiresIn());
-		map.put("client_id", clientId);
-		map.put("scopes", scopes);
-		map.put("openid", openid);
-		return map;
-	}
-	
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
index ca0ce0fa..1d9865eb 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
@@ -16,7 +16,6 @@
 package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -50,6 +49,57 @@ public class ClientTokenModel implements Serializable {
 	 */
 	public List<String> scopes;
 
+	/**
+	 * 扩展数据
+	 */
+	public Map<String, Object> extraData;
+
+
+	public String getClientToken() {
+		return clientToken;
+	}
+
+	public ClientTokenModel setClientToken(String clientToken) {
+		this.clientToken = clientToken;
+		return this;
+	}
+
+	public long getExpiresTime() {
+		return expiresTime;
+	}
+
+	public ClientTokenModel setExpiresTime(long expiresTime) {
+		this.expiresTime = expiresTime;
+		return this;
+	}
+
+	public String getClientId() {
+		return clientId;
+	}
+
+	public ClientTokenModel setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	public List<String> getScopes() {
+		return scopes;
+	}
+
+	public ClientTokenModel setScopes(List<String> scopes) {
+		this.scopes = scopes;
+		return this;
+	}
+
+	public Map<String, Object> getExtraData() {
+		return extraData;
+	}
+
+	public ClientTokenModel setExtraData(Map<String, Object> extraData) {
+		this.extraData = extraData;
+		return this;
+	}
+
 	public ClientTokenModel() {}
 	
 	/**
@@ -64,35 +114,25 @@ public class ClientTokenModel implements Serializable {
 		this.clientId = clientId;
 		this.scopes = scopes;
 	}
-	
+
 	@Override
 	public String toString() {
-		return "ClientTokenModel [clientToken=" + clientToken + ", expiresTime=" + expiresTime + ", clientId="
-				+ clientId + ", scopes=" + scopes + "]";
+		return "ClientTokenModel{" +
+				"clientToken='" + clientToken + '\'' +
+				", expiresTime=" + expiresTime +
+				", clientId='" + clientId + '\'' +
+				", scopes=" + scopes +
+				", extraData=" + extraData +
+				'}';
 	}
-	
+
 	/**
 	 * 获取：此 Client-Token 的剩余有效期（秒）
-	 * @return see note 
+	 * @return /
 	 */
 	public long getExpiresIn() {
 		long s = (expiresTime - System.currentTimeMillis()) / 1000;
 		return s < 1 ? -2 : s;
 	}
-	
-	/**
-	 * 将所有属性转换为下划线形式的Map
-	 * @return 属性转Map
-	 */
-	@Deprecated
-	public Map<String, Object> toLineMap() {
-		Map<String, Object> map = new LinkedHashMap<>();
-		map.put("client_token", clientToken);
-		map.put("expires_in", getExpiresIn());
-		map.put("client_id", clientId);
-		map.put("scopes", scopes);
-		return map;
-	}
-	
-	
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
index 7f036358..fc72d495 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RefreshTokenModel.java
@@ -17,6 +17,7 @@ package cn.dev33.satoken.oauth2.data.model;
 
 import java.io.Serializable;
 import java.util.List;
+import java.util.Map;
 
 /**
  * Model: Refresh-Token
@@ -42,11 +43,6 @@ public class RefreshTokenModel implements Serializable {
 	 * 应用id 
 	 */
 	public String clientId;
-	
-	/**
-	 * 授权范围
-	 */
-	public List<String> scopes;
 
 	/**
 	 * 对应账号id 
@@ -54,9 +50,15 @@ public class RefreshTokenModel implements Serializable {
 	public Object loginId;
 
 	/**
-	 * 对应账号id 
+	 * 授权范围
+	 */
+	public List<String> scopes;
+
+	/**
+	 * 扩展数据
 	 */
-	public String openid;
+	public Map<String, Object> extraData;
+
 
 	public String getRefreshToken() {
 		return refreshToken;
@@ -103,24 +105,24 @@ public class RefreshTokenModel implements Serializable {
 		return this;
 	}
 
-	public String getOpenid() {
-		return openid;
+	public Map<String, Object> getExtraData() {
+		return extraData;
 	}
 
-	public RefreshTokenModel setOpenid(String openid) {
-		this.openid = openid;
+	public RefreshTokenModel setExtraData(Map<String, Object> extraData) {
+		this.extraData = extraData;
 		return this;
 	}
 
 	@Override
 	public String toString() {
 		return "RefreshTokenModel [refreshToken=" + refreshToken + ", expiresTime=" + expiresTime
-				+ ", clientId=" + clientId + ", scopes=" + scopes + ", loginId=" + loginId + ", openid=" + openid + "]";
+				+ ", clientId=" + clientId + ", loginId=" + loginId + ", scopes=" + scopes + ", extraData=" + extraData + "]";
 	}
 
 	/**
 	 * 获取：此 Refresh-Token 的剩余有效期（秒）
-	 * @return see note 
+	 * @return /
 	 */
 	public long getExpiresIn() {
 		long s = (expiresTime - System.currentTimeMillis()) / 1000;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
similarity index 99%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index 8c944ba4..04dcce98 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.data.model;
+package cn.dev33.satoken.oauth2.data.model.loader;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/ClientIdAndSecretModel.java
similarity index 97%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/ClientIdAndSecretModel.java
index b5180f3f..299f55bb 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/other/ClientIdAndSecretModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/ClientIdAndSecretModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.data.model.other;
+package cn.dev33.satoken.oauth2.data.model.request;
 
 import java.io.Serializable;
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/RequestAuthModel.java
similarity index 97%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/RequestAuthModel.java
index c6d6d3d4..9837e437 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/RequestAuthModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/request/RequestAuthModel.java
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package cn.dev33.satoken.oauth2.data.model;
+package cn.dev33.satoken.oauth2.data.model.request;
 
 import java.io.Serializable;
 import java.util.List;
@@ -23,7 +23,7 @@ import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 /**
- * 请求授权参数的Model
+ * 请求授权参数的 Model
  *
  * @author click33
  * @since 1.23.0
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 7b6ff223..4dd957b9 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -18,7 +18,8 @@ package cn.dev33.satoken.oauth2.data.resolver;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.Map;
@@ -41,6 +42,14 @@ public interface SaOAuth2DataResolver {
      */
     ClientIdAndSecretModel readClientIdAndSecret(SaRequest request);
 
+    /**
+     * 数据读取：从请求对象中构建 RequestAuthModel
+     * @param req SaRequest对象
+     * @param loginId 账号id
+     * @return RequestAuthModel对象
+     */
+    RequestAuthModel readRequestAuthModel(SaRequest req, Object loginId);
+
 
     /**
      * 构建返回值: 获取 token
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index b8c5286c..97375f88 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -22,7 +22,8 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -40,7 +41,6 @@ import java.util.Map;
  */
 public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
 
-
     /**
      * 数据读取：从请求对象中读取 ClientId、Secret，如果获取不到则抛出异常
      *
@@ -71,6 +71,24 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         throw new SaOAuth2Exception("请提供 client 信息");
     }
 
+    /**
+     * 数据读取：从请求对象中构建 RequestAuthModel
+     */
+    @Override
+    public RequestAuthModel readRequestAuthModel(SaRequest req, Object loginId) {
+        RequestAuthModel ra = new RequestAuthModel();
+        ra.clientId = req.getParamNotNull(SaOAuth2Consts.Param.client_id);
+        ra.responseType = req.getParamNotNull(SaOAuth2Consts.Param.response_type);
+        ra.redirectUri = req.getParamNotNull(SaOAuth2Consts.Param.redirect_uri);
+        ra.state = req.getParam(SaOAuth2Consts.Param.state);
+        // 数据解析
+        String scope = req.getParam(SaOAuth2Consts.Param.scope, "");
+        ra.scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
+        ra.loginId = loginId;
+        return ra;
+    }
+
+
     /**
      * 构建返回值: 获取 token
      */
@@ -84,7 +102,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("refresh_expires_in", at.getRefreshExpiresIn());
         map.put("client_id", at.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(at.scopes));
-        map.put("openid", at.openid);
+        map.putAll(at.extraData);
         return SaResult.ok().setMap(map);
     }
 
@@ -99,9 +117,9 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("expires_in", ct.getExpiresIn());
         map.put("client_id", ct.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(ct.scopes));
+        map.putAll(ct.extraData);
         return SaResult.ok().setMap(map);
     }
 
-
 }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index ab19bfec..39a2446c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -26,8 +26,12 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
 import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
-import cn.dev33.satoken.oauth2.data.model.*;
-import cn.dev33.satoken.oauth2.data.model.other.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
@@ -148,8 +152,8 @@ public class SaOAuth2ServerProcessor {
 			return cfg.notLoginView.get();
 		}
 
-		// 2、构建请求Model
-		RequestAuthModel ra = oauth2Template.generateRequestAuth(req, getStpLogic().getLoginId());
+		// 2、构建请求 Model
+		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, getStpLogic().getLoginId());
 
 		// 3、校验：重定向域名是否合法
 		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java
index e64892db..8a73c090 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/CommonScope.java
@@ -32,9 +32,9 @@ public final class CommonScope {
     public static final String OPENID = "openid";
 
     /**
-     * 获取用户信息
+     * 获取 userid
      */
-    public static final String USERINFO = "userinfo";
+    public static final String USERID = "userid";
 
     /**
      * 获取 id_token
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
new file mode 100644
index 00000000..71961833
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.scope.handler;
+
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.scope.CommonScope;
+
+/**
+ * id_token 权限处理器：在 AccessToken 扩展参数中追加 id_token 字段
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class OidcScopeHandler implements SaOAuth2ScopeAbstractHandler {
+
+    public String getHandlerScope() {
+        return CommonScope.OIDC;
+    }
+
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
+        // TODO 追加参数 id_token
+    }
+
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
index 00da76b0..0bc100e7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
@@ -16,29 +16,26 @@
 package cn.dev33.satoken.oauth2.scope.handler;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 
 /**
- * OpenId 权限处理器
+ * OpenId 权限处理器：在 AccessToken 扩展参数中追加 openid 字段
  *
  * @author click33
  * @since 1.39.0
  */
 public class OpenIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
 
-    /**
-     * 获取所要处理的权限
-     */
     public String getHandlerScope() {
         return CommonScope.OPENID;
     }
 
     @Override
     public void workAccessToken(AccessTokenModel at) {
-        System.out.println("追加 openid " + at.accessToken);
-        at.openid = SaOAuth2Manager.getDataLoader().getOpenid(at.clientId, at.loginId);
+        at.extraData.put(SaOAuth2Consts.ExtraField.openid, SaOAuth2Manager.getDataLoader().getOpenid(at.clientId, at.loginId));
     }
 
     @Override
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java
new file mode 100644
index 00000000..b062a3df
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.scope.handler;
+
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.scope.CommonScope;
+
+/**
+ * UserId 权限处理器：在 AccessToken 扩展参数中追加 userid 字段
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class UserIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
+
+    public String getHandlerScope() {
+        return CommonScope.USERID;
+    }
+
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
+        at.extraData.put(SaOAuth2Consts.ExtraField.userid, at.loginId);
+    }
+
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index ce0144f1..97fbab77 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -18,8 +18,10 @@ package cn.dev33.satoken.oauth2.strategy;
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.oauth2.function.strategy.*;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
+import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
 import cn.dev33.satoken.oauth2.scope.handler.OpenIdScopeHandler;
 import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeAbstractHandler;
+import cn.dev33.satoken.oauth2.scope.handler.UserIdScopeHandler;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.LinkedHashMap;
@@ -54,6 +56,8 @@ public final class SaOAuth2Strategy {
 	 */
 	public void registerDefaultScopeHandler() {
 		scopeHandlerMap.put(CommonScope.OPENID, new OpenIdScopeHandler());
+		scopeHandlerMap.put(CommonScope.USERID, new UserIdScopeHandler());
+		scopeHandlerMap.put(CommonScope.OIDC, new OidcScopeHandler());
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 90af6f8c..c8536a0b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -15,11 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.template;
 
-import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.strategy.SaStrategy;
@@ -119,25 +118,6 @@ public class SaOAuth2Template {
 		}
 	}
 
-	// ------------------- generate 构建数据
-	/**
-	 * 构建Model：请求Model
-	 * @param req SaRequest对象
-	 * @param loginId 账号id
-	 * @return RequestAuthModel对象
-	 */
-	public RequestAuthModel generateRequestAuth(SaRequest req, Object loginId) {
-		RequestAuthModel ra = new RequestAuthModel();
-		ra.clientId = req.getParamNotNull(Param.client_id);
-		ra.responseType = req.getParamNotNull(Param.response_type);
-		ra.redirectUri = req.getParamNotNull(Param.redirect_uri);
-		ra.state = req.getParam(Param.state);
-		// 数据解析
-		String scope = req.getParam(Param.scope, "");
-		ra.scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
-		ra.loginId = loginId;
-		return ra;
-	}
 
 	// ------------------- check 数据校验
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 44478769..38a6464a 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -15,9 +15,12 @@
  */
 package cn.dev33.satoken.oauth2.template;
 
-import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
 import java.util.List;
@@ -86,17 +89,6 @@ public class SaOAuth2Util {
 		SaOAuth2ServerProcessor.instance.oauth2Template.checkClientTokenScope(clientToken, scopes);
 	}
 
-	// ------------------- generate 构建数据 
-	
-	/**
-	 * 构建Model：请求Model  
-	 * @param req SaRequest对象 
-	 * @param loginId 账号id 
-	 * @return RequestAuthModel对象 
-	 */
-	public static RequestAuthModel generateRequestAuth(SaRequest req, Object loginId) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.generateRequestAuth(req, loginId);
-	}
 
 	// ------------------- 数据校验 
 	
-- 
Gitee


From c17b2444522bf14556a80c541cfb570699beb78c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 20:58:09 +0800
Subject: [PATCH 134/172] =?UTF-8?q?=E6=8F=90=E4=BE=9B=E9=BB=98=E8=AE=A4=20?=
 =?UTF-8?q?openid=20=E7=94=9F=E6=88=90=E7=AE=97=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/resources/templates/index.html   |  8 ++---
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  9 ++---
 .../satoken/oauth2/config/SaOAuth2Config.java | 36 ++++++++++++++++---
 .../satoken/oauth2/consts/SaOAuth2Consts.java |  4 +++
 .../data/loader/SaOAuth2DataLoader.java       | 25 +++++++------
 5 files changed, 54 insertions(+), 28 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
index 9bcfde53..711f1a97 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
@@ -45,14 +45,14 @@
 			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/">
 				<button>点我开始授权登录（静默授权）</button> 
 			</a>
-			<span class="ps">当请求链接不包含scope权限时，将无需用户手动确认，做到静默授权，当然此时我们也只能获取openid</span>
+			<span class="ps">当请求链接不包含 scope 权限，或请求的 scope 近期已授权时，将无需用户手动确认，做到静默授权</span>
 			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/</code>
 			
-			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo">
+			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo">
 				<button>授权登录（显式授权）</button> 
 			</a>
-			<span class="ps">当请求链接包含具体的scope权限时，将需要用户手动确认，此时我们除了openid以外还可以获取更多的资源</span>
-			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo</code>
+			<span class="ps">当请求链接包含具体的 scope 权限时，将需要用户手动确认，此时 OAuth-Server 会返回更多的数据</span>
+			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo</code>
 			
 			<button onclick="refreshToken()">刷新令牌</button> 
 			<span class="ps">我们可以拿着 Refresh-Token 去刷新我们的 Access-Token，每次刷新后旧Token将作废</span>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index af90c631..f6ca372f 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -2,7 +2,6 @@ package com.pj.oauth2;
 
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
-import cn.dev33.satoken.secure.SaSecureUtil;
 import org.springframework.stereotype.Component;
 
 import java.util.Arrays;
@@ -24,7 +23,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientId("1001")
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
 					.setAllowUrl("*")
-					.setContractScopes(Arrays.asList("userinfo", "openid"))
+					.setContractScopes(Arrays.asList("openid", "userid", "userinfo"))
 					.setIsAutoMode(true);
 		}
 		return null;
@@ -33,10 +32,8 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	// 根据ClientId 和 LoginId 获取openid 
 	@Override
 	public String getOpenid(String clientId, Object loginId) {
-		// 此为模拟数据，真实环境需要从数据库查询 
-//		return "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__";
-		String prefix = "grSwoIN0MC1ewxHXvfCW3BothWDZMMtx";
-		return SaSecureUtil.md5(prefix + "_" + clientId + "_" + loginId);
+		// 此处使用框架默认算法生成 openid，真实环境建议改为从数据库查询
+		return SaOAuth2DataLoader.super.getOpenid(clientId, loginId);
 	}
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
index 7478d63b..192c7b15 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
@@ -15,6 +15,7 @@
  */
 package cn.dev33.satoken.oauth2.config;
 
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.function.SaOAuth2ConfirmViewFunction;
 import cn.dev33.satoken.oauth2.function.SaOAuth2DoLoginHandleFunction;
 import cn.dev33.satoken.oauth2.function.SaOAuth2NotLoginViewFunction;
@@ -59,9 +60,13 @@ public class SaOAuth2Config implements Serializable {
 	/** Client-Token 保存的时间(单位：秒) 默认两个小时 */
 	public long clientTokenTimeout = 60 * 60 * 2;
 
-	/** Past-Client-Token 保存的时间(单位：秒) 默认为 -1，代表延续 Client-Token有效期 */
+	/** Past-Client-Token 保存的时间(单位：秒) 默认为 -1，代表延续 Client-Token 有效期 */
 	public long pastClientTokenTimeout = -1;
 
+	/** 默认 openid 生成算法中使用的摘要前缀 */
+	public String openidDigestPrefix = SaOAuth2Consts.OPENID_DEFAULT_DIGEST_PREFIX;
+
+
 
 	/**
 	 * @return isCode
@@ -213,13 +218,29 @@ public class SaOAuth2Config implements Serializable {
 		return this;
 	}
 
+	/**
+	 * @return openidDigestPrefix
+	 */
+	public String getOpenidDigestPrefix() {
+		return openidDigestPrefix;
+	}
+
+	/**
+	 * @param openidDigestPrefix 要设置的 openidDigestPrefix
+	 * @return 对象自身
+	 */
+	public SaOAuth2Config setOpenidMd5Prefix(String openidDigestPrefix) {
+		this.openidDigestPrefix = openidDigestPrefix;
+		return this;
+	}
+
 	
 	// -------------------- SaOAuth2Handle 所有回调函数 -------------------- 
 	
 	/**
 	 * OAuth-Server端：未登录时返回的View 
 	 */
-	public SaOAuth2NotLoginViewFunction notLoginView = () -> "当前会话在OAuth-Server认证中心尚未登录";
+	public SaOAuth2NotLoginViewFunction notLoginView = () -> "当前会话在 OAuth-Server 认证中心尚未登录";
 
 	/**
 	 * OAuth-Server端：确认授权时返回的View 
@@ -234,9 +255,14 @@ public class SaOAuth2Config implements Serializable {
 	@Override
 	public String toString() {
 		return "SaOAuth2Config [isCode=" + isCode + ", isImplicit=" + isImplicit + ", isPassword=" + isPassword
-				+ ", isClient=" + isClient + ", isNewRefresh=" + isNewRefresh + ", codeTimeout=" + codeTimeout
-				+ ", accessTokenTimeout=" + accessTokenTimeout + ", refreshTokenTimeout=" + refreshTokenTimeout
-				+ ", clientTokenTimeout=" + clientTokenTimeout + ", pastClientTokenTimeout=" + pastClientTokenTimeout
+				+ ", isClient=" + isClient
+				+ ", isNewRefresh=" + isNewRefresh
+				+ ", codeTimeout=" + codeTimeout
+				+ ", accessTokenTimeout=" + accessTokenTimeout
+				+ ", refreshTokenTimeout=" + refreshTokenTimeout
+				+ ", clientTokenTimeout=" + clientTokenTimeout
+				+ ", pastClientTokenTimeout=" + pastClientTokenTimeout
+				+ ", openidDigestPrefix=" + openidDigestPrefix
 				+"]";
 	}
 	
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index 6337cefc..a6e104c4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -102,6 +102,10 @@ public class SaOAuth2Consts {
 		public static String id_token = "id_token";
 	}
 
+
+	/** 默认 openid 生成算法中使用的前缀 */
+	public static final String OPENID_DEFAULT_DIGEST_PREFIX = "openid_default_digest_prefix";
+
 	/** 表示OK的返回结果 */
 	public static final String OK = "ok";
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index 4e262395..df6dece3 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -15,8 +15,10 @@
  */
 package cn.dev33.satoken.oauth2.data.loader;
 
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.secure.SaSecureUtil;
 
 /**
  * Sa-Token OAuth2 数据加载器
@@ -36,18 +38,6 @@ public interface SaOAuth2DataLoader {
         return null;
     }
 
-    /**
-     * 根据ClientId 和 LoginId 获取openid
-     *
-     * @param clientId 应用id
-     * @param loginId 账号id
-     * @return 此账号在此Client下的openid
-     */
-    default String getOpenid(String clientId, Object loginId) {
-        return null;
-    }
-
-
     /**
      * 根据 id 获取 Client 信息，不允许为 null
      *
@@ -62,6 +52,15 @@ public interface SaOAuth2DataLoader {
         return clientModel;
     }
 
-
+    /**
+     * 根据ClientId 和 LoginId 获取openid
+     *
+     * @param clientId 应用id
+     * @param loginId 账号id
+     * @return 此账号在此Client下的openid
+     */
+    default String getOpenid(String clientId, Object loginId) {
+        return SaSecureUtil.md5(SaOAuth2Manager.getConfig().getOpenidDigestPrefix() + "_" + clientId + "_" + loginId);
+    }
 
 }
-- 
Gitee


From dd359b20d638b27c5db0e1b59d38d5273bdabed1 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 21:11:34 +0800
Subject: [PATCH 135/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20addAllowUrls=20add?=
 =?UTF-8?q?ContractScopes=20=E6=96=B9=E6=B3=95=EF=BC=8C=E7=AE=80=E5=8C=96?=
 =?UTF-8?q?=20SaClientModel=20=E6=9E=84=E5=BB=BA=E4=BB=A3=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  6 +-
 .../data/model/loader/SaClientModel.java      | 82 ++++++++++++++-----
 .../oauth2/template/SaOAuth2Template.java     | 10 ++-
 3 files changed, 69 insertions(+), 29 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index f6ca372f..e8358a24 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -4,8 +4,6 @@ import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import org.springframework.stereotype.Component;
 
-import java.util.Arrays;
-
 /**
  * Sa-Token OAuth2：自定义数据加载器
  *
@@ -22,8 +20,8 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 			return new SaClientModel()
 					.setClientId("1001")
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
-					.setAllowUrl("*")
-					.setContractScopes(Arrays.asList("openid", "userid", "userinfo"))
+					.addAllowUrls("*")
+					.addContractScopes("openid", "userid", "userinfo")
 					.setIsAutoMode(true);
 		}
 		return null;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index 04dcce98..2cc8dc5f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -19,6 +19,8 @@ import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
 
 import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 
 /**
@@ -42,14 +44,14 @@ public class SaClientModel implements Serializable {
 	public String clientSecret;
 
 	/**
-	 * 应用签约的所有权限, 多个用逗号隔开 
+	 * 应用签约的所有权限
 	 */
 	public List<String> contractScopes;
 	
 	/**
-	 * 应用允许授权的所有URL, 多个用逗号隔开 
+	 * 应用允许授权的所有URL
 	 */
-	public String allowUrl;
+	public List<String> allowUrls;
 	
 	/** 此 Client 是否打开模式：授权码（Authorization Code） */
 	public Boolean isCode = false;
@@ -94,12 +96,12 @@ public class SaClientModel implements Serializable {
 		this.clientTokenTimeout = config.getClientTokenTimeout();
 		this.pastClientTokenTimeout = config.getPastClientTokenTimeout();
 	}
-	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, String allowUrl) {
+	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, List<String> allowUrls) {
 		super();
 		this.clientId = clientId;
 		this.clientSecret = clientSecret;
 		this.contractScopes = contractScopes;
-		this.allowUrl = allowUrl;
+		this.allowUrls = allowUrls;
 	}
 
 	/**
@@ -142,7 +144,7 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @param contractScopes 应用签约的所有权限, 多个用逗号隔开
+	 * @param contractScopes 应用签约的所有权限
 	 * @return 对象自身 
 	 */
 	public SaClientModel setContractScopes(List<String> contractScopes) {
@@ -151,18 +153,18 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @return 应用允许授权的所有URL, 多个用逗号隔开
+	 * @return 应用允许授权的所有URL
 	 */
-	public String getAllowUrl() {
-		return allowUrl;
+	public List<String> getAllowUrls() {
+		return allowUrls;
 	}
 
 	/**
-	 * @param allowUrl 应用允许授权的所有URL, 多个用逗号隔开
+	 * @param allowUrls 应用允许授权的所有URL
 	 * @return 对象自身 
 	 */
-	public SaClientModel setAllowUrl(String allowUrl) {
-		this.allowUrl = allowUrl;
+	public SaClientModel setAllowUrls(List<String> allowUrls) {
+		this.allowUrls = allowUrls;
 		return this;
 	}
 
@@ -327,16 +329,54 @@ public class SaClientModel implements Serializable {
 		return this;
 	}
 	
-	// 
+	//
+
 	@Override
 	public String toString() {
-		return "SaClientModel [clientId=" + clientId + ", clientSecret=" + clientSecret + ", contractScopes="
-				+ contractScopes + ", allowUrl=" + allowUrl + ", isCode=" + isCode + ", isImplicit=" + isImplicit
-				+ ", isPassword=" + isPassword + ", isClient=" + isClient + ", isAutoMode=" + isAutoMode
-				+ ", isNewRefresh=" + isNewRefresh + ", accessTokenTimeout=" + accessTokenTimeout
-				+ ", refreshTokenTimeout=" + refreshTokenTimeout + ", clientTokenTimeout=" + clientTokenTimeout
-				+ ", pastClientTokenTimeout=" + pastClientTokenTimeout + "]";
+		return "SaClientModel{" +
+				"clientId='" + clientId + '\'' +
+				", clientSecret='" + clientSecret + '\'' +
+				", contractScopes=" + contractScopes +
+				", allowUrls=" + allowUrls +
+				", isCode=" + isCode +
+				", isImplicit=" + isImplicit +
+				", isPassword=" + isPassword +
+				", isClient=" + isClient +
+				", isAutoMode=" + isAutoMode +
+				", isNewRefresh=" + isNewRefresh +
+				", accessTokenTimeout=" + accessTokenTimeout +
+				", refreshTokenTimeout=" + refreshTokenTimeout +
+				", clientTokenTimeout=" + clientTokenTimeout +
+				", pastClientTokenTimeout=" + pastClientTokenTimeout +
+				'}';
 	}
-	
-	
+
+
+	// 追加方法
+
+	/**
+	 * @param scopes 添加应用签约的所有权限
+	 * @return 对象自身
+	 */
+	public SaClientModel addContractScopes(String... scopes) {
+		if(this.contractScopes == null) {
+			this.contractScopes = new ArrayList<>();
+		}
+		this.contractScopes.addAll(Arrays.asList(scopes));
+		return this;
+	}
+
+	/**
+	 * @param urls 添加应用签约的所有权限
+	 * @return 对象自身
+	 */
+	public SaClientModel addAllowUrls(String... urls) {
+		if(this.allowUrls == null) {
+			this.allowUrls = new ArrayList<>();
+		}
+		this.allowUrls.addAll(Arrays.asList(urls));
+		return this;
+	}
+
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index c8536a0b..73422fae 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -17,7 +17,10 @@ package cn.dev33.satoken.oauth2.template;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
-import cn.dev33.satoken.oauth2.data.model.*;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
@@ -187,9 +190,8 @@ public class SaOAuth2Template {
 
 		// 4、是否在[允许地址列表]之中
 		SaClientModel clientModel = checkClientModel(clientId);
-		List<String> allowList = SaOAuth2Manager.getDataConverter().convertAllowUrlStringToList(clientModel.allowUrl);
-		checkAllowUrlList(allowList);
-		if( ! SaStrategy.instance.hasElement.apply(allowList, url)) {
+		checkAllowUrlList(clientModel.allowUrls);
+		if( ! SaStrategy.instance.hasElement.apply(clientModel.allowUrls, url)) {
 			throw new SaOAuth2Exception("非法 redirect_url: " + url).setCode(SaOAuth2ErrorCode.CODE_30114);
 		}
 	}
-- 
Gitee


From e8d3a6f137dfc517a6ea129a15d39bbe16a80cd3 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 18 Aug 2024 22:30:39 +0800
Subject: [PATCH 136/172] =?UTF-8?q?=E9=83=A8=E5=88=86=E9=85=8D=E7=BD=AE?=
 =?UTF-8?q?=E9=A1=B9=E6=94=B9=E4=B8=BAtrue?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
index 192c7b15..3114e650 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
@@ -37,13 +37,13 @@ public class SaOAuth2Config implements Serializable {
 	public Boolean isCode = true;
 
 	/** 是否打开模式：隐藏式（Implicit） */
-	public Boolean isImplicit = false;
+	public Boolean isImplicit = true;
 
 	/** 是否打开模式：密码式（Password） */
-	public Boolean isPassword = false;
+	public Boolean isPassword = true;
 
 	/** 是否打开模式：凭证式（Client Credentials） */
-	public Boolean isClient = false;
+	public Boolean isClient = true;
 
 	/** 是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token */
 	public Boolean isNewRefresh = false;
-- 
Gitee


From 25b24414ff6b35db93877537f33ce2d193168ba6 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 19 Aug 2024 17:49:59 +0800
Subject: [PATCH 137/172] =?UTF-8?q?=E5=88=9D=E6=AD=A5=E5=AE=8C=E5=96=84=20?=
 =?UTF-8?q?oauth2=20=E7=9B=B8=E5=85=B3=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../pj/oauth2/SaOAuthClientController.java    |   2 +-
 .../src/main/resources/templates/index.html   |  20 +-
 .../pj/current/GlobalExceptionHandler.java    |  22 ++
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  14 +-
 .../pj/oauth2/SaOAuth2ServerController.java   |  12 +-
 .../src/main/resources/application.yml        |   2 +-
 sa-token-doc/_sidebar.md                      |  15 +-
 sa-token-doc/fun/sso-vs-oauth2.md             |   1 +
 .../{oauth2-api.md => oauth2-apidoc.md}       | 205 +++++++++---------
 sa-token-doc/oauth2/oauth2-check-domain.md    |  93 ++++++++
 sa-token-doc/oauth2/oauth2-custom-login.md    |  94 ++++++++
 sa-token-doc/oauth2/oauth2-server.md          | 123 +++++++----
 sa-token-doc/oauth2/readme.md                 |  46 +++-
 sa-token-doc/sso/sso-apidoc.md                |   5 +
 sa-token-doc/use/config.md                    |   6 +-
 .../SaOAuth2DataGenerateDefaultImpl.java      |   9 +-
 16 files changed, 479 insertions(+), 190 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java
 rename sa-token-doc/oauth2/{oauth2-api.md => oauth2-apidoc.md} (40%)
 create mode 100644 sa-token-doc/oauth2/oauth2-check-domain.md
 create mode 100644 sa-token-doc/oauth2/oauth2-custom-login.md

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
index 77240d0a..ffa9fe0c 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
@@ -23,7 +23,7 @@ public class SaOAuthClientController {
 	// 相关参数配置 
 	private final String clientId = "1001";								// 应用id
 	private final String clientSecret = "aaaa-bbbb-cccc-dddd-eeee";		// 应用秘钥
-	private final String serverUrl = "http://sa-oauth-server.com:8001";	// 服务端接口
+	private final String serverUrl = "http://sa-oauth-server.com:8000";	// 服务端接口
 	
 	// 进入首页 
 	@RequestMapping("/")
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
index 711f1a97..79c33db3 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
@@ -42,33 +42,33 @@
 			<h3>模式一：授权码（Authorization Code）</h3>
 			<p class="pst">授权码：OAuth2.0标准授权流程，先 (重定向) 获取Code授权码，再 (Rest API) 获取 Access-Token 和 Openid </p> 
 			
-			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/">
+			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/">
 				<button>点我开始授权登录（静默授权）</button> 
 			</a>
 			<span class="ps">当请求链接不包含 scope 权限，或请求的 scope 近期已授权时，将无需用户手动确认，做到静默授权</span>
-			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/</code>
 			
-			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo">
+			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo">
 				<button>授权登录（显式授权）</button> 
 			</a>
 			<span class="ps">当请求链接包含具体的 scope 权限时，将需要用户手动确认，此时 OAuth-Server 会返回更多的数据</span>
-			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo</code>
 			
 			<button onclick="refreshToken()">刷新令牌</button> 
 			<span class="ps">我们可以拿着 Refresh-Token 去刷新我们的 Access-Token，每次刷新后旧Token将作废</span>
-			<code>http://sa-oauth-server.com:8001/oauth2/refresh?grant_type=refresh_token&client_id={value}&client_secret={value}&refresh_token={value}</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/refresh?grant_type=refresh_token&client_id={value}&client_secret={value}&refresh_token={value}</code>
 			
 			<button onclick="getUserinfo()">获取账号信息</button> 
 			<span class="ps">使用 Access-Token 置换资源: 获取账号昵称、头像、性别等信息 (Access-Token具备userinfo权限时才可以获取成功) </span>
-			<code>http://sa-oauth-server.com:8001/oauth2/userinfo?access_token={value}</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/userinfo?access_token={value}</code>
 			
 			<br>
 			<h3>模式二：隐藏式（Implicit）</h3>
-			<a href="http://sa-oauth-server.com:8001/oauth2/authorize?response_type=token&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo">
+			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=token&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo">
 				<button>隐藏式</button> 
 			</a>
 			<span class="ps">越过授权码的步骤，直接返回token到前端页面（ 格式：http//:domain.com#token=xxxx-xxxx ）</span>
-			<code>http://sa-oauth-server.com:8001/oauth2/authorize?response_type=token&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=token&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=userinfo</code>
 			
 			<br>
 			<h3>模式三：密码式（Password）</h3>
@@ -76,7 +76,7 @@
 			账号：<input name="username">
 			密码：<input name="password">
 			<button onclick="passwordLogin()">登录</button> 
-			<code>http://sa-oauth-server.com:8001/oauth2/token?grant_type=password&client_id={value}&client_secret={value}&username={value}&password={value}</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/token?grant_type=password&client_id={value}&client_secret={value}&username={value}&password={value}</code>
 			
 			<br>
 			<h3>模式四：凭证式（Client Credentials）</h3>
@@ -87,7 +87,7 @@
 				保证了服务的高可用</p>
 				
 			<button onclick="getClientToken()">获取应用Client-Token</button> 
-			<code>http://sa-oauth-server.com:8001/oauth2/client_token?grant_type=client_credentials&client_id={value}&client_secret={value}</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/client_token?grant_type=client_credentials&client_id={value}&client_secret={value}</code>
 			
 			<br><br>
 			<span>更多资料请参考 Sa-Token 官方文档地址：</span>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java
new file mode 100644
index 00000000..f251e478
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java
@@ -0,0 +1,22 @@
+package com.pj.current;
+
+import cn.dev33.satoken.util.SaResult;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+/**
+ * 全局异常处理 
+ * @author click33
+ *
+ */
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+
+	// 全局异常拦截 
+	@ExceptionHandler
+	public SaResult handlerException(Exception e) {
+		e.printStackTrace(); 
+		return SaResult.error(e.getMessage());
+	}
+	
+}
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index e8358a24..72948364 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -12,22 +12,22 @@ import org.springframework.stereotype.Component;
 @Component
 public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	
-	// 根据 client_id 获取 Client 信息
+	// 根据 clientId 获取 Client 信息
 	@Override
 	public SaClientModel getClientModel(String clientId) {
 		// 此为模拟数据，真实环境需要从数据库查询 
 		if("1001".equals(clientId)) {
 			return new SaClientModel()
-					.setClientId("1001")
-					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
-					.addAllowUrls("*")
-					.addContractScopes("openid", "userid", "userinfo")
-					.setIsAutoMode(true);
+					.setClientId("1001")    // client id
+					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
+					.addAllowUrls("*")    // 所有允许授权的 url
+					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+					.setIsAutoMode(true);    // 是否自动判断开放的授权模式
 		}
 		return null;
 	}
 	
-	// 根据ClientId 和 LoginId 获取openid 
+	// 根据 clientId 和 loginId 获取 openid
 	@Override
 	public String getOpenid(String clientId, Object loginId) {
 		// 此处使用框架默认算法生成 openid，真实环境建议改为从数据库查询
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 03fbbf60..44ddce9d 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -33,12 +33,13 @@ public class SaOAuth2ServerController {
 	
 	// Sa-OAuth2 定制化配置 
 	@Autowired
-	public void setSaOAuth2Config(SaOAuth2Config cfg) {
+	public void configOAuth2Server(SaOAuth2Config cfg) {
 		// 未登录的视图
 		cfg.notLoginView = ()->{
 			return new ModelAndView("login.html");
 		};
-			// 登录处理函数 
+
+		// 登录处理函数
 		cfg.doLoginHandle = (name, pwd) -> {
 			if("sa".equals(name) && "123456".equals(pwd)) {
 				StpUtil.login(10001);
@@ -46,11 +47,12 @@ public class SaOAuth2ServerController {
 			}
 			return SaResult.error("账号名或密码错误");
 		};
-			// 授权确认视图 
-		cfg.confirmView = (clientId, scope)->{
+
+		// 授权确认视图
+		cfg.confirmView = (clientId, scopes)->{
 			Map<String, Object> map = new HashMap<>();
 			map.put("clientId", clientId);
-			map.put("scope", scope);
+			map.put("scope", scopes);
 			return new ModelAndView("confirm.html", map);
 		};
 	}
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index f745a8d9..0d263504 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -1,5 +1,5 @@
 server: 
-    port: 8001
+    port: 8000
 
 # sa-token配置
 sa-token: 
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index e07e2cc9..e15f364c 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -37,7 +37,7 @@
 - **单点登录**
 	- [单点登录简述](/sso/readme)
 	- [搭建统一认证中心：SSO-Server](/sso/sso-server)
-	- [SSO-Server 认证中心开放接口](/sso/sso-apidoc)
+	- [SSO-Server 认证中心开放 API 接口](/sso/sso-apidoc)
 	- [SSO模式一 共享Cookie同步会话](/sso/sso-type1)
 	- [SSO模式二 URL重定向传播会话](/sso/sso-type2)
 	- [SSO模式三 Http请求获取会话](/sso/sso-type3)
@@ -54,9 +54,18 @@
 - **OAuth2.0**
 	- [OAuth2.0简述](/oauth2/readme)
 	- [OAuth2-Server搭建](/oauth2/oauth2-server)
-	- [OAuth2-Server端-API列表](/oauth2/oauth2-api)
-	- [OAuth2-二次开发说明](/oauth2/oauth2-dev)
+	- [OAuth2-Server端开放 API 接口](/oauth2/oauth2-apidoc)
+	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
+	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
+	- [拆分式路由](/oauth2/3)
+	- [前后端分离模式整合方案](/oauth2/4)
+	- [平台中心模式开发](/oauth2/5)
+	- [自定义 Scope 权限以处理器](/oauth2/6)
+	- [为 Scope 划分等级](/oauth2/7)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
+	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
+	- [常见问题说明](/oauth2/8)
+	- <!-- jwt风格token、使用注解校验权限、OAuth2整个流程参考、state参数详解 -->
 
 - **微服务**
 	- [分布式Session会话](/micro/dcs-session)
diff --git a/sa-token-doc/fun/sso-vs-oauth2.md b/sa-token-doc/fun/sso-vs-oauth2.md
index a3cd5764..e8dd8b0f 100644
--- a/sa-token-doc/fun/sso-vs-oauth2.md
+++ b/sa-token-doc/fun/sso-vs-oauth2.md
@@ -14,6 +14,7 @@ QQ群库经常有小伙伴提问：项目需要搭建统一认证中心，是用
 | 自有系统授权管理	| 支持度高				| 支持度低										|
 | Client级的权限校验	| 不支持					| 支持度高										|
 | 集成简易度			| 比较简单				| 难度中等									|
+| 适合项目			| 企业内部项目整合		| 企业搭建统一认证授权平台，对外开放服务			|
 
 
 注：以上仅为在 Sa-Token 中两种技术的差异度比较，不同框架的实现可能略有差异，但整体思想是一致的。
diff --git a/sa-token-doc/oauth2/oauth2-api.md b/sa-token-doc/oauth2/oauth2-apidoc.md
similarity index 40%
rename from sa-token-doc/oauth2/oauth2-api.md
rename to sa-token-doc/oauth2/oauth2-apidoc.md
index a214c271..eedcdf04 100644
--- a/sa-token-doc/oauth2/oauth2-api.md
+++ b/sa-token-doc/oauth2/oauth2-apidoc.md
@@ -9,75 +9,79 @@
 
 根据以下格式构建URL，引导用户访问 （复制时请注意删减掉相应空格和换行符）
 ``` url
-http://sa-oauth-server.com:8001/oauth2/authorize
+http://{host}:{port}/oauth2/authorize
 	?response_type=code
-	&client_id={value}
-	&redirect_uri={value}
-	&scope={value}
-	&state={value}
+	&client_id={client_id}
+	&redirect_uri={redirect_uri}
+	&scope={scope}
+	&state={state}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明													|
 | :--------		| :--------	| :--------												|
-| response_type	| 是		| 返回类型，这里请填写：code							|
-| client_id		| 是		| 应用id												|
-| redirect_uri	| 是		| 用户确认授权后，重定向的url地址							|
-| scope			| 否		| 具体请求的权限，多个用逗号隔开						|
-| state			| 否		| 随机值，此参数会在重定向时追加到url末尾，不填不追加	|
+| response_type	| 是		| 返回类型，这里请填写：`code`							|
+| client_id		| 是		| 应用 id												|
+| redirect_uri	| 是		| 用户确认授权后，重定向的 url 地址							|
+| scope			| 否		| 具体请求的权限，多个用逗号(或空格)隔开						|
+| state			| 否		| 随机值，此参数会在重定向时追加到url末尾，不填不追加，如果填写则每次填写的值不可以重复	|
 
 注意点：
-1. 如果用户在Server端尚未登录：会被转发到登录视图，你可以参照文档或官方示例自定义登录页面
-2. 如果scope参数为空，或者请求的权限用户近期已确认过，则无需用户再次确认，达到静默授权的效果，否则需要用户手动确认，服务器才可以下放code授权码 
+1. 如果用户在 `OAuth-Server` 端尚未登录：会被转发到登录视图，你可以参照文档或官方示例自定义登录页面。
+2. 如果 `scope` 参数为空，或者请求的 `scope` 用户近期已确认授权过，则无需用户再次确认，达到静默授权的效果，否则需要用户手动确认，服务器才可以下放 `code` 授权码。
 
-用户确认授权之后，会被重定向至`redirect_uri`，并追加code参数与state参数，形如：
+用户确认授权之后，会被重定向至`redirect_uri`，并追加 `code` 参数与 `state` 参数，形如：
 ``` url
 redirect_uri?code={code}&state={state}
 ```
 
-Code授权码具有以下特点：
-1. 每次授权产生的Code码都不一样
-2. Code码用完即废，不能二次使用
-3. 一个Code的有效期默认为五分钟，超时自动作废
-4. 每次授权产生新Code码，会导致旧Code码立即作废，即使旧Code码尚未使用 
+`Code` 授权码具有以下特点：
+1. 每次授权产生的 `Code` 码都不一样。
+2. `Code` 码用完即废，不能二次使用。
+3. 一个 `Code` 的有效期默认为五分钟，超时自动作废。
+4. 每次授权产生新 `Code` 码，会导致旧 `Code` 码立即作废，即使旧 `Code` 码尚未使用。
 
 
-### 1.2、根据授权码获取Access-Token
-获得Code码后，我们可以通过以下接口，获取到用户的`Access-Token`、`Refresh-Token`、`openid`等关键信息
+### 1.2、根据授权码获取 Access-Token
+获得 `Code` 码后，我们可以通过以下接口，获取到用户的 `Access-Token`、`Refresh-Token` 等信息。
 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/token
+http://{host}:{port}/oauth2/token
 	?grant_type=authorization_code
-	&client_id={value}
-	&client_secret={value}
-	&code={value}
+	&client_id={client_id}
+	&client_secret={client_secret}
+	&code={code}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明													|
 | :--------		| :--------	| :--------												|
-| grant_type	| 是		| 授权类型，这里请填写：authorization_code				|
-| client_id		| 是		| 应用id												|
+| grant_type	| 是		| 授权类型，这里请填写：`authorization_code`				|
+| client_id		| 是		| 应用 id												|
 | client_secret	| 是		| 应用秘钥												|
-| code			| 是		| 步骤1.1中获取到的授权码								|
+| code			| 是		| 步骤 1.1 中获取到的授权码								|
+
+也可以通过 `Basic Authorization` 方式提交 `client` 信息，格式为在请求 `header` 头添加 `Authorization` 参数：
+``` js
+header['Authorization'] = base64(`${client_id}:${client_secret}`);
+```
 
 接口返回示例：
 
 ``` js
 {
-    "code": 200,	// 200表示请求成功，非200标识请求失败, 以下不再赘述 
+    "code": 200,    // 200表示请求成功，非200标识请求失败, 以下不再赘述 
     "msg": "ok",
-    "data": {
-        "access_token": "7Ngo1Igg6rieWwAmWMe4cxT7j8o46mjyuabuwLETuAoN6JpPzPO2i3PVpEVJ",     // Access-Token值
-        "refresh_token": "ZMG7QbuCVtCIn1FAJuDbgEjsoXt5Kqzii9zsPeyahAmoir893ARA4rbmeR66",    // Refresh-Token值
-        "expires_in": 7199,                 // Access-Token剩余有效期，单位秒  
-        "refresh_expires_in": 2591999,      // Refresh-Token剩余有效期，单位秒  
-        "client_id": "1001",                // 应用id
-        "scope": "userinfo",                // 此令牌包含的权限
-        "openid": "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__"     // openid 
-    }
+    "data": null,
+    "token_type": "bearer",
+    "access_token": "Gly7mnnXSdCxkOqmOwcA5SbG6ZtPmJVX7ZgSn1pidhRmnenBEgxbWJS8VWxA",     // Access-Token值
+    "refresh_token": "EuYNwpxdc18MpaZLPyhFeyAyzr2IOWEr4q3QUGgPWqdJujQqvohjQEDJpwOm",    // Refresh-Token值
+    "expires_in": 7199,                  // Access-Token剩余有效期，单位秒  
+    "refresh_expires_in": 2591999,       // Refresh-Token剩余有效期，单位秒  
+    "client_id": "1001",                 // 应用 id
+    "scope": "userinfo"                  // 此令牌包含的权限
 }
 ```
 
@@ -86,40 +90,40 @@ http://sa-oauth-server.com:8001/oauth2/token
 Access-Token的有效期较短，如果每次过期都需要重新授权的话，会比较影响用户体验，因此我们可以在后台通过`Refresh-Token` 刷新 `Access-Token`
 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/refresh
+http://{host}:{port}/oauth2/refresh
 	?grant_type=refresh_token
-	&client_id={value}
-	&client_secret={value}
-	&refresh_token={value}
+	&client_id={client_id}
+	&client_secret={client_secret}
+	&refresh_token={refresh_token}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明													|
 | :--------		| :--------	| :--------												|
-| grant_type	| 是		| 授权类型，这里请填写：refresh_token				|
-| client_id		| 是		| 应用id												|
+| grant_type	| 是		| 授权类型，这里请填写：`refresh_token`				|
+| client_id		| 是		| 应用 id												|
 | client_secret	| 是		| 应用秘钥												|
-| refresh_token | 是		| 步骤1.2中获取到的`Refresh-Token`值							|
+| refresh_token | 是		| 步骤1.2中获取到的 `Refresh-Token` 值							|
 
 接口返回值同章节1.2，此处不再赘述 
 
 
 ### 1.4、回收 Access-Token （如果需要的话）
-在Access-Token过期前主动将其回收 
+在A ccess-Token 过期之前主动将其回收 
 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/revoke
-	?client_id={value}
-	&client_secret={value}
-	&access_token={value}
+http://{host}:{port}/oauth2/revoke
+	?client_id={client_id}
+	&client_secret={client_secret}
+	&access_token={access_token}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明													|
 | :--------		| :--------	| :--------												|
-| client_id		| 是		| 应用id												|
+| client_id		| 是		| 应用 id												|
 | client_secret	| 是		| 应用秘钥												|
 | access_token  | 是		| 步骤1.2中获取到的`Access-Token`值						|
 
@@ -137,7 +141,7 @@ http://sa-oauth-server.com:8001/oauth2/revoke
 注：此接口为官方仓库模拟接口，正式项目中大家可以根据此样例，自定义需要的接口及参数 
 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/userinfo?access_token={value}
+http://{host}:{port}/oauth2/userinfo?access_token={access_token}
 ```
 
 返回值样例：
@@ -145,13 +149,11 @@ http://sa-oauth-server.com:8001/oauth2/userinfo?access_token={value}
 {
     "code": 200,
     "msg": "ok",
-    "data": {
-        "nickname": "shengzhang_",         // 账号昵称
-        "avatar": "http://xxx.com/1.jpg",  // 头像地址
-        "age": "18",                       // 年龄
-        "sex": "男",                       // 性别
-        "address": "山东省 青岛市 城阳区"   // 所在城市 
-    }
+	"nickname": "shengzhang_",         // 账号昵称
+	"avatar": "http://xxx.com/1.jpg",  // 头像地址
+	"age": "18",                       // 年龄
+	"sex": "男",                       // 性别
+	"address": "山东省 青岛市 城阳区"   // 所在城市 
 }
 ```
 
@@ -160,50 +162,53 @@ http://sa-oauth-server.com:8001/oauth2/userinfo?access_token={value}
 
 根据以下格式构建URL，引导用户访问：
 ``` url
-http://sa-oauth-server.com:8001/oauth2/authorize
+http://{host}:{port}/oauth2/authorize
 	?response_type=token
-	&client_id={value}
-	&redirect_uri={value}
-	&scope={value}
-	$state={value}
+	&client_id={client_id}
+	&redirect_uri={redirect_uri}
+	&scope={scope}
+	&state={state}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明													|
 | :--------		| :--------	| :--------												|
-| response_type	| 是		| 返回类型，这里请填写：token							|
-| client_id		| 是		| 应用id												|
+| response_type	| 是		| 返回类型，这里请填写：`token`							|
+| client_id		| 是		| 应用 id												|
 | redirect_uri	| 是		| 用户确认授权后，重定向的url地址							|
-| scope			| 否		| 具体请求的权限，多个用逗号隔开							|
-| state			| 否		| 随机值，此参数会在重定向时追加到url末尾，不填不追加		|
+| scope			| 否		| 具体请求的权限，多个用逗号(或空格)隔开							|
+| state			| 否		| 随机值，此参数会在重定向时追加到url末尾，不填不追加，如果填写则每次填写的值不可以重复			|
 
-此模式会越过授权码的步骤，直接返回Access-Token到前端页面，形如：
+此模式会越过授权码的步骤，直接返回 `Access-Token` 到前端页面，形如：
 ``` url
 redirect_uri#token=xxxx-xxxx-xxxx-xxxx
 ```
+注意 token 是以 `#` 锚参数的形式拼接到 url 上的。
+
 
 ## 3、模式三：密码式（Password）
-首先在Client端构建表单，让用户输入Server端的账号和密码，然后在Client端访问接口 
+首先在Client端构建表单，让用户输入 Server 端的账号和密码，然后在 Client 端访问接口 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/token
+http://{host}:{port}/oauth2/token
 	?grant_type=password
-	&client_id={value}
-	&client_secret={value}
-	&username={value}
-	&password={value}
+	&client_id={client_id}
+	&client_secret={client_secret}
+	&username={username}
+	&password={password}
+	&scope={scope}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明							|
 | :--------		| :--------	| :--------						|
-| grant_type	| 是		| 返回类型，这里请填写：password|
-| client_id		| 是		| 应用id						|
+| grant_type	| 是		| 返回类型，这里请填写：`password`|
+| client_id		| 是		| 应用 id						|
 | client_secret	| 是		| 应用秘钥												|
-| username		| 是		| 用户的Server端账号			|
-| password		| 是		| 用户的Server端密码			|
-| scope			| 否		| 具体请求的权限，多个用逗号隔开						|
+| username		| 是		| 用户的 `OAuth2-Server` 端账号			|
+| password		| 是		| 用户的 `OAuth2-Server` 端密码			|
+| scope			| 否		| 具体请求的权限，多个用逗号(或空格)隔开						|
 
 接口返回示例：
 
@@ -211,15 +216,12 @@ http://sa-oauth-server.com:8001/oauth2/token
 {
     "code": 200,	// 200表示请求成功，非200标识请求失败, 以下不再赘述 
     "msg": "ok",
-    "data": {
-        "access_token": "7Ngo1Igg6rieWwAmWMe4cxT7j8o46mjyuabuwLETuAoN6JpPzPO2i3PVpEVJ",     // Access-Token值
-        "refresh_token": "ZMG7QbuCVtCIn1FAJuDbgEjsoXt5Kqzii9zsPeyahAmoir893ARA4rbmeR66",    // Refresh-Token值
-        "expires_in": 7199,                 // Access-Token剩余有效期，单位秒  
-        "refresh_expires_in": 2591999,      // Refresh-Token剩余有效期，单位秒  
-        "client_id": "1001",                // 应用id
-        "scope": "",                        // 此令牌包含的权限
-        "openid": "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__"     // openid 
-    }
+	"access_token": "7Ngo1Igg6rieWwAmWMe4cxT7j8o46mjyuabuwLETuAoN6JpPzPO2i3PVpEVJ",     // Access-Token 值
+	"refresh_token": "ZMG7QbuCVtCIn1FAJuDbgEjsoXt5Kqzii9zsPeyahAmoir893ARA4rbmeR66",    // Refresh-Token 值
+	"expires_in": 7199,                 // Access-Token 剩余有效期，单位秒  
+	"refresh_expires_in": 2591999,      // Refresh-Token 剩余有效期，单位秒  
+	"client_id": "1001",                // 应用 id
+	"scope": "",                        // 此令牌包含的权限
 }
 ```
 
@@ -228,38 +230,37 @@ http://sa-oauth-server.com:8001/oauth2/token
 以上三种模式获取的都是用户的 `Access-Token`，代表用户对第三方应用的授权，
 在OAuth2.0中还有一种针对 Client级别的授权， 即：`Client-Token`，代表应用自身的资源授权
 
-在Client端的后台访问以下接口：
+在 Client 端的后台访问以下接口：
 
 ``` url
-http://sa-oauth-server.com:8001/oauth2/client_token
+http://{host}:{port}/oauth2/client_token
 	?grant_type=client_credentials
-	&client_id={value}
-	&client_secret={value}
+	&client_id={client_id}
+	&client_secret={client_secret}
+	&scope={scope}
 ```
 
 参数详解：
 
 | 参数			| 是否必填	| 说明									|
 | :--------		| :--------	| :--------								|
-| grant_type	| 是		| 返回类型，这里请填写：client_credentials|
-| client_id		| 是		| 应用id								|
+| grant_type	| 是		| 返回类型，这里请填写：`client_credentials`|
+| client_id		| 是		| 应用 id								|
 | client_secret	| 是		| 应用秘钥								|
-| scope			| 否		| 申请权限								|
+| scope			| 否		| 具体请求的权限，多个用逗号(或空格)隔开	|
 
 接口返回值样例：
 ``` js
 {
     "code": 200,
     "msg": "ok",
-    "data": {
-        "client_token": "HmzPtaNuIqGrOdudWLzKJRSfPadN497qEJtanYwE7ZvHQWDy0jeoZJuDIiqO",	// Client-Token 值
-        "expires_in": 7199,     // Token剩余有效时间，单位秒 
-        "client_id": "1001",    // 应用id
-        "scope": null           // 包含权限 
-    }
+	"client_token": "HmzPtaNuIqGrOdudWLzKJRSfPadN497qEJtanYwE7ZvHQWDy0jeoZJuDIiqO",	// Client-Token 值
+	"expires_in": 7199,     // Token剩余有效时间，单位秒 
+	"client_id": "1001",    // 应用 id
+	"scope": null           // 包含权限 
 }
 ```
 
 注：`Client-Token`具有延迟作废特性，即：在每次获取最新`Client-Token`的时候，旧`Client-Token`不会立即过期，而是作为`Past-Token`再次储存起来，
-资源请求方只要携带其中之一便可通过Token校验，这种特性保证了在大量并发请求时不会出现“新旧Token交替造成的授权失效”， 保证了服务的高可用
+资源请求方只要携带其中之一便可通过Token校验，这种特性保证了在大量并发请求时不会出现“新旧Token交替造成的授权失效”， 保证了服务的高可用。
 
diff --git a/sa-token-doc/oauth2/oauth2-check-domain.md b/sa-token-doc/oauth2/oauth2-check-domain.md
new file mode 100644
index 00000000..f1cca9e3
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-check-domain.md
@@ -0,0 +1,93 @@
+# OAuth2 整合-配置域名校验
+
+--- 
+
+### 1、code 劫持攻击
+在前面章节的 OAuth-Server 搭建示例中：
+
+``` java
+@Component
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
+	// 根据 clientId 获取 Client 信息
+	@Override
+	public SaClientModel getClientModel(String clientId) {
+		if("1001".equals(clientId)) {
+			return new SaClientModel()
+					// ...
+					.addAllowUrls("*")    // 所有允许授权的 url
+					// ...
+		}
+		return null;
+	}
+	// 其它代码 ... 
+}
+```
+
+配置项 `AllowUrls` 意为配置此 `Client` 端所有允许的授权地址，不在此配置项中的 URL 将无法下发 `code` 授权码。
+
+为了方便测试，上述代码将其配置为`*`，但是，<font color="#FF0000" >在生产环境中，此配置项绝对不能配置为 * </font>，否则会有被 `code` 劫持的风险。
+
+假设攻击者根据模仿我们的授权地址，巧妙的构造一个URL：
+
+> [http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=https://www.baidu.com](http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=https://www.baidu.com)
+
+当不知情的小红被诱导访问了这个 URL 时，它将被重定向至百度首页。
+
+![oauth2-ticket-jc](https://oss.dev33.cn/sa-token/doc/oauth2-new/oauth2-ticket-jc.png 's-w-sh')
+
+可以看到，代表着用户身份的 code 授权码也显现到了URL之中，借此漏洞，攻击者完全可以构建一个 URL 将小红的 code 授权码自动提交到攻击者自己的服务器，伪造小红身份登录网站。
+
+
+### 2、防范方法
+
+造成此漏洞的直接原因就是我们对此 client 配置了过于宽泛的 `AllowUrls` 允许授权地址，防范的方法也很简单，就是缩小 `AllowUrls` 授权范围。
+
+我们将其配置为一个具体的URL：
+
+``` java
+@Component
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
+	// 根据 clientId 获取 Client 信息
+	@Override
+	public SaClientModel getClientModel(String clientId) {
+		if("1001".equals(clientId)) {
+			return new SaClientModel()
+					// ...
+					.addAllowUrls("http://sa-oauth-client.com:8002/")    // 所有允许授权的 url
+					// ...
+		}
+		return null;
+	}
+	// 其它代码 ... 
+}
+```
+
+再次访问上述链接：
+
+![oauth2-feifa-rf](https://oss.dev33.cn/sa-token/doc/oauth2-new/oauth2-feifa-rf.png 's-w-sh')
+
+域名没有通过校验，拒绝授权！
+
+
+### 3、配置安全性参考表
+
+| 配置方式		| 举例											| 安全性								|  建议									|
+| :--------		| :--------										| :--------							| :--------								|
+| 配置为*		| `*`											| <font color="#F00" >低</font>		| **<font color="#F00" >禁止在生产环境下使用</font>**	|
+| 配置到域名		| `http://sa-oauth-client.com:8002/*`			| <font color="#F70" >中</font>		| <font color="#F70" >不建议在生产环境下使用</font>	|
+| 配置到详细地址	| `http://sa-oauth-client.com:8002/xxx/xxx`		| <font color="#080" >高</font>		| <font color="#080" >可以在生产环境下使用</font>	|
+
+
+### 4、其它规则
+
+1、AllowUrls 配置的地址不允许出现 `@` 字符。
+*详见源码：[SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
+`checkRightUrl` 方法。*
+
+2、AllowUrls 配置的地址 `*` 通配符只允许出现在字符串末尾，不允许出现在字符串中间位置。
+*详见源码： [SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
+`checkAllowUrlListStaticMethod` 方法。*
+
+参考：[github/issue/529](https://github.com/dromara/Sa-Token/issues/529)
+感谢这位 `@m4ra7h0n` 用户反馈的漏洞。
+
diff --git a/sa-token-doc/oauth2/oauth2-custom-login.md b/sa-token-doc/oauth2/oauth2-custom-login.md
new file mode 100644
index 00000000..25cb0bb1
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-custom-login.md
@@ -0,0 +1,94 @@
+# OAuth2 定制化登录页面
+
+---
+
+
+
+### 1、如何自定义 OAuth-Server 端的登录视图？
+
+重写 `cfg.notLoginView` 策略：
+
+``` java
+@Autowired
+public void configOAuth2Server(SaOAuth2Config cfg) {
+	// 配置：未登录时返回的View 
+	cfg.notLoginView = ()->{
+		return new ModelAndView("xxx.html");
+	};
+}
+```
+
+在以上返回的视图中 ajax 方式调用 `/oauth2/doLogin` 接口，该接口接受以下参数：
+
+| 参数			| 是否必填	| 说明									|
+| :--------		| :--------	| :--------								|
+| name			| 否		| 账号									|
+| pwd			| 否		| 密码									|
+
+接口返回值根据你重写的 `cfg.doLoginHandle` 策略进行自由决定。
+
+
+
+### 2、如何自定义登录API的接口地址？
+根据需求点选择解决方案：
+
+#### 2.1、如果只是想在 doLoginHandle 函数里获取除 name、pwd 以外的参数？
+``` java
+// 在任意代码处获取前端提交的参数 
+String xxx = SaHolder.getRequest().getParam("xxx");
+```
+
+#### 2.2、想完全自定义一个接口来接受前端登录请求？
+``` java
+// 直接定义一个拦截路由为 `/oauth2/doLogin` 的接口即可 
+@RequestMapping("/oauth2/doLogin")
+public SaResult ss(String name, String pwd) {
+	System.out.println("------ 请求进入了自定义的API接口 ---------- ");
+	if("sa".equals(name) && "123456".equals(pwd)) {
+		StpUtil.login(10001);
+		return SaResult.ok("登录成功！");
+	}
+	return SaResult.error("登录失败！");
+}
+```
+
+#### 2.3、不想使用`/oauth2/doLogin`这个接口，想自定义一个API地址？
+
+答：直接在前端更改点击按钮时 Ajax 的请求地址即可 
+
+
+
+### 3、如何自定义 OAuth-Server 端的确认授权视图？
+
+重写 `cfg.confirmView` 策略：
+
+``` java
+@Autowired
+public void configOAuth2Server(SaOAuth2Config cfg) {
+	// 配置：授权确认视图 
+	cfg.confirmView = (clientId, scopes)->{
+		Map<String, Object> map = new HashMap<>();
+		map.put("clientId", clientId);
+		map.put("scope", scopes);
+		return new ModelAndView("confirm.html", map);
+	};
+}
+```
+
+在以上返回的视图中 ajax 方式调用 `/oauth2/doConfirm` 接口，即可完成授权，该接口接受以下参数：
+
+| 参数			| 是否必填	| 说明									|
+| :--------		| :--------	| :--------								|
+| client_id		| 是		| 应用 id								|
+| scope			| 是		| 具体授予的权限，多个用逗号(或空格)隔开	|
+
+接口返回值样例：
+``` js
+{
+    "code": 200,
+    "msg": "ok",
+    "data": null,
+}
+```
+
+
diff --git a/sa-token-doc/oauth2/oauth2-server.md b/sa-token-doc/oauth2/oauth2-server.md
index 9f2b631f..ad4a1724 100644
--- a/sa-token-doc/oauth2/oauth2-server.md
+++ b/sa-token-doc/oauth2/oauth2-server.md
@@ -11,7 +11,7 @@
 
 
 ### 2、引入依赖 
-创建SpringBoot项目 `sa-token-demo-oauth2-server`（不会的同学自行百度或参考仓库示例），添加pom依赖：
+创建SpringBoot项目 `sa-token-demo-oauth2-server`（不会的同学自行百度或参考仓库示例），引入 `pom.xml` 依赖：
 
 <!---------------------------- tabs:start ---------------------------->
 <!-------- tab:Maven 方式 -------->
@@ -43,36 +43,37 @@ implementation 'cn.dev33:sa-token-oauth2:${sa.top.version}'
 
 
 ### 3、开放服务 
-1、新建 `SaOAuth2TemplateImpl` 
+1、自定义数据加载器：新建 `SaOAuth2DataLoaderImpl` 实现 `SaOAuth2DataLoader` 接口。
+
 ``` java
 /**
- * Sa-Token OAuth2.0 整合实现 
+ * Sa-Token OAuth2：自定义数据加载器
  */
 @Component
-public class SaOAuth2TemplateImpl extends SaOAuth2Template {
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	
-	// 根据 id 获取 Client 信息 
+	// 根据 clientId 获取 Client 信息
 	@Override
 	public SaClientModel getClientModel(String clientId) {
 		// 此为模拟数据，真实环境需要从数据库查询 
 		if("1001".equals(clientId)) {
 			return new SaClientModel()
-					.setClientId("1001")
-					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")
-					.setAllowUrl("*")
-					.setContractScope("userinfo")
-					.setIsAutoMode(true);
+					.setClientId("1001")    // client id
+					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
+					.addAllowUrls("*")    // 所有允许授权的 url
+					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+					.setIsAutoMode(true);    // 是否自动判断开放的授权模式 
 		}
 		return null;
 	}
 	
-	// 根据ClientId 和 LoginId 获取openid 
+	// 根据 clientId 和 loginId 获取 openid
 	@Override
 	public String getOpenid(String clientId, Object loginId) {
-		// 此为模拟数据，真实环境需要从数据库查询 
-		return "gr_SwoIN0MC1ewxHX_vfCW3BothWDZMMtx__";
+		// 此处使用框架默认算法生成 openid，真实环境建议改为从数据库查询
+		return SaOAuth2DataLoader.super.getOpenid(clientId, loginId);
 	}
-	
+
 }
 ```
 
@@ -97,30 +98,32 @@ public class SaOAuth2ServerController {
 	// Sa-OAuth2 定制化配置 
 	@Autowired
 	public void setSaOAuth2Config(SaOAuth2Config cfg) {
-		cfg.
-			// 配置：未登录时返回的View 
-			setNotLoginView(() -> {
-				String msg = "当前会话在OAuth-Server端尚未登录，请先访问"
-	                        + "<a href='/oauth2/doLogin?name=sa&pwd=123456' target='_blank'> doLogin登录 </a>"
-	                        + "进行登录之后，刷新页面开始授权";
-	            return msg;
-			}).
-			// 配置：登录处理函数 
-			setDoLoginHandle((name, pwd) -> {
-				if("sa".equals(name) && "123456".equals(pwd)) {
-					StpUtil.login(10001);
-					return SaResult.ok();
-				}
-				return SaResult.error("账号名或密码错误");
-			}).
-			// 配置：确认授权时返回的View 
-			setConfirmView((clientId, scope) -> {
-				String msg = "<p>应用 " + clientId + " 请求授权：" + scope + "</p>"
-                        + "<p>请确认：<a href='/oauth2/doConfirm?client_id=" + clientId + "&scope=" + scope + "' target='_blank'> 确认授权 </a></p>"
-                        + "<p>确认之后刷新页面</p>";
-				return msg;
-			})
-			;
+		
+		// 配置：未登录时返回的View 
+		cfg.notLoginView = () -> {
+			String msg = "当前会话在OAuth-Server端尚未登录，请先访问"
+						+ "<a href='/oauth2/doLogin?name=sa&pwd=123456' target='_blank'> doLogin登录 </a>"
+						+ "进行登录之后，刷新页面开始授权";
+			return msg;
+		};
+		
+		// 配置：登录处理函数 
+		cfg.doLoginHandle = (name, pwd) -> {
+			if("sa".equals(name) && "123456".equals(pwd)) {
+				StpUtil.login(10001);
+				return SaResult.ok();
+			}
+			return SaResult.error("账号名或密码错误");
+		};
+		
+		// 配置：确认授权时返回的 view 
+		cfg.confirmView = (clientId, scopes) -> {
+			String scopeStr = SaFoxUtil.convertListToString(scopes);
+			String msg = "<p>应用 " + clientId + " 请求授权：" + scopeStr + "</p>"
+					+ "<p>请确认：<a href='/oauth2/doConfirm?client_id=" + clientId + "&scope=" + scopeStr + "' target='_blank'> 确认授权 </a></p>"
+					+ "<p>确认之后刷新页面</p>";
+			return msg;
+		};
 	}
 
 	// 全局异常拦截  
@@ -134,7 +137,19 @@ public class SaOAuth2ServerController {
 ```
 注意：在`setDoLoginHandle`函数里如果要获取name, pwd以外的参数，可通过`SaHolder.getRequest().getParam("xxx")`来获取 
 
-3、创建启动类：
+3、全局异常处理
+``` java
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+	@ExceptionHandler
+	public SaResult handlerException(Exception e) {
+		e.printStackTrace(); 
+		return SaResult.error(e.getMessage());
+	}
+}
+```
+
+4、创建启动类：
 ``` java
 /**
  * 启动：Sa-OAuth2 Server端 
@@ -154,28 +169,44 @@ public class SaOAuth2ServerApplication {
 
 1、由于暂未搭建Client端，我们可以使用Sa-Token官网作为重定向URL进行测试：
 ``` url
-http://sa-oauth-server.com:8001/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=https://sa-token.cc&scope=userinfo
+http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=https://sa-token.cc&scope=openid
 ```
 
 2、由于首次访问，我们在OAuth-Server端暂未登录，会被转发到登录视图 
 
-![sa-oauth2-server-login-view](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-server-login-view.png 's-w-sh')
+![sa-oauth2-server-login-view](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-server-login-view.png 's-w-sh')
 
 3、点击doLogin进行登录之后刷新页面，会提示我们确认授权
-![sa-oauth2-server-login-view](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-server-scope.png 's-w-sh')
+![sa-oauth2-server-scope](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-server-scope.png 's-w-sh')
 
 4、点击确认授权之后刷新页面，我们会被重定向至 redirect_uri 页面，并携带了code参数 
 
-![sa-oauth2-server-code](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-server-code.png 's-w-sh')
+![sa-oauth2-server-code](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-server-code.png 's-w-sh')
 
 4、我们拿着code参数，访问以下地址：
 ``` url
-http://sa-oauth-server.com:8001/oauth2/token?grant_type=authorization_code&client_id=1001&client_secret=aaaa-bbbb-cccc-dddd-eeee&code={code}
+http://sa-oauth-server.com:8000/oauth2/token?grant_type=authorization_code&client_id=1001&client_secret=aaaa-bbbb-cccc-dddd-eeee&code={code}
 ```
 
 将得到 `Access-Token`、`Refresh-Token`、`openid`等授权信息 
 
-![sa-oauth2-server-token](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-server-token.png 's-w-sh')
+``` js
+{
+  "code": 200,
+  "msg": "ok",
+  "data": null,
+  "token_type": "bearer",
+  "access_token": "cAls8jnBLmeo5yuCUMwb8zxaSsQPPzGINXF3NOCjCqFHplr6hagdT6A5HeR2",
+  "refresh_token": "L2rPbJ3aaOXwaB4Zu0EGWNz5EjVNpw5u2oMP9CS2IEap7rR3Hb76ZqqHS07J",
+  "expires_in": 7199,
+  "refresh_expires_in": 2591999,
+  "client_id": "1001",
+  "scope": "openid",
+  "openid": "ded91dc189a437dd1bac2274be167d50"
+}
+```
+
+<!-- ![sa-oauth2-server-token](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-server-token.png 's-w-sh') -->
 
 测试完毕
 
@@ -188,7 +219,7 @@ http://sa-oauth-server.com:8001/oauth2/token?grant_type=authorization_code&clien
 
 依次启动`OAuth2-Server` 与 `OAuth2-Client`，然后从浏览器访问：[http://sa-oauth-client.com:8002](http://sa-oauth-client.com:8002)
 
-![sa-oauth2-client-index](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-client-index.png 's-w-sh')
+![sa-oauth2-client-index](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-client-index.png 's-w-sh')
 
 如图，可以针对OAuth2.0四种模式进行详细测试 
 
diff --git a/sa-token-doc/oauth2/readme.md b/sa-token-doc/oauth2/readme.md
index 59d9e4b0..5776fb42 100644
--- a/sa-token-doc/oauth2/readme.md
+++ b/sa-token-doc/oauth2/readme.md
@@ -2,12 +2,12 @@
 
 --- 
 
-### 什么是OAuth2.0？解决什么问题？
+### 什么是 OAuth2.0 ？解决什么问题？
 
-简单来讲，OAuth2.0的应用场景可以理解为单点登录的升级版，单点登录解决了多个系统间会话的共享，OAuth2.0在此基础上增加了应用之间的权限控制
-（SO：有些系统采用OAuth2.0模式实现了单点登录，但这总给人一种“杀鸡焉用宰牛刀”的感觉）
+简单来讲，OAuth2.0的应用场景可以理解为单点登录的升级版，单点登录解决了多个系统间会话的共享，OAuth2.0 在此基础上增加了应用之间的权限控制
+（SO：有些系统采用 OAuth2.0 模式实现了单点登录，但这总给人一种 “杀鸡焉用宰牛刀” 的感觉）
 
-有关OAuth2.0的设计思想网上教程较多，此处不再重复赘述，详细可参考博客：
+有关 OAuth2.0 的设计思想网上教程较多，此处不再重复赘述，详细可参考博客：
 [OAuth2.0 简单解释](https://www.ruanyifeng.com/blog/2019/04/oauth_design.html)
 <!-- 、[OAuth2.0 的四种方式](http://www.ruanyifeng.com/blog/2019/04/oauth-grant-types.html) -->
 
@@ -19,14 +19,40 @@
 
 基于不同的使用场景，OAuth2.0设计了四种模式：
 
-1. 授权码（Authorization Code）：OAuth2.0标准授权步骤，Server端向Client端下放Code码，Client端再用Code码换取授权Token
-2. 隐藏式（Implicit）：无法使用授权码模式时的备用选择，Server端使用URL重定向方式直接将Token下放到Client端页面
-3. 密码式（Password）：Client直接拿着用户的账号密码换取授权Token
-4. 客户端凭证（Client Credentials）：Server端针对Client级别的Token，代表应用自身的资源授权
+1. 授权码（Authorization Code）：OAuth2.0 标准授权步骤，Server 端向 Client 端下放 `Code` 码，Client 端再用 `Code` 码换取授权 `Access-Token`。
+2. 隐藏式（Implicit）：无法使用授权码模式时的备用选择，Server 端使用 URL 重定向方式直接将 `Access-Token` 下放到 Client 端页面。
+3. 密码式（Password）：Client 端直接拿着用户的账号密码换取授权 `Access-Token`。
+4. 客户端凭证（Client Credentials）：Server 端针对 Client 级别的 Token，代表应用自身的资源授权。
 
 ![https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-setup.png](https://oss.dev33.cn/sa-token/doc/oauth2/sa-oauth2-setup.png)
 
-接下来我们将通过简单示例演示如何在 Sa-OAuth2 中完成这四种模式的对接: [搭建OAuth2-Server](/oauth2/oauth2-server)
-
+接下来我们将通过简单示例演示如何在 Sa-Token-OAuth2 中完成这四种模式的对接: [搭建OAuth2-Server](/oauth2/oauth2-server)
+
+
+### OAuth2.0 第三方开放平台完整开发流程参考
+
+1. oauth2-server 平台端 
+	1. 搭建 oauth2-server 数据后台管理端（后台人员对底层数据增删改查维护的地方）。
+	2. 搭建 oauth2-server 数据前台申请端（给第三方公司提供一个申请注册 client 的地方）。
+	3. 搭建 oauth2-server 授权端 以及其接口文档（让第三方公司拿到 access_token）。
+	4. 搭建 oauth2-server 资源端 以及其接口文档（让第三方公司通过 access_token 拿到对应的资源数据）。
+	5. 以上四端可以为一个项目，也可以为四个独立的项目。
+
+2. oauth2-client 第三方公司端
+	1. 第三方公司登录 oauth-server 数据前台申请端，申请注册应用，拿到 `clientId`、`clientSecret` 等数据。
+	2. 在自己系统通过 `clientId`、`clientSecret` 等参数对接 oauth2-server 授权端，拿到 `access_token`。
+	3. 通过 `access_token` 调用 oauth2-server 资源端接口，拿到对应资源数据。
+
+3. 用户端操作
+	1. 打开第三方公司开发的网站或APP等程序。
+	2. 一般有个“通过xx第三方登录”的按钮，点它。
+	3. 跳转到了 oauth2-server 端的网站，在此网站用 oauth2-server 的账号开始登录。
+	4. 登录完成，继续跳转到授权页，点击确认授权。
+	5. 授权完成，oauth2-server 端生成一个 code 码，重定向回 oauth2-client 的网站，把 code 参数挂到对应的 url 上。
+	6. oauth2-client 从 url 中读取 code 参数，提交到 oauth2-client 的后端。
+	7. oauth2-client 后端拿着 `code`、`clientId`、`clientSecret` 等信息调用 oauth2-server 授权端 的接口，得到 `access_token`。
+	8. 继续拿着 `access_token` 调用 oauth2-server 资源端获取此用户对应的数据。
+	9. 一般最终目的拿到一个 openid 值，oauth2-client 根据 openid 进行登录。生成自己的会话 token ，返回到数据到前端。
+	10. 前端拿到自己 oauth2-client 生成的会话 token ，完成登录。开始进行业务操作。
 
 
diff --git a/sa-token-doc/sso/sso-apidoc.md b/sa-token-doc/sso/sso-apidoc.md
index 53d47ef4..093a6e4f 100644
--- a/sa-token-doc/sso/sso-apidoc.md
+++ b/sa-token-doc/sso/sso-apidoc.md
@@ -28,6 +28,11 @@ http://{host}:{port}/sso/auth
 - 情况一：当前会话在 SSO 认证中心未登录，会进入登录页开始登录。
 - 情况二：当前会话在 SSO 认证中心已登录，会被重定向至 `redirect` 地址，并携带 `ticket` 参数。
 
+`ticket` 码具有以下特点：
+1. 每次授权产生的 `ticket` 码都不一样。
+2. `ticket` 码用完即废，不能二次使用。
+3. 一个 `ticket` 的有效期默认为五分钟，超时自动作废。
+4. 每次授权产生新 `ticket` 码，会导致旧 `ticket` 码立即作废，即使旧 `ticket` 码尚未使用。
 
 ### 2、RestAPI 登录接口
 ``` url
diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index 0e80c9cb..89a97a97 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -297,9 +297,9 @@ sa-token.sso-client.is-slo=true
 | 参数名称				| 类型		| 默认值	| 说明																		|
 | :--------				| :--------	| :--------	| :--------																	|
 | isCode				| Boolean	| true		| 是否打开模式：授权码（`Authorization Code`）								|
-| isImplicit			| Boolean	| false		| 是否打开模式：隐藏式（`Implicit`）											|
-| isPassword			| Boolean	| false		| 是否打开模式：密码式（`Password`）											|
-| isClient				| Boolean	| false		| 是否打开模式：凭证式（`Client Credentials`）								|
+| isImplicit			| Boolean	| true		| 是否打开模式：隐藏式（`Implicit`）											|
+| isPassword			| Boolean	| true		| 是否打开模式：密码式（`Password`）											|
+| isClient				| Boolean	| true		| 是否打开模式：凭证式（`Client Credentials`）								|
 | isNewRefresh			| Boolean	| false		| 是否在每次 `Refresh-Token` 刷新 `Access-Token` 时，产生一个新的 Refresh-Token	|
 | codeTimeout			| long		| 300		| Code授权码 保存的时间（单位：秒） 默认五分钟									|
 | accessTokenTimeout	| long		| 7200		| `Access-Token` 保存的时间（单位：秒）默认两个小时								|
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index a88b6b7a..7c6f5ff6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -19,14 +19,18 @@ import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
-import cn.dev33.satoken.oauth2.data.model.*;
-import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.CodeModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
+import java.util.LinkedHashMap;
 import java.util.List;
 
 /**
@@ -211,6 +215,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         String clientTokenValue = SaOAuth2Strategy.instance.createClientToken.execute(clientId, scopes);
         ClientTokenModel ct = new ClientTokenModel(clientTokenValue, clientId, scopes);
         ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
+        ct.extraData = new LinkedHashMap<>();
         SaOAuth2Strategy.instance.workClientTokenByScope.accept(ct);
 
         // 3、保存新Client-Token
-- 
Gitee


From 174a94db01c4d1cb84ffff4e0e507414f5f321a8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 19 Aug 2024 23:29:05 +0800
Subject: [PATCH 138/172] =?UTF-8?q?=E5=AE=8C=E6=95=B4=E9=80=82=E9=85=8D?=
 =?UTF-8?q?=E6=8B=86=E5=88=86=E5=BC=8F=E8=B7=AF=E7=94=B1=E5=86=99=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/pj/SaOAuth2ServerApplication.java     |   4 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |   6 +-
 .../pj/oauth2/SaOAuth2ServerController.java   |  16 +-
 .../src/main/resources/application.yml        |  20 ++-
 sa-token-doc/_sidebar.md                      |   2 +-
 sa-token-doc/oauth2/oauth2-custom-api.md      | 104 ++++++++++++
 .../satoken/oauth2/config/SaOAuth2Config.java |  63 +++----
 .../SaOAuth2DataConverterDefaultImpl.java     |   4 +-
 .../SaOAuth2DataGenerateDefaultImpl.java      |  12 +-
 .../data/model/loader/SaClientModel.java      | 104 ++++++------
 .../SaOAuth2DataResolverDefaultImpl.java      |   2 +-
 .../oauth2/error/SaOAuth2ErrorCode.java       |   3 +
 .../processor/SaOAuth2ServerProcessor.java    | 155 ++++++++++++------
 13 files changed, 335 insertions(+), 160 deletions(-)
 create mode 100644 sa-token-doc/oauth2/oauth2-custom-api.md

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
index 4accb81c..4cf9200b 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
@@ -1,5 +1,6 @@
 package com.pj;
 
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
@@ -12,7 +13,8 @@ public class SaOAuth2ServerApplication {
 
 	public static void main(String[] args) {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
-		System.out.println("\nSa-Token-OAuth Server端启动成功");
+		System.out.println("\nSa-Token-OAuth Server端启动成功，配置如下：");
+		System.out.println(SaOAuth2Manager.getConfig());
 	}
 	
 }
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index 72948364..a7d10925 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -22,7 +22,11 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
 					.addAllowUrls("*")    // 所有允许授权的 url
 					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
-					.setIsAutoMode(true);    // 是否自动判断开放的授权模式
+					.setEnableCode(true)    	// 是否开启授权码模式
+					.setEnableImplicit(true)    // 是否开启隐式模式
+					.setEnablePassword(true)    // 是否开启密码模式
+					.setEnableClient(true)    	// 是否开启客户端模式
+			;
 		}
 		return null;
 	}
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 44ddce9d..594b8126 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -7,7 +7,6 @@ import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
@@ -17,20 +16,20 @@ import java.util.LinkedHashMap;
 import java.util.Map;
 
 /**
- * Sa-OAuth2 Server端 控制器
+ * Sa-Token-OAuth2 Server端 Controller
+ *
  * @author click33
- * 
  */
 @RestController
 public class SaOAuth2ServerController {
 
-	// 处理所有OAuth相关请求 
+	// OAuth2-Server 端：处理所有OAuth相关请求
 	@RequestMapping("/oauth2/*")
 	public Object request() {
 		System.out.println("------- 进入请求: " + SaHolder.getRequest().getUrl());
 		return SaOAuth2ServerProcessor.instance.dister();
 	}
-	
+
 	// Sa-OAuth2 定制化配置 
 	@Autowired
 	public void configOAuth2Server(SaOAuth2Config cfg) {
@@ -57,13 +56,6 @@ public class SaOAuth2ServerController {
 		};
 	}
 
-	// 全局异常拦截  
-	@ExceptionHandler
-	public SaResult handlerException(Exception e) {
-		e.printStackTrace(); 
-		return SaResult.error(e.getMessage());
-	}
-	
 	
 	// ---------- 开放相关资源接口： Client端根据 Access-Token ，置换相关资源 ------------ 
 	
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index 0d263504..44f39cd0 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -3,15 +3,19 @@ server:
 
 # sa-token配置
 sa-token: 
-    # token名称 (同时也是cookie名称)
-    token-name: satoken-server
+    # token名称 (同时也是 Cookie 名称)
+    token-name: satoken-oauth2-server
     # OAuth2.0 配置 
-    oauth2: 
-        is-code: true
-        is-implicit: true
-        is-password: true
-        is-client: true
-    
+    oauth2:
+        # 是否全局开启授权码模式
+        enable-code: true
+        # 是否全局开启 Implicit 模式
+        enable-implicit: true
+        # 是否全局开启密码模式
+        enable-password: true
+        # 是否全局开启客户端模式
+        enable-client: true
+
 spring: 
     # redis配置 
     redis:
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index e15f364c..432eb727 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -57,7 +57,7 @@
 	- [OAuth2-Server端开放 API 接口](/oauth2/oauth2-apidoc)
 	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
 	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
-	- [拆分式路由](/oauth2/3)
+	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
 	- [前后端分离模式整合方案](/oauth2/4)
 	- [平台中心模式开发](/oauth2/5)
 	- [自定义 Scope 权限以处理器](/oauth2/6)
diff --git a/sa-token-doc/oauth2/oauth2-custom-api.md b/sa-token-doc/oauth2/oauth2-custom-api.md
new file mode 100644
index 00000000..a398c37d
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-custom-api.md
@@ -0,0 +1,104 @@
+# OAuth2-自定义 API 路由 
+
+---
+
+### 方式一：修改全局变量
+
+在之前的章节中，我们演示了如何搭建一个 OAuth2 认证中心：
+``` java
+/**
+ * Sa-Token-OAuth2 Server端 Controller 
+ */
+@RestController
+public class SaOAuth2ServerController {
+
+	// OAuth2-Server 端：处理所有 OAuth 相关请求 
+	@RequestMapping("/oauth2/*")
+	public Object request() {
+		return SaOAuth2ServerProcessor.instance.dister();
+	}
+	
+	// ... 其它代码
+	
+}
+```
+
+这种写法集成简单但却不够灵活。例如获取 code 授权码地址只能是：`http://{host}:{port}/oauth2/authorize`，如果我们想要自定义其API地址，应该怎么做呢？
+
+打开 OAuth2 模块相关源码，有关 API 的设计都定义在：
+[SaOAuth2Consts.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java)
+中，我们可以对其进行二次修改。
+
+例如，我们可以在 Main 方法启动类或者 OAuth2 配置方法中修改变量值：
+``` java
+// 配置 OAuth2 相关参数 
+@Autowired
+private void configOAuth2Server(SaOAuth2Config cfg) {
+	// 自定义API地址
+	SaOAuth2Consts.Api.authorize = "/oauth2/authorize2";
+	// ... 
+}
+```
+
+启动项目，统一认证地址就被我们修改成了：`http://{host}:{port}/oauth2/authorize2`
+
+
+### 方式二：拆分路由入口
+根据上述路由入口：`@RequestMapping("/oauth2/*")`，我们给它起一个合适的名字 —— 聚合式路由。
+
+与之对应的，我们可以将其修改为拆分式路由：
+
+``` java
+/**
+ * Sa-Token-OAuth2 Server端 Controller 
+ */
+@RestController
+public class SaOAuth2ServerController {
+
+	// 模式一：Code授权码 || 模式二：隐藏式
+	@RequestMapping("/oauth2/authorize")
+	public Object authorize() {
+		return SaOAuth2ServerProcessor.instance.authorize();
+	}
+
+	// 用户登录
+	@RequestMapping("/oauth2/doLogin")
+	public Object doLogin() {
+		return SaOAuth2ServerProcessor.instance.doLogin();
+	}
+
+	// 用户确认授权
+	@RequestMapping("/oauth2/doConfirm")
+	public Object doConfirm() {
+		return SaOAuth2ServerProcessor.instance.doConfirm();
+	}
+
+	// Code 换 Access-Token || 模式三：密码式
+	@RequestMapping("/oauth2/token")
+	public Object token() {
+		return SaOAuth2ServerProcessor.instance.tokenOrPassword();
+	}
+
+	// Refresh-Token 刷新 Access-Token
+	@RequestMapping("/oauth2/refresh")
+	public Object refresh() {
+		return SaOAuth2ServerProcessor.instance.refresh();
+	}
+
+	// 回收 Access-Token
+	@RequestMapping("/oauth2/revoke")
+	public Object revoke() {
+		return SaOAuth2ServerProcessor.instance.revoke();
+	}
+
+	// 模式四：凭证式
+	@RequestMapping("/oauth2/client_token")
+	public Object clientToken() {
+		return SaOAuth2ServerProcessor.instance.clientToken();
+	}
+
+}
+```
+
+拆分式路由 与 聚合式路由 在功能上完全等价，且提供了更为细致的路由管控。
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
index 3114e650..41cab136 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
@@ -34,16 +34,16 @@ public class SaOAuth2Config implements Serializable {
 	private static final long serialVersionUID = -6541180061782004705L;
 
 	/** 是否打开模式：授权码（Authorization Code） */
-	public Boolean isCode = true;
+	public Boolean enableCode = true;
 
 	/** 是否打开模式：隐藏式（Implicit） */
-	public Boolean isImplicit = true;
+	public Boolean enableImplicit = true;
 
 	/** 是否打开模式：密码式（Password） */
-	public Boolean isPassword = true;
+	public Boolean enablePassword = true;
 
 	/** 是否打开模式：凭证式（Client Credentials） */
-	public Boolean isClient = true;
+	public Boolean enableClient = true;
 
 	/** 是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token */
 	public Boolean isNewRefresh = false;
@@ -69,59 +69,59 @@ public class SaOAuth2Config implements Serializable {
 
 
 	/**
-	 * @return isCode
+	 * @return enableCode
 	 */
-	public Boolean getIsCode() {
-		return isCode;
+	public Boolean getEnableCode() {
+		return enableCode;
 	}
 
 	/**
-	 * @param isCode 要设置的 isCode
+	 * @param enableCode 要设置的 enableCode
 	 */
-	public void setIsCode(Boolean isCode) {
-		this.isCode = isCode;
+	public void setEnableCode(Boolean enableCode) {
+		this.enableCode = enableCode;
 	}
 
 	/**
-	 * @return isImplicit
+	 * @return enableImplicit
 	 */
-	public Boolean getIsImplicit() {
-		return isImplicit;
+	public Boolean getEnableImplicit() {
+		return enableImplicit;
 	}
 
 	/**
-	 * @param isImplicit 要设置的 isImplicit
+	 * @param enableImplicit 要设置的 enableImplicit
 	 */
-	public void setIsImplicit(Boolean isImplicit) {
-		this.isImplicit = isImplicit;
+	public void setEnableImplicit(Boolean enableImplicit) {
+		this.enableImplicit = enableImplicit;
 	}
 
 	/**
-	 * @return isPassword
+	 * @return enablePassword
 	 */
-	public Boolean getIsPassword() {
-		return isPassword;
+	public Boolean getEnablePassword() {
+		return enablePassword;
 	}
 
 	/**
-	 * @param isPassword 要设置的 isPassword
+	 * @param enablePassword 要设置的 enablePassword
 	 */
-	public void setIsPassword(Boolean isPassword) {
-		this.isPassword = isPassword;
+	public void setEnablePassword(Boolean enablePassword) {
+		this.enablePassword = enablePassword;
 	}
 
 	/**
-	 * @return isClient
+	 * @return enableClient
 	 */
-	public Boolean getIsClient() {
-		return isClient;
+	public Boolean getEnableClient() {
+		return enableClient;
 	}
 
 	/**
-	 * @param isClient 要设置的 isClient
+	 * @param enableClient 要设置的 enableClient
 	 */
-	public void setIsClient(Boolean isClient) {
-		this.isClient = isClient;
+	public void setEnableClient(Boolean enableClient) {
+		this.enableClient = enableClient;
 	}
 
 	/**
@@ -254,8 +254,11 @@ public class SaOAuth2Config implements Serializable {
 
 	@Override
 	public String toString() {
-		return "SaOAuth2Config [isCode=" + isCode + ", isImplicit=" + isImplicit + ", isPassword=" + isPassword
-				+ ", isClient=" + isClient
+		return "SaOAuth2Config [" +
+				"enableCode=" + enableCode
+				+ ", enableImplicit=" + enableImplicit
+				+ ", enablePassword=" + enablePassword
+				+ ", enableClient=" + enableClient
 				+ ", isNewRefresh=" + isNewRefresh
 				+ ", codeTimeout=" + codeTimeout
 				+ ", accessTokenTimeout=" + accessTokenTimeout
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 37ec58b3..5212fc43 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -100,8 +100,8 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         rt.expiresTime = System.currentTimeMillis() + (clientModel.getRefreshTokenTimeout() * 1000);
         rt.extraData = new LinkedHashMap<>(at.extraData);
         // 改变 at 属性
-        at.refreshToken = rt.refreshToken;
-        at.refreshExpiresTime = rt.expiresTime;
+//        at.refreshToken = rt.refreshToken;
+//        at.refreshExpiresTime = rt.expiresTime;
         return rt;
     }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 7c6f5ff6..1ff51e79 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -87,10 +87,10 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
 
         // 3、生成token
         AccessTokenModel at = dataConverter.convertCodeToAccessToken(cm);
+        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
         RefreshTokenModel rt = dataConverter.convertAccessTokenToRefreshToken(at);
         at.refreshToken = rt.refreshToken;
         at.refreshExpiresTime = rt.expiresTime;
-        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
 
         // 4、保存token
         dao.saveAccessToken(at);
@@ -166,14 +166,20 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         // 2、生成 新Access-Token
         String newAtValue = SaOAuth2Strategy.instance.createAccessToken.execute(ra.clientId, ra.loginId, ra.scopes);
         AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
-        // TODO 此处的 openid 应该怎么加载？
-        // at.openid = SaOAuth2Manager.getDataLoader().getOpenid(ra.clientId, ra.loginId);
+
+        // 3、根据权限构建额外参数
+        at.extraData = new LinkedHashMap<>();
+        SaOAuth2Strategy.instance.workAccessTokenByScope.accept(at);
+
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(ra.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
 
         // 3、生成&保存 Refresh-Token
         if(isCreateRt) {
             RefreshTokenModel rt = SaOAuth2Manager.getDataConverter().convertAccessTokenToRefreshToken(at);
+            at.refreshToken = rt.refreshToken;
+            at.refreshExpiresTime = rt.expiresTime;
+
             dao.saveRefreshToken(rt);
             dao.saveRefreshTokenIndex(rt);
         }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index 2cc8dc5f..248c1aef 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -54,23 +54,23 @@ public class SaClientModel implements Serializable {
 	public List<String> allowUrls;
 	
 	/** 此 Client 是否打开模式：授权码（Authorization Code） */
-	public Boolean isCode = false;
+	public Boolean enableCode = false;
 
 	/** 此 Client 是否打开模式：隐藏式（Implicit） */
-	public Boolean isImplicit = false;
+	public Boolean enableImplicit = false;
 
 	/** 此 Client 是否打开模式：密码式（Password） */
-	public Boolean isPassword = false;
+	public Boolean enablePassword = false;
 
 	/** 此 Client 是否打开模式：凭证式（Client Credentials） */
-	public Boolean isClient = false;
+	public Boolean enableClient = false;
 
-	/** 
-	 * 是否自动判断此 Client 开放的授权模式 
-	 * <br> 此值为true时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠全局设置
-	 * <br> 此值为false时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠局部配置+全局配置 
-	 */
-	public Boolean isAutoMode = true;
+//	/**
+//	 * 是否自动判断此 Client 开放的授权模式
+//	 * <br> 此值为true时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠全局设置
+//	 * <br> 此值为false时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠局部配置+全局配置
+//	 */
+//	public Boolean isAutoMode = true;
 
 	/** 单独配置此Client：是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token [默认取全局配置] */
 	public Boolean isNewRefresh;
@@ -171,83 +171,83 @@ public class SaClientModel implements Serializable {
 	/**
 	 * @return 此 Client 是否打开模式：授权码（Authorization Code）
 	 */
-	public Boolean getIsCode() {
-		return isCode;
+	public Boolean getEnableCode() {
+		return enableCode;
 	}
 	
 	/**
-	 * @param isCode 此 Client 是否打开模式：授权码（Authorization Code）
+	 * @param enableCode 此 Client 是否打开模式：授权码（Authorization Code）
 	 * @return 对象自身 
 	 */
-	public SaClientModel setIsCode(Boolean isCode) {
-		this.isCode = isCode;
+	public SaClientModel setEnableCode(Boolean enableCode) {
+		this.enableCode = enableCode;
 		return this;
 	}
 	
 	/**
 	 * @return 此 Client 是否打开模式：隐藏式（Implicit）
 	 */
-	public Boolean getIsImplicit() {
-		return isImplicit;
+	public Boolean getEnableImplicit() {
+		return enableImplicit;
 	}
 	
 	/**
-	 * @param isImplicit 此 Client 是否打开模式：隐藏式（Implicit）
+	 * @param enableImplicit 此 Client 是否打开模式：隐藏式（Implicit）
 	 * @return 对象自身 
 	 */
-	public SaClientModel setIsImplicit(Boolean isImplicit) {
-		this.isImplicit = isImplicit;
+	public SaClientModel setEnableImplicit(Boolean enableImplicit) {
+		this.enableImplicit = enableImplicit;
 		return this;
 	}
 	
 	/**
 	 * @return 此 Client 是否打开模式：密码式（Password）
 	 */
-	public Boolean getIsPassword() {
-		return isPassword;
+	public Boolean getEnablePassword() {
+		return enablePassword;
 	}
 	
 	/**
-	 * @param isPassword 此 Client 是否打开模式：密码式（Password）
+	 * @param enablePassword 此 Client 是否打开模式：密码式（Password）
 	 * @return 对象自身 
 	 */
-	public SaClientModel setIsPassword(Boolean isPassword) {
-		this.isPassword = isPassword;
+	public SaClientModel setEnablePassword(Boolean enablePassword) {
+		this.enablePassword = enablePassword;
 		return this;
 	}
 	
 	/**
 	 * @return 此 Client 是否打开模式：凭证式（Client Credentials）
 	 */
-	public Boolean getIsClient() {
-		return isClient;
-	}
-	
-	/**
-	 * @param isClient 此 Client 是否打开模式：凭证式（Client Credentials）
-	 * @return 对象自身 
-	 */
-	public SaClientModel setIsClient(Boolean isClient) {
-		this.isClient = isClient;
-		return this;
-	}
-
-	/**
-	 * @return 是否自动判断此 Client 开放的授权模式
-	 */
-	public Boolean getIsAutoMode() {
-		return isAutoMode;
+	public Boolean getEnableClient() {
+		return enableClient;
 	}
 	
 	/**
-	 * @param isAutoMode 是否自动判断此 Client 开放的授权模式
+	 * @param enableClient 此 Client 是否打开模式：凭证式（Client Credentials）
 	 * @return 对象自身 
 	 */
-	public SaClientModel setIsAutoMode(Boolean isAutoMode) {
-		this.isAutoMode = isAutoMode;
+	public SaClientModel setEnableClient(Boolean enableClient) {
+		this.enableClient = enableClient;
 		return this;
 	}
-	
+//
+//	/**
+//	 * @return 是否自动判断此 Client 开放的授权模式
+//	 */
+//	public Boolean getIsAutoMode() {
+//		return isAutoMode;
+//	}
+//
+//	/**
+//	 * @param isAutoMode 是否自动判断此 Client 开放的授权模式
+//	 * @return 对象自身
+//	 */
+//	public SaClientModel setIsAutoMode(Boolean isAutoMode) {
+//		this.isAutoMode = isAutoMode;
+//		return this;
+//	}
+//
 	
 	/**
 	 * @return 此Client：是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token [默认取全局配置]
@@ -338,11 +338,11 @@ public class SaClientModel implements Serializable {
 				", clientSecret='" + clientSecret + '\'' +
 				", contractScopes=" + contractScopes +
 				", allowUrls=" + allowUrls +
-				", isCode=" + isCode +
-				", isImplicit=" + isImplicit +
-				", isPassword=" + isPassword +
-				", isClient=" + isClient +
-				", isAutoMode=" + isAutoMode +
+				", isCode=" + enableCode +
+				", isImplicit=" + enableImplicit +
+				", isPassword=" + enablePassword +
+				", isClient=" + enableClient +
+//				", isAutoMode=" + isAutoMode +
 				", isNewRefresh=" + isNewRefresh +
 				", accessTokenTimeout=" + accessTokenTimeout +
 				", refreshTokenTimeout=" + refreshTokenTimeout +
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 97375f88..339ac51a 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -113,7 +113,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     public Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct) {
         Map<String, Object> map = new LinkedHashMap<>();
         map.put("client_token", ct.clientToken);
-        map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
+        // map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
         map.put("expires_in", ct.getExpiresIn());
         map.put("client_id", ct.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(ct.scopes));
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
index cd6a3fa4..fa15e0d4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
@@ -98,6 +98,9 @@ public interface SaOAuth2ErrorCode {
 	/** 无效response_type */
 	int CODE_30125 = 30125;
 
+	/** 无效grant_type */
+	int CODE_30126 = 30126;
+
 	/** 暂未开放授权码模式 */
 	int CODE_30131 = 30131;
 	
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 39a2446c..55857340 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -71,28 +71,24 @@ public class SaOAuth2ServerProcessor {
 
 		// ------------------ 路由分发 ------------------
 
-		// 模式一：Code授权码
-		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.code)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsCode() && (cm.isCode || cm.isAutoMode)) {
-				return authorize();
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+		// 模式一：Code授权码 || 模式二：隐藏式
+		if(req.isPath(Api.authorize)) {
+			return authorize();
 		}
-		
-		// Code授权码 获取 Access-Token
-		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.authorization_code)) {
-			return token();
+
+		// Code 换 Access-Token || 模式三：密码式
+		if(req.isPath(Api.token)) {
+			return tokenOrPassword();
 		}
 
 		// Refresh-Token 刷新 Access-Token
-		if(req.isPath(Api.refresh) && req.isParam(Param.grant_type, GrantType.refresh_token)) {
-			return refreshToken();
+		if(req.isPath(Api.refresh)) {
+			return refresh();
 		}
 
 		// 回收 Access-Token
 		if(req.isPath(Api.revoke)) {
-			return revokeToken();
+			return revoke();
 		}
 
 		// doLogin 登录接口
@@ -105,31 +101,9 @@ public class SaOAuth2ServerProcessor {
 			return doConfirm();
 		}
 
-		// 模式二：隐藏式
-		if(req.isPath(Api.authorize) && req.isParam(Param.response_type, ResponseType.token)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsImplicit() && (cm.isImplicit || cm.isAutoMode)) {
-				return authorize();
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30132);
-		}
-
-		// 模式三：密码式
-		if(req.isPath(Api.token) && req.isParam(Param.grant_type, GrantType.password)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsPassword() && (cm.isPassword || cm.isAutoMode)) {
-				return password();
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30133);
-		}
-
 		// 模式四：凭证式
-		if(req.isPath(Api.client_token) && req.isParam(Param.grant_type, GrantType.client_credentials)) {
-			SaClientModel cm = currClientModel();
-			if(cfg.getIsClient() && (cm.isClient || cm.isAutoMode)) {
-				return clientToken();
-			}
-			throw new SaOAuth2Exception("暂未开放的授权模式").setCode(SaOAuth2ErrorCode.CODE_30134);
+		if(req.isPath(Api.client_token)) {
+			return clientToken();
 		}
 
 		// 默认返回
@@ -141,42 +115,67 @@ public class SaOAuth2ServerProcessor {
 	 * @return 处理结果
 	 */
 	public Object authorize() {
+
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
+		String responseType = req.getParamNotNull(Param.response_type);
 
-		// 1、如果尚未登录, 则先去登录
+		// 1、先判断是否开启了指定的授权模式
+		// 		模式一：Code授权码
+		if(responseType.equals(ResponseType.code)) {
+			if(!cfg.enableCode) {
+				throwErrorSystemNotEnableModel();
+			}
+			if(!currClientModel().enableCode) {
+				throwErrorClientNotEnableModel();
+			}
+		}
+		// 		模式二：隐藏式
+		else if(responseType.equals(ResponseType.token)) {
+			if(!cfg.enableImplicit) {
+				throwErrorSystemNotEnableModel();
+			}
+			if(!currClientModel().enableImplicit) {
+				throwErrorClientNotEnableModel();
+			}
+		}
+		// 		其它
+		else {
+			throw new SaOAuth2Exception("无效 response_type: " + req.getParam(Param.response_type)).setCode(SaOAuth2ErrorCode.CODE_30125);
+		}
+
+		// 2、如果尚未登录, 则先去登录
 		if( ! getStpLogic().isLogin()) {
 			return cfg.notLoginView.get();
 		}
 
-		// 2、构建请求 Model
+		// 3、构建请求 Model
 		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, getStpLogic().getLoginId());
 
-		// 3、校验：重定向域名是否合法
+		// 4、校验：重定向域名是否合法
 		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
 
-		// 4、校验：此次申请的Scope，该Client是否已经签约
+		// 5、校验：此次申请的Scope，该Client是否已经签约
 		oauth2Template.checkContract(ra.clientId, ra.scopes);
 
-		// 5、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
+		// 6、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
 		boolean isGrant = oauth2Template.isGrant(ra.loginId, ra.clientId, ra.scopes);
 		if( ! isGrant) {
 			return cfg.confirmView.apply(ra.clientId, ra.scopes);
 		}
 
-
-		// 6、判断授权类型
-		// 如果是 授权码式，则：开始重定向授权，下放code
+		// 7、判断授权类型，重定向到不同地址
+		// 		如果是 授权码式，则：开始重定向授权，下放code
 		if(ResponseType.code.equals(ra.responseType)) {
 			CodeModel codeModel = dataGenerate.generateCode(ra);
 			String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
 			return res.redirect(redirectUri);
 		}
 		
-		// 如果是 隐藏式，则：开始重定向授权，下放 token
+		// 		如果是 隐藏式，则：开始重定向授权，下放 token
 		if(ResponseType.token.equals(ra.responseType)) {
 			AccessTokenModel at = dataGenerate.generateAccessToken(ra, false);
 			String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
@@ -187,6 +186,34 @@ public class SaOAuth2ServerProcessor {
 		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
 	}
 
+	/**
+	 * Code 换 Access-Token || 模式三：密码式
+	 * @return 处理结果
+	 */
+	public Object tokenOrPassword() {
+
+		String grantType = SaHolder.getRequest().getParamNotNull(Param.grant_type);
+
+		// Code 换 Access-Token
+		if(grantType.equals(GrantType.authorization_code)) {
+			return token();
+		}
+
+		// 模式三：密码式
+		if(grantType.equals(GrantType.password)) {
+			SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+			if(!cfg.enablePassword) {
+				throwErrorSystemNotEnableModel();
+			}
+			if(!currClientModel().enablePassword) {
+				throwErrorClientNotEnableModel();
+			}
+			return password();
+		}
+
+		throw new SaOAuth2Exception("无效 grant_type：" + grantType);
+	}
+
 	/**
 	 * Code授权码 获取 Access-Token
 	 * @return 处理结果
@@ -216,9 +243,13 @@ public class SaOAuth2ServerProcessor {
 	 * Refresh-Token 刷新 Access-Token
 	 * @return 处理结果
 	 */
-	public Object refreshToken() {
+	public Object refresh() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
+		String grantType = req.getParamNotNull(Param.grant_type);
+		if(!grantType.equals(GrantType.refresh_token)) {
+			throw new SaOAuth2Exception("无效 grant_type：" + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
+		}
 
 		// 获取参数
 
@@ -241,7 +272,7 @@ public class SaOAuth2ServerProcessor {
 	 * 回收 Access-Token
 	 * @return 处理结果
 	 */
-	public Object revokeToken() {
+	public Object revoke() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 
@@ -344,6 +375,18 @@ public class SaOAuth2ServerProcessor {
 	public Object clientToken() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
+		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+
+		String grantType = req.getParamNotNull(Param.grant_type);
+		if(!grantType.equals(GrantType.client_credentials)) {
+			throw new SaOAuth2Exception("无效 grant_type：" + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
+		}
+		if(!cfg.enableClient) {
+			throwErrorSystemNotEnableModel();
+		}
+		if(!currClientModel().enableClient) {
+			throwErrorClientNotEnableModel();
+		}
 
 		// 获取参数
 		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
@@ -383,4 +426,18 @@ public class SaOAuth2ServerProcessor {
 		return StpUtil.stpLogic;
 	}
 
+	/**
+	 * 系统未开放此授权模式时抛出异常
+	 */
+	public void throwErrorSystemNotEnableModel() {
+		throw new SaOAuth2Exception("系统暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+	}
+
+	/**
+	 * 应用未开放此授权模式时抛出异常
+	 */
+	public void throwErrorClientNotEnableModel() {
+		throw new SaOAuth2Exception("应用暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+	}
+
 }
-- 
Gitee


From c4b6a6381e6652314be486ba82a6d805e4ce5899 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 20 Aug 2024 12:58:56 +0800
Subject: [PATCH 139/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=20OAuth2-=E8=87=AA?=
 =?UTF-8?q?=E5=AE=9A=E4=B9=89=E6=9D=83=E9=99=90=E5=A4=84=E7=90=86=E5=99=A8?=
 =?UTF-8?q?=20=E7=AB=A0=E8=8A=82=E6=96=87=E6=A1=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../pj/oauth2/SaOAuth2ServerController.java   |  14 +-
 .../com/pj/oauth2/UserinfoScopeHandler.java   |  41 ++++
 sa-token-doc/_sidebar.md                      |   6 +-
 .../oauth2/oauth2-custom-scope-handler.md     | 178 ++++++++++++++++++
 .../scope/handler/OidcScopeHandler.java       |   2 +-
 .../scope/handler/OpenIdScopeHandler.java     |   2 +-
 ...ava => SaOAuth2ScopeHandlerInterface.java} |   2 +-
 .../scope/handler/UserIdScopeHandler.java     |   2 +-
 .../oauth2/strategy/SaOAuth2Strategy.java     |  10 +-
 .../spring/oauth2/SaOAuth2BeanInject.java     |  64 ++++++-
 10 files changed, 300 insertions(+), 21 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java
 create mode 100644 sa-token-doc/oauth2/oauth2-custom-scope-handler.md
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/{SaOAuth2ScopeAbstractHandler.java => SaOAuth2ScopeHandlerInterface.java} (96%)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 594b8126..58d75726 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -8,6 +8,7 @@ import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
 
@@ -59,11 +60,10 @@ public class SaOAuth2ServerController {
 	
 	// ---------- 开放相关资源接口： Client端根据 Access-Token ，置换相关资源 ------------ 
 	
-	// 获取Userinfo信息：昵称、头像、性别等等
+	// 获取 userinfo 信息：昵称、头像、性别等等
 	@RequestMapping("/oauth2/userinfo")
-	public SaResult userinfo() {
-		// 获取 Access-Token 对应的账号id 
-		String accessToken = SaHolder.getRequest().getParamNotNull("access_token");
+	public SaResult userinfo(@RequestParam("access_token") String accessToken) {
+		// 获取 Access-Token 对应的账号id
 		Object loginId = SaOAuth2Util.getLoginIdByAccessToken(accessToken);
 		System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
 		
@@ -71,9 +71,9 @@ public class SaOAuth2ServerController {
 		SaOAuth2Util.checkScope(accessToken, "userinfo");
 		
 		// 模拟账号信息 （真实环境需要查询数据库获取信息）
-		Map<String, Object> map = new LinkedHashMap<String, Object>();
-		map.put("userId", "10008");
-		map.put("nickname", "shengzhang_");
+		Map<String, Object> map = new LinkedHashMap<>();
+		// map.put("userId", loginId);  一般原则下，oauth2-server 不能把 userId 返回给 oauth2-client
+		map.put("nickname", "林小林");
 		map.put("avatar", "http://xxx.com/1.jpg");
 		map.put("age", "18");
 		map.put("sex", "男");
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java
new file mode 100644
index 00000000..afca1436
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java
@@ -0,0 +1,41 @@
+package com.pj.oauth2;
+
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
+import org.springframework.stereotype.Component;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * @author click33
+ * @since 2024/8/20
+ */
+@Component
+public class UserinfoScopeHandler implements SaOAuth2ScopeHandlerInterface {
+
+    @Override
+    public String getHandlerScope() {
+        return "userinfo";
+    }
+
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
+        System.out.println("--------- userinfo 权限，加工 AccessTokenModel --------- ");
+        // 模拟账号信息 （真实环境需要查询数据库获取信息）
+        Map<String, Object> map = new LinkedHashMap<String, Object>();
+        map.put("userId", "10008");
+        map.put("nickname", "shengzhang_");
+        map.put("avatar", "http://xxx.com/1.jpg");
+        map.put("age", "18");
+        map.put("sex", "男");
+        map.put("address", "山东省 青岛市 城阳区");
+        at.extraData.put("userinfo", map);
+    }
+
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 432eb727..f742c13f 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -58,10 +58,10 @@
 	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
 	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
 	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
-	- [前后端分离模式整合方案](/oauth2/4)
-	- [平台中心模式开发](/oauth2/5)
-	- [自定义 Scope 权限以处理器](/oauth2/6)
+	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope-handler)
 	- [为 Scope 划分等级](/oauth2/7)
+	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
+	- [平台中心模式开发](/oauth2/5)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
 	- [常见问题说明](/oauth2/8)
diff --git a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
new file mode 100644
index 00000000..2a391c80
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
@@ -0,0 +1,178 @@
+# OAuth2-自定义权限处理器 
+
+--- 
+
+### 1、需求场景
+一般情况下，对于第三方 oauth2-client 来讲，仅仅拿到用户的 access_token 是不够的，还需要拿到更多的信息，比如用户昵称、头像等资料。
+
+sa-token-oauth2 提供两种模式，让 access_token 可以得到更多信息。
+
+- 自定义接口模式：在 oauth2-server 端开放一个资料查询接口，在 oauth2-client 得到 `access_token` 后，再次调用这个接口来获取 `userinfo` 信息。
+- 自定义权限处理器模式：自定义一个 `ScopeHandler`，直接在返回 `access_token` 时追加字段，将 `userinfo` 信息和 `access_token` 一并返回到 oauth2-client。
+
+
+### 2、自定义接口模式
+
+#### 1、新建查询接口
+
+在 oauth2-server 新建接口，查询指定 `access_token` 代表的 `userId` 其 `userinfo`：
+
+``` java
+// 获取 userinfo 信息：昵称、头像、性别等等
+@RequestMapping("/oauth2/userinfo")
+public SaResult userinfo(@RequestParam("access_token") String accessToken) {
+	// 获取 Access-Token 对应的账号id
+	Object loginId = SaOAuth2Util.getLoginIdByAccessToken(accessToken);
+	System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
+	
+	// 校验 Access-Token 是否具有权限: userinfo
+	SaOAuth2Util.checkScope(accessToken, "userinfo");
+	
+	// 模拟账号信息 （真实环境需要查询数据库获取信息）
+	Map<String, Object> map = new LinkedHashMap<>();
+	// map.put("userId", loginId);  一般原则下，oauth2-server 不能把 userId 返回给 oauth2-client
+	map.put("nickname", "林小林");
+	map.put("avatar", "http://xxx.com/1.jpg");
+	map.put("age", "18");
+	map.put("sex", "男");
+	map.put("address", "山东省 青岛市 城阳区");
+	return SaResult.ok().setMap(map);
+}
+```
+
+
+#### 2、申请 code 时指定权限
+oauth2-client 申请 `code` 时，一定需要加上 `userinfo` 权限
+
+``` url
+http://sa-oauth-server.com:8000/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=userinfo
+```
+
+
+#### 3、code 换 access_token
+访问上述链接后，得到 `code` 授权码，然后我们拿着 `code` 换 `access_token`
+
+``` url
+http://sa-oauth-server.com:8000/oauth2/token
+    ?grant_type=authorization_code
+    &client_id=1001
+    &client_secret=aaaa-bbbb-cccc-dddd-eeee
+    &code=${code}
+```
+
+#### 4、access_token 取 userinfo 
+使用返回的 `access_token` 再次访问接口 `/oauth2/userinfo`
+
+``` url
+http://sa-oauth-server.com:8000/oauth2/userinfo?access_token=${access_token}
+```
+
+返回以下结果：
+``` js
+{
+  "code": 200,
+  "msg": "ok",
+  "data": null,
+  "nickname": "林小林",
+  "avatar": "http://xxx.com/1.jpg",
+  "age": "18",
+  "sex": "男",
+  "address": "山东省 青岛市 城阳区"
+}
+```
+
+拿到 userinfo。
+
+
+
+### 3、自定义权限处理器模式
+
+#### 1、新建权限处理器
+在 oauth2-server 新建 `UserinfoScopeHandler.java` 实现 `SaOAuth2ScopeHandlerInterface` 接口：
+
+``` java
+@Component
+public class UserinfoScopeHandler implements SaOAuth2ScopeHandlerInterface {
+
+    @Override
+    public String getHandlerScope() {
+        return "userinfo";
+    }
+
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
+        System.out.println("--------- userinfo 权限，加工 AccessTokenModel --------- ");
+        // 模拟账号信息 （真实环境需要查询数据库获取信息）
+        Map<String, Object> map = new LinkedHashMap<String, Object>();
+        map.put("userId", "10008");
+        map.put("nickname", "shengzhang_");
+        map.put("avatar", "http://xxx.com/1.jpg");
+        map.put("age", "18");
+        map.put("sex", "男");
+        map.put("address", "山东省 青岛市 城阳区");
+        at.extraData.putAll(map);
+    }
+
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+    }
+
+}
+```
+
+如上所述，所有写入到 `extraData` 中的数据，都将追加返回到 oauth2-client 端。
+
+
+#### 2、申请 code 时指定权限
+oauth2-client 申请 `code` 时，一定需要加上 `userinfo` 权限
+``` url
+http://sa-oauth-server.com:8000/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=userinfo
+```
+
+
+#### 3、code 换 access_token
+3、访问上述链接后，得到 `code` 授权码，然后我们拿着 `code` 换 `access_token`
+``` url
+http://sa-oauth-server.com:8000/oauth2/token
+    ?grant_type=authorization_code
+    &client_id=1001
+    &client_secret=aaaa-bbbb-cccc-dddd-eeee
+    &code=${code}
+```
+
+返回结果如下
+``` js
+{
+  "code": 200,
+  "msg": "ok",
+  "data": null,
+  "token_type": "bearer",
+  "access_token": "LQ24xI0hX25vIzvciHPA0PNsnGCweSFM1Bzl8783li07VAXpw8sEfn9xsta2",
+  "refresh_token": "rKB8mby1Mw8yZXHbWzliHx6lmatcLcULLw5C5cUMBhMMRx72DFg5u0owZgrA",
+  "expires_in": 7199,
+  "refresh_expires_in": 2591999,
+  "client_id": "1001",
+  "scope": "openid,userid,userinfo",
+  "userinfo": {
+    "userId": "10008",
+    "nickname": "shengzhang_",
+    "avatar": "http://xxx.com/1.jpg",
+    "age": "18",
+    "sex": "男",
+    "address": "山东省 青岛市 城阳区"
+  }
+}
+```
+
+拿到 userinfo。
+
+#### 总结
+相比于自定义接口模式，自定义权限处理器模式可以少一次网络请求，提前拿到 `userinfo` 信息。
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
index 71961833..7adb42d6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
@@ -25,7 +25,7 @@ import cn.dev33.satoken.oauth2.scope.CommonScope;
  * @author click33
  * @since 1.39.0
  */
-public class OidcScopeHandler implements SaOAuth2ScopeAbstractHandler {
+public class OidcScopeHandler implements SaOAuth2ScopeHandlerInterface {
 
     public String getHandlerScope() {
         return CommonScope.OIDC;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
index 0bc100e7..cfc07a2b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OpenIdScopeHandler.java
@@ -27,7 +27,7 @@ import cn.dev33.satoken.oauth2.scope.CommonScope;
  * @author click33
  * @since 1.39.0
  */
-public class OpenIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
+public class OpenIdScopeHandler implements SaOAuth2ScopeHandlerInterface {
 
     public String getHandlerScope() {
         return CommonScope.OPENID;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeHandlerInterface.java
similarity index 96%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeHandlerInterface.java
index 32aa8110..d06ed40b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeAbstractHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/SaOAuth2ScopeHandlerInterface.java
@@ -24,7 +24,7 @@ import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
  * @author click33
  * @since 1.39.0
  */
-public interface SaOAuth2ScopeAbstractHandler {
+public interface SaOAuth2ScopeHandlerInterface {
 
     /**
      * 获取所要处理的权限
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java
index b062a3df..18fad7d2 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/UserIdScopeHandler.java
@@ -26,7 +26,7 @@ import cn.dev33.satoken.oauth2.scope.CommonScope;
  * @author click33
  * @since 1.39.0
  */
-public class UserIdScopeHandler implements SaOAuth2ScopeAbstractHandler {
+public class UserIdScopeHandler implements SaOAuth2ScopeHandlerInterface {
 
     public String getHandlerScope() {
         return CommonScope.USERID;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index 97fbab77..05aa59f5 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -20,7 +20,7 @@ import cn.dev33.satoken.oauth2.function.strategy.*;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
 import cn.dev33.satoken.oauth2.scope.handler.OpenIdScopeHandler;
-import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeAbstractHandler;
+import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
 import cn.dev33.satoken.oauth2.scope.handler.UserIdScopeHandler;
 import cn.dev33.satoken.util.SaFoxUtil;
 
@@ -49,7 +49,7 @@ public final class SaOAuth2Strategy {
 	/**
 	 * 权限处理器集合
 	 */
-	public Map<String, SaOAuth2ScopeAbstractHandler> scopeHandlerMap = new LinkedHashMap<>();
+	public Map<String, SaOAuth2ScopeHandlerInterface> scopeHandlerMap = new LinkedHashMap<>();
 
 	/**
 	 * 注册所有默认的权限处理器
@@ -63,7 +63,7 @@ public final class SaOAuth2Strategy {
 	/**
 	 * 注册一个权限处理器
 	 */
-	public void registerScopeHandler(SaOAuth2ScopeAbstractHandler handler) {
+	public void registerScopeHandler(SaOAuth2ScopeHandlerInterface handler) {
 		scopeHandlerMap.put(handler.getHandlerScope(), handler);
 		// TODO 优化日志输出
 		SaManager.getLog().info("新增权限处理器：" + handler.getHandlerScope());
@@ -86,7 +86,7 @@ public final class SaOAuth2Strategy {
 	public SaOAuth2ScopeWorkAccessTokenFunction workAccessTokenByScope = (at) -> {
 		if(at.scopes != null && !at.scopes.isEmpty()) {
 			for (String scope : at.scopes) {
-				SaOAuth2ScopeAbstractHandler handler = scopeHandlerMap.get(scope);
+				SaOAuth2ScopeHandlerInterface handler = scopeHandlerMap.get(scope);
 				if(handler != null) {
 					handler.workAccessToken(at);
 				}
@@ -100,7 +100,7 @@ public final class SaOAuth2Strategy {
 	public SaOAuth2ScopeWorkClientTokenFunction workClientTokenByScope = (ct) -> {
 		if(ct.scopes != null && !ct.scopes.isEmpty()) {
 			for (String scope : ct.scopes) {
-				SaOAuth2ScopeAbstractHandler handler = scopeHandlerMap.get(scope);
+				SaOAuth2ScopeHandlerInterface handler = scopeHandlerMap.get(scope);
 				if(handler != null) {
 					handler.workClientToken(ct);
 				}
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index 0f4e1767..3ff3dda9 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -17,12 +17,20 @@ package cn.dev33.satoken.spring.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
+import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
+import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
+import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
+import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
+import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 
+import java.util.List;
+
 
 // 小提示：如果你在 idea 中运行源码时出现异常：java: 程序包cn.dev33.satoken.oauth2不存在。
 // 在项目根目录进入 cmd，执行 mvn package 即可解决
@@ -53,7 +61,7 @@ public class SaOAuth2BeanInject {
 	 * @param saOAuth2Template 模板代码类
 	 */
 	@Autowired(required = false)
-	public void setSaOAuth2Interface(SaOAuth2Template saOAuth2Template) {
+	public void setSaOAuth2Template(SaOAuth2Template saOAuth2Template) {
 		SaOAuth2ServerProcessor.instance.oauth2Template = saOAuth2Template;
 	}
 
@@ -63,8 +71,60 @@ public class SaOAuth2BeanInject {
 	 * @param dataLoader /
 	 */
 	@Autowired(required = false)
-	public void setSaOAuth2Interface(SaOAuth2DataLoader dataLoader) {
+	public void setSaOAuth2DataLoader(SaOAuth2DataLoader dataLoader) {
 		SaOAuth2Manager.setDataLoader(dataLoader);
 	}
 
+	/**
+	 * 注入 OAuth2 数据解析器 Bean
+	 *
+	 * @param dataResolver /
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2DataResolver(SaOAuth2DataResolver dataResolver) {
+		SaOAuth2Manager.setDataResolver(dataResolver);
+	}
+
+	/**
+	 * 注入 OAuth2 数据格式转换器 Bean
+	 *
+	 * @param dataConverter /
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2DataConverter(SaOAuth2DataConverter dataConverter) {
+		SaOAuth2Manager.setDataConverter(dataConverter);
+	}
+
+	/**
+	 * 注入 OAuth2 数据构建器 Bean
+	 *
+	 * @param dataGenerate /
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2DataGenerate(SaOAuth2DataGenerate dataGenerate) {
+		SaOAuth2Manager.setDataGenerate(dataGenerate);
+	}
+
+	/**
+	 * 注入 OAuth2 数据持久 Bean
+	 *
+	 * @param dao /
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2Dao(SaOAuth2Dao dao) {
+		SaOAuth2Manager.setDao(dao);
+	}
+
+	/**
+	 * 注入自定义 scope 处理器
+	 *
+	 * @param handlerList 自定义 scope 处理器集合
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2ScopeHandler(List<SaOAuth2ScopeHandlerInterface> handlerList) {
+		for (SaOAuth2ScopeHandlerInterface handler : handlerList) {
+			SaOAuth2Strategy.instance.registerScopeHandler(handler);
+		}
+	}
+
 }
-- 
Gitee


From 0ca8a1ab2d7cbb2cc7ca25dae7a982282734b006 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 20 Aug 2024 13:00:22 +0800
Subject: [PATCH 140/172] =?UTF-8?q?=E6=B3=A8=E8=A7=A3=E5=A4=84=E7=90=86?=
 =?UTF-8?q?=E5=99=A8=E7=88=B6=E6=8E=A5=E5=8F=A3=E9=87=8D=E5=91=BD=E5=90=8D?=
 =?UTF-8?q?=20SaAnnotationAbstractHandler=20->=20SaAnnotationHandlerInterf?=
 =?UTF-8?q?ace?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...tHandler.java => SaAnnotationHandlerInterface.java} |  2 +-
 .../annotation/handler/SaCheckDisableHandler.java      |  2 +-
 .../annotation/handler/SaCheckHttpBasicHandler.java    |  2 +-
 .../annotation/handler/SaCheckHttpDigestHandler.java   |  2 +-
 .../annotation/handler/SaCheckLoginHandler.java        |  2 +-
 .../satoken/annotation/handler/SaCheckOrHandler.java   |  2 +-
 .../annotation/handler/SaCheckPermissionHandler.java   |  2 +-
 .../satoken/annotation/handler/SaCheckRoleHandler.java |  2 +-
 .../satoken/annotation/handler/SaCheckSafeHandler.java |  2 +-
 .../satoken/annotation/handler/SaIgnoreHandler.java    |  2 +-
 .../cn/dev33/satoken/listener/SaTokenEventCenter.java  |  4 ++--
 .../cn/dev33/satoken/listener/SaTokenListener.java     |  4 ++--
 .../dev33/satoken/listener/SaTokenListenerForLog.java  |  4 ++--
 .../dev33/satoken/strategy/SaAnnotationStrategy.java   | 10 +++++-----
 .../custom_annotation/handler/CheckAccountHandler.java |  4 ++--
 .../handler/SaUserCheckLoginHandler.java               |  4 ++--
 .../handler/SaUserCheckPermissionHandler.java          |  4 ++--
 .../handler/SaUserCheckRoleHandler.java                |  4 ++--
 .../handler/SaUserCheckSafeHandler.java                |  4 ++--
 .../custom_annotation/handler/CheckAccountHandler.java |  4 ++--
 .../satoken/aop/SaAopPointcutAdvisorBeanRegister.java  |  8 ++++----
 .../main/java/cn/dev33/satoken/solon/XPluginImp.java   |  4 ++--
 .../java/cn/dev33/satoken/spring/SaBeanInject.java     |  6 +++---
 23 files changed, 42 insertions(+), 42 deletions(-)
 rename sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/{SaAnnotationAbstractHandler.java => SaAnnotationHandlerInterface.java} (95%)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationHandlerInterface.java
similarity index 95%
rename from sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
rename to sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationHandlerInterface.java
index 8db94fc9..fd91d396 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationAbstractHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaAnnotationHandlerInterface.java
@@ -24,7 +24,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public interface SaAnnotationAbstractHandler<T extends Annotation> {
+public interface SaAnnotationHandlerInterface<T extends Annotation> {
 
     /**
      * 获取所要处理的注解类型
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
index 67817621..d1faa35d 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckDisableHandler.java
@@ -27,7 +27,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckDisableHandler implements SaAnnotationAbstractHandler<SaCheckDisable> {
+public class SaCheckDisableHandler implements SaAnnotationHandlerInterface<SaCheckDisable> {
 
     @Override
     public Class<SaCheckDisable> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
index 2c809b60..7e15ce6b 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpBasicHandler.java
@@ -26,7 +26,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckHttpBasicHandler implements SaAnnotationAbstractHandler<SaCheckHttpBasic> {
+public class SaCheckHttpBasicHandler implements SaAnnotationHandlerInterface<SaCheckHttpBasic> {
 
     @Override
     public Class<SaCheckHttpBasic> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
index 1a688492..1829ce81 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckHttpDigestHandler.java
@@ -28,7 +28,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckHttpDigestHandler implements SaAnnotationAbstractHandler<SaCheckHttpDigest> {
+public class SaCheckHttpDigestHandler implements SaAnnotationHandlerInterface<SaCheckHttpDigest> {
 
     @Override
     public Class<SaCheckHttpDigest> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
index ab83f39e..d549763a 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckLoginHandler.java
@@ -27,7 +27,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckLoginHandler implements SaAnnotationAbstractHandler<SaCheckLogin> {
+public class SaCheckLoginHandler implements SaAnnotationHandlerInterface<SaCheckLogin> {
 
     @Override
     public Class<SaCheckLogin> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
index 3aafbfb5..bb7b9c1d 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckOrHandler.java
@@ -31,7 +31,7 @@ import java.util.List;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckOrHandler implements SaAnnotationAbstractHandler<SaCheckOr> {
+public class SaCheckOrHandler implements SaAnnotationHandlerInterface<SaCheckOr> {
 
     @Override
     public Class<SaCheckOr> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
index 64e79b01..62321098 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckPermissionHandler.java
@@ -30,7 +30,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckPermissionHandler implements SaAnnotationAbstractHandler<SaCheckPermission> {
+public class SaCheckPermissionHandler implements SaAnnotationHandlerInterface<SaCheckPermission> {
 
     @Override
     public Class<SaCheckPermission> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
index e5c88b14..f5297a3d 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckRoleHandler.java
@@ -28,7 +28,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckRoleHandler implements SaAnnotationAbstractHandler<SaCheckRole> {
+public class SaCheckRoleHandler implements SaAnnotationHandlerInterface<SaCheckRole> {
 
     @Override
     public Class<SaCheckRole> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
index b07358b1..c4052385 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSafeHandler.java
@@ -27,7 +27,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaCheckSafeHandler implements SaAnnotationAbstractHandler<SaCheckSafe> {
+public class SaCheckSafeHandler implements SaAnnotationHandlerInterface<SaCheckSafe> {
 
     @Override
     public Class<SaCheckSafe> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
index 93319cd4..1fdef904 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaIgnoreHandler.java
@@ -26,7 +26,7 @@ import java.lang.reflect.Method;
  * @author click33
  * @since 2024/8/2
  */
-public class SaIgnoreHandler implements SaAnnotationAbstractHandler<SaIgnore> {
+public class SaIgnoreHandler implements SaAnnotationHandlerInterface<SaIgnore> {
 
     @Override
     public Class<SaIgnore> getHandlerAnnotationClass() {
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
index 29ed5d89..53c18dd8 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenEventCenter.java
@@ -18,7 +18,7 @@ package cn.dev33.satoken.listener;
 import java.util.ArrayList;
 import java.util.List;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.error.SaErrorCode;
 import cn.dev33.satoken.exception.SaTokenException;
@@ -292,7 +292,7 @@ public class SaTokenEventCenter {
 	 * 事件发布：有新的注解处理器载入到框架中
 	 * @param handler 注解处理器
 	 */
-	public static void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+	public static void doRegisterAnnotationHandler(SaAnnotationHandlerInterface<?> handler) {
 		for (SaTokenListener listener : listenerList) {
 			listener.doRegisterAnnotationHandler(handler);
 		}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
index 6a4e3564..1d867f2c 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListener.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.listener;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.StpLogic;
@@ -130,7 +130,7 @@ public interface SaTokenListener {
 	 * 注册了自定义注解处理器
 	 * @param handler 注解处理器
 	 */
-	default void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {}
+	default void doRegisterAnnotationHandler(SaAnnotationHandlerInterface<?> handler) {}
 
 	/**
 	 * StpLogic 对象替换 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
index 7bb32ef4..c1b61118 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/listener/SaTokenListenerForLog.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.listener;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.stp.SaLoginModel;
 import cn.dev33.satoken.stp.StpLogic;
@@ -136,7 +136,7 @@ public class SaTokenListenerForLog implements SaTokenListener {
 	 * @param handler 注解处理器
 	 */
 	@Override
-	public void doRegisterAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+	public void doRegisterAnnotationHandler(SaAnnotationHandlerInterface<?> handler) {
 		if(handler != null) {
 			log.info("注解扩展 @{} (处理器: {})", handler.getHandlerAnnotationClass().getSimpleName(), handler.getClass().getCanonicalName());
 		}
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
index 9c8b88ba..e0ffc23a 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
@@ -49,7 +49,7 @@ public final class SaAnnotationStrategy {
 	/**
 	 * 注解处理器集合
 	 */
-	public Map<Class<?>, SaAnnotationAbstractHandler<?>> annotationHandlerMap = new LinkedHashMap<>();
+	public Map<Class<?>, SaAnnotationHandlerInterface<?>> annotationHandlerMap = new LinkedHashMap<>();
 
 	/**
 	 * 注册所有默认的注解处理器
@@ -69,7 +69,7 @@ public final class SaAnnotationStrategy {
 	/**
 	 * 注册一个注解处理器
 	 */
-	public void registerAnnotationHandler(SaAnnotationAbstractHandler<?> handler) {
+	public void registerAnnotationHandler(SaAnnotationHandlerInterface<?> handler) {
 		annotationHandlerMap.put(handler.getHandlerAnnotationClass(), handler);
 		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
 	}
@@ -77,8 +77,8 @@ public final class SaAnnotationStrategy {
 	/**
 	 * 注册一个注解处理器，到首位
 	 */
-	public void registerAnnotationHandlerToFirst(SaAnnotationAbstractHandler<?> handler) {
-		Map<Class<?>, SaAnnotationAbstractHandler<?>> newMap = new LinkedHashMap<>();
+	public void registerAnnotationHandlerToFirst(SaAnnotationHandlerInterface<?> handler) {
+		Map<Class<?>, SaAnnotationHandlerInterface<?>> newMap = new LinkedHashMap<>();
 		newMap.put(handler.getHandlerAnnotationClass(), handler);
 		newMap.putAll(annotationHandlerMap);
 		this.annotationHandlerMap = newMap;
@@ -98,7 +98,7 @@ public final class SaAnnotationStrategy {
 	@SuppressWarnings("unchecked")
 	public SaCheckMethodAnnotationFunction checkMethodAnnotation = (method) -> {
 		// 遍历所有的注解处理器，检查此 method 是否具有这些指定的注解
-		for (Map.Entry<Class<?>, SaAnnotationAbstractHandler<?>> entry: annotationHandlerMap.entrySet()) {
+		for (Map.Entry<Class<?>, SaAnnotationHandlerInterface<?>> entry: annotationHandlerMap.entrySet()) {
 
 			// 先校验 Method 所属 Class 上的注解
 			Annotation classTakeAnnotation = instance.getAnnotation.apply(method.getDeclaringClass(), (Class<Annotation>)entry.getKey());
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
index 96cb659e..2b49badf 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.exception.SaTokenException;
 import com.pj.satoken.custom_annotation.CheckAccount;
@@ -15,7 +15,7 @@ import java.lang.reflect.Method;
  *
  */
 @Component
-public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAccount> {
+public class CheckAccountHandler implements SaAnnotationHandlerInterface<CheckAccount> {
 
     // 指定这个处理器要处理哪个注解
     @Override
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
index 46401f9e..73c51865 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckLoginHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.annotation.handler.SaCheckLoginHandler;
 import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckLogin;
@@ -14,7 +14,7 @@ import java.lang.reflect.Method;
  * @author click33
  */
 @Component
-public class SaUserCheckLoginHandler implements SaAnnotationAbstractHandler<SaUserCheckLogin> {
+public class SaUserCheckLoginHandler implements SaAnnotationHandlerInterface<SaUserCheckLogin> {
 
     @Override
     public Class<SaUserCheckLogin> getHandlerAnnotationClass() {
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
index 9759d884..35ef3a44 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckPermissionHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.annotation.handler.SaCheckPermissionHandler;
 import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckPermission;
@@ -14,7 +14,7 @@ import java.lang.reflect.Method;
  * @author click33
  */
 @Component
-public class SaUserCheckPermissionHandler implements SaAnnotationAbstractHandler<SaUserCheckPermission> {
+public class SaUserCheckPermissionHandler implements SaAnnotationHandlerInterface<SaUserCheckPermission> {
 
     @Override
     public Class<SaUserCheckPermission> getHandlerAnnotationClass() {
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
index 633a756b..c430fb1e 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckRoleHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.annotation.handler.SaCheckRoleHandler;
 import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckRole;
@@ -14,7 +14,7 @@ import java.lang.reflect.Method;
  * @author click33
  */
 @Component
-public class SaUserCheckRoleHandler implements SaAnnotationAbstractHandler<SaUserCheckRole> {
+public class SaUserCheckRoleHandler implements SaAnnotationHandlerInterface<SaUserCheckRole> {
 
     @Override
     public Class<SaUserCheckRole> getHandlerAnnotationClass() {
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
index 8c046506..88504e06 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/custom_annotation/handler/SaUserCheckSafeHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.annotation.handler.SaCheckSafeHandler;
 import com.pj.satoken.StpUserUtil;
 import com.pj.satoken.custom_annotation.SaUserCheckSafe;
@@ -14,7 +14,7 @@ import java.lang.reflect.Method;
  * @author click33
  */
 @Component
-public class SaUserCheckSafeHandler implements SaAnnotationAbstractHandler<SaUserCheckSafe> {
+public class SaUserCheckSafeHandler implements SaAnnotationHandlerInterface<SaUserCheckSafe> {
 
     @Override
     public Class<SaUserCheckSafe> getHandlerAnnotationClass() {
diff --git a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
index f7f9c6e6..e7c608f2 100644
--- a/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
+++ b/sa-token-demo/sa-token-demo-solon/src/main/java/com/pj/satoken/custom_annotation/handler/CheckAccountHandler.java
@@ -1,6 +1,6 @@
 package com.pj.satoken.custom_annotation.handler;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.exception.SaTokenException;
 import com.pj.satoken.custom_annotation.CheckAccount;
@@ -15,7 +15,7 @@ import java.lang.reflect.Method;
  *
  */
 @Component
-public class CheckAccountHandler implements SaAnnotationAbstractHandler<CheckAccount> {
+public class CheckAccountHandler implements SaAnnotationHandlerInterface<CheckAccount> {
 
     // 指定这个处理器要处理哪个注解
     @Override
diff --git a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
index d379ebdd..8fe1a649 100644
--- a/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
+++ b/sa-token-plugin/sa-token-spring-aop/src/main/java/cn/dev33/satoken/aop/SaAopPointcutAdvisorBeanRegister.java
@@ -1,6 +1,6 @@
 package cn.dev33.satoken.aop;
 
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.strategy.SaAnnotationStrategy;
 import org.springframework.aop.aspectj.AspectJExpressionPointcut;
 import org.springframework.context.annotation.Bean;
@@ -30,7 +30,7 @@ public class SaAopPointcutAdvisorBeanRegister {
     public static SaAroundAnnotationPointcutAdvisor saAroundAnnoAdvisor;
 
     @Bean
-    public SaAroundAnnotationPointcutAdvisor saAroundAnnotationHandlePointcutAdvisor (List<SaAnnotationAbstractHandler<?>> handlerList) {
+    public SaAroundAnnotationPointcutAdvisor saAroundAnnotationHandlePointcutAdvisor (List<SaAnnotationHandlerInterface<?>> handlerList) {
         SaAroundAnnotationPointcutAdvisor advisor = new SaAroundAnnotationPointcutAdvisor();
 
         // 定义切入规则
@@ -52,14 +52,14 @@ public class SaAopPointcutAdvisorBeanRegister {
      * @param appendHandlerList 追加的 SaAnnotationAbstractHandler 处理器
      * @return /
      */
-    public static String calcExpression(List<SaAnnotationAbstractHandler<?>> appendHandlerList) {
+    public static String calcExpression(List<SaAnnotationHandlerInterface<?>> appendHandlerList) {
 
         // 框架内置的
         List<Class<?>> list = new ArrayList<>(SaAnnotationStrategy.instance.annotationHandlerMap.keySet());
 
         // 额外追加的
         if(appendHandlerList != null) {
-            for (SaAnnotationAbstractHandler<?> handler : appendHandlerList) {
+            for (SaAnnotationHandlerInterface<?> handler : appendHandlerList) {
                 Class<?> cls = handler.getHandlerAnnotationClass();
                 if(!list.contains(cls)) {
                     list.add(handler.getHandlerAnnotationClass());
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
index bbff6026..a6bb293e 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/XPluginImp.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.solon;
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.context.second.SaTokenSecondContextCreator;
 import cn.dev33.satoken.dao.SaTokenDao;
@@ -98,7 +98,7 @@ public class XPluginImp implements Plugin {
         });
 
         // 注入自定义注解处理器 Bean （可以有多个）
-        context.subBeansOfType(SaAnnotationAbstractHandler.class, sl -> {
+        context.subBeansOfType(SaAnnotationHandlerInterface.class, sl -> {
             SaAnnotationStrategy.instance.registerAnnotationHandler(sl);
         });
 
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
index 69d4777e..ce9ff0d3 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/SaBeanInject.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.spring;
 
 import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.annotation.handler.SaAnnotationAbstractHandler;
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.config.SaTokenConfig;
 import cn.dev33.satoken.context.SaTokenContext;
 import cn.dev33.satoken.context.second.SaTokenSecondContextCreator;
@@ -126,8 +126,8 @@ public class SaBeanInject {
 	 * @param handlerList 自定义注解处理器集合
 	 */
 	@Autowired(required = false)
-	public void setSaAnnotationHandler(List<SaAnnotationAbstractHandler<?>> handlerList) {
-		for (SaAnnotationAbstractHandler<?> handler : handlerList) {
+	public void setSaAnnotationHandler(List<SaAnnotationHandlerInterface<?>> handlerList) {
+		for (SaAnnotationHandlerInterface<?> handler : handlerList) {
 			SaAnnotationStrategy.instance.registerAnnotationHandler(handler);
 		}
 	}
-- 
Gitee


From 1bc59dc14cb3bb5ce0d7928b54f40f9415f1fab3 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Tue, 20 Aug 2024 17:34:18 +0800
Subject: [PATCH 141/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20=5FFINALLY=5FWORK?=
 =?UTF-8?q?=5FSCOPE=20=E6=9C=80=E7=BB=88=E6=9D=83=E9=99=90=E5=A4=84?=
 =?UTF-8?q?=E7=90=86=E5=99=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../oauth2/oauth2-custom-scope-handler.md     | 45 ++++++++++++++++++-
 .../satoken/oauth2/consts/SaOAuth2Consts.java |  7 ++-
 .../oauth2/strategy/SaOAuth2Strategy.java     |  9 ++++
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
index 2a391c80..17e9548e 100644
--- a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
+++ b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
@@ -175,4 +175,47 @@ http://sa-oauth-server.com:8000/oauth2/token
 拿到 userinfo。
 
 #### 总结
-相比于自定义接口模式，自定义权限处理器模式可以少一次网络请求，提前拿到 `userinfo` 信息。
\ No newline at end of file
+相比于自定义接口模式，自定义权限处理器模式可以少一次网络请求，让 oauth2-client 端提前拿到 `userinfo` 信息。
+
+
+
+### 4、最终权限处理器
+当一个自定义权限处理器，监听的 scope 字符串为 `_FINALLY_WORK_SCOPE` 时，则代表这个权限处理器为“最终权限处理器”。
+
+最终权限处理器会永远在所有权限处理器工作完成之后执行一次，即使 oauth2-client 端没有申请任何 scope，最终权限处理器也会固定执行。
+
+示例：
+``` java
+/**
+ * 最终权限处理器：在所有权限处理器工作完成之后，执行此权限处理器
+ */
+@Component
+public class FinallyWorkScopeHandler implements SaOAuth2ScopeHandlerInterface {
+
+    @Override
+    public String getHandlerScope() {
+        return SaOAuth2Consts._FINALLY_WORK_SCOPE;
+    }
+
+    @Override
+    public void workAccessToken(AccessTokenModel at) {
+        // 在所有权限处理器工作完成之后，执行此处方法加工 AccessToken
+        // System.out.println(123);
+    }
+
+    @Override
+    public void workClientToken(ClientTokenModel ct) {
+        // System.out.println(456);
+    }
+}
+```
+
+
+
+
+
+
+
+
+
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index a6e104c4..9311a0a3 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -111,5 +111,10 @@ public class SaOAuth2Consts {
 
 	/** 表示请求没有得到任何有效处理 {msg: "not handle"} */
 	public static final String NOT_HANDLE = "{\"msg\": \"not handle\"}";
-	
+
+	/**
+	 * 最终权限处理器标识符：在所有权限处理器执行之后，执行此 scope 标识符代表的权限处理器
+	 */
+	public static final String _FINALLY_WORK_SCOPE = "_FINALLY_WORK_SCOPE";
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index 05aa59f5..f1dc0187 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.strategy;
 
 import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.function.strategy.*;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
@@ -92,6 +93,10 @@ public final class SaOAuth2Strategy {
 				}
 			}
 		}
+		SaOAuth2ScopeHandlerInterface finallyWorkScopeHandler = scopeHandlerMap.get(SaOAuth2Consts._FINALLY_WORK_SCOPE);
+		if(finallyWorkScopeHandler != null) {
+			finallyWorkScopeHandler.workAccessToken(at);
+		}
 	};
 
 	/**
@@ -106,6 +111,10 @@ public final class SaOAuth2Strategy {
 				}
 			}
 		}
+		SaOAuth2ScopeHandlerInterface finallyWorkScopeHandler = scopeHandlerMap.get(SaOAuth2Consts._FINALLY_WORK_SCOPE);
+		if(finallyWorkScopeHandler != null) {
+			finallyWorkScopeHandler.workClientToken(ct);
+		}
 	};
 
 	/**
-- 
Gitee


From 4aa494159806b73f3fe0ced0ccfe1e4dfb46ba8c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 21 Aug 2024 13:57:05 +0800
Subject: [PATCH 142/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20scope=20=E7=AD=89?=
 =?UTF-8?q?=E7=BA=A7=E5=88=92=E5=88=86=EF=BC=8C=E5=8F=AF=E6=8C=87=E5=AE=9A?=
 =?UTF-8?q?=E5=93=AA=E4=BA=9B=E6=9D=83=E9=99=90=E9=9C=80=E8=A6=81=E5=BC=BA?=
 =?UTF-8?q?=E5=88=B6=E6=AF=8F=E6=AC=A1=E6=89=8B=E5=8A=A8=E6=8E=88=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/context/model/SaRequest.java      |  21 ++-
 .../java/cn/dev33/satoken/util/SaFoxUtil.java |  59 ++++++++
 .../pj/oauth2/SaOAuth2ServerController.java   |   2 +-
 .../src/main/resources/application.yml        |   4 +
 .../src/main/resources/templates/confirm.html |  19 ++-
 sa-token-doc/_sidebar.md                      |   9 +-
 sa-token-doc/oauth2/oauth2-apidoc.md          |  78 +++++++++-
 .../oauth2/oauth2-custom-scope-handler.md     |   2 +-
 sa-token-doc/oauth2/oauth2-scope-level.md     | 137 ++++++++++++++++++
 sa-token-doc/oauth2/oauth2-server.md          |  14 +-
 sa-token-doc/static/doc.css                   |  10 +-
 .../satoken/oauth2/config/SaOAuth2Config.java |  98 ++++++++++---
 .../satoken/oauth2/consts/SaOAuth2Consts.java |   1 +
 .../oauth2/error/SaOAuth2ErrorCode.java       |   5 +-
 .../processor/SaOAuth2ServerProcessor.java    | 105 ++++++++++----
 .../oauth2/template/SaOAuth2Template.java     |  52 +++++++
 16 files changed, 545 insertions(+), 71 deletions(-)
 create mode 100644 sa-token-doc/oauth2/oauth2-scope-level.md

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java b/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
index 7c0c0fa9..8a0b3d45 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
@@ -17,6 +17,7 @@ package cn.dev33.satoken.context.model;
 
 import cn.dev33.satoken.error.SaErrorCode;
 import cn.dev33.satoken.exception.SaTokenException;
+import cn.dev33.satoken.router.SaHttpMethod;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.List;
@@ -156,7 +157,25 @@ public interface SaRequest {
 	 * @return /
 	 */
 	String getMethod();
-	
+
+	/**
+	 * 返回当前请求 Method 是否为指定值
+	 * @param method method
+	 * @return /
+	 */
+	default boolean isMethod(String method) {
+		return getMethod().equals(method);
+	}
+
+	/**
+	 * 返回当前请求 Method 是否为指定值
+	 * @param method method
+	 * @return /
+	 */
+	default boolean isMethod(SaHttpMethod method) {
+		return getMethod().equals(method.name());
+	}
+
 	/**
 	 * 判断此请求是否为 Ajax 异步请求
 	 * @return /
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
index 530e1fbd..4994bde0 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
@@ -678,4 +678,63 @@ public class SaFoxUtil {
 		return false;
 	}
 
