Merge pull request #6778 from dataease/pr@dev-v2@perf_embedded_limit

Pr@dev v2@perf embedded limit

de-xpack

@@ -1 +1 @@
-Subproject commit b97e7263b7e763e5a513f6abfe8c3152f6091d75
+Subproject commit 411c21f3228c89e60cbf90d90ace4e1a905e9016

sdk/api/api-permissions/src/main/java/io/dataease/api/permissions/embedded/api/EmbeddedApi.java

@@ -27,4 +27,7 @@ public interface EmbeddedApi {
 
     @PostMapping("/reset")
     void reset(@RequestBody EmbeddedResetRequest request);
+
+    @GetMapping("/domainList")
+    List<String> domainList();
 }

sdk/common/src/main/java/io/dataease/auth/interceptor/CorsConfig.java

@@ -1,6 +1,7 @@
 package io.dataease.auth.interceptor;
 
 import io.dataease.constant.AuthConstant;
+import jakarta.annotation.Resource;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.bind.annotation.RestController;
@@ -13,12 +14,16 @@ import java.util.List;
 @Configuration
 public class CorsConfig implements WebMvcConfigurer {
 
+    @Resource(name = "deCorsInterceptor")
+    private CorsInterceptor corsInterceptor;
+
     @Value("#{'${dataease.origin-list}'.split(',')}")
     private List<String> originList;
 
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(new CorsInterceptor(originList)).addPathPatterns("/**");
+        corsInterceptor.addOriginList(originList);
+        registry.addInterceptor(corsInterceptor).addPathPatterns("/**");
     }
 
     @Override

sdk/common/src/main/java/io/dataease/auth/interceptor/CorsInterceptor.java

@@ -1,27 +1,73 @@
 package io.dataease.auth.interceptor;
 
+import cn.hutool.core.util.ReflectUtil;
+import io.dataease.utils.CommonBeanFactory;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Component;
 import org.springframework.web.servlet.HandlerInterceptor;
 
+import java.util.ArrayList;
 import java.util.List;
 
+@Component("deCorsInterceptor")
 public class CorsInterceptor implements HandlerInterceptor {
 
 
-    private List<String> originList;
+    private final List<String> originList;
+
+    private final List<String> busiOriginList = new ArrayList<>();
+
+    private Class<?> aClass;
+
+    private Object bean;
+
 
     public CorsInterceptor(List<String> originList) {
         this.originList = originList;
     }
 
+    public void addOriginList(List<String> list) {
+        List<String> strings = list.stream().filter(item -> !originList.contains(item)).toList();
+        originList.addAll(strings);
+    }
+
+
+    public void addOriginList() {
+        String className = "io.dataease.api.permissions.embedded.api.EmbeddedApi";
+        String methodName = "domainList";
+        if (ObjectUtils.isEmpty(aClass)) {
+            try {
+                aClass = Class.forName(className);
+            } catch (ClassNotFoundException e) {
+                return;
+            }
+        }
+        if (ObjectUtils.isEmpty(bean)) {
+            bean = CommonBeanFactory.getBean(aClass);
+        }
+        if (ObjectUtils.isNotEmpty(bean)) {
+            Object result = ReflectUtil.invoke(bean, methodName);
+            if (ObjectUtils.isNotEmpty(result)) {
+                List<String> list = (List<String>) result;
+                if (CollectionUtils.isNotEmpty(list)) {
+                    List<String> strings = list.stream().filter(item -> !busiOriginList.contains(item)).toList();
+                    busiOriginList.addAll(strings);
+                }
+
+            }
+        }
+    }
+
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
-
+        addOriginList();
         String origin = request.getHeader("Origin");
         boolean embedded = StringUtils.startsWithAny(request.getRequestURI(), "/assets/", "/js/");
-        if ((StringUtils.isNotBlank(origin) && originList.contains(origin)) || embedded) {
+        if ((StringUtils.isNotBlank(origin) && originList.contains(origin)) || busiOriginList.contains(origin) || embedded) {
             response.setHeader("Access-Control-Allow-Origin", embedded ? "*" : origin);
             response.setHeader("Access-Control-Allow-Credentials", "true");
             response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS");