权限判断Interception

网站鉴权

拦截器验证登录

package com.solo.manages.config;

//实现spring提供的拦截器类
public class InterceptorLogin implements HandlerInterceptor {

    private SlMenuMapper menuMapper;

    private SlManagerPermissionMapper managerPermissionMapper;

    private SlRolePermissionMapper rolePermissionMapper;

    private SlPermissionMapper permissionMapper;

	//这个类是spring对redis封装好的操作类
    private ValueOperations<String, String> valueOperations;

    private RedisTemplate<String, String> redisTemplate;

    private SlManageMapper manageMapper;

    private Boolean needLogin;

    private static final Logger LOG = LoggerFactory.getLogger(InterceptorLogin.class);

    private static final SimpleDateFormat sdf = new SimpleDateFormat(TimeUtils.TIME_PATTERN_yyyy_MM_DD_HH_mm_ss);

    public InterceptorLogin(ValueOperations valueOperations, RedisTemplate redisTemplate, SlManageMapper manageMapper, Boolean needLogin, SlMenuMapper menuMapper, SlManagerPermissionMapper managerPermissionMapper, SlRolePermissionMapper rolePermissionMapper, SlPermissionMapper permissionMapper) {
        this.valueOperations = valueOperations;
        this.redisTemplate = redisTemplate;
        this.manageMapper = manageMapper;
        this.needLogin = needLogin;
        this.menuMapper = menuMapper;
        this.managerPermissionMapper = managerPermissionMapper;
        this.rolePermissionMapper = rolePermissionMapper;
        this.permissionMapper = permissionMapper;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    	//swagger自动生成文档接口调试
        if (request.getRequestURI().contains(RequestErrorCodeConst.ChangeBindUid.DOC_STR)){
            //放行swagger文档访问
            return true;
        }
        if (needLogin != null && !needLogin){
            return true;
        }
        //设置请求与响应编码
        request.setCharacterEncoding("UTF-8");
        response.setCharacterEncoding("UTF-8");
        //拿到请求的sessionid
        String sessionid = request.getHeader(ConfigConst.Token.SESSION_KEY_IN_HEADER);
        if (sessionid == null) {
            String resultTip = JsonUtils.buildJsonResult("-2", "Please login before request");
            response.getWriter().write(resultTip);
            return false;
        }
        LOG.info("登录人sessionId:" + sessionid);
        String microManage;
        String key = ConfigConst.Token.TOKEN_CACHE_PREFIX + sessionid;
        try {
            microManage = valueOperations.get(key);
            LOG.info("管理员信息:" + microManage + ",key:" + key);
        } catch (Exception e) {
            LOG.error("【拦截器】连接Redis服务器超时[{}], [{}]", e.getMessage(), sdf.format(System.currentTimeMillis()));
            String resultTip = JsonUtils.buildJsonResult("-2", "Please try again");
            response.getWriter().write(resultTip);
            return false;
        }
        if (microManage == null) {
            String resultTip = JsonUtils.buildJsonResult("-2", "Please login before request");
            response.getWriter().write(resultTip);
            return false;
        }
        ManagerMessage mm = JSON.parseObject(microManage, ManagerMessage.class);
        SlManage manage = manageMapper.selectByPrimaryKey(Integer.valueOf(AESUtils.AESDecode(ConfigKit.getConfigKit().getConfigContent(ConfigKey.AES_KEY), mm.getManager_id())));
        if (manage == null) {
            String resultTip = JsonUtils.buildJsonResult("-3", "Invalid token");
            response.getWriter().write(resultTip);
            return false;
        }

		//获取到拦截器handler对象
		//在springmvc mapping中，每个请求都会和一个控制器方法mapping起来，而这个handler也会被包含在请求体中传给controller，可以再controller的参数栏中获取到这个handler
        HandlerMethod handlerMethod = (HandlerMethod)handler;
		//这里的OperationPermission是一个注解类，这样注解了这个类的对象就会进入权限判断
		//这里判断的是访问的控制器方法是否有注解
        OperationPermission methodAnnotation = handlerMethod.getMethodAnnotation(OperationPermission.class);
        // 如果方法没有加注解，则可以访问
        if (methodAnnotation == null){
            return true;
        }

        if (methodAnnotation != null) {
            //在类上寻找注解
            //通过getBeanType获取类，然后获取到类上的注解
            OperationPermission classAnnotation = handlerMethod.getBeanType().getAnnotation(OperationPermission.class);
            if (classAnnotation == null){
                throw new RuntimeException("方法有注解但类没有注解:"+handlerMethod.getMethod().getName());
            }
            //获取注解里的menu值对应的权限（这里的menu代表某个大菜单主界面）
            SlPermission menuPermission = permissionMapper.selectByUrl(classAnnotation.menu());
            //获取注解里的method值（这里的method代表接口地址）
            SlPermission methodPermission = permissionMapper.selectByUrl(methodAnnotation.method());

            if (menuPermission == null || methodPermission == null){
                throw new RuntimeException("接口权限未正确配置，请配置后重试");
            }

            List<SlManagerPermission> managerPermissions = managerPermissionMapper.selectByManagerId(manage.getId());
            List<SlRolePermission> rolePermissions = rolePermissionMapper.selectByRole(manage.getRole());
            List<Integer> managerPermissionIds = managerPermissions.stream().map(t -> t.getPermissionId()).collect(Collectors.toList());
            List<Integer> rolePermissionIds = rolePermissions.stream().map(t -> t.getPermissionId()).collect(Collectors.toList());
            if(CollectionUtils.isEmpty(managerPermissionIds) && CollectionUtils.isEmpty(rolePermissionIds)){
                return false;
            }

            managerPermissionIds.addAll(rolePermissionIds);

            if (managerPermissionIds.contains(menuPermission.getId()) && managerPermissionIds.contains(methodPermission.getId())){
                return true;
            }
            throw new RuntimeException("权限不足，请联系相关人员添加权限");
        }
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable ModelAndView modelAndView) throws Exception {

    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {

    }
}