+	/**
+	 * list1 是否完全包含 list2 中所有元素
+	 * @param list1 集合1
+	 * @param list2 集合2
+	 * @return /
+	 */
+	public static boolean list1ContainList2AllElement(List<String> list1, List<String> list2){
+		if(list2 == null || list2.isEmpty()) {
+			return true;
+		}
+		if(list1 == null || list1.isEmpty()) {
+			return false;
+		}
+		for (String str : list2) {
+			if(!list1.contains(str)) {
+				return false;
+			}
+		}
+		return true;
+	}
+
+	/**
+	 * list1 是否包含 list2 中任意一个元素
+	 * @param list1 集合1
+	 * @param list2 集合2
+	 * @return /
+	 */
+	public static boolean list1ContainList2AnyElement(List<String> list1, List<String> list2){
+		if(list1 == null || list1.isEmpty() || list2 == null || list2.isEmpty()) {
+			return false;
+		}
+		for (String str : list2) {
+			if(list1.contains(str)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	/**
+	 * 从 list1 中剔除 list2 所包含的元素 （克隆副本操作，不影响 list1）
+	 * @param list1 集合1
+	 * @param list2 集合2
+	 * @return /
+	 */
+	public static List<String> list1RemoveByList2(List<String> list1, List<String> list2){
+		if(list1 == null) {
+			return null;
+		}
+		if(list1.isEmpty() || list2 == null || list2.isEmpty()) {
+			return new ArrayList<>(list1);
+		}
+		List<String> listX = new ArrayList<>(list1);
+		for (String str : list2) {
+			listX.remove(str);
+		}
+		return listX;
+	}
+
 }
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 58d75726..37261fd0 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -57,7 +57,7 @@ public class SaOAuth2ServerController {
 		};
 	}
 
-	
+
 	// ---------- 开放相关资源接口： Client端根据 Access-Token ，置换相关资源 ------------ 
 	
 	// 获取 userinfo 信息：昵称、头像、性别等等
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index 44f39cd0..073f9d06 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -15,6 +15,10 @@ sa-token:
         enable-password: true
         # 是否全局开启客户端模式
         enable-client: true
+        # 定义哪些 scope 是高级权限，多个用逗号隔开
+        # higher-scope: openid,userid
+        # 定义哪些 scope 是低级权限，多个用逗号隔开
+        # lower-scope: userinfo
 
 spring: 
     # redis配置 
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/templates/confirm.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/templates/confirm.html
index 7ede1714..cfeaf099 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/templates/confirm.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/templates/confirm.html
@@ -33,20 +33,31 @@
 				console.log('-----------');
 				$.ajax({
 					url: '/oauth2/doConfirm',
+					method: "POST",
 					data: {
 						client_id: getParam('client_id'),
-						scope: getParam('scope')
+						scope: getParam('scope'),
+						// 以下四个参数必须一起出现
+						build_redirect_uri: true,
+						response_type: getParam('response_type'),
+						redirect_uri: getParam('redirect_uri'),
+						state: getParam('state'),
 					},
 					dataType: 'json',
 					success: function(res) {
-						if(res.code == 200) {
+						console.log('res：', res);
+						if(res.code === 200) {
 							layer.msg('授权成功！');
 							setTimeout(function() {
-								location.reload(true);
+								if (res.redirect_uri) {
+									location.href = res.redirect_uri;
+								} else {
+									location.reload();
+								}
 							}, 800);
 						} else {
 							// 重定向至授权失败URL 
-							layer.alert('授权失败！');
+							layer.alert('授权失败:' + res.msg);
 						}
 					},
 					error: function(e) {
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index f742c13f..cdd29799 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -59,13 +59,14 @@
 	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
 	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
 	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope-handler)
-	- [为 Scope 划分等级](/oauth2/7)
-	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
-	- [平台中心模式开发](/oauth2/5)
+	- [为 Scope 划分等级](/oauth2/oauth2-scope-level)
+	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
 	- [常见问题说明](/oauth2/8)
-	- <!-- jwt风格token、使用注解校验权限、OAuth2整个流程参考、state参数详解 -->
+	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
+	<!-- - [平台中心模式开发](/oauth2/5) -->
+	- <!-- jwt风格token、使用注解校验权限、state参数详解 -->
 
 - **微服务**
 	- [分布式Session会话](/micro/dcs-session)
diff --git a/sa-token-doc/oauth2/oauth2-apidoc.md b/sa-token-doc/oauth2/oauth2-apidoc.md
index eedcdf04..a1b7b10f 100644
--- a/sa-token-doc/oauth2/oauth2-apidoc.md
+++ b/sa-token-doc/oauth2/oauth2-apidoc.md
@@ -43,6 +43,82 @@ redirect_uri?code={code}&state={state}
 4. 每次授权产生新 `Code` 码，会导致旧 `Code` 码立即作废，即使旧 `Code` 码尚未使用。
 
 
+<details>
+<summary>RestAPI 登录接口：/oauth2/doLogin</summary>
+
+如果用户在 OAuth-Server 端尚未登录，则会被阻塞在登录界面，开始登录，需要在页面上调用`/oauth2/doLogin`完成登录（此接口非 OAuth2 标准协议接口）
+
+``` url
+http://{host}:{port}/oauth2/doLogin
+	?name={name}
+	&pwd={pwd}
+```
+参数详解：
+
+| 参数			| 是否必填	| 说明													|
+| :--------		| :--------	| :--------												|
+| name			| 否		| 账号													|
+| pwd			| 否		| 密码													|
+
+访问此接口将进入自定义的 `cfg.doLoginHandle` 函数开始登录，你只要在此函数内调用 `StpUtil.login(xxx)` 即代表登录成功。
+
+另外需要注意：此接口并非只能携带 `name`、`pwd` 参数，因为你可以在方法里通过 `SaHolder.getRequest().getParam("xxx")` 来获取前端提交的其它参数。
+
+</details>
+
+
+<details>
+<summary>RestAPI 确认授权接口：/oauth2/doConfirm</summary>
+
+如果 oauth-client 端申请的 scope 在 OAuth-Server 端需要用户手动确认授权，则会被阻塞在授权界面，
+需要在页面上调用`/oauth2/doConfirm`完成授权（此接口非 OAuth2 标准协议接口）
+
+``` url
+http://{host}:{port}/oauth2/doConfirm
+    ?client={value}
+    &scope={value}
+    &build_redirect_uri={true|false}
+    &response_type={value}
+    &redirect_uri={value}
+    &state={value}
+```
+参数详解：
+
+| 参数					| 是否必填	| 说明													|
+| :--------				| :--------	| :--------												|
+| client_id				| 是		| 应用 id												|
+| scope					| 是		| 具体确认的权限，多个用逗号(或空格)隔开					|
+| build_redirect_uri	| 否		| 是否立即构建 `redirect_uri` 授权地址，取值：true | false		|
+| response_type			| 否		| 取 url 上的 `response_type` 参数来提交					|
+| redirect_uri			| 否		| 取 url 上的 `redirect_uri` 参数来提交					|
+| state					| 否		| 取 url 上的 `state` 参数来提交							|
+
+此接口有两种调用方式，一种只提供 `client_id`、`scope` 两个参数，此时返回结果代表是否确认授权成功：
+``` js
+{
+    code: 200, 
+    msg: 'ok', 
+    data: null,
+}
+```
+
+一种是指定 `build_redirect_uri: true`，并同时提供 `client_id`、`scope`、`response_type`、`redirect_uri`、`state` 全部参数，
+此时返回结果包括最终的 code 授权地址：
+``` js
+{
+    code: 200, 
+    msg: 'ok', 
+    data: null,
+	redirect_uri: 'http://sa-oauth-client.com:8002/?code=n12TTc1M9REfJVqKm0wewDz0tNZDBhE1A90irOJmxD0zb92pdhUK8NghJfuC'
+}
+```
+
+前端在 ajax 回调函数中直接使用 `location.href=res.redirect_uri` 跳转即可，无需再重复访问 `/oauth2/authorize` 接口。
+
+</details>
+
+
+
 ### 1.2、根据授权码获取 Access-Token
 获得 `Code` 码后，我们可以通过以下接口，获取到用户的 `Access-Token`、`Refresh-Token` 等信息。
 
@@ -138,7 +214,7 @@ http://{host}:{port}/oauth2/revoke
 
 
 ### 1.5、根据 Access-Token 获取相应用户的账号信息  
-注：此接口为官方仓库模拟接口，正式项目中大家可以根据此样例，自定义需要的接口及参数 
+注：此接口非 OAuth2 标准协议接口，为官方仓库 demo 模拟接口，正式项目中大家可以根据此样例，自定义需要的接口及参数 
 
 ``` url
 http://{host}:{port}/oauth2/userinfo?access_token={access_token}
diff --git a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
index 17e9548e..58207223 100644
--- a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
+++ b/sa-token-doc/oauth2/oauth2-custom-scope-handler.md
@@ -139,7 +139,7 @@ http://sa-oauth-server.com:8000/oauth2/authorize
 
 
 #### 3、code 换 access_token
-3、访问上述链接后，得到 `code` 授权码，然后我们拿着 `code` 换 `access_token`
+访问上述链接后，得到 `code` 授权码，然后我们拿着 `code` 换 `access_token`
 ``` url
 http://sa-oauth-server.com:8000/oauth2/token
     ?grant_type=authorization_code
diff --git a/sa-token-doc/oauth2/oauth2-scope-level.md b/sa-token-doc/oauth2/oauth2-scope-level.md
new file mode 100644
index 00000000..161065e7
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-scope-level.md
@@ -0,0 +1,137 @@
+# OAuth2 - 为 Scope 划分等级
+
+
+### 1、划分等级 
+
+我们可以通过配置文件来为 scope 划分等级
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# sa-token 配置
+sa-token: 
+    # OAuth2.0 配置 
+    oauth2:
+        # 定义哪些 scope 是高级权限，多个用逗号隔开
+        higher-scope: openid,userid
+        # 定义哪些 scope 是低级权限，多个用逗号隔开
+        lower-scope: userinfo
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 定义哪些 scope 是高级权限，多个用逗号隔开
+sa-token.oauth2.higher-scope=openid,userid
+# 定义哪些 scope 是低级权限，多个用逗号隔开
+sa-token.oauth2.lower-scope=userinfo
+```
+<!---------------------------- tabs:end ---------------------------->
+
+如上所示：
+- 通过 `sa-token.oauth2.higher-scope` 配置项指定的 `scope` 将变成 **高级权限**。
+- 通过 `sa-token.oauth2.lower-scope` 配置项指定的 `scope` 将变成 **低级权限**。
+- 其它未指定的 `scope` 将默认为 **一般权限**。
+
+不同的权限等级其差异主要表现在：oauth2-client 授权时是否需要用户手动确认授权。
+
+| 权限等级		| 申请授权时表现						| 
+| :--------		| :--------							| 
+| 高级权限		| 申请授权时：每次都需要用户手动点击确认授权按钮，才会下放 code 授权码	| 
+| 一般权限		| 申请授权时：如果申请的 scope 用户近期授权过，则静默授权，如果近期未授权过，则需要手动点击确认授权按钮		| 
+| 低级权限		| 申请授权时：不需要用户手动点击确认授权，程序自动完成静默授权						| 
+
+
+### 2、详细举例
+
+1、如下例子，oauth2-client 申请的 `openid` 权限为**高级权限**，每次都需要用户手动点击确认授权按钮，才会下放 code 授权码。
+
+``` url
+http://{host}:{port}/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=openid
+```
+
+2、如下例子，oauth2-client 申请的 `userinfo` 权限为**低级权限**，此时不需要用户手动点击确认授权，程序自动完成静默授权。
+
+``` url
+http://{host}:{port}/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=userinfo
+```
+
+3、如下例子，oauth2-client 申请的 `fans_list` 权限为**一般权限**，首次申请时，需要用户手动点击确认授权，第二次再申请则是静默授权。
+
+``` url
+http://{host}:{port}/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=fans_list
+```
+
+4、如下例子，oauth2-client 申请的 `openid,userid,userinfo,fans_list` 权限同时包括 **高级权限**、**低级权限**、**一般权限**：
+
+``` url
+http://{host}:{port}/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=openid,userid,userinfo,fans_list
+```
+
+此时是否需要用户手动点击确认授权按钮？具体规则表现为：
+- 如果请求的 scope 列表包括高级权限，则必须用户手动点击确认授权。
+- 如果 scope 列表不包括高级权限，则将 scope 列表中的所有低级权限剔除。
+- 剔除后的 list 大小如果为零，则直接静默授权通过。
+- 剔除后的 list 大小如果不为零，则判断剩余的这些 scope 是否全部已近期授权过：
+	- 如果是，则静默授权。
+	- 如果否，则需要用户手动点击确认授权。
+
+
+### 3、申请高级权限时 `/oauth2/authorize` 无法通过验证
+
+由于申请高级权限时，每次都必须用户手动点击确认授权，`/oauth2/authorize` 路由接口是无法完成权限验证操作的。
+
+此时需要将构建 `redirect_uri` 的动作提前，在 `/oauth2/doConfirm` 确认授权接口时额外追加 `build_redirect_uri: true` 等参数：
+``` url
+http://{host}:{port}/oauth2/doConfirm
+    ?client={value}
+    &scope={value}
+    &build_redirect_uri=true
+    &response_type={value}
+    &redirect_uri={value}
+    &state={value}
+```
+
+返回结果示例：
+``` js
+{
+	code: 200, 
+	msg: 'ok', 
+	data: null,
+	redirect_uri: 'http://sa-oauth-client.com:8002/?code=n12TTc1M9REfJVqKm0wewDz0tNZDBhE1A90irOJmxD0zb92pdhUK8NghJfuC'
+}
+```
+
+其中 `redirect_uri` 参数为授权挂载code地址，直接在 ajax 回调函数中使用 `location.href=res.redirect_uri` 跳转即可。
+
+自定义确认授权视图修改参考：
+``` java
+// 授权确认视图
+cfg.confirmView = (clientId, scopes)->{
+	String scopeStr = SaFoxUtil.convertListToString(scopes);
+	String yesCode =
+			"fetch('/oauth2/doConfirm' + location.search + '&build_redirect_uri=true', {method: 'POST'})" +
+					".then(res => res.json())" +
+					".then(res => location.href=res.redirect_uri)";
+	String res = "<p>应用 " + clientId + " 请求授权：" + scopeStr + "，是否同意？</p>"
+			+ "<p>" +
+			"		<button onclick=\"" + yesCode + "\">同意</button>" +
+			"		<button onclick='history.back()'>拒绝</button>" +
+			"</p>";
+	return res;
+};
+```
\ No newline at end of file
diff --git a/sa-token-doc/oauth2/oauth2-server.md b/sa-token-doc/oauth2/oauth2-server.md
index ad4a1724..de684040 100644
--- a/sa-token-doc/oauth2/oauth2-server.md
+++ b/sa-token-doc/oauth2/oauth2-server.md
@@ -119,10 +119,16 @@ public class SaOAuth2ServerController {
 		// 配置：确认授权时返回的 view 
 		cfg.confirmView = (clientId, scopes) -> {
 			String scopeStr = SaFoxUtil.convertListToString(scopes);
-			String msg = "<p>应用 " + clientId + " 请求授权：" + scopeStr + "</p>"
-					+ "<p>请确认：<a href='/oauth2/doConfirm?client_id=" + clientId + "&scope=" + scopeStr + "' target='_blank'> 确认授权 </a></p>"
-					+ "<p>确认之后刷新页面</p>";
-			return msg;
+			String yesCode =
+					"fetch('/oauth2/doConfirm?client_id=" + clientId + "&scope=" + scopeStr + "', {method: 'POST'})" +
+					".then(res => res.json())" +
+					".then(res => location.reload())";
+			String res = "<p>应用 " + clientId + " 请求授权：" + scopeStr + "，是否同意？</p>"
+					+ "<p>" +
+					"		<button onclick=\"" + yesCode + "\">同意</button>" +
+					"		<button onclick='history.back()'>拒绝</button>" +
+					"</p>";
+			return res;
 		};
 	}
 
diff --git a/sa-token-doc/static/doc.css b/sa-token-doc/static/doc.css
index 7806a12d..fe7b8c93 100644
--- a/sa-token-doc/static/doc.css
+++ b/sa-token-doc/static/doc.css
@@ -413,13 +413,14 @@ body {
 	background-color: #f4fdef;
 	overflow: hidden;
 	max-height: 44px;
+	margin-bottom: 1em;
 	/* transition: all 1s; */
 }
-.main-box details[open]{ /* max-height: 1000px; */ overflow: auto; animation: slideDown 0.4s linear both;}
+.main-box details[open]{ /* max-height: 1000px; */ overflow: auto; animation: slideDown 0.6s linear both;}
 @keyframes slideDown {
     0% { max-height: 44px; overflow: hidden; }
-    99% { max-height: 1000px; overflow: hidden; }
-    100% { max-height: 1000px; overflow: auto; }
+    99% { max-height: 1500px; overflow: hidden; }
+    100% { max-height: 1500px; overflow: auto; }
 }
 .main-box details summary{
 	padding: 11px 14px;
@@ -429,8 +430,9 @@ body {
 }
 .main-box details pre{
 	margin-left: 1em;
-	margin-right: 14px;
+	margin-right: 1em;
 }
+.main-box details table{margin-left: 1em !important; margin-right: 1em; width: auto;}
 .main-box details p{padding: 0 14px;}
 
 /* 广告盒子 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
index 41cab136..0bb39073 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
@@ -66,7 +66,11 @@ public class SaOAuth2Config implements Serializable {
 	/** 默认 openid 生成算法中使用的摘要前缀 */
 	public String openidDigestPrefix = SaOAuth2Consts.OPENID_DEFAULT_DIGEST_PREFIX;
 
+	/** 指定高级权限，多个用逗号隔开 */
+	public String higherScope;
 
+	/** 指定低级权限，多个用逗号隔开 */
+	public String lowerScope;
 
 	/**
 	 * @return enableCode
@@ -77,9 +81,11 @@ public class SaOAuth2Config implements Serializable {
 
 	/**
 	 * @param enableCode 要设置的 enableCode
+	 * @return /
 	 */
-	public void setEnableCode(Boolean enableCode) {
+	public SaOAuth2Config setEnableCode(Boolean enableCode) {
 		this.enableCode = enableCode;
+		return this;
 	}
 
 	/**
@@ -91,9 +97,11 @@ public class SaOAuth2Config implements Serializable {
 
 	/**
 	 * @param enableImplicit 要设置的 enableImplicit
+	 * @return /
 	 */
-	public void setEnableImplicit(Boolean enableImplicit) {
+	public SaOAuth2Config setEnableImplicit(Boolean enableImplicit) {
 		this.enableImplicit = enableImplicit;
+		return this;
 	}
 
 	/**
@@ -106,8 +114,9 @@ public class SaOAuth2Config implements Serializable {
 	/**
 	 * @param enablePassword 要设置的 enablePassword
 	 */
-	public void setEnablePassword(Boolean enablePassword) {
+	public SaOAuth2Config setEnablePassword(Boolean enablePassword) {
 		this.enablePassword = enablePassword;
+		return this;
 	}
 
 	/**
@@ -119,9 +128,11 @@ public class SaOAuth2Config implements Serializable {
 
 	/**
 	 * @param enableClient 要设置的 enableClient
+	 * @return /
 	 */
-	public void setEnableClient(Boolean enableClient) {
+	public SaOAuth2Config setEnableClient(Boolean enableClient) {
 		this.enableClient = enableClient;
+		return this;
 	}
 
 	/**
@@ -133,9 +144,11 @@ public class SaOAuth2Config implements Serializable {
 
 	/**
 	 * @param isNewRefresh 要设置的 isNewRefresh
+	 * @return /
 	 */
-	public void setIsNewRefresh(Boolean isNewRefresh) {
+	public SaOAuth2Config setIsNewRefresh(Boolean isNewRefresh) {
 		this.isNewRefresh = isNewRefresh;
+		return this;
 	}
 
 	/**
@@ -229,13 +242,53 @@ public class SaOAuth2Config implements Serializable {
 	 * @param openidDigestPrefix 要设置的 openidDigestPrefix
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setOpenidMd5Prefix(String openidDigestPrefix) {
+	public SaOAuth2Config setOpenidDigestPrefix(String openidDigestPrefix) {
 		this.openidDigestPrefix = openidDigestPrefix;
 		return this;
 	}
 
-	
-	// -------------------- SaOAuth2Handle 所有回调函数 -------------------- 
+	/**
+	 * 获取 指定高级权限，多个用逗号隔开
+	 *
+	 * @return higherScope 指定高级权限，多个用逗号隔开
+	 */
+	public String getHigherScope() {
+		return this.higherScope;
+	}
+
+	/**
+	 * 设置 指定高级权限，多个用逗号隔开
+	 *
+	 * @param higherScope 指定高级权限，多个用逗号隔开
+	 * @return /
+	 */
+	public SaOAuth2Config setHigherScope(String higherScope) {
+		this.higherScope = higherScope;
+		return this;
+	}
+
+	/**
+	 * 获取 指定低级权限，多个用逗号隔开
+	 *
+	 * @return lowerScope 指定低级权限，多个用逗号隔开
+	 */
+	public String getLowerScope() {
+		return this.lowerScope;
+	}
+
+	/**
+	 * 设置 指定低级权限，多个用逗号隔开
+	 *
+	 * @param lowerScope 指定低级权限，多个用逗号隔开
+	 * @return /
+	 */
+	public SaOAuth2Config setLowerScope(String lowerScope) {
+		this.lowerScope = lowerScope;
+		return this;
+	}
+
+
+	// -------------------- SaOAuth2Handle 所有回调函数 --------------------
 	
 	/**
 	 * OAuth-Server端：未登录时返回的View 
@@ -254,19 +307,20 @@ public class SaOAuth2Config implements Serializable {
 
 	@Override
 	public String toString() {
-		return "SaOAuth2Config [" +
-				"enableCode=" + enableCode
-				+ ", enableImplicit=" + enableImplicit
-				+ ", enablePassword=" + enablePassword
-				+ ", enableClient=" + enableClient
-				+ ", isNewRefresh=" + isNewRefresh
-				+ ", codeTimeout=" + codeTimeout
-				+ ", accessTokenTimeout=" + accessTokenTimeout
-				+ ", refreshTokenTimeout=" + refreshTokenTimeout
-				+ ", clientTokenTimeout=" + clientTokenTimeout
-				+ ", pastClientTokenTimeout=" + pastClientTokenTimeout
-				+ ", openidDigestPrefix=" + openidDigestPrefix
-				+"]";
+		return "SaOAuth2Config{" +
+				"enableCode=" + enableCode +
+				", enableImplicit=" + enableImplicit +
+				", enablePassword=" + enablePassword +
+				", enableClient=" + enableClient +
+				", isNewRefresh=" + isNewRefresh +
+				", codeTimeout=" + codeTimeout +
+				", accessTokenTimeout=" + accessTokenTimeout +
+				", refreshTokenTimeout=" + refreshTokenTimeout +
+				", clientTokenTimeout=" + clientTokenTimeout +
+				", pastClientTokenTimeout=" + pastClientTokenTimeout +
+				", openidDigestPrefix='" + openidDigestPrefix +
+				", higherScope='" + higherScope +
+				", lowerScope='" + lowerScope +
+				'}';
 	}
-	
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index 9311a0a3..1ecd5425 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -57,6 +57,7 @@ public class SaOAuth2Consts {
 		public static String password = "password";
 		public static String name = "name";
 		public static String pwd = "pwd";
+		public static String build_redirect_uri = "build_redirect_uri";
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
index fa15e0d4..b6f3cbd7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
@@ -112,5 +112,8 @@ public interface SaOAuth2ErrorCode {
 	
 	/** 暂未开放凭证式模式 */
 	int CODE_30134 = 30134;
-	
+
+	/** 无效的请求 Method */
+	int CODE_30141 = 30141;
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 55857340..e5d3af01 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -35,6 +35,7 @@ import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
+import cn.dev33.satoken.router.SaHttpMethod;
 import cn.dev33.satoken.stp.StpLogic;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -124,28 +125,7 @@ public class SaOAuth2ServerProcessor {
 		String responseType = req.getParamNotNull(Param.response_type);
 
 		// 1、先判断是否开启了指定的授权模式
-		// 		模式一：Code授权码
-		if(responseType.equals(ResponseType.code)) {
-			if(!cfg.enableCode) {
-				throwErrorSystemNotEnableModel();
-			}
-			if(!currClientModel().enableCode) {
-				throwErrorClientNotEnableModel();
-			}
-		}
-		// 		模式二：隐藏式
-		else if(responseType.equals(ResponseType.token)) {
-			if(!cfg.enableImplicit) {
-				throwErrorSystemNotEnableModel();
-			}
-			if(!currClientModel().enableImplicit) {
-				throwErrorClientNotEnableModel();
-			}
-		}
-		// 		其它
-		else {
-			throw new SaOAuth2Exception("无效 response_type: " + req.getParam(Param.response_type)).setCode(SaOAuth2ErrorCode.CODE_30125);
-		}
+		checkAuthorizeResponseType(responseType, req, cfg);
 
 		// 2、如果尚未登录, 则先去登录
 		if( ! getStpLogic().isLogin()) {
@@ -162,8 +142,8 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkContract(ra.clientId, ra.scopes);
 
 		// 6、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
-		boolean isGrant = oauth2Template.isGrant(ra.loginId, ra.clientId, ra.scopes);
-		if( ! isGrant) {
+		boolean isNeedCarefulConfirm = oauth2Template.isNeedCarefulConfirm(ra.loginId, ra.clientId, ra.scopes);
+		if(isNeedCarefulConfirm) {
 			return cfg.confirmView.apply(ra.clientId, ra.scopes);
 		}
 
@@ -306,7 +286,7 @@ public class SaOAuth2ServerProcessor {
 		SaRequest req = SaHolder.getRequest();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
-		return cfg.doLoginHandle.apply(req.getParamNotNull(Param.name), req.getParamNotNull(Param.pwd));
+		return cfg.doLoginHandle.apply(req.getParam(Param.name), req.getParam(Param.pwd));
 	}
 
 	/**
@@ -316,13 +296,51 @@ public class SaOAuth2ServerProcessor {
 	public Object doConfirm() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-
 		String clientId = req.getParamNotNull(Param.client_id);
+		Object loginId = getStpLogic().getLoginId();
 		String scope = req.getParamNotNull(Param.scope);
 		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
-		Object loginId = getStpLogic().getLoginId();
+		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
+
+		// 此请求只允许 POST 方式
+		if(!req.isMethod(SaHttpMethod.POST)) {
+			throw new SaOAuth2Exception("无效请求方式：" + req.getMethod()).setCode(SaOAuth2ErrorCode.CODE_30141);
+		}
+
+		// 确认授权
 		oauth2Template.saveGrantScope(clientId, loginId, scopes);
-		return SaResult.ok();
+
+		// 判断所需的返回结果模式
+		boolean buildRedirectUri = req.isParam(Param.build_redirect_uri, "true");
+
+		// -------- 情况1：只返回确认结果即可
+		if( ! buildRedirectUri ) {
+			oauth2Template.saveGrantScope(clientId, loginId, scopes);
+			return SaResult.ok();
+		}
+
+		// -------- 情况2：需要返回最终的 redirect_uri 地址
+
+		// s3、构建请求 Model
+		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, loginId);
+
+		// 7、判断授权类型，构建不同的重定向地址
+		// 		如果是 授权码式，则：开始重定向授权，下放code
+		if(ResponseType.code.equals(ra.responseType)) {
+			CodeModel codeModel = dataGenerate.generateCode(ra);
+			String redirectUri = dataGenerate.buildRedirectUri(ra.redirectUri, codeModel.code, ra.state);
+			return SaResult.ok().set(Param.redirect_uri, redirectUri);
+		}
+
+		// 		如果是 隐藏式，则：开始重定向授权，下放 token
+		if(ResponseType.token.equals(ra.responseType)) {
+			AccessTokenModel at = dataGenerate.generateAccessToken(ra, false);
+			String redirectUri = dataGenerate.buildImplicitRedirectUri(ra.redirectUri, at.accessToken, ra.state);
+			return SaResult.ok().set(Param.redirect_uri, redirectUri);
+		}
+
+		// 默认返回
+		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
 	}
 
 	/**
@@ -408,6 +426,9 @@ public class SaOAuth2ServerProcessor {
 		return SaOAuth2Manager.getDataResolver().buildClientTokenReturnValue(ct);
 	}
 
+
+	// ----------- 代码块封装 --------------
+
 	/**
 	 * 根据当前请求提交的 client_id 参数获取 SaClientModel 对象 
 	 * @return / 
@@ -417,6 +438,34 @@ public class SaOAuth2ServerProcessor {
 		return oauth2Template.checkClientModel(clientIdAndSecret.clientId);
 	}
 
+	/**
+	 * 校验 authorize 路由的 ResponseType 参数
+	 */
+	public void checkAuthorizeResponseType(String responseType, SaRequest req, SaOAuth2Config cfg) {
+		// 模式一：Code授权码
+		if(responseType.equals(ResponseType.code)) {
+			if(!cfg.enableCode) {
+				throwErrorSystemNotEnableModel();
+			}
+			if(!currClientModel().enableCode) {
+				throwErrorClientNotEnableModel();
+			}
+		}
+		// 模式二：隐藏式
+		else if(responseType.equals(ResponseType.token)) {
+			if(!cfg.enableImplicit) {
+				throwErrorSystemNotEnableModel();
+			}
+			if(!currClientModel().enableImplicit) {
+				throwErrorClientNotEnableModel();
+			}
+		}
+		// 其它
+		else {
+			throw new SaOAuth2Exception("无效 response_type: " + req.getParam(Param.response_type)).setCode(SaOAuth2ErrorCode.CODE_30125);
+		}
+	}
+
 	/**
 	 * 获取底层使用的会话对象
 	 *
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 73422fae..3062f525 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -123,6 +123,7 @@ public class SaOAuth2Template {
 
 
 	// ------------------- check 数据校验
+
 	/**
 	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
 	 * @param loginId 账号id
@@ -135,6 +136,39 @@ public class SaOAuth2Template {
 		List<String> grantScopeList = dao.getGrantScope(clientId, loginId);
         return scopes.isEmpty() || new HashSet<>(grantScopeList).containsAll(scopes);
 	}
+
+	/**
+	 * 判断：指定 loginId 在指定 Client 请求指定 Scope 时，是否需要手动确认授权
+	 * @param loginId 账号id
+	 * @param clientId 应用id
+	 * @param scopes 权限
+	 * @return 是否已经授权
+	 */
+	public boolean isNeedCarefulConfirm(Object loginId, String clientId, List<String> scopes) {
+		// 如果请求的权限为空，则不需要确认
+		if(scopes == null || scopes.isEmpty()) {
+			return false;
+		}
+
+		// 如果包含高级权限，则必须手动确认授权
+		List<String> higherScopeList = getHigherScopeList();
+		if(SaFoxUtil.list1ContainList2AnyElement(scopes, higherScopeList)) {
+			return true;
+		}
+
+		// 如果包含低级权限，则先将低级权限剔除掉
+		List<String> lowerScopeList = getLowerScopeList();
+		scopes = SaFoxUtil.list1RemoveByList2(scopes, lowerScopeList);
+
+		// 如果剔除后的权限为空，则不需要确认
+		if(scopes.isEmpty()) {
+			return false;
+		}
+
+		// 根据近期授权记录，判断是否需要确认
+		return !isGrant(loginId, clientId, scopes);
+	}
+
 	/**
 	 * 校验：该Client是否签约了指定的Scope
 	 * @param clientId 应用id
@@ -362,6 +396,24 @@ public class SaOAuth2Template {
 		SaOAuth2Manager.getDao().saveGrantScope(clientId, loginId, scopes);
 	}
 
+	/**
+	 * 获取高级权限列表
+	 * @return /
+	 */
+	public List<String> getHigherScopeList() {
+		String higherScope = SaOAuth2Manager.getConfig().getHigherScope();
+		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(higherScope);
+	}
+
+	/**
+	 * 获取低级权限列表
+	 * @return /
+	 */
+	public List<String> getLowerScopeList() {
+		String lowerScope = SaOAuth2Manager.getConfig().getLowerScope();
+		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(lowerScope);
+	}
+
 
 
 
-- 
Gitee


From 3345e3aaf98be0f06a6c3d8e3af472d687781ce6 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 23 Aug 2024 03:24:30 +0800
Subject: [PATCH 143/172] =?UTF-8?q?sa-token-oauth2=20=E6=96=B0=E5=A2=9E?=
 =?UTF-8?q?=E8=87=AA=E5=AE=9A=E4=B9=89=20grant=5Ftype=20=E8=83=BD=E5=8A=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/util/SaFoxUtil.java |  11 ++
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  13 +-
 .../custom/PhoneCodeGrantTypeHandler.java     |  56 ++++++
 .../oauth2/custom/PhoneLoginController.java   |  26 +++
 .../{ => custom}/UserinfoScopeHandler.java    |   2 +-
 .../src/main/resources/application.yml        |   2 +
 sa-token-doc/_sidebar.md                      |   2 +-
 .../oauth2/oauth2-custom-grant_type.md        | 174 ++++++++++++++++++
 .../dev33/satoken/oauth2/SaOAuth2Manager.java |  39 ++++
 .../satoken/oauth2/consts/GrantType.java      |  12 ++
 .../satoken/oauth2/consts/SaOAuth2Consts.java |  11 --
 .../data/generate/SaOAuth2DataGenerate.java   |  18 +-
 .../data/model/loader/SaClientModel.java      | 126 +++----------
 .../SaOAuth2GrantTypeAuthFunction.java        |  35 ++++
 .../AuthorizationCodeGrantTypeHandler.java    |  57 ++++++
 .../handler/PasswordGrantTypeHandler.java     |  76 ++++++++
 .../handler/RefreshTokenGrantTypeHandler.java |  59 ++++++
 .../SaOAuth2GrantTypeHandlerInterface.java    |  46 +++++
 .../processor/SaOAuth2ServerProcessor.java    | 151 ++-------------
 .../oauth2/strategy/SaOAuth2Strategy.java     |  84 ++++++++-
 .../satoken/oauth2/template/SaOAuth2Util.java |  30 +--
 .../spring/oauth2/SaOAuth2BeanInject.java     |  25 ++-
 22 files changed, 778 insertions(+), 277 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
 rename sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/{ => custom}/UserinfoScopeHandler.java (97%)
 create mode 100644 sa-token-doc/oauth2/oauth2-custom-grant_type.md
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/GrantType.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2GrantTypeAuthFunction.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
index 4994bde0..8044a223 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
@@ -75,6 +75,17 @@ public class SaFoxUtil {
 		return sb.toString();
 	}
 
+	/**
+	 * 生成指定区间的 int 值
+	 *
+	 * @param min 最小值（包括）
+	 * @param max 最大值（包括）
+	 * @return /
+	 */
+	public static int getRandomNumber(int min, int max) {
+		return ThreadLocalRandom.current().nextInt(min, max + 1);
+	}
+
 	/**
 	 * 指定元素是否为null或者空字符串
 	 * @param str 指定元素
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index a7d10925..fbcc2863 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -1,5 +1,6 @@
 package com.pj.oauth2;
 
+import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import org.springframework.stereotype.Component;
@@ -22,10 +23,14 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
 					.addAllowUrls("*")    // 所有允许授权的 url
 					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
-					.setEnableCode(true)    	// 是否开启授权码模式
-					.setEnableImplicit(true)    // 是否开启隐式模式
-					.setEnablePassword(true)    // 是否开启密码模式
-					.setEnableClient(true)    	// 是否开启客户端模式
+					.addAllowGrantTypes(	 // 所有允许的授权模式
+							GrantType.authorization_code, // 授权码式
+							GrantType.implicit,  // 隐式式
+							GrantType.refresh_token,  // 刷新令牌
+							GrantType.password,  // 密码式
+							GrantType.client_credentials,  // 客户端模式
+							"phone_code"  // 自定义授权模式 手机号验证码登录
+					)
 			;
 		}
 		return null;
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
new file mode 100644
index 00000000..9bad7d29
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
@@ -0,0 +1,56 @@
+package com.pj.oauth2.custom;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.granttype.handler.SaOAuth2GrantTypeHandlerInterface;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+/**
+ * 自定义 phone_code 授权模式处理器
+ *
+ * @author click33
+ * @since 2024/8/23
+ */
+@Component
+public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+
+    @Override
+    public String getHandlerGrantType() {
+        return "phone_code";
+    }
+
+    @Override
+    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+
+        String phone = req.getParamNotNull("phone");
+        String code = req.getParamNotNull("code");
+        String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
+
+        // 1、校验验证码是否正确
+        if(!code.equals(realCode)) {
+            throw new SaOAuth2Exception("验证码错误");
+        }
+
+        // 2、校验通过，删除验证码
+        SaManager.getSaTokenDao().delete("phone_code:" + phone);
+
+        // 3、登录
+        long userId = 10001; // 模拟 userId，真实项目应该根据手机号从数据库查询
+
+        // 4、构建 ra 对象
+        RequestAuthModel ra = new RequestAuthModel();
+        ra.clientId = clientId;
+        ra.loginId = userId;
+        ra.scopes = scopes;
+
+        // 5、生成 Access-Token
+        AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
+        return at;
+    }
+}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
new file mode 100644
index 00000000..92cb3d99
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
@@ -0,0 +1,26 @@
+package com.pj.oauth2.custom;
+
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.util.SaFoxUtil;
+import cn.dev33.satoken.util.SaResult;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * 自定义手机登录接口
+ *
+ * @author click33
+ * @since 2024/8/23
+ */
+@RestController
+public class PhoneLoginController {
+
+    @RequestMapping("/oauth2/sendPhoneCode")
+    public SaResult sendCode(String phone) {
+        String code = SaFoxUtil.getRandomNumber(100000, 999999) + "";
+        SaManager.getSaTokenDao().set("phone_code:" + phone, code, 60 * 5);
+        System.out.println("手机号：" + phone + "，验证码：" + code + "，已发送成功");
+        return SaResult.ok("验证码发送成功");
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
similarity index 97%
rename from sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java
rename to sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
index afca1436..088e9f57 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/UserinfoScopeHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
@@ -1,4 +1,4 @@
-package com.pj.oauth2;
+package com.pj.oauth2.custom;
 
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index 073f9d06..0cd51d5c 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -5,6 +5,8 @@ server:
 sa-token: 
     # token名称 (同时也是 Cookie 名称)
     token-name: satoken-oauth2-server
+    # 是否打印操作日志
+    is-log: true
     # OAuth2.0 配置 
     oauth2:
         # 是否全局开启授权码模式
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index cdd29799..f87b8192 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -63,7 +63,7 @@
 	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
-	- [常见问题说明](/oauth2/8)
+	<!-- - [常见问题说明](/oauth2/8) -->
 	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
 	<!-- - [平台中心模式开发](/oauth2/5) -->
 	- <!-- jwt风格token、使用注解校验权限、state参数详解 -->
diff --git a/sa-token-doc/oauth2/oauth2-custom-grant_type.md b/sa-token-doc/oauth2/oauth2-custom-grant_type.md
new file mode 100644
index 00000000..071fab88
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-custom-grant_type.md
@@ -0,0 +1,174 @@
+# OAuth2-自定义权限处理器 
+
+
+### 1、需求场景
+
+OAuth2 协议的 `/oauth2/token` 接口定义了两种获取 `access_token` 的 `grant_type`，分别是：
+- `authorization_code`：使用用户授权的授权码获取 access_token。
+- `password`：使用用户提交的账号、密码来获取 access_token。
+
+除此之外，你还可以自定义 `grant_type`，来支持更多的场景。
+
+假设有以下需求：通过 手机号+验证码 登录，返回 `access_token`。
+
+--- 
+
+
+### 2、实现步骤
+
+#### 2.1、新增验证码发送接口
+
+首先在 oauth2-server 端开放一个接口，为指定手机号发送验证码。
+
+``` java
+/**
+ * 自定义手机登录接口
+ */
+@RestController
+public class PhoneLoginController {
+
+    @RequestMapping("/oauth2/sendPhoneCode")
+    public SaResult sendCode(String phone) {
+        String code = SaFoxUtil.getRandomNumber(100000, 999999) + "";
+        SaManager.getSaTokenDao().set("phone_code:" + phone, code, 60 * 5);
+        System.out.println("手机号：" + phone + "，验证码：" + code + "，已发送成功");
+        return SaResult.ok("验证码发送成功");
+    }
+
+}
+```
+
+真实项目肯定是要对接短信服务商的，此处我们仅做模拟代码，将发送的验证码打印在控制台上。
+
+
+#### 2.2、自定义 grant_type 处理器
+
+在 oauth2-server 新建 `PhoneCodeGrantTypeHandler` 实现 `SaOAuth2GrantTypeHandlerInterface` 接口：
+
+``` java
+/**
+ * 自定义 phone_code 授权模式处理器 
+ */
+@Component
+public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+
+    @Override
+    public String getHandlerGrantType() {
+        return "phone_code";
+    }
+
+    @Override
+    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+
+        String phone = req.getParamNotNull("phone");
+        String code = req.getParamNotNull("code");
+        String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
+
+        // 1、校验验证码是否正确
+        if(!code.equals(realCode)) {
+            throw new SaOAuth2Exception("验证码错误");
+        }
+
+        // 2、校验通过，删除验证码
+        SaManager.getSaTokenDao().delete("phone_code:" + phone);
+
+        // 3、登录
+        long userId = 10001; // 模拟 userId，真实项目应该根据手机号从数据库查询
+
+        // 4、构建 ra 对象
+        RequestAuthModel ra = new RequestAuthModel();
+        ra.clientId = clientId;
+        ra.loginId = userId;
+        ra.scopes = scopes;
+
+        // 5、生成 Access-Token
+        AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
+        return at;
+    }
+}
+```
+
+#### 2.3、为应用添加允许的授权类型
+
+在 `SaOAuth2DataLoader` 实现类中，为 client 的允许授权类型增加自定义的 `phone_code` 
+
+``` java
+// Sa-Token OAuth2：自定义数据加载器 
+@Component
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
+	@Override
+	public SaClientModel getClientModel(String clientId) {
+		if("1001".equals(clientId)) {
+			return new SaClientModel()
+					.setClientId("1001")  
+					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")  
+					.addAllowUrls("*")  
+					.addContractScopes("openid", "userid", "userinfo")  
+					.addAllowGrantTypes( 
+							GrantType.authorization_code, 
+							GrantType.implicit, 
+							GrantType.refresh_token, 
+							GrantType.password, 
+							GrantType.client_credentials, 
+							"phone_code"  // 重要代码：自定义授权模式 手机号验证码登录
+					)
+			;
+		}
+		return null;
+	}
+	// 其它代码 ... 
+}
+```
+
+完工，开始测试。
+
+
+### 3、测试步骤
+
+#### 1、先发送验证码 
+
+``` url
+http://sa-oauth-server.com:8000/oauth2/sendPhoneCode?phone=13144556677
+```
+
+#### 2、请求 token  
+
+注意 `grant_type` 要填写我们自定义的 `phone_code`，code 的具体值可以在后端的控制台上看到 
+
+``` url
+http://sa-oauth-server.com:8000/oauth2/token
+    ?grant_type=phone_code
+    &client_id=1001
+    &client_secret=aaaa-bbbb-cccc-dddd-eeee
+	&scope=openid
+    &phone=13144556677
+	&code={value}
+```
+
+返回结果参考如下：
+
+``` js
+{
+    "code": 200,
+    "msg": "ok",
+    "data": null,
+    "token_type": "bearer",
+    "access_token": "pfxRz6KVacwvKNu4IHmDsCJs33kvvARs2z1lTch7stog8nRt6rfVLowtAZ0E",
+    "refresh_token": "qcFD6Wo2qZidofXQtWF5oK5ML6ljHKufQ5SbouBxzGnHhnMjUG4VV0iXZhdE",
+    "expires_in": 7199,
+    "refresh_expires_in": 2591999,
+    "client_id": "1001",
+    "scope": "openid",
+    "openid": "ded91dc189a437dd1bac2274be167d50"
+}
+```
+
+
+
+
+
+
+
+
+
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 0d9d1790..8521d353 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -26,6 +26,9 @@ import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoaderDefaultImpl;
 import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
 import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolverDefaultImpl;
+import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
+import cn.dev33.satoken.stp.StpLogic;
+import cn.dev33.satoken.stp.StpUtil;
 
 /**
  * Sa-Token-OAuth2 模块 总控类
@@ -144,4 +147,40 @@ public class SaOAuth2Manager {
 		SaOAuth2Manager.dao = dao;
 	}
 
+	/**
+	 * OAuth2 模板方法 Bean
+	 */
+	private static volatile SaOAuth2Template template;
+	public static SaOAuth2Template getTemplate() {
+		if (template == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (template == null) {
+					setTemplate(new SaOAuth2Template());
+				}
+			}
+		}
+		return template;
+	}
+	public static void setTemplate(SaOAuth2Template template) {
+		SaOAuth2Manager.template = template;
+	}
+
+	/**
+	 * OAuth2 StpLogic
+	 */
+	private static volatile StpLogic stpLogic;
+	public static StpLogic getStpLogic() {
+		if (stpLogic == null) {
+			synchronized (SaOAuth2Manager.class) {
+				if (stpLogic == null) {
+					setStpLogic(StpUtil.stpLogic);
+				}
+			}
+		}
+		return stpLogic;
+	}
+	public static void setStpLogic(StpLogic stpLogic) {
+		SaOAuth2Manager.stpLogic = stpLogic;
+	}
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/GrantType.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/GrantType.java
new file mode 100644
index 00000000..d1238d43
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/GrantType.java
@@ -0,0 +1,12 @@
+package cn.dev33.satoken.oauth2.consts;
+
+/**
+ * 所有授权类型
+ */
+public final class GrantType {
+    public static String authorization_code = "authorization_code";
+    public static String refresh_token = "refresh_token";
+    public static String password = "password";
+    public static String client_credentials = "client_credentials";
+    public static String implicit = "implicit";
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index 1ecd5425..d2ab4bb8 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -68,17 +68,6 @@ public class SaOAuth2Consts {
 		public static String token = "token";
 	}
 
-	/**
-	 * 所有授权类型 
-	 */
-	public static final class GrantType {
-		public static String authorization_code = "authorization_code";
-		public static String refresh_token = "refresh_token";
-		public static String password = "password";
-		public static String client_credentials = "client_credentials";
-		public static String implicit = "implicit";
-	}
-
 	/**
 	 * 所有 token 类型
 	 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
index a4a1670b..6fbee6a3 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -35,21 +35,21 @@ public interface SaOAuth2DataGenerate {
      * @param ra 请求参数Model
      * @return 授权码Model
      */
-    public CodeModel generateCode(RequestAuthModel ra);
+    CodeModel generateCode(RequestAuthModel ra);
 
     /**
      * 构建Model：Access-Token
      * @param code 授权码Model
      * @return AccessToken Model
      */
-    public AccessTokenModel generateAccessToken(String code);
+    AccessTokenModel generateAccessToken(String code);
 
     /**
      * 刷新Model：根据 Refresh-Token 生成一个新的 Access-Token
      * @param refreshToken Refresh-Token值
      * @return 新的 Access-Token
      */
-    public AccessTokenModel refreshAccessToken(String refreshToken);
+    AccessTokenModel refreshAccessToken(String refreshToken);
 
     /**
      * 构建Model：Access-Token (根据RequestAuthModel构建，用于隐藏式 and 密码式)
@@ -57,7 +57,7 @@ public interface SaOAuth2DataGenerate {
      * @param isCreateRt 是否生成对应的Refresh-Token
      * @return Access-Token Model
      */
-    public AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt);
+    AccessTokenModel generateAccessToken(RequestAuthModel ra, boolean isCreateRt);
 
     /**
      * 构建Model：Client-Token
@@ -65,7 +65,7 @@ public interface SaOAuth2DataGenerate {
      * @param scopes 授权范围
      * @return Client-Token Model
      */
-    public ClientTokenModel generateClientToken(String clientId, List<String> scopes);
+    ClientTokenModel generateClientToken(String clientId, List<String> scopes);
 
     /**
      * 构建URL：下放Code URL (Authorization Code 授权码)
@@ -74,7 +74,7 @@ public interface SaOAuth2DataGenerate {
      * @param state state参数
      * @return 构建完毕的URL
      */
-    public String buildRedirectUri(String redirectUri, String code, String state);
+    String buildRedirectUri(String redirectUri, String code, String state);
 
     /**
      * 构建URL：下放Access-Token URL （implicit 隐藏式）
@@ -83,14 +83,12 @@ public interface SaOAuth2DataGenerate {
      * @param state state参数
      * @return 构建完毕的URL
      */
-    public String buildImplicitRedirectUri(String redirectUri, String token, String state);
+    String buildImplicitRedirectUri(String redirectUri, String token, String state);
 
     /**
      * 回收 Access-Token
      * @param accessToken Access-Token值
      */
-    public void revokeAccessToken(String accessToken);
-
-
+    void revokeAccessToken(String accessToken);
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index 248c1aef..f84ce3d2 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -52,25 +52,11 @@ public class SaClientModel implements Serializable {
 	 * 应用允许授权的所有URL
 	 */
 	public List<String> allowUrls;
-	
-	/** 此 Client 是否打开模式：授权码（Authorization Code） */
-	public Boolean enableCode = false;
-
-	/** 此 Client 是否打开模式：隐藏式（Implicit） */
-	public Boolean enableImplicit = false;
-
-	/** 此 Client 是否打开模式：密码式（Password） */
-	public Boolean enablePassword = false;
 
-	/** 此 Client 是否打开模式：凭证式（Client Credentials） */
-	public Boolean enableClient = false;
-
-//	/**
-//	 * 是否自动判断此 Client 开放的授权模式
-//	 * <br> 此值为true时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠全局设置
-//	 * <br> 此值为false时：四种模式（isCode、isImplicit、isPassword、isClient）是否生效，依靠局部配置+全局配置
-//	 */
-//	public Boolean isAutoMode = true;
+	/**
+	 * 应用允许的所有 grant_type
+	 */
+	public List<String> allowGrantTypes = new ArrayList<>();
 
 	/** 单独配置此Client：是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token [默认取全局配置] */
 	public Boolean isNewRefresh;
@@ -169,86 +155,22 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @return 此 Client 是否打开模式：授权码（Authorization Code）
-	 */
-	public Boolean getEnableCode() {
-		return enableCode;
-	}
-	
-	/**
-	 * @param enableCode 此 Client 是否打开模式：授权码（Authorization Code）
-	 * @return 对象自身 
-	 */
-	public SaClientModel setEnableCode(Boolean enableCode) {
-		this.enableCode = enableCode;
-		return this;
-	}
-	
-	/**
-	 * @return 此 Client 是否打开模式：隐藏式（Implicit）
-	 */
-	public Boolean getEnableImplicit() {
-		return enableImplicit;
-	}
-	
-	/**
-	 * @param enableImplicit 此 Client 是否打开模式：隐藏式（Implicit）
-	 * @return 对象自身 
-	 */
-	public SaClientModel setEnableImplicit(Boolean enableImplicit) {
-		this.enableImplicit = enableImplicit;
-		return this;
-	}
-	
-	/**
-	 * @return 此 Client 是否打开模式：密码式（Password）
-	 */
-	public Boolean getEnablePassword() {
-		return enablePassword;
-	}
-	
-	/**
-	 * @param enablePassword 此 Client 是否打开模式：密码式（Password）
-	 * @return 对象自身 
-	 */
-	public SaClientModel setEnablePassword(Boolean enablePassword) {
-		this.enablePassword = enablePassword;
-		return this;
-	}
-	
-	/**
-	 * @return 此 Client 是否打开模式：凭证式（Client Credentials）
+	 * @return 应用允许的所有 grant_type
 	 */
-	public Boolean getEnableClient() {
-		return enableClient;
+	public List<String> getAllowGrantTypes() {
+		return allowGrantTypes;
 	}
-	
+
 	/**
-	 * @param enableClient 此 Client 是否打开模式：凭证式（Client Credentials）
-	 * @return 对象自身 
+	 * 应用允许的所有 grant_type
+	 * @param allowGrantTypes /
+	 * @return /
 	 */
-	public SaClientModel setEnableClient(Boolean enableClient) {
-		this.enableClient = enableClient;
+	public SaClientModel setAllowGrantTypes(List<String> allowGrantTypes) {
+		this.allowGrantTypes = allowGrantTypes;
 		return this;
 	}
-//
-//	/**
-//	 * @return 是否自动判断此 Client 开放的授权模式
-//	 */
-//	public Boolean getIsAutoMode() {
-//		return isAutoMode;
-//	}
-//
-//	/**
-//	 * @param isAutoMode 是否自动判断此 Client 开放的授权模式
-//	 * @return 对象自身
-//	 */
-//	public SaClientModel setIsAutoMode(Boolean isAutoMode) {
-//		this.isAutoMode = isAutoMode;
-//		return this;
-//	}
-//
-	
+
 	/**
 	 * @return 此Client：是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token [默认取全局配置]
 	 */
@@ -338,11 +260,7 @@ public class SaClientModel implements Serializable {
 				", clientSecret='" + clientSecret + '\'' +
 				", contractScopes=" + contractScopes +
 				", allowUrls=" + allowUrls +
-				", isCode=" + enableCode +
-				", isImplicit=" + enableImplicit +
-				", isPassword=" + enablePassword +
-				", isClient=" + enableClient +
-//				", isAutoMode=" + isAutoMode +
+				", allowGrantTypes=" + allowGrantTypes +
 				", isNewRefresh=" + isNewRefresh +
 				", accessTokenTimeout=" + accessTokenTimeout +
 				", refreshTokenTimeout=" + refreshTokenTimeout +
@@ -367,7 +285,7 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @param urls 添加应用签约的所有权限
+	 * @param urls 添加应用允许授权的所有URL
 	 * @return 对象自身
 	 */
 	public SaClientModel addAllowUrls(String... urls) {
@@ -378,5 +296,17 @@ public class SaClientModel implements Serializable {
 		return this;
 	}
 
+	/**
+	 * @param grantTypes 应用允许的所有 grant_type
+	 * @return 对象自身
+	 */
+	public SaClientModel addAllowGrantTypes(String... grantTypes) {
+		if(this.allowGrantTypes == null) {
+			this.allowGrantTypes = new ArrayList<>();
+		}
+		this.allowGrantTypes.addAll(Arrays.asList(grantTypes));
+		return this;
+	}
+
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2GrantTypeAuthFunction.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2GrantTypeAuthFunction.java
new file mode 100644
index 00000000..caaf5ab9
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/function/strategy/SaOAuth2GrantTypeAuthFunction.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.function.strategy;
+
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+
+import java.util.function.Function;
+
+/**
+ * 函数式接口：GrantType 认证
+ *
+ * <p>  参数：SaRequest、grant_type </p>
+ * <p>  返回：处理结果  </p>
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@FunctionalInterface
+public interface SaOAuth2GrantTypeAuthFunction extends Function<SaRequest, AccessTokenModel> {
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
new file mode 100644
index 00000000..1f80841b
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.granttype.handler;
+
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.consts.GrantType;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+
+import java.util.List;
+
+/**
+ * authorization_code grant_type 处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class AuthorizationCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+
+    @Override
+    public String getHandlerGrantType() {
+        return GrantType.authorization_code;
+    }
+
+    @Override
+    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+        // 获取参数
+        ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+//        String clientId = clientIdAndSecret.clientId;
+        String clientSecret = clientIdAndSecret.clientSecret;
+        String code = req.getParamNotNull(SaOAuth2Consts.Param.code);
+        String redirectUri = req.getParam(SaOAuth2Consts.Param.redirect_uri);
+
+        // 校验参数
+        SaOAuth2Manager.getTemplate().checkGainTokenParam(code, clientId, clientSecret, redirectUri);
+
+        // 构建 Access-Token、返回
+        AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().generateAccessToken(code);
+        return accessTokenModel;
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
new file mode 100644
index 00000000..89a89df2
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.granttype.handler;
+
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.GrantType;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.stp.StpUtil;
+
+import java.util.List;
+
+/**
+ * password grant_type 处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class PasswordGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+
+    @Override
+    public String getHandlerGrantType() {
+        return GrantType.password;
+    }
+
+    @Override
+    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+
+        // 1、获取请求参数
+        String username = req.getParamNotNull(SaOAuth2Consts.Param.username);
+        String password = req.getParamNotNull(SaOAuth2Consts.Param.password);
+
+        // 3、调用API 开始登录，如果没能成功登录，则直接退出
+        loginByUsernamePassword(username, password);
+        Object loginId = StpUtil.getLoginIdDefaultNull();
+        if(loginId == null) {
+            throw new SaOAuth2Exception("登录失败");
+        }
+
+        // 4、构建 ra 对象
+        RequestAuthModel ra = new RequestAuthModel();
+        ra.clientId = clientId;
+        ra.loginId = loginId;
+        ra.scopes = scopes;
+
+        // 5、生成 Access-Token
+        AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
+        return at;
+    }
+
+    /**
+     * 根据 username、password 进行登录，如果登录失败请直接抛出异常
+     * @param username /
+     * @param password /
+     */
+    public void loginByUsernamePassword(String username, String password) {
+        SaOAuth2Manager.getConfig().doLoginHandle.apply(username, password);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
new file mode 100644
index 00000000..b526f7bf
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.granttype.handler;
+
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.GrantType;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+
+import java.util.List;
+
+/**
+ * refresh_token grant_type 处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class RefreshTokenGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+
+    @Override
+    public String getHandlerGrantType() {
+        return GrantType.refresh_token;
+    }
+
+    @Override
+    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+        // 获取参数
+        String refreshToken = req.getParamNotNull(SaOAuth2Consts.Param.refresh_token);
+
+        // 校验：Refresh-Token 是否存在
+        RefreshTokenModel rt = SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
+        SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30121);
+
+        // 校验：Refresh-Token 代表的 ClientId 与提供的 ClientId 是否一致
+        SaOAuth2Exception.throwBy( ! rt.clientId.equals(clientId), "无效client_id: " + clientId, SaOAuth2ErrorCode.CODE_30122);
+
+        // 获取新 Access-Token
+        AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().refreshAccessToken(refreshToken);
+        return accessTokenModel;
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java
new file mode 100644
index 00000000..c07868e1
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.granttype.handler;
+
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+
+import java.util.List;
+
+/**
+ * 所有 OAuth2 GrantType 处理器的父接口
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public interface SaOAuth2GrantTypeHandlerInterface {
+
+    /**
+     * 获取所要处理的 GrantType
+     *
+     * @return /
+     */
+    String getHandlerGrantType();
+
+    /**
+     * 获取 AccessTokenModel 对象
+     *
+     * @param req /
+     * @return /
+     */
+    AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes);
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index e5d3af01..feaa02de 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -20,9 +20,9 @@ import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
-import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.ResponseType;
 import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
@@ -34,10 +34,9 @@ import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
 import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.router.SaHttpMethod;
-import cn.dev33.satoken.stp.StpLogic;
-import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.List;
@@ -55,11 +54,6 @@ public class SaOAuth2ServerProcessor {
 	 */
 	public static SaOAuth2ServerProcessor instance = new SaOAuth2ServerProcessor();
 
-	/**
-	 * 底层 SaOAuth2Template 对象
-	 */
-	public SaOAuth2Template oauth2Template =  new SaOAuth2Template();
-
 	/**
 	 * 处理 Server 端请求， 路由分发
 	 * @return 处理结果
@@ -68,7 +62,6 @@ public class SaOAuth2ServerProcessor {
 
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 
 		// ------------------ 路由分发 ------------------
 
@@ -79,7 +72,7 @@ public class SaOAuth2ServerProcessor {
 
 		// Code 换 Access-Token || 模式三：密码式
 		if(req.isPath(Api.token)) {
-			return tokenOrPassword();
+			return token();
 		}
 
 		// Refresh-Token 刷新 Access-Token
@@ -122,18 +115,19 @@ public class SaOAuth2ServerProcessor {
 		SaResponse res = SaHolder.getResponse();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
 		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 		String responseType = req.getParamNotNull(Param.response_type);
 
 		// 1、先判断是否开启了指定的授权模式
 		checkAuthorizeResponseType(responseType, req, cfg);
 
 		// 2、如果尚未登录, 则先去登录
-		if( ! getStpLogic().isLogin()) {
+		if( ! SaOAuth2Manager.getStpLogic().isLogin()) {
 			return cfg.notLoginView.get();
 		}
 
 		// 3、构建请求 Model
-		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, getStpLogic().getLoginId());
+		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, SaOAuth2Manager.getStpLogic().getLoginId());
 
 		// 4、校验：重定向域名是否合法
 		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
@@ -167,55 +161,11 @@ public class SaOAuth2ServerProcessor {
 	}
 
 	/**
-	 * Code 换 Access-Token || 模式三：密码式
-	 * @return 处理结果
-	 */
-	public Object tokenOrPassword() {
-
-		String grantType = SaHolder.getRequest().getParamNotNull(Param.grant_type);
-
-		// Code 换 Access-Token
-		if(grantType.equals(GrantType.authorization_code)) {
-			return token();
-		}
-
-		// 模式三：密码式
-		if(grantType.equals(GrantType.password)) {
-			SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
-			if(!cfg.enablePassword) {
-				throwErrorSystemNotEnableModel();
-			}
-			if(!currClientModel().enablePassword) {
-				throwErrorClientNotEnableModel();
-			}
-			return password();
-		}
-
-		throw new SaOAuth2Exception("无效 grant_type：" + grantType);
-	}
-
-	/**
-	 * Code授权码 获取 Access-Token
+	 * Code 换 Access-Token / 模式三：密码式 / 自定义 grant_type
 	 * @return 处理结果
 	 */
 	public Object token() {
-		// 获取变量
-		SaRequest req = SaHolder.getRequest();
-
-		// 获取参数
-		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
-		String clientId = clientIdAndSecret.clientId;
-		String clientSecret = clientIdAndSecret.clientSecret;
-		String code = req.getParamNotNull(Param.code);
-		String redirectUri = req.getParam(Param.redirect_uri);
-
-		// 校验参数
-		oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
-
-		// 构建 Access-Token
-		AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().generateAccessToken(code);
-
-		// 返回
+		AccessTokenModel accessTokenModel = SaOAuth2Strategy.instance.grantTypeAuth.apply(SaHolder.getRequest());
 		return SaOAuth2Manager.getDataResolver().buildTokenReturnValue(accessTokenModel);
 	}
 
@@ -224,27 +174,10 @@ public class SaOAuth2ServerProcessor {
 	 * @return 处理结果
 	 */
 	public Object refresh() {
-		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		String grantType = req.getParamNotNull(Param.grant_type);
-		if(!grantType.equals(GrantType.refresh_token)) {
-			throw new SaOAuth2Exception("无效 grant_type：" + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
-		}
-
-		// 获取参数
-
-		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
-		String clientId = clientIdAndSecret.clientId;
-		String clientSecret = clientIdAndSecret.clientSecret;
-		String refreshToken = req.getParamNotNull(Param.refresh_token);
-
-		// 校验参数
-		oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
-
-		// 获取新 Access-Token
-		AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().refreshAccessToken(refreshToken);
-
-		// 返回
+		SaOAuth2Exception.throwBy(!grantType.equals(GrantType.refresh_token), "无效 grant_type：" + grantType, SaOAuth2ErrorCode.CODE_30126);
+		AccessTokenModel accessTokenModel = SaOAuth2Strategy.instance.grantTypeAuth.apply(req);
 		return SaOAuth2Manager.getDataResolver().buildRefreshTokenReturnValue(accessTokenModel);
 	}
 
@@ -254,6 +187,7 @@ public class SaOAuth2ServerProcessor {
 	 */
 	public Object revoke() {
 		// 获取变量
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 		SaRequest req = SaHolder.getRequest();
 
 		// 获取参数
@@ -297,10 +231,11 @@ public class SaOAuth2ServerProcessor {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		String clientId = req.getParamNotNull(Param.client_id);
-		Object loginId = getStpLogic().getLoginId();
+		Object loginId = SaOAuth2Manager.getStpLogic().getLoginId();
 		String scope = req.getParamNotNull(Param.scope);
 		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
 		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 
 		// 此请求只允许 POST 方式
 		if(!req.isMethod(SaHttpMethod.POST)) {
@@ -343,49 +278,6 @@ public class SaOAuth2ServerProcessor {
 		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
 	}
 
-	/**
-	 * 模式三：密码式
-	 * @return 处理结果
-	 */
-	public Object password() {
-		// 获取变量
-		SaRequest req = SaHolder.getRequest();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
-
-		// 1、获取请求参数
-		String username = req.getParamNotNull(Param.username);
-		String password = req.getParamNotNull(Param.password);
-		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
-		String clientId = clientIdAndSecret.clientId;
-		String clientSecret = clientIdAndSecret.clientSecret;
-		String scope = req.getParam(Param.scope, "");
-		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
-
-		// 2、校验 ClientScope 和 scope 
-		oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
-
-		// 3、防止因前端误传token造成逻辑干扰
-		// SaHolder.getStorage().set(getStpLogic().stpLogic.splicingKeyJustCreatedSave(), "no-token");
-
-		// 3、调用API 开始登录，如果没能成功登录，则直接退出
-		Object retObj = cfg.doLoginHandle.apply(username, password);
-		if( ! getStpLogic().isLogin()) {
-			return retObj;
-		}
-
-		// 4、构建 ra对象
-		RequestAuthModel ra = new RequestAuthModel();
-		ra.clientId = clientId;
-		ra.loginId = getStpLogic().getLoginId();
-		ra.scopes = scopes;
-
-		// 5、生成 Access-Token
-		AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
-
-		// 6、返回 Access-Token
-		return SaOAuth2Manager.getDataResolver().buildPasswordReturnValue(at);
-	}
-
 	/**
 	 * 模式四：凭证式
 	 * @return 处理结果
@@ -394,6 +286,7 @@ public class SaOAuth2ServerProcessor {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 
 		String grantType = req.getParamNotNull(Param.grant_type);
 		if(!grantType.equals(GrantType.client_credentials)) {
@@ -402,7 +295,7 @@ public class SaOAuth2ServerProcessor {
 		if(!cfg.enableClient) {
 			throwErrorSystemNotEnableModel();
 		}
-		if(!currClientModel().enableClient) {
+		if(!currClientModel().getAllowGrantTypes().contains(GrantType.client_credentials)) {
 			throwErrorClientNotEnableModel();
 		}
 
@@ -434,6 +327,7 @@ public class SaOAuth2ServerProcessor {
 	 * @return / 
 	 */
 	public SaClientModel currClientModel() {
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(SaHolder.getRequest());
 		return oauth2Template.checkClientModel(clientIdAndSecret.clientId);
 	}
@@ -447,7 +341,7 @@ public class SaOAuth2ServerProcessor {
 			if(!cfg.enableCode) {
 				throwErrorSystemNotEnableModel();
 			}
-			if(!currClientModel().enableCode) {
+			if(!currClientModel().getAllowGrantTypes().contains(GrantType.authorization_code)) {
 				throwErrorClientNotEnableModel();
 			}
 		}
@@ -456,7 +350,7 @@ public class SaOAuth2ServerProcessor {
 			if(!cfg.enableImplicit) {
 				throwErrorSystemNotEnableModel();
 			}
-			if(!currClientModel().enableImplicit) {
+			if(!currClientModel().getAllowGrantTypes().contains(GrantType.implicit)) {
 				throwErrorClientNotEnableModel();
 			}
 		}
@@ -466,15 +360,6 @@ public class SaOAuth2ServerProcessor {
 		}
 	}
 
-	/**
-	 * 获取底层使用的会话对象
-	 *
-	 * @return /
-	 */
-	public StpLogic getStpLogic() {
-		return StpUtil.stpLogic;
-	}
-
 	/**
 	 * 系统未开放此授权模式时抛出异常
 	 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index f1dc0187..70affdc3 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -16,8 +16,18 @@
 package cn.dev33.satoken.oauth2.strategy;
 
 import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.function.strategy.*;
+import cn.dev33.satoken.oauth2.granttype.handler.AuthorizationCodeGrantTypeHandler;
+import cn.dev33.satoken.oauth2.granttype.handler.PasswordGrantTypeHandler;
+import cn.dev33.satoken.oauth2.granttype.handler.RefreshTokenGrantTypeHandler;
+import cn.dev33.satoken.oauth2.granttype.handler.SaOAuth2GrantTypeHandlerInterface;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
 import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
 import cn.dev33.satoken.oauth2.scope.handler.OpenIdScopeHandler;
@@ -26,6 +36,7 @@ import cn.dev33.satoken.oauth2.scope.handler.UserIdScopeHandler;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 /**
@@ -38,6 +49,7 @@ public final class SaOAuth2Strategy {
 
 	private SaOAuth2Strategy() {
 		registerDefaultScopeHandler();
+		registerDefaultGrantTypeHandler();
 	}
 
 	/**
@@ -78,9 +90,6 @@ public final class SaOAuth2Strategy {
 		scopeHandlerMap.remove(scope);
 	}
 
-
-	// ----------------------- 所有策略
-
 	/**
 	 * 根据 scope 信息对一个 AccessTokenModel 进行加工处理
 	 */
@@ -117,6 +126,75 @@ public final class SaOAuth2Strategy {
 		}
 	};
 
+	// grant_type 处理器
+
+	/**
+	 * grant_type 处理器集合
+	 */
+	public Map<String, SaOAuth2GrantTypeHandlerInterface> grantTypeHandlerMap = new LinkedHashMap<>();
+
+	/**
+	 * 注册所有默认的权限处理器
+	 */
+	public void registerDefaultGrantTypeHandler() {
+		grantTypeHandlerMap.put(GrantType.authorization_code, new AuthorizationCodeGrantTypeHandler());
+		grantTypeHandlerMap.put(GrantType.password, new PasswordGrantTypeHandler());
+		grantTypeHandlerMap.put(GrantType.refresh_token, new RefreshTokenGrantTypeHandler());
+	}
+
+	/**
+	 * 注册一个权限处理器
+	 */
+	public void registerGrantTypeHandler(SaOAuth2GrantTypeHandlerInterface handler) {
+		grantTypeHandlerMap.put(handler.getHandlerGrantType(), handler);
+		// TODO 优化日志输出
+		SaManager.getLog().info("新增GrantType处理器：" + handler.getHandlerGrantType());
+		//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+	}
+
+	/**
+	 * 移除一个权限处理器
+	 */
+	public void removeGrantTypeHandler(String scope) {
+		scopeHandlerMap.remove(scope);
+	}
+
+	/**
+	 * 根据 scope 信息对一个 AccessTokenModel 进行加工处理
+	 */
+	public SaOAuth2GrantTypeAuthFunction grantTypeAuth = (req) -> {
+		String grantType = req.getParamNotNull(SaOAuth2Consts.Param.grant_type);
+		SaOAuth2GrantTypeHandlerInterface grantTypeHandler = grantTypeHandlerMap.get(grantType);
+		if(grantTypeHandler == null) {
+			throw new RuntimeException("无效 grant_type: " + grantType);
+		}
+
+		// 看看全局是否开启了此 grantType
+		SaOAuth2Config config = SaOAuth2Manager.getConfig();
+		if(grantType.equals(GrantType.authorization_code) && !config.getEnableCode() ) {
+			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
+		}
+		if(grantType.equals(GrantType.password) && !config.getEnablePassword() ) {
+			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
+		}
+
+		// 校验 clientSecret 和 scope
+		ClientIdAndSecretModel clientIdAndSecretModel = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(req.getParam(SaOAuth2Consts.Param.scope));
+		SaClientModel clientModel = SaOAuth2Manager.getTemplate().checkClientSecretAndScope(clientIdAndSecretModel.getClientId(), clientIdAndSecretModel.getClientSecret(), scopes);
+
+		// 检测应用是否开启此 grantType
+		if(!clientModel.getAllowGrantTypes().contains(grantType)) {
+			throw new SaOAuth2Exception("应用未开放的 grant_type: " + grantType);
+		}
+
+		// 调用 处理器
+		return grantTypeHandler.getAccessTokenModel(req, clientIdAndSecretModel.getClientId(), scopes);
+	};
+
+
+	// ----------------------- 所有策略
+
 	/**
 	 * 创建一个 code value
 	 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 38a6464a..1e2fe37c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -41,7 +41,7 @@ public class SaOAuth2Util {
 	 * @return ClientModel 
 	 */
 	public static SaClientModel checkClientModel(String clientId) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientModel(clientId);
+		return SaOAuth2Manager.getTemplate().checkClientModel(clientId);
 	}
 	
 	/**
@@ -50,7 +50,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static AccessTokenModel checkAccessToken(String accessToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkAccessToken(accessToken);
+		return SaOAuth2Manager.getTemplate().checkAccessToken(accessToken);
 	}
 	
 	/**
@@ -59,7 +59,7 @@ public class SaOAuth2Util {
 	 * @return .
 	 */
 	public static ClientTokenModel checkClientToken(String clientToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientToken(clientToken);
+		return SaOAuth2Manager.getTemplate().checkClientToken(clientToken);
 	}
 	
 	/**
@@ -68,7 +68,7 @@ public class SaOAuth2Util {
 	 * @return LoginId 
 	 */
 	public static Object getLoginIdByAccessToken(String accessToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.getLoginIdByAccessToken(accessToken);
+		return SaOAuth2Manager.getTemplate().getLoginIdByAccessToken(accessToken);
 	}
 	
 	/**
@@ -77,7 +77,7 @@ public class SaOAuth2Util {
 	 * @param scopes 需要校验的权限列表 
 	 */
 	public static void checkScope(String accessToken, String... scopes) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.checkScope(accessToken, scopes);
+		SaOAuth2Manager.getTemplate().checkScope(accessToken, scopes);
 	}
 	
 	/**
@@ -86,7 +86,7 @@ public class SaOAuth2Util {
 	 * @param scopes 需要校验的权限列表
 	 */
 	public static void checkClientTokenScope(String clientToken, String... scopes) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.checkClientTokenScope(clientToken, scopes);
+		SaOAuth2Manager.getTemplate().checkClientTokenScope(clientToken, scopes);
 	}
 
 
@@ -100,7 +100,7 @@ public class SaOAuth2Util {
 	 * @return 是否已经授权
 	 */
 	public static boolean isGrant(Object loginId, String clientId, List<String> scopes) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.isGrant(loginId, clientId, scopes);
+		return SaOAuth2Manager.getTemplate().isGrant(loginId, clientId, scopes);
 	}
 	
 	/**
@@ -109,7 +109,7 @@ public class SaOAuth2Util {
 	 * @param scopes 权限(多个用逗号隔开)
 	 */
 	public static void checkContract(String clientId, List<String> scopes) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.checkContract(clientId, scopes);
+		SaOAuth2Manager.getTemplate().checkContract(clientId, scopes);
 	}
 	
 	/**
@@ -118,7 +118,7 @@ public class SaOAuth2Util {
 	 * @param url 指定url
 	 */
 	public static void checkRightUrl(String clientId, String url) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.checkRightUrl(clientId, url);
+		SaOAuth2Manager.getTemplate().checkRightUrl(clientId, url);
 	}
 	
 	/**
@@ -128,7 +128,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象 
 	 */
 	public static SaClientModel checkClientSecret(String clientId, String clientSecret) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientSecret(clientId, clientSecret);
+		return SaOAuth2Manager.getTemplate().checkClientSecret(clientId, clientSecret);
 	}
 	
 	/**
@@ -139,7 +139,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象
 	 */
 	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
+		return SaOAuth2Manager.getTemplate().checkClientSecretAndScope(clientId, clientSecret, scopes);
 	}
 	
