补充token代码上传

alien-gateway/src/main/java/shop/alien/gateway/config/JwtTokenFilter.java

@@ -33,6 +33,7 @@ import shop.alien.util.common.JwtUtil;
 
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
@@ -145,7 +146,7 @@ public class JwtTokenFilter implements GlobalFilter, Ordered {
                     if ("store".equals(deviceType) || "storePlatform".equals(deviceType)) {
                         //判断程序是否为用户禁用
                         StoreUser storeUser = storeUserMapper.selectOne(new LambdaQueryWrapper<StoreUser>().eq(StoreUser::getPhone, phone));
-                        if (storeUser.getStatus() == 1) {
+                        if (storeUser != null && storeUser.getStatus() == 1) {
                             map.put("msg", "你的账号已被禁用");
                             //别问, 问就是约定俗成
                             map.put("code", 777);
@@ -239,26 +240,24 @@ public class JwtTokenFilter implements GlobalFilter, Ordered {
 
     private Mono<Void> allowChain(ServerWebExchange exchange, GatewayFilterChain chain) {
         return chain.filter(exchange).then(Mono.fromRunnable(() -> {
-            exchange.getResponse().getHeaders().entrySet().stream()
-                    .filter(kv -> (kv.getValue() != null && kv.getValue().size() > 1))
-                    .filter(kv -> (kv.getKey().equals(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN)
-                            || kv.getKey().equals(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS)
-                            || kv.getKey().equals(HttpHeaders.VARY)))
-                    .forEach(kv -> {
-                        // Vary只需要去重即可
-                        if (kv.getKey().equals(HttpHeaders.VARY))
-                            kv.setValue(kv.getValue().stream().distinct().collect(Collectors.toList()));
-                        else {
-                            List<String> value = new ArrayList<>();
-                            if (kv.getValue().contains(ANY)) {  //如果包含*，则取*
-                                value.add(ANY);
-                                kv.setValue(value);
-                            } else {
-                                value.add(kv.getValue().get(0)); // 否则默认取第一个
-                                kv.setValue(value);
-                            }
-                        }
-                    });
+            try {
+                HttpHeaders headers = exchange.getResponse().getHeaders();
+                for (String name : Arrays.asList(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, HttpHeaders.VARY)) {
+                    List<String> values = headers.get(name);
+                    if (values == null || values.size() <= 1) continue;
+                    List<String> newValue;
+                    if (HttpHeaders.VARY.equals(name)) {
+                        newValue = values.stream().distinct().collect(Collectors.toList());
+                    } else {
+                        newValue = new ArrayList<>();
+                        newValue.add(values.contains(ANY) ? ANY : values.get(0));
+                    }
+                    headers.put(name, newValue);
+                }
+            } catch (Exception e) {
+                // 响应已提交或 headers 不可写时忽略，避免 UnsupportedOperationException 等打断链路
+                log.debug("allowChain 整理 CORS 头失败（可能响应已提交）: {}", e.getMessage());
+            }
         }));
     }