8-9智能商贸-权限和菜单

1.课程介绍
1. 权限判断(掌握)
2. 菜单配置(掌握)

一,权限判断

拿到所有用户

 //登陆认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        //身份 username
        Object username = authenticationToken.getPrincipal();
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username1 = token.getUsername();

        //通过用户名得到密码 admin 从数据库读取数据 --根据用户名去查询用户的方法

        Employee employee = employeeService.getEmployeeByUsername(username1);
        if(employee == null){
            return null;
        }
        System.out.println(employee.getPassword());
        //添加颜值
        ByteSource salt = ByteSource.Util.bytes("itsource");
        //得到simpleAuthenticationInfo
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(employee,employee.getPassword(),salt,getName());


        return simpleAuthenticationInfo;
    }

UserContext:设置与拿到当前登录用户
放入到session中去

//工具
public class UserContext {

    public static final String USER_IN_SESSION = "loginUser";

    //存入session
    public static void setUser(Employee loginUser){
        Subject subject = SecurityUtils.getSubject();
        subject.getSession().setAttribute(USER_IN_SESSION, loginUser);
    }

    //取出session
    public static Employee getUser(){
        Subject subject = SecurityUtils.getSubject();
        return (Employee) subject.getSession().getAttribute(USER_IN_SESSION);
    }
}

根据当前用户拿到当前用户对应的id

public interface IPermissionService extends IBaseService<Permission,Long>{

    //根据当前登录的用户 查询用户自己的权限
    public Set<String> findPermissionsByLoginUser(Long id);

}

权限判断Ajax请求和自定义权限拦截器

public class AisellPermissionAuthorizationFilter extends PermissionsAuthorizationFilter {
    //Ctrl+o复写方法
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        //得到主体
        Subject subject = this.getSubject(request, response);
        //判断主体是否为空
        if(subject.getPrincipal()==null){
        //登录失败的操作
            this.saveRequestAndRedirectToLogin(request,response);
        }else {
            //如果拦截请求是ajax请求,就返回json处理 否者就返回页面

            HttpServletRequest req = (HttpServletRequest) request;

            HttpServletResponse resp =(HttpServletResponse) response;

            //获取请求头
            String header = req.getHeader("X-Requested-With");


            if ("XMLHttpRequest".equals(header)){
                //设置类型和编码

                resp.setContentType("text/json;charset=UTF-8");
                resp.getWriter().print("{\"success\":false,\"msg\":\"没有权限\"}");
            }else {
                //返回页面
                String unauthorizedUrl = this.getUnauthorizedUrl();
                if (StringUtils.hasText(unauthorizedUrl)) {
                    WebUtils.issueRedirect(request, response, unauthorizedUrl);
                } else {
                    WebUtils.toHttp(response).sendError(401);
                }
            }
        }


        return false;


    }

}

静态资源放行

public class AisellFilterChainDefinitionMapBuilder {
    //注入
    @Autowired
    private IPermissionService permissionService;


    public Map buildFilterChaiDefinitionMap(){
        //map要顺序要求
        /**
         */
        Map mp = new LinkedHashMap();
        mp.put("/login","anon");
        mp.put("*.js","anon");
        mp.put("*.css","anon");
        mp.put("/css/**","anon");
        mp.put("/js/**","anon");
        mp.put("/easyui/**","anon");
        mp.put("/images/**","anon");

        mp.put("/s/login.jsp","anon");

       //从数据库查询出来放入shiro不能写死
        List<Permission> permissions = permissionService.findAll();
        //取出所有url和sn
        for (Permission permission : permissions) {
            String url = permission.getUrl();
            String sn = permission.getSn();
            mp.put(url,"aisellPerm["+sn+"]");


        }
        mp.put("/**","authc");
        return mp;


    }
}

二,菜单读取

menu

@Entity
@Table(name = "menu")
public class Menu extends BaseDomain{
    private String name;
    private String url;
    private String icon;

    //懒加载
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "parent_id")
    //加载json时忽略
    private Menu parent;


    //表示临时的属性
    @Transient
    private List<Menu> children = new ArrayList<>();
    下面是get,set

然后配置permission

 //加载方式懒加载
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "menu_id")
    private Menu menu;

MenuRepository

public interface MenuRepository extends BaseRepository<Menu,Long>{

    @Query("select m from Employee e join e.roles er join er.permissions p join p.menu m where e.id = ?1 ")
    public List<Menu> findMenuByLoginUser(Long userid);
}

MenuService
思路就是,判断每个不同用户下面有没有父菜单,有就添加子菜单,没有就添加父菜单

public class MenuServiceImpl extends BaseServiceImpl<Menu,Long> implements IMenuService {

    @Autowired
    private MenuRepository menuRepository;



    @Override
    public List<Menu> findMenuByLoginUser(Long userid) {
        //查询所有子菜单
        List<Menu> childrenList = menuRepository.findMenuByLoginUser(userid);

        //创建一个集合放父菜单
        List<Menu> perentList = new ArrayList<>();
        //拿到所有菜单
        for (Menu childrenMenu : childrenList) {
            //得到父菜单
            Menu parent = childrenMenu.getParent();
            //判断时候有父菜单,没有就添加,有就添加子菜单
            if (!perentList.contains(parent)){

                perentList.add(parent);
            }
                parent.getChildren().add(childrenMenu);

        }

        return perentList;
    }
}

MenuController

 @RequestMapping("/findMenuByLoginUser")
    @ResponseBody
    public List<Menu> findMenuByLoginUser(){
        Employee employee = UserContext.getUser();
        //根据登陆用户的id 查询菜单
        return  menuService.findMenuByLoginUser(employee.getId());
    }