 	/**
@@ -151,7 +151,7 @@ public class SaOAuth2Util {
 	 * @return CodeModel对象 
 	 */
 	public static CodeModel checkGainTokenParam(String code, String clientId, String clientSecret, String redirectUri) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkGainTokenParam(code, clientId, clientSecret, redirectUri);
+		return SaOAuth2Manager.getTemplate().checkGainTokenParam(code, clientId, clientSecret, redirectUri);
 	}
 
 	/**
@@ -162,7 +162,7 @@ public class SaOAuth2Util {
 	 * @return CodeModel对象 
 	 */
 	public static RefreshTokenModel checkRefreshTokenParam(String clientId, String clientSecret, String refreshToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkRefreshTokenParam(clientId, clientSecret, refreshToken);
+		return SaOAuth2Manager.getTemplate().checkRefreshTokenParam(clientId, clientSecret, refreshToken);
 	}
 	
 	/**
@@ -173,7 +173,7 @@ public class SaOAuth2Util {
 	 * @return SaClientModel对象 
 	 */
 	public static AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
-		return SaOAuth2ServerProcessor.instance.oauth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
+		return SaOAuth2Manager.getTemplate().checkAccessTokenParam(clientId, clientSecret, accessToken);
 	}
 	
 	// ------------------- save 数据 
@@ -185,7 +185,7 @@ public class SaOAuth2Util {
 	 * @param scopes 权限列表
 	 */
 	public static void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
-		SaOAuth2ServerProcessor.instance.oauth2Template.saveGrantScope(clientId, loginId, scopes);
+		SaOAuth2Manager.getTemplate().saveGrantScope(clientId, loginId, scopes);
 	}
 	
 	
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index 3ff3dda9..8511384b 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -22,6 +22,7 @@ import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
 import cn.dev33.satoken.oauth2.data.loader.SaOAuth2DataLoader;
 import cn.dev33.satoken.oauth2.data.resolver.SaOAuth2DataResolver;
+import cn.dev33.satoken.oauth2.granttype.handler.SaOAuth2GrantTypeHandlerInterface;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
@@ -62,7 +63,17 @@ public class SaOAuth2BeanInject {
 	 */
 	@Autowired(required = false)
 	public void setSaOAuth2Template(SaOAuth2Template saOAuth2Template) {
-		SaOAuth2ServerProcessor.instance.oauth2Template = saOAuth2Template;
+		SaOAuth2Manager.setTemplate(saOAuth2Template);
+	}
+
+	/**
+	 * 注入 OAuth2 请求处理器
+	 *
+	 * @param serverProcessor 请求处理器
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2Template(SaOAuth2ServerProcessor serverProcessor) {
+		SaOAuth2ServerProcessor.instance = serverProcessor;
 	}
 
 	/**
@@ -127,4 +138,16 @@ public class SaOAuth2BeanInject {
 		}
 	}
 
+	/**
+	 * 注入自定义 grant_type 处理器
+	 *
+	 * @param handlerList 自定义 grant_type 处理器集合
+	 */
+	@Autowired(required = false)
+	public void setSaOAuth2GrantTypeHandlerInterface(List<SaOAuth2GrantTypeHandlerInterface> handlerList) {
+		for (SaOAuth2GrantTypeHandlerInterface handler : handlerList) {
+			SaOAuth2Strategy.instance.registerGrantTypeHandler(handler);
+		}
+	}
+
 }
-- 
Gitee


From 419ca3797cda80d28e59f10b07dbb75dc2d76936 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Fri, 23 Aug 2024 16:18:24 +0800
Subject: [PATCH 144/172] =?UTF-8?q?=E7=BB=86=E8=8A=82=E4=BC=98=E5=8C=96?=
 =?UTF-8?q?=E3=80=81=E6=96=87=E6=A1=A3=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/stp/StpLogic.java   |  5 +-
 .../com/pj/SaOAuth2ServerApplication.java     |  2 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |  2 +-
 .../pj/oauth2/SaOAuth2ServerController.java   | 15 ++--
 .../custom/PhoneCodeGrantTypeHandler.java     |  3 +-
 .../src/main/resources/application.yml        |  8 +-
 sa-token-doc/_sidebar.md                      |  2 +-
 sa-token-doc/oauth2/oauth2-check-domain.md    | 18 +++--
 sa-token-doc/oauth2/oauth2-custom-api.md      |  6 +-
 .../oauth2/oauth2-custom-grant_type.md        |  5 +-
 sa-token-doc/oauth2/oauth2-custom-login.md    |  8 +-
 ...cope-handler.md => oauth2-custom-scope.md} |  0
 sa-token-doc/oauth2/oauth2-interworking.md    | 41 +++++-----
 sa-token-doc/oauth2/oauth2-server.md          | 67 +++++++++------
 sa-token-doc/up/integ-redis.md                |  2 +-
 sa-token-doc/use/config.md                    | 81 +++++++++----------
 .../dev33/satoken/oauth2/SaOAuth2Manager.java | 10 +--
 ...2Config.java => SaOAuth2ServerConfig.java} | 58 ++++++-------
 .../SaOAuth2DataConverterDefaultImpl.java     |  6 +-
 .../data/model/loader/SaClientModel.java      | 36 ++++-----
 .../AuthorizationCodeGrantTypeHandler.java    |  2 +-
 .../handler/PasswordGrantTypeHandler.java     |  2 +-
 .../handler/RefreshTokenGrantTypeHandler.java |  2 +-
 .../SaOAuth2GrantTypeHandlerInterface.java    |  2 +-
 .../processor/SaOAuth2ServerProcessor.java    | 14 ++--
 .../oauth2/strategy/SaOAuth2Strategy.java     |  8 +-
 .../oauth2/template/SaOAuth2Template.java     |  4 +-
 .../solon/oauth2/SaOAuth2AutoConfigure.java   |  6 +-
 .../spring/oauth2/SaOAuth2BeanInject.java     |  4 +-
 .../spring/oauth2/SaOAuth2BeanRegister.java   |  8 +-
 30 files changed, 227 insertions(+), 200 deletions(-)
 rename sa-token-doc/oauth2/{oauth2-custom-scope-handler.md => oauth2-custom-scope.md} (100%)
 rename sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/{SaOAuth2Config.java => SaOAuth2ServerConfig.java} (79%)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 1c071119..0e5050b5 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -36,6 +36,7 @@ import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaTokenConsts;
 import cn.dev33.satoken.util.SaValue2Box;
 
+import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
@@ -2114,7 +2115,7 @@ public class StpLogic {
 		// 如果该账号的 Account-Session 为 null，说明此账号尚没有客户端在登录，此时返回空集合
 		SaSession session = getSessionByLoginId(loginId, false);
 		if(session == null) {
-			return Collections.emptyList();
+			return new ArrayList<>();
 		}
 
 		// 按照设备类型进行筛选
@@ -2132,7 +2133,7 @@ public class StpLogic {
 		// 如果该账号的 Account-Session 为 null，说明此账号尚没有客户端在登录，此时返回空集合
 		SaSession session = getSessionByLoginId(loginId, false);
 		if(session == null) {
-			return Collections.emptyList();
+			return new ArrayList<>();
 		}
 
 		// 按照设备类型进行筛选
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
index 4cf9200b..8666f2c3 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
@@ -13,7 +13,7 @@ public class SaOAuth2ServerApplication {
 
 	public static void main(String[] args) {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
-		System.out.println("\nSa-Token-OAuth Server端启动成功，配置如下：");
+		System.out.println("\nSa-Token-OAuth2 Server端启动成功，配置如下：");
 		System.out.println(SaOAuth2Manager.getConfig());
 	}
 	
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index fbcc2863..fd8216fc 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -21,7 +21,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 			return new SaClientModel()
 					.setClientId("1001")    // client id
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
-					.addAllowUrls("*")    // 所有允许授权的 url
+					.addAllowRedirectUris("*")    // 所有允许授权的 url
 					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
 					.addAllowGrantTypes(	 // 所有允许的授权模式
 							GrantType.authorization_code, // 授权码式
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 37261fd0..bc473a8a 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -1,7 +1,7 @@
 package com.pj.oauth2;
 
 import cn.dev33.satoken.context.SaHolder;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import cn.dev33.satoken.stp.StpUtil;
@@ -24,23 +24,23 @@ import java.util.Map;
 @RestController
 public class SaOAuth2ServerController {
 
-	// OAuth2-Server 端：处理所有OAuth相关请求
+	// OAuth2-Server 端：处理所有 OAuth2 相关请求
 	@RequestMapping("/oauth2/*")
 	public Object request() {
 		System.out.println("------- 进入请求: " + SaHolder.getRequest().getUrl());
 		return SaOAuth2ServerProcessor.instance.dister();
 	}
 
-	// Sa-OAuth2 定制化配置 
+	// Sa-Token OAuth2 定制化配置
 	@Autowired
-	public void configOAuth2Server(SaOAuth2Config cfg) {
+	public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 		// 未登录的视图
-		cfg.notLoginView = ()->{
+		oauth2Server.notLoginView = ()->{
 			return new ModelAndView("login.html");
 		};
 
 		// 登录处理函数
-		cfg.doLoginHandle = (name, pwd) -> {
+		oauth2Server.doLoginHandle = (name, pwd) -> {
 			if("sa".equals(name) && "123456".equals(pwd)) {
 				StpUtil.login(10001);
 				return SaResult.ok();
@@ -49,12 +49,13 @@ public class SaOAuth2ServerController {
 		};
 
 		// 授权确认视图
-		cfg.confirmView = (clientId, scopes)->{
+		oauth2Server.confirmView = (clientId, scopes)->{
 			Map<String, Object> map = new HashMap<>();
 			map.put("clientId", clientId);
 			map.put("scope", scopes);
 			return new ModelAndView("confirm.html", map);
 		};
+
 	}
 
 
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
index 9bad7d29..6afb64a7 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
@@ -26,8 +26,9 @@ public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterf
     }
 
     @Override
-    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
 
+        // 获取前端提交的参数
         String phone = req.getParamNotNull("phone");
         String code = req.getParamNotNull("code");
         String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index 0cd51d5c..eada44d9 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -4,19 +4,19 @@ server:
 # sa-token配置
 sa-token: 
     # token名称 (同时也是 Cookie 名称)
-    token-name: satoken-oauth2-server
+    token-name: sa-token-oauth2-server
     # 是否打印操作日志
     is-log: true
     # OAuth2.0 配置 
-    oauth2:
+    oauth2-server:
         # 是否全局开启授权码模式
-        enable-code: true
+        enable-authorization-code: true
         # 是否全局开启 Implicit 模式
         enable-implicit: true
         # 是否全局开启密码模式
         enable-password: true
         # 是否全局开启客户端模式
-        enable-client: true
+        enable-client-credentials: true
         # 定义哪些 scope 是高级权限，多个用逗号隔开
         # higher-scope: openid,userid
         # 定义哪些 scope 是低级权限，多个用逗号隔开
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index f87b8192..3a7c4b0f 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -58,7 +58,7 @@
 	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
 	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
 	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
-	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope-handler)
+	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope)
 	- [为 Scope 划分等级](/oauth2/oauth2-scope-level)
 	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
diff --git a/sa-token-doc/oauth2/oauth2-check-domain.md b/sa-token-doc/oauth2/oauth2-check-domain.md
index f1cca9e3..a6e8faf6 100644
--- a/sa-token-doc/oauth2/oauth2-check-domain.md
+++ b/sa-token-doc/oauth2/oauth2-check-domain.md
@@ -14,7 +14,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 		if("1001".equals(clientId)) {
 			return new SaClientModel()
 					// ...
-					.addAllowUrls("*")    // 所有允许授权的 url
+					.addAllowRedirectUris("*")    // 所有允许授权的 url
 					// ...
 		}
 		return null;
@@ -23,7 +23,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 }
 ```
 
-配置项 `AllowUrls` 意为配置此 `Client` 端所有允许的授权地址，不在此配置项中的 URL 将无法下发 `code` 授权码。
+配置项 `AllowRedirectUris` 意为配置此 `Client` 端所有允许的授权地址，不在此配置项中的 URL 将无法下发 `code` 授权码。
 
 为了方便测试，上述代码将其配置为`*`，但是，<font color="#FF0000" >在生产环境中，此配置项绝对不能配置为 * </font>，否则会有被 `code` 劫持的风险。
 
@@ -40,7 +40,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 
 ### 2、防范方法
 
-造成此漏洞的直接原因就是我们对此 client 配置了过于宽泛的 `AllowUrls` 允许授权地址，防范的方法也很简单，就是缩小 `AllowUrls` 授权范围。
+造成此漏洞的直接原因就是我们对此 client 配置了过于宽泛的 `AllowRedirectUris` 允许授权地址，防范的方法也很简单，就是缩小 `AllowRedirectUris` 授权范围。
 
 我们将其配置为一个具体的URL：
 
@@ -53,7 +53,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 		if("1001".equals(clientId)) {
 			return new SaClientModel()
 					// ...
-					.addAllowUrls("http://sa-oauth-client.com:8002/")    // 所有允许授权的 url
+					.addAllowRedirectUris("http://sa-oauth-client.com:8002/")    // 所有允许授权的 url
 					// ...
 		}
 		return null;
@@ -66,7 +66,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 
 ![oauth2-feifa-rf](https://oss.dev33.cn/sa-token/doc/oauth2-new/oauth2-feifa-rf.png 's-w-sh')
 
-域名没有通过校验，拒绝授权！
+URL 没有通过校验，拒绝授权！
 
 
 ### 3、配置安全性参考表
@@ -81,10 +81,18 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 ### 4、其它规则
 
 1、AllowUrls 配置的地址不允许出现 `@` 字符。
+
+- 反例：`http://user@sa-token.cc`
+- 反例：`http://sa-oauth-client.com@sa-token.cc`
+
 *详见源码：[SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
 `checkRightUrl` 方法。*
 
 2、AllowUrls 配置的地址 `*` 通配符只允许出现在字符串末尾，不允许出现在字符串中间位置。
+
+- 反例：`http*://sa-oauth-client.com/`
+- 反例：`http://*.sa-oauth-client.com/`
+
 *详见源码： [SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
 `checkAllowUrlListStaticMethod` 方法。*
 
diff --git a/sa-token-doc/oauth2/oauth2-custom-api.md b/sa-token-doc/oauth2/oauth2-custom-api.md
index a398c37d..1802a4f1 100644
--- a/sa-token-doc/oauth2/oauth2-custom-api.md
+++ b/sa-token-doc/oauth2/oauth2-custom-api.md
@@ -12,7 +12,7 @@
 @RestController
 public class SaOAuth2ServerController {
 
-	// OAuth2-Server 端：处理所有 OAuth 相关请求 
+	// OAuth2-Server 端：处理所有 OAuth2 相关请求 
 	@RequestMapping("/oauth2/*")
 	public Object request() {
 		return SaOAuth2ServerProcessor.instance.dister();
@@ -33,7 +33,7 @@ public class SaOAuth2ServerController {
 ``` java
 // 配置 OAuth2 相关参数 
 @Autowired
-private void configOAuth2Server(SaOAuth2Config cfg) {
+private void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 	// 自定义API地址
 	SaOAuth2Consts.Api.authorize = "/oauth2/authorize2";
 	// ... 
@@ -76,7 +76,7 @@ public class SaOAuth2ServerController {
 	// Code 换 Access-Token || 模式三：密码式
 	@RequestMapping("/oauth2/token")
 	public Object token() {
-		return SaOAuth2ServerProcessor.instance.tokenOrPassword();
+		return SaOAuth2ServerProcessor.instance.token();
 	}
 
 	// Refresh-Token 刷新 Access-Token
diff --git a/sa-token-doc/oauth2/oauth2-custom-grant_type.md b/sa-token-doc/oauth2/oauth2-custom-grant_type.md
index 071fab88..4714b329 100644
--- a/sa-token-doc/oauth2/oauth2-custom-grant_type.md
+++ b/sa-token-doc/oauth2/oauth2-custom-grant_type.md
@@ -58,8 +58,9 @@ public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterf
     }
 
     @Override
-    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
 
+        // 获取前端提交的参数 
         String phone = req.getParamNotNull("phone");
         String code = req.getParamNotNull("code");
         String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
@@ -102,7 +103,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 			return new SaClientModel()
 					.setClientId("1001")  
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")  
-					.addAllowUrls("*")  
+					.addAllowRedirectUris("*")    // 所有允许授权的 url
 					.addContractScopes("openid", "userid", "userinfo")  
 					.addAllowGrantTypes( 
 							GrantType.authorization_code, 
diff --git a/sa-token-doc/oauth2/oauth2-custom-login.md b/sa-token-doc/oauth2/oauth2-custom-login.md
index 25cb0bb1..2a23e7a6 100644
--- a/sa-token-doc/oauth2/oauth2-custom-login.md
+++ b/sa-token-doc/oauth2/oauth2-custom-login.md
@@ -10,9 +10,9 @@
 
 ``` java
 @Autowired
-public void configOAuth2Server(SaOAuth2Config cfg) {
+public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 	// 配置：未登录时返回的View 
-	cfg.notLoginView = ()->{
+	oauth2Server.notLoginView = ()->{
 		return new ModelAndView("xxx.html");
 	};
 }
@@ -64,9 +64,9 @@ public SaResult ss(String name, String pwd) {
 
 ``` java
 @Autowired
-public void configOAuth2Server(SaOAuth2Config cfg) {
+public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 	// 配置：授权确认视图 
-	cfg.confirmView = (clientId, scopes)->{
+	oauth2Server.confirmView = (clientId, scopes)->{
 		Map<String, Object> map = new HashMap<>();
 		map.put("clientId", clientId);
 		map.put("scope", scopes);
diff --git a/sa-token-doc/oauth2/oauth2-custom-scope-handler.md b/sa-token-doc/oauth2/oauth2-custom-scope.md
similarity index 100%
rename from sa-token-doc/oauth2/oauth2-custom-scope-handler.md
rename to sa-token-doc/oauth2/oauth2-custom-scope.md
diff --git a/sa-token-doc/oauth2/oauth2-interworking.md b/sa-token-doc/oauth2/oauth2-interworking.md
index 002ec431..77c0b33c 100644
--- a/sa-token-doc/oauth2/oauth2-interworking.md
+++ b/sa-token-doc/oauth2/oauth2-interworking.md
@@ -1,4 +1,4 @@
-# Sa-Token-OAuth2 与登录会话实现数据互通
+# OAuth2 与登录会话实现数据互通
 
 --- 
 
@@ -16,29 +16,35 @@
 
 ### OAuth2-Server 端数据互通
 
-很简单，你只需要在 `SaOAuth2TemplateImpl` 实现类中继续重写 Access-Token 的生成策略：
+很简单，你只需要在 `configOAuth2Server` 中重写 Access-Token 的生成策略：
 
 ``` java
-@Component
-public class SaOAuth2TemplateImpl extends SaOAuth2Template {
-	
-	// ... 其它代码 
-
-	// 重写 Access-Token 生成策略：复用登录会话的Token 
-	@Override
-	public String randomAccessToken(String clientId, Object loginId, String scope) {
-		String tokenValue = StpUtil.createLoginSession(loginId);
-		return tokenValue;
-	}
+// Sa-Token OAuth2 定制化配置 
+@Autowired
+public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
+	// 其它配置 ...
 	
+	// 重写 AccessToken 创建策略，返回会话令牌
+	SaOAuth2Strategy.instance.createAccessToken = (clientId, loginId, scopes) -> {
+		System.out.println("----返回会话令牌");
+		return StpUtil.createLoginSession(loginId);
+	};
+
 }
 ```
 
 重启项目，然后在 OAuth2 模块授权登录，现在生成的 `access_token` ，可以用来访问 `satoken` 的会话接口了。
 
 
+> [!WARNING| label:注意点] 
+> 数据互通，让前端与后端的交互更加方便，一个 token 即可访问所有接口，但也一定程度上失去了OAuth2的 “不同 Client 不同权限” 的设计意义，
+> 同时也默认每个 Client 都拥有了账号的会话权限（access_token 与 satoken 为同一个）。
+> 
+> 应该根据自己的架构合理分析是否应该整合数据互通。
+
+
 ### OAuth2-Client 数据互通
-除了Server端，Client端也可以打通 `access_token` 与 `satoken` 会话。做法是在 Client 端拿到 `access_token` 后进行登录时，使用 SaLoginModel 预定登录生成的 Token 值 
+除了Server端，Client端也可以打通 `access_token` 与 `satoken` 会话。做法是在 Client 端拿到 `access_token` 后进行登录时，使用 `SaLoginModel` 预定登录生成的 Token 值 
 
 ``` java
 // 1. 获取到access_token
@@ -51,13 +57,6 @@ StpUtil.login(uid, SaLoginConfig.setToken(access_token));
 ```
 
 
-> [!WARNING| label:注意点] 
-> 数据互通，让前端与后端的交互更加方便，一个 token 即可访问所有接口，但也一定程度上失去了OAuth2的 “不同 Client 不同权限” 的设计意义，
-> 同时也默认每个 Client 都拥有了账号的会话权限（access_token 与 satoken 为同一个）。
-> 
-> 应该根据自己的架构合理分析是否应该整合数据互通。
-
-
 
 
 
diff --git a/sa-token-doc/oauth2/oauth2-server.md b/sa-token-doc/oauth2/oauth2-server.md
index de684040..ab385de2 100644
--- a/sa-token-doc/oauth2/oauth2-server.md
+++ b/sa-token-doc/oauth2/oauth2-server.md
@@ -23,23 +23,39 @@
 	<version>${sa.top.version}</version>
 </dependency>
 
-<!-- Sa-Token-OAuth2.0 模块 -->
+<!-- Sa-Token OAuth2.0 模块 -->
 <dependency>
 	<groupId>cn.dev33</groupId>
 	<artifactId>sa-token-oauth2</artifactId>
 	<version>${sa.top.version}</version>
 </dependency>
+
+<!-- Sa-Token 整合 Redis (可选) -->
+<dependency>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-redis-jackson</artifactId>
+	<version>${sa-token.version}</version>
+</dependency>
+<dependency>
+	<groupId>org.apache.commons</groupId>
+	<artifactId>commons-pool2</artifactId>
+</dependency>
 ```
 <!-------- tab:Gradle 方式 -------->
 ``` gradle
 // Sa-Token 权限认证，在线文档：https://sa-token.cc
 implementation 'cn.dev33:sa-token-spring-boot-starter:${sa.top.version}'
 
-// Sa-Token-OAuth2.0 模块
+// Sa-Token OAuth2.0 模块
 implementation 'cn.dev33:sa-token-oauth2:${sa.top.version}'
+
+// Sa-Token 整合 Redis (可选)
+implementation 'cn.dev33:sa-token-redis-jackson:${sa.top.version}'
+implementation 'org.apache.commons:commons-pool2'
 ```
 <!---------------------------- tabs:end ---------------------------->
 
+注：Redis 相关依赖是非必须的，如果集成了 redis，可以让你更细致的观察到 sa-token-oauth2 的底层数据格式。
 
 
 ### 3、开放服务 
@@ -60,9 +76,16 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 			return new SaClientModel()
 					.setClientId("1001")    // client id
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
-					.addAllowUrls("*")    // 所有允许授权的 url
+					.addAllowRedirectUris("*")    // 所有允许授权的 url
 					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
-					.setIsAutoMode(true);    // 是否自动判断开放的授权模式 
+					.addAllowGrantTypes(	 // 所有允许的授权模式
+							GrantType.authorization_code, // 授权码式
+							GrantType.implicit,  // 隐式式
+							GrantType.refresh_token,  // 刷新令牌
+							GrantType.password,  // 密码式
+							GrantType.client_credentials  // 客户端模式
+					)
+			;
 		}
 		return null;
 	}
@@ -83,24 +106,24 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 2、新建`SaOAuth2ServerController`
 ``` java
 /**
- * Sa-OAuth2 Server端 控制器 
+ * Sa-Token OAuth2 Server端 控制器 
  */
 @RestController
 public class SaOAuth2ServerController {
 
-	// 处理所有OAuth相关请求 
+	// OAuth2-Server 端：处理所有 OAuth2 相关请求
 	@RequestMapping("/oauth2/*")
 	public Object request() {
 		System.out.println("------- 进入请求: " + SaHolder.getRequest().getUrl());
-		return SaOAuth2Handle.serverRequest();
+		return SaOAuth2ServerProcessor.instance.dister();
 	}
-	
-	// Sa-OAuth2 定制化配置 
+
+	// Sa-Token OAuth2 定制化配置 
 	@Autowired
-	public void setSaOAuth2Config(SaOAuth2Config cfg) {
+	public void setSaOAuth2Config(SaOAuth2Config oauth2Server) {
 		
 		// 配置：未登录时返回的View 
-		cfg.notLoginView = () -> {
+		oauth2Server.notLoginView = () -> {
 			String msg = "当前会话在OAuth-Server端尚未登录，请先访问"
 						+ "<a href='/oauth2/doLogin?name=sa&pwd=123456' target='_blank'> doLogin登录 </a>"
 						+ "进行登录之后，刷新页面开始授权";
@@ -108,7 +131,7 @@ public class SaOAuth2ServerController {
 		};
 		
 		// 配置：登录处理函数 
-		cfg.doLoginHandle = (name, pwd) -> {
+		oauth2Server.doLoginHandle = (name, pwd) -> {
 			if("sa".equals(name) && "123456".equals(pwd)) {
 				StpUtil.login(10001);
 				return SaResult.ok();
@@ -117,7 +140,7 @@ public class SaOAuth2ServerController {
 		};
 		
 		// 配置：确认授权时返回的 view 
-		cfg.confirmView = (clientId, scopes) -> {
+		oauth2Server.confirmView = (clientId, scopes) -> {
 			String scopeStr = SaFoxUtil.convertListToString(scopes);
 			String yesCode =
 					"fetch('/oauth2/doConfirm?client_id=" + clientId + "&scope=" + scopeStr + "', {method: 'POST'})" +
@@ -132,16 +155,9 @@ public class SaOAuth2ServerController {
 		};
 	}
 
-	// 全局异常拦截  
-	@ExceptionHandler
-	public SaResult handlerException(Exception e) {
-		e.printStackTrace(); 
-		return SaResult.error(e.getMessage());
-	}
-	
 }
 ```
-注意：在`setDoLoginHandle`函数里如果要获取name, pwd以外的参数，可通过`SaHolder.getRequest().getParam("xxx")`来获取 
+注意：在 `doLoginHandle` 函数里如果要获取 name, pwd 以外的参数，可通过 `SaHolder.getRequest().getParam("xxx")` 来获取。
 
 3、全局异常处理
 ``` java
@@ -164,7 +180,8 @@ public class GlobalExceptionHandler {
 public class SaOAuth2ServerApplication {
 	public static void main(String[] args) {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
-		System.out.println("\nSa-Token-OAuth Server 端启动成功");
+		System.out.println("\nSa-Token-OAuth2 Server 端启动成功");
+		System.out.println(SaOAuth2Manager.getConfig());
 	}
 }
 ```
@@ -173,7 +190,7 @@ public class SaOAuth2ServerApplication {
 
 ### 4、访问测试 
 
-1、由于暂未搭建Client端，我们可以使用Sa-Token官网作为重定向URL进行测试：
+1、由于暂未搭建Client端，我们可以使用 Sa-Token 官网作为重定向URL进行测试：
 ``` url
 http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=https://sa-token.cc&scope=openid
 ```
@@ -185,7 +202,7 @@ http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=10
 3、点击doLogin进行登录之后刷新页面，会提示我们确认授权
 ![sa-oauth2-server-scope](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-server-scope.png 's-w-sh')
 
-4、点击确认授权之后刷新页面，我们会被重定向至 redirect_uri 页面，并携带了code参数 
+4、点击同意授权之后，我们会被重定向至 redirect_uri 页面，并携带了code参数 
 
 ![sa-oauth2-server-code](https://oss.dev33.cn/sa-token/doc/oauth2-new/sa-oauth2-server-code.png 's-w-sh')
 
@@ -194,7 +211,7 @@ http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=10
 http://sa-oauth-server.com:8000/oauth2/token?grant_type=authorization_code&client_id=1001&client_secret=aaaa-bbbb-cccc-dddd-eeee&code={code}
 ```
 
-将得到 `Access-Token`、`Refresh-Token`、`openid`等授权信息 
+将得到 `Access-Token`、`Refresh-Token`、`openid`等授权信息：
 
 ``` js
 {
diff --git a/sa-token-doc/up/integ-redis.md b/sa-token-doc/up/integ-redis.md
index b01ec4de..e0c18701 100644
--- a/sa-token-doc/up/integ-redis.md
+++ b/sa-token-doc/up/integ-redis.md
@@ -73,7 +73,7 @@ implementation 'cn.dev33:sa-token-redis-jackson:${sa.top.version}'
 ```
 <!-------- tab:Gradle 方式 -------->
 ``` gradle
-// Sa-Token 整合 Redis （使用 jackson 序列化方式）
+// 提供Redis连接池
 implementation 'org.apache.commons:commons-pool2'
 ```
 <!---------------------------- tabs:end ------------------------------>
diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index 89a97a97..bc314b06 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -294,18 +294,21 @@ sa-token.sso-client.is-slo=true
 
 
 ### 4、OAuth2.0相关配置 
-| 参数名称				| 类型		| 默认值	| 说明																		|
-| :--------				| :--------	| :--------	| :--------																	|
-| isCode				| Boolean	| true		| 是否打开模式：授权码（`Authorization Code`）								|
-| isImplicit			| Boolean	| true		| 是否打开模式：隐藏式（`Implicit`）											|
-| isPassword			| Boolean	| true		| 是否打开模式：密码式（`Password`）											|
-| isClient				| Boolean	| true		| 是否打开模式：凭证式（`Client Credentials`）								|
-| isNewRefresh			| Boolean	| false		| 是否在每次 `Refresh-Token` 刷新 `Access-Token` 时，产生一个新的 Refresh-Token	|
-| codeTimeout			| long		| 300		| Code授权码 保存的时间（单位：秒） 默认五分钟									|
-| accessTokenTimeout	| long		| 7200		| `Access-Token` 保存的时间（单位：秒）默认两个小时								|
-| refreshTokenTimeout	| long		| 2592000	| `Refresh-Token` 保存的时间（单位：秒） 默认30 天								|
-| clientTokenTimeout	| long		| 7200		| `Client-Token` 保存的时间（单位：秒） 默认两个小时								|
-| pastClientTokenTimeout	| long	| 7200		| `Past-Client-Token` 保存的时间（单位：秒） ，默认为-1，代表延续 `Client-Token` 的有效时间 	|
+| 参数名称					| 类型		| 默认值	| 说明																		|
+| :--------					| :--------	| :--------	| :--------																	|
+| enableAuthorizationCode	| Boolean	| true		| 是否打开模式：授权码（`Authorization Code`）								|
+| enableImplicit			| Boolean	| true		| 是否打开模式：隐藏式（`Implicit`）											|
+| enablePassword			| Boolean	| true		| 是否打开模式：密码式（`Password`）											|
+| enableClientCredentials	| Boolean	| true		| 是否打开模式：凭证式（`Client Credentials`）								|
+| isNewRefresh				| Boolean	| false		| 是否在每次 `Refresh-Token` 刷新 `Access-Token` 时，产生一个新的 `Refresh-Token`	|
+| codeTimeout				| long		| 300		| Code授权码 保存的时间（单位：秒） 默认五分钟									|
+| accessTokenTimeout		| long		| 7200		| `Access-Token` 保存的时间（单位：秒）默认两个小时								|
+| refreshTokenTimeout		| long		| 2592000	| `Refresh-Token` 保存的时间（单位：秒） 默认30 天								|
+| clientTokenTimeout		| long		| 7200		| `Client-Token` 保存的时间（单位：秒） 默认两个小时								|
+| pastClientTokenTimeout	| long		| 7200		| `Past-Client-Token` 保存的时间（单位：秒） ，默认为-1，代表延续 `Client-Token` 的有效时间 	|
+| openidDigestPrefix		| String	| openid_default_digest_prefix		| 默认 openid 生成算法中使用的摘要前缀				 	|
+| higherScope				| String	| 		| 指定高级权限，多个用逗号隔开				 	|
+| lowerScope				| String	| 		| 指定低级权限，多个用逗号隔开				 	|
 
 配置示例：
 <!---------------------------- tabs:start ---------------------------->
@@ -313,44 +316,40 @@ sa-token.sso-client.is-slo=true
 ``` yaml
 # Sa-Token 配置
 sa-token: 
-    token-name: satoken-server
+    token-name: sa-token-oauth2-server
     # OAuth2.0 配置 
-    oauth2: 
-        is-code: true
-        is-implicit: true
-        is-password: true
-        is-client: true
+    oauth2-server: 
+        enable-authorization-code: true
+        enable-implicit: true
+        enable-password: true
+        enable-client-credentials: true
 ```
 <!------------- tab:properties 风格  ------------->
 ``` properties
 # Sa-Token 配置 
-sa-token.token-name=satoken-server
+sa-token.token-name=sa-token-oauth2-server
 # OAuth2.0 配置 
-sa-token.oauth2.is-code=true
-sa-token.oauth2.is-implicit=true
-sa-token.oauth2.is-password=true
-sa-token.oauth2.is-client=true
+sa-token.oauth2-server.enable-authorization-code=true
+sa-token.oauth2-server.enable-implicit=true
+sa-token.oauth2-server.enable-password=true
+sa-token.oauth2-server.enable-client-credentials=true
 ```
 <!---------------------------- tabs:end ---------------------------->
 
 
 ##### SaClientModel属性定义
-| 参数名称				| 类型		| 默认值	| 说明													|
-| :--------				| :--------	| :--------	| :--------											|
-| clientId				| String	| null		| 应用id，应该全局唯一								|
-| clientSecret			| String	| null		| 应用秘钥											|
-| contractScope			| String	| null		| 应用签约的所有权限, 多个用逗号隔开					|
-| allowUrl				| String	| null		| 应用允许授权的所有URL, 多个用逗号隔开 （可以使用 `*` 号通配符）			|
-| isCode				| Boolean	| false		| 单独配置此 Client 是否打开模式：授权码（`Authorization Code`）		|
-| isImplicit			| Boolean	| false		| 单独配置此 Client 是否打开模式：隐藏式（`Implicit`）		|
-| isPassword			| Boolean	| false		| 单独配置此 Client 是否打开模式：密码式（`Password`）		|
-| isClient				| Boolean	| false		| 单独配置此 Client 是否打开模式：凭证式（`Client Credentials`）		|
-| isAutoMode			| Boolean	| true		| 是否自动判断此 Client 开放的授权模式。 参考：[详解](/use/config?id=配置项详解：isAutoMode)  |
-| isNewRefresh			| Boolean	| 取全局配置		| 单独配置此Client：是否在每次 `Refresh-Token` 刷新 `Access-Token` 时，产生一个新的 Refresh-Token [ 默认取全局配置 ]	|
-| accessTokenTimeout	| long		| 取全局配置		| 单独配置此Client：`Access-Token` 保存的时间（单位：秒）  [默认取全局配置]	|
-| refreshTokenTimeout	| long		| 取全局配置		| 单独配置此Client：`Refresh-Token` 保存的时间（单位：秒） [默认取全局配置]	|
-| clientTokenTimeout	| long		| 取全局配置		| 单独配置此Client：`Client-Token` 保存的时间（单位：秒） [默认取全局配置]	|
-| pastClientTokenTimeout	| long	| 取全局配置		| 单独配置此Client：`Past-Client-Token` 保存的时间（单位：秒） [默认取全局配置]	|
+| 参数名称				| 类型			| 默认值	| 说明													|
+| :--------				| :--------		| :--------	| :--------											|
+| clientId				| String		| null		| 应用id，应该全局唯一								|
+| clientSecret			| String		| null		| 应用秘钥											|
+| contractScopes		| List<String>	| null		| 应用签约的所有权限 									|
+| allowUrls				| List<String>	| null		| 应用允许授权的所有URL（可以使用 `*` 号通配符）			|
+| allowGrantTypes		| List<String>	| new ArrayList<>()	| 应用允许的所有 `grant_type`							|
+| isNewRefresh			| Boolean		| 取全局配置		| 单独配置此Client：是否在每次 `Refresh-Token` 刷新 `Access-Token` 时，产生一个新的 Refresh-Token [ 默认取全局配置 ]	|
+| accessTokenTimeout	| long			| 取全局配置		| 单独配置此Client：`Access-Token` 保存的时间（单位：秒）  [默认取全局配置]	|
+| refreshTokenTimeout	| long			| 取全局配置		| 单独配置此Client：`Refresh-Token` 保存的时间（单位：秒） [默认取全局配置]	|
+| clientTokenTimeout	| long			| 取全局配置		| 单独配置此Client：`Client-Token` 保存的时间（单位：秒） [默认取全局配置]	|
+| pastClientTokenTimeout	| long		| 取全局配置		| 单独配置此Client：`Past-Client-Token` 保存的时间（单位：秒） [默认取全局配置]	|
 
 
 
@@ -392,14 +391,14 @@ sa-token.oauth2.is-client=true
 
 但是 —— 有的场景下我们又确实需要在登录之前就使用 Token-Session 对象，这时候就把配置项 `tokenSessionCheckLogin` 值改为 `false` 即可。
 
-
+<!-- 
 #### 配置项详解：isAutoMode
 
 配置含义：是否自动判断此 Client 开放的授权模式。
 
 - 此值为 true 时：四种模式（`isCode、isImplicit、isPassword、isClient`）是否生效，依靠全局设置；
 - 此值为 false 时：四种模式（`isCode、isImplicit、isPassword、isClient`）是否生效，依靠局部配置+全局配置（两个都为 true 时才打开） 
-
+ -->
 
 #### 配置项详解：isHttp
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 8521d353..8ba535b8 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -15,7 +15,7 @@
  */
 package cn.dev33.satoken.oauth2;
 
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2DaoDefaultImpl;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
@@ -41,19 +41,19 @@ public class SaOAuth2Manager {
 	/**
 	 * OAuth2 配置 Bean 
 	 */
-	private static volatile SaOAuth2Config config;
-	public static SaOAuth2Config getConfig() {
+	private static volatile SaOAuth2ServerConfig config;
+	public static SaOAuth2ServerConfig getConfig() {
 		if (config == null) {
 			// 初始化默认值
 			synchronized (SaOAuth2Manager.class) {
 				if (config == null) {
-					setConfig(new SaOAuth2Config());
+					setConfig(new SaOAuth2ServerConfig());
 				}
 			}
 		}
 		return config;
 	}
-	public static void setConfig(SaOAuth2Config config) {
+	public static void setConfig(SaOAuth2ServerConfig config) {
 		SaOAuth2Manager.config = config;
 	}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
similarity index 79%
rename from sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
rename to sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index 0bb39073..1ae2e05f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2Config.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -24,17 +24,17 @@ import cn.dev33.satoken.util.SaResult;
 import java.io.Serializable;
 
 /**
- * Sa-Token-OAuth2 配置类 Model
+ * Sa-Token OAuth2 Server 端 配置类 Model
  *
  * @author click33
  * @since 1.19.0
  */
-public class SaOAuth2Config implements Serializable {
+public class SaOAuth2ServerConfig implements Serializable {
 
 	private static final long serialVersionUID = -6541180061782004705L;
 
 	/** 是否打开模式：授权码（Authorization Code） */
-	public Boolean enableCode = true;
+	public Boolean enableAuthorizationCode = true;
 
 	/** 是否打开模式：隐藏式（Implicit） */
 	public Boolean enableImplicit = true;
@@ -43,7 +43,7 @@ public class SaOAuth2Config implements Serializable {
 	public Boolean enablePassword = true;
 
 	/** 是否打开模式：凭证式（Client Credentials） */
-	public Boolean enableClient = true;
+	public Boolean enableClientCredentials = true;
 
 	/** 是否在每次 Refresh-Token 刷新 Access-Token 时，产生一个新的 Refresh-Token */
 	public Boolean isNewRefresh = false;
@@ -75,16 +75,16 @@ public class SaOAuth2Config implements Serializable {
 	/**
 	 * @return enableCode
 	 */
-	public Boolean getEnableCode() {
-		return enableCode;
+	public Boolean getEnableAuthorizationCode() {
+		return enableAuthorizationCode;
 	}
 
 	/**
-	 * @param enableCode 要设置的 enableCode
+	 * @param enableAuthorizationCode 要设置的 enableAuthorizationCode
 	 * @return /
 	 */
-	public SaOAuth2Config setEnableCode(Boolean enableCode) {
-		this.enableCode = enableCode;
+	public SaOAuth2ServerConfig setEnableAuthorizationCode(Boolean enableAuthorizationCode) {
+		this.enableAuthorizationCode = enableAuthorizationCode;
 		return this;
 	}
 
@@ -99,7 +99,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param enableImplicit 要设置的 enableImplicit
 	 * @return /
 	 */
-	public SaOAuth2Config setEnableImplicit(Boolean enableImplicit) {
+	public SaOAuth2ServerConfig setEnableImplicit(Boolean enableImplicit) {
 		this.enableImplicit = enableImplicit;
 		return this;
 	}
@@ -114,24 +114,24 @@ public class SaOAuth2Config implements Serializable {
 	/**
 	 * @param enablePassword 要设置的 enablePassword
 	 */
-	public SaOAuth2Config setEnablePassword(Boolean enablePassword) {
+	public SaOAuth2ServerConfig setEnablePassword(Boolean enablePassword) {
 		this.enablePassword = enablePassword;
 		return this;
 	}
 
 	/**
-	 * @return enableClient
+	 * @return enableClientCredentials
 	 */
-	public Boolean getEnableClient() {
-		return enableClient;
+	public Boolean getEnableClientCredentials() {
+		return enableClientCredentials;
 	}
 
 	/**
-	 * @param enableClient 要设置的 enableClient
+	 * @param enableClientCredentials 要设置的 enableClientCredentials
 	 * @return /
 	 */
-	public SaOAuth2Config setEnableClient(Boolean enableClient) {
-		this.enableClient = enableClient;
+	public SaOAuth2ServerConfig setEnableClientCredentials(Boolean enableClientCredentials) {
+		this.enableClientCredentials = enableClientCredentials;
 		return this;
 	}
 
@@ -146,7 +146,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param isNewRefresh 要设置的 isNewRefresh
 	 * @return /
 	 */
-	public SaOAuth2Config setIsNewRefresh(Boolean isNewRefresh) {
+	public SaOAuth2ServerConfig setIsNewRefresh(Boolean isNewRefresh) {
 		this.isNewRefresh = isNewRefresh;
 		return this;
 	}
@@ -162,7 +162,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param codeTimeout 要设置的 codeTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setCodeTimeout(long codeTimeout) {
+	public SaOAuth2ServerConfig setCodeTimeout(long codeTimeout) {
 		this.codeTimeout = codeTimeout;
 		return this;
 	}
@@ -178,7 +178,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param accessTokenTimeout 要设置的 accessTokenTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setAccessTokenTimeout(long accessTokenTimeout) {
+	public SaOAuth2ServerConfig setAccessTokenTimeout(long accessTokenTimeout) {
 		this.accessTokenTimeout = accessTokenTimeout;
 		return this;
 	}
@@ -194,7 +194,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param refreshTokenTimeout 要设置的 refreshTokenTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setRefreshTokenTimeout(long refreshTokenTimeout) {
+	public SaOAuth2ServerConfig setRefreshTokenTimeout(long refreshTokenTimeout) {
 		this.refreshTokenTimeout = refreshTokenTimeout;
 		return this;
 	}
@@ -210,7 +210,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param clientTokenTimeout 要设置的 clientTokenTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setClientTokenTimeout(long clientTokenTimeout) {
+	public SaOAuth2ServerConfig setClientTokenTimeout(long clientTokenTimeout) {
 		this.clientTokenTimeout = clientTokenTimeout;
 		return this;
 	}
@@ -226,7 +226,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param pastClientTokenTimeout 要设置的 pastClientTokenTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setPastClientTokenTimeout(long pastClientTokenTimeout) {
+	public SaOAuth2ServerConfig setPastClientTokenTimeout(long pastClientTokenTimeout) {
 		this.pastClientTokenTimeout = pastClientTokenTimeout;
 		return this;
 	}
@@ -242,7 +242,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param openidDigestPrefix 要设置的 openidDigestPrefix
 	 * @return 对象自身
 	 */
-	public SaOAuth2Config setOpenidDigestPrefix(String openidDigestPrefix) {
+	public SaOAuth2ServerConfig setOpenidDigestPrefix(String openidDigestPrefix) {
 		this.openidDigestPrefix = openidDigestPrefix;
 		return this;
 	}
@@ -262,7 +262,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param higherScope 指定高级权限，多个用逗号隔开
 	 * @return /
 	 */
-	public SaOAuth2Config setHigherScope(String higherScope) {
+	public SaOAuth2ServerConfig setHigherScope(String higherScope) {
 		this.higherScope = higherScope;
 		return this;
 	}
@@ -282,7 +282,7 @@ public class SaOAuth2Config implements Serializable {
 	 * @param lowerScope 指定低级权限，多个用逗号隔开
 	 * @return /
 	 */
-	public SaOAuth2Config setLowerScope(String lowerScope) {
+	public SaOAuth2ServerConfig setLowerScope(String lowerScope) {
 		this.lowerScope = lowerScope;
 		return this;
 	}
@@ -307,11 +307,11 @@ public class SaOAuth2Config implements Serializable {
 
 	@Override
 	public String toString() {
-		return "SaOAuth2Config{" +
-				"enableCode=" + enableCode +
+		return "SaOAuth2ServerConfig{" +
+				"enableAuthorizationCode=" + enableAuthorizationCode +
 				", enableImplicit=" + enableImplicit +
 				", enablePassword=" + enablePassword +
-				", enableClient=" + enableClient +
+				", enableClientCredentials=" + enableClientCredentials +
 				", isNewRefresh=" + isNewRefresh +
 				", codeTimeout=" + codeTimeout +
 				", accessTokenTimeout=" + accessTokenTimeout +
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 5212fc43..1c8865f5 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -23,7 +23,7 @@ import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
-import java.util.Collections;
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 
@@ -41,7 +41,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public List<String> convertScopeStringToList(String scopeString) {
         if(SaFoxUtil.isEmpty(scopeString)) {
-            return Collections.emptyList();
+            return new ArrayList<>();
         }
         // 兼容以下三种分隔符：空格、逗号、%20
         scopeString = scopeString.replaceAll(" ", ",");
@@ -63,7 +63,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     @Override
     public List<String> convertAllowUrlStringToList(String allowUrl) {
         if(SaFoxUtil.isEmpty(allowUrl)) {
-            return Collections.emptyList();
+            return new ArrayList<>();
         }
         return SaFoxUtil.convertStringToList(allowUrl);
     }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index f84ce3d2..e6ae542d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.oauth2.data.model.loader;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 
 import java.io.Serializable;
 import java.util.ArrayList;
@@ -49,9 +49,9 @@ public class SaClientModel implements Serializable {
 	public List<String> contractScopes;
 	
 	/**
-	 * 应用允许授权的所有URL
+	 * 应用允许授权的所有 redirect_uri
 	 */
-	public List<String> allowUrls;
+	public List<String> allowRedirectUris;
 
 	/**
 	 * 应用允许的所有 grant_type
@@ -75,19 +75,19 @@ public class SaClientModel implements Serializable {
 
 	
 	public SaClientModel() {
-		SaOAuth2Config config = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig config = SaOAuth2Manager.getConfig();
 		this.isNewRefresh = config.getIsNewRefresh();
 		this.accessTokenTimeout = config.getAccessTokenTimeout();
 		this.refreshTokenTimeout = config.getRefreshTokenTimeout();
 		this.clientTokenTimeout = config.getClientTokenTimeout();
 		this.pastClientTokenTimeout = config.getPastClientTokenTimeout();
 	}
-	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, List<String> allowUrls) {
+	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, List<String> allowRedirectUris) {
 		super();
 		this.clientId = clientId;
 		this.clientSecret = clientSecret;
 		this.contractScopes = contractScopes;
-		this.allowUrls = allowUrls;
+		this.allowRedirectUris = allowRedirectUris;
 	}
 
 	/**
@@ -139,18 +139,18 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @return 应用允许授权的所有URL
+	 * @return 应用允许授权的所有 redirect_uri
 	 */
-	public List<String> getAllowUrls() {
-		return allowUrls;
+	public List<String> getAllowRedirectUris() {
+		return allowRedirectUris;
 	}
 
 	/**
-	 * @param allowUrls 应用允许授权的所有URL
+	 * @param allowRedirectUris 应用允许授权的所有 redirect_uri
 	 * @return 对象自身 
 	 */
-	public SaClientModel setAllowUrls(List<String> allowUrls) {
-		this.allowUrls = allowUrls;
+	public SaClientModel setAllowRedirectUris(List<String> allowRedirectUris) {
+		this.allowRedirectUris = allowRedirectUris;
 		return this;
 	}
 
@@ -259,7 +259,7 @@ public class SaClientModel implements Serializable {
 				"clientId='" + clientId + '\'' +
 				", clientSecret='" + clientSecret + '\'' +
 				", contractScopes=" + contractScopes +
-				", allowUrls=" + allowUrls +
+				", allowRedirectUris=" + allowRedirectUris +
 				", allowGrantTypes=" + allowGrantTypes +
 				", isNewRefresh=" + isNewRefresh +
 				", accessTokenTimeout=" + accessTokenTimeout +
@@ -285,14 +285,14 @@ public class SaClientModel implements Serializable {
 	}
 
 	/**
-	 * @param urls 添加应用允许授权的所有URL
+	 * @param redirectUris 添加应用允许授权的所有 redirect_uri
 	 * @return 对象自身
 	 */
-	public SaClientModel addAllowUrls(String... urls) {
-		if(this.allowUrls == null) {
-			this.allowUrls = new ArrayList<>();
+	public SaClientModel addAllowRedirectUris(String... redirectUris) {
+		if(this.allowRedirectUris == null) {
+			this.allowRedirectUris = new ArrayList<>();
 		}
-		this.allowUrls.addAll(Arrays.asList(urls));
+		this.allowRedirectUris.addAll(Arrays.asList(redirectUris));
 		return this;
 	}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
index 1f80841b..00de1e0c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/AuthorizationCodeGrantTypeHandler.java
@@ -38,7 +38,7 @@ public class AuthorizationCodeGrantTypeHandler implements SaOAuth2GrantTypeHandl
     }
 
     @Override
-    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
         // 获取参数
         ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
 //        String clientId = clientIdAndSecret.clientId;
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
index 89a89df2..1609e355 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
@@ -40,7 +40,7 @@ public class PasswordGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterfa
     }
 
     @Override
-    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
 
         // 1、获取请求参数
         String username = req.getParamNotNull(SaOAuth2Consts.Param.username);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
index b526f7bf..238e35c1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
@@ -40,7 +40,7 @@ public class RefreshTokenGrantTypeHandler implements SaOAuth2GrantTypeHandlerInt
     }
 
     @Override
-    public AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes) {
+    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
         // 获取参数
         String refreshToken = req.getParamNotNull(SaOAuth2Consts.Param.refresh_token);
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java
index c07868e1..48d47a19 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/SaOAuth2GrantTypeHandlerInterface.java
@@ -41,6 +41,6 @@ public interface SaOAuth2GrantTypeHandlerInterface {
      * @param req /
      * @return /
      */
-    AccessTokenModel getAccessTokenModel(SaRequest req, String clientId, List<String> scopes);
+    AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes);
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index feaa02de..ed8cc38b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -19,7 +19,7 @@ import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.context.model.SaResponse;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Api;
@@ -113,7 +113,7 @@ public class SaOAuth2ServerProcessor {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
 		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
 		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 		String responseType = req.getParamNotNull(Param.response_type);
@@ -218,7 +218,7 @@ public class SaOAuth2ServerProcessor {
 	public Object doLogin() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
 
 		return cfg.doLoginHandle.apply(req.getParam(Param.name), req.getParam(Param.pwd));
 	}
@@ -285,14 +285,14 @@ public class SaOAuth2ServerProcessor {
 	public Object clientToken() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaOAuth2Config cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
 		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 
 		String grantType = req.getParamNotNull(Param.grant_type);
 		if(!grantType.equals(GrantType.client_credentials)) {
 			throw new SaOAuth2Exception("无效 grant_type：" + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
 		}
-		if(!cfg.enableClient) {
+		if(!cfg.enableClientCredentials) {
 			throwErrorSystemNotEnableModel();
 		}
 		if(!currClientModel().getAllowGrantTypes().contains(GrantType.client_credentials)) {
@@ -335,10 +335,10 @@ public class SaOAuth2ServerProcessor {
 	/**
 	 * 校验 authorize 路由的 ResponseType 参数
 	 */
-	public void checkAuthorizeResponseType(String responseType, SaRequest req, SaOAuth2Config cfg) {
+	public void checkAuthorizeResponseType(String responseType, SaRequest req, SaOAuth2ServerConfig cfg) {
 		// 模式一：Code授权码
 		if(responseType.equals(ResponseType.code)) {
-			if(!cfg.enableCode) {
+			if(!cfg.enableAuthorizationCode) {
 				throwErrorSystemNotEnableModel();
 			}
 			if(!currClientModel().getAllowGrantTypes().contains(GrantType.authorization_code)) {
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index 70affdc3..dbfda655 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -17,7 +17,7 @@ package cn.dev33.satoken.oauth2.strategy;
 
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
@@ -170,8 +170,8 @@ public final class SaOAuth2Strategy {
 		}
 
 		// 看看全局是否开启了此 grantType
-		SaOAuth2Config config = SaOAuth2Manager.getConfig();
-		if(grantType.equals(GrantType.authorization_code) && !config.getEnableCode() ) {
+		SaOAuth2ServerConfig config = SaOAuth2Manager.getConfig();
+		if(grantType.equals(GrantType.authorization_code) && !config.getEnableAuthorizationCode() ) {
 			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
 		}
 		if(grantType.equals(GrantType.password) && !config.getEnablePassword() ) {
@@ -189,7 +189,7 @@ public final class SaOAuth2Strategy {
 		}
 
 		// 调用 处理器
-		return grantTypeHandler.getAccessTokenModel(req, clientIdAndSecretModel.getClientId(), scopes);
+		return grantTypeHandler.getAccessToken(req, clientIdAndSecretModel.getClientId(), scopes);
 	};
 
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 3062f525..cbfeedbb 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -224,8 +224,8 @@ public class SaOAuth2Template {
 
 		// 4、是否在[允许地址列表]之中
 		SaClientModel clientModel = checkClientModel(clientId);
-		checkAllowUrlList(clientModel.allowUrls);
-		if( ! SaStrategy.instance.hasElement.apply(clientModel.allowUrls, url)) {
+		checkAllowUrlList(clientModel.allowRedirectUris);
+		if( ! SaStrategy.instance.hasElement.apply(clientModel.allowRedirectUris, url)) {
 			throw new SaOAuth2Exception("非法 redirect_url: " + url).setCode(SaOAuth2ErrorCode.CODE_30114);
 		}
 	}
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
index 5c7626c5..dab18067 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.solon.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import org.noear.solon.annotation.Bean;
@@ -39,7 +39,7 @@ public class SaOAuth2AutoConfigure {
             SaOAuth2Util.saOAuth2Template = bean;
         });
 
-        appContext.subBeansOfType(SaOAuth2Config.class, bean -> {
+        appContext.subBeansOfType(SaOAuth2ServerConfig.class, bean -> {
             SaOAuth2Manager.setConfig(bean);
         });
     }
@@ -48,7 +48,7 @@ public class SaOAuth2AutoConfigure {
      * 获取 OAuth2配置Bean
      */
     @Bean
-    public SaOAuth2Config getConfig(@Inject(value = "${sa-token.oauth2}", required = false) SaOAuth2Config oAuth2Config) {
+    public SaOAuth2ServerConfig getConfig(@Inject(value = "${sa-token.oauth2}", required = false) SaOAuth2ServerConfig oAuth2Config) {
         return oAuth2Config;
     }
 }
\ No newline at end of file
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index 8511384b..092d7956 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.spring.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.dao.SaOAuth2Dao;
 import cn.dev33.satoken.oauth2.data.convert.SaOAuth2DataConverter;
 import cn.dev33.satoken.oauth2.data.generate.SaOAuth2DataGenerate;
@@ -52,7 +52,7 @@ public class SaOAuth2BeanInject {
 	 * @param saOAuth2Config 配置对象 
 	 */
 	@Autowired(required = false)
-	public void setSaOAuth2Config(SaOAuth2Config saOAuth2Config) {
+	public void setSaOAuth2Config(SaOAuth2ServerConfig saOAuth2Config) {
 		SaOAuth2Manager.setConfig(saOAuth2Config);
 	}
 
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
index 2a4a5ed7..788f97af 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
@@ -16,7 +16,7 @@
 package cn.dev33.satoken.spring.oauth2;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.config.SaOAuth2Config;
+import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
@@ -36,9 +36,9 @@ public class SaOAuth2BeanRegister {
 	 * @return 配置对象 
 	 */
 	@Bean
-	@ConfigurationProperties(prefix = "sa-token.oauth2")
-	public SaOAuth2Config getSaOAuth2Config() {
-		return new SaOAuth2Config();
+	@ConfigurationProperties(prefix = "sa-token.oauth2-server")
+	public SaOAuth2ServerConfig getSaOAuth2Config() {
+		return new SaOAuth2ServerConfig();
 	}
 
 }
-- 
Gitee


From a7a3e8c14f8f333f2dc9e8188e6e5a19c35649ef Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 00:20:17 +0800
Subject: [PATCH 145/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20OIDC=20=E5=8D=8F?=
 =?UTF-8?q?=E8=AE=AE=E5=AE=9E=E7=8E=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/resources/templates/index.html   |   4 +-
 .../sa-token-demo-oauth2-server/pom.xml       |   7 +
 .../com/pj/SaOAuth2ServerApplication.java     |   6 +-
 .../com/pj/oauth2/SaOAuth2DataLoaderImpl.java |   2 +-
 .../oauth2/custom/CustomOidcScopeHandler.java |  32 ++++
 .../src/main/resources/application.yml        |   2 +
 sa-token-doc/_sidebar.md                      |   1 +
 sa-token-doc/oauth2/oauth2-oidc.md            | 154 ++++++++++++++++++
 .../cn/dev33/satoken/jwt/SaJwtTemplate.java   |  20 +++
 .../java/cn/dev33/satoken/jwt/SaJwtUtil.java  |  17 +-
 sa-token-plugin/sa-token-oauth2/pom.xml       |   6 +
 .../dev33/satoken/oauth2/SaOAuth2Manager.java |  16 +-
 .../oauth2/config/SaOAuth2OidcConfig.java     |  62 +++++++
 .../oauth2/config/SaOAuth2ServerConfig.java   |  26 +++
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java |   6 +-
 .../data/loader/SaOAuth2DataLoader.java       |   2 +-
 .../data/model/loader/SaClientModel.java      |   2 +-
 .../oauth2/data/model/oidc/IdTokenModel.java  |  90 ++++++++++
 .../oauth2/exception/SaOAuth2Exception.java   |  10 +-
 .../handler/PasswordGrantTypeHandler.java     |   2 +-
 .../processor/SaOAuth2ServerProcessor.java    |   6 +-
 .../scope/handler/OidcScopeHandler.java       | 122 +++++++++++++-
 .../oauth2/strategy/SaOAuth2Strategy.java     |   2 +-
 .../oauth2/template/SaOAuth2Template.java     |   4 +-
 .../solon/oauth2/SaOAuth2AutoConfigure.java   |   7 +-
 .../spring/oauth2/SaOAuth2BeanInject.java     |   2 +-
 26 files changed, 576 insertions(+), 34 deletions(-)
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
 create mode 100644 sa-token-doc/oauth2/oauth2-oidc.md
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2OidcConfig.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/oidc/IdTokenModel.java

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
index 79c33db3..adc3bd0a 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
@@ -48,11 +48,11 @@
 			<span class="ps">当请求链接不包含 scope 权限，或请求的 scope 近期已授权时，将无需用户手动确认，做到静默授权</span>
 			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/</code>
 			
-			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo">
+			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo,oidc">
 				<button>授权登录（显式授权）</button> 
 			</a>
 			<span class="ps">当请求链接包含具体的 scope 权限时，将需要用户手动确认，此时 OAuth-Server 会返回更多的数据</span>
-			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo,oidc</code>
 			
 			<button onclick="refreshToken()">刷新令牌</button> 
 			<span class="ps">我们可以拿着 Refresh-Token 去刷新我们的 Access-Token，每次刷新后旧Token将作废</span>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
index a9599fba..db0b6c7d 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
@@ -59,6 +59,13 @@
 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
 		</dependency>
 
+		<!-- sa-token-jwt 签发 OIDC id_token 令牌 -->
+		<dependency>
+			<groupId>cn.dev33</groupId>
+			<artifactId>sa-token-jwt</artifactId>
+			<version>${sa-token.version}</version>
+		</dependency>
+
 		<!-- 热刷新 -->
 		<!--<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
index 8666f2c3..d8c7a741 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
@@ -4,6 +4,8 @@ import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
+import java.net.MalformedURLException;
+
 /**
  * 启动：Sa-OAuth2 Server端 
  * @author click33 
@@ -11,10 +13,10 @@ import org.springframework.boot.autoconfigure.SpringBootApplication;
 @SpringBootApplication 
 public class SaOAuth2ServerApplication {
 
-	public static void main(String[] args) {
+	public static void main(String[] args) throws MalformedURLException {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
 		System.out.println("\nSa-Token-OAuth2 Server端启动成功，配置如下：");
-		System.out.println(SaOAuth2Manager.getConfig());
+		System.out.println(SaOAuth2Manager.getServerConfig());
 	}
 	
 }
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
index fd8216fc..2f582696 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2DataLoaderImpl.java
@@ -22,7 +22,7 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 					.setClientId("1001")    // client id
 					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
 					.addAllowRedirectUris("*")    // 所有允许授权的 url
-					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+					.addContractScopes("openid", "userid", "userinfo", "oidc")    // 所有签约的权限
 					.addAllowGrantTypes(	 // 所有允许的授权模式
 							GrantType.authorization_code, // 授权码式
 							GrantType.implicit,  // 隐式式
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
new file mode 100644
index 00000000..342498e8
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
@@ -0,0 +1,32 @@
+package com.pj.oauth2.custom;
+
+import cn.dev33.satoken.oauth2.data.model.oidc.IdTokenModel;
+import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
+import org.springframework.stereotype.Component;
+
+/**
+ * 扩展 OIDC 权限处理器，返回更多字段
+ *
+ * @author click33
+ * @since 2024/8/24
+ */
+@Component
+public class CustomOidcScopeHandler extends OidcScopeHandler {
+
+    @Override
+    public IdTokenModel workExtraData(IdTokenModel idToken) {
+        Object userId = idToken.sub;
+        System.out.println("----- 为 idToken 追加扩展字段 ----- ");
+
+        idToken.extraData.put("uid", userId); // 用户id
+        idToken.extraData.put("nickname", "lin_xiao_lin"); // 昵称
+        idToken.extraData.put("picture", "https://sa-token.cc/logo.png"); // 头像
+        idToken.extraData.put("email", "456456@xx.com"); // 邮箱
+        idToken.extraData.put("phone_number", "13144556677"); // 手机号
+        // 更多字段 ...
+        // 可参考：https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+
+        return idToken;
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index eada44d9..f12e1b5b 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -7,6 +7,8 @@ sa-token:
     token-name: sa-token-oauth2-server
     # 是否打印操作日志
     is-log: true
+    # jwt 秘钥
+    jwt-secret-key: saxsaxsaxsax
     # OAuth2.0 配置 
     oauth2-server:
         # 是否全局开启授权码模式
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index 3a7c4b0f..eaa5c341 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -61,6 +61,7 @@
 	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope)
 	- [为 Scope 划分等级](/oauth2/oauth2-scope-level)
 	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
+	- [开启 OIDC 协议](/oauth2/oauth2-oidc)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
 	<!-- - [常见问题说明](/oauth2/8) -->
diff --git a/sa-token-doc/oauth2/oauth2-oidc.md b/sa-token-doc/oauth2/oauth2-oidc.md
new file mode 100644
index 00000000..754822ef
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-oidc.md
@@ -0,0 +1,154 @@
+# OAuth2 开启 OIDC 协议 （OpenID Connect）
+
+--- 
+
+### 1、开启步骤
+
+1、引入 `sa-token-jwt` 依赖，用来签发 `id_token` 
+
+<!---------------------------- tabs:start ---------------------------->
+<!-------- tab:Maven 方式 -------->
+``` xml
+<!-- sa-token-jwt 签发 OIDC id_token 令牌 -->
+<dependency>
+	<groupId>cn.dev33</groupId>
+	<artifactId>sa-token-jwt</artifactId>
+	<version>${sa.top.version}</version>
+</dependency>
+```
+<!-------- tab:Gradle 方式 -------->
+``` gradle
+// sa-token-jwt 签发 OIDC id_token 令牌 
+implementation 'cn.dev33:sa-token-jwt:${sa.top.version}'
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+2、在 `SaOAuth2DataLoader` 实现类中，返回的 `SaClientModel` 中添加 `oidc` 的签约权限。
+
+``` java
+@Component
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
+	@Override
+	public SaClientModel getClientModel(String clientId) {
+		// 此为模拟数据，真实环境需要从数据库查询 
+		if("1001".equals(clientId)) {
+			return new SaClientModel()
+					// .... 
+					.addContractScopes("openid", "userid", "userinfo", "oidc")    // 此处添加上签约权限：oidc 
+					.addAllowGrantTypes(	
+							// ... 
+					)
+			;
+		}
+		return null;
+	}
+	// 其它代码 ... 
+}
+```
+
+
+### 2、测试
+
+1、在 OAuth2-Client 端申请授权码时，添加上 `oidc` 权限：
+``` url
+http://sa-oauth-server.com:8000/oauth2/authorize
+	?response_type=code
+	&client_id=1001
+	&redirect_uri=http://sa-oauth-client.com:8002/
+	&scope=oidc
+```
+
+2、得到授权码后，然后拿着 `code` 换 `access_token`
+``` url
+http://sa-oauth-server.com:8000/oauth2/token
+    ?grant_type=authorization_code
+    &client_id=1001
+    &client_secret=aaaa-bbbb-cccc-dddd-eeee
+    &code=${code}
+```
+
+3、返回的结果中将包含 `id_token` 字段：
+``` js
+{
+	"code": 200,
+	"msg": "ok",
+	"data": null,
+	"token_type": "bearer",
+	"access_token": "WdpjZdGlXdOzsAcr7gqPwmLVInHrhpznQa2pDOVqZmLXQynBflkcWqE6f5o2",
+	"refresh_token": "hKHwBm3eH6iqSHlXRGWQaziV8OoyHvzmUb97lKEEZnZJLt3NunBFx7rVZWbT",
+	"expires_in": 7199,
+	"refresh_expires_in": 2591999,
+	"client_id": "1001",
+	"scope": "oidc",
+	"id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOi8vc2Etb2F1dGgtc2VydmVyLmNvbTo4MDAwIiwic3ViIjoiMTAwMDEiLCJhdWQiOiIxMDAxIiwiZXhwIjoxNzI0NDI1OTg5LCJpYXQiOjE3MjQ0MjUzODksImF1dGhfdGltZSI6MTcyNDQwMDUyNiwibm9uY2UiOiJLTHlNR08zZ1R0YVdhMEFRcHF0RUNpTk9SWkY1QkhvRCIsImF6cCI6IjEwMDEifQ.gP3UYMexaQ9v0huKUuqhV9-dPxPpaEuFPIlPb2UZaOI"
+}
+```
+
+4、解析 `id_token` 将得到以下载荷
+``` js
+{
+  "iss": "http://sa-oauth-server.com:8000",  // 签发人
+  "sub": "10001",   // userId 
+  "aud": "1001",   // clientId
+  "exp": 1724425989,   // 令牌到期时间，10位时间戳 
+  "iat": 1724425389,   // 签发此令牌的时间，10位时间戳 
+  "auth_time": 1724400526,   // 用户认证时间，10位时间戳 
+  "nonce": "KLyMGO3gTtaWa0AQpqtECiNORZF5BHoD",  // 随机数，防止重放攻击 
+  "azp": "1001"   // clientId
+}
+```
+
+如果默认携带的载荷无法满足你的业务需求，你还可以自定义追加扩展字段，让 `id_token` 返回更多信息 
+
+
+### 3、扩展 id_token 载荷
+
+新建 `CustomOidcScopeHandler` 集成 `OidcScopeHandler`，扩展 OIDC 权限处理器，返回更多字段：
+``` java
+/**
+ * 扩展 OIDC 权限处理器，返回更多字段
+ */
+@Component
+public class CustomOidcScopeHandler extends OidcScopeHandler {
+
+    @Override
+    public IdTokenModel workExtraData(IdTokenModel idToken) {
+        Object userId = idToken.sub;
+        System.out.println("----- 为 idToken 追加扩展字段 ----- ");
+
+        idToken.extraData.put("uid", userId); // 用户id
+        idToken.extraData.put("nickname", "lin_xiao_lin"); // 昵称
+        idToken.extraData.put("picture", "https://sa-token.cc/logo.png"); // 头像
+        idToken.extraData.put("email", "456456@xx.com"); // 邮箱
+        idToken.extraData.put("phone_number", "13144556677"); // 手机号
+        // 更多字段 ...
+        // 可参考：https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+
+        return idToken;
+    }
+
+}
+```
+
+重启项目，再次请求授权，返回的 `id_token` 载荷将包含更多字段：
+
+``` js
+{
+  "iss": "http://sa-oauth-server.com:8000",
+  "sub": "10001",
+  "aud": "1001",
+  "exp": 1724430149,
+  "iat": 1724429549,
+  "auth_time": 1724400526,
+  "nonce": "SBRLOcfeo9FFmLTB8OINvuulam5FMOre",
+  "azp": "1001",
+  "uid": "10001",
+  "nickname": "lin_xiao_lin",
+  "picture": "https://sa-token.cc/logo.png",
+  "email": "456456@xx.com",
+  "phone_number": "13144556677"
+}
+```
+
+
diff --git a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
index 90ad98ef..1f828409 100644
--- a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
+++ b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtTemplate.java
@@ -309,4 +309,24 @@ public class SaJwtTemplate {
         return (effTime - System.currentTimeMillis()) / 1000;
     }
 
+
+
+	// -------------- 其它方法
+
+	/**
+	 * 创建 jwt （Map 参数方式）
+	 *
+	 * @param map 扩展数据
+	 * @param keyt 秘钥
+	 * @return jwt-token
+	 */
+	public String createToken(Map<String, Object> map, String keyt) {
+		// 创建
+		JWT jwt = JWT.create().addPayloads(map);
+
+		// 返回
+		return generateToken(jwt, keyt);
+	}
+
+
 }
diff --git a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtUtil.java b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtUtil.java
index 3661b614..42c4b541 100644
--- a/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtUtil.java
+++ b/sa-token-plugin/sa-token-jwt/src/main/java/cn/dev33/satoken/jwt/SaJwtUtil.java
@@ -15,11 +15,11 @@
  */
 package cn.dev33.satoken.jwt;
 
-import java.util.Map;
-
 import cn.hutool.json.JSONObject;
 import cn.hutool.jwt.JWT;
 
+import java.util.Map;
+
 /**
  * jwt 操作工具类封装
  *
@@ -195,4 +195,17 @@ public class SaJwtUtil {
     	return saJwtTemplate.getTimeout(token, loginType, keyt);
     }
 
+
+	// -------------- 其它方法
+
+	/**
+	 * 创建 jwt （Map 参数方式）
+	 *
+	 * @param map 扩展数据
+	 * @param keyt 秘钥
+	 * @return jwt-token
+	 */
+	public static String createToken(Map<String, Object> map, String keyt) {
+		return saJwtTemplate.createToken(map, keyt);
+	}
 }
diff --git a/sa-token-plugin/sa-token-oauth2/pom.xml b/sa-token-plugin/sa-token-oauth2/pom.xml
index f8717b99..f3f5bee9 100644
--- a/sa-token-plugin/sa-token-oauth2/pom.xml
+++ b/sa-token-plugin/sa-token-oauth2/pom.xml
@@ -22,6 +22,12 @@
             <groupId>cn.dev33</groupId>
             <artifactId>sa-token-core</artifactId>
         </dependency>
+        <!-- sa-token-jwt 签发 OIDC id_token 令牌 -->
+        <dependency>
+            <groupId>cn.dev33</groupId>
+            <artifactId>sa-token-jwt</artifactId>
+            <optional>true</optional>
+        </dependency>
 	</dependencies>
 
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
index 8ba535b8..270da526 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/SaOAuth2Manager.java
@@ -41,20 +41,20 @@ public class SaOAuth2Manager {
 	/**
 	 * OAuth2 配置 Bean 
 	 */
-	private static volatile SaOAuth2ServerConfig config;
-	public static SaOAuth2ServerConfig getConfig() {
-		if (config == null) {
+	private static volatile SaOAuth2ServerConfig serverConfig;
+	public static SaOAuth2ServerConfig getServerConfig() {
+		if (serverConfig == null) {
 			// 初始化默认值
 			synchronized (SaOAuth2Manager.class) {
-				if (config == null) {
-					setConfig(new SaOAuth2ServerConfig());
+				if (serverConfig == null) {
+					setServerConfig(new SaOAuth2ServerConfig());
 				}
 			}
 		}
-		return config;
+		return serverConfig;
 	}
-	public static void setConfig(SaOAuth2ServerConfig config) {
-		SaOAuth2Manager.config = config;
+	public static void setServerConfig(SaOAuth2ServerConfig serverConfig) {
+		SaOAuth2Manager.serverConfig = serverConfig;
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2OidcConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2OidcConfig.java
new file mode 100644
index 00000000..2eb817d4
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2OidcConfig.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.config;
+
+import java.io.Serializable;
+
+/**
+ * Sa-Token OAuth2 Server 端 Oidc 配置类 Model
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2OidcConfig implements Serializable {
+
+	private static final long serialVersionUID = -6541180061782004705L;
+
+	/** iss 值，如不配置则自动计算 */
+	public String iss;
+
+	/** idToken 有效期（单位秒） 默认十分钟 */
+	public long idTokenTimeout = 60 * 10;
+
+	public String getIss() {
+		return iss;
+	}
+
+	public SaOAuth2OidcConfig setIss(String iss) {
+		this.iss = iss;
+		return this;
+	}
+
+	public long getIdTokenTimeout() {
+		return idTokenTimeout;
+	}
+
+	public SaOAuth2OidcConfig setIdTokenTimeout(long idTokenTimeout) {
+		this.idTokenTimeout = idTokenTimeout;
+		return this;
+	}
+
+	@Override
+	public String toString() {
+		return "SaOAuth2OidcConfig{" +
+				"iss='" + iss + '\'' +
+				", idTokenTimeout=" + idTokenTimeout +
+				'}';
+	}
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index 1ae2e05f..dbb2e74f 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -72,6 +72,11 @@ public class SaOAuth2ServerConfig implements Serializable {
 	/** 指定低级权限，多个用逗号隔开 */
 	public String lowerScope;
 
+	/**
+	 * oidc 相关配置
+	 */
+	SaOAuth2OidcConfig oidc = new SaOAuth2OidcConfig();
+
 	/**
 	 * @return enableCode
 	 */
@@ -287,6 +292,26 @@ public class SaOAuth2ServerConfig implements Serializable {
 		return this;
 	}
 
+	/**
+	 * 获取 oidc 相关配置
+	 *
+	 * @return oidc 相关配置
+	 */
+	public SaOAuth2OidcConfig getOidc() {
+		return this.oidc;
+	}
+
+	/**
+	 * 设置 oidc 相关配置
+	 *
+	 * @param oidc /
+	 * @return /
+	 */
+	public SaOAuth2ServerConfig setOidc(SaOAuth2OidcConfig oidc) {
+		this.oidc = oidc;
+		return this;
+	}
+
 
 	// -------------------- SaOAuth2Handle 所有回调函数 --------------------
 	
@@ -321,6 +346,7 @@ public class SaOAuth2ServerConfig implements Serializable {
 				", openidDigestPrefix='" + openidDigestPrefix +
 				", higherScope='" + higherScope +
 				", lowerScope='" + lowerScope +
+				", oidc='" + oidc +
 				'}';
 	}
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
index 209f8a55..801e22cf 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -45,7 +45,7 @@ public interface SaOAuth2Dao {
 		if(c == null) {
 			return;
 		}
-		getSaTokenDao().setObject(splicingCodeSaveKey(c.code), c, SaOAuth2Manager.getConfig().getCodeTimeout());
+		getSaTokenDao().setObject(splicingCodeSaveKey(c.code), c, SaOAuth2Manager.getServerConfig().getCodeTimeout());
 	}
 
 	/**
@@ -56,7 +56,7 @@ public interface SaOAuth2Dao {
 		if(c == null) {
 			return;
 		}
-		getSaTokenDao().set(splicingCodeIndexKey(c.clientId, c.loginId), c.code, SaOAuth2Manager.getConfig().getCodeTimeout());
+		getSaTokenDao().set(splicingCodeIndexKey(c.clientId, c.loginId), c.code, SaOAuth2Manager.getServerConfig().getCodeTimeout());
 	}
 
 	/**
@@ -151,7 +151,7 @@ public interface SaOAuth2Dao {
 	default void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
 		if( ! SaFoxUtil.isEmpty(scopes)) {
 			// TODO ttl 计算规则优化
-			long ttl = SaOAuth2Manager.getConfig().getAccessTokenTimeout();
+			long ttl = SaOAuth2Manager.getServerConfig().getAccessTokenTimeout();
 			// long ttl = checkClientModel(clientId).getAccessTokenTimeout();
 			String value = SaOAuth2Manager.getDataConverter().convertScopeListToString(scopes);
 			getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), value, ttl);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index df6dece3..c8f93ef6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -60,7 +60,7 @@ public interface SaOAuth2DataLoader {
      * @return 此账号在此Client下的openid
      */
     default String getOpenid(String clientId, Object loginId) {
-        return SaSecureUtil.md5(SaOAuth2Manager.getConfig().getOpenidDigestPrefix() + "_" + clientId + "_" + loginId);
+        return SaSecureUtil.md5(SaOAuth2Manager.getServerConfig().getOpenidDigestPrefix() + "_" + clientId + "_" + loginId);
     }
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index e6ae542d..46e64344 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -75,7 +75,7 @@ public class SaClientModel implements Serializable {
 
 	
 	public SaClientModel() {
-		SaOAuth2ServerConfig config = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig config = SaOAuth2Manager.getServerConfig();
 		this.isNewRefresh = config.getIsNewRefresh();
 		this.accessTokenTimeout = config.getAccessTokenTimeout();
 		this.refreshTokenTimeout = config.getRefreshTokenTimeout();
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/oidc/IdTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/oidc/IdTokenModel.java
new file mode 100644
index 00000000..7e9783e0
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/oidc/IdTokenModel.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.data.model.oidc;
+
+import java.io.Serializable;
+import java.util.Map;
+
+/**
+ * OIDC IdToken Model
+ *
+ * <br/> 参考：
+ * <br/> <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDToken">IDToken</a>
+ * <br/> <a href="https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims">StandardClaims</a>
+ *
+ * @author click33
+ * @since 1.23.0
+ */
+public class IdTokenModel implements Serializable {
+
+	private static final long serialVersionUID = -6541180061782004705L;
+
+	/**
+	 * 必填：发行者标识符，例如：https://server.example.com
+	 */
+	public String iss;
+
+	/**
+	 * 必填：用户标识符，用户id，例如：10001
+	 */
+	public Object sub;
+
+	/**
+	 * 必填：客户端标识符，clientId，例如：s6BhdRkqt3
+	 */
+	public String aud;
+
+	/**
+	 * 必填：令牌到期时间，10位时间戳，例如：1723341795
+	 */
+	public long exp;
+
+	/**
+	 * 必填：签发此令牌的时间，10位时间戳，例如：1723339995
+	 */
+	public long iat;
+
+	/**
+	 * 用户认证时间，10位时间戳，例如：1723339988
+	 */
+	public long authTime;
+
+	/**
+	 * 随机数，客户端提供，防止重放攻击，例如：e9a3f4d9
+	 */
+	public String nonce;
+
+	/**
+	 * 身份验证上下文类引用
+	 */
+	public String acr;
+
+	/**
+	 * 身份验证方法参考
+	 */
+	public String amr;
+
+	/**
+	 * 授权方 - 签发 ID 令牌的一方，如果存在，它必须包含此方的 OAuth 2.0 客户端 ID。
+	 */
+	public String azp;
+
+	/**
+	 * 扩展数据
+	 */
+	public Map<String, Object> extraData;
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
index 62803e27..c1b96496 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
@@ -29,7 +29,15 @@ public class SaOAuth2Exception extends SaTokenException {
 	 * 序列化版本号
 	 */
 	private static final long serialVersionUID = 6806129545290130114L;
-	
+
+	/**
+	 * 一个异常：代表OAuth2认证流程错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2Exception(Throwable cause) {
+		super(cause);
+	}
+
 	/**
 	 * 一个异常：代表OAuth2认证流程错误 
 	 * @param message 异常描述 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
index 1609e355..e5615e83 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/PasswordGrantTypeHandler.java
@@ -70,7 +70,7 @@ public class PasswordGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterfa
      * @param password /
      */
     public void loginByUsernamePassword(String username, String password) {
-        SaOAuth2Manager.getConfig().doLoginHandle.apply(username, password);
+        SaOAuth2Manager.getServerConfig().doLoginHandle.apply(username, password);
     }
 
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index ed8cc38b..ce05abc9 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -113,7 +113,7 @@ public class SaOAuth2ServerProcessor {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
 		SaResponse res = SaHolder.getResponse();
-		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getServerConfig();
 		SaOAuth2DataGenerate dataGenerate = SaOAuth2Manager.getDataGenerate();
 		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 		String responseType = req.getParamNotNull(Param.response_type);
@@ -218,7 +218,7 @@ public class SaOAuth2ServerProcessor {
 	public Object doLogin() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getServerConfig();
 
 		return cfg.doLoginHandle.apply(req.getParam(Param.name), req.getParam(Param.pwd));
 	}
@@ -285,7 +285,7 @@ public class SaOAuth2ServerProcessor {
 	public Object clientToken() {
 		// 获取变量
 		SaRequest req = SaHolder.getRequest();
-		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig cfg = SaOAuth2Manager.getServerConfig();
 		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
 
 		String grantType = req.getParamNotNull(Param.grant_type);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
index 7adb42d6..97c70d1d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/scope/handler/OidcScopeHandler.java
@@ -15,9 +15,25 @@
  */
 package cn.dev33.satoken.oauth2.scope.handler;
 
+import cn.dev33.satoken.SaManager;
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.context.model.SaRequest;
+import cn.dev33.satoken.jwt.SaJwtUtil;
+import cn.dev33.satoken.jwt.error.SaJwtErrorCode;
+import cn.dev33.satoken.jwt.exception.SaJwtException;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+import cn.dev33.satoken.oauth2.data.model.oidc.IdTokenModel;
+import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.scope.CommonScope;
+import cn.dev33.satoken.util.SaFoxUtil;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
 /**
  * id_token 权限处理器：在 AccessToken 扩展参数中追加 id_token 字段
@@ -33,7 +49,31 @@ public class OidcScopeHandler implements SaOAuth2ScopeHandlerInterface {
 
     @Override
     public void workAccessToken(AccessTokenModel at) {
-        // TODO 追加参数 id_token
+        SaRequest req = SaHolder.getRequest();
+        ClientIdAndSecretModel client = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
+
+        // 基础参数
+        IdTokenModel idToken = new IdTokenModel();
+        idToken.iss = getIss();
+        idToken.sub = at.loginId;
+        idToken.aud = client.clientId;
+        idToken.iat = System.currentTimeMillis() / 1000;
+        idToken.exp = idToken.iat + SaOAuth2Manager.getServerConfig().getOidc().getIdTokenTimeout();
+        idToken.authTime = SaOAuth2Manager.getStpLogic().getSessionByLoginId(at.loginId).getCreateTime() / 1000;
+        idToken.nonce = getNonce();
+        idToken.acr = null;
+        idToken.amr = null;
+        idToken.azp = client.clientId;
+
+        // 额外参数
+        idToken.extraData = new LinkedHashMap<>();
+        idToken = workExtraData(idToken);
+
+        // 构建 jwtIdToken
+        String jwtIdToken = generateJwtIdToken(idToken);
+
+        // 放入 AccessTokenModel
+        at.extraData.put("id_token", jwtIdToken);
     }
 
     @Override
@@ -41,4 +81,84 @@ public class OidcScopeHandler implements SaOAuth2ScopeHandlerInterface {
 
     }
 
+    /**
+     * 获取 iss
+     * @return /
+     */
+    public String getIss() {
+        String urlString = SaHolder.getRequest().getUrl();
+        try {
+            URL url = new URL(urlString);
+            String iss = url.getProtocol() + "://" + url.getHost();
+            if(url.getPort() != -1) {
+                iss += ":" + url.getPort();
+            }
+            return iss;
+        } catch (MalformedURLException e) {
+            throw new SaOAuth2Exception(e);
+        }
+    }
+
+    /**
+     * 获取 nonce
+     * @return /
+     */
+    public String getNonce() {
+        String nonce = SaHolder.getRequest().getParam("nonce");
+        if(SaFoxUtil.isEmpty(nonce)) {
+            nonce = SaFoxUtil.getRandomString(32);
+        }
+        SaManager.getSaSignTemplate().checkNonce(nonce);
+        return nonce;
+    }
+
+    /**
+     * 加工 IdTokenModel
+     * @return /
+     */
+    public IdTokenModel workExtraData(IdTokenModel idToken) {
+        //
+        return idToken;
+    }
+
+    /**
+     * 将 IdTokenModel 转化为 Map 数据
+     * @return /
+     */
+    public Map<String, Object> convertIdTokenToMap(IdTokenModel idToken) {
+        // 基础参数
+        Map<String, Object> map = new LinkedHashMap<>();
+        map.put("iss", idToken.iss);
+        map.put("sub", idToken.sub);
+        map.put("aud", idToken.aud);
+        map.put("exp", idToken.exp);
+        map.put("iat", idToken.iat);
+        map.put("auth_time", idToken.authTime);
+        map.put("nonce", idToken.nonce);
+        map.put("acr", idToken.acr);
+        map.put("amr", idToken.amr);
+        map.put("azp", idToken.azp);
+
+        // 移除 null 值
+        idToken.extraData.entrySet().removeIf(entry -> entry.getValue() == null);
+
+        // 扩展参数
+        map.putAll(idToken.extraData);
+
+        // 返回
+        return map;
+    }
+
+    /**
+     * 生成 jwt 格式的 id_token
+     * @param idToken /
+     * @return /
+     */
+    public String generateJwtIdToken(IdTokenModel idToken) {
+        Map<String, Object> dataMap = convertIdTokenToMap(idToken);
+        String keyt = SaOAuth2Manager.getStpLogic().getConfigOrGlobal().getJwtSecretKey();
+        SaJwtException.throwByNull(keyt, "请配置jwt秘钥", SaJwtErrorCode.CODE_30205);
+        return SaJwtUtil.createToken(dataMap, keyt);
+    }
+
 }
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index dbfda655..939b9ff9 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -170,7 +170,7 @@ public final class SaOAuth2Strategy {
 		}
 
 		// 看看全局是否开启了此 grantType
-		SaOAuth2ServerConfig config = SaOAuth2Manager.getConfig();
+		SaOAuth2ServerConfig config = SaOAuth2Manager.getServerConfig();
 		if(grantType.equals(GrantType.authorization_code) && !config.getEnableAuthorizationCode() ) {
 			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
 		}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index cbfeedbb..ea5d33ca 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -401,7 +401,7 @@ public class SaOAuth2Template {
 	 * @return /
 	 */
 	public List<String> getHigherScopeList() {
-		String higherScope = SaOAuth2Manager.getConfig().getHigherScope();
+		String higherScope = SaOAuth2Manager.getServerConfig().getHigherScope();
 		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(higherScope);
 	}
 
@@ -410,7 +410,7 @@ public class SaOAuth2Template {
 	 * @return /
 	 */
 	public List<String> getLowerScopeList() {
-		String lowerScope = SaOAuth2Manager.getConfig().getLowerScope();
+		String lowerScope = SaOAuth2Manager.getServerConfig().getLowerScope();
 		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(lowerScope);
 	}
 
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
index dab18067..d0d7ee45 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/oauth2/SaOAuth2AutoConfigure.java
@@ -18,7 +18,6 @@ package cn.dev33.satoken.solon.oauth2;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
-import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import org.noear.solon.annotation.Bean;
 import org.noear.solon.annotation.Condition;
 import org.noear.solon.annotation.Configuration;
@@ -36,11 +35,11 @@ public class SaOAuth2AutoConfigure {
     @Bean
     public void init(AppContext appContext) throws Throwable {
         appContext.subBeansOfType(SaOAuth2Template.class, bean -> {
-            SaOAuth2Util.saOAuth2Template = bean;
+            SaOAuth2Manager.setTemplate(bean);
         });
 
         appContext.subBeansOfType(SaOAuth2ServerConfig.class, bean -> {
-            SaOAuth2Manager.setConfig(bean);
+            SaOAuth2Manager.setServerConfig(bean);
         });
     }
 
@@ -48,7 +47,7 @@ public class SaOAuth2AutoConfigure {
      * 获取 OAuth2配置Bean
      */
     @Bean
-    public SaOAuth2ServerConfig getConfig(@Inject(value = "${sa-token.oauth2}", required = false) SaOAuth2ServerConfig oAuth2Config) {
+    public SaOAuth2ServerConfig getConfig(@Inject(value = "${sa-token.oauth2-server}", required = false) SaOAuth2ServerConfig oAuth2Config) {
         return oAuth2Config;
     }
 }
\ No newline at end of file
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
index 092d7956..03748859 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanInject.java
@@ -53,7 +53,7 @@ public class SaOAuth2BeanInject {
 	 */
 	@Autowired(required = false)
 	public void setSaOAuth2Config(SaOAuth2ServerConfig saOAuth2Config) {
-		SaOAuth2Manager.setConfig(saOAuth2Config);
+		SaOAuth2Manager.setServerConfig(saOAuth2Config);
 	}
 
 	/**
-- 
Gitee


From 2d13e908b1016890817f802bc71de2a96ded6287 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 03:46:03 +0800
Subject: [PATCH 146/172] =?UTF-8?q?access=5Ftoken=20=E8=AF=BB=E5=8F=96?=
 =?UTF-8?q?=E5=85=BC=E5=AE=B9=20Bearer=20Token=20=E6=96=B9=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/pj/SaOAuth2ServerApplication.java     |  4 +--
 .../pj/oauth2/SaOAuth2ServerController.java   |  5 +--
 sa-token-doc/oauth2/readme.md                 |  5 +--
 .../satoken/oauth2/consts/SaOAuth2Consts.java |  1 +
 .../data/resolver/SaOAuth2DataResolver.java   | 21 ++++++-------
 .../SaOAuth2DataResolverDefaultImpl.java      | 31 +++++++++++++++++--
 6 files changed, 46 insertions(+), 21 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
index d8c7a741..33cadea4 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
@@ -4,8 +4,6 @@ import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
-import java.net.MalformedURLException;
-
 /**
  * 启动：Sa-OAuth2 Server端 
  * @author click33 
@@ -13,7 +11,7 @@ import java.net.MalformedURLException;
 @SpringBootApplication 
 public class SaOAuth2ServerApplication {
 
-	public static void main(String[] args) throws MalformedURLException {
+	public static void main(String[] args) {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
 		System.out.println("\nSa-Token-OAuth2 Server端启动成功，配置如下：");
 		System.out.println(SaOAuth2Manager.getServerConfig());
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index bc473a8a..929bdd4f 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -1,6 +1,7 @@
 package com.pj.oauth2;
 
 import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
@@ -8,7 +9,6 @@ import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.ModelAndView;
 
@@ -63,8 +63,9 @@ public class SaOAuth2ServerController {
 	
 	// 获取 userinfo 信息：昵称、头像、性别等等
 	@RequestMapping("/oauth2/userinfo")
-	public SaResult userinfo(@RequestParam("access_token") String accessToken) {
+	public SaResult userinfo() {
 		// 获取 Access-Token 对应的账号id
+		String accessToken = SaOAuth2Manager.getDataResolver().readAccessToken(SaHolder.getRequest());
 		Object loginId = SaOAuth2Util.getLoginIdByAccessToken(accessToken);
 		System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
 		
diff --git a/sa-token-doc/oauth2/readme.md b/sa-token-doc/oauth2/readme.md
index 5776fb42..9a34cb52 100644
--- a/sa-token-doc/oauth2/readme.md
+++ b/sa-token-doc/oauth2/readme.md
@@ -40,8 +40,9 @@
 
 2. oauth2-client 第三方公司端
 	1. 第三方公司登录 oauth-server 数据前台申请端，申请注册应用，拿到 `clientId`、`clientSecret` 等数据。
-	2. 在自己系统通过 `clientId`、`clientSecret` 等参数对接 oauth2-server 授权端，拿到 `access_token`。
-	3. 通过 `access_token` 调用 oauth2-server 资源端接口，拿到对应资源数据。
+	2. 根据自己的业务选择对应的 scope 申请签约，等待平台端审核通过。
+	3. 在自己系统通过 `clientId`、`clientSecret` 等参数对接 oauth2-server 授权端，拿到 `access_token`。
+	4. 通过 `access_token` 调用 oauth2-server 资源端接口，拿到对应资源数据。
 
 3. 用户端操作
 	1. 打开第三方公司开发的网站或APP等程序。
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index d2ab4bb8..bdb8c650 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -58,6 +58,7 @@ public class SaOAuth2Consts {
 		public static String name = "name";
 		public static String pwd = "pwd";
 		public static String build_redirect_uri = "build_redirect_uri";
+		public static String Authorization = "Authorization";
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 4dd957b9..5ea2b7dd 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -18,8 +18,8 @@ package cn.dev33.satoken.oauth2.data.resolver;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.Map;
@@ -42,6 +42,14 @@ public interface SaOAuth2DataResolver {
      */
     ClientIdAndSecretModel readClientIdAndSecret(SaRequest request);
 
+    /**
+     * 数据读取：从请求对象中读取 AccessToken
+     *
+     * @param request /
+     * @return /
+     */
+    String readAccessToken(SaRequest request);
+
     /**
      * 数据读取：从请求对象中构建 RequestAuthModel
      * @param req SaRequest对象
@@ -75,21 +83,10 @@ public interface SaOAuth2DataResolver {
         return SaResult.ok();
     }
 
-    /**
-     * 构建返回值: password 模式认证 获取 token
-     * @param at token信息
-     * @return /
-     */
-    default Map<String, Object> buildPasswordReturnValue(AccessTokenModel at) {
-        return buildTokenReturnValue(at);
-    }
-
     /**
      * 构建返回值: 凭证式 模式认证 获取 token
      * @param ct token信息
      */
     Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct);
 
-
-
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 339ac51a..7ccc9fe2 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -22,8 +22,8 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -56,7 +56,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
             return new ClientIdAndSecretModel(clientId, clientSecret);
         }
 
-        // 如果请求参数中没有提供 client_id 参数，则尝试从 base auth 中获取
+        // 如果请求参数中没有提供 client_id 参数，则尝试从 Authorization 中获取
         String authorizationValue = SaHttpBasicUtil.getAuthorizationValue();
         if(SaFoxUtil.isNotEmpty(authorizationValue)) {
             String[] arr = authorizationValue.split(":");
@@ -71,6 +71,33 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         throw new SaOAuth2Exception("请提供 client 信息");
     }
 
+    /**
+     * 数据读取：从请求对象中读取 AccessToken
+     */
+    @Override
+    public String readAccessToken(SaRequest request) {
+        // 优先从请求参数中获取
+        String accessToken = request.getParam(SaOAuth2Consts.Param.access_token);
+        if(SaFoxUtil.isNotEmpty(accessToken)) {
+            return accessToken;
+        }
+
+        // 如果请求参数中没有提供 access_token 参数，则尝试从 Authorization 中获取
+        String authorizationValue = request.getHeader(SaOAuth2Consts.Param.Authorization);
+        if(SaFoxUtil.isEmpty(authorizationValue)) {
+            return null;
+        }
+
+        // 判断前缀，裁剪
+        String prefix = TokenType.Bearer + " ";
+        if(authorizationValue.startsWith(prefix)) {
+            return authorizationValue.substring(prefix.length());
+        }
+
+        // 前缀不符合，返回 null
+        return null;
+    }
+
     /**
      * 数据读取：从请求对象中构建 RequestAuthModel
      */
-- 
Gitee


From 06b06cdb5e5411fd65a93b1fd6002b0d79a5d74b Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 04:14:12 +0800
Subject: [PATCH 147/172] =?UTF-8?q?TokenType=20=E6=8C=87=E5=AE=9A=E6=96=B9?=
 =?UTF-8?q?=E5=BC=8F=E7=BB=86=E8=8A=82=E9=87=8D=E6=9E=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/oauth2/oauth2-apidoc.md          |  5 ++++
 sa-token-doc/oauth2/oauth2-custom-scope.md    |  3 +-
 .../SaOAuth2DataConverterDefaultImpl.java     |  3 ++
 .../SaOAuth2DataGenerateDefaultImpl.java      |  2 ++
 .../oauth2/data/model/AccessTokenModel.java   | 28 +++++++++++++++++--
 .../oauth2/data/model/ClientTokenModel.java   | 19 +++++++++++--
 .../SaOAuth2DataResolverDefaultImpl.java      |  3 +-
 .../processor/SaOAuth2ServerProcessor.java    |  3 +-
 8 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/sa-token-doc/oauth2/oauth2-apidoc.md b/sa-token-doc/oauth2/oauth2-apidoc.md
index a1b7b10f..6699de53 100644
--- a/sa-token-doc/oauth2/oauth2-apidoc.md
+++ b/sa-token-doc/oauth2/oauth2-apidoc.md
@@ -233,6 +233,11 @@ http://{host}:{port}/oauth2/userinfo?access_token={access_token}
 }
 ```
 
+除了直接在 url 中以 query 参数方式提交 `access_token`，你也可以在 `Authorization` 请求头以 `Bearer Token` 方式提交：
+``` js
+header['Authorization'] = 'Bearer access_token';
+```
+
 
 ## 2、模式二：隐藏式（Implicit）
 
diff --git a/sa-token-doc/oauth2/oauth2-custom-scope.md b/sa-token-doc/oauth2/oauth2-custom-scope.md
index 58207223..a857913d 100644
--- a/sa-token-doc/oauth2/oauth2-custom-scope.md
+++ b/sa-token-doc/oauth2/oauth2-custom-scope.md
@@ -20,8 +20,9 @@ sa-token-oauth2 提供两种模式，让 access_token 可以得到更多信息
 ``` java
 // 获取 userinfo 信息：昵称、头像、性别等等
 @RequestMapping("/oauth2/userinfo")
-public SaResult userinfo(@RequestParam("access_token") String accessToken) {
+public SaResult userinfo() {
 	// 获取 Access-Token 对应的账号id
+	String accessToken = SaOAuth2Manager.getDataResolver().readAccessToken(SaHolder.getRequest());
 	Object loginId = SaOAuth2Util.getLoginIdByAccessToken(accessToken);
 	System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
 	
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 1c8865f5..03073085 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -16,6 +16,7 @@
 package cn.dev33.satoken.oauth2.data.convert;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
@@ -78,6 +79,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         at.clientId = cm.clientId;
         at.loginId = cm.loginId;
         at.scopes = cm.scopes;
+        at.tokenType = SaOAuth2Consts.TokenType.bearer;
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(cm.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
         at.extraData = new LinkedHashMap<>();
@@ -118,6 +120,7 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
         at.clientId = rt.clientId;
         at.loginId = rt.loginId;
         at.scopes = rt.scopes;
+        at.tokenType = SaOAuth2Consts.TokenType.bearer;
         at.extraData = new LinkedHashMap<>(rt.extraData);
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
         at.expiresTime = System.currentTimeMillis() + (clientModel.getAccessTokenTimeout() * 1000);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 1ff51e79..0090a2db 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -166,6 +166,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         // 2、生成 新Access-Token
         String newAtValue = SaOAuth2Strategy.instance.createAccessToken.execute(ra.clientId, ra.loginId, ra.scopes);
         AccessTokenModel at = new AccessTokenModel(newAtValue, ra.clientId, ra.loginId, ra.scopes);
+        at.tokenType = SaOAuth2Consts.TokenType.bearer;
 
         // 3、根据权限构建额外参数
         at.extraData = new LinkedHashMap<>();
@@ -220,6 +221,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         // 3、生成新 Client-Token
         String clientTokenValue = SaOAuth2Strategy.instance.createClientToken.execute(clientId, scopes);
         ClientTokenModel ct = new ClientTokenModel(clientTokenValue, clientId, scopes);
+        ct.tokenType = SaOAuth2Consts.TokenType.bearer;
         ct.expiresTime = System.currentTimeMillis() + (cm.getClientTokenTimeout() * 1000);
         ct.extraData = new LinkedHashMap<>();
         SaOAuth2Strategy.instance.workClientTokenByScope.accept(ct);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
index 83325e81..21935d83 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/AccessTokenModel.java
@@ -64,6 +64,11 @@ public class AccessTokenModel implements Serializable {
 	 */
 	public List<String> scopes;
 
+	/**
+	 * Token 类型
+	 */
+	public String tokenType;
+
 	/**
 	 * 扩展数据
 	 */
@@ -152,6 +157,15 @@ public class AccessTokenModel implements Serializable {
 		return this;
 	}
 
+	public String getTokenType() {
+		return tokenType;
+	}
+
+	public AccessTokenModel setTokenType(String tokenType) {
+		this.tokenType = tokenType;
+		return this;
+	}
+
 	public Map<String, Object> getExtraData() {
 		return extraData;
 	}
@@ -163,9 +177,17 @@ public class AccessTokenModel implements Serializable {
 
 	@Override
 	public String toString() {
-		return "AccessTokenModel [accessToken=" + accessToken + ", refreshToken=" + refreshToken
-				+ ", accessTokenTimeout=" + expiresTime + ", refreshTokenTimeout=" + refreshExpiresTime
-				+ ", clientId=" + clientId + ", scopes=" + scopes + ", extraData=" + extraData + "]";
+		return "AccessTokenModel{" +
+				"accessToken='" + accessToken + '\'' +
+				", refreshToken='" + refreshToken + '\'' +
+				", expiresTime=" + expiresTime +
+				", refreshExpiresTime=" + refreshExpiresTime +
+				", clientId='" + clientId + '\'' +
+				", loginId=" + loginId +
+				", scopes=" + scopes +
+				", tokenType='" + tokenType + '\'' +
+				", extraData=" + extraData +
+				'}';
 	}
 
 	// 追加只读属性
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
index 1d9865eb..d31bb1c9 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/ClientTokenModel.java
@@ -49,6 +49,11 @@ public class ClientTokenModel implements Serializable {
 	 */
 	public List<String> scopes;
 
+	/**
+	 * Token 类型
+	 */
+	public String tokenType;
+
 	/**
 	 * 扩展数据
 	 */
@@ -91,6 +96,15 @@ public class ClientTokenModel implements Serializable {
 		return this;
 	}
 
+	public String getTokenType() {
+		return tokenType;
+	}
+
+	public ClientTokenModel setTokenType(String tokenType) {
+		this.tokenType = tokenType;
+		return this;
+	}
+
 	public Map<String, Object> getExtraData() {
 		return extraData;
 	}
@@ -118,10 +132,11 @@ public class ClientTokenModel implements Serializable {
 	@Override
 	public String toString() {
 		return "ClientTokenModel{" +
-				"clientToken='" + clientToken + '\'' +
+				"clientToken='" + clientToken +
 				", expiresTime=" + expiresTime +
-				", clientId='" + clientId + '\'' +
+				", clientId='" + clientId +
 				", scopes=" + scopes +
+				", tokenType=" + tokenType +
 				", extraData=" + extraData +
 				'}';
 	}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 7ccc9fe2..5693d9aa 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -122,7 +122,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     @Override
     public Map<String, Object> buildTokenReturnValue(AccessTokenModel at) {
         Map<String, Object> map = new LinkedHashMap<>();
-        map.put("token_type", TokenType.bearer);
+        map.put("token_type", at.tokenType);
         map.put("access_token", at.accessToken);
         map.put("refresh_token", at.refreshToken);
         map.put("expires_in", at.getExpiresIn());
@@ -139,6 +139,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     @Override
     public Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct) {
         Map<String, Object> map = new LinkedHashMap<>();
+        map.put("token_type", ct.tokenType);
         map.put("client_token", ct.clientToken);
         // map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
         map.put("expires_in", ct.getExpiresIn());
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index ce05abc9..552c46b4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -303,8 +303,7 @@ public class SaOAuth2ServerProcessor {
 		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(req);
 		String clientId = clientIdAndSecret.clientId;
 		String clientSecret = clientIdAndSecret.clientSecret;
-		String scope = req.getParam(Param.scope, "");
-		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
+		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(req.getParam(Param.scope));
 
 		//校验 ClientScope
 		oauth2Template.checkContract(clientId, scopes);
-- 
Gitee


From 760805f78cdd65477039997314eeb0c64d08b9f8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 04:27:29 +0800
Subject: [PATCH 148/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20mode4ReturnAccessT?=
 =?UTF-8?q?oken=20=E9=85=8D=E7=BD=AE=EF=BC=8C=E6=8C=87=E5=AE=9A=E6=A8=A1?=
 =?UTF-8?q?=E5=BC=8F4=E6=98=AF=E5=90=A6=E8=BF=94=E5=9B=9E=20AccessToken=20?=
 =?UTF-8?q?=E5=AD=97=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/use/config.md                    | 27 +++++++++++++++++++
 .../oauth2/config/SaOAuth2ServerConfig.java   | 19 +++++++++++++
 .../SaOAuth2DataResolverDefaultImpl.java      |  5 +++-
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index bc314b06..210175e7 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -309,6 +309,8 @@ sa-token.sso-client.is-slo=true
 | openidDigestPrefix		| String	| openid_default_digest_prefix		| 默认 openid 生成算法中使用的摘要前缀				 	|
 | higherScope				| String	| 		| 指定高级权限，多个用逗号隔开				 	|
 | lowerScope				| String	| 		| 指定低级权限，多个用逗号隔开				 	|
+| mode4ReturnAccessToken	| Boolean	| false	| 模式4是否返回 AccessToken 字段，用于兼容OAuth2标准协议			 	|
+| oidc		| SaOAuth2OidcConfig	| new SaOAuth2OidcConfig()	| OIDC 相关配置			 	|
 
 配置示例：
 <!---------------------------- tabs:start ---------------------------->
@@ -337,6 +339,31 @@ sa-token.oauth2-server.enable-client-credentials=true
 <!---------------------------- tabs:end ---------------------------->
 
 
+##### OIDC 相关配置
+| 参数名称					| 类型		| 默认值	| 说明																			|
+| :--------					| :--------	| :--------	| :--------																	|
+| iss						| String	| 			| iss 值，如不配置则自动计算													|
+| idTokenTimeout			| long		| 600		| idToken 有效期（单位秒） 默认十分钟											|
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# Sa-Token 配置
+sa-token: 
+    oauth2-server: 
+		oidc: 
+			iss: xxx
+			idTokenTimeout: 600
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+sa-token.oauth2-server.oidc.iss=xxx
+sa-token.oauth2-server.oidc.idTokenTimeout=600
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+
 ##### SaClientModel属性定义
 | 参数名称				| 类型			| 默认值	| 说明													|
 | :--------				| :--------		| :--------	| :--------											|
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index dbb2e74f..39555dfd 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -72,6 +72,9 @@ public class SaOAuth2ServerConfig implements Serializable {
 	/** 指定低级权限，多个用逗号隔开 */
 	public String lowerScope;
 
+	/** 模式4是否返回 AccessToken 字段 */
+	public Boolean mode4ReturnAccessToken = false;
+
 	/**
 	 * oidc 相关配置
 	 */
@@ -292,6 +295,21 @@ public class SaOAuth2ServerConfig implements Serializable {
 		return this;
 	}
 
+	/**
+	 * @return mode4ReturnAccessToken
+	 */
+	public Boolean getMode4ReturnAccessToken() {
+		return mode4ReturnAccessToken;
+	}
+
+	/**
+	 * @param mode4ReturnAccessToken 要设置的 mode4ReturnAccessToken
+	 */
+	public SaOAuth2ServerConfig setMode4ReturnAccessToken(Boolean mode4ReturnAccessToken) {
+		this.mode4ReturnAccessToken = mode4ReturnAccessToken;
+		return this;
+	}
+
 	/**
 	 * 获取 oidc 相关配置
 	 *
@@ -346,6 +364,7 @@ public class SaOAuth2ServerConfig implements Serializable {
 				", openidDigestPrefix='" + openidDigestPrefix +
 				", higherScope='" + higherScope +
 				", lowerScope='" + lowerScope +
+				", mode4ReturnAccessToken='" + mode4ReturnAccessToken +
 				", oidc='" + oidc +
 				'}';
 	}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 5693d9aa..9311abb5 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -141,7 +141,10 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         Map<String, Object> map = new LinkedHashMap<>();
         map.put("token_type", ct.tokenType);
         map.put("client_token", ct.clientToken);
-        // map.put("access_token", ct.clientToken); // 兼容 OAuth2 协议
+        // 兼容 OAuth2 协议
+        if(SaOAuth2Manager.getServerConfig().mode4ReturnAccessToken) {
+             map.put("access_token", ct.clientToken);
+        }
         map.put("expires_in", ct.getExpiresIn());
         map.put("client_id", ct.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(ct.scopes));
-- 
Gitee


From 8c008a1aec08ad7a9f22b4fb02eb801ecd8525ff Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 04:44:14 +0800
Subject: [PATCH 149/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20hideStatusField=20?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E9=A1=B9=EF=BC=8C=E7=94=A8=E4=BA=8E=E6=8C=87?=
 =?UTF-8?q?=E5=AE=9A=E6=98=AF=E5=90=A6=E5=9C=A8=E8=BF=94=E5=9B=9E=E5=80=BC?=
 =?UTF-8?q?=E4=B8=AD=E9=9A=90=E8=97=8F=E9=BB=98=E8=AE=A4=E7=9A=84=E7=8A=B6?=
 =?UTF-8?q?=E6=80=81=E5=AD=97=E6=AE=B5=20(code=E3=80=81msg=E3=80=81data)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/pj/SaOAuth2ServerApplication.java     |  6 +++---
 .../oauth2/config/SaOAuth2ServerConfig.java   | 20 +++++++++++++++++++
 .../SaOAuth2DataResolverDefaultImpl.java      | 15 +++++++++++---
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
index 33cadea4..e7bef935 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/SaOAuth2ServerApplication.java
@@ -5,10 +5,10 @@ import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
 /**
- * 启动：Sa-OAuth2 Server端 
- * @author click33 
+ * 启动：Sa-OAuth2 Server端
+ * @author click33
  */
-@SpringBootApplication 
+@SpringBootApplication
 public class SaOAuth2ServerApplication {
 
 	public static void main(String[] args) {
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index 39555dfd..3791c939 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -75,6 +75,10 @@ public class SaOAuth2ServerConfig implements Serializable {
 	/** 模式4是否返回 AccessToken 字段 */
 	public Boolean mode4ReturnAccessToken = false;
 
+	/** 是否在返回值中隐藏默认的状态字段 (code、msg、data) */
+	public Boolean hideStatusField = false;
+
+
 	/**
 	 * oidc 相关配置
 	 */
@@ -310,6 +314,21 @@ public class SaOAuth2ServerConfig implements Serializable {
 		return this;
 	}
 
+	/**
+	 * @return hideStatusField
+	 */
+	public Boolean getHideStatusField() {
+		return hideStatusField;
+	}
+
+	/**
+	 * @param hideStatusField 要设置的 hideStatusField
+	 */
+	public SaOAuth2ServerConfig setHideStatusField(Boolean hideStatusField) {
+		this.hideStatusField = hideStatusField;
+		return this;
+	}
+
 	/**
 	 * 获取 oidc 相关配置
 	 *
@@ -365,6 +384,7 @@ public class SaOAuth2ServerConfig implements Serializable {
 				", higherScope='" + higherScope +
 				", lowerScope='" + lowerScope +
 				", mode4ReturnAccessToken='" + mode4ReturnAccessToken +
+				", hideStatusField='" + hideStatusField +
 				", oidc='" + oidc +
 				'}';
 	}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 9311abb5..31186e4b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -130,11 +130,15 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("client_id", at.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(at.scopes));
         map.putAll(at.extraData);
-        return SaResult.ok().setMap(map);
+        SaResult result = SaResult.ok().setMap(map);
+        if(SaOAuth2Manager.getServerConfig().hideStatusField) {
+            result.removeDefaultFields();
+        }
+        return result;
     }
 
     /**
-     * 构建返回值: password 模式认证 获取 token
+     * 构建返回值: 凭证式 模式认证 获取 token
      */
     @Override
     public Map<String, Object> buildClientTokenReturnValue(ClientTokenModel ct) {
@@ -149,7 +153,12 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         map.put("client_id", ct.clientId);
         map.put("scope", SaOAuth2Manager.getDataConverter().convertScopeListToString(ct.scopes));
         map.putAll(ct.extraData);
-        return SaResult.ok().setMap(map);
+
+        SaResult result = SaResult.ok().setMap(map);
+        if(SaOAuth2Manager.getServerConfig().hideStatusField) {
+            result.removeDefaultFields();
+        }
+        return result;
     }
 
 }
-- 
Gitee


From 8235fe7633e2c5035885ed3bd7413d6c10d54d5f Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 17:02:23 +0800
Subject: [PATCH 150/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20oauth2=20=E6=A8=A1?=
 =?UTF-8?q?=E5=9D=97=E5=B8=B8=E8=A7=81=E9=97=AE=E7=AD=94=E9=A1=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md                |  2 +-
 sa-token-doc/oauth2/oauth2-questions.md | 48 +++++++++++++++++++++++++
 sa-token-doc/use/config.md              |  1 +
 3 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 sa-token-doc/oauth2/oauth2-questions.md

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index eaa5c341..f11153ff 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -64,7 +64,7 @@
 	- [开启 OIDC 协议](/oauth2/oauth2-oidc)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
-	<!-- - [常见问题说明](/oauth2/8) -->
+	- [常见问题总结](/oauth2/oauth2-questions)
 	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
 	<!-- - [平台中心模式开发](/oauth2/5) -->
 	- <!-- jwt风格token、使用注解校验权限、state参数详解 -->
diff --git a/sa-token-doc/oauth2/oauth2-questions.md b/sa-token-doc/oauth2/oauth2-questions.md
new file mode 100644
index 00000000..0b92e069
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-questions.md
@@ -0,0 +1,48 @@
+# Sa-Token-OAuth2整合-常见问题总结
+
+OAuth2 集成常见问题整理
+
+[[toc]]
+
+--- 
+
+
+### 问：搭建好 oauth2-server 服务后，访问返回：`{"msg": "not handle"}`。
+
+返回这个信息，代表你访问的路由有错误，比如说：
+
+- 统一认证登录地址是：`http://{host}:{port}/oauth2/authorize`。
+- 而你访问的却是：`http://{host}:{port}/oauth2/authorize2`。
+
+地址写错了，框架就不会处理这个请求，会直接返回 `{"msg": "not handle"}`，所有开放地址可参考：[SSO 开放接口](/oauth2/oauth2-apidoc)
+
+如果仔细检查地址后没有写错，却依然返回了这个信息，那有可能是对应的接口没有打开，比如说：
+
+- sso-server 端的单点注销地址：`http://{host}:{port}/sso/signout`；
+- sso-client 端的注销地址：`http://{host}:{port}/sso/logout`；
+
+都需要在配置文件配置：`sa-token.sso.is-slo=true`后，才会打开。
+
+
+
+### 问：我参照文档搭建 oauth2-server，一直提示：code 无效，请问怎么回事？
+一个 code 码只能使用一次，多次使用就会报这个错。
+
+
+
+
+
+### 问：Sa-Token-OAuth2 怎么集成多账号模式？
+
+在 `configOAuth2Server` 里指定 oauth2 模块使用的 `StpLogic` 对象即可： 
+
+``` java
+// Sa-Token OAuth2 定制化配置
+@Autowired
+public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
+	// 其它配置 ... 
+	
+	// 指定 oauth2 模块使用的 `StpLogic` 对象 
+	SaOAuth2Manager.setStpLogic(StpUserUtil.stpLogic);
+}
+```
\ No newline at end of file
diff --git a/sa-token-doc/use/config.md b/sa-token-doc/use/config.md
index 210175e7..aa081436 100644
--- a/sa-token-doc/use/config.md
+++ b/sa-token-doc/use/config.md
@@ -310,6 +310,7 @@ sa-token.sso-client.is-slo=true
 | higherScope				| String	| 		| 指定高级权限，多个用逗号隔开				 	|
 | lowerScope				| String	| 		| 指定低级权限，多个用逗号隔开				 	|
 | mode4ReturnAccessToken	| Boolean	| false	| 模式4是否返回 AccessToken 字段，用于兼容OAuth2标准协议			 	|
+| hideStatusField			| Boolean	| false	| 是否在返回值中隐藏默认的状态字段 (code、msg、data)			 	|
 | oidc		| SaOAuth2OidcConfig	| new SaOAuth2OidcConfig()	| OIDC 相关配置			 	|
 
 配置示例：
-- 
Gitee


From a1560ce0a783648ab8c0855707bf147ac657a4f7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 17:55:46 +0800
Subject: [PATCH 151/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20StpLogic#getOrCrea?=
 =?UTF-8?q?teLoginSession=20=E6=96=B9=E6=B3=95=EF=BC=8C=E8=8E=B7=E5=8F=96?=
 =?UTF-8?q?=E6=8C=87=E5=AE=9A=E8=B4=A6=E5=8F=B7=20id=20=E7=9A=84=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=E4=BC=9A=E8=AF=9D=E6=95=B0=E6=8D=AE=EF=BC=8C=E5=A6=82?=
 =?UTF-8?q?=E6=9E=9C=E8=8E=B7=E5=8F=96=E4=B8=8D=E5=88=B0=E5=88=99=E5=88=9B?=
 =?UTF-8?q?=E5=BB=BA=E5=B9=B6=E8=BF=94=E5=9B=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/stp/StpLogic.java   | 15 ++++++++++++++-
 .../java/cn/dev33/satoken/stp/StpUtil.java    | 12 +++++++++++-
 .../main/java/com/pj/satoken/StpUserUtil.java | 10 ++++++++++
 .../pj/oauth2/SaOAuth2ServerController.java   |  7 +++++++
 .../main/java/com/pj/satoken/StpUserUtil.java | 10 ++++++++++
 sa-token-doc/oauth2/oauth2-interworking.md    |  2 +-
 sa-token-doc/oauth2/oauth2-oidc.md            | 19 +++++++++++++++++++
 7 files changed, 72 insertions(+), 3 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
index 0e5050b5..57cfc2c3 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpLogic.java
@@ -37,7 +37,6 @@ import cn.dev33.satoken.util.SaTokenConsts;
 import cn.dev33.satoken.util.SaValue2Box;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.function.Consumer;
@@ -591,6 +590,20 @@ public class StpLogic {
 
 	}
 
+	/**
+	 * 获取指定账号 id 的登录会话数据，如果获取不到则创建并返回
+	 *
+	 * @param id 账号id，建议的类型：（long | int | String）
+	 * @return 返回会话令牌
+	 */
+	public String getOrCreateLoginSession(Object id) {
+		String tokenValue = getTokenValueByLoginId(id);
+		if(tokenValue == null) {
+			tokenValue = createLoginSession(id, new SaLoginModel());
+		}
+		return tokenValue;
+	}
+
 	// --- 注销 
 	
 	/** 
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpUtil.java
index aaf5ec7a..60cf4b92 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/stp/StpUtil.java
@@ -224,7 +224,17 @@ public class StpUtil {
 	public static String createLoginSession(Object id, SaLoginModel loginModel) {
 		return stpLogic.createLoginSession(id, loginModel);
 	}
-	
+
+	/**
+	 * 获取指定账号 id 的登录会话数据，如果获取不到则创建并返回
+	 *
+	 * @param id 账号id，建议的类型：（long | int | String）
+	 * @return 返回会话令牌
+	 */
+	public static String getOrCreateLoginSession(Object id) {
+		return stpLogic.getOrCreateLoginSession(id);
+	}
+
 	// --- 注销 
 
 	/**
diff --git a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
index d2fab5fd..1bbabcf7 100644
--- a/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
+++ b/sa-token-demo/sa-token-demo-case/src/main/java/com/pj/satoken/StpUserUtil.java
@@ -215,6 +215,16 @@ public class StpUserUtil {
 		return stpLogic.createLoginSession(id, loginModel);
 	}
 
+	/**
+	 * 获取指定账号 id 的登录会话数据，如果获取不到则创建并返回
+	 *
+	 * @param id 账号id，建议的类型：（long | int | String）
+	 * @return 返回会话令牌
+	 */
+	public static String getOrCreateLoginSession(Object id) {
+		return stpLogic.getOrCreateLoginSession(id);
+	}
+
 	// --- 注销
 
 	/**
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 929bdd4f..391a22d6 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -4,6 +4,7 @@ import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
+import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -56,6 +57,12 @@ public class SaOAuth2ServerController {
 			return new ModelAndView("confirm.html", map);
 		};
 
+		// 重写 AccessToken 创建策略，返回会话令牌
+		SaOAuth2Strategy.instance.createAccessToken = (clientId, loginId, scopes) -> {
+			System.out.println("----返回会话令牌");
+			return StpUtil.getOrCreateLoginSession(loginId);
+		};
+
 	}
 
 
diff --git a/sa-token-demo/sa-token-demo-test/src/main/java/com/pj/satoken/StpUserUtil.java b/sa-token-demo/sa-token-demo-test/src/main/java/com/pj/satoken/StpUserUtil.java
index ddaf4d25..9a54330e 100644
--- a/sa-token-demo/sa-token-demo-test/src/main/java/com/pj/satoken/StpUserUtil.java
+++ b/sa-token-demo/sa-token-demo-test/src/main/java/com/pj/satoken/StpUserUtil.java
@@ -212,6 +212,16 @@ public class StpUserUtil {
 		return stpLogic.createLoginSession(id, loginModel);
 	}
 
+	/**
+	 * 获取指定账号 id 的登录会话数据，如果获取不到则创建并返回
+	 *
+	 * @param id 账号id，建议的类型：（long | int | String）
+	 * @return 返回会话令牌
+	 */
+	public static String getOrCreateLoginSession(Object id) {
+		return stpLogic.getOrCreateLoginSession(id);
+	}
+
 	// --- 注销
 
 	/**
diff --git a/sa-token-doc/oauth2/oauth2-interworking.md b/sa-token-doc/oauth2/oauth2-interworking.md
index 77c0b33c..0ca981f0 100644
--- a/sa-token-doc/oauth2/oauth2-interworking.md
+++ b/sa-token-doc/oauth2/oauth2-interworking.md
@@ -27,7 +27,7 @@ public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 	// 重写 AccessToken 创建策略，返回会话令牌
 	SaOAuth2Strategy.instance.createAccessToken = (clientId, loginId, scopes) -> {
 		System.out.println("----返回会话令牌");
-		return StpUtil.createLoginSession(loginId);
+		return StpUtil.getOrCreateLoginSession(loginId);
 	};
 
 }
diff --git a/sa-token-doc/oauth2/oauth2-oidc.md b/sa-token-doc/oauth2/oauth2-oidc.md
index 754822ef..a275d0f8 100644
--- a/sa-token-doc/oauth2/oauth2-oidc.md
+++ b/sa-token-doc/oauth2/oauth2-oidc.md
@@ -47,6 +47,25 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 }
 ```
 
+3、在 `application.yml` 配置文件中配置 jwt 生成秘钥：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+sa-token:
+	# jwt秘钥 
+	jwt-secret-key: asdasdasifhueuiwyurfewbfjsdafjk
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# jwt秘钥 
+sa-token.jwt-secret-key: asdasdasifhueuiwyurfewbfjsdafjk
+```
+<!---------------------------- tabs:end ---------------------------->
+
+注：为了安全起见请不要直接复制官网示例这个字符串（随便按几个字符就好了）
+
+
 
 ### 2、测试
 
-- 
Gitee


From d3b337a6a6d0e0bb66ab277c5d42d8a29160753c Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 18:55:48 +0800
Subject: [PATCH 152/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=20revokeClientToken?=
 =?UTF-8?q?=E3=80=81revokeClientTokenByIndex=EF=BC=9A=20Client-Token=20?=
 =?UTF-8?q?=E5=9B=9E=E6=94=B6=E5=87=BD=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java |  9 ++++
 .../oauth2/template/SaOAuth2Template.java     | 41 +++++++++++++++++++
 .../satoken/oauth2/template/SaOAuth2Util.java | 21 +++++++++-
 3 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
index 801e22cf..136612e8 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -236,6 +236,15 @@ public interface SaOAuth2Dao {
 		getSaTokenDao().delete(splicingClientTokenIndexKey(clientId));
 	}
 
+	/**
+	 * 删除：Past-Token
+	 * @param pastToken 值
+	 */
+	default void deletePastToken(String pastToken) {
+		// 其实就是删除 ClientToken
+		deleteClientToken(pastToken);
+	}
+
 	/**
 	 * 删除：Past-Token索引
 	 * @param clientId 应用id
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index ea5d33ca..f9862b61 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -374,6 +374,47 @@ public class SaOAuth2Template {
 	}
 
 
+	/**
+	 * 回收指定的 ClientToken
+	 *
+	 * @param clientToken /
+	 */
+	public void revokeClientToken(String clientToken) {
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+		ClientTokenModel ctModel = dao.getClientToken(clientToken);
+		if(ctModel == null) {
+			return;
+		}
+		// 删 ct、索引
+		dao.deleteClientToken(clientToken);
+		dao.deleteClientTokenIndex(ctModel.clientId);
+	}
+
+	/**
+	 * 回收指定的 ClientToken，根据索引： clientId
+	 *
+	 * @param clientId /
+	 */
+	public void revokeClientTokenByIndex(String clientId) {
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+		// 删 clientToken
+		String clientToken = dao.getClientTokenValue(clientId);
+		if(clientToken != null) {
+			dao.deleteClientToken(clientToken);
+			dao.deleteClientTokenIndex(clientId);
+		}
+
+		// 删 pastToken
+		String pastToken = dao.getPastTokenValue(clientId);
+		if(pastToken != null) {
+			dao.deletePastToken(pastToken);
+			dao.deletePastTokenIndex(clientId);
+		}
+
+	}
+
+
 
 	// ------------------- 包装其它 bean 的方法
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 1e2fe37c..223d7dcb 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -21,7 +21,6 @@ import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
-import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
 
 import java.util.List;
 
@@ -175,7 +174,25 @@ public class SaOAuth2Util {
 	public static AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
 		return SaOAuth2Manager.getTemplate().checkAccessTokenParam(clientId, clientSecret, accessToken);
 	}
-	
+
+	/**
+	 * 回收指定的 ClientToken
+	 *
+	 * @param clientToken /
+	 */
+	public static void revokeClientToken(String clientToken) {
+		SaOAuth2Manager.getTemplate().revokeClientToken(clientToken);
+	}
+
+	/**
+	 * 回收指定的 ClientToken，根据索引：clientId
+	 *
+	 * @param clientId /
+	 */
+	public static void revokeClientTokenByIndex(String clientId) {
+		SaOAuth2Manager.getTemplate().revokeClientTokenByIndex(clientId);
+	}
+
 	// ------------------- save 数据 
 	
 	/**
-- 
Gitee


From e0a609b12862842926af6a49339fb19e9a403dbf Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sat, 24 Aug 2024 20:18:23 +0800
Subject: [PATCH 153/172] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=20state=20=E5=80=BC?=
 =?UTF-8?q?=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/resources/application.yml        |  2 +-
 sa-token-doc/oauth2/oauth2-questions.md       | 17 ++++++--
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java | 40 +++++++++++++++++++
 .../data/generate/SaOAuth2DataGenerate.java   |  6 +++
 .../SaOAuth2DataGenerateDefaultImpl.java      | 15 +++++++
 5 files changed, 76 insertions(+), 4 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index f12e1b5b..4c661c3c 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -4,7 +4,7 @@ server:
 # sa-token配置
 sa-token: 
     # token名称 (同时也是 Cookie 名称)
-    token-name: sa-token-oauth2-server
+    token-name: satoken
     # 是否打印操作日志
     is-log: true
     # jwt 秘钥
diff --git a/sa-token-doc/oauth2/oauth2-questions.md b/sa-token-doc/oauth2/oauth2-questions.md
index 0b92e069..4c7a4f33 100644
--- a/sa-token-doc/oauth2/oauth2-questions.md
+++ b/sa-token-doc/oauth2/oauth2-questions.md
@@ -30,8 +30,6 @@ OAuth2 集成常见问题整理
 
 
 
-
-
 ### 问：Sa-Token-OAuth2 怎么集成多账号模式？
 
 在 `configOAuth2Server` 里指定 oauth2 模块使用的 `StpLogic` 对象即可： 
@@ -45,4 +43,17 @@ public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 	// 指定 oauth2 模块使用的 `StpLogic` 对象 
 	SaOAuth2Manager.setStpLogic(StpUserUtil.stpLogic);
 }
-```
\ No newline at end of file
+```
+
+
+
+
+### 问：授权码流程中 state 参数是干吗用的？
+
+state 参数用于验证授权码流程的发起端和接受端是否为同一个客户端，以防止OAuth-Server账号伪装攻击。
+
+授权流程发起端必须保证：
+- state 参数必须足够随机，不可被预测。
+- state 参数与授权码流程发起客户端 一 一 对 应，授权流程发起时创建的 state 必须与接受时返回的 state 值一致。
+- 安全起见，一个 state 参数只允许使用一次。
+
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
index 136612e8..f3110717 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -158,6 +158,17 @@ public interface SaOAuth2Dao {
 		}
 	}
 
+	/**
+	 * 持久化：state
+	 * @param state /
+	 */
+	default void saveState(String state) {
+		if( ! SaFoxUtil.isEmpty(state)) {
+			long ttl = SaOAuth2Manager.getServerConfig().getCodeTimeout();
+			getSaTokenDao().set(splicingStateSaveKey(state), state, ttl);
+		}
+	}
+
 
 	// ------------------- delete数据
 
@@ -262,6 +273,14 @@ public interface SaOAuth2Dao {
 		getSaTokenDao().delete(splicingGrantScopeKey(clientId, loginId));
 	}
 
+	/**
+	 * 删除：state记录
+	 * @param state /
+	 */
+	default void deleteGrantScope(String state) {
+		getSaTokenDao().delete(splicingStateSaveKey(state));
+	}
+
 
 	// ------------------- get 数据
 
@@ -372,6 +391,18 @@ public interface SaOAuth2Dao {
 		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(value);
 	}
 
+	/**
+	 * 获取：state
+	 * @param state /
+	 * @return /
+	 */
+	default String getState(String state) {
+		if(SaFoxUtil.isEmpty(state)) {
+			return null;
+		}
+		return getSaTokenDao().get(splicingStateSaveKey(state));
+	}
+
 
 	// ------------------- 拼接key
 
@@ -469,6 +500,15 @@ public interface SaOAuth2Dao {
 		return getSaTokenConfig().getTokenName() + ":oauth2:grant-scope:" + clientId + ":" + loginId;
 	}
 
+	/**
+	 * 拼接key：state 参数持久化
+	 * @param state /
+	 * @return key
+	 */
+	default String splicingStateSaveKey(String state) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:state:" + state;
+	}
+
 
 	// -------- bean 对象代理
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
index 6fbee6a3..197dfde7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -91,4 +91,10 @@ public interface SaOAuth2DataGenerate {
      */
     void revokeAccessToken(String accessToken);
 
+    /**
+     * 检查 state 是否被重复使用
+     * @param state /
+     */
+    void checkState(String state);
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 0090a2db..266342bf 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -245,6 +245,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
     public String buildRedirectUri(String redirectUri, String code, String state) {
         String url = SaFoxUtil.joinParam(redirectUri, SaOAuth2Consts.Param.code, code);
         if( ! SaFoxUtil.isEmpty(state)) {
+            checkState(state);
             url = SaFoxUtil.joinParam(url, SaOAuth2Consts.Param.state, state);
         }
         return url;
@@ -261,6 +262,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
     public String buildImplicitRedirectUri(String redirectUri, String token, String state) {
         String url = SaFoxUtil.joinSharpParam(redirectUri, SaOAuth2Consts.Param.token, token);
         if( ! SaFoxUtil.isEmpty(state)) {
+            checkState(state);
             url = SaFoxUtil.joinSharpParam(url, SaOAuth2Consts.Param.state, state);
         }
         return url;
@@ -291,5 +293,18 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
     }
 
+    /**
+     * 检查 state 是否被重复使用
+     * @param state /
+     */
+    @Override
+    public void checkState(String state) {
+        String value = SaOAuth2Manager.getDao().getState(state);
+        if(SaFoxUtil.isNotEmpty(value)) {
+            throw new SaOAuth2Exception("多次请求的 state 不可重复: " + state);
+        }
+        SaOAuth2Manager.getDao().saveState(state);
+    }
+
 }
 
-- 
Gitee


From 7f20c8d4502c44626c1774bfde3f465d7b2cbd84 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 10:32:52 +0800
Subject: [PATCH 154/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=20SaOAuth2Util=20?=
 =?UTF-8?q?=E7=9B=B8=E5=85=B3=E6=96=B9=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/cn/dev33/satoken/util/SaFoxUtil.java |  30 +
 .../pj/oauth2/SaOAuth2ServerController.java   |   4 +-
 sa-token-doc/oauth2/oauth2-check-domain.md    |   2 +-
 sa-token-doc/oauth2/oauth2-dev.md             | 113 +++-
 .../data/generate/SaOAuth2DataGenerate.java   |   6 -
 .../SaOAuth2DataGenerateDefaultImpl.java      |  27 +-
 .../data/loader/SaOAuth2DataLoader.java       |   7 +-
 .../SaOAuth2AccessTokenException.java         |  73 +++
 .../SaOAuth2AccessTokenScopeException.java    |  87 +++
 .../SaOAuth2ClientModelException.java         |  86 +++
 .../SaOAuth2ClientModelScopeException.java    |  87 +++
 .../SaOAuth2ClientTokenException.java         |  73 +++
 .../SaOAuth2ClientTokenScopeException.java    |  87 +++
 .../oauth2/exception/SaOAuth2Exception.java   |   8 +-
 .../SaOAuth2RefreshTokenException.java        |  86 +++
 .../processor/SaOAuth2ServerProcessor.java    |   9 +-
 .../oauth2/template/SaOAuth2Template.java     | 563 ++++++++++++------
 .../satoken/oauth2/template/SaOAuth2Util.java | 362 ++++++-----
 18 files changed, 1326 insertions(+), 384 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenScopeException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelScopeException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenScopeException.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2RefreshTokenException.java

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
index 8044a223..63bfbb60 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaFoxUtil.java
@@ -106,14 +106,35 @@ public class SaFoxUtil {
 
 	/**
 	 * 指定数组是否为null或者空数组
+	 * <h3> 该方法已过时，建议使用 isEmptyArray 方法 </h3>
 	 * @param <T> /
 	 * @param array /
 	 * @return /
 	 */
+	@Deprecated
 	public static <T> boolean isEmpty(T[] array) {
+		return isEmptyArray(array);
+	}
+
+	/**
+	 * 指定数组是否为null或者空数组
+	 * @param <T> /
+	 * @param array /
+	 * @return /
+	 */
+	public static <T> boolean isEmptyArray(T[] array) {
 		return array == null || array.length == 0;
 	}
 
+	/**
+	 * 指定集合是否为null或者空数组
+	 * @param list /
+	 * @return /
+	 */
+	public static boolean isEmptyList(List<?> list) {
+		return list == null || list.isEmpty();
+	}
+
 	/**
 	 * 比较两个对象是否相等
 	 * @param a 第一个对象
@@ -626,6 +647,15 @@ public class SaFoxUtil {
 		return new ArrayList<>(Arrays.asList(str));
     }
 
+	/**
+	 * String 集合转数组
+	 * @param list 集合
+	 * @return 数组
+	 */
+	public static String[] toArray(List<String> list) {
+		return list.toArray(new String[0]);
+	}
+
     public static List<String> logLevelList = Arrays.asList("", "trace", "debug", "info", "warn", "error", "fatal");
 
     /**
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 391a22d6..94a95446 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -75,10 +75,10 @@ public class SaOAuth2ServerController {
 		String accessToken = SaOAuth2Manager.getDataResolver().readAccessToken(SaHolder.getRequest());
 		Object loginId = SaOAuth2Util.getLoginIdByAccessToken(accessToken);
 		System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
-		
+
 		// 校验 Access-Token 是否具有权限: userinfo
 		SaOAuth2Util.checkScope(accessToken, "userinfo");
-		
+
 		// 模拟账号信息 （真实环境需要查询数据库获取信息）
 		Map<String, Object> map = new LinkedHashMap<>();
 		// map.put("userId", loginId);  一般原则下，oauth2-server 不能把 userId 返回给 oauth2-client
diff --git a/sa-token-doc/oauth2/oauth2-check-domain.md b/sa-token-doc/oauth2/oauth2-check-domain.md
index a6e8faf6..841d3ff0 100644
--- a/sa-token-doc/oauth2/oauth2-check-domain.md
+++ b/sa-token-doc/oauth2/oauth2-check-domain.md
@@ -94,7 +94,7 @@ URL 没有通过校验，拒绝授权！
 - 反例：`http://*.sa-oauth-client.com/`
 
 *详见源码： [SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
-`checkAllowUrlListStaticMethod` 方法。*
+`checkRedirectUriListNormalStaticMethod` 方法。*
 
 参考：[github/issue/529](https://github.com/dromara/Sa-Token/issues/529)
 感谢这位 `@m4ra7h0n` 用户反馈的漏洞。
diff --git a/sa-token-doc/oauth2/oauth2-dev.md b/sa-token-doc/oauth2/oauth2-dev.md
index def72b9b..45f7097a 100644
--- a/sa-token-doc/oauth2/oauth2-dev.md
+++ b/sa-token-doc/oauth2/oauth2-dev.md
@@ -1,49 +1,118 @@
 # Sa-Token-OAuth2 Server端 二次开发用到的所有函数说明 
 
-官方示例只提供了基本的授权流程，以及userinfo资源的开放，如果您需要开放更多的接口，则二次开发时用到以下相关API方法 
+官方示例只提供了基本的授权流程，以及 userinfo 资源的开放，如果您需要开放更多的接口，则二次开发时可能用到以下相关 API 方法 
 
 --- 
 
-## Sa-OAuth2 模块常用方法
+### Client 信息相关
 
 ``` java
-// 根据 id 获取 Client 信息, 如果 Client 为空，则抛出异常 
+// 获取 ClientModel，根据 clientId
+SaOAuth2Util.getClientModel(clientId);
+
+// 校验 clientId 信息并返回 ClientModel，如果找不到对应 Client 信息则抛出异常
 SaOAuth2Util.checkClientModel(clientId);
 
-// 获取 Access-Token，如果Access-Token为空则抛出异常 
+// 校验：clientId 与 clientSecret 是否正确
+SaOAuth2Util.checkClientSecret(clientId, clientSecret);
+
+// 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes
+SaOAuth2Util.checkClientSecretAndScope(clientId, clientSecret, scopes);
+
+// 判断：该 Client 是否签约了指定的 Scope，返回 true 或 false
+SaOAuth2Util.isContractScope(clientId, scopes);
+
+// 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
+SaOAuth2Util.checkContractScope(clientId, scopes);
+
+// 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
+SaOAuth2Util.checkContractScope(clientModel, scopes);
+
+// 校验：该 Client 使用指定 url 作为回调地址，是否合法
+SaOAuth2Util.checkRedirectUri(clientId, url);
+
+// 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
+SaOAuth2Util.isGrantScope(loginId, clientId, scopes);
+```
+
+
+### Access-Token 相关
+``` java
+// 获取 AccessTokenModel，无效的 AccessToken 会返回 null
+SaOAuth2Util.getAccessToken(accessToken);
+
+// 校验 Access-Token，成功返回 AccessTokenModel，失败则抛出异常
 SaOAuth2Util.checkAccessToken(accessToken);
 
-// 获取 Client-Token，如果Client-Token为空则抛出异常
-SaOAuth2Util.checkClientToken(clientToken);
+// 获取 Access-Token，根据索引： clientId、loginId
+SaOAuth2Util.getAccessTokenValue(clientId, loginId);
+
+// 判断：指定 Access-Token 是否具有指定 Scope 列表，返回 true 或 false
+SaOAuth2Util.hasAccessTokenScope(accessToken, ...scopes);
+
+// 校验：指定 Access-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+SaOAuth2Util.checkAccessTokenScope(accessToken, ...scopes);
 
 // 获取 Access-Token 所代表的LoginId
 SaOAuth2Util.getLoginIdByAccessToken(accessToken);
 
-// 校验：指定 Access-Token 是否具有指定 Scope
-SaOAuth2Util.checkScope(accessToken, scopes);
+// 获取 Access-Token 所代表的 clientId
+SaOAuth2Util.getClientIdByAccessToken(accessToken);
+
+// 回收 Access-Token
+SaOAuth2Util.revokeAccessToken(accessToken);
+
+// 回收 Access-Token，根据索引： clientId、loginId
+SaOAuth2Util.revokeAccessTokenByIndex(clientId, loginId);
+```
+
+
+### Refresh-Token 相关
+``` java
+// 获取 RefreshTokenModel，无效的 RefreshToken 会返回 null
+SaOAuth2Util.getRefreshToken(refreshToken);
 
-// 根据 code码 生成 Access-Token 
-SaOAuth2Util.generateAccessToken(code);
+// 校验 Refresh-Token，成功返回 RefreshTokenModel，失败则抛出异常
+SaOAuth2Util.checkRefreshToken(refreshToken);
 
-// 根据 Refresh-Token 生成一个新的 Access-Token
+// 获取 Refresh-Token，根据索引： clientId、loginId
+SaOAuth2Util.getRefreshTokenValue(clientId, Object loginId);
+
+// 根据 RefreshToken 刷新出一个 AccessToken
 SaOAuth2Util.refreshAccessToken(refreshToken);
+```
 
-// 构建 Client-Token 
-SaOAuth2Util.generateClientToken(clientId, scope);
 
-// 校验 Client-Token 是否含有指定 Scope 
-SaOAuth2Util.checkClientTokenScope(clientToken, scopes);
+### Client-Token 相关
 
-// 回收 Access-Token 
-SaOAuth2Util.revokeAccessToken(accessToken);
+``` java
+// 获取 ClientTokenModel，无效的 ClientToken 会返回 null
+SaOAuth2Util.getClientToken(clientToken);
 
-// 持久化：用户授权记录 
-SaOAuth2Util.saveGrantScope(clientId, loginId, scope);
+// 校验 Client-Token，成功返回 ClientTokenModel，失败则抛出异常
+SaOAuth2Util.checkClientToken(clientToken);
 
