macrozheng/mall
mall项目是一套电商系统，包括前台商城系统及后台管理系统，基于Spring Boot+MyBatis实现，采用Docker容器化部署。 前台商城系统包含首页门户、商品推荐、商品搜索、商品展示、购物车、订单流程、会员中心、客户服务、帮助中心等模块。 后台管理系统包含商品管理、订单管理、会员管理、促销管理、运营管理、内容管理、统计报表、财务管理、权限管理、设置等模块。
How mall is put together
mall is a full e-commerce platform (admin back-office + storefront APIs) built as a multi-module Maven project on Java 17 and Spring Boot 3.5.14. It is split into shared libraries (mall-common utilities, mall-mbg MyBatis Generator persistence layer, mall-security Spring Security wrapper) and three runnable services: mall-admin (back-office REST API), mall-search (Elasticsearch product search), and mall-portal (storefront API), plus mall-demo for framework testing. Each service follows a Controller -> Service -> DAO/Mapper layering over MySQL via MyBatis, with Redis caching, RabbitMQ messaging, MongoDB, and Elasticsearch as supporting stores. Deployment is containerized via the fabric8 docker-maven-plugin building images at package time against a remote Docker host.
Languages
Frameworks
Datastores
Infrastructure
Major components
mall-common
Shared utility classes, common web/Redis/validation configuration, and logback logging setup used by all modules.
mall-mbg
MyBatis Generator-produced database access layer (models, mappers, example queries) plus the custom CommentGenerator and Generator entry point.
mall-security
Reusable Spring Security packaging providing JWT authentication and dynamic URL-based authorization (DynamicSecurityService) consumed by other modules.
mall-admin
Back-office management REST API covering products (PMS), orders (OMS), promotions (SMS), content (CMS), users/roles/resources (UMS), and file upload to OSS/MinIO.
mall-search
Product search service that indexes product data into Elasticsearch and serves search queries (EsProductDao).
mall-portal
Storefront-facing REST API for home page content, products, shopping cart, orders, and member/coupon flows (PortalOrderDao, HomeDao, SmsCouponHistoryDao).
mall-demo
Test/sandbox module exercising Thymeleaf and Spring Security integration during framework setup.
document/
Deployment assets: docker-compose env/app files, nginx.conf, logstash.conf, shell scripts, full mall.sql schema, Postman collections, and design docs.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
JwtAuthenticationTokenFilter (applies to every authenticated /admin/* route, e.g. POST /admin/update/{id}, POST /order/update/delivery)
A deactivated or locked-out administrator keeps full API access for the remaining lifetime of their JWT, defeating account disablement as a revocation control.
Fix: In JwtAuthenticationTokenFilter, after loadUserByUsername and before setting the SecurityContext, reject the request when userDetails.isEnabled() is false (and ideally also check isAccountNonLocked/isCredentialsNonExpired), or run the token through an AuthenticationProvider that enforces the DefaultPreAuthenticationChecks.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required