From 940caedea862fedef87865d75363c732897f8396 Mon Sep 17 00:00:00 2001
From: wanghanlin <1533525126@qq.com>
Date: Tue, 18 Aug 2026 10:57:34 +0800
Subject: [PATCH] =?UTF-8?q?feat(=E9=83=A8=E7=BD=B2):=20=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E9=9D=99=E6=80=81=E8=B5=84=E6=BA=90=E5=85=8D=E8=AE=A4=E8=AF=81?=
 =?UTF-8?q?=E8=AE=BF=E9=97=AE=E4=B8=8E=E6=89=93=E5=8C=85=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pom.xml 将 static/** 单独作为资源目录，关闭 filtering 并指定 targetPath 避免平铺到 classes 根目录
- JwtAuthFilter 跳过首页与静态资源路径，避免管理后台密钥误校验产生 WARN 日志
- SecurityConfig 放行 /、/index.html、/assets/**、/sdk/** 等静态资源与首页
---
 pom.xml                                              |  9 +++++++++
 .../com/wok/supportbot/security/JwtAuthFilter.java   | 12 +++++++++---
 .../com/wok/supportbot/security/SecurityConfig.java  |  3 +++
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 049bd72..08f9462 100644
--- a/pom.xml
+++ b/pom.xml
@@ -203,6 +203,15 @@
             <resource>
                 <directory>src/main/resources</directory>
                 <filtering>true</filtering>
+                <excludes>
+                    <exclude>static/**</exclude>
+                </excludes>
+            </resource>
+            <resource>
+                <directory>src/main/resources/static</directory>
+                <!-- 必须指定 targetPath，否则文件会被平铺到 target/classes/ 根目录，而不是 target/classes/static/ -->
+                <targetPath>static</targetPath>
+                <filtering>false</filtering>
             </resource>
         </resources>
         <plugins>
diff --git a/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java b/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
index f573702..504d168 100644
--- a/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
+++ b/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
@@ -63,13 +63,19 @@ public class JwtAuthFilter extends OncePerRequestFilter {
     }
 
     /**
-     * 跳过 SDK 路径 — 这些路径由 SdkAuthFilter 使用独立的 jwt.sdk-secret 验签，
-     * 不应由本 Filter 用管理后台密钥重复验证，避免产生误报 WARN 日志。
+     * 跳过 SDK 路径和静态资源路径 — 这些路径要么由 SdkAuthFilter 使用独立的 jwt.sdk-secret 验签，
+     * 要么是不需要认证的首页/前端资源，不应由本 Filter 用管理后台密钥重复验证，避免产生误报 WARN 日志。
      */
     @Override
     protected boolean shouldNotFilter(HttpServletRequest request) {
         String path = request.getServletPath();
-        return path.startsWith("/ai/");
+        return path.startsWith("/ai/")
+            || path.isEmpty() || path.equals("/")
+            || path.equals("/index.html")
+            || path.startsWith("/assets/")
+            || path.startsWith("/sdk/")
+            || path.equals("/favicon.ico")
+            || path.equals("/favicon.svg");
     }
 
     /**
diff --git a/src/main/java/com/wok/supportbot/security/SecurityConfig.java b/src/main/java/com/wok/supportbot/security/SecurityConfig.java
index 926d3bc..e850e1a 100644
--- a/src/main/java/com/wok/supportbot/security/SecurityConfig.java
+++ b/src/main/java/com/wok/supportbot/security/SecurityConfig.java
@@ -44,6 +44,9 @@ public class SecurityConfig {
             .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
                 // ========== 公开接口（无需认证） ==========
+                // 静态资源与首页（放在最前面，优先匹配）
+                .requestMatchers("/", "/index.html", "/favicon.ico", "/favicon.svg").permitAll()
+                .requestMatchers("/assets/**", "/sdk/**").permitAll()
                 // SDK 对话接口
                 // SdkAuthFilter 作为 Servlet Filter 已在 SecurityFilterChain 之前执行，
                 // 校验通过时已放行，校验失败时已返回 401，不会到达此处。