-// 获取：Refresh-Token Model
-SaOAuth2Util.getRefreshToken(refreshToken);
+// 获取 ClientToken，根据索引： clientId
+SaOAuth2Util.getClientTokenValue(clientId);
+
+// 判断：指定 Client-Token 是否具有指定 Scope 列表，返回 true 或 false
+SaOAuth2Util.hasClientTokenScope(clientToken, ...scopes);
+
+// 校验：指定 Client-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+SaOAuth2Util.checkClientTokenScope(clientToken, ...scopes);
+
+// 回收 ClientToken
+SaOAuth2Util.revokeClientToken(clientToken);
+
+// 回收 ClientToken，根据索引： clientId
+SaOAuth2Util.revokeClientTokenByIndex(clientId);
+
+// 回收 PastToken，根据索引： clientId
+SaOAuth2Util.revokePastTokenByIndex(clientId);
 ```
 
-详情请参考源码：[码云：SaOAuth2Util.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Util.java)
+--- 
+
+详情请参考源码：[码云：SaOAuth2Util.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java)
 
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
index 197dfde7..aa9fe197 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerate.java
@@ -85,12 +85,6 @@ public interface SaOAuth2DataGenerate {
      */
     String buildImplicitRedirectUri(String redirectUri, String token, String state);
 
-    /**
-     * 回收 Access-Token
-     * @param accessToken Access-Token值
-     */
-    void revokeAccessToken(String accessToken);
-
     /**
      * 检查 state 是否被重复使用
      * @param state /
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 266342bf..33ad2055 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -126,7 +126,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
             // 删除旧 Refresh-Token
             dao.deleteRefreshToken(rt.refreshToken);
 
-            // 创建并保持新的 Refresh-Token
+            // 创建并保存新的 Refresh-Token
             rt = SaOAuth2Manager.getDataConverter().convertRefreshTokenToRefreshToken(rt);
             dao.saveRefreshToken(rt);
             dao.saveRefreshTokenIndex(rt);
@@ -268,31 +268,6 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
         return url;
     }
 
-    /**
-     * 回收 Access-Token
-     * @param accessToken Access-Token值
-     */
-    @Override
-    public void revokeAccessToken(String accessToken) {
-
-        SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-
-        // 如果查不到任何东西, 直接返回
-        AccessTokenModel at = dao.getAccessToken(accessToken);
-        if(at == null) {
-            return;
-        }
-
-        // 删除 Access-Token
-        dao.deleteAccessToken(accessToken);
-        dao.deleteAccessTokenIndex(at.clientId, at.loginId);
-
-        // 删除对应的 Refresh-Token
-        String refreshToken = dao.getRefreshTokenValue(at.clientId, at.loginId);
-        dao.deleteRefreshToken(refreshToken);
-        dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
-    }
-
     /**
      * 检查 state 是否被重复使用
      * @param state /
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index c8f93ef6..aa8815a7 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -17,7 +17,8 @@ package cn.dev33.satoken.oauth2.data.loader;
 
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2ClientModelException;
 import cn.dev33.satoken.secure.SaSecureUtil;
 
 /**
@@ -47,7 +48,9 @@ public interface SaOAuth2DataLoader {
     default SaClientModel getClientModelNotNull(String clientId) {
         SaClientModel clientModel = getClientModel(clientId);
         if(clientModel == null) {
-            throw new SaOAuth2Exception("未找到对应的 Client 信息");
+            throw new SaOAuth2ClientModelException("无效 client_id: " + clientId)
+                    .setClientId(clientId)
+                    .setCode(SaOAuth2ErrorCode.CODE_30105);
         }
         return clientModel;
     }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenException.java
new file mode 100644
index 00000000..89b6ac65
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenException.java
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Access-Token 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2AccessTokenException extends SaOAuth2Exception {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Access-Token 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2AccessTokenException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Access-Token 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2AccessTokenException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 Access-Token 值
+	 */
+	public String accessToken;
+
+	public String getAccessToken() {
+		return accessToken;
+	}
+
+	public SaOAuth2AccessTokenException setAccessToken(String accessToken) {
+		this.accessToken = accessToken;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2AccessTokenException(message).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenScopeException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenScopeException.java
new file mode 100644
index 00000000..cecc4141
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AccessTokenScopeException.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Access-Token Scope 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2AccessTokenScopeException extends SaOAuth2AccessTokenException {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Access-Token Scope 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2AccessTokenScopeException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Access-Token Scope 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2AccessTokenScopeException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 Access-Token 值
+	 */
+	public String accessToken;
+
+	/**
+	 * 具体引起异常的 scope 值
+	 */
+	public String scope;
+
+	public String getAccessToken() {
+		return accessToken;
+	}
+
+	public SaOAuth2AccessTokenScopeException setAccessToken(String accessToken) {
+		this.accessToken = accessToken;
+		return this;
+	}
+
+	public String getScope() {
+		return scope;
+	}
+
+	public SaOAuth2AccessTokenScopeException setScope(String scope) {
+		this.scope = scope;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2AccessTokenScopeException(message).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelException.java
new file mode 100644
index 00000000..59c36238
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelException.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 ClientModel 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2ClientModelException extends SaOAuth2Exception {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 ClientModel 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2ClientModelException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 ClientModel 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2ClientModelException(String message) {
+		super(message);
+	}
+
+	/**
+     * 具体引起异常的 ClientId 值
+	 */
+	public String clientId;
+
+	public String getClientId() {
+		return clientId;
+	}
+
+	public SaOAuth2ClientModelException setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2ClientModelException(message).setCode(code);
+		}
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息
+	 * @param clientId 应用id
+	 * @param code 异常细分码
+	 */
+	public static void throwBy(boolean flag, String message, String clientId, int code) {
+		if(flag) {
+			throw new SaOAuth2ClientModelException(message).setClientId(clientId).setCode(code);
+		}
+	}
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelScopeException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelScopeException.java
new file mode 100644
index 00000000..ad1b2507
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientModelScopeException.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 ClientModel Scope 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2ClientModelScopeException extends SaOAuth2ClientModelException {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 ClientModel Scope 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2ClientModelScopeException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 ClientModel Scope 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2ClientModelScopeException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 ClientId 值
+	 */
+	public String clientId;
+
+	/**
+	 * 具体引起异常的 scope 值
+	 */
+	public String scope;
+
+	public String getClientId() {
+		return clientId;
+	}
+
+	public SaOAuth2ClientModelScopeException setClientId(String clientId) {
+		this.clientId = clientId;
+		return this;
+	}
+
+	public String getScope() {
+		return scope;
+	}
+
+	public SaOAuth2ClientModelScopeException setScope(String scope) {
+		this.scope = scope;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2ClientModelScopeException(message).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenException.java
new file mode 100644
index 00000000..2d69dbb8
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenException.java
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Client-Token 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2ClientTokenException extends SaOAuth2Exception {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Client-Token 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2ClientTokenException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Client-Token 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2ClientTokenException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 Client-Token 值
+	 */
+	public String clientToken;
+
+	public String getClientToken() {
+		return clientToken;
+	}
+
+	public SaOAuth2ClientTokenException setClientToken(String clientToken) {
+		this.clientToken = clientToken;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2ClientTokenException(message).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenScopeException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenScopeException.java
new file mode 100644
index 00000000..987dea68
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2ClientTokenScopeException.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Client-Token Scope 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2ClientTokenScopeException extends SaOAuth2ClientTokenException {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Client-Token Scope 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2ClientTokenScopeException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Client-Token Scope 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2ClientTokenScopeException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 Client-Token 值
+	 */
+	public String clientToken;
+
+	/**
+	 * 具体引起异常的 scope 值
+	 */
+	public String scope;
+
+	public String getClientToken() {
+		return clientToken;
+	}
+
+	public SaOAuth2ClientTokenScopeException setClientToken(String clientToken) {
+		this.clientToken = clientToken;
+		return this;
+	}
+
+	public String getScope() {
+		return scope;
+	}
+
+	public SaOAuth2ClientTokenScopeException setScope(String scope) {
+		this.scope = scope;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2ClientTokenScopeException(message).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
index c1b96496..04b7d3cc 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2Exception.java
@@ -18,7 +18,7 @@ package cn.dev33.satoken.oauth2.exception;
 import cn.dev33.satoken.exception.SaTokenException;
 
 /**
- * 一个异常：代表OAuth2认证流程错误 
+ * 一个异常：代表 OAuth2 认证流程错误
  * 
  * @author click33
  * @since 1.33.0
@@ -31,7 +31,7 @@ public class SaOAuth2Exception extends SaTokenException {
 	private static final long serialVersionUID = 6806129545290130114L;
 
 	/**
-	 * 一个异常：代表OAuth2认证流程错误
+	 * 一个异常：代表 OAuth2 认证流程错误
 	 * @param cause 根异常原因
 	 */
 	public SaOAuth2Exception(Throwable cause) {
@@ -39,7 +39,7 @@ public class SaOAuth2Exception extends SaTokenException {
 	}
 
 	/**
-	 * 一个异常：代表OAuth2认证流程错误 
+	 * 一个异常：代表 OAuth2 认证流程错误
 	 * @param message 异常描述 
 	 */
 	public SaOAuth2Exception(String message) {
@@ -47,7 +47,7 @@ public class SaOAuth2Exception extends SaTokenException {
 	}
 
 	/**
-	 * 如果flag==true，则抛出message异常 
+	 * 如果 flag==true，则抛出 message 异常
 	 * @param flag 标记
 	 * @param message 异常信息 
 	 * @param code 异常细分码 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2RefreshTokenException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2RefreshTokenException.java
new file mode 100644
index 00000000..e110a31e
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2RefreshTokenException.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Refresh-Token 相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2RefreshTokenException extends SaOAuth2Exception {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Refresh-Token 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2RefreshTokenException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Refresh-Token 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2RefreshTokenException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 Refresh-Token 值
+	 */
+	public String refreshToken;
+
+	public String getRefreshToken() {
+		return refreshToken;
+	}
+
+	public SaOAuth2RefreshTokenException setRefreshToken(String refreshToken) {
+		this.refreshToken = refreshToken;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param code 异常细分码 
+	 */
+	public static void throwBy(boolean flag, String message, int code) {
+		if(flag) {
+			throw new SaOAuth2RefreshTokenException(message).setCode(code);
+		}
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息
+	 * @param refreshToken refreshToken
+	 * @param code 异常细分码
+	 */
+	public static void throwBy(boolean flag, String message, String refreshToken, int code) {
+		if(flag) {
+			throw new SaOAuth2RefreshTokenException(message).setRefreshToken(refreshToken).setCode(code);
+		}
+	}
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index 552c46b4..f8e56867 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -37,6 +37,7 @@ import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.router.SaHttpMethod;
+import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.List;
@@ -130,10 +131,10 @@ public class SaOAuth2ServerProcessor {
 		RequestAuthModel ra = SaOAuth2Manager.getDataResolver().readRequestAuthModel(req, SaOAuth2Manager.getStpLogic().getLoginId());
 
 		// 4、校验：重定向域名是否合法
-		oauth2Template.checkRightUrl(ra.clientId, ra.redirectUri);
+		oauth2Template.checkRedirectUri(ra.clientId, ra.redirectUri);
 
 		// 5、校验：此次申请的Scope，该Client是否已经签约
-		oauth2Template.checkContract(ra.clientId, ra.scopes);
+		oauth2Template.checkContractScope(ra.clientId, ra.scopes);
 
 		// 6、判断：如果此次申请的Scope，该用户尚未授权，则转到授权页面
 		boolean isNeedCarefulConfirm = oauth2Template.isNeedCarefulConfirm(ra.loginId, ra.clientId, ra.scopes);
@@ -205,7 +206,7 @@ public class SaOAuth2ServerProcessor {
 		oauth2Template.checkAccessTokenParam(clientId, clientSecret, accessToken);
 
 		// 回收 Access-Token
-		SaOAuth2Manager.getDataGenerate().revokeAccessToken(accessToken);
+		oauth2Template.revokeAccessToken(accessToken);
 
 		// 返回
 		return SaOAuth2Manager.getDataResolver().buildRevokeTokenReturnValue();
@@ -306,7 +307,7 @@ public class SaOAuth2ServerProcessor {
 		List<String> scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(req.getParam(Param.scope));
 
 		//校验 ClientScope
-		oauth2Template.checkContract(clientId, scopes);
+		oauth2Template.checkContractScope(clientId, scopes);
 
 		// 校验 ClientSecret
 		oauth2Template.checkClientSecret(clientId, clientSecret);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index f9862b61..e35cef93 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -23,11 +23,10 @@ import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.exception.*;
 import cn.dev33.satoken.strategy.SaStrategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
-import java.util.HashSet;
 import java.util.List;
 
 /**
@@ -38,157 +37,118 @@ import java.util.List;
  */
 public class SaOAuth2Template {
 
-	// ------------------- 数据加载
+	// ----------------- ClientModel 相关 -----------------
 
 	/**
-	 * 根据id获取Client信息
-	 * @param clientId 应用id
-	 * @return ClientModel
+	 * 获取 ClientModel，根据 clientId
+	 *
+	 * @param clientId /
+	 * @return /
 	 */
 	public SaClientModel getClientModel(String clientId) {
 		return SaOAuth2Manager.getDataLoader().getClientModel(clientId);
 	}
 
-	// ------------------- 资源校验API
 	/**
-	 * 根据id获取Client信息, 如果Client为空，则抛出异常
-	 * @param clientId 应用id
-	 * @return ClientModel
+	 * 校验 clientId 信息并返回 ClientModel，如果找不到对应 Client 信息则抛出异常
+	 * @param clientId /
+	 * @return /
 	 */
 	public SaClientModel checkClientModel(String clientId) {
 		SaClientModel clientModel = getClientModel(clientId);
 		if(clientModel == null) {
-			throw new SaOAuth2Exception("无效client_id: " + clientId).setCode(SaOAuth2ErrorCode.CODE_30105);
+			throw new SaOAuth2ClientModelException("无效 client_id: " + clientId)
+					.setClientId(clientId)
+					.setCode(SaOAuth2ErrorCode.CODE_30105);
 		}
 		return clientModel;
 	}
+
 	/**
-	 * 获取 Access-Token，如果AccessToken为空则抛出异常
-	 * @param accessToken .
-	 * @return .
-	 */
-	public AccessTokenModel checkAccessToken(String accessToken) {
-		AccessTokenModel at = SaOAuth2Manager.getDao().getAccessToken(accessToken);
-		SaOAuth2Exception.throwBy(at == null, "无效access_token：" + accessToken, SaOAuth2ErrorCode.CODE_30106);
-		return at;
-	}
-	/**
-	 * 获取 Client-Token，如果ClientToken为空则抛出异常
-	 * @param clientToken .
-	 * @return .
-	 */
-	public ClientTokenModel checkClientToken(String clientToken) {
-		ClientTokenModel ct = SaOAuth2Manager.getDao().getClientToken(clientToken);
-		SaOAuth2Exception.throwBy(ct == null, "无效：client_token" + clientToken, SaOAuth2ErrorCode.CODE_30107);
-		return ct;
-	}
-	/**
-	 * 获取 Access-Token 所代表的LoginId
-	 * @param accessToken Access-Token
-	 * @return LoginId
-	 */
-	public Object getLoginIdByAccessToken(String accessToken) {
-		return checkAccessToken(accessToken).loginId;
-	}
-	/**
-	 * 校验：指定 Access-Token 是否具有指定 Scope
-	 * @param accessToken Access-Token
-	 * @param scopes 需要校验的权限列表
-	 */
-	public void checkScope(String accessToken, String... scopes) {
-		if(scopes == null || scopes.length == 0) {
-			return;
-		}
-		AccessTokenModel at = checkAccessToken(accessToken);
-		List<String> scopeList = at.scopes;
-		for (String scope : scopes) {
-			SaOAuth2Exception.throwBy( ! scopeList.contains(scope), "该 Access-Token 不具备 Scope：" + scope, SaOAuth2ErrorCode.CODE_30108);
-		}
-	}
-	/**
-	 * 校验：指定 Client-Token 是否具有指定 Scope
-	 * @param clientToken Client-Token
-	 * @param scopes 需要校验的权限列表
+	 * 校验：clientId 与 clientSecret 是否正确
+	 * @param clientId 应用id
+	 * @param clientSecret 秘钥
+	 * @return SaClientModel对象
 	 */
-	public void checkClientTokenScope(String clientToken, String... scopes) {
-		if(scopes == null || scopes.length == 0) {
-			return;
-		}
-		ClientTokenModel ct = checkClientToken(clientToken);
-		List<String> scopeList = ct.scopes;
-		for (String scope : scopes) {
-			SaOAuth2Exception.throwBy( ! scopeList.contains(scope), "该 Client-Token 不具备 Scope：" + scope, SaOAuth2ErrorCode.CODE_30109);
-		}
+	public SaClientModel checkClientSecret(String clientId, String clientSecret) {
+		SaClientModel cm = checkClientModel(clientId);
+		SaOAuth2ClientModelException.throwBy(cm.clientSecret == null || ! cm.clientSecret.equals(clientSecret), "无效client_secret: " + clientSecret,
+				clientId, SaOAuth2ErrorCode.CODE_30115);
+		return cm;
 	}
 
-
-	// ------------------- check 数据校验
-
 	/**
-	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
-	 * @param loginId 账号id
+	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes
 	 * @param clientId 应用id
+	 * @param clientSecret 秘钥
 	 * @param scopes 权限
-	 * @return 是否已经授权
+	 * @return SaClientModel对象
 	 */
-	public boolean isGrant(Object loginId, String clientId, List<String> scopes) {
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-		List<String> grantScopeList = dao.getGrantScope(clientId, loginId);
-        return scopes.isEmpty() || new HashSet<>(grantScopeList).containsAll(scopes);
+	public SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
+		SaClientModel cm = checkClientSecret(clientId, clientSecret);
+		checkContractScope(cm, scopes);
+		return cm;
 	}
 
 	/**
-	 * 判断：指定 loginId 在指定 Client 请求指定 Scope 时，是否需要手动确认授权
-	 * @param loginId 账号id
+	 * 判断：该 Client 是否签约了指定的 Scope，返回 true 或 false
 	 * @param clientId 应用id
 	 * @param scopes 权限
-	 * @return 是否已经授权
+	 * @return /
 	 */
-	public boolean isNeedCarefulConfirm(Object loginId, String clientId, List<String> scopes) {
-		// 如果请求的权限为空，则不需要确认
-		if(scopes == null || scopes.isEmpty()) {
-			return false;
-		}
-
-		// 如果包含高级权限，则必须手动确认授权
-		List<String> higherScopeList = getHigherScopeList();
-		if(SaFoxUtil.list1ContainList2AnyElement(scopes, higherScopeList)) {
+	public boolean isContractScope(String clientId, List<String> scopes) {
+		try {
+			checkContractScope(clientId, scopes);
 			return true;
-		}
-
-		// 如果包含低级权限，则先将低级权限剔除掉
-		List<String> lowerScopeList = getLowerScopeList();
-		scopes = SaFoxUtil.list1RemoveByList2(scopes, lowerScopeList);
-
-		// 如果剔除后的权限为空，则不需要确认
-		if(scopes.isEmpty()) {
+		} catch (SaOAuth2ClientModelException e) {
 			return false;
 		}
-
-		// 根据近期授权记录，判断是否需要确认
-		return !isGrant(loginId, clientId, scopes);
 	}
 
 	/**
-	 * 校验：该Client是否签约了指定的Scope
+	 * 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
 	 * @param clientId 应用id
-	 * @param scopes 权限(多个用逗号隔开)
+	 * @param scopes 权限列表
+	 * @return /
+	 */
+	public SaClientModel checkContractScope(String clientId, List<String> scopes) {
+		return checkContractScope(checkClientModel(clientId), scopes);
+	}
+
+	/**
+	 * 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
+	 * @param cm 应用
+	 * @param scopes 权限列表
+	 * @return /
 	 */
-	public void checkContract(String clientId, List<String> scopes) {
-		List<String> clientScopeList = checkClientModel(clientId).contractScopes;
-        if( ! new HashSet<>(clientScopeList).containsAll(scopes)) {
-			throw new SaOAuth2Exception("请求的Scope暂未签约").setCode(SaOAuth2ErrorCode.CODE_30112);
+	public SaClientModel checkContractScope(SaClientModel cm, List<String> scopes) {
+		if(SaFoxUtil.isEmptyList(scopes)) {
+			return cm;
 		}
+		for (String scope : scopes) {
+			if(! cm.contractScopes.contains(scope)) {
+				throw new SaOAuth2ClientModelScopeException("该 client 暂未签约 scope: " + scope)
+						.setClientId(cm.clientId)
+						.setScope(scope)
+						.setCode(SaOAuth2ErrorCode.CODE_30112);
+			}
+		}
+		return cm;
 	}
+
+	// --------- redirect_uri 相关
+
 	/**
-	 * 校验：该Client使用指定url作为回调地址，是否合法
+	 * 校验：该 Client 使用指定 url 作为回调地址，是否合法
 	 * @param clientId 应用id
 	 * @param url 指定url
 	 */
-	public void checkRightUrl(String clientId, String url) {
+	public void checkRedirectUri(String clientId, String url) {
 		// 1、是否是一个有效的url
 		if( ! SaFoxUtil.isUrl(url)) {
-			throw new SaOAuth2Exception("无效redirect_url：" + url).setCode(SaOAuth2ErrorCode.CODE_30113);
+			throw new SaOAuth2ClientModelException("无效redirect_url：" + url)
+					.setClientId(clientId)
+					.setCode(SaOAuth2ErrorCode.CODE_30113);
 		}
 
 		// 2、截取掉?后面的部分
@@ -219,31 +179,34 @@ public class SaOAuth2Template {
 			//       http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com/@getInfo
 			//
 			//  但是为了安全起见，这么做还是有必要的
-			throw new SaOAuth2Exception("无效 redirect_url（不允许出现@字符）：" + url);
+			throw new SaOAuth2ClientModelException("无效 redirect_url（不允许出现@字符）：" + url)
+					.setClientId(clientId);
 		}
 
 		// 4、是否在[允许地址列表]之中
 		SaClientModel clientModel = checkClientModel(clientId);
-		checkAllowUrlList(clientModel.allowRedirectUris);
+		checkRedirectUriListNormal(clientModel.allowRedirectUris);
 		if( ! SaStrategy.instance.hasElement.apply(clientModel.allowRedirectUris, url)) {
-			throw new SaOAuth2Exception("非法 redirect_url: " + url).setCode(SaOAuth2ErrorCode.CODE_30114);
+			throw new SaOAuth2ClientModelException("非法 redirect_url: " + url)
+					.setClientId(clientId)
+					.setCode(SaOAuth2ErrorCode.CODE_30114);
 		}
 	}
 
 	/**
-	 * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
-	 * @param allowUrlList 待校验的 allow-url 地址列表
+	 * 校验配置的 allowRedirectUris 是否合规，如果不合规则抛出异常
+	 * @param redirectUriList 待校验的 allow-url 地址列表
 	 */
-	public void checkAllowUrlList(List<String> allowUrlList){
-		checkAllowUrlListStaticMethod(allowUrlList);
+	public void checkRedirectUriListNormal(List<String> redirectUriList){
+		checkRedirectUriListNormalStaticMethod(redirectUriList);
 	}
 
 	/**
-	 * 校验配置的 AllowUrl 是否合规，如果不合规则抛出异常
-	 * @param allowUrlList 待校验的 allow-url 地址列表
+	 * 校验配置的 allowRedirectUris 是否合规，如果不合规则抛出异常，静态方法内部实现
+	 * @param redirectUriList 待校验的 allow-url 地址列表
 	 */
-	public static void checkAllowUrlListStaticMethod(List<String> allowUrlList){
-		for (String url : allowUrlList) {
+	public static void checkRedirectUriListNormalStaticMethod(List<String> redirectUriList){
+		for (String url : redirectUriList) {
 			int index = url.indexOf("*");
 			// 如果配置了 * 字符，则必须出现在最后一位，否则属于无效配置项
 			if(index != -1 && index != url.length() - 1) {
@@ -273,36 +236,55 @@ public class SaOAuth2Template {
 		}
 	}
 
+	// --------- 授权相关
+
 	/**
-	 * 校验：clientId 与 clientSecret 是否正确
+	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
+	 * @param loginId 账号id
 	 * @param clientId 应用id
-	 * @param clientSecret 秘钥
-	 * @return SaClientModel对象
+	 * @param scopes 权限
+	 * @return 是否已经授权
 	 */
-	public SaClientModel checkClientSecret(String clientId, String clientSecret) {
-		SaClientModel cm = checkClientModel(clientId);
-		SaOAuth2Exception.throwBy(cm.clientSecret == null || ! cm.clientSecret.equals(clientSecret),
-				"无效client_secret: " + clientSecret, SaOAuth2ErrorCode.CODE_30115);
-		return cm;
+	public boolean isGrantScope(Object loginId, String clientId, List<String> scopes) {
+		List<String> grantScopeList = SaOAuth2Manager.getDao().getGrantScope(clientId, loginId);
+		return SaFoxUtil.list1ContainList2AllElement(grantScopeList, scopes);
 	}
+
 	/**
-	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes 
+	 * 判断：指定 loginId 在指定 Client 请求指定 Scope 时，是否需要手动确认授权
+	 * @param loginId 账号id
 	 * @param clientId 应用id
-	 * @param clientSecret 秘钥
 	 * @param scopes 权限
-	 * @return SaClientModel对象
+	 * @return 是否已经授权
 	 */
-	public SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
-		// 先校验 clientSecret
-		SaClientModel cm = checkClientSecret(clientId, clientSecret);
-		// 再校验 是否签约 
-		List<String> clientScopeList = cm.contractScopes;
-        if( ! new HashSet<>(clientScopeList).containsAll(scopes)) {
-			throw new SaOAuth2Exception("请求的Scope暂未签约").setCode(SaOAuth2ErrorCode.CODE_30116);
+	public boolean isNeedCarefulConfirm(Object loginId, String clientId, List<String> scopes) {
+		// 如果请求的权限为空，则不需要确认
+		if(scopes == null || scopes.isEmpty()) {
+			return false;
 		}
-		// 返回数据
-		return cm;
+
+		// 如果包含高级权限，则必须手动确认授权
+		List<String> higherScopeList = getHigherScopeList();
+		if(SaFoxUtil.list1ContainList2AnyElement(scopes, higherScopeList)) {
+			return true;
+		}
+
+		// 如果包含低级权限，则先将低级权限剔除掉
+		List<String> lowerScopeList = getLowerScopeList();
+		scopes = SaFoxUtil.list1RemoveByList2(scopes, lowerScopeList);
+
+		// 如果剔除后的权限为空，则不需要确认
+		if(scopes.isEmpty()) {
+			return false;
+		}
+
+		// 根据近期授权记录，判断是否需要确认
+		return !isGrantScope(loginId, clientId, scopes);
 	}
+
+
+	// --------- 请求数据校验相关
+
 	/**
 	 * 校验：使用 code 获取 token 时提供的参数校验
 	 * @param code 授权码
@@ -317,23 +299,24 @@ public class SaOAuth2Template {
 
 		// 校验：Code是否存在
 		CodeModel cm = dao.getCode(code);
-		SaOAuth2Exception.throwBy(cm == null, "无效code: " + code, SaOAuth2ErrorCode.CODE_30117);
+		SaOAuth2Exception.throwBy(cm == null, "无效 code: " + code, SaOAuth2ErrorCode.CODE_30117);
 
 		// 校验：ClientId是否一致
-		SaOAuth2Exception.throwBy( ! cm.clientId.equals(clientId), "无效client_id: " + clientId, SaOAuth2ErrorCode.CODE_30118);
+		SaOAuth2Exception.throwBy( ! cm.clientId.equals(clientId), "无效 client_id: " + clientId, SaOAuth2ErrorCode.CODE_30118);
 
 		// 校验：Secret是否正确
 		String dbSecret = checkClientModel(clientId).clientSecret;
-		SaOAuth2Exception.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效client_secret: " + clientSecret, SaOAuth2ErrorCode.CODE_30119);
+		SaOAuth2Exception.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效 client_secret: " + clientSecret, SaOAuth2ErrorCode.CODE_30119);
 
 		// 如果提供了redirectUri，则校验其是否与请求Code时提供的一致
 		if( ! SaFoxUtil.isEmpty(redirectUri)) {
-			SaOAuth2Exception.throwBy( ! redirectUri.equals(cm.redirectUri), "无效redirect_uri: " + redirectUri, SaOAuth2ErrorCode.CODE_30120);
+			SaOAuth2Exception.throwBy( ! redirectUri.equals(cm.redirectUri), "无效 redirect_uri: " + redirectUri, SaOAuth2ErrorCode.CODE_30120);
 		}
 
 		// 返回CodeModel
 		return cm;
 	}
+
 	/**
 	 * 校验：使用 Refresh-Token 刷新 Access-Token 时提供的参数校验
 	 * @param clientId 应用id
@@ -347,18 +330,20 @@ public class SaOAuth2Template {
 
 		// 校验：Refresh-Token是否存在
 		RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
-		SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30121);
+		SaOAuth2RefreshTokenException.throwBy(rt == null, "无效 refresh_token: " + refreshToken, refreshToken, SaOAuth2ErrorCode.CODE_30121);
 
 		// 校验：ClientId是否一致
-		SaOAuth2Exception.throwBy( ! rt.clientId.equals(clientId), "无效client_id: " + clientId, SaOAuth2ErrorCode.CODE_30122);
+		SaOAuth2ClientModelException.throwBy( ! rt.clientId.equals(clientId), "无效 client_id: " + clientId, clientId, SaOAuth2ErrorCode.CODE_30122);
 
 		// 校验：Secret是否正确
 		String dbSecret = checkClientModel(clientId).clientSecret;
-		SaOAuth2Exception.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效client_secret: " + clientSecret, SaOAuth2ErrorCode.CODE_30123);
+		SaOAuth2ClientModelException.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效client_secret: " + clientSecret,
+				clientId, SaOAuth2ErrorCode.CODE_30123);
 
-		// 返回Refresh-Token
+		// 返回 Refresh-Token
 		return rt;
 	}
+
 	/**
 	 * 校验：Access-Token、clientId、clientSecret 三者是否匹配成功
 	 * @param clientId 应用id
@@ -368,30 +353,271 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
 		AccessTokenModel at = checkAccessToken(accessToken);
-		SaOAuth2Exception.throwBy( ! at.clientId.equals(clientId), "无效client_id：" + clientId, SaOAuth2ErrorCode.CODE_30124);
+		SaOAuth2ClientModelException.throwBy( ! at.clientId.equals(clientId), "无效 client_id：" + clientId, clientId, SaOAuth2ErrorCode.CODE_30124);
 		checkClientSecret(clientId, clientSecret);
 		return at;
 	}
 
 
+	// ----------------- Access-Token 相关 -----------------
+
 	/**
-	 * 回收指定的 ClientToken
+	 * 获取 AccessTokenModel，无效的 AccessToken 会返回 null
+	 * @param accessToken /
+	 * @return /
+	 */
+	public AccessTokenModel getAccessToken(String accessToken) {
+		return SaOAuth2Manager.getDao().getAccessToken(accessToken);
+	}
+
+	/**
+	 * 校验 Access-Token，成功返回 AccessTokenModel，失败则抛出异常
+	 * @param accessToken /
+	 * @return /
+	 */
+	public AccessTokenModel checkAccessToken(String accessToken) {
+		AccessTokenModel at = SaOAuth2Manager.getDao().getAccessToken(accessToken);
+		if(at == null) {
+			throw new SaOAuth2AccessTokenException("无效 access_token: " + accessToken)
+					.setAccessToken(accessToken)
+					.setCode(SaOAuth2ErrorCode.CODE_30106);
+		}
+		return at;
+	}
+
+	/**
+	 * 获取 Access-Token，根据索引： clientId、loginId
+	 * @param clientId /
+	 * @param loginId /
+	 * @return /
+	 */
+	public String getAccessTokenValue(String clientId, Object loginId) {
+		return SaOAuth2Manager.getDao().getAccessTokenValue(clientId, loginId);
+	}
+
+	/**
+	 * 判断：指定 Access-Token 是否具有指定 Scope 列表，返回 true 或 false
+	 * @param accessToken Access-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public boolean hasAccessTokenScope(String accessToken, String... scopes) {
+		try {
+			checkAccessTokenScope(accessToken, scopes);
+			return true;
+		} catch (SaOAuth2AccessTokenException e) {
+			return false;
+		}
+	}
+
+	/**
+	 * 校验：指定 Access-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+	 * @param accessToken Access-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public void checkAccessTokenScope(String accessToken, String... scopes) {
+		if(SaFoxUtil.isEmptyArray(scopes)) {
+			return;
+		}
+		ClientTokenModel ct = checkClientToken(accessToken);
+		for (String scope : scopes) {
+			if(! ct.scopes.contains(scope)) {
+				throw new SaOAuth2AccessTokenScopeException("该 access_token 不具备 scope：" + scope)
+						.setAccessToken(accessToken)
+						.setScope(scope)
+						.setCode(SaOAuth2ErrorCode.CODE_30108);
+			}
+		}
+	}
+
+	/**
+	 * 获取 Access-Token 所代表的LoginId
+	 * @param accessToken Access-Token
+	 * @return LoginId
+	 */
+	public Object getLoginIdByAccessToken(String accessToken) {
+		return checkAccessToken(accessToken).loginId;
+	}
+
+	/**
+	 * 获取 Access-Token 所代表的 clientId
+	 * @param accessToken Access-Token
+	 * @return LoginId
+	 */
+	public Object getClientIdByAccessToken(String accessToken) {
+		return checkAccessToken(accessToken).clientId;
+	}
+
+	/**
+	 * 回收 Access-Token
+	 * @param accessToken Access-Token值
+	 */
+	public void revokeAccessToken(String accessToken) {
+		AccessTokenModel at = getAccessToken(accessToken);
+		if(at == null) {
+			return;
+		}
+
+		// 删 at、索引
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+		dao.deleteAccessToken(accessToken);
+		dao.deleteAccessTokenIndex(at.clientId, at.loginId);
+
+		// 删对应的 rt、索引
+//		String rtValue = dao.getRefreshTokenValue(at.clientId, at.loginId);
+//		dao.deleteRefreshToken(rtValue);
+//		dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
+	}
+
+	/**
+	 * 回收 Access-Token，根据索引： clientId、loginId
+	 * @param clientId /
+	 * @param loginId /
+	 */
+	public void revokeAccessTokenByIndex(String clientId, Object loginId) {
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
+
+		// 删 at、删索引
+		String accessToken = getAccessTokenValue(clientId, loginId);
+		if(accessToken != null) {
+			dao.deleteAccessToken(accessToken);
+			dao.deleteAccessTokenIndex(clientId, loginId);
+		}
+	}
+
+
+	// ----------------- Refresh-Token 相关 -----------------
+
+	/**
+	 * 获取 RefreshTokenModel，无效的 RefreshToken 会返回 null
+	 * @param refreshToken /
+	 * @return /
+	 */
+	public RefreshTokenModel getRefreshToken(String refreshToken) {
+		return SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
+	}
+
+	/**
+	 * 校验 Refresh-Token，成功返回 RefreshTokenModel，失败则抛出异常
+	 * @param refreshToken /
+	 * @return /
+	 */
+	public RefreshTokenModel checkRefreshToken(String refreshToken) {
+		RefreshTokenModel rt = SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
+		if(rt == null) {
+			throw new SaOAuth2RefreshTokenException("无效 refresh_token: " + refreshToken)
+					.setRefreshToken(refreshToken)
+					.setCode(SaOAuth2ErrorCode.CODE_30111);
+		}
+		return rt;
+	}
+
+	/**
+	 * 获取 Refresh-Token，根据索引： clientId、loginId
+	 * @param clientId /
+	 * @param loginId /
+	 * @return /
+	 */
+	public String getRefreshTokenValue(String clientId, Object loginId) {
+		return SaOAuth2Manager.getDao().getRefreshTokenValue(clientId, loginId);
+	}
+
+	/**
+	 * 根据 RefreshToken 刷新出一个 AccessToken
+	 * @param refreshToken /
+	 * @return /
+	 */
+	public AccessTokenModel refreshAccessToken(String refreshToken) {
+		return SaOAuth2Manager.getDataGenerate().refreshAccessToken(refreshToken);
+	}
+
+
+	// ----------------- Client-Token 相关 -----------------
+
+	/**
+	 * 获取 ClientTokenModel，无效的 ClientToken 会返回 null
+	 * @param clientToken /
+	 * @return /
+	 */
+	public ClientTokenModel getClientToken(String clientToken) {
+		return SaOAuth2Manager.getDao().getClientToken(clientToken);
+	}
+
+	/**
+	 * 校验 Client-Token，成功返回 ClientTokenModel，失败则抛出异常
+	 * @param clientToken /
+	 * @return /
+	 */
+	public ClientTokenModel checkClientToken(String clientToken) {
+		ClientTokenModel ct = getClientToken(clientToken);
+		if(ct == null) {
+			throw new SaOAuth2ClientTokenException("无效 client_token: " + clientToken)
+					.setClientToken(clientToken)
+					.setCode(SaOAuth2ErrorCode.CODE_30107);
+		}
+		return ct;
+	}
+
+	/**
+	 * 获取 ClientToken，根据索引： clientId
+	 * @param clientId /
+	 * @return /
+	 */
+	public String getClientTokenValue(String clientId) {
+		return SaOAuth2Manager.getDao().getClientTokenValue(clientId);
+	}
+
+	/**
+	 * 判断：指定 Client-Token 是否具有指定 Scope 列表，返回 true 或 false
+	 * @param clientToken Client-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public boolean hasClientTokenScope(String clientToken, String... scopes) {
+		try {
+			checkClientTokenScope(clientToken, scopes);
+			return true;
+		} catch (SaOAuth2ClientTokenException e) {
+			return false;
+		}
+	}
+
+	/**
+	 * 校验：指定 Client-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+	 * @param clientToken Client-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public void checkClientTokenScope(String clientToken, String... scopes) {
+		if(SaFoxUtil.isEmptyArray(scopes)) {
+			return;
+		}
+		ClientTokenModel ct = checkClientToken(clientToken);
+		for (String scope : scopes) {
+			if(! ct.scopes.contains(scope)) {
+				throw new SaOAuth2ClientTokenScopeException("该 client_token 不具备 scope：" + scope)
+						.setClientToken(clientToken)
+						.setScope(scope)
+						.setCode(SaOAuth2ErrorCode.CODE_30109);
+			}
+		}
+	}
+
+	/**
+	 * 回收 ClientToken
 	 *
 	 * @param clientToken /
 	 */
 	public void revokeClientToken(String clientToken) {
-		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-		ClientTokenModel ctModel = dao.getClientToken(clientToken);
-		if(ctModel == null) {
+		ClientTokenModel ct = getClientToken(clientToken);
+		if(ct == null) {
 			return;
 		}
-		// 删 ct、索引
+		// 删 ct、删索引
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
 		dao.deleteClientToken(clientToken);
-		dao.deleteClientTokenIndex(ctModel.clientId);
+		dao.deleteClientTokenIndex(ct.clientId);
 	}
 
 	/**
-	 * 回收指定的 ClientToken，根据索引： clientId
+	 * 回收 ClientToken，根据索引： clientId
 	 *
 	 * @param clientId /
 	 */
@@ -399,33 +625,30 @@ public class SaOAuth2Template {
 		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
 
 		// 删 clientToken
-		String clientToken = dao.getClientTokenValue(clientId);
+		String clientToken = getClientTokenValue(clientId);
 		if(clientToken != null) {
 			dao.deleteClientToken(clientToken);
 			dao.deleteClientTokenIndex(clientId);
 		}
+	}
 
+	/**
+	 * 回收 PastToken，根据索引： clientId
+	 *
+	 * @param clientId /
+	 */
+	public void revokePastTokenByIndex(String clientId) {
+		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
 		// 删 pastToken
 		String pastToken = dao.getPastTokenValue(clientId);
 		if(pastToken != null) {
 			dao.deletePastToken(pastToken);
 			dao.deletePastTokenIndex(clientId);
 		}
-
 	}
 
 
-
-	// ------------------- 包装其它 bean 的方法
-
-	/**
-	 * 获取：Access-Token Model
-	 * @param accessToken /
-	 * @return /
-	 */
-	public AccessTokenModel getAccessToken(String accessToken) {
-		return SaOAuth2Manager.getDao().getAccessToken(accessToken);
-	}
+	// ----------------- 包装其它 bean 的方法 -----------------
 
 	/**
 	 * 持久化：用户授权记录
@@ -455,8 +678,4 @@ public class SaOAuth2Template {
 		return SaOAuth2Manager.getDataConverter().convertScopeStringToList(lowerScope);
 	}
 
-
-
-
-
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 223d7dcb..4d667933 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -18,240 +18,312 @@ package cn.dev33.satoken.oauth2.template;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 
 import java.util.List;
 
 /**
- * Sa-Token-OAuth2 模块 工具类
+ * Sa-Token OAuth2 模块 工具类
  *
  * @author click33
  * @since 1.23.0
  */
 public class SaOAuth2Util {
-	
-	// ------------------- 资源校验API  
-	
+
+	// ----------------- ClientModel 相关 -----------------
+
 	/**
-	 * 根据id获取Client信息, 如果Client为空，则抛出异常 
-	 * @param clientId 应用id
-	 * @return ClientModel 
+	 * 获取 ClientModel，根据 clientId
+	 *
+	 * @param clientId /
+	 * @return /
+	 */
+	public static SaClientModel getClientModel(String clientId) {
+		return SaOAuth2Manager.getTemplate().getClientModel(clientId);
+	}
+
+	/**
+	 * 校验 clientId 信息并返回 ClientModel，如果找不到对应 Client 信息则抛出异常
+	 * @param clientId /
+	 * @return /
 	 */
 	public static SaClientModel checkClientModel(String clientId) {
 		return SaOAuth2Manager.getTemplate().checkClientModel(clientId);
 	}
-	
+
 	/**
-	 * 获取 Access-Token，如果AccessToken为空则抛出异常 
-	 * @param accessToken . 
-	 * @return .
+	 * 校验：clientId 与 clientSecret 是否正确
+	 * @param clientId 应用id
+	 * @param clientSecret 秘钥
+	 * @return SaClientModel对象
 	 */
-	public static AccessTokenModel checkAccessToken(String accessToken) {
-		return SaOAuth2Manager.getTemplate().checkAccessToken(accessToken);
+	public static SaClientModel checkClientSecret(String clientId, String clientSecret) {
+		return SaOAuth2Manager.getTemplate().checkClientSecret(clientId, clientSecret);
 	}
-	
+
 	/**
-	 * 获取 Client-Token，如果ClientToken为空则抛出异常 
-	 * @param clientToken . 
-	 * @return .
+	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes
+	 * @param clientId 应用id
+	 * @param clientSecret 秘钥
+	 * @param scopes 权限
+	 * @return SaClientModel对象
 	 */
-	public static ClientTokenModel checkClientToken(String clientToken) {
-		return SaOAuth2Manager.getTemplate().checkClientToken(clientToken);
+	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
+		return SaOAuth2Manager.getTemplate().checkClientSecretAndScope(clientId, clientSecret, scopes);
 	}
-	
+
 	/**
-	 * 获取 Access-Token 所代表的LoginId 
-	 * @param accessToken Access-Token 
-	 * @return LoginId 
+	 * 判断：该 Client 是否签约了指定的 Scope，返回 true 或 false
+	 * @param clientId 应用id
+	 * @param scopes 权限
+	 * @return /
 	 */
-	public static Object getLoginIdByAccessToken(String accessToken) {
-		return SaOAuth2Manager.getTemplate().getLoginIdByAccessToken(accessToken);
+	public static boolean isContractScope(String clientId, List<String> scopes) {
+		return SaOAuth2Manager.getTemplate().isContractScope(clientId, scopes);
 	}
-	
+
 	/**
-	 * 校验：指定 Access-Token 是否具有指定 Scope  
-	 * @param accessToken Access-Token
-	 * @param scopes 需要校验的权限列表 
+	 * 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
+	 * @param clientId 应用id
+	 * @param scopes 权限列表
+	 * @return /
 	 */
-	public static void checkScope(String accessToken, String... scopes) {
-		SaOAuth2Manager.getTemplate().checkScope(accessToken, scopes);
+	public static SaClientModel checkContractScope(String clientId, List<String> scopes) {
+		return SaOAuth2Manager.getTemplate().checkContractScope(clientId, scopes);
 	}
-	
+
 	/**
-	 * 校验：指定 Client-Token 是否具有指定 Scope
-	 * @param clientToken Client-Token
-	 * @param scopes 需要校验的权限列表
+	 * 校验：该 Client 是否签约了指定的 Scope，如果没有则抛出异常
+	 * @param cm 应用
+	 * @param scopes 权限列表
+	 * @return /
 	 */
-	public static void checkClientTokenScope(String clientToken, String... scopes) {
-		SaOAuth2Manager.getTemplate().checkClientTokenScope(clientToken, scopes);
+	public static SaClientModel checkContractScope(SaClientModel cm, List<String> scopes) {
+		return SaOAuth2Manager.getTemplate().checkContractScope(cm, scopes);
 	}
 
+	// --------- redirect_uri 相关
 
-	// ------------------- 数据校验 
-	
 	/**
-	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope 
-	 * @param loginId 账号id 
-	 * @param clientId 应用id 
+	 * 校验：该 Client 使用指定 url 作为回调地址，是否合法
+	 * @param clientId 应用id
+	 * @param url 指定url
+	 */
+	public static void checkRedirectUri(String clientId, String url) {
+		SaOAuth2Manager.getTemplate().checkRedirectUri(clientId, url);
+	}
+
+	// --------- 授权相关
+
+	/**
+	 * 判断：指定 loginId 是否对一个 Client 授权给了指定 Scope
+	 * @param loginId 账号id
+	 * @param clientId 应用id
 	 * @param scopes 权限
 	 * @return 是否已经授权
 	 */
-	public static boolean isGrant(Object loginId, String clientId, List<String> scopes) {
-		return SaOAuth2Manager.getTemplate().isGrant(loginId, clientId, scopes);
+	public static boolean isGrantScope(Object loginId, String clientId, List<String> scopes) {
+		return SaOAuth2Manager.getTemplate().isGrantScope(loginId, clientId, scopes);
 	}
-	
+
+
+	// ----------------- Access-Token 相关 -----------------
+
 	/**
-	 * 校验：该Client是否签约了指定的Scope 
-	 * @param clientId 应用id
-	 * @param scopes 权限(多个用逗号隔开)
+	 * 获取 AccessTokenModel，无效的 AccessToken 会返回 null
+	 * @param accessToken /
+	 * @return /
 	 */
-	public static void checkContract(String clientId, List<String> scopes) {
-		SaOAuth2Manager.getTemplate().checkContract(clientId, scopes);
+	public static AccessTokenModel getAccessToken(String accessToken) {
+		return SaOAuth2Manager.getTemplate().getAccessToken(accessToken);
 	}
-	
+
 	/**
-	 * 校验：该Client使用指定url作为回调地址，是否合法 
-	 * @param clientId 应用id 
-	 * @param url 指定url
+	 * 校验 Access-Token，成功返回 AccessTokenModel，失败则抛出异常
+	 * @param accessToken /
+	 * @return /
 	 */
-	public static void checkRightUrl(String clientId, String url) {
-		SaOAuth2Manager.getTemplate().checkRightUrl(clientId, url);
+	public static AccessTokenModel checkAccessToken(String accessToken) {
+		return SaOAuth2Manager.getTemplate().checkAccessToken(accessToken);
 	}
-	
+
 	/**
-	 * 校验：clientId 与 clientSecret 是否正确
-	 * @param clientId 应用id 
-	 * @param clientSecret 秘钥 
-	 * @return SaClientModel对象 
+	 * 获取 Access-Token，根据索引： clientId、loginId
+	 * @param clientId /
+	 * @param loginId /
+	 * @return /
 	 */
-	public static SaClientModel checkClientSecret(String clientId, String clientSecret) {
-		return SaOAuth2Manager.getTemplate().checkClientSecret(clientId, clientSecret);
+	public static String getAccessTokenValue(String clientId, Object loginId) {
+		return SaOAuth2Manager.getTemplate().getAccessTokenValue(clientId, loginId);
 	}
-	
+
 	/**
-	 * 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes 
-	 * @param clientId 应用id
-	 * @param clientSecret 秘钥
-	 * @param scopes 权限
-	 * @return SaClientModel对象
+	 * 判断：指定 Access-Token 是否具有指定 Scope 列表，返回 true 或 false
+	 * @param accessToken Access-Token
+	 * @param scopes 需要校验的权限列表
 	 */
-	public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, List<String> scopes) {
-		return SaOAuth2Manager.getTemplate().checkClientSecretAndScope(clientId, clientSecret, scopes);
+	public static boolean hasAccessTokenScope(String accessToken, String... scopes) {
+		return SaOAuth2Manager.getTemplate().hasAccessTokenScope(accessToken, scopes);
 	}
-	
+
 	/**
-	 * 校验：使用 code 获取 token 时提供的参数校验 
-	 * @param code 授权码
-	 * @param clientId 应用id 
-	 * @param clientSecret 秘钥 
-	 * @param redirectUri 重定向地址 
-	 * @return CodeModel对象 
+	 * 校验：指定 Access-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+	 * @param accessToken Access-Token
+	 * @param scopes 需要校验的权限列表
 	 */
-	public static CodeModel checkGainTokenParam(String code, String clientId, String clientSecret, String redirectUri) {
-		return SaOAuth2Manager.getTemplate().checkGainTokenParam(code, clientId, clientSecret, redirectUri);
+	public static void checkAccessTokenScope(String accessToken, String... scopes) {
+		SaOAuth2Manager.getTemplate().checkAccessTokenScope(accessToken, scopes);
 	}
 
 	/**
-	 * 校验：使用 Refresh-Token 刷新 Access-Token 时提供的参数校验 
-	 * @param clientId 应用id 
-	 * @param clientSecret 秘钥 
-	 * @param refreshToken Refresh-Token
-	 * @return CodeModel对象 
+	 * 获取 Access-Token 所代表的LoginId
+	 * @param accessToken Access-Token
+	 * @return LoginId
 	 */
-	public static RefreshTokenModel checkRefreshTokenParam(String clientId, String clientSecret, String refreshToken) {
-		return SaOAuth2Manager.getTemplate().checkRefreshTokenParam(clientId, clientSecret, refreshToken);
+	public static Object getLoginIdByAccessToken(String accessToken) {
+		return SaOAuth2Manager.getTemplate().getLoginIdByAccessToken(accessToken);
 	}
-	
+
 	/**
-	 * 校验：Access-Token、clientId、clientSecret 三者是否匹配成功 
-	 * @param clientId 应用id 
-	 * @param clientSecret 秘钥 
-	 * @param accessToken Access-Token 
-	 * @return SaClientModel对象 
+	 * 获取 Access-Token 所代表的 clientId
+	 * @param accessToken Access-Token
+	 * @return LoginId
 	 */
-	public static AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
-		return SaOAuth2Manager.getTemplate().checkAccessTokenParam(clientId, clientSecret, accessToken);
+	public static Object getClientIdByAccessToken(String accessToken) {
+		return SaOAuth2Manager.getTemplate().getClientIdByAccessToken(accessToken);
 	}
 
 	/**
-	 * 回收指定的 ClientToken
-	 *
-	 * @param clientToken /
+	 * 回收 Access-Token
+	 * @param accessToken Access-Token值
 	 */
-	public static void revokeClientToken(String clientToken) {
-		SaOAuth2Manager.getTemplate().revokeClientToken(clientToken);
+	public static void revokeAccessToken(String accessToken) {
+		SaOAuth2Manager.getTemplate().revokeAccessToken(accessToken);
 	}
 
 	/**
-	 * 回收指定的 ClientToken，根据索引：clientId
-	 *
+	 * 回收 Access-Token，根据索引： clientId、loginId
 	 * @param clientId /
+	 * @param loginId /
 	 */
-	public static void revokeClientTokenByIndex(String clientId) {
-		SaOAuth2Manager.getTemplate().revokeClientTokenByIndex(clientId);
+	public static void revokeAccessTokenByIndex(String clientId, Object loginId) {
+		SaOAuth2Manager.getTemplate().revokeAccessTokenByIndex(clientId, loginId);
 	}
 
-	// ------------------- save 数据 
-	
+
+	// ----------------- Refresh-Token 相关 -----------------
+
 	/**
-	 * 持久化：用户授权记录 
-	 * @param clientId 应用id 
-	 * @param loginId 账号id 
-	 * @param scopes 权限列表
+	 * 获取 RefreshTokenModel，无效的 RefreshToken 会返回 null
+	 * @param refreshToken /
+	 * @return /
 	 */
-	public static void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
-		SaOAuth2Manager.getTemplate().saveGrantScope(clientId, loginId, scopes);
+	public static RefreshTokenModel getRefreshToken(String refreshToken) {
+		return SaOAuth2Manager.getTemplate().getRefreshToken(refreshToken);
 	}
-	
-	
-	// ------------------- get 数据
-	
+
 	/**
-	 * 获取：Code Model  
-	 * @param code .
-	 * @return .
+	 * 校验 Refresh-Token，成功返回 RefreshTokenModel，失败则抛出异常
+	 * @param refreshToken /
+	 * @return /
 	 */
-	public static CodeModel getCode(String code) {
-		return SaOAuth2Manager.getDao().getCode(code);
+	public static RefreshTokenModel checkRefreshToken(String refreshToken) {
+		return SaOAuth2Manager.getTemplate().checkRefreshToken(refreshToken);
 	}
 
 	/**
-	 * 获取：Access-Token Model 
-	 * @param accessToken . 
-	 * @return .
+	 * 获取 Refresh-Token，根据索引： clientId、loginId
+	 * @param clientId /
+	 * @param loginId /
+	 * @return /
 	 */
-	public static AccessTokenModel getAccessToken(String accessToken) {
-		return SaOAuth2Manager.getDao().getAccessToken(accessToken);
+	public static String getRefreshTokenValue(String clientId, Object loginId) {
+		return SaOAuth2Manager.getTemplate().getRefreshTokenValue(clientId, loginId);
 	}
-	
+
 	/**
-	 * 获取：Refresh-Token Model 
-	 * @param refreshToken . 
-	 * @return . 
+	 * 根据 RefreshToken 刷新出一个 AccessToken
+	 * @param refreshToken /
+	 * @return /
 	 */
-	public static RefreshTokenModel getRefreshToken(String refreshToken) {
-		return SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
+	public static AccessTokenModel refreshAccessToken(String refreshToken) {
+		return SaOAuth2Manager.getTemplate().refreshAccessToken(refreshToken);
 	}
-	
+
+
+	// ----------------- Client-Token 相关 -----------------
+
 	/**
-	 * 获取：Client-Token Model 
-	 * @param clientToken . 
-	 * @return .
+	 * 获取 ClientTokenModel，无效的 ClientToken 会返回 null
+	 * @param clientToken /
+	 * @return /
 	 */
 	public static ClientTokenModel getClientToken(String clientToken) {
-		return SaOAuth2Manager.getDao().getClientToken(clientToken);
+		return SaOAuth2Manager.getTemplate().getClientToken(clientToken);
 	}
-	
+
 	/**
-	 * 获取：用户授权记录 
-	 * @param clientId 应用id 
-	 * @param loginId 账号id 
-	 * @return 权限 
+	 * 校验 Client-Token，成功返回 ClientTokenModel，失败则抛出异常
+	 * @param clientToken /
+	 * @return /
+	 */
+	public static ClientTokenModel checkClientToken(String clientToken) {
+		return SaOAuth2Manager.getTemplate().checkClientToken(clientToken);
+	}
+
+	/**
+	 * 获取 ClientToken，根据索引： clientId
+	 * @param clientId /
+	 * @return /
+	 */
+	public static String getClientTokenValue(String clientId) {
+		return SaOAuth2Manager.getTemplate().getClientTokenValue(clientId);
+	}
+
+	/**
+	 * 判断：指定 Client-Token 是否具有指定 Scope 列表，返回 true 或 false
+	 * @param clientToken Client-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public static boolean hasClientTokenScope(String clientToken, String... scopes) {
+		return SaOAuth2Manager.getTemplate().hasClientTokenScope(clientToken, scopes);
+	}
+
+	/**
+	 * 校验：指定 Client-Token 是否具有指定 Scope 列表，如果不具备则抛出异常
+	 * @param clientToken Client-Token
+	 * @param scopes 需要校验的权限列表
+	 */
+	public static void checkClientTokenScope(String clientToken, String... scopes) {
+		SaOAuth2Manager.getTemplate().checkClientTokenScope(clientToken, scopes);
+	}
+
+	/**
+	 * 回收 ClientToken
+	 *
+	 * @param clientToken /
+	 */
+	public static void revokeClientToken(String clientToken) {
+		SaOAuth2Manager.getTemplate().revokeClientToken(clientToken);
+	}
+
+	/**
+	 * 回收 ClientToken，根据索引： clientId
+	 *
+	 * @param clientId /
+	 */
+	public static void revokeClientTokenByIndex(String clientId) {
+		SaOAuth2Manager.getTemplate().revokeClientTokenByIndex(clientId);
+	}
+
+	/**
+	 * 回收 PastToken，根据索引： clientId
+	 *
+	 * @param clientId /
 	 */
-	public static List<String> getGrantScope(String clientId, Object loginId) {
-		return SaOAuth2Manager.getDao().getGrantScope(clientId, loginId);
+	public static void revokePastTokenByIndex(String clientId) {
+		SaOAuth2Manager.getTemplate().revokePastTokenByIndex(clientId);
 	}
 
 }
-- 
Gitee


From 672f3bd081909f6b3493fc0e5d3c48c55c29c8c0 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 10:50:16 +0800
Subject: [PATCH 155/172] =?UTF-8?q?=E9=94=99=E8=AF=AF=E8=B0=83=E7=94=A8API?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/com/pj/oauth2/SaOAuth2ServerController.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index 94a95446..f2acd722 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -77,7 +77,7 @@ public class SaOAuth2ServerController {
 		System.out.println("-------- 此Access-Token对应的账号id: " + loginId);
 
 		// 校验 Access-Token 是否具有权限: userinfo
-		SaOAuth2Util.checkScope(accessToken, "userinfo");
+		SaOAuth2Util.checkAccessTokenScope(accessToken, "userinfo");
 
 		// 模拟账号信息 （真实环境需要查询数据库获取信息）
 		Map<String, Object> map = new LinkedHashMap<>();
-- 
Gitee


From 6a9f25093dacf50a0664625afdf44b7419f7ddcb Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 11:46:43 +0800
Subject: [PATCH 156/172] =?UTF-8?q?=E7=BB=86=E8=8A=82=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-demo/sa-token-demo-solon/pom.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sa-token-demo/sa-token-demo-solon/pom.xml b/sa-token-demo/sa-token-demo-solon/pom.xml
index ecd93e43..c3178eaa 100644
--- a/sa-token-demo/sa-token-demo-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon/pom.xml
@@ -10,12 +10,15 @@
 	<parent>
 		<groupId>org.noear</groupId>
 		<artifactId>solon-parent</artifactId>
-		<version>2.7.0</version>
+		<version>2.9.1</version>
 		<relativePath/>
 	</parent>
 
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
+		<java.version>17</java.version>
+		<maven.compiler.source>17</maven.compiler.source>
+		<maven.compiler.traget>17</maven.compiler.traget>
 		<sa-token.version>1.38.0</sa-token.version>
 	    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-- 
Gitee


From beb958f2744e47c4f97512c937a13980939698ed Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 14:02:50 +0800
Subject: [PATCH 157/172] =?UTF-8?q?=E6=96=B0=E5=A2=9Esa-token-oauth2=20?=
 =?UTF-8?q?=E6=B3=A8=E8=A7=A3=E9=89=B4=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../pj/oauth2/SaOAuthClientController.java    |   2 +-
 .../pj/oauth2/SaOAuth2ServerController.java   |   9 +-
 .../oauth2/custom/CustomOidcScopeHandler.java |  64 +++++-----
 .../custom/PhoneCodeGrantTypeHandler.java     | 114 +++++++++---------
 .../oauth2/custom/PhoneLoginController.java   |  52 ++++----
 .../oauth2/custom/UserinfoScopeHandler.java   |  82 ++++++-------
 .../GlobalExceptionHandler.java               |   2 +-
 .../java/com/pj/satoken/SaTokenConfigure.java |  27 +++++
 .../main/java/com/pj/test/TestController.java |  72 +++++++++++
 sa-token-doc/_sidebar.md                      |   1 +
 sa-token-doc/oauth2/oauth2-at-check.md        |  94 +++++++++++++++
 .../oauth2/annotation/SaCheckAccessToken.java |  42 +++++++
 .../annotation/SaCheckClientIdSecret.java     |  35 ++++++
 .../oauth2/annotation/SaCheckClientToken.java |  42 +++++++
 .../handler/SaCheckAccessTokenHandler.java    |  48 ++++++++
 .../handler/SaCheckClientIdSecretHandler.java |  46 +++++++
 .../handler/SaCheckClientTokenHandler.java    |  48 ++++++++
 .../satoken/oauth2/consts/SaOAuth2Consts.java |   1 +
 .../data/resolver/SaOAuth2DataResolver.java   |   8 ++
 .../SaOAuth2DataResolverDefaultImpl.java      |  27 +++++
 .../processor/SaOAuth2ServerProcessor.java    |  12 +-
 .../oauth2/template/SaOAuth2Template.java     |  11 +-
 .../spring/oauth2/SaOAuth2BeanRegister.java   |  34 ++++++
 23 files changed, 698 insertions(+), 175 deletions(-)
 rename sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/{current => satoken}/GlobalExceptionHandler.java (94%)
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/SaTokenConfigure.java
 create mode 100644 sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/test/TestController.java
 create mode 100644 sa-token-doc/oauth2/oauth2-at-check.md
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckAccessToken.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientIdSecret.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientToken.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckAccessTokenHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientIdSecretHandler.java
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientTokenHandler.java

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
index ffa9fe0c..6769068e 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/java/com/pj/oauth2/SaOAuthClientController.java
@@ -24,7 +24,7 @@ public class SaOAuthClientController {
 	private final String clientId = "1001";								// 应用id
 	private final String clientSecret = "aaaa-bbbb-cccc-dddd-eeee";		// 应用秘钥
 	private final String serverUrl = "http://sa-oauth-server.com:8000";	// 服务端接口
-	
+
 	// 进入首页 
 	@RequestMapping("/")
 	public Object index(HttpServletRequest request) {
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
index f2acd722..fee73b06 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/SaOAuth2ServerController.java
@@ -4,7 +4,6 @@ import cn.dev33.satoken.context.SaHolder;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
 import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
-import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Util;
 import cn.dev33.satoken.stp.StpUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -57,12 +56,6 @@ public class SaOAuth2ServerController {
 			return new ModelAndView("confirm.html", map);
 		};
 
-		// 重写 AccessToken 创建策略，返回会话令牌
-		SaOAuth2Strategy.instance.createAccessToken = (clientId, loginId, scopes) -> {
-			System.out.println("----返回会话令牌");
-			return StpUtil.getOrCreateLoginSession(loginId);
-		};
-
 	}
 
 
@@ -89,5 +82,5 @@ public class SaOAuth2ServerController {
 		map.put("address", "山东省 青岛市 城阳区");
 		return SaResult.ok().setMap(map);
 	}
-	
+
 }
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
index 342498e8..835cc377 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/CustomOidcScopeHandler.java
@@ -1,32 +1,32 @@
-package com.pj.oauth2.custom;
-
-import cn.dev33.satoken.oauth2.data.model.oidc.IdTokenModel;
-import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
-import org.springframework.stereotype.Component;
-
-/**
- * 扩展 OIDC 权限处理器，返回更多字段
- *
- * @author click33
- * @since 2024/8/24
- */
-@Component
-public class CustomOidcScopeHandler extends OidcScopeHandler {
-
-    @Override
-    public IdTokenModel workExtraData(IdTokenModel idToken) {
-        Object userId = idToken.sub;
-        System.out.println("----- 为 idToken 追加扩展字段 ----- ");
-
-        idToken.extraData.put("uid", userId); // 用户id
-        idToken.extraData.put("nickname", "lin_xiao_lin"); // 昵称
-        idToken.extraData.put("picture", "https://sa-token.cc/logo.png"); // 头像
-        idToken.extraData.put("email", "456456@xx.com"); // 邮箱
-        idToken.extraData.put("phone_number", "13144556677"); // 手机号
-        // 更多字段 ...
-        // 可参考：https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
-
-        return idToken;
-    }
-
-}
\ No newline at end of file
+//package com.pj.oauth2.custom;
+//
+//import cn.dev33.satoken.oauth2.data.model.oidc.IdTokenModel;
+//import cn.dev33.satoken.oauth2.scope.handler.OidcScopeHandler;
+//import org.springframework.stereotype.Component;
+//
+///**
+// * 扩展 OIDC 权限处理器，返回更多字段
+// *
+// * @author click33
+// * @since 2024/8/24
+// */
+//@Component
+//public class CustomOidcScopeHandler extends OidcScopeHandler {
+//
+//    @Override
+//    public IdTokenModel workExtraData(IdTokenModel idToken) {
+//        Object userId = idToken.sub;
+//        System.out.println("----- 为 idToken 追加扩展字段 ----- ");
+//
+//        idToken.extraData.put("uid", userId); // 用户id
+//        idToken.extraData.put("nickname", "lin_xiao_lin"); // 昵称
+//        idToken.extraData.put("picture", "https://sa-token.cc/logo.png"); // 头像
+//        idToken.extraData.put("email", "456456@xx.com"); // 邮箱
+//        idToken.extraData.put("phone_number", "13144556677"); // 手机号
+//        // 更多字段 ...
+//        // 可参考：https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+//
+//        return idToken;
+//    }
+//
+//}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
index 6afb64a7..da77857d 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneCodeGrantTypeHandler.java
@@ -1,57 +1,57 @@
-package com.pj.oauth2.custom;
-
-import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.context.model.SaRequest;
-import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
-import cn.dev33.satoken.oauth2.granttype.handler.SaOAuth2GrantTypeHandlerInterface;
-import org.springframework.stereotype.Component;
-
-import java.util.List;
-
-/**
- * 自定义 phone_code 授权模式处理器
- *
- * @author click33
- * @since 2024/8/23
- */
-@Component
-public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
-
-    @Override
-    public String getHandlerGrantType() {
-        return "phone_code";
-    }
-
-    @Override
-    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
-
-        // 获取前端提交的参数
-        String phone = req.getParamNotNull("phone");
-        String code = req.getParamNotNull("code");
-        String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
-
-        // 1、校验验证码是否正确
-        if(!code.equals(realCode)) {
-            throw new SaOAuth2Exception("验证码错误");
-        }
-
-        // 2、校验通过，删除验证码
-        SaManager.getSaTokenDao().delete("phone_code:" + phone);
-
-        // 3、登录
-        long userId = 10001; // 模拟 userId，真实项目应该根据手机号从数据库查询
-
-        // 4、构建 ra 对象
-        RequestAuthModel ra = new RequestAuthModel();
-        ra.clientId = clientId;
-        ra.loginId = userId;
-        ra.scopes = scopes;
-
-        // 5、生成 Access-Token
-        AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
-        return at;
-    }
-}
\ No newline at end of file
+//package com.pj.oauth2.custom;
+//
+//import cn.dev33.satoken.SaManager;
+//import cn.dev33.satoken.context.model.SaRequest;
+//import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+//import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+//import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+//import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+//import cn.dev33.satoken.oauth2.granttype.handler.SaOAuth2GrantTypeHandlerInterface;
+//import org.springframework.stereotype.Component;
+//
+//import java.util.List;
+//
+///**
+// * 自定义 phone_code 授权模式处理器
+// *
+// * @author click33
+// * @since 2024/8/23
+// */
+//@Component
+//public class PhoneCodeGrantTypeHandler implements SaOAuth2GrantTypeHandlerInterface {
+//
+//    @Override
+//    public String getHandlerGrantType() {
+//        return "phone_code";
+//    }
+//
+//    @Override
+//    public AccessTokenModel getAccessToken(SaRequest req, String clientId, List<String> scopes) {
+//
+//        // 获取前端提交的参数
+//        String phone = req.getParamNotNull("phone");
+//        String code = req.getParamNotNull("code");
+//        String realCode = SaManager.getSaTokenDao().get("phone_code:" + phone);
+//
+//        // 1、校验验证码是否正确
+//        if(!code.equals(realCode)) {
+//            throw new SaOAuth2Exception("验证码错误");
+//        }
+//
+//        // 2、校验通过，删除验证码
+//        SaManager.getSaTokenDao().delete("phone_code:" + phone);
+//
+//        // 3、登录
+//        long userId = 10001; // 模拟 userId，真实项目应该根据手机号从数据库查询
+//
+//        // 4、构建 ra 对象
+//        RequestAuthModel ra = new RequestAuthModel();
+//        ra.clientId = clientId;
+//        ra.loginId = userId;
+//        ra.scopes = scopes;
+//
+//        // 5、生成 Access-Token
+//        AccessTokenModel at = SaOAuth2Manager.getDataGenerate().generateAccessToken(ra, true);
+//        return at;
+//    }
+//}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
index 92cb3d99..8f25a174 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/PhoneLoginController.java
@@ -1,26 +1,26 @@
-package com.pj.oauth2.custom;
-
-import cn.dev33.satoken.SaManager;
-import cn.dev33.satoken.util.SaFoxUtil;
-import cn.dev33.satoken.util.SaResult;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-/**
- * 自定义手机登录接口
- *
- * @author click33
- * @since 2024/8/23
- */
-@RestController
-public class PhoneLoginController {
-
-    @RequestMapping("/oauth2/sendPhoneCode")
-    public SaResult sendCode(String phone) {
-        String code = SaFoxUtil.getRandomNumber(100000, 999999) + "";
-        SaManager.getSaTokenDao().set("phone_code:" + phone, code, 60 * 5);
-        System.out.println("手机号：" + phone + "，验证码：" + code + "，已发送成功");
-        return SaResult.ok("验证码发送成功");
-    }
-
-}
\ No newline at end of file
+//package com.pj.oauth2.custom;
+//
+//import cn.dev33.satoken.SaManager;
+//import cn.dev33.satoken.util.SaFoxUtil;
+//import cn.dev33.satoken.util.SaResult;
+//import org.springframework.web.bind.annotation.RequestMapping;
+//import org.springframework.web.bind.annotation.RestController;
+//
+///**
+// * 自定义手机登录接口
+// *
+// * @author click33
+// * @since 2024/8/23
+// */
+//@RestController
+//public class PhoneLoginController {
+//
+//    @RequestMapping("/oauth2/sendPhoneCode")
+//    public SaResult sendCode(String phone) {
+//        String code = SaFoxUtil.getRandomNumber(100000, 999999) + "";
+//        SaManager.getSaTokenDao().set("phone_code:" + phone, code, 60 * 5);
+//        System.out.println("手机号：" + phone + "，验证码：" + code + "，已发送成功");
+//        return SaResult.ok("验证码发送成功");
+//    }
+//
+//}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
index 088e9f57..bc71bebe 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/oauth2/custom/UserinfoScopeHandler.java
@@ -1,41 +1,41 @@
-package com.pj.oauth2.custom;
-
-import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
-import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
-import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
-import org.springframework.stereotype.Component;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-/**
- * @author click33
- * @since 2024/8/20
- */
-@Component
-public class UserinfoScopeHandler implements SaOAuth2ScopeHandlerInterface {
-
-    @Override
-    public String getHandlerScope() {
-        return "userinfo";
-    }
-
-    @Override
-    public void workAccessToken(AccessTokenModel at) {
-        System.out.println("--------- userinfo 权限，加工 AccessTokenModel --------- ");
-        // 模拟账号信息 （真实环境需要查询数据库获取信息）
-        Map<String, Object> map = new LinkedHashMap<String, Object>();
-        map.put("userId", "10008");
-        map.put("nickname", "shengzhang_");
-        map.put("avatar", "http://xxx.com/1.jpg");
-        map.put("age", "18");
-        map.put("sex", "男");
-        map.put("address", "山东省 青岛市 城阳区");
-        at.extraData.put("userinfo", map);
-    }
-
-    @Override
-    public void workClientToken(ClientTokenModel ct) {
-    }
-
-}
\ No newline at end of file
+//package com.pj.oauth2.custom;
+//
+//import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
+//import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
+//import cn.dev33.satoken.oauth2.scope.handler.SaOAuth2ScopeHandlerInterface;
+//import org.springframework.stereotype.Component;
+//
+//import java.util.LinkedHashMap;
+//import java.util.Map;
+//
+///**
+// * @author click33
+// * @since 2024/8/20
+// */
+//@Component
+//public class UserinfoScopeHandler implements SaOAuth2ScopeHandlerInterface {
+//
+//    @Override
+//    public String getHandlerScope() {
+//        return "userinfo";
+//    }
+//
+//    @Override
+//    public void workAccessToken(AccessTokenModel at) {
+//        System.out.println("--------- userinfo 权限，加工 AccessTokenModel --------- ");
+//        // 模拟账号信息 （真实环境需要查询数据库获取信息）
+//        Map<String, Object> map = new LinkedHashMap<String, Object>();
+//        map.put("userId", "10008");
+//        map.put("nickname", "shengzhang_");
+//        map.put("avatar", "http://xxx.com/1.jpg");
+//        map.put("age", "18");
+//        map.put("sex", "男");
+//        map.put("address", "山东省 青岛市 城阳区");
+//        at.extraData.put("userinfo", map);
+//    }
+//
+//    @Override
+//    public void workClientToken(ClientTokenModel ct) {
+//    }
+//
+//}
\ No newline at end of file
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/GlobalExceptionHandler.java
similarity index 94%
rename from sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java
rename to sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/GlobalExceptionHandler.java
index f251e478..b97704fa 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/current/GlobalExceptionHandler.java
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/GlobalExceptionHandler.java
@@ -1,4 +1,4 @@
-package com.pj.current;
+package com.pj.satoken;
 
 import cn.dev33.satoken.util.SaResult;
 import org.springframework.web.bind.annotation.ExceptionHandler;
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/SaTokenConfigure.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/SaTokenConfigure.java
new file mode 100644
index 00000000..eadad0f3
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/satoken/SaTokenConfigure.java
@@ -0,0 +1,27 @@
+package com.pj.satoken;
+
+import cn.dev33.satoken.interceptor.SaInterceptor;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+
+/**
+ * [Sa-Token 权限认证] 配置类 
+ * @author click33
+ *
+ */
+@Configuration
+public class SaTokenConfigure implements WebMvcConfigurer {
+	
+	/**
+	 * 注册 Sa-Token 拦截器打开注解鉴权功能  
+	 */
+	@Override
+	public void addInterceptors(InterceptorRegistry registry) {
+		// 注册 Sa-Token 拦截器打开注解鉴权功能 
+		registry.addInterceptor(new SaInterceptor()).addPathPatterns("/**");
+		
+	}
+
+}
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/test/TestController.java b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/test/TestController.java
new file mode 100644
index 00000000..8adc82dc
--- /dev/null
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/java/com/pj/test/TestController.java
@@ -0,0 +1,72 @@
+package com.pj.test;
+
+import cn.dev33.satoken.oauth2.annotation.SaCheckAccessToken;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientIdSecret;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientToken;
+import cn.dev33.satoken.util.SaResult;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * OAuth2 相关注解测试 Controller
+ *
+ * @author click33
+ * @since 2024/8/25
+ */
+@RestController
+@RequestMapping("/test")
+public class TestController {
+
+    // 测试：携带有效的 access_token 才可以进入请求
+    // 你可以在请求参数中携带 access_token 参数，或者从请求头以 Authorization: bearer xxx 的形式携带
+    @SaCheckAccessToken
+    @RequestMapping("/checkAccessToken")
+    public SaResult checkAccessToken() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 access_token ，并且具备指定 scope 才可以进入请求
+    @SaCheckAccessToken(scope = "userinfo")
+    @RequestMapping("/checkAccessTokenScope")
+    public SaResult checkAccessTokenScope() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 access_token ，并且具备指定 scope 列表才可以进入请求
+    @SaCheckAccessToken(scope = {"openid", "userinfo"})
+    @RequestMapping("/checkAccessTokenScopeList")
+    public SaResult checkAccessTokenScopeList() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_token 才可以进入请求
+    // 你可以在请求参数中携带 client_token 参数，或者从请求头以 Authorization: bearer xxx 的形式携带
+    @SaCheckClientToken
+    @RequestMapping("/checkClientToken")
+    public SaResult checkClientToken() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_token ，并且具备指定 scope 才可以进入请求
+    @SaCheckClientToken(scope = "userinfo")
+    @RequestMapping("/checkClientTokenScope")
+    public SaResult checkClientTokenScope() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_token ，并且具备指定 scope 列表才可以进入请求
+    @SaCheckClientToken(scope = {"openid", "userinfo"})
+    @RequestMapping("/checkClientTokenScopeList")
+    public SaResult checkClientTokenScopeList() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_id 和 client_secret 信息，才可以进入请求
+    // 你可以在请求参数中携带 client_id 和 client_secret 参数，或者从请求头以 Authorization: Basic base64(client_id:client_secret) 的形式携带
+    @SaCheckClientIdSecret
+    @RequestMapping("/checkClientIdSecret")
+    public SaResult checkClientIdSecret() {
+        return SaResult.ok("访问成功");
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index f11153ff..f23aa033 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -63,6 +63,7 @@
 	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
 	- [开启 OIDC 协议](/oauth2/oauth2-oidc)
 	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
+	- [使用注解校验 Access-Token](/oauth2/oauth2-at-check)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
 	- [常见问题总结](/oauth2/oauth2-questions)
 	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
diff --git a/sa-token-doc/oauth2/oauth2-at-check.md b/sa-token-doc/oauth2/oauth2-at-check.md
new file mode 100644
index 00000000..aa0fbfe8
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-at-check.md
@@ -0,0 +1,94 @@
+# Sa-Token OAuth2 模块相关注解
+
+sa-token-oauth2 模块扩展了三个注解用于相关数据校验：
+- `@SaCheckAccessToken`：指定请求中必须包含有效的 `access_token` ，并且包含指定的 `scope`。
+- `@SaCheckClientToken`：指定请求中必须包含有效的 `client_token` ，并且包含指定的 `scope`。
+- `@SaCheckClientIdSecret`：指定请求中必须包含有效的 `client_id` 和 `client_secret` 信息。
+
+和 Sa-Token-Code 模块的注解一样，你必须先注册框架的内置拦截器，才可以使用这些注解，详细参考：[注解鉴权](/use/at-check) 。
+
+--- 
+
+
+### 1、@SaCheckAccessToken 示例
+
+``` java
+@RestController
+@RequestMapping("/test")
+public class TestController {
+
+    // 测试：携带有效的 access_token 才可以进入请求
+    // 你可以在请求参数中携带 access_token 参数，或者从请求头以 Authorization: bearer xxx 的形式携带 
+    @SaCheckAccessToken
+    @RequestMapping("/checkAccessToken")
+    public SaResult checkAccessToken() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 access_token ，并且具备指定 scope 才可以进入请求
+    @SaCheckAccessToken(scope = "userinfo")
+    @RequestMapping("/checkAccessTokenScope")
+    public SaResult checkAccessTokenScope() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 access_token ，并且具备指定 scope 列表才可以进入请求
+    @SaCheckAccessToken(scope = {"openid", "userinfo"})
+    @RequestMapping("/checkAccessTokenScopeList")
+    public SaResult checkAccessTokenScopeList() {
+        return SaResult.ok("访问成功");
+    }
+
+}
+```
+
+
+### 2、@SaCheckClientToken 示例
+
+``` java
+@RestController
+@RequestMapping("/test")
+public class TestController {
+
+    // 测试：携带有效的 client_token 才可以进入请求
+    // 你可以在请求参数中携带 client_token 参数，或者从请求头以 Authorization: bearer xxx 的形式携带
+    @SaCheckClientToken
+    @RequestMapping("/checkClientToken")
+    public SaResult checkClientToken() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_token ，并且具备指定 scope 才可以进入请求
+    @SaCheckClientToken(scope = "userinfo")
+    @RequestMapping("/checkClientTokenScope")
+    public SaResult checkClientTokenScope() {
+        return SaResult.ok("访问成功");
+    }
+
+    // 测试：携带有效的 client_token ，并且具备指定 scope 列表才可以进入请求
+    @SaCheckClientToken(scope = {"openid", "userinfo"})
+    @RequestMapping("/checkClientTokenScopeList")
+    public SaResult checkClientTokenScopeList() {
+        return SaResult.ok("访问成功");
+    }
+
+}
+```
+
+
+### 3、@SaCheckClientIdSecret 示例
+``` java
+@RestController
+@RequestMapping("/test")
+public class TestController {
+
+    // 测试：携带有效的 client_id 和 client_secret 信息，才可以进入请求
+    // 你可以在请求参数中携带 client_id 和 client_secret 参数，或者从请求头以 Authorization: Basic base64(client_id:client_secret) 的形式携带
+    @SaCheckClientIdSecret
+    @RequestMapping("/checkClientIdSecret")
+    public SaResult checkClientIdSecret() {
+        return SaResult.ok("访问成功");
+    }
+
+}
+```
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckAccessToken.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckAccessToken.java
new file mode 100644
index 00000000..2f41ccee
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckAccessToken.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * Access-Token 校验：指定请求中必须包含有效的 access_token ，并且包含指定的 scope
+ *
+ * <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD,ElementType.TYPE})
+public @interface SaCheckAccessToken {
+
+	/**
+	 * 需要校验的 scope [ 数组 ]
+	 *
+	 * @return /
+	 */
+	String [] scope() default {};
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientIdSecret.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientIdSecret.java
new file mode 100644
index 00000000..ee849984
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientIdSecret.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * ClientSecret 校验：指定请求中必须包含有效的 client_id 和 client_secret 信息
+ *
+ * <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD,ElementType.TYPE})
+public @interface SaCheckClientIdSecret {
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientToken.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientToken.java
new file mode 100644
index 00000000..16e7f8b9
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/SaCheckClientToken.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * Client-Token 校验：指定请求中必须包含有效的 client_token ，并且包含指定的 scope
+ *
+ * <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD,ElementType.TYPE})
+public @interface SaCheckClientToken {
+
+	/**
+	 * 需要校验的 scope [ 数组 ]
+	 *
+	 * @return /
+	 */
+	String [] scope() default {};
+
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckAccessTokenHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckAccessTokenHandler.java
new file mode 100644
index 00000000..c7caf663
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckAccessTokenHandler.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.annotation.SaCheckAccessToken;
+
+import java.lang.reflect.Method;
+
+/**
+ * 注解 SaCheckAccessToken 的处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaCheckAccessTokenHandler implements SaAnnotationHandlerInterface<SaCheckAccessToken> {
+
+    @Override
+    public Class<SaCheckAccessToken> getHandlerAnnotationClass() {
+        return SaCheckAccessToken.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckAccessToken at, Method method) {
+        _checkMethod(at.scope());
+    }
+
+    public static void _checkMethod(String[] scope) {
+        String accessToken = SaOAuth2Manager.getDataResolver().readAccessToken(SaHolder.getRequest());
+        SaOAuth2Manager.getTemplate().checkAccessTokenScope(accessToken, scope);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientIdSecretHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientIdSecretHandler.java
new file mode 100644
index 00000000..6f1179e9
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientIdSecretHandler.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientIdSecret;
+import cn.dev33.satoken.oauth2.processor.SaOAuth2ServerProcessor;
+
+import java.lang.reflect.Method;
+
+/**
+ * 注解 SaCheckClientSecret 的处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaCheckClientIdSecretHandler implements SaAnnotationHandlerInterface<SaCheckClientIdSecret> {
+
+    @Override
+    public Class<SaCheckClientIdSecret> getHandlerAnnotationClass() {
+        return SaCheckClientIdSecret.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckClientIdSecret at, Method method) {
+        _checkMethod();
+    }
+
+    public static void _checkMethod() {
+        SaOAuth2ServerProcessor.instance.checkCurrClientSecret();
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientTokenHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientTokenHandler.java
new file mode 100644
index 00000000..b8c958f1
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/annotation/handler/SaCheckClientTokenHandler.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.annotation.handler;
+
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientToken;
+
+import java.lang.reflect.Method;
+
+/**
+ * 注解 SaCheckAccessToken 的处理器
+ *
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaCheckClientTokenHandler implements SaAnnotationHandlerInterface<SaCheckClientToken> {
+
+    @Override
+    public Class<SaCheckClientToken> getHandlerAnnotationClass() {
+        return SaCheckClientToken.class;
+    }
+
+    @Override
+    public void checkMethod(SaCheckClientToken at, Method method) {
+        _checkMethod(at.scope());
+    }
+
+    public static void _checkMethod(String[] scope) {
+        String clientToken = SaOAuth2Manager.getDataResolver().readClientToken(SaHolder.getRequest());
+        SaOAuth2Manager.getTemplate().checkClientTokenScope(clientToken, scope);
+    }
+
+}
\ No newline at end of file
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
index bdb8c650..9637d125 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/consts/SaOAuth2Consts.java
@@ -52,6 +52,7 @@ public class SaOAuth2Consts {
 		public static String token = "token";
 		public static String access_token = "access_token";
 		public static String refresh_token = "refresh_token";
+		public static String client_token = "client_token";
 		public static String grant_type = "grant_type";
 		public static String username = "username";
 		public static String password = "password";
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 5ea2b7dd..49d3e949 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -50,6 +50,14 @@ public interface SaOAuth2DataResolver {
      */
     String readAccessToken(SaRequest request);
 
+    /**
+     * 数据读取：从请求对象中读取 ClientToken
+     *
+     * @param request /
+     * @return /
+     */
+    String readClientToken(SaRequest request);
+
     /**
      * 数据读取：从请求对象中构建 RequestAuthModel
      * @param req SaRequest对象
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 31186e4b..4cac496b 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -98,6 +98,33 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         return null;
     }
 
+    /**
+     * 数据读取：从请求对象中读取 ClientToken
+     */
+    @Override
+    public String readClientToken(SaRequest request) {
+        // 优先从请求参数中获取
+        String clientToken = request.getParam(SaOAuth2Consts.Param.client_token);
+        if(SaFoxUtil.isNotEmpty(clientToken)) {
+            return clientToken;
+        }
+
+        // 如果请求参数中没有提供 client_token 参数，则尝试从 Authorization 中获取
+        String authorizationValue = request.getHeader(SaOAuth2Consts.Param.Authorization);
+        if(SaFoxUtil.isEmpty(authorizationValue)) {
+            return null;
+        }
+
+        // 判断前缀，裁剪
+        String prefix = TokenType.Bearer + " ";
+        if(authorizationValue.startsWith(prefix)) {
+            return authorizationValue.substring(prefix.length());
+        }
+
+        // 前缀不符合，返回 null
+        return null;
+    }
+
     /**
      * 数据读取：从请求对象中构建 RequestAuthModel
      */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index f8e56867..e6401002 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -37,7 +37,6 @@ import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.oauth2.template.SaOAuth2Template;
 import cn.dev33.satoken.router.SaHttpMethod;
-import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
 
 import java.util.List;
@@ -332,6 +331,17 @@ public class SaOAuth2ServerProcessor {
 		return oauth2Template.checkClientModel(clientIdAndSecret.clientId);
 	}
 
+	/**
+	 * 校验当前请求中提交的 clientId 和 clientSecret 是否正确，如果正确则返回 SaClientModel 对象
+	 *
+	 * @return /
+	 */
+	public SaClientModel checkCurrClientSecret() {
+		SaOAuth2Template oauth2Template = SaOAuth2Manager.getTemplate();
+		ClientIdAndSecretModel clientIdAndSecret = SaOAuth2Manager.getDataResolver().readClientIdAndSecret(SaHolder.getRequest());
+		return oauth2Template.checkClientSecret(clientIdAndSecret.clientId, clientIdAndSecret.clientSecret);
+	}
+
 	/**
 	 * 校验 authorize 路由的 ResponseType 参数
 	 */
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index e35cef93..7479f24d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -415,12 +415,12 @@ public class SaOAuth2Template {
 	 * @param scopes 需要校验的权限列表
 	 */
 	public void checkAccessTokenScope(String accessToken, String... scopes) {
+		AccessTokenModel at = checkAccessToken(accessToken);
 		if(SaFoxUtil.isEmptyArray(scopes)) {
 			return;
 		}
-		ClientTokenModel ct = checkClientToken(accessToken);
 		for (String scope : scopes) {
-			if(! ct.scopes.contains(scope)) {
+			if(! at.scopes.contains(scope)) {
 				throw new SaOAuth2AccessTokenScopeException("该 access_token 不具备 scope：" + scope)
 						.setAccessToken(accessToken)
 						.setScope(scope)
@@ -461,11 +461,6 @@ public class SaOAuth2Template {
 		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
 		dao.deleteAccessToken(accessToken);
 		dao.deleteAccessTokenIndex(at.clientId, at.loginId);
-
-		// 删对应的 rt、索引
-//		String rtValue = dao.getRefreshTokenValue(at.clientId, at.loginId);
-//		dao.deleteRefreshToken(rtValue);
-//		dao.deleteRefreshTokenIndex(at.clientId, at.loginId);
 	}
 
 	/**
@@ -586,10 +581,10 @@ public class SaOAuth2Template {
 	 * @param scopes 需要校验的权限列表
 	 */
 	public void checkClientTokenScope(String clientToken, String... scopes) {
+		ClientTokenModel ct = checkClientToken(clientToken);
 		if(SaFoxUtil.isEmptyArray(scopes)) {
 			return;
 		}
-		ClientTokenModel ct = checkClientToken(clientToken);
 		for (String scope : scopes) {
 			if(! ct.scopes.contains(scope)) {
 				throw new SaOAuth2ClientTokenScopeException("该 client_token 不具备 scope：" + scope)
diff --git a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
index 788f97af..b9b99a3c 100644
--- a/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
+++ b/sa-token-starter/sa-token-spring-boot-autoconfig/src/main/java/cn/dev33/satoken/spring/oauth2/SaOAuth2BeanRegister.java
@@ -15,7 +15,14 @@
  */
 package cn.dev33.satoken.spring.oauth2;
 
+import cn.dev33.satoken.annotation.handler.SaAnnotationHandlerInterface;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
+import cn.dev33.satoken.oauth2.annotation.SaCheckAccessToken;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientIdSecret;
+import cn.dev33.satoken.oauth2.annotation.SaCheckClientToken;
+import cn.dev33.satoken.oauth2.annotation.handler.SaCheckAccessTokenHandler;
+import cn.dev33.satoken.oauth2.annotation.handler.SaCheckClientIdSecretHandler;
+import cn.dev33.satoken.oauth2.annotation.handler.SaCheckClientTokenHandler;
 import cn.dev33.satoken.oauth2.config.SaOAuth2ServerConfig;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -41,4 +48,31 @@ public class SaOAuth2BeanRegister {
 		return new SaOAuth2ServerConfig();
 	}
 
+	// 自定义注解处理器
+	@Bean
+	public SaAnnotationHandlerInterface<SaCheckAccessToken> getSaCheckAccessTokenHandler() {
+		return new SaCheckAccessTokenHandler();
+	}
+	@Bean
+	public SaAnnotationHandlerInterface<SaCheckClientToken> getSaCheckClientTokenHandler() {
+		return new SaCheckClientTokenHandler();
+	}
+	@Bean
+	public SaAnnotationHandlerInterface<SaCheckClientIdSecret> getSaCheckClientIdSecretHandler() {
+		return new SaCheckClientIdSecretHandler();
+	}
+
+	/*
+	 // 这种写法有问题，当项目还有自定义的注解处理器时，项目中的自定义注解处理器将会覆盖掉此处 List 中的注解处理器
+//	@Bean
+//	public List<SaAnnotationHandlerInterface<?>> getXxx() {
+//		return Arrays.asList(
+//				new SaCheckAccessTokenHandler(),
+//				new SaCheckClientTokenHandler(),
+//				new SaCheckClientSecretHandler()
+//		);
+//	}
+
+	 */
+
 }
-- 
Gitee


From 60b7c9036fa9f05120aa9b2a5220ad73b2c54581 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 20:00:05 +0800
Subject: [PATCH 158/172] =?UTF-8?q?=E9=87=8D=E6=9E=84=E6=94=B9=E5=90=8D=20?=
 =?UTF-8?q?PastToken=20->=20LowerClientToken?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/resources/templates/index.html   |  2 +-
 .../oauth2/config/SaOAuth2ServerConfig.java   | 18 ++++----
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java | 45 ++++++++++---------
 .../SaOAuth2DataGenerateDefaultImpl.java      | 14 +++---
 .../data/model/loader/SaClientModel.java      | 20 ++++-----
 .../oauth2/template/SaOAuth2Template.java     | 14 +++---
 .../satoken/oauth2/template/SaOAuth2Util.java |  6 +--
 .../dev33/satoken/dao/SaSessionForJson.java   |  1 -
 8 files changed, 61 insertions(+), 59 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
index adc3bd0a..0e8d6858 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
@@ -82,7 +82,7 @@
 			<h3>模式四：凭证式（Client Credentials）</h3>
 			<p class="pst">以上三种模式获取的都是用户的 Access-Token，代表用户对第三方应用的授权，在OAuth2.0中还有一种针对 Client级别的授权，
 				即：Client-Token，代表应用自身的资源授权</p>
-			<p class="pst">Client-Token具有延迟作废特性，即：在每次获取最新Client-Token的时候，旧Client-Token不会立即过期，而是作为Past-Token再次
+			<p class="pst">Client-Token具有延迟作废特性，即：在每次获取最新Client-Token的时候，旧Client-Token不会立即过期，而是作为Lower-Client-Token再次
 				储存起来，资源请求方只要携带其中之一便可通过Token校验，这种特性保证了在大量并发请求时不会出现“新旧Token交替造成的授权失效”，
 				保证了服务的高可用</p>
 				
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index 3791c939..abdbc03d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -60,8 +60,8 @@ public class SaOAuth2ServerConfig implements Serializable {
 	/** Client-Token 保存的时间(单位：秒) 默认两个小时 */
 	public long clientTokenTimeout = 60 * 60 * 2;
 
-	/** Past-Client-Token 保存的时间(单位：秒) 默认为 -1，代表延续 Client-Token 有效期 */
-	public long pastClientTokenTimeout = -1;
+	/** Lower-Client-Token 保存的时间(单位：秒) 默认为 -1，代表延续 Client-Token 有效期 */
+	public long lowerClientTokenTimeout = -1;
 
 	/** 默认 openid 生成算法中使用的摘要前缀 */
 	public String openidDigestPrefix = SaOAuth2Consts.OPENID_DEFAULT_DIGEST_PREFIX;
@@ -228,18 +228,18 @@ public class SaOAuth2ServerConfig implements Serializable {
 	}
 
 	/**
-	 * @return pastClientTokenTimeout
+	 * @return lowerClientTokenTimeout
 	 */
-	public long getPastClientTokenTimeout() {
-		return pastClientTokenTimeout;
+	public long getLowerClientTokenTimeout() {
+		return lowerClientTokenTimeout;
 	}
 
 	/**
-	 * @param pastClientTokenTimeout 要设置的 pastClientTokenTimeout
+	 * @param lowerClientTokenTimeout 要设置的 lowerClientTokenTimeout
 	 * @return 对象自身
 	 */
-	public SaOAuth2ServerConfig setPastClientTokenTimeout(long pastClientTokenTimeout) {
-		this.pastClientTokenTimeout = pastClientTokenTimeout;
+	public SaOAuth2ServerConfig setLowerClientTokenTimeout(long lowerClientTokenTimeout) {
+		this.lowerClientTokenTimeout = lowerClientTokenTimeout;
 		return this;
 	}
 
@@ -379,7 +379,7 @@ public class SaOAuth2ServerConfig implements Serializable {
 				", accessTokenTimeout=" + accessTokenTimeout +
 				", refreshTokenTimeout=" + refreshTokenTimeout +
 				", clientTokenTimeout=" + clientTokenTimeout +
-				", pastClientTokenTimeout=" + pastClientTokenTimeout +
+				", lowerClientTokenTimeout=" + lowerClientTokenTimeout +
 				", openidDigestPrefix='" + openidDigestPrefix +
 				", higherScope='" + higherScope +
 				", lowerScope='" + lowerScope +
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
index f3110717..803c8b03 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -23,10 +23,13 @@ import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.data.model.CodeModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.util.SaFoxUtil;
 
 import java.util.List;
 
+import static cn.dev33.satoken.oauth2.template.SaOAuth2Util.checkClientModel;
+
 /**
  * Sa-Token OAuth2 数据持久层
  *
@@ -126,20 +129,20 @@ public interface SaOAuth2Dao {
 	}
 
 	/**
-	 * 持久化：Past-Token-索引
+	 * 持久化：Lower-Client-Token 索引
 	 * @param ct /
 	 */
-	default void savePastTokenIndex(ClientTokenModel ct) {
+	default void saveLowerClientTokenIndex(ClientTokenModel ct) {
 		if(ct == null) {
 			return;
 		}
 		long ttl = ct.getExpiresIn();
-		// TODO PastToken ttl 是否有必要单独配置个字段？
-//		SaClientModel cm = checkClientModel(ct.clientId);
-//		if (cm.getPastClientTokenTimeout() != -1) {
-//			ttl = cm.getPastClientTokenTimeout();
-//		}
-		getSaTokenDao().set(splicingPastTokenIndexKey(ct.clientId), ct.clientToken, ttl);
+		// 如果此 client 单独配置了 Lower-Client-Token 的 TTL，则使用单独配置
+		SaClientModel cm = checkClientModel(ct.clientId);
+		if (cm.getLowerClientTokenTimeout() != -1) {
+			ttl = cm.getLowerClientTokenTimeout();
+		}
+		getSaTokenDao().set(splicingLowerClientTokenIndexKey(ct.clientId), ct.clientToken, ttl);
 	}
 
 	/**
@@ -248,20 +251,20 @@ public interface SaOAuth2Dao {
 	}
 
 	/**
-	 * 删除：Past-Token
-	 * @param pastToken 值
+	 * 删除：Lower-Client-Token
+	 * @param lowerClientToken 值
 	 */
-	default void deletePastToken(String pastToken) {
+	default void deleteLowerClientToken(String lowerClientToken) {
 		// 其实就是删除 ClientToken
-		deleteClientToken(pastToken);
+		deleteClientToken(lowerClientToken);
 	}
 
 	/**
-	 * 删除：Past-Token索引
+	 * 删除：Lower-Client-Token索引
 	 * @param clientId 应用id
 	 */
-	default void deletePastTokenIndex(String clientId) {
-		getSaTokenDao().delete(splicingPastTokenIndexKey(clientId));
+	default void deleteLowerClientTokenIndex(String clientId) {
+		getSaTokenDao().delete(splicingLowerClientTokenIndexKey(clientId));
 	}
 
 	/**
@@ -372,12 +375,12 @@ public interface SaOAuth2Dao {
 	}
 
 	/**
-	 * 获取：Past-Token Value
+	 * 获取：Lower-Client-Token Value
 	 * @param clientId 应用id
 	 * @return .
 	 */
-	default String getPastTokenValue(String clientId) {
-		return getSaTokenDao().get(splicingPastTokenIndexKey(clientId));
+	default String getLowerClientTokenValue(String clientId) {
+		return getSaTokenDao().get(splicingLowerClientTokenIndexKey(clientId));
 	}
 
 	/**
@@ -482,12 +485,12 @@ public interface SaOAuth2Dao {
 	}
 
 	/**
-	 * 拼接key：Past-Token 索引
+	 * 拼接key：Lower-Client-Token 索引
 	 * @param clientId clientId
 	 * @return key
 	 */
-	default String splicingPastTokenIndexKey(String clientId) {
-		return getSaTokenConfig().getTokenName() + ":oauth2:past-token-index:" + clientId;
+	default String splicingLowerClientTokenIndexKey(String clientId) {
+		return getSaTokenConfig().getTokenName() + ":oauth2:lower-client-token-index:" + clientId;
 	}
 
 	/**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 33ad2055..36c1e9fe 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -204,17 +204,17 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
 
         SaOAuth2Dao dao = SaOAuth2Manager.getDao();
 
-        // 1、删掉旧 Past-Token
-        dao.deleteClientToken(dao.getPastTokenValue(clientId));
+        // 1、删掉旧 Lower-Client-Token
+        dao.deleteClientToken(dao.getLowerClientTokenValue(clientId));
 
-        // 2、将旧Client-Token 标记为新 Past-Token
+        // 2、将旧Client-Token 标记为新 Lower-Client-Token
         ClientTokenModel oldCt = dao.getClientToken(dao.getClientTokenValue(clientId));
-        dao.savePastTokenIndex(oldCt);
+        dao.saveLowerClientTokenIndex(oldCt);
 
-        // 2.5、如果配置了 PastClientToken 的 ttl ，则需要更新一下
+        // 2.5、如果配置了 Lower-Client-Token 的 ttl ，则需要更新一下
         SaClientModel cm = SaOAuth2Manager.getDataLoader().getClientModelNotNull(clientId);
-        if(oldCt != null && cm.getPastClientTokenTimeout() != -1) {
-            oldCt.expiresTime = System.currentTimeMillis() + (cm.getPastClientTokenTimeout() * 1000);
+        if(oldCt != null && cm.getLowerClientTokenTimeout() != -1) {
+            oldCt.expiresTime = System.currentTimeMillis() + (cm.getLowerClientTokenTimeout() * 1000);
             dao.saveClientToken(oldCt);
         }
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
index 46e64344..393da7c8 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/model/loader/SaClientModel.java
@@ -70,8 +70,8 @@ public class SaClientModel implements Serializable {
 	/** 单独配置此Client：Client-Token 保存的时间(单位秒) [默认取全局配置] */
 	public long clientTokenTimeout;
 
-	/** 单独配置此Client：Past-Client-Token 保存的时间(单位：秒) [默认取全局配置] */
-	public long pastClientTokenTimeout;
+	/** 单独配置此Client：Lower-Client-Token 保存的时间(单位：秒) [默认取全局配置] */
+	public long lowerClientTokenTimeout;
 
 	
 	public SaClientModel() {
@@ -80,7 +80,7 @@ public class SaClientModel implements Serializable {
 		this.accessTokenTimeout = config.getAccessTokenTimeout();
 		this.refreshTokenTimeout = config.getRefreshTokenTimeout();
 		this.clientTokenTimeout = config.getClientTokenTimeout();
-		this.pastClientTokenTimeout = config.getPastClientTokenTimeout();
+		this.lowerClientTokenTimeout = config.getLowerClientTokenTimeout();
 	}
 	public SaClientModel(String clientId, String clientSecret, List<String> contractScopes, List<String> allowRedirectUris) {
 		super();
@@ -236,18 +236,18 @@ public class SaClientModel implements Serializable {
 	}
 	
 	/**
-	 * @return 此Client：Past-Client-Token 保存的时间(单位：秒) [默认取全局配置]
+	 * @return 此Client：Lower-Client-Token 保存的时间(单位：秒) [默认取全局配置]
 	 */
-	public long getPastClientTokenTimeout() {
-		return pastClientTokenTimeout;
+	public long getLowerClientTokenTimeout() {
+		return lowerClientTokenTimeout;
 	}
 	
 	/**
-	 * @param pastClientTokenTimeout 单独配置此Client：Past-Client-Token 保存的时间(单位：秒) [默认取全局配置]
+	 * @param lowerClientTokenTimeout 单独配置此Client：Lower-Client-Token 保存的时间(单位：秒) [默认取全局配置]
 	 * @return 对象自身 
 	 */
-	public SaClientModel setPastClientTokenTimeout(long pastClientTokenTimeout) {
-		this.pastClientTokenTimeout = pastClientTokenTimeout;
+	public SaClientModel setLowerClientTokenTimeout(long lowerClientTokenTimeout) {
+		this.lowerClientTokenTimeout = lowerClientTokenTimeout;
 		return this;
 	}
 	
@@ -265,7 +265,7 @@ public class SaClientModel implements Serializable {
 				", accessTokenTimeout=" + accessTokenTimeout +
 				", refreshTokenTimeout=" + refreshTokenTimeout +
 				", clientTokenTimeout=" + clientTokenTimeout +
-				", pastClientTokenTimeout=" + pastClientTokenTimeout +
+				", lowerClientTokenTimeout=" + lowerClientTokenTimeout +
 				'}';
 	}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 7479f24d..2e6a506c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -628,17 +628,17 @@ public class SaOAuth2Template {
 	}
 
 	/**
-	 * 回收 PastToken，根据索引： clientId
+	 * 回收 Lower-Client-Token，根据索引： clientId
 	 *
 	 * @param clientId /
 	 */
-	public void revokePastTokenByIndex(String clientId) {
+	public void revokeLowerClientTokenByIndex(String clientId) {
 		SaOAuth2Dao dao = SaOAuth2Manager.getDao();
-		// 删 pastToken
-		String pastToken = dao.getPastTokenValue(clientId);
-		if(pastToken != null) {
-			dao.deletePastToken(pastToken);
-			dao.deletePastTokenIndex(clientId);
+		// 删 Lower-Client-Token
+		String lowerClientToken = dao.getLowerClientTokenValue(clientId);
+		if(lowerClientToken != null) {
+			dao.deleteLowerClientToken(lowerClientToken);
+			dao.deleteLowerClientTokenIndex(clientId);
 		}
 	}
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
index 4d667933..a59077e4 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Util.java
@@ -318,12 +318,12 @@ public class SaOAuth2Util {
 	}
 
 	/**
-	 * 回收 PastToken，根据索引： clientId
+	 * 回收 Lower-Client-Token，根据索引： clientId
 	 *
 	 * @param clientId /
 	 */
-	public static void revokePastTokenByIndex(String clientId) {
-		SaOAuth2Manager.getTemplate().revokePastTokenByIndex(clientId);
+	public static void revokeLowerClientTokenByIndex(String clientId) {
+		SaOAuth2Manager.getTemplate().revokeLowerClientTokenByIndex(clientId);
 	}
 
 }
diff --git a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
index 680230f9..f5a89f87 100644
--- a/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
+++ b/sa-token-plugin/sa-token-redisx/src/main/java/cn/dev33/satoken/dao/SaSessionForJson.java
@@ -19,7 +19,6 @@ import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.util.SaFoxUtil;
 import org.noear.snack.ONode;
 
-//todo: 不能删；为保持与旧的序列化兼容
 /**
  * Snack3 定制版 SaSession，重写类型转换API
  * 
-- 
Gitee


From ffd557c5d7c30a2e0f67a3fd664de046e0aaae65 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Sun, 25 Aug 2024 21:25:10 +0800
Subject: [PATCH 159/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=97=A5=E5=BF=97?=
 =?UTF-8?q?=E6=89=93=E5=8D=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/sso/sso-questions.md             | 24 +++++++++----------
 .../dev33/satoken/oauth2/dao/SaOAuth2Dao.java |  4 +---
 .../oauth2/strategy/SaOAuth2Strategy.java     |  8 ++-----
 .../satoken/solon/dao/SaSessionForJson.java   |  2 +-
 4 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/sa-token-doc/sso/sso-questions.md b/sa-token-doc/sso/sso-questions.md
index 618f0bda..93649329 100644
--- a/sa-token-doc/sso/sso-questions.md
+++ b/sa-token-doc/sso/sso-questions.md
@@ -25,7 +25,7 @@ SSO 集成常见问题整理
 - sso-server 端的单点注销地址：`http://{host}:{port}/sso/signout`；
 - sso-client 端的注销地址：`http://{host}:{port}/sso/logout`；
 
-都需要在配置文件配置：`sa-token.sso.is-slo=true`后，才会打开。
+都需要在配置文件配置：`sa-token.sso-server.is-slo=true`(client端为 `sa-token.sso-client.is-slo=true` )后，才会打开。
 
 
 ### 问：我参照文档搭建SSO-Client，一直提示：Ticket无效，请问怎么回事？
@@ -85,7 +85,7 @@ public class SaSsoServerApplication {
 
 
 ### 问：模式三配置一堆 xxx-url ，有办法简化一下吗？
-可以使用 `sa-token.sso.server-url` 来简化：
+可以使用 `sa-token.sso-client.server-url` 来简化：
 
 配置含义：配置 Server 端主机总地址，拼接在 authUrl、checkTicketUrl、getDataUrl、sloUrl 属性前面，用以简化各种 url 配置。
 
@@ -93,7 +93,7 @@ public class SaSsoServerApplication {
 
