AOP权限控制

 

               使用Spring AOP做权限控制。Service提供的方法拥有自定义注解信息做权限控制，根据请求的权限，匹配方法上的权限。

               权限信息类：Privilege

               自定义注解类：PrivlegeInfo

                注解解析类  ： AnnotationParse

               权限控制切面类：PrivilegeAspect      

               方法的接口/实现类：PersonService/PersonServiceImpl

               调用测试类：PrivilegeTest

     

              Spring AOP配置文件：applicationContext.xml

Privilege：

package com.tgb.spring.aop.xml.privilege.bean;

public class Privilege {

	private String name ;

	public String getName() {
		return name;
	}

	public void setName(String name) {
		this.name = name;
	}
	
}

PrivlegeInfo：

package com.tgb.spring.aop.xml.privilege.annotation;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
//zheg 只能出现在方法上
//作用域范围
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface PrivlegeInfo {

	String name () default "";
	
}

AnnotationParse：

package com.tgb.spring.aop.xml.privilege.annotation;

import java.lang.reflect.Method;

public class AnnotationParse {

	/**
	 * targetClass  目标类的class字节码文件
	 * methodName 在客户端调用哪个 方法，methodname
	 * @throws SecurityException 
	 * @throws NoSuchMethodException 
	 */
	public static String parse(Class targetClass,String mthodName) throws NoSuchMethodException, SecurityException{
		
		String methodAccess="";
		/**
		 * 该方法没有参数
		 */
      Method method= targetClass.getMethod(mthodName);
      //判断传入的字节码文件的方法上是否 有 PrivilegeInfo注解
       if(method.isAnnotationPresent(PrivlegeInfo.class)){
    	   //得到方法上面的注解
    	  PrivlegeInfo privlegeInfo=  method.getAnnotation(PrivlegeInfo.class);
    	  methodAccess = privlegeInfo.name();
       }
       return methodAccess;