 ``` yaml
 sa-token: 
-    sso: 
+    sso-client: 
         # SSO-Server端 统一认证地址 
         auth-url: http://sa-sso-server.com:9000/sso/auth
         # SSO-Server端 ticket校验地址 
@@ -107,7 +107,7 @@ sa-token:
 一堆 xxx-url 配置比较繁琐，且含有大量重复字符，现在我们可以将其简化为：
 ``` yaml
 sa-token: 
-    sso: 
+    sso-client: 
         server-url: http://sa-sso-server.com:9000
 ```
 
@@ -135,22 +135,22 @@ sa-token:
 **方法二，根据配置项来分析，例如：**
 
 - 先看配置项 `sa-token.cookie.domain`，如果此配置项有值，一般是在使用模式一开发，否则就是模式二或者模式三。
-- 再看配置项 `sa-token.sso.is-http` ，如果有值且为 true，一般是在使用模式三，否则就是模式二。
+- 再看配置项 `sa-token.sso-client.is-http` ，如果有值且为 true，一般是在使用模式三，否则就是模式二。
 
-**方法三，根据配置项 `sa-token.sso.mode` 的提示来判断**
+**方法三，根据配置项 `sa-token.sso-client.mode` 的提示来判断**
 
-`sa-token.sso.mode` 是框架预留的约定型配置项，此配置项不对代码逻辑产生任何影响，只为系统做一个标记，标注此系统用到了SSO的哪个模式。
+`sa-token.sso-client.mode` 是框架预留的约定型配置项，此配置项不对代码逻辑产生任何影响，只为系统做一个标记，标注此系统用到了SSO的哪个模式。
 
-例如你可以将其配置为 `sa-token.sso.mode=client-2`，代表当前系统为 sso-client 端，使用 SSO 模式二来对接。
+例如你可以将其配置为 `sa-token.sso-client.mode=client-2`，代表当前系统为 sso-client 端，使用 SSO 模式二来对接。
 
 需要注意，这个配置项不是必须的，你不写也不会对代码造成任何影响，只有在你需要为系统做一个明确的标记时才需要去配置它，方便后人阅读代码时快速分析使用的模式。
 
 例如我们可以使用以下约定：
 
-- `sa-token.sso.mode=client-2`：代表当前系统为 sso-client 端，使用 SSO 模式二来对接。
-- `sa-token.sso.mode=client-2,h5`：代表当前系统为 sso-client 端，使用 SSO 模式二来对接，并且是前后端分离模式。
-- `sa-token.sso.mode=server-123`：代表当前系统为 sso-server 端，同时开放了 SSO 模式一、模式二、模式三。
-- `sa-token.sso.mode=server-2,client-2`：代表当前系统既是 sso-server 端，又是 sso-clent 端，使用模式二来对接。
+- `sa-token.sso-client.mode=client-2`：代表当前系统为 sso-client 端，使用 SSO 模式二来对接。
+- `sa-token.sso-client.mode=client-2,h5`：代表当前系统为 sso-client 端，使用 SSO 模式二来对接，并且是前后端分离模式。
+- `sa-token.sso-server.mode=server-123`：代表当前系统为 sso-server 端，同时开放了 SSO 模式一、模式二、模式三。
+- `sa-token.sso-server.mode=server-2,client-2`：代表当前系统既是 sso-server 端，又是 sso-clent 端，使用模式二来对接。
 - 等等等等...
 
 此配置项可以是任意字符串，你也可以自己整理一套合适的表达规则。
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
index 803c8b03..0c4b3eef 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/dao/SaOAuth2Dao.java
@@ -153,9 +153,7 @@ public interface SaOAuth2Dao {
 	 */
 	default void saveGrantScope(String clientId, Object loginId, List<String> scopes) {
 		if( ! SaFoxUtil.isEmpty(scopes)) {
-			// TODO ttl 计算规则优化
-			long ttl = SaOAuth2Manager.getServerConfig().getAccessTokenTimeout();
-			// long ttl = checkClientModel(clientId).getAccessTokenTimeout();
+			long ttl = checkClientModel(clientId).getAccessTokenTimeout();
 			String value = SaOAuth2Manager.getDataConverter().convertScopeListToString(scopes);
 			getSaTokenDao().set(splicingGrantScopeKey(clientId, loginId), value, ttl);
 		}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index 939b9ff9..e9ca6372 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -78,9 +78,7 @@ public final class SaOAuth2Strategy {
 	 */
 	public void registerScopeHandler(SaOAuth2ScopeHandlerInterface handler) {
 		scopeHandlerMap.put(handler.getHandlerScope(), handler);
-		// TODO 优化日志输出
-		SaManager.getLog().info("新增权限处理器：" + handler.getHandlerScope());
-		//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+		SaManager.getLog().info("自定义 SCOPE [{}] (处理器: {})", handler.getHandlerScope(), handler.getClass().getCanonicalName());
 	}
 
 	/**
@@ -147,9 +145,7 @@ public final class SaOAuth2Strategy {
 	 */
 	public void registerGrantTypeHandler(SaOAuth2GrantTypeHandlerInterface handler) {
 		grantTypeHandlerMap.put(handler.getHandlerGrantType(), handler);
-		// TODO 优化日志输出
-		SaManager.getLog().info("新增GrantType处理器：" + handler.getHandlerGrantType());
-		//		SaTokenEventCenter.doRegisterAnnotationHandler(handler);
+		SaManager.getLog().info("自定义 GRANT_TYPE [{}] (处理器: {})", handler.getHandlerGrantType(), handler.getClass().getCanonicalName());
 	}
 
 	/**
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
index ced5e993..98150c58 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/dao/SaSessionForJson.java
@@ -19,7 +19,7 @@ import cn.dev33.satoken.session.SaSession;
 import cn.dev33.satoken.util.SaFoxUtil;
 import org.noear.snack.ONode;
 
-//todo: 不能删；为保持与旧的序列化兼容
+// 不能删；为保持与旧的序列化兼容
 /**
  * Snack3 定制版 SaSession，重写类型转换API
  * 
-- 
Gitee


From b552dd334cb24150761e23cd0a604fc63b033f20 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 26 Aug 2024 02:34:34 +0800
Subject: [PATCH 160/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=20sa-token-oauth2=20?=
 =?UTF-8?q?=E5=BC=82=E5=B8=B8=E7=BB=86=E5=88=86=E7=8A=B6=E6=80=81=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md                      | 10 +--
 sa-token-doc/fun/data-structure.md            |  4 +-
 sa-token-doc/fun/exception-code.md            | 55 +++++++-------
 sa-token-doc/oauth2/oauth2-check-domain.md    |  2 +-
 sa-token-doc/oauth2/oauth2-custom-scope.md    |  2 +-
 .../data/convert/SaOAuth2DataConverter.java   |  7 +-
 .../SaOAuth2DataConverterDefaultImpl.java     |  8 +-
 .../SaOAuth2DataGenerateDefaultImpl.java      |  8 +-
 .../data/resolver/SaOAuth2DataResolver.java   |  4 +-
 .../SaOAuth2DataResolverDefaultImpl.java      | 36 +++++----
 .../oauth2/error/SaOAuth2ErrorCode.java       | 55 ++++++--------
 .../SaOAuth2AuthorizationCodeException.java   | 74 +++++++++++++++++++
 .../handler/RefreshTokenGrantTypeHandler.java |  7 +-
 .../processor/SaOAuth2ServerProcessor.java    | 12 +--
 .../oauth2/strategy/SaOAuth2Strategy.java     |  9 ++-
 .../oauth2/template/SaOAuth2Template.java     | 31 ++++----
 16 files changed, 195 insertions(+), 129 deletions(-)
 create mode 100644 sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AuthorizationCodeException.java

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index f23aa033..b926c996 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -56,19 +56,19 @@
 	- [OAuth2-Server搭建](/oauth2/oauth2-server)
 	- [OAuth2-Server端开放 API 接口](/oauth2/oauth2-apidoc)
 	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
-	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
-	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
-	- [自定义 Scope 权限以处理器](/oauth2/oauth2-custom-scope)
+	- [自定义 Scope 权限及处理器](/oauth2/oauth2-custom-scope)
 	- [为 Scope 划分等级](/oauth2/oauth2-scope-level)
 	- [自定义 grant_type](/oauth2/oauth2-custom-grant_type)
+	- [定制化登录页面与授权页面](/oauth2/oauth2-custom-login)
+	- [自定义 API 路由 ](/oauth2/oauth2-custom-api)
 	- [开启 OIDC 协议](/oauth2/oauth2-oidc)
-	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [使用注解校验 Access-Token](/oauth2/oauth2-at-check)
+	- [OAuth2-与登录会话实现数据互通](/oauth2/oauth2-interworking)
 	- [OAuth2 代码 API 参考](/oauth2/oauth2-dev)
 	- [常见问题总结](/oauth2/oauth2-questions)
 	<!-- - [前后端分离模式整合方案](/oauth2/4) -->
 	<!-- - [平台中心模式开发](/oauth2/5) -->
-	- <!-- jwt风格token、使用注解校验权限、state参数详解 -->
+	<!-- - [jwt 风格 token](/oauth2/6) -->
 
 - **微服务**
 	- [分布式Session会话](/micro/dcs-session)
diff --git a/sa-token-doc/fun/data-structure.md b/sa-token-doc/fun/data-structure.md
index a74bafcf..f5595551 100644
--- a/sa-token-doc/fun/data-structure.md
+++ b/sa-token-doc/fun/data-structure.md
@@ -311,9 +311,9 @@ clientId 反查 Client-Token
 {tokenName}:oauth2:client-token-index:{clientId}
 ```
 
-Past-Token 次级应用令牌索引
+Lower-Client-Token 次级应用令牌索引
 ``` js
-{tokenName}:oauth2:past-token-index:{clientId}
+{tokenName}:oauth2:lower-client-token-index:{clientId}
 ```
 
 ### 3.5、用户授权记录
diff --git a/sa-token-doc/fun/exception-code.md b/sa-token-doc/fun/exception-code.md
index b86aeb9d..b2df661e 100644
--- a/sa-token-doc/fun/exception-code.md
+++ b/sa-token-doc/fun/exception-code.md
@@ -160,37 +160,32 @@ SaToken 中的所有异常都是继承于 `SaTokenException` 的，也就是说
 
 
 #### sa-token-oauth2 相关：
-| code码值	| 含义												|
-| :--------	| :--------											|
-| 30101		| client_id 不可为空					|
-| 30102		| scope 不可为空					|
+| code码值	| 含义									|
+| :--------	| :--------								|
+| 30101		| client_id 不可为空						|
+| 30102		| scope 不可为空							|
 | 30103		| redirect_uri 不可为空					|
-| 30104		| LoginId 不可为空					|
-| 30105		| 无效client_id					|
-| 30106		| 无效access_token					|
-| 30107		| 无效 client_token					|
-| 30108		| Access-Token 不具备指定的 Scope					|
-| 30109		| Client-Token 不具备指定的 Scope					|
-| 30110		| 无效 code 码					|
-| 30111		| 无效 Refresh-Token					|
-| 30112		| 请求的Scope暂未签约					|
-| 30113		| 无效redirect_url					|
-| 30114		| 非法redirect_url					|
-| 30115		| 无效client_secret					|
-| 30116		| 请求的Scope暂未签约					|
-| 30117		| 无效code					|
-| 30118		| 无效client_id					|
-| 30119		| 无效client_secret					|
-| 30120		| 无效redirect_uri					|
-| 30121		| 无效refresh_token					|
-| 30122		| 无效client_id					|
-| 30123		| 无效client_secret					|
-| 30124		| 无效client_id					|
-| 30125		| 无效response_type					|
-| 30131		| 暂未开放授权码模式					|
-| 30132		| 暂未开放隐藏式模式					|
-| 30133		| 暂未开放密码式模式					|
-| 30134		| 暂未开放凭证式模式					|
+| 30104		| LoginId 不可为空						|
+| 30105		| 无效 client_id							|
+| 30106		| 无效 access_token						|
+| 30107		| 无效 client_token						|
+| 30108		| Access-Token 不具备指定的 Scope		|
+| 30109		| Client-Token 不具备指定的 Scope		|
+| 30110		| 无效 code 码							|
+| 30111		| 无效 Refresh-Token						|
+| 30112		| 请求的 Scope 暂未签约					|
+| 30113		| 无效 redirect_url						|
+| 30114		| 非法 redirect_url						|
+| 30115		| 无效 client_secret						|
+| 30120		| redirect_uri 不一致					|
+| 30122		| client_id	不一致						|
+| 30125		| 无效 response_type						|
+| 30126		| 无效 grant_type						|
+| 30127		| 无效 state								|
+| 30141		| 系统暂未开放的授权模式					|
+| 30142		| 应用暂未开放的授权模式					|
+| 30151		| 无效的请求 Method						|
+| 30191		| 其它异常								|
 
 
 #### sa-token-jwt 插件相关：
diff --git a/sa-token-doc/oauth2/oauth2-check-domain.md b/sa-token-doc/oauth2/oauth2-check-domain.md
index 841d3ff0..de3250ca 100644
--- a/sa-token-doc/oauth2/oauth2-check-domain.md
+++ b/sa-token-doc/oauth2/oauth2-check-domain.md
@@ -86,7 +86,7 @@ URL 没有通过校验，拒绝授权！
 - 反例：`http://sa-oauth-client.com@sa-token.cc`
 
 *详见源码：[SaOAuth2Template.java](https://gitee.com/dromara/sa-token/blob/master/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java) 
-`checkRightUrl` 方法。*
+`checkRedirectUri` 方法。*
 
 2、AllowUrls 配置的地址 `*` 通配符只允许出现在字符串末尾，不允许出现在字符串中间位置。
 
diff --git a/sa-token-doc/oauth2/oauth2-custom-scope.md b/sa-token-doc/oauth2/oauth2-custom-scope.md
index a857913d..e3e6e881 100644
--- a/sa-token-doc/oauth2/oauth2-custom-scope.md
+++ b/sa-token-doc/oauth2/oauth2-custom-scope.md
@@ -1,4 +1,4 @@
-# OAuth2-自定义权限处理器 
+# OAuth2-自定义 Scope 权限及处理器
 
 --- 
 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
index fddeb33a..e66097d1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverter.java
@@ -44,12 +44,11 @@ public interface SaOAuth2DataConverter {
     String convertScopeListToString(List<String> scopeList);
 
     /**
-     * 转换 AllowUrl 数据格式：String -> List
-     * @param allowUrl /
+     * 转换 redirect_uri 数据格式：String -> List
+     * @param redirectUris /
      * @return /
      */
-    List<String> convertAllowUrlStringToList(String allowUrl);
-
+    List<String> convertRedirectUriStringToList(String redirectUris);
 
     /**
      * 将 Code 转换为 Access-Token
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
index 03073085..b1738570 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/convert/SaOAuth2DataConverterDefaultImpl.java
@@ -59,14 +59,14 @@ public class SaOAuth2DataConverterDefaultImpl implements SaOAuth2DataConverter {
     }
 
     /**
-     * 转换 AllowUrl 数据格式：String -> List
+     * 转换 redirect_uri 数据格式：String -> List
      */
     @Override
-    public List<String> convertAllowUrlStringToList(String allowUrl) {
-        if(SaFoxUtil.isEmpty(allowUrl)) {
+    public List<String> convertRedirectUriStringToList(String redirectUris) {
+        if(SaFoxUtil.isEmpty(redirectUris)) {
             return new ArrayList<>();
         }
-        return SaFoxUtil.convertStringToList(allowUrl);
+        return SaFoxUtil.convertStringToList(redirectUris);
     }
 
     /**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
index 36c1e9fe..b9f5186e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/generate/SaOAuth2DataGenerateDefaultImpl.java
@@ -26,7 +26,9 @@ import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2AuthorizationCodeException;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2RefreshTokenException;
 import cn.dev33.satoken.oauth2.strategy.SaOAuth2Strategy;
 import cn.dev33.satoken.util.SaFoxUtil;
 
@@ -79,7 +81,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
 
         // 1、先校验
         CodeModel cm = dao.getCode(code);
-        SaOAuth2Exception.throwBy(cm == null, "无效code", SaOAuth2ErrorCode.CODE_30110);
+        SaOAuth2AuthorizationCodeException.throwBy(cm == null, "无效 code: " + code, code, SaOAuth2ErrorCode.CODE_30110);
 
         // 2、删除旧Token
         dao.deleteAccessToken(dao.getAccessTokenValue(cm.clientId, cm.loginId));
@@ -118,7 +120,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
 
         // 获取 Refresh-Token 信息
         RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
-        SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30111);
+        SaOAuth2RefreshTokenException.throwBy(rt == null, "无效 refresh_token: " + refreshToken, refreshToken, SaOAuth2ErrorCode.CODE_30111);
 
         // 如果配置了[每次刷新产生新的Refresh-Token]
         SaClientModel clientModel = SaOAuth2Manager.getDataLoader().getClientModelNotNull(rt.clientId);
@@ -276,7 +278,7 @@ public class SaOAuth2DataGenerateDefaultImpl implements SaOAuth2DataGenerate {
     public void checkState(String state) {
         String value = SaOAuth2Manager.getDao().getState(state);
         if(SaFoxUtil.isNotEmpty(value)) {
-            throw new SaOAuth2Exception("多次请求的 state 不可重复: " + state);
+            throw new SaOAuth2Exception("多次请求的 state 不可重复: " + state).setCode(SaOAuth2ErrorCode.CODE_30127);
         }
         SaOAuth2Manager.getDao().saveState(state);
     }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
index 49d3e949..37aacbd1 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolver.java
@@ -72,7 +72,7 @@ public interface SaOAuth2DataResolver {
      * @param at token信息
      * @return /
      */
-    Map<String, Object> buildTokenReturnValue(AccessTokenModel at);
+    Map<String, Object> buildAccessTokenReturnValue(AccessTokenModel at);
 
     /**
      * 构建返回值: RefreshToken 刷新 Access-Token
@@ -80,7 +80,7 @@ public interface SaOAuth2DataResolver {
      * @return /
      */
     default Map<String, Object> buildRefreshTokenReturnValue(AccessTokenModel at) {
-        return buildTokenReturnValue(at);
+        return buildAccessTokenReturnValue(at);
     }
 
     /**
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
index 4cac496b..64ade8a6 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/resolver/SaOAuth2DataResolverDefaultImpl.java
@@ -18,12 +18,13 @@ package cn.dev33.satoken.oauth2.data.resolver;
 import cn.dev33.satoken.context.model.SaRequest;
 import cn.dev33.satoken.httpauth.basic.SaHttpBasicUtil;
 import cn.dev33.satoken.oauth2.SaOAuth2Manager;
-import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.Param;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts.TokenType;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.ClientTokenModel;
 import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
 import cn.dev33.satoken.oauth2.data.model.request.RequestAuthModel;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.util.SaFoxUtil;
 import cn.dev33.satoken.util.SaResult;
@@ -50,8 +51,8 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     @Override
     public ClientIdAndSecretModel readClientIdAndSecret(SaRequest request) {
         // 优先从请求参数中获取
-        String clientId = request.getParam(SaOAuth2Consts.Param.client_id);
-        String clientSecret = request.getParam(SaOAuth2Consts.Param.client_secret);
+        String clientId = request.getParam(Param.client_id);
+        String clientSecret = request.getParam(Param.client_secret);
         if(SaFoxUtil.isNotEmpty(clientId)) {
             return new ClientIdAndSecretModel(clientId, clientSecret);
         }
@@ -68,22 +69,22 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         }
 
         // 如果都没有提供，则抛出异常
-        throw new SaOAuth2Exception("请提供 client 信息");
+        throw new SaOAuth2Exception("请提供 client 信息").setCode(SaOAuth2ErrorCode.CODE_30191);
     }
 
     /**
-     * 数据读取：从请求对象中读取 AccessToken
+     * 数据读取：从请求对象中读取 AccessToken，获取不到返回 null
      */
     @Override
     public String readAccessToken(SaRequest request) {
         // 优先从请求参数中获取
-        String accessToken = request.getParam(SaOAuth2Consts.Param.access_token);
+        String accessToken = request.getParam(Param.access_token);
         if(SaFoxUtil.isNotEmpty(accessToken)) {
             return accessToken;
         }
 
         // 如果请求参数中没有提供 access_token 参数，则尝试从 Authorization 中获取
-        String authorizationValue = request.getHeader(SaOAuth2Consts.Param.Authorization);
+        String authorizationValue = request.getHeader(Param.Authorization);
         if(SaFoxUtil.isEmpty(authorizationValue)) {
             return null;
         }
@@ -99,18 +100,18 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     }
 
     /**
-     * 数据读取：从请求对象中读取 ClientToken
+     * 数据读取：从请求对象中读取 ClientToken，获取不到返回 null
      */
     @Override
     public String readClientToken(SaRequest request) {
         // 优先从请求参数中获取
-        String clientToken = request.getParam(SaOAuth2Consts.Param.client_token);
+        String clientToken = request.getParam(Param.client_token);
         if(SaFoxUtil.isNotEmpty(clientToken)) {
             return clientToken;
         }
 
         // 如果请求参数中没有提供 client_token 参数，则尝试从 Authorization 中获取
-        String authorizationValue = request.getHeader(SaOAuth2Consts.Param.Authorization);
+        String authorizationValue = request.getHeader(Param.Authorization);
         if(SaFoxUtil.isEmpty(authorizationValue)) {
             return null;
         }
@@ -131,13 +132,11 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
     @Override
     public RequestAuthModel readRequestAuthModel(SaRequest req, Object loginId) {
         RequestAuthModel ra = new RequestAuthModel();
-        ra.clientId = req.getParamNotNull(SaOAuth2Consts.Param.client_id);
-        ra.responseType = req.getParamNotNull(SaOAuth2Consts.Param.response_type);
-        ra.redirectUri = req.getParamNotNull(SaOAuth2Consts.Param.redirect_uri);
-        ra.state = req.getParam(SaOAuth2Consts.Param.state);
-        // 数据解析
-        String scope = req.getParam(SaOAuth2Consts.Param.scope, "");
-        ra.scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(scope);
+        ra.clientId = req.getParamNotNull(Param.client_id);
+        ra.responseType = req.getParamNotNull(Param.response_type);
+        ra.redirectUri = req.getParamNotNull(Param.redirect_uri);
+        ra.state = req.getParam(Param.state);
+        ra.scopes = SaOAuth2Manager.getDataConverter().convertScopeStringToList(req.getParam(Param.scope));
         ra.loginId = loginId;
         return ra;
     }
@@ -147,7 +146,7 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
      * 构建返回值: 获取 token
      */
     @Override
-    public Map<String, Object> buildTokenReturnValue(AccessTokenModel at) {
+    public Map<String, Object> buildAccessTokenReturnValue(AccessTokenModel at) {
         Map<String, Object> map = new LinkedHashMap<>();
         map.put("token_type", at.tokenType);
         map.put("access_token", at.accessToken);
@@ -172,7 +171,6 @@ public class SaOAuth2DataResolverDefaultImpl implements SaOAuth2DataResolver {
         Map<String, Object> map = new LinkedHashMap<>();
         map.put("token_type", ct.tokenType);
         map.put("client_token", ct.clientToken);
-        // 兼容 OAuth2 协议
         if(SaOAuth2Manager.getServerConfig().mode4ReturnAccessToken) {
              map.put("access_token", ct.clientToken);
         }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
index b6f3cbd7..37026d7e 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/error/SaOAuth2ErrorCode.java
@@ -35,10 +35,10 @@ public interface SaOAuth2ErrorCode {
 	/** LoginId 不可为空 */
 	int CODE_30104 = 30104;
 
-	/** 无效client_id */
+	/** 无效 client_id */
 	int CODE_30105 = 30105;
 
-	/** 无效access_token */
+	/** 无效 access_token */
 	int CODE_30106 = 30106;
 
 	/** 无效 client_token */
@@ -50,57 +50,39 @@ public interface SaOAuth2ErrorCode {
 	/** Client-Token 不具备指定的 Scope */
 	int CODE_30109 = 30109;
 
-	/** 无效 code 码 */
+	/** 无效 Code 码 */
 	int CODE_30110 = 30110;
 
 	/** 无效 Refresh-Token */
 	int CODE_30111 = 30111;
 
-	/** 请求的Scope暂未签约 */
+	/** 请求的 Scope 暂未签约 */
 	int CODE_30112 = 30112;
 
-	/** 无效redirect_url */
+	/** 无效 redirect_url */
 	int CODE_30113 = 30113;
 
-	/** 非法redirect_url */
+	/** 非法 redirect_url */
 	int CODE_30114 = 30114;
 	
 	/** 无效client_secret */
 	int CODE_30115 = 30115;
 
-	/** 请求的Scope暂未签约 */
-	int CODE_30116 = 30116;
-
-	/** 无效code */
-	int CODE_30117 = 30117;
-
-	/** 无效client_id */
-	int CODE_30118 = 30118;
-
-	/** 无效client_secret */
-	int CODE_30119 = 30119;
-
-	/** 无效redirect_uri */
+	/** redirect_uri 不一致 */
 	int CODE_30120 = 30120;
 
-	/** 无效refresh_token */
-	int CODE_30121 = 30121;
-
-	/** 无效client_id */
+	/** client_id 不一致 */
 	int CODE_30122 = 30122;
 
-	/** 无效client_secret */
-	int CODE_30123 = 30123;
-
-	/** 无效client_id */
-	int CODE_30124 = 30124;
-
-	/** 无效response_type */
+	/** 无效 response_type */
 	int CODE_30125 = 30125;
 
-	/** 无效grant_type */
+	/** 无效 grant_type */
 	int CODE_30126 = 30126;
 
+	/** 无效 state */
+	int CODE_30127 = 30127;
+
 	/** 暂未开放授权码模式 */
 	int CODE_30131 = 30131;
 	
@@ -113,7 +95,16 @@ public interface SaOAuth2ErrorCode {
 	/** 暂未开放凭证式模式 */
 	int CODE_30134 = 30134;
 
-	/** 无效的请求 Method */
+	/** 系统暂未开放的授权模式 */
 	int CODE_30141 = 30141;
 
+	/** 应用暂未开放的授权模式 */
+	int CODE_30142 = 30142;
+
+	/** 无效的请求 Method */
+	int CODE_30151 = 30151;
+
+	/** 其它异常 */
+	int CODE_30191 = 30191;
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AuthorizationCodeException.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AuthorizationCodeException.java
new file mode 100644
index 00000000..5b8d45db
--- /dev/null
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/exception/SaOAuth2AuthorizationCodeException.java
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.oauth2.exception;
+
+/**
+ * 一个异常：代表 Code 授权码相关错误
+ * 
+ * @author click33
+ * @since 1.39.0
+ */
+public class SaOAuth2AuthorizationCodeException extends SaOAuth2Exception {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 6806129545290130114L;
+
+	/**
+	 * 一个异常：代表 Access-Token 相关错误
+	 * @param cause 根异常原因
+	 */
+	public SaOAuth2AuthorizationCodeException(Throwable cause) {
+		super(cause);
+	}
+
+	/**
+	 * 一个异常：代表 Access-Token 相关错误
+	 * @param message 异常描述
+	 */
+	public SaOAuth2AuthorizationCodeException(String message) {
+		super(message);
+	}
+
+	/**
+	 * 具体引起异常的 code 值
+	 */
+	public String authorizationCode;
+
+	public String getAuthorizationCode() {
+		return authorizationCode;
+	}
+
+	public SaOAuth2AuthorizationCodeException setAuthorizationCode(String authorizationCode) {
+		this.authorizationCode = authorizationCode;
+		return this;
+	}
+
+	/**
+	 * 如果 flag==true，则抛出 message 异常
+	 * @param flag 标记
+	 * @param message 异常信息 
+	 * @param authorizationCode 引入异常的 code 值
+	 * @param code 异常细分码
+	 */
+	public static void throwBy(boolean flag, String message, String authorizationCode, int code) {
+		if(flag) {
+			throw new SaOAuth2AuthorizationCodeException(message).setAuthorizationCode(authorizationCode).setCode(code);
+		}
+	}
+	
+}
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
index 238e35c1..df0143f5 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/granttype/handler/RefreshTokenGrantTypeHandler.java
@@ -22,7 +22,8 @@ import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.data.model.AccessTokenModel;
 import cn.dev33.satoken.oauth2.data.model.RefreshTokenModel;
 import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
-import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2ClientModelException;
+import cn.dev33.satoken.oauth2.exception.SaOAuth2RefreshTokenException;
 
 import java.util.List;
 
@@ -46,10 +47,10 @@ public class RefreshTokenGrantTypeHandler implements SaOAuth2GrantTypeHandlerInt
 
         // 校验：Refresh-Token 是否存在
         RefreshTokenModel rt = SaOAuth2Manager.getDao().getRefreshToken(refreshToken);
-        SaOAuth2Exception.throwBy(rt == null, "无效refresh_token: " + refreshToken, SaOAuth2ErrorCode.CODE_30121);
+        SaOAuth2RefreshTokenException.throwBy(rt == null, "无效refresh_token: " + refreshToken, refreshToken, SaOAuth2ErrorCode.CODE_30111);
 
         // 校验：Refresh-Token 代表的 ClientId 与提供的 ClientId 是否一致
-        SaOAuth2Exception.throwBy( ! rt.clientId.equals(clientId), "无效client_id: " + clientId, SaOAuth2ErrorCode.CODE_30122);
+        SaOAuth2ClientModelException.throwBy( ! rt.clientId.equals(clientId), "无效client_id: " + clientId, clientId, SaOAuth2ErrorCode.CODE_30122);
 
         // 获取新 Access-Token
         AccessTokenModel accessTokenModel = SaOAuth2Manager.getDataGenerate().refreshAccessToken(refreshToken);
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
index e6401002..840d9f4d 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java
@@ -157,7 +157,7 @@ public class SaOAuth2ServerProcessor {
 		}
 
 		// 默认返回
-		throw new SaOAuth2Exception("无效response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
+		throw new SaOAuth2Exception("无效 response_type: " + ra.responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
 	}
 
 	/**
@@ -166,7 +166,7 @@ public class SaOAuth2ServerProcessor {
 	 */
 	public Object token() {
 		AccessTokenModel accessTokenModel = SaOAuth2Strategy.instance.grantTypeAuth.apply(SaHolder.getRequest());
-		return SaOAuth2Manager.getDataResolver().buildTokenReturnValue(accessTokenModel);
+		return SaOAuth2Manager.getDataResolver().buildAccessTokenReturnValue(accessTokenModel);
 	}
 
 	/**
@@ -239,7 +239,7 @@ public class SaOAuth2ServerProcessor {
 
 		// 此请求只允许 POST 方式
 		if(!req.isMethod(SaHttpMethod.POST)) {
-			throw new SaOAuth2Exception("无效请求方式：" + req.getMethod()).setCode(SaOAuth2ErrorCode.CODE_30141);
+			throw new SaOAuth2Exception("无效请求方式：" + req.getMethod()).setCode(SaOAuth2ErrorCode.CODE_30151);
 		}
 
 		// 确认授权
@@ -366,7 +366,7 @@ public class SaOAuth2ServerProcessor {
 		}
 		// 其它
 		else {
-			throw new SaOAuth2Exception("无效 response_type: " + req.getParam(Param.response_type)).setCode(SaOAuth2ErrorCode.CODE_30125);
+			throw new SaOAuth2Exception("无效 response_type: " + responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
 		}
 	}
 
@@ -374,14 +374,14 @@ public class SaOAuth2ServerProcessor {
 	 * 系统未开放此授权模式时抛出异常
 	 */
 	public void throwErrorSystemNotEnableModel() {
-		throw new SaOAuth2Exception("系统暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+		throw new SaOAuth2Exception("系统暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30141);
 	}
 
 	/**
 	 * 应用未开放此授权模式时抛出异常
 	 */
 	public void throwErrorClientNotEnableModel() {
-		throw new SaOAuth2Exception("应用暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30131);
+		throw new SaOAuth2Exception("应用暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30142);
 	}
 
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
index e9ca6372..ec722221 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/strategy/SaOAuth2Strategy.java
@@ -22,6 +22,7 @@ import cn.dev33.satoken.oauth2.consts.GrantType;
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
 import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.data.model.request.ClientIdAndSecretModel;
+import cn.dev33.satoken.oauth2.error.SaOAuth2ErrorCode;
 import cn.dev33.satoken.oauth2.exception.SaOAuth2Exception;
 import cn.dev33.satoken.oauth2.function.strategy.*;
 import cn.dev33.satoken.oauth2.granttype.handler.AuthorizationCodeGrantTypeHandler;
@@ -162,16 +163,16 @@ public final class SaOAuth2Strategy {
 		String grantType = req.getParamNotNull(SaOAuth2Consts.Param.grant_type);
 		SaOAuth2GrantTypeHandlerInterface grantTypeHandler = grantTypeHandlerMap.get(grantType);
 		if(grantTypeHandler == null) {
-			throw new RuntimeException("无效 grant_type: " + grantType);
+			throw new SaOAuth2Exception("无效 grant_type: " + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
 		}
 
 		// 看看全局是否开启了此 grantType
 		SaOAuth2ServerConfig config = SaOAuth2Manager.getServerConfig();
 		if(grantType.equals(GrantType.authorization_code) && !config.getEnableAuthorizationCode() ) {
-			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
+			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
 		}
 		if(grantType.equals(GrantType.password) && !config.getEnablePassword() ) {
-			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType);
+			throw new SaOAuth2Exception("系统未开放的 grant_type: " + grantType).setCode(SaOAuth2ErrorCode.CODE_30126);
 		}
 
 		// 校验 clientSecret 和 scope
@@ -181,7 +182,7 @@ public final class SaOAuth2Strategy {
 
 		// 检测应用是否开启此 grantType
 		if(!clientModel.getAllowGrantTypes().contains(grantType)) {
-			throw new SaOAuth2Exception("应用未开放的 grant_type: " + grantType);
+			throw new SaOAuth2Exception("应用未开放的 grant_type: " + grantType).setCode(SaOAuth2ErrorCode.CODE_30141);
 		}
 
 		// 调用 处理器
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
index 2e6a506c..5ce1b8fb 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/template/SaOAuth2Template.java
@@ -72,8 +72,11 @@ public class SaOAuth2Template {
 	 */
 	public SaClientModel checkClientSecret(String clientId, String clientSecret) {
 		SaClientModel cm = checkClientModel(clientId);
-		SaOAuth2ClientModelException.throwBy(cm.clientSecret == null || ! cm.clientSecret.equals(clientSecret), "无效client_secret: " + clientSecret,
-				clientId, SaOAuth2ErrorCode.CODE_30115);
+		if(cm.clientSecret == null || ! cm.clientSecret.equals(clientSecret)) {
+			throw new SaOAuth2ClientModelException("无效 client_secret: " + clientSecret)
+					.setClientId(clientId)
+					.setCode(SaOAuth2ErrorCode.CODE_30115);
+		}
 		return cm;
 	}
 
@@ -146,7 +149,7 @@ public class SaOAuth2Template {
 	public void checkRedirectUri(String clientId, String url) {
 		// 1、是否是一个有效的url
 		if( ! SaFoxUtil.isUrl(url)) {
-			throw new SaOAuth2ClientModelException("无效redirect_url：" + url)
+			throw new SaOAuth2ClientModelException("无效 redirect_url：" + url)
 					.setClientId(clientId)
 					.setCode(SaOAuth2ErrorCode.CODE_30113);
 		}
@@ -180,7 +183,8 @@ public class SaOAuth2Template {
 			//
 			//  但是为了安全起见，这么做还是有必要的
 			throw new SaOAuth2ClientModelException("无效 redirect_url（不允许出现@字符）：" + url)
-					.setClientId(clientId);
+					.setClientId(clientId)
+					.setCode(SaOAuth2ErrorCode.CODE_30113);
 		}
 
 		// 4、是否在[允许地址列表]之中
@@ -231,7 +235,8 @@ public class SaOAuth2Template {
 				//       http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://shop.sa-oauth2-client.com/
 				//
 				//  但是为了安全起见，这么做还是有必要的
-				throw new SaOAuth2Exception("无效的 allow-url 配置（*通配符只允许出现在最后一位）：" + url);
+				throw new SaOAuth2Exception("无效的 allow-url 配置（*通配符只允许出现在最后一位）：" + url)
+						.setCode(SaOAuth2ErrorCode.CODE_30114);
 			}
 		}
 	}
@@ -299,18 +304,18 @@ public class SaOAuth2Template {
 
 		// 校验：Code是否存在
 		CodeModel cm = dao.getCode(code);
-		SaOAuth2Exception.throwBy(cm == null, "无效 code: " + code, SaOAuth2ErrorCode.CODE_30117);
+		SaOAuth2AuthorizationCodeException.throwBy(cm == null, "无效 code: " + code, code, SaOAuth2ErrorCode.CODE_30110);
 
 		// 校验：ClientId是否一致
-		SaOAuth2Exception.throwBy( ! cm.clientId.equals(clientId), "无效 client_id: " + clientId, SaOAuth2ErrorCode.CODE_30118);
+		SaOAuth2ClientModelException.throwBy( ! cm.clientId.equals(clientId), "无效 client_id: " + clientId, clientId, SaOAuth2ErrorCode.CODE_30105);
 
 		// 校验：Secret是否正确
 		String dbSecret = checkClientModel(clientId).clientSecret;
-		SaOAuth2Exception.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效 client_secret: " + clientSecret, SaOAuth2ErrorCode.CODE_30119);
+		SaOAuth2ClientModelException.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效 client_secret: " + clientSecret, clientId, SaOAuth2ErrorCode.CODE_30115);
 
 		// 如果提供了redirectUri，则校验其是否与请求Code时提供的一致
 		if( ! SaFoxUtil.isEmpty(redirectUri)) {
-			SaOAuth2Exception.throwBy( ! redirectUri.equals(cm.redirectUri), "无效 redirect_uri: " + redirectUri, SaOAuth2ErrorCode.CODE_30120);
+			SaOAuth2ClientModelException.throwBy( ! redirectUri.equals(cm.redirectUri), "无效 redirect_uri: " + redirectUri, clientId, SaOAuth2ErrorCode.CODE_30120);
 		}
 
 		// 返回CodeModel
@@ -330,15 +335,15 @@ public class SaOAuth2Template {
 
 		// 校验：Refresh-Token是否存在
 		RefreshTokenModel rt = dao.getRefreshToken(refreshToken);
-		SaOAuth2RefreshTokenException.throwBy(rt == null, "无效 refresh_token: " + refreshToken, refreshToken, SaOAuth2ErrorCode.CODE_30121);
+		SaOAuth2RefreshTokenException.throwBy(rt == null, "无效 refresh_token: " + refreshToken, refreshToken, SaOAuth2ErrorCode.CODE_30111);
 
 		// 校验：ClientId是否一致
 		SaOAuth2ClientModelException.throwBy( ! rt.clientId.equals(clientId), "无效 client_id: " + clientId, clientId, SaOAuth2ErrorCode.CODE_30122);
 
 		// 校验：Secret是否正确
 		String dbSecret = checkClientModel(clientId).clientSecret;
-		SaOAuth2ClientModelException.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效client_secret: " + clientSecret,
-				clientId, SaOAuth2ErrorCode.CODE_30123);
+		SaOAuth2ClientModelException.throwBy(dbSecret == null || ! dbSecret.equals(clientSecret), "无效 client_secret: " + clientSecret,
+				clientId, SaOAuth2ErrorCode.CODE_30115);
 
 		// 返回 Refresh-Token
 		return rt;
@@ -353,7 +358,7 @@ public class SaOAuth2Template {
 	 */
 	public AccessTokenModel checkAccessTokenParam(String clientId, String clientSecret, String accessToken) {
 		AccessTokenModel at = checkAccessToken(accessToken);
-		SaOAuth2ClientModelException.throwBy( ! at.clientId.equals(clientId), "无效 client_id：" + clientId, clientId, SaOAuth2ErrorCode.CODE_30124);
+		SaOAuth2ClientModelException.throwBy( ! at.clientId.equals(clientId), "无效 client_id：" + clientId, clientId, SaOAuth2ErrorCode.CODE_30122);
 		checkClientSecret(clientId, clientSecret);
 		return at;
 	}
-- 
Gitee


From b1180a219d651fc1406062060bc0b78dcfa86854 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 26 Aug 2024 18:50:38 +0800
Subject: [PATCH 161/172] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E5=9F=BA=E4=BA=8E?=
 =?UTF-8?q?=E5=86=85=E5=AD=98=E5=BD=A2=E5=BC=8F=E7=9A=84=20client=20?=
 =?UTF-8?q?=E4=BF=A1=E6=81=AF=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/_sidebar.md                      |   1 +
 sa-token-doc/oauth2/oauth2-data-loader.md     | 208 ++++++++++++++++++
 sa-token-doc/oauth2/oauth2-server.md          |  37 +++-
 .../oauth2/config/SaOAuth2ServerConfig.java   |  39 +++-
 .../data/loader/SaOAuth2DataLoader.java       |   3 +-
 5 files changed, 279 insertions(+), 9 deletions(-)
 create mode 100644 sa-token-doc/oauth2/oauth2-data-loader.md

diff --git a/sa-token-doc/_sidebar.md b/sa-token-doc/_sidebar.md
index b926c996..8cdb52ad 100644
--- a/sa-token-doc/_sidebar.md
+++ b/sa-token-doc/_sidebar.md
@@ -55,6 +55,7 @@
 	- [OAuth2.0简述](/oauth2/readme)
 	- [OAuth2-Server搭建](/oauth2/oauth2-server)
 	- [OAuth2-Server端开放 API 接口](/oauth2/oauth2-apidoc)
+	- [自定义数据加载器](/oauth2/oauth2-data-loader)
 	- [配置 client 域名校验 ](/oauth2/oauth2-check-domain)
 	- [自定义 Scope 权限及处理器](/oauth2/oauth2-custom-scope)
 	- [为 Scope 划分等级](/oauth2/oauth2-scope-level)
diff --git a/sa-token-doc/oauth2/oauth2-data-loader.md b/sa-token-doc/oauth2/oauth2-data-loader.md
new file mode 100644
index 00000000..92d6055e
--- /dev/null
+++ b/sa-token-doc/oauth2/oauth2-data-loader.md
@@ -0,0 +1,208 @@
+# OAuth2-自定义数据加载器
+
+
+
+### 1、基于内存的数据加载
+
+在之前搭建 OAuth2-Server 示例中，我们演示了 client 信息配置方案：
+``` java
+// Sa-Token OAuth2 定制化配置
+@Autowired
+public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
+	
+	// 添加 client 
+	oauth2Server.addClient(
+		new SaClientModel()
+			.setClientId("1001")    // client id
+			.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
+			.addAllowRedirectUris("*")    // 所有允许授权的 url
+			.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+			.addAllowGrantTypes(	 // 所有允许的授权模式
+					GrantType.authorization_code, // 授权码式
+					GrantType.implicit,  // 隐式式
+					GrantType.refresh_token,  // 刷新令牌
+					GrantType.password,  // 密码式
+					GrantType.client_credentials,  // 客户端模式
+			)
+	)
+	
+	// 可以添加更多 client 信息，只要保持 clientId 唯一就行了
+	// oauth2Server.addClient(...)
+
+}
+```
+
+你也可以在 `application.yml` 配置中 `client` 信息：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# sa-token配置
+sa-token: 
+    # OAuth2.0 配置 
+    oauth2-server:
+		# client 列表 
+        clients:
+            # 客户端1
+            1001:
+                # 客户端id
+                client-id: 1001
+                # 客户端秘钥
+                client-secret: aaaa-bbbb-cccc-dddd-eeee
+                # 所有允许授权的 url
+                allow-redirect-uris:
+                  - http://sa-oauth-client.com:8002
+                  - http://sa-oauth-client.com:8002/*
+                # 所有签约的权限
+                contract-scopes:
+                  - openid
+                  - userid
+                  - userinfo
+                # 所有允许的授权模式
+                allow-grant-types:
+                  - authorization_code
+                  - implicit
+                  - refresh_token
+                  - password
+                  - client_credentials
+            # 客户端2
+            1002:
+                # 客户端id
+                client-id: 1002
+				# 更多配置 ...
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+########### 客户端1
+# 客户端id
+sa-token.oauth2-server.clients.1001.client-id=1001
+# 客户端秘钥
+sa-token.oauth2-server.clients.1001.client-secret=aaaa-bbbb-cccc-dddd-eeee
+# 所有允许授权的 url
+sa-token.oauth2-server.clients.1001.allow-redirect-uris[0]=http://sa-oauth-client.com:8002
+sa-token.oauth2-server.clients.1001.allow-redirect-uris[1]=http://sa-oauth-client.com:8002/*
+# 所有签约的权限
+sa-token.oauth2-server.clients.1001.contract-scopes[0]=openid
+sa-token.oauth2-server.clients.1001.contract-scopes[1]=userid
+sa-token.oauth2-server.clients.1001.contract-scopes[2]=userinfo
+# 所有允许的授权模式
+sa-token.oauth2-server.clients.1001.allow-grant-types[0]=authorization_code
+sa-token.oauth2-server.clients.1001.allow-grant-types[1]=implicit
+sa-token.oauth2-server.clients.1001.allow-grant-types[2]=refresh_token
+sa-token.oauth2-server.clients.1001.allow-grant-types[3]=password
+sa-token.oauth2-server.clients.1001.allow-grant-types[4]=client_credentials
+
+########### 客户端2
+sa-token.oauth2-server.clients.1002.client-id=1002
+sa-token.oauth2-server.clients.1002.client-secret=...
+```
+<!---------------------------- tabs:end ---------------------------->
+
+
+这两种方案都是基于内存形式的 client 信息配置，只适合简单的测试，一般真实项目的 client 信息都是保存在数据库中的，下面演示一下如何在数据库中动态获取 client 信息
+
+
+### 2、基于数据库的数据加载
+
+你只需要自定义数据加载器：新建 `SaOAuth2DataLoaderImpl` 实现 `SaOAuth2DataLoader` 接口。
+
+
+``` java
+/**
+ * Sa-Token OAuth2：自定义数据加载器
+ */
+@Component
+public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
+	
+	// 根据 clientId 获取 Client 信息
+	@Override
+	public SaClientModel getClientModel(String clientId) {
+		// 此为模拟数据，真实环境需要从数据库查询 
+		if("1001".equals(clientId)) {
+			return new SaClientModel()
+					.setClientId("1001")    // client id
+					.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
+					.addAllowRedirectUris("*")    // 所有允许授权的 url
+					.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+					.addAllowGrantTypes(	 // 所有允许的授权模式
+							GrantType.authorization_code, // 授权码式
+							GrantType.implicit,  // 隐式式
+							GrantType.refresh_token,  // 刷新令牌
+							GrantType.password,  // 密码式
+							GrantType.client_credentials  // 客户端模式
+					)
+			;
+		}
+		return null;
+	}
+	
+	// 根据 clientId 和 loginId 获取 openid
+	@Override
+	public String getOpenid(String clientId, Object loginId) {
+		// 此处使用框架默认算法生成 openid，真实环境建议改为从数据库查询
+		return SaOAuth2DataLoader.super.getOpenid(clientId, loginId);
+	}
+
+}
+``` 
+
+此种形式更加灵活，后续文档将默认按照此种形式来展示示例。
+
+
+### 3、自定义 openid 生成算法
+
+openid 是用户在某一 client 下的唯一标识，其有如下特点：
+
+- 一个用户在同一个 client 下，openid 是固定的，每次请求都会返回相同的值。
+- 一个用户在不同的 client 下，openid 是不同的，会返回不同的值。
+
+oauth2-client 在每次授权时可根据返回的 openid 值来确定用户身份。
+
+框架默认的 openid 生成算法为：
+``` java
+md5(prefix + "_" + clientId + "_" + loginId);
+```
+
+其中的 prefix 前缀默认值为：`openid_default_digest_prefix`，你可以通过以下方式配置：
+
+<!---------------------------- tabs:start ---------------------------->
+<!------------- tab:yaml 风格  ------------->
+``` yaml
+# sa-token配置
+sa-token:
+	oauth2-server:
+		# 默认 openid 生成算法中使用的摘要前缀
+		openid-digest-prefix: xxxxxx
+```
+<!------------- tab:properties 风格  ------------->
+``` properties
+# 默认 openid 生成算法中使用的摘要前缀
+sa-token.oauth2-server.openid-digest-prefix=xxxxxx
+```
+<!---------------------------- tabs:end ---------------------------->
+
+正常来讲，openid 算法需要保证：
+
+1. 单个 clientId 下同一 loginId 生成的 `openid` 一致。[必须]
+2. 多个 clientId 下同一 loginId 生成的 `openid` 不一致。[非常建议]
+3. 客户端无法通过 clientId + loginId 推测 `openid` 值。[建议]
+4. 客户端无法通过 clientId + loginId + openid 推测该 loginId 在其它 clientId 下的 `openid` 值。[建议]
+5. oauth2-server 自身由 `openid` 可以反查出对应的 clientId 和 loginId。[根据业务需求而定是否满足]
+
+框架内置的算法，可以满足 1和2，如果自定义了 `sa-token.oauth2-server.openid-digest-prefix` 配置，可以满足3。
+
+如果自定义配置的 prefix 长度较短，或比较简单呈现规律性，则有客户端根据 clientId + loginId + openid 穷举爆破出 `prefix` 的风险，
+从而获得提前计算彩虹表来推测出其它 clientId、loginId 对应 openid 值的能力。
+
+如果自定义的 prefix 前缀比较复杂，让客户端无法爆破，则可以满足4。但依然无法满足5。
+
+所以 openid 算法的最优解，应该是 oauth2-server 采用随机字符串作为 openid，然后自建数据库表来维护其映射关系，这样可以同时满足12345。
+
+表结构参考如下：
+
+- id：数据id，主键。
+- client_id：应用id。
+- user_id：用户账号id。
+- openid：对应的 openid 值，随机字符串。
+- create_time：数据创建时间。
+- xxx：其它需要扩展的字段。
diff --git a/sa-token-doc/oauth2/oauth2-server.md b/sa-token-doc/oauth2/oauth2-server.md
index ab385de2..66d0e2a7 100644
--- a/sa-token-doc/oauth2/oauth2-server.md
+++ b/sa-token-doc/oauth2/oauth2-server.md
@@ -59,6 +59,7 @@ implementation 'org.apache.commons:commons-pool2'
 
 
 ### 3、开放服务 
+<!-- 
 1、自定义数据加载器：新建 `SaOAuth2DataLoaderImpl` 实现 `SaOAuth2DataLoader` 接口。
 
 ``` java
@@ -98,12 +99,12 @@ public class SaOAuth2DataLoaderImpl implements SaOAuth2DataLoader {
 	}
 
 }
-```
+``` 
 
 你可以在 [框架配置](/use/config?id=SaClientModel属性定义) 了解有关 `SaClientModel` 对象所有属性的详细定义
+-->
 
-
-2、新建`SaOAuth2ServerController`
+1、新建`SaOAuth2ServerController`
 ``` java
 /**
  * Sa-Token OAuth2 Server端 控制器 
@@ -122,6 +123,25 @@ public class SaOAuth2ServerController {
 	@Autowired
 	public void setSaOAuth2Config(SaOAuth2Config oauth2Server) {
 		
+		// 添加 client 信息 
+		oauth2Server.addClient(
+			new SaClientModel()
+				.setClientId("1001")    // client id
+				.setClientSecret("aaaa-bbbb-cccc-dddd-eeee")    // client 秘钥
+				.addAllowRedirectUris("*")    // 所有允许授权的 url
+				.addContractScopes("openid", "userid", "userinfo")    // 所有签约的权限
+				.addAllowGrantTypes(	 // 所有允许的授权模式
+						GrantType.authorization_code, // 授权码式
+						GrantType.implicit,  // 隐式式
+						GrantType.refresh_token,  // 刷新令牌
+						GrantType.password,  // 密码式
+						GrantType.client_credentials,  // 客户端模式
+				)
+		);
+		
+		// 可以添加更多 client 信息，只要保持 clientId 唯一就行了
+		// oauth2Server.addClient(...)
+		
 		// 配置：未登录时返回的View 
 		oauth2Server.notLoginView = () -> {
 			String msg = "当前会话在OAuth-Server端尚未登录，请先访问"
@@ -154,12 +174,15 @@ public class SaOAuth2ServerController {
 			return res;
 		};
 	}
-
+	
 }
 ```
-注意：在 `doLoginHandle` 函数里如果要获取 name, pwd 以外的参数，可通过 `SaHolder.getRequest().getParam("xxx")` 来获取。
+注意：
+- 在 `doLoginHandle` 函数里如果要获取 name, pwd 以外的参数，可通过 `SaHolder.getRequest().getParam("xxx")` 来获取。
+- 你可以在 [框架配置](/use/config?id=SaClientModel属性定义) 了解有关 `SaClientModel` 对象所有属性的详细定义。
+
 
-3、全局异常处理
+2、全局异常处理
 ``` java
 @RestControllerAdvice
 public class GlobalExceptionHandler {
@@ -171,7 +194,7 @@ public class GlobalExceptionHandler {
 }
 ```
 
-4、创建启动类：
+3、创建启动类：
 ``` java
 /**
  * 启动：Sa-OAuth2 Server端 
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
index abdbc03d..a01b3c8c 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/config/SaOAuth2ServerConfig.java
@@ -16,12 +16,15 @@
 package cn.dev33.satoken.oauth2.config;
 
 import cn.dev33.satoken.oauth2.consts.SaOAuth2Consts;
+import cn.dev33.satoken.oauth2.data.model.loader.SaClientModel;
 import cn.dev33.satoken.oauth2.function.SaOAuth2ConfirmViewFunction;
 import cn.dev33.satoken.oauth2.function.SaOAuth2DoLoginHandleFunction;
 import cn.dev33.satoken.oauth2.function.SaOAuth2NotLoginViewFunction;
 import cn.dev33.satoken.util.SaResult;
 
 import java.io.Serializable;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
 /**
  * Sa-Token OAuth2 Server 端 配置类 Model
@@ -78,12 +81,14 @@ public class SaOAuth2ServerConfig implements Serializable {
 	/** 是否在返回值中隐藏默认的状态字段 (code、msg、data) */
 	public Boolean hideStatusField = false;
 
-
 	/**
 	 * oidc 相关配置
 	 */
 	SaOAuth2OidcConfig oidc = new SaOAuth2OidcConfig();
 
+	/** client 列表 */
+	public Map<String, SaClientModel> clients = new LinkedHashMap<>();
+
 	/**
 	 * @return enableCode
 	 */
@@ -349,6 +354,23 @@ public class SaOAuth2ServerConfig implements Serializable {
 		return this;
 	}
 
+	/**
+	 * 获取 client 列表
+	 * @return /
+	 */
+	public Map<String, SaClientModel> getClients() {
+		return clients;
+	}
+
+	/**
+	 * 写入 client 列表
+	 * @return /
+	 */
+	public SaOAuth2ServerConfig setClients(Map<String, SaClientModel> clients) {
+		this.clients = clients;
+		return this;
+	}
+
 
 	// -------------------- SaOAuth2Handle 所有回调函数 --------------------
 	
@@ -388,4 +410,19 @@ public class SaOAuth2ServerConfig implements Serializable {
 				", oidc='" + oidc +
 				'}';
 	}
+
+
+	/**
+	 * 注册 client
+	 * @return /
+	 */
+	public SaOAuth2ServerConfig addClient(SaClientModel client) {
+		if(this.clients == null) {
+			this.clients = new LinkedHashMap<>();
+		}
+		this.clients.put(client.getClientId(), client);
+		return this;
+	}
+
+
 }
diff --git a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
index aa8815a7..635f07ad 100644
--- a/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
+++ b/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/data/loader/SaOAuth2DataLoader.java
@@ -36,7 +36,8 @@ public interface SaOAuth2DataLoader {
      * @return ClientModel
      */
     default SaClientModel getClientModel(String clientId) {
-        return null;
+        // 默认从内存配置中读取数据
+        return SaOAuth2Manager.getServerConfig().getClients().get(clientId);
     }
 
     /**
-- 
Gitee


From 0229efa5fd09c02840fa97408344fc8a8c6622c7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Mon, 26 Aug 2024 23:14:59 +0800
Subject: [PATCH 162/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E7=A4=BA=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/resources/templates/index.html                   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
index 0e8d6858..6399985e 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/src/main/resources/templates/index.html
@@ -48,11 +48,11 @@
 			<span class="ps">当请求链接不包含 scope 权限，或请求的 scope 近期已授权时，将无需用户手动确认，做到静默授权</span>
 			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/</code>
 			
-			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo,oidc">
+			<a href="http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userinfo">
 				<button>授权登录（显式授权）</button> 
 			</a>
 			<span class="ps">当请求链接包含具体的 scope 权限时，将需要用户手动确认，此时 OAuth-Server 会返回更多的数据</span>
-			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userid,userinfo,oidc</code>
+			<code>http://sa-oauth-server.com:8000/oauth2/authorize?response_type=code&client_id=1001&redirect_uri=http://sa-oauth-client.com:8002/&scope=openid,userinfo</code>
 			
 			<button onclick="refreshToken()">刷新令牌</button> 
 			<span class="ps">我们可以拿着 Refresh-Token 去刷新我们的 Access-Token，每次刷新后旧Token将作废</span>
-- 
Gitee


From 3eaa6b9baf3d3fa7ba7c3aed114372a7e9d114c1 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 00:28:41 +0800
Subject: [PATCH 163/172] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E6=8F=90=E4=BA=A4=E5=90=8C=E5=90=8Dcookie=E6=97=B6=E7=9A=84?=
 =?UTF-8?q?=E6=A1=86=E6=9E=B6=E9=94=99=E8=AF=BB=E7=8E=B0=E8=B1=A1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../satoken/context/model/SaRequest.java      | 14 +++++++
 .../dubbo/model/SaRequestForDubbo.java        | 20 ++++++++++
 .../dubbo3/model/SaRequestForDubbo3.java      | 20 ++++++++++
 .../context/grpc/model/SaRequestForGrpc.java  | 20 ++++++++++
 .../servlet/model/SaRequestForServlet.java    | 27 +++++++++++++
 .../reactor/model/SaRequestForReactor.java    | 38 +++++++++++++++++++
 .../reactor/model/SaRequestForReactor.java    | 38 +++++++++++++++++++
 .../servlet/model/SaRequestForServlet.java    | 27 +++++++++++++
 .../solon/model/SaRequestForSolon.java        | 35 ++++++++++++++++-
 9 files changed, 237 insertions(+), 2 deletions(-)

diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java b/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
index 8a0b3d45..91c0f73f 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/context/model/SaRequest.java
@@ -131,6 +131,20 @@ public interface SaRequest {
 	 */
 	String getCookieValue(String name);
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	String getCookieFirstValue(String name);
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	String getCookieLastValue(String name);
+
 	/**
 	 * 返回当前请求path (不包括上下文名称) 
 	 * @return /
diff --git a/sa-token-plugin/sa-token-dubbo/src/main/java/cn/dev33/satoken/context/dubbo/model/SaRequestForDubbo.java b/sa-token-plugin/sa-token-dubbo/src/main/java/cn/dev33/satoken/context/dubbo/model/SaRequestForDubbo.java
index f411be02..5cebcd25 100644
--- a/sa-token-plugin/sa-token-dubbo/src/main/java/cn/dev33/satoken/context/dubbo/model/SaRequestForDubbo.java
+++ b/sa-token-plugin/sa-token-dubbo/src/main/java/cn/dev33/satoken/context/dubbo/model/SaRequestForDubbo.java
@@ -95,6 +95,26 @@ public class SaRequestForDubbo implements SaRequest {
 		return null;
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
+		// 不传播 cookie 参数
+		return null;
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		// 不传播 cookie 参数
+		return null;
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称)  
 	 */
diff --git a/sa-token-plugin/sa-token-dubbo3/src/main/java/cn/dev33/satoken/context/dubbo3/model/SaRequestForDubbo3.java b/sa-token-plugin/sa-token-dubbo3/src/main/java/cn/dev33/satoken/context/dubbo3/model/SaRequestForDubbo3.java
index 1200f1c0..73e6d2a1 100644
--- a/sa-token-plugin/sa-token-dubbo3/src/main/java/cn/dev33/satoken/context/dubbo3/model/SaRequestForDubbo3.java
+++ b/sa-token-plugin/sa-token-dubbo3/src/main/java/cn/dev33/satoken/context/dubbo3/model/SaRequestForDubbo3.java
@@ -95,6 +95,26 @@ public class SaRequestForDubbo3 implements SaRequest {
 		return null;
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
+		// 不传播 cookie 参数
+		return null;
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		// 不传播 cookie 参数
+		return null;
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称)  
 	 */
diff --git a/sa-token-plugin/sa-token-grpc/src/main/java/cn/dev33/satoken/context/grpc/model/SaRequestForGrpc.java b/sa-token-plugin/sa-token-grpc/src/main/java/cn/dev33/satoken/context/grpc/model/SaRequestForGrpc.java
index 184d8007..f6ca8a4d 100644
--- a/sa-token-plugin/sa-token-grpc/src/main/java/cn/dev33/satoken/context/grpc/model/SaRequestForGrpc.java
+++ b/sa-token-plugin/sa-token-grpc/src/main/java/cn/dev33/satoken/context/grpc/model/SaRequestForGrpc.java
@@ -82,6 +82,26 @@ public class SaRequestForGrpc implements SaRequest {
         return null;
     }
 
+    /**
+     * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+     */
+    @Override
+    public String getCookieFirstValue(String name){
+        // 不传播 cookie 参数
+        return null;
+    }
+
+    /**
+     * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+     * @param name 键
+     * @return 值
+     */
+    @Override
+    public String getCookieLastValue(String name){
+        // 不传播 cookie 参数
+        return null;
+    }
+
     /**
      * 返回当前请求path (不包括上下文名称)
      */
diff --git a/sa-token-starter/sa-token-jakarta-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java b/sa-token-starter/sa-token-jakarta-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
index 57f7f216..cc677c3c 100644
--- a/sa-token-starter/sa-token-jakarta-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
+++ b/sa-token-starter/sa-token-jakarta-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
@@ -109,6 +109,14 @@ public class SaRequestForServlet implements SaRequest {
 	 */
 	@Override
 	public String getCookieValue(String name) {
+		return getCookieLastValue(name);
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
 		Cookie[] cookies = request.getCookies();
 		if (cookies != null) {
 			for (Cookie cookie : cookies) {
@@ -120,6 +128,25 @@ public class SaRequestForServlet implements SaRequest {
 		return null;
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		String value = null;
+		Cookie[] cookies = request.getCookies();
+		if (cookies != null) {
+			for (Cookie cookie : cookies) {
+				if (cookie != null && name.equals(cookie.getName())) {
+					value = cookie.getValue();
+				}
+			}
+		}
+		return value;
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称) 
 	 */
diff --git a/sa-token-starter/sa-token-reactor-spring-boot-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java b/sa-token-starter/sa-token-reactor-spring-boot-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
index 7b798cb9..b209afd9 100644
--- a/sa-token-starter/sa-token-reactor-spring-boot-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
+++ b/sa-token-starter/sa-token-reactor-spring-boot-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
@@ -101,6 +101,14 @@ public class SaRequestForReactor implements SaRequest {
 	 */
 	@Override
 	public String getCookieValue(String name) {
+		return getCookieLastValue(name);
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
 		HttpCookie cookie = request.getCookies().getFirst(name);
 		if(cookie == null) {
 			return null;
@@ -108,6 +116,36 @@ public class SaRequestForReactor implements SaRequest {
 		return cookie.getValue();
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		String value = null;
+		String cookieStr = getHeader("Cookie");
+		if(SaFoxUtil.isNotEmpty(cookieStr)) {
+			String[] cookieItems = cookieStr.split(";");
+			for (String item : cookieItems) {
+				String[] kv = item.split("=");
+				if (kv.length == 2) {
+					if (kv[0].trim().equals(name)) {
+						value = kv[1].trim();
+					}
+				}
+			}
+		}
+		return value;
+
+		// 此种写法无法获取到最后一个 Cookie，WebFlux 底层代码应该是有bug，前端提交多个同名Cookie时只能解析出第一个来
+//		List<HttpCookie> cookies = request.getCookies().get(name);
+//		if(cookies.isEmpty()) {
+//			return null;
+//		}
+//		return cookies.get(cookies.size() - 1).getValue();
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称)  
 	 */
diff --git a/sa-token-starter/sa-token-reactor-spring-boot3-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java b/sa-token-starter/sa-token-reactor-spring-boot3-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
index c8a5c588..e656a4b6 100644
--- a/sa-token-starter/sa-token-reactor-spring-boot3-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
+++ b/sa-token-starter/sa-token-reactor-spring-boot3-starter/src/main/java/cn/dev33/satoken/reactor/model/SaRequestForReactor.java
@@ -101,6 +101,14 @@ public class SaRequestForReactor implements SaRequest {
 	 */
 	@Override
 	public String getCookieValue(String name) {
+		return getCookieLastValue(name);
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
 		HttpCookie cookie = request.getCookies().getFirst(name);
 		if(cookie == null) {
 			return null;
@@ -108,6 +116,36 @@ public class SaRequestForReactor implements SaRequest {
 		return cookie.getValue();
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		String value = null;
+		String cookieStr = getHeader("Cookie");
+		if(SaFoxUtil.isNotEmpty(cookieStr)) {
+			String[] cookieItems = cookieStr.split(";");
+			for (String item : cookieItems) {
+				String[] kv = item.split("=");
+				if (kv.length == 2) {
+					if (kv[0].trim().equals(name)) {
+						value = kv[1].trim();
+					}
+				}
+			}
+		}
+		return value;
+
+		// 此种写法无法获取到最后一个 Cookie，WebFlux 底层代码应该是有bug，前端提交多个同名Cookie时只能解析出第一个来
+		//		List<HttpCookie> cookies = request.getCookies().get(name);
+		//		if(cookies.isEmpty()) {
+		//			return null;
+		//		}
+		//		return cookies.get(cookies.size() - 1).getValue();
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称)  
 	 */
diff --git a/sa-token-starter/sa-token-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java b/sa-token-starter/sa-token-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
index d1228b51..5088143c 100644
--- a/sa-token-starter/sa-token-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
+++ b/sa-token-starter/sa-token-servlet/src/main/java/cn/dev33/satoken/servlet/model/SaRequestForServlet.java
@@ -109,6 +109,14 @@ public class SaRequestForServlet implements SaRequest {
 	 */
 	@Override
 	public String getCookieValue(String name) {
+		return getCookieLastValue(name);
+	}
+
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+	 */
+	@Override
+	public String getCookieFirstValue(String name){
 		Cookie[] cookies = request.getCookies();
 		if (cookies != null) {
 			for (Cookie cookie : cookies) {
@@ -120,6 +128,25 @@ public class SaRequestForServlet implements SaRequest {
 		return null;
 	}
 
+	/**
+	 * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+	 * @param name 键
+	 * @return 值
+	 */
+	@Override
+	public String getCookieLastValue(String name){
+		String value = null;
+		Cookie[] cookies = request.getCookies();
+		if (cookies != null) {
+			for (Cookie cookie : cookies) {
+				if (cookie != null && name.equals(cookie.getName())) {
+					value = cookie.getValue();
+				}
+			}
+		}
+		return value;
+	}
+
 	/**
 	 * 返回当前请求path (不包括上下文名称) 
 	 */
diff --git a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/model/SaRequestForSolon.java b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/model/SaRequestForSolon.java
index 3de3469a..2b820bff 100644
--- a/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/model/SaRequestForSolon.java
+++ b/sa-token-starter/sa-token-solon-plugin/src/main/java/cn/dev33/satoken/solon/model/SaRequestForSolon.java
@@ -68,8 +68,39 @@ public class SaRequestForSolon implements SaRequest {
     }
 
     @Override
-    public String getCookieValue(String s) {
-        return ctx.cookie(s);
+    public String getCookieValue(String name) {
+        return getCookieLastValue(name);
+    }
+
+    /**
+     * 在 [ Cookie作用域 ] 里获取一个值 (第一个此名称的)
+     */
+    @Override
+    public String getCookieFirstValue(String name){
+        return ctx.cookie(name);
+    }
+
+    /**
+     * 在 [ Cookie作用域 ] 里获取一个值 (最后一个此名称的)
+     * @param name 键
+     * @return 值
+     */
+    @Override
+    public String getCookieLastValue(String name){
+        String value = null;
+        String cookieStr = ctx.header("Cookie");
+        if(SaFoxUtil.isNotEmpty(cookieStr)) {
+            String[] cookieItems = cookieStr.split(";");
+            for (String item : cookieItems) {
+                String[] kv = item.split("=");
+                if (kv.length == 2) {
+                    if (kv[0].trim().equals(name)) {
+                        value = kv[1].trim();
+                    }
+                }
+            }
+        }
+        return value;
     }
 
     @Override
-- 
Gitee


From e1141ef942d1775801566c273730a40f5ba86678 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 02:05:02 +0800
Subject: [PATCH 164/172] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=96=87=E6=A1=A3SSO?=
 =?UTF-8?q?=E9=9B=86=E6=88=90=E6=B5=81=E7=A8=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../java/com/pj/sso/SsoClientController.java  |   6 +-
 sa-token-doc/sso/sso-type2.md                 | 121 +-----------------
 sa-token-doc/sso/sso-type3.md                 | 106 ++++++++++++++-
 3 files changed, 111 insertions(+), 122 deletions(-)

diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
index 4eeed193..361d1cfb 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/src/main/java/com/pj/sso/SsoClientController.java
@@ -1,5 +1,6 @@
 package com.pj.sso;
 
+import cn.dev33.satoken.sso.SaSsoManager;
 import cn.dev33.satoken.sso.config.SaSsoClientConfig;
 import cn.dev33.satoken.sso.processor.SaSsoClientProcessor;
 import cn.dev33.satoken.stp.StpUtil;
@@ -20,10 +21,11 @@ public class SsoClientController {
 	// 首页 
 	@RequestMapping("/")
 	public String index() {
+		String solUrl = SaSsoManager.getClientConfig().splicingSloUrl();
 		String str = "<h2>Sa-Token SSO-Client 应用端</h2>" + 
 					"<p>当前会话是否登录：" + StpUtil.isLogin() + "</p>" + 
-					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a> " + 
-					"<a href='/sso/logout?back=self'>注销</a></p>"; 
+					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a> " +
+					"<a href=\"javascript:location.href='" + solUrl + "?back=' + encodeURIComponent(location.href);\">注销</a> </p>";
 		return str;
 	}
 
diff --git a/sa-token-doc/sso/sso-type2.md b/sa-token-doc/sso/sso-type2.md
index 75ebb0eb..3be00670 100644
--- a/sa-token-doc/sso/sso-type2.md
+++ b/sa-token-doc/sso/sso-type2.md
@@ -137,10 +137,11 @@ public class SsoClientController {
 	// 首页 
 	@RequestMapping("/")
 	public String index() {
+		String solUrl = SaSsoManager.getClientConfig().splicingSloUrl();
 		String str = "<h2>Sa-Token SSO-Client 应用端</h2>" + 
 					"<p>当前会话是否登录：" + StpUtil.isLogin() + "</p>" + 
-					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a> " + 
-					"<a href='/sso/logout?back=self'>注销</a></p>";
+					"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a> " +
+					"<a href=\"javascript:location.href='" + solUrl + "?back=' + encodeURIComponent(location.href);\">注销</a> </p>";
 		return str;
 	}
 	
@@ -295,122 +296,8 @@ public class SaSso2ClientApplication {
  -->
  
  
-### 5、无刷单点注销
 
-有了单点登录，就必然伴随着单点注销（一处注销，全端下线）
-
-如果你的所有 client 都是基于 SSO 模式二来对接的，那么单点注销其实很简单：
-
-``` java
-// 在 `sa-token.is-share=true` 的情况下，调用此代码即可单点注销：
-StpUtil.logout();
-
-// 在 `sa-token.is-share=false` 的情况下，调用此代码即可单点注销：
-StpUtil.logout(StpUtil.getLoginId());
-```
-
-你可能会比较疑惑，这不就是个普通的会话注销API吗，为什么会有单点注销的效果？
-
-因为模式二需要各个 sso-client 和 sso-server 连接同一个 redis，即使登录再多的 client，本质上对应的仍是同一个会话，因此可以做到任意一处调用注销，全端一起下线的效果。
-
-而如果你的各个 client 架构各不相同，有的是模式二对接，有的是模式三对接，则需要麻烦一点才能做到单点注销。
-
-这里的“麻烦”指两处：1、框架内部逻辑麻烦；2、开发者集成麻烦。
-
-框架内部的麻烦 sa-token-sso 已经封装完毕，无需过多关注，而开发者的麻烦步骤也不是很多：
-
-
-#### 5.1、增加 pom.xml 配置 
-
-<!---------------------------- tabs:start ---------------------------->
-<!-------- tab:Maven 方式 -------->
-``` xml
-<!-- Http请求工具 -->
-<dependency>
-	<groupId>com.dtflys.forest</groupId>
-	<artifactId>forest-spring-boot-starter</artifactId>
-	<version>1.5.26</version>
-</dependency>
-```
-<!-------- tab:Gradle 方式 -------->
-``` gradle
-// Http请求工具
-implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
-```
-<!---------------------------- tabs:end ---------------------------->
-
-Forest 是一个轻量级 http 请求工具，详情参考：[Forest](https://forest.dtflyx.com/)
-
-因为我们已经在控制台手动打印 url 请求日志了，所以此处 `forest.log-enabled=false` 关闭 Forest 框架自身的日志打印，这不是必须的，你可以将其打开。
-
-
-#### 5.2、SSO-Client 端新增配置：API调用秘钥
-
-在 `application.yml` 增加：
-
-<!---------------------------- tabs:start ---------------------------->
-<!------------- tab:yaml 风格  ------------->
-``` yaml
-sa-token: 
-    sign:
-        # API 接口调用秘钥
-        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
-		
-forest: 
-	# 关闭 forest 请求日志打印
-	log-enabled: false
-```
-<!------------- tab:properties 风格  ------------->
-``` properties
-# 接口调用秘钥 
-sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
-
-# 关闭 forest 请求日志打印
-forest.log-enabled=false
-```
-<!---------------------------- tabs:end ---------------------------->
-
-注意 secretkey 秘钥需要与SSO认证中心的一致 
-
-#### 5.3、SSO-Client 配置 http 请求处理器
-``` java
-// 配置SSO相关参数
-@Autowired
-private void configSso(SaSsoClientConfig ssoClient) {
-	// 配置Http请求处理器
-	ssoClient.sendHttp = url -> {
-		System.out.println("------ 发起请求：" + url);
-		String resStr = Forest.get(url).executeAsString();
-		System.out.println("------ 请求结果：" + resStr);
-		return resStr;
-	};
-}
-```
-
-#### 5.3、启动测试 
-重启项目，依次登录三个 client：
-- [http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
-- [http://sa-sso-client2.com:9001/](http://sa-sso-client2.com:9001/)
-- [http://sa-sso-client3.com:9001/](http://sa-sso-client3.com:9001/)
-
-![sso-type3-client-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-client-index.png 's-w-sh')
-
-在任意一个 client 里，点击 **`[注销]`** 按钮，即可单点注销成功（打开另外两个client，刷新一下页面，登录态丢失）。
-
-<!-- ![sso-type3-slo.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo.png 's-w-sh') -->
-
-![sso-type3-slo-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo-index.png 's-w-sh')
-
-PS：这里我们为了方便演示，使用的是超链接跳页面的形式，正式项目中使用 Ajax 调用接口即可做到无刷单点登录退出。
-
-例如，我们使用 [Apifox 接口测试工具](https://www.apifox.cn/) 可以做到同样的效果：
-
-![sso-slo-apifox.png](https://oss.dev33.cn/sa-token/doc/sso/sso-slo-apifox.png 's-w-sh')
-
-测试完毕！
-
-
-### 6、跨 Redis 的单点登录
+### 5、跨 Redis 的单点登录
 以上流程解决了跨域模式下的单点登录，但是后端仍然采用了共享Redis来同步会话，如果我们的架构设计中Client端与Server端无法共享Redis，又该怎么完成单点登录？
 
 这就要采用模式三了，且往下看：[SSO模式三：Http请求获取会话](/sso/sso-type3)
diff --git a/sa-token-doc/sso/sso-type3.md b/sa-token-doc/sso/sso-type3.md
index 39fe8c4a..5ec4ea98 100644
--- a/sa-token-doc/sso/sso-type3.md
+++ b/sa-token-doc/sso/sso-type3.md
@@ -22,7 +22,32 @@
 
 ### 2、在Client 端更改 Ticket 校验方式
 
-在 application.yml 新增配置：
+
+#### 2.1、增加 pom.xml 配置 
+
+<!---------------------------- tabs:start ---------------------------->
+<!-------- tab:Maven 方式 -------->
+``` xml
+<!-- Http请求工具 -->
+<dependency>
+	<groupId>com.dtflys.forest</groupId>
+	<artifactId>forest-spring-boot-starter</artifactId>
+	<version>1.5.26</version>
+</dependency>
+```
+<!-------- tab:Gradle 方式 -------->
+``` gradle
+// Http请求工具
+implementation 'com.dtflys.forest:forest-spring-boot-starter:1.5.26'
+```
+<!---------------------------- tabs:end ---------------------------->
+
+Forest 是一个轻量级 http 请求工具，详情参考：[Forest](https://forest.dtflyx.com/)
+
+
+#### 2.2、SSO-Client 端新增配置：API调用秘钥
+
+在 `application.yml` 增加：
 
 <!---------------------------- tabs:start ---------------------------->
 <!------------- tab:yaml 风格  ------------->
@@ -31,14 +56,47 @@ sa-token:
     sso-client: 
         # 打开模式三（使用Http请求校验ticket）
         is-http: true
+    sign:
+        # API 接口调用秘钥
+        secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+		
+forest: 
+	# 关闭 forest 请求日志打印
+	log-enabled: false
 ```
 <!------------- tab:properties 风格  ------------->
 ``` properties
 # 打开模式三（使用Http请求校验ticket）
 sa-token.sso-client.is-http=true
+# 接口调用秘钥 
+sa-token.sign.secret-key=kQwIOrYvnXmSDkwEiFngrKidMcdrgKor
+
+# 关闭 forest 请求日志打印
+forest.log-enabled=false
 ```
 <!---------------------------- tabs:end ---------------------------->
 
+因为我们已经在控制台手动打印 url 请求日志了，所以此处 `forest.log-enabled=false` 关闭 Forest 框架自身的日志打印，这不是必须的，你可以将其打开。
+
+注意 secretkey 秘钥需要与SSO认证中心的一致 
+
+#### 2.3、SSO-Client 配置 http 请求处理器
+``` java
+// 配置SSO相关参数
+@Autowired
+private void configSso(SaSsoClientConfig ssoClient) {
+	// 配置Http请求处理器
+	ssoClient.sendHttp = url -> {
+		System.out.println("------ 发起请求：" + url);
+		String resStr = Forest.get(url).executeAsString();
+		System.out.println("------ 请求结果：" + resStr);
+		return resStr;
+	};
+}
+```
+
+
+#### 2.4、测试
 
 重启项目，访问测试：
 - [http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
@@ -49,6 +107,10 @@ sa-token.sso-client.is-http=true
 > 注：如果已测试运行模式二，可先将Redis中的数据清空，以防旧数据对测试造成干扰
 
 
+
+
+
+
 ### 3、获取 UserInfo 
 除了账号id，我们可能还需要将用户的昵称、头像等信息从 Server端 带到 Client端，即：用户资料的拉取。
 
@@ -192,10 +254,10 @@ public Object getFansList(Long loginId) {
 访问测试：[http://sa-sso-client1.com:9001/sso/myFansList](http://sa-sso-client1.com:9001/sso/myFansList)
 
 
+### 5、无刷单点注销
 
-### 5、单点注销
+有了单点登录，就必然伴随着单点注销（一处注销，全端下线）
 
-有关 SSO 单点注销的步骤，在上一章节的“无刷单点注销”部分已讲解完毕（模式二和模式三通用），所以此处就不再赘述了。
 
 此处简单介绍一下 SSO 模式三的单点注销链路过程：
 
@@ -212,6 +274,44 @@ public Object getFansList(Long loginId) {
 
 这些逻辑 Sa-Token 内部已经封装完毕，你只需按照文档步骤集成即可。
 
+#### 5.1、更改注销方案
+
+将 sso-client 首页路由方法里的注销链接换成 `/sso/logout` 接口：
+``` java
+// SSO-Client端：首页
+@RequestMapping("/")
+public String index() {
+	String str = "<h2>Sa-Token SSO-Client 应用端</h2>" + 
+				"<p>当前会话是否登录：" + StpUtil.isLogin() + "</p>" + 
+				"<p><a href=\"javascript:location.href='/sso/login?back=' + encodeURIComponent(location.href);\">登录</a>" + 
+				" <a href='/sso/logout?back=self'>注销</a></p>";
+	return str;
+}
+```
+
+#### 5.2、启动测试 
+重启项目，依次登录三个 client：
+- [http://sa-sso-client1.com:9001/](http://sa-sso-client1.com:9001/)
+- [http://sa-sso-client2.com:9001/](http://sa-sso-client2.com:9001/)
+- [http://sa-sso-client3.com:9001/](http://sa-sso-client3.com:9001/)
+
+![sso-type3-client-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-client-index.png 's-w-sh')
+
+在任意一个 client 里，点击 **`[注销]`** 按钮，即可单点注销成功（打开另外两个client，刷新一下页面，登录态丢失）。
+
+<!-- ![sso-type3-slo.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo.png 's-w-sh') -->
+
+![sso-type3-slo-index.png](https://oss.dev33.cn/sa-token/doc/sso/sso-type3-slo-index.png 's-w-sh')
+
+PS：这里我们为了方便演示，使用的是超链接跳页面的形式，正式项目中使用 Ajax 调用接口即可做到无刷单点登录退出。
+
+例如，我们使用 [Apifox 接口测试工具](https://www.apifox.cn/) 可以做到同样的效果：
+
+![sso-slo-apifox.png](https://oss.dev33.cn/sa-token/doc/sso/sso-slo-apifox.png 's-w-sh')
+
+测试完毕！
+
+
 
 ### 6、后记
 当我们熟读三种模式的单点登录之后，其实不难发现：所谓单点登录，其本质就是多个系统之间的会话共享。
-- 
Gitee


From f8afd89154a48ed763f6d9e452a430d56f92e327 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 09:58:06 +0800
Subject: [PATCH 165/172] v1.39.0 update

---
 README.md                                     |  2 +-
 pom.xml                                       |  2 +-
 sa-token-bom/pom.xml                          |  2 +-
 .../cn/dev33/satoken/util/SaTokenConsts.java  |  2 +-
 .../sa-token-demo-alone-redis-cluster/pom.xml |  2 +-
 .../sa-token-demo-alone-redis/pom.xml         |  2 +-
 sa-token-demo/sa-token-demo-beetl/pom.xml     |  2 +-
 .../sa-token-demo-bom-import/pom.xml          |  4 +-
 sa-token-demo/sa-token-demo-case/pom.xml      |  2 +-
 .../sa-token-demo-dubbo-consumer/pom.xml      |  2 +-
 .../sa-token-demo-dubbo-provider/pom.xml      |  2 +-
 .../sa-token-demo-dubbo3-consumer/pom.xml     |  2 +-
 .../sa-token-demo-dubbo3-provider/pom.xml     |  2 +-
 sa-token-demo/sa-token-demo-grpc/pom.xml      |  2 +-
 .../sa-token-demo-hutool-timed-cache/pom.xml  |  2 +-
 sa-token-demo/sa-token-demo-jwt/pom.xml       |  2 +-
 .../sa-token-demo-oauth2-client/pom.xml       |  2 +-
 .../sa-token-demo-oauth2-server/pom.xml       |  2 +-
 .../src/main/resources/application.yml        | 17 ++++----
 .../sa-token-demo-quick-login/pom.xml         |  2 +-
 .../sa-token-demo-remember-me-server/pom.xml  |  2 +-
 .../sa-token-demo-solon-redisson/pom.xml      |  2 +-
 sa-token-demo/sa-token-demo-solon/pom.xml     |  2 +-
 .../sa-token-demo-springboot-redis/pom.xml    |  2 +-
 .../sa-token-demo-springboot-redisson/pom.xml |  2 +-
 .../sa-token-demo-springboot/pom.xml          |  2 +-
 .../sa-token-demo-springboot3-redis/pom.xml   |  2 +-
 sa-token-demo/sa-token-demo-ssm/pom.xml       |  2 +-
 .../sa-token-demo-sso-server-solon/pom.xml    |  2 +-
 .../sa-token-demo-sso1-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso2-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso3-client-solon/pom.xml   |  2 +-
 .../sa-token-demo-sso-server/pom.xml          |  2 +-
 .../sa-token-demo-sso1-client/pom.xml         |  2 +-
 .../sa-token-demo-sso2-client/pom.xml         |  2 +-
 .../sa-token-demo-sso3-client-test2/pom.xml   |  2 +-
 .../sa-token-demo-sso3-client/pom.xml         |  2 +-
 sa-token-demo/sa-token-demo-test/pom.xml      |  2 +-
 sa-token-demo/sa-token-demo-thymeleaf/pom.xml |  2 +-
 .../sa-token-demo-webflux-springboot3/pom.xml |  2 +-
 sa-token-demo/sa-token-demo-webflux/pom.xml   |  2 +-
 .../sa-token-demo-websocket-spring/pom.xml    |  2 +-
 sa-token-demo/sa-token-demo-websocket/pom.xml |  2 +-
 sa-token-dependencies/pom.xml                 |  2 +-
 sa-token-doc/README.md                        |  2 +-
 sa-token-doc/doc.html                         |  5 ++-
 .../fun/auth-framework-function-test.md       |  2 +-
 sa-token-doc/index.html                       |  2 +-
 sa-token-doc/more/update-log.md               | 43 +++++++++++++++++++
 sa-token-doc/start/new-version.md             |  4 +-
 50 files changed, 103 insertions(+), 60 deletions(-)

diff --git a/README.md b/README.md
index 5badb14f..98c665c7 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 <p align="center">
 	<img alt="logo" src="https://sa-token.cc/logo.png" width="150" height="150">
 </p>
-<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.38.0</h1>
+<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.39.0</h1>
 <h4 align="center">一个轻量级 Java 权限认证框架，让鉴权变得简单、优雅！</h4>
 <p align="center">
 	<a href="https://gitee.com/dromara/sa-token/stargazers"><img src="https://gitee.com/dromara/sa-token/badge/star.svg?theme=gvp"></a>
diff --git a/pom.xml b/pom.xml
index 9dce4b56..cc136113 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,7 +37,7 @@
 	
 	<!-- 一些属性 -->
 	<properties>
-        <revision>1.38.0</revision>
+        <revision>1.39.0</revision>
         <jdk.version>1.8</jdk.version>
 		<project.build.sourceEncoding>utf-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>utf-8</project.reporting.outputEncoding>
diff --git a/sa-token-bom/pom.xml b/sa-token-bom/pom.xml
index a47f6ee2..74e4b510 100644
--- a/sa-token-bom/pom.xml
+++ b/sa-token-bom/pom.xml
@@ -13,7 +13,7 @@
     <url>https://github.com/dromara/sa-token</url>
 
     <properties>
-        <revision>1.38.0</revision>
+        <revision>1.39.0</revision>
     </properties>
 
     <dependencyManagement>
diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
index baebafe7..c54c2722 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java
@@ -36,7 +36,7 @@ public class SaTokenConsts {
 	/**
 	 * Sa-Token 当前版本号 
 	 */
-	public static final String VERSION_NO = "v1.38.0";
+	public static final String VERSION_NO = "v1.39.0";
 
 	/**
 	 * Sa-Token 开源地址 Gitee 
diff --git a/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml b/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
index 240b63a3..b1835aaf 100644
--- a/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
+++ b/sa-token-demo/sa-token-demo-alone-redis-cluster/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-alone-redis/pom.xml b/sa-token-demo/sa-token-demo-alone-redis/pom.xml
index 8d24f792..c036ca14 100644
--- a/sa-token-demo/sa-token-demo-alone-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-alone-redis/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-beetl/pom.xml b/sa-token-demo/sa-token-demo-beetl/pom.xml
index a51ea399..aa208375 100644
--- a/sa-token-demo/sa-token-demo-beetl/pom.xml
+++ b/sa-token-demo/sa-token-demo-beetl/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-bom-import/pom.xml b/sa-token-demo/sa-token-demo-bom-import/pom.xml
index 0e0ee7f4..2a03843b 100644
--- a/sa-token-demo/sa-token-demo-bom-import/pom.xml
+++ b/sa-token-demo/sa-token-demo-bom-import/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
@@ -73,7 +73,7 @@
 			<dependency>
 				<groupId>cn.dev33</groupId>
 				<artifactId>sa-token-bom</artifactId>
-				<version>1.38.0</version>
+				<version>1.39.0</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
diff --git a/sa-token-demo/sa-token-demo-case/pom.xml b/sa-token-demo/sa-token-demo-case/pom.xml
index dbb0fd82..f3bf964c 100644
--- a/sa-token-demo/sa-token-demo-case/pom.xml
+++ b/sa-token-demo/sa-token-demo-case/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
index 6f3fd5f4..5954ce96 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-consumer/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<dubbo.version>2.7.21</dubbo.version>
 		<nacos.version>1.4.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
index aeb6f90d..522a5ada 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo-provider/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<dubbo.version>2.7.21</dubbo.version>
 		<nacos.version>1.4.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
index 9a7a1af2..b88b05cf 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-consumer/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<dubbo.version>3.2.2</dubbo.version>
 		<nacos.version>2.2.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
index c420e235..cca02604 100644
--- a/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
+++ b/sa-token-demo/sa-token-demo-dubbo/sa-token-demo-dubbo3-provider/pom.xml
@@ -17,7 +17,7 @@
 	<properties> 
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<dubbo.version>3.2.2</dubbo.version>
 		<nacos.version>2.2.2</nacos.version>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-grpc/pom.xml b/sa-token-demo/sa-token-demo-grpc/pom.xml
index df0cc5ca..1d0c04f2 100644
--- a/sa-token-demo/sa-token-demo-grpc/pom.xml
+++ b/sa-token-demo/sa-token-demo-grpc/pom.xml
@@ -27,7 +27,7 @@
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <lombok.version>1.18.10</lombok.version>
-        <sa-token.version>1.38.0</sa-token.version>
+        <sa-token.version>1.39.0</sa-token.version>
     </properties>
 
     <dependencies>
diff --git a/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml b/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
index 18897f60..3c906b61 100644
--- a/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
+++ b/sa-token-demo/sa-token-demo-hutool-timed-cache/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-jwt/pom.xml b/sa-token-demo/sa-token-demo-jwt/pom.xml
index 2359117a..d498d672 100644
--- a/sa-token-demo/sa-token-demo-jwt/pom.xml
+++ b/sa-token-demo/sa-token-demo-jwt/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
index 57ef7f5d..c32a5002 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-client/pom.xml
@@ -17,7 +17,7 @@
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
 		<!-- 定义 Sa-Token 版本号 -->
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 	
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
index db0b6c7d..2eb121b3 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/pom.xml
@@ -17,7 +17,7 @@
 		<java.version>1.8</java.version>
 		<maven-jar-plugin.version>3.1.1</maven-jar-plugin.version>
 		<!-- 定义 Sa-Token 版本号 -->
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 	
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
index 4c661c3c..5b2e9ebb 100644
--- a/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
+++ b/sa-token-demo/sa-token-demo-oauth2/sa-token-demo-oauth2-server/src/main/resources/application.yml
@@ -1,15 +1,15 @@
-server: 
+server:
     port: 8000
 
 # sa-token配置
-sa-token: 
+sa-token:
     # token名称 (同时也是 Cookie 名称)
     token-name: satoken
     # 是否打印操作日志
     is-log: true
     # jwt 秘钥
     jwt-secret-key: saxsaxsaxsax
-    # OAuth2.0 配置 
+    # OAuth2.0 配置
     oauth2-server:
         # 是否全局开启授权码模式
         enable-authorization-code: true
@@ -24,8 +24,8 @@ sa-token:
         # 定义哪些 scope 是低级权限，多个用逗号隔开
         # lower-scope: userinfo
 
-spring: 
-    # redis配置 
+spring:
+    # redis配置
     redis:
         # Redis数据库索引（默认为0）
         database: 1
@@ -34,7 +34,7 @@ spring:
         # Redis服务器连接端口
         port: 6379
         # Redis服务器连接密码（默认为空）
-        # password: 
+        # password:
         # 连接超时时间（毫秒）
         timeout: 1000ms
         lettuce:
@@ -47,6 +47,5 @@ spring:
                 max-idle: 10
                 # 连接池中的最小空闲连接
                 min-idle: 0
-        
-        
-        
\ No newline at end of file
+
+
diff --git a/sa-token-demo/sa-token-demo-quick-login/pom.xml b/sa-token-demo/sa-token-demo-quick-login/pom.xml
index 51bb3868..549954f0 100644
--- a/sa-token-demo/sa-token-demo-quick-login/pom.xml
+++ b/sa-token-demo/sa-token-demo-quick-login/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml b/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
index ccc15d35..53bdb851 100644
--- a/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-remember-me/sa-token-demo-remember-me-server/pom.xml
@@ -17,7 +17,7 @@
     </parent>
 
     <properties>
-        <sa-token.version>1.38.0</sa-token.version>
+        <sa-token.version>1.39.0</sa-token.version>
     </properties>
 
     <dependencies>
diff --git a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
index d60eb51e..6118605f 100644
--- a/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon-redisson/pom.xml
@@ -16,7 +16,7 @@
 
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-solon/pom.xml b/sa-token-demo/sa-token-demo-solon/pom.xml
index c3178eaa..6edda287 100644
--- a/sa-token-demo/sa-token-demo-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-solon/pom.xml
@@ -19,7 +19,7 @@
 		<java.version>17</java.version>
 		<maven.compiler.source>17</maven.compiler.source>
 		<maven.compiler.traget>17</maven.compiler.traget>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 	</properties>
diff --git a/sa-token-demo/sa-token-demo-springboot-redis/pom.xml b/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
index f60c4ed8..261b2252 100644
--- a/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot-redis/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml b/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
index b3a373cd..351e9fbe 100644
--- a/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot-redisson/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot/pom.xml b/sa-token-demo/sa-token-demo-springboot/pom.xml
index a6f41c64..3fe2c51b 100644
--- a/sa-token-demo/sa-token-demo-springboot/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml b/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
index 8cd82921..f717e272 100644
--- a/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
+++ b/sa-token-demo/sa-token-demo-springboot3-redis/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-ssm/pom.xml b/sa-token-demo/sa-token-demo-ssm/pom.xml
index 0e35d6e1..5a23365f 100644
--- a/sa-token-demo/sa-token-demo-ssm/pom.xml
+++ b/sa-token-demo/sa-token-demo-ssm/pom.xml
@@ -27,7 +27,7 @@
 		<!--<spring.version>4.2.5.RELEASE</spring.version>-->
 		<spring.version>5.3.7</spring.version>
 		<jackson.version>2.16.1</jackson.version>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
index 5c7d651c..e0f63a10 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso-server-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<solon.version>2.7.0</solon.version>
 	</properties>
 
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
index 0437b6fe..5d7cea06 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso1-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
index 66048e33..d59ea913 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso2-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
index 17b2d5c2..a9b6736e 100644
--- a/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso-for-solon/sa-token-demo-sso3-client-solon/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
index dc7c6767..bf320ff8 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso-server/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
index 50ef2657..afb16a4a 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso1-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
index cd026558..513333b7 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso2-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
index 3c32f669..df69f8ed 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client-test2/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
index d45bff0b..f0ae9427 100644
--- a/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
+++ b/sa-token-demo/sa-token-demo-sso/sa-token-demo-sso3-client/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-test/pom.xml b/sa-token-demo/sa-token-demo-test/pom.xml
index df740e04..9a424918 100644
--- a/sa-token-demo/sa-token-demo-test/pom.xml
+++ b/sa-token-demo/sa-token-demo-test/pom.xml
@@ -18,7 +18,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 		<java.run.main.class>com.pj.SaTokenApplication</java.run.main.class>
 	</properties>
 
diff --git a/sa-token-demo/sa-token-demo-thymeleaf/pom.xml b/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
index 4175c35c..811190d6 100644
--- a/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
+++ b/sa-token-demo/sa-token-demo-thymeleaf/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml b/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
index 609b90c7..6f0dee7e 100644
--- a/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
+++ b/sa-token-demo/sa-token-demo-webflux-springboot3/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-webflux/pom.xml b/sa-token-demo/sa-token-demo-webflux/pom.xml
index 058edaa9..88ed9408 100644
--- a/sa-token-demo/sa-token-demo-webflux/pom.xml
+++ b/sa-token-demo/sa-token-demo-webflux/pom.xml
@@ -16,7 +16,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-websocket-spring/pom.xml b/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
index 44134e1c..27c4376e 100644
--- a/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
+++ b/sa-token-demo/sa-token-demo-websocket-spring/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-demo/sa-token-demo-websocket/pom.xml b/sa-token-demo/sa-token-demo-websocket/pom.xml
index a15d39b8..bf610483 100644
--- a/sa-token-demo/sa-token-demo-websocket/pom.xml
+++ b/sa-token-demo/sa-token-demo-websocket/pom.xml
@@ -17,7 +17,7 @@
 	
 	<!-- 定义 Sa-Token 版本号 -->
 	<properties>
-		<sa-token.version>1.38.0</sa-token.version>
+		<sa-token.version>1.39.0</sa-token.version>
 	</properties>
 
 	<dependencies>
diff --git a/sa-token-dependencies/pom.xml b/sa-token-dependencies/pom.xml
index 5be7f46f..67e00ea8 100644
--- a/sa-token-dependencies/pom.xml
+++ b/sa-token-dependencies/pom.xml
@@ -12,7 +12,7 @@
     <description>Sa-Token Dependencies</description>
 
     <properties>
-        <revision>1.38.0</revision>
+        <revision>1.39.0</revision>
 		
 		<!-- 统一定义依赖版本号 -->
 		<springboot.version>2.5.15</springboot.version>
diff --git a/sa-token-doc/README.md b/sa-token-doc/README.md
index 56105163..e3446cae 100644
--- a/sa-token-doc/README.md
+++ b/sa-token-doc/README.md
@@ -1,7 +1,7 @@
 <p align="center">
 	<img alt="logo" src="https://sa-token.cc/logo.png" width="150" height="150">
 </p>
-<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.38.0</h1>
+<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">Sa-Token v1.39.0</h1>
 <h5 align="center">一个轻量级 Java 权限认证框架，让鉴权变得简单、优雅！</h5>
 <p align="center" class="badge-box">
 	<a href="https://gitee.com/dromara/sa-token/stargazers"><img src="https://gitee.com/dromara/sa-token/badge/star.svg?theme=gvp"></a>
diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index e64e6fa6..842136ff 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -18,7 +18,7 @@
 					<div class="logo-box">
 						<img src="logo.png" title="logo" />
 						<h1 class="logo-text">Sa-Token</h1>
-						<sub>v1.38.0</sub>
+						<sub>v1.39.0</sub>
 					</div>
 				</a>
 			</div>
@@ -28,6 +28,7 @@
 				</div>
 				<select class="select-version p-none" onchange="location.href=this.value">
 					<option value="doc.html">最新版</option>
+					<option value="v/v1.38.0/doc.html">v1.38.0</option>
 					<option value="v/v1.37.0/doc.html">v1.37.0</option>
 					<option value="v/v1.36.0/doc.html">v1.36.0</option>
 					<option value="v/v1.35.0/doc.html">v1.35.0</option>
@@ -219,7 +220,7 @@
 		<script src="./static/is-star-plugin.js?v=7"></script>
 		<script src="./static/is-fill-in-wj-plugin.js?v=7"></script>
 		<script>
-			var saTokenTopVersion = '1.38.0';	// Sa-Token最新版本 
+			var saTokenTopVersion = '1.39.0';	// Sa-Token最新版本 
 			var name = '<img style="width: 60px; height: 60px; vertical-align: middle;" src="logo.png" alt="logo" /> ';
 			name += '<b style="font-size: 28px; vertical-align: middle;">Sa-Token</b> <sub>v' + saTokenTopVersion + '</sub>';
 			window.$docsify = {
diff --git a/sa-token-doc/fun/auth-framework-function-test.md b/sa-token-doc/fun/auth-framework-function-test.md
index daa644df..3625d666 100644
--- a/sa-token-doc/fun/auth-framework-function-test.md
+++ b/sa-token-doc/fun/auth-framework-function-test.md
@@ -27,7 +27,7 @@
 <dependency>
 	<groupId>cn.dev33</groupId>
 	<artifactId>sa-token-spring-boot3-starter</artifactId>
-	<version>1.38.0</version>
+	<version>1.39.0</version>
 </dependency>
 ```
 
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 223373b8..99a7d93a 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -116,7 +116,7 @@
 			<div class="main-box">
 				<div class="content-box">
 					<!-- <div class="fenge"></div> -->
-					<h1>Sa-Token<small>v1.38.0</small></h1>
+					<h1>Sa-Token<small>v1.39.0</small></h1>
 					<div class="sub-title">
 						<span class="sub-title-nr">一个轻量级 java 权限认证框架，让鉴权变得简单、优雅！</span>
 						<div class="gb-cursor">&nbsp;</div>
diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index 5149481c..b5532a22 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -1,5 +1,48 @@
 # 更新日志 
 
+### v1.39.0 @2024-8-28
+- 核心：
+	- 升级：重构注解鉴权底层，支持自定义鉴权注解了。  **[重要]**
+	- 修复：修复前端提交同名 `Cookie` 时的框架错读现象。
+- 插件：
+	- 修复：修复 `sa-token-quick-login` 插件无法正常拦截的问题。
+- SSO：
+	- 优化：优化 sso-server 前后端分离 demo 代码。
+	- 优化：优化 sso-server 前后端分离时的跳转流程。
+- OAuth2：
+	- 重构：`sa-token-oauth2` 模块整体重构。   **[重要]**  **[不向下兼容]**
+	- 新增：新增支持自定义 `scope` 处理器。	 **[重要]**
+	- 新增：新增支持自定义 `grant_type`。	 **[重要]**
+	- 新增：新增 `scope` 划分等级。		 **[重要]**
+	- 新增：新增 `oidc` 协议支持。		 **[重要]**
+	- 新增：新增支持默认 `openid` 生成算法。	 **[重要]**
+	- 新增：新增 `OAuth2` 注解鉴权支持。		 **[重要]**
+	- 修复：`redirect_url` 参数校验增加规则：不允许出现@字符、*通配符只能出现在最后一位。关联 [issue](https://github.com/dromara/Sa-Token/issues/529) **[重要]**
+	- 优化：优化代码注释、异常提示信息。
+	- 升级：兼容 `Http Basic` 提交 `client` 信息的场景。感谢 github `@CuiGeekYoung` 提交的pr。
+	- 升级：兼容 `Bearer Token` 方式提交 `access_token` 和 `client_token`。
+	- 升级：适配拆分式路由。
+	- 新增：将 `scope` 字段改为 List 类型。
+	- 重构：抽离 `SaOAuth2Strategy` 全局策略接口，定义一些创建 token 的算法策略。
+	- 新增：新增 `addAllowUrls` `addContractScopes` 方法，简化 `SaClientModel` 构建代码。
+	- 重构：抽离 `SaOAuth2Dao` 接口，负责数据持久。
+	- 重构：抽离 `SaOAuth2DataLoader` 数据加载器接口。
+	- 重构：抽离 `SaOAuth2DataGenerate` 数据构造器接口。
+	- 重构：抽离 `SaOAuth2DataConverter` 数据转换器接口。
+	- 重构：抽离 `SaOAuth2DataResolver` 数据解析器接口。
+	- 重构：重构 `SaOAuth2Handle` -> `SaOAuth2ServerProcessor` 更方便的逻辑重写。
+	- 重构：重构 `PastToken` -> `LowerClientToken`。
+	- 新增：新增 `state` 值校验，同一 `state` 参数不可重复使用。
+	- 优化：完善 `SaOAuth2Util` 相关方法，更方便的二次开发。
+	- 新增：新增部分异常类，细分异常 `ClassType`。
+	- 优化：优化 `sa-token-oauth2` 异常细分状态码。
+- 文档：
+	- 新增：新增数据结构说明。
+	- 新增：新增不同 `client` 不同登录页说明。
+	- 优化：优化文档 [将权限数据放在缓存里] 示例。
+	- 新增：新增 从 Shiro、SpringSecurity、JWT 迁移 示例。  **[重要]**
+
+
 ### v1.38.0 @2024-5-12
 - sa-token-core：
 	- 修复：修复 `StpUtil.getSessionByLoginId(xx)` 参数为 null 时创建无效 `SaSession` 的 bug。
diff --git a/sa-token-doc/start/new-version.md b/sa-token-doc/start/new-version.md
index 60424752..f7c35f2c 100644
--- a/sa-token-doc/start/new-version.md
+++ b/sa-token-doc/start/new-version.md
@@ -5,14 +5,14 @@
 --- 
 
 ### 正式版本 
-v1.38.0 正式版，可上生产：
+v1.39.0 正式版，可上生产：
 
 ``` xml
 <!-- Sa-Token 权限认证 -->
 <dependency>
     <groupId>cn.dev33</groupId>
     <artifactId>sa-token-spring-boot-starter</artifactId>
-    <version>1.38.0</version>
+    <version>1.39.0</version>
 </dependency>
 ```
 
-- 
Gitee


From f9113ddce5a1ba97b692793ad99b1997c26894c8 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 12:44:10 +0800
Subject: [PATCH 166/172] =?UTF-8?q?=E5=AE=8C=E5=96=84=E8=B5=9E=E5=8A=A9?=
 =?UTF-8?q?=E8=80=85=E5=90=8D=E5=8D=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/doc.html                     |  1 +
 sa-token-doc/index.html                   | 11 +++++++
 sa-token-doc/oauth2/oauth2-questions.md   |  2 +-
 sa-token-doc/oauth2/oauth2-server.md      |  8 ++---
 sa-token-doc/static/donate/donate-list.js | 37 +++++++++++++++++++++++
 5 files changed, 54 insertions(+), 5 deletions(-)

diff --git a/sa-token-doc/doc.html b/sa-token-doc/doc.html
index 842136ff..1428fc22 100644
--- a/sa-token-doc/doc.html
+++ b/sa-token-doc/doc.html
@@ -109,6 +109,7 @@
 					</a>
 					<div class="zk-context">
 						<div>
+							<a href="https://www.bilibili.com/video/BV1nJWWeDEFN/" target="_blank">架构驿站（11集）</a>
 							<a href="https://www.bilibili.com/video/BV1Zt421u7gk/" target="_blank">王清江唷（99集）</a>
 							<a href="https://www.bilibili.com/video/BV1kG411o7Ms/" target="_blank">筑梦信仰-joy（20集）</a>
 							<a href="https://www.bilibili.com/video/BV11u4y197JL/" target="_blank">达达-Java（26集）</a>
diff --git a/sa-token-doc/index.html b/sa-token-doc/index.html
index 99a7d93a..facffd84 100644
--- a/sa-token-doc/index.html
+++ b/sa-token-doc/index.html
@@ -63,6 +63,7 @@
 						</a>
 						<div class="zk-context">
 							<div>
+								<a href="https://www.bilibili.com/video/BV1nJWWeDEFN/" target="_blank">架构驿站（11集）</a>
 								<a href="https://www.bilibili.com/video/BV1Zt421u7gk/" target="_blank">王清江唷（99集）</a>
 								<a href="https://www.bilibili.com/video/BV1kG411o7Ms/" target="_blank">筑梦信仰-joy（20集）</a>
 								<a href="https://www.bilibili.com/video/BV11u4y197JL/" target="_blank">达达-Java（26集）</a>
@@ -209,6 +210,10 @@
 									<img src="https://oss.dev33.cn/sa-token/awards/gpv.jpg?x-oss-process=style/st" /> <br>
 									<p>GVP - Gitee 最有价值开源项目</p>
 								</div>
+								<div class="swiper-slide">
+									<img src="https://oss.dev33.cn/sa-token/awards/g-star.jpg?x-oss-process=style/st" /> <br>
+									<p>GitCode G-Star 优质开源项目</p>
+								</div>
 								<div class="swiper-slide">
 									<img src="https://oss.dev33.cn/sa-token/awards/osc-2021.jpg?x-oss-process=style/st"/> <br>
 									<p>OSCHINA 2021 人气指数 TOP 30 开源项目</p>
@@ -547,6 +552,12 @@
 						<a href="https://www.jcodeyun.com/" target="_blank" title="协卓云动（深圳）数字发展有限公司">
 							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/xiezhuoyundong.png">
 						</a>
+						<a href="https://www.fakamiao.com/" target="_blank" title="秦皇岛桃猫信息科技有限责任公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/taomaoxinxi.png" style="max-height: 50%;">
+						</a>
+						<a href="https://jiagouyizhan.com/" target="_blank" title="可持续架构（菏泽）信息科技有限公司">
+							<img class="lazy" data-original="https://oss.dev33.cn/sa-token/com/jiagouyizhan.png">
+						</a>
 					</div>
 					<div style="height: 10px; clear: both;"></div>
 					<p>
diff --git a/sa-token-doc/oauth2/oauth2-questions.md b/sa-token-doc/oauth2/oauth2-questions.md
index 4c7a4f33..131f238c 100644
--- a/sa-token-doc/oauth2/oauth2-questions.md
+++ b/sa-token-doc/oauth2/oauth2-questions.md
@@ -14,7 +14,7 @@ OAuth2 集成常见问题整理
 - 统一认证登录地址是：`http://{host}:{port}/oauth2/authorize`。
 - 而你访问的却是：`http://{host}:{port}/oauth2/authorize2`。
 
-地址写错了，框架就不会处理这个请求，会直接返回 `{"msg": "not handle"}`，所有开放地址可参考：[SSO 开放接口](/oauth2/oauth2-apidoc)
+地址写错了，框架就不会处理这个请求，会直接返回 `{"msg": "not handle"}`，所有开放地址可参考：[OAuth2 开放接口](/oauth2/oauth2-apidoc)
 
 如果仔细检查地址后没有写错，却依然返回了这个信息，那有可能是对应的接口没有打开，比如说：
 
diff --git a/sa-token-doc/oauth2/oauth2-server.md b/sa-token-doc/oauth2/oauth2-server.md
index 66d0e2a7..40afd3a8 100644
--- a/sa-token-doc/oauth2/oauth2-server.md
+++ b/sa-token-doc/oauth2/oauth2-server.md
@@ -121,7 +121,7 @@ public class SaOAuth2ServerController {
 
 	// Sa-Token OAuth2 定制化配置 
 	@Autowired
-	public void setSaOAuth2Config(SaOAuth2Config oauth2Server) {
+	public void configOAuth2Server(SaOAuth2ServerConfig oauth2Server) {
 		
 		// 添加 client 信息 
 		oauth2Server.addClient(
@@ -135,7 +135,7 @@ public class SaOAuth2ServerController {
 						GrantType.implicit,  // 隐式式
 						GrantType.refresh_token,  // 刷新令牌
 						GrantType.password,  // 密码式
-						GrantType.client_credentials,  // 客户端模式
+						GrantType.client_credentials  // 客户端模式
 				)
 		);
 		
@@ -203,8 +203,8 @@ public class GlobalExceptionHandler {
 public class SaOAuth2ServerApplication {
 	public static void main(String[] args) {
 		SpringApplication.run(SaOAuth2ServerApplication.class, args);
-		System.out.println("\nSa-Token-OAuth2 Server 端启动成功");
-		System.out.println(SaOAuth2Manager.getConfig());
+		System.out.println("\nSa-Token-OAuth2 Server端启动成功，配置如下：");
+		System.out.println(SaOAuth2Manager.getServerConfig());
 	}
 }
 ```
diff --git a/sa-token-doc/static/donate/donate-list.js b/sa-token-doc/static/donate/donate-list.js
index 87ba9665..e7dcfda0 100644
--- a/sa-token-doc/static/donate/donate-list.js
+++ b/sa-token-doc/static/donate/donate-list.js
@@ -1166,4 +1166,41 @@ var donateList = [
 		"msg": '感谢您的开源项目，内部项目鉴权框架参考了您的部分设计思想（用户会话和令牌会话）。',
 		"date": "2024-07-20"
 	},
+	{
+		"name": "张磊",
+		"link": "https://gitee.com/zl18282425038",
+		"money": 1.0,
+		"msg": '感谢您的开源项目！',
+		"date": "2024-08-03"
+	},
+	{
+		"name": "老黄H",
+		"link": "https://gitee.com/lao-huang-h",
+		"money": 1.0,
+		"msg": '感谢您的开源项目我是王攀',
+		"date": "2024-08-04"
+	},
+	{
+		"name": "Chat2DB",
+		"link": "https://gitee.com/jipengfei001",
+		"money": 10.0,
+		"msg": 'https://github.com/chat2db/Chat2DB/ 数据库客户端',
+		"date": "2024-08-05"
+	},
+	
+	{
+		"name": "gentleman",
+		"link": "https://gitee.com/guoweiweigege",
+		"money": 10.0,
+		"msg": '设计简单 功能多且强大 我杜伟坤为你代言',
+		"date": "2024-08-09"
+	},
+	{
+		"name": "june",
+		"link": "https://gitee.com/june_home",
+		"money": 50.0,
+		"msg": '非常方便简单易用，感谢您的开源项目！',
+		"date": "2024-08-14"
+	},
+	
 ]
\ No newline at end of file
-- 
Gitee


From 7db36d5a970243b4a777664d80e8931ed1d991bf Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 21:30:45 +0800
Subject: [PATCH 167/172] =?UTF-8?q?=E6=96=87=E6=A1=A3=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/up/many-account.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sa-token-doc/up/many-account.md b/sa-token-doc/up/many-account.md
index f3271716..800d50a5 100644
--- a/sa-token-doc/up/many-account.md
+++ b/sa-token-doc/up/many-account.md
@@ -151,7 +151,7 @@ public class SaTokenConfigure {
     @PostConstruct
     public void rewriteSaStrategy() {
     	// 重写Sa-Token的注解处理器，增加注解合并功能 
-		SaStrategy.instance.getAnnotation = (element, annotationClass) -> {
+		SaAnnotationStrategy.instance.getAnnotation = (element, annotationClass) -> {
 			return AnnotatedElementUtils.getMergedAnnotation(element, annotationClass); 
 		};
     }
-- 
Gitee


From e3d93c7103862c1639212b2ebec2004e17075961 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Wed, 28 Aug 2024 23:08:42 +0800
Subject: [PATCH 168/172] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=96=87=E6=A1=A3?=
 =?UTF-8?q?=E9=83=A8=E5=88=86=E9=94=99=E8=AF=AF=E4=B9=8B=E5=A4=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/oauth2/oauth2-apidoc.md | 2 +-
 sa-token-doc/oauth2/oauth2-dev.md    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sa-token-doc/oauth2/oauth2-apidoc.md b/sa-token-doc/oauth2/oauth2-apidoc.md
index 6699de53..80bc1fb1 100644
--- a/sa-token-doc/oauth2/oauth2-apidoc.md
+++ b/sa-token-doc/oauth2/oauth2-apidoc.md
@@ -342,6 +342,6 @@ http://{host}:{port}/oauth2/client_token
 }
 ```
 
-注：`Client-Token`具有延迟作废特性，即：在每次获取最新`Client-Token`的时候，旧`Client-Token`不会立即过期，而是作为`Past-Token`再次储存起来，
+注：`Client-Token`具有延迟作废特性，即：在每次获取最新`Client-Token`的时候，旧`Client-Token`不会立即过期，而是作为`Lower-Client-Token`再次储存起来，
 资源请求方只要携带其中之一便可通过Token校验，这种特性保证了在大量并发请求时不会出现“新旧Token交替造成的授权失效”， 保证了服务的高可用。
 
diff --git a/sa-token-doc/oauth2/oauth2-dev.md b/sa-token-doc/oauth2/oauth2-dev.md
index 45f7097a..0d02cc41 100644
--- a/sa-token-doc/oauth2/oauth2-dev.md
+++ b/sa-token-doc/oauth2/oauth2-dev.md
@@ -107,8 +107,8 @@ SaOAuth2Util.revokeClientToken(clientToken);
 // 回收 ClientToken，根据索引： clientId
 SaOAuth2Util.revokeClientTokenByIndex(clientId);
 
-// 回收 PastToken，根据索引： clientId
-SaOAuth2Util.revokePastTokenByIndex(clientId);
+// 回收 Lower-ClientToken，根据索引： clientId
+SaOAuth2Util.revokeLowerClientTokenByIndex(clientId);
 ```
 
 --- 
-- 
Gitee


From 8c2ff8be9a63c8e90ecadb5ab32b137e0cfb8ce7 Mon Sep 17 00:00:00 2001
From: click33 <2393584716@qq.com>
Date: Thu, 29 Aug 2024 10:37:14 +0800
Subject: [PATCH 169/172] =?UTF-8?q?=E8=A1=A5=E4=B8=8A=E9=81=97=E6=BC=8F?=
 =?UTF-8?q?=E7=9A=84=E6=9B=B4=E6=96=B0=E6=97=A5=E5=BF=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sa-token-doc/more/update-log.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sa-token-doc/more/update-log.md b/sa-token-doc/more/update-log.md
index b5532a22..d09ce8b0 100644
--- a/sa-token-doc/more/update-log.md
+++ b/sa-token-doc/more/update-log.md
@@ -4,6 +4,7 @@
 - 核心：
 	- 升级：重构注解鉴权底层，支持自定义鉴权注解了。  **[重要]**
 	- 修复：修复前端提交同名 `Cookie` 时的框架错读现象。
+	- 更名：`NotBasicAuthException` -> `NotHttpBasicAuthException`。
 - 插件：
 	- 修复：修复 `sa-token-quick-login` 插件无法正常拦截的问题。
 - SSO：
-- 
Gitee


From e4fdf0a15ed5f01cfea71cb739faf9b61e0078c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AD=99=E7=BB=B4=E5=9B=BD?=
 <14083526+sun-wg@user.noreply.gitee.com>
Date: Mon, 2 Dec 2024 06:17:54 +0000
Subject: [PATCH 170/172] add CODEOWNERS.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: 孙维国 <14083526+sun-wg@user.noreply.gitee.com>
---
 CODEOWNERS | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 CODEOWNERS

diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 00000000..12258356
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1,22 @@
+# 这是一个注释。
+# 指定根目录下README文件的Code Owner
+# commiter 非项目成员 维护者 维护者 开发者 
+README.md @duxin @stars @yinlin @yanfan @gitcode_test
+
+# 指定scripts文件夹的Code Owner gitee规则
+scripts/*  @yinlin
+
+# 指定scripts文件夹的Code Owner github规则
+/scripts/*  @jiulongSQ
+
+# 指定scripts文件夹的Code Owner,不一定是根目录 gitee规则
+scripts/  @aron1
+
+# 指定scripts文件夹的Code Owner,不一定是根目录 github规则
+/scripts/  @yanfan
+
+# 指定所有JS文件的Code Owner
+*.js @stars
+
+# 指定docs文件夹的多个Code Owners
+/docs/ @username1 @username2
\ No newline at end of file
-- 
Gitee


From 9ac8f8ed338073afceb7f38a0a9098c7d238ff18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AD=99=E7=BB=B4=E5=9B=BD?=
 <14083526+sun-wg@user.noreply.gitee.com>
Date: Mon, 2 Dec 2024 06:18:18 +0000
Subject: [PATCH 171/172] add default pipeline template yaml

---
 .workflow/branch-pipeline.yml | 53 +++++++++++++++++++++++++++++++++++
 .workflow/master-pipeline.yml | 51 +++++++++++++++++++++++++++++++++
 .workflow/pr-pipeline.yml     | 40 ++++++++++++++++++++++++++
 3 files changed, 144 insertions(+)
 create mode 100644 .workflow/branch-pipeline.yml
 create mode 100644 .workflow/master-pipeline.yml
 create mode 100644 .workflow/pr-pipeline.yml

diff --git a/.workflow/branch-pipeline.yml b/.workflow/branch-pipeline.yml
new file mode 100644
index 00000000..9d2a2926
--- /dev/null
+++ b/.workflow/branch-pipeline.yml
@@ -0,0 +1,53 @@
+version: '1.0'
+name: branch-pipeline
+displayName: BranchPipeline
+stages:
+  - stage: 
+    name: compile
+    displayName: 编译
+    steps:
+      - step: build@maven
+        name: build_maven
+        displayName: Maven 构建
+        # 支持6、7、8、9、10、11六个版本
+        jdkVersion: 8
+        # 支持2.2.1、3.2.5、3.3.9、3.5.2、3.5.3、3.5.4、3.6.1、3.6.3八个版本
+        mavenVersion: 3.3.9
+        # 构建命令
+        commands:
+          - mvn -B clean package -Dmaven.test.skip=true
+        # 非必填字段，开启后表示将构建产物暂存，但不会上传到制品库中，7天后自动清除
+        artifacts:
+            # 构建产物名字，作为产物的唯一标识可向下传递，支持自定义，默认为BUILD_ARTIFACT。在下游可以通过${BUILD_ARTIFACT}方式引用来获取构建物地址
+          - name: BUILD_ARTIFACT
+            # 构建产物获取路径，是指代码编译完毕之后构建物的所在路径，如通常jar包在target目录下。当前目录为代码库根目录
+            path:
+              - ./target
+      - step: publish@general_artifacts
+        name: publish_general_artifacts
+        displayName: 上传制品
+        # 上游构建任务定义的产物名，默认BUILD_ARTIFACT
+        dependArtifact: BUILD_ARTIFACT
+        # 上传到制品库时的制品命名，默认output
+        artifactName: output
+        dependsOn: build_maven
+  - stage: 
+    name: release
+    displayName: 发布
+    steps:
+      - step: publish@release_artifacts
+        name: publish_release_artifacts
+        displayName: '发布'
+        # 上游上传制品任务的产出
+        dependArtifact: output
+        # 发布制品版本号
+        version: '1.0.0.0'
+        # 是否开启版本号自增，默认开启
+        autoIncrement: true
+triggers:
+  push:
+    branches:
+      exclude:
+        - master
+      include:
+        - .*
diff --git a/.workflow/master-pipeline.yml b/.workflow/master-pipeline.yml
new file mode 100644
index 00000000..5d926c26
--- /dev/null
+++ b/.workflow/master-pipeline.yml
@@ -0,0 +1,51 @@
+version: '1.0'
+name: master-pipeline
+displayName: MasterPipeline
+stages:
+  - stage: 
+    name: compile
+    displayName: 编译
+    steps:
+      - step: build@maven
+        name: build_maven
+        displayName: Maven 构建
+        # 支持6、7、8、9、10、11六个版本
+        jdkVersion: 8
+        # 支持2.2.1、3.2.5、3.3.9、3.5.2、3.5.3、3.5.4、3.6.1、3.6.3八个版本
+        mavenVersion: 3.3.9
+        # 构建命令
+        commands:
+          - mvn -B clean package -Dmaven.test.skip=true
+        # 非必填字段，开启后表示将构建产物暂存，但不会上传到制品库中，7天后自动清除
+        artifacts:
+            # 构建产物名字，作为产物的唯一标识可向下传递，支持自定义，默认为BUILD_ARTIFACT。在下游可以通过${BUILD_ARTIFACT}方式引用来获取构建物地址
+          - name: BUILD_ARTIFACT
+            # 构建产物获取路径，是指代码编译完毕之后构建物的所在路径，如通常jar包在target目录下。当前目录为代码库根目录
+            path:
+              - ./target
+      - step: publish@general_artifacts
+        name: publish_general_artifacts
+        displayName: 上传制品
+        # 上游构建任务定义的产物名，默认BUILD_ARTIFACT
+        dependArtifact: BUILD_ARTIFACT
+        # 上传到制品库时的制品命名，默认output
+        artifactName: output
+        dependsOn: build_maven
+  - stage: 
+    name: release
+    displayName: 发布
+    steps:
+      - step: publish@release_artifacts
+        name: publish_release_artifacts
+        displayName: '发布'
+        # 上游上传制品任务的产出
+        dependArtifact: output
+        # 发布制品版本号
+        version: '1.0.0.0'
+        # 是否开启版本号自增，默认开启
+        autoIncrement: true
+triggers:
+  push:
+    branches:
+      include:
+        - master
diff --git a/.workflow/pr-pipeline.yml b/.workflow/pr-pipeline.yml
new file mode 100644
index 00000000..3f7579dd
--- /dev/null
+++ b/.workflow/pr-pipeline.yml
@@ -0,0 +1,40 @@
+version: '1.0'
+name: pr-pipeline
+displayName: PRPipeline
+stages:
+  - stage: 
+    name: compile
+    displayName: 编译
+    steps:
+      - step: build@maven
+        name: build_maven
+        displayName: Maven 构建
+        # 支持6、7、8、9、10、11六个版本
+        jdkVersion: 8
+        # 支持2.2.1、3.2.5、3.3.9、3.5.2、3.5.3、3.5.4、3.6.1、3.6.3八个版本
+        mavenVersion: 3.3.9
+        # 构建命令
+        commands:
+          - mvn -B clean package -Dmaven.test.skip=true
+        # 非必填字段，开启后表示将构建产物暂存，但不会上传到制品库中，7天后自动清除
+        artifacts:
+            # 构建产物名字，作为产物的唯一标识可向下传递，支持自定义，默认为BUILD_ARTIFACT。在下游可以通过${BUILD_ARTIFACT}方式引用来获取构建物地址
+          - name: BUILD_ARTIFACT
+            # 构建产物获取路径，是指代码编译完毕之后构建物的所在路径，如通常jar包在target目录下。当前目录为代码库根目录
+            path:
+              - ./target
+      - step: publish@general_artifacts
+        name: publish_general_artifacts
+        displayName: 上传制品
+        # 上游构建任务定义的产物名，默认BUILD_ARTIFACT
+        dependArtifact: BUILD_ARTIFACT
+        # 构建产物制品库，默认default，系统默认创建
+        artifactRepository: default
+        # 上传到制品库时的制品命名，默认output
+        artifactName: output
+        dependsOn: build_maven
+triggers:
+  pr:
+    branches:
+      include:
+        - master
-- 
Gitee


From 138586fccf38fb01a17082fc5321fe243d2d69d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=AD=99=E7=BB=B4=E5=9B=BD?=
 <14083526+sun-wg@user.noreply.gitee.com>
Date: Wed, 4 Dec 2024 05:41:53 +0000
Subject: [PATCH 172/172] update README.md.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: 孙维国 <14083526+sun-wg@user.noreply.gitee.com>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 98c665c7..406c2248 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,4 @@
+<p>哈哈哈<p>
 <p align="center">
 	<img alt="logo" src="https://sa-token.cc/logo.png" width="150" height="150">
 </p>
-- 
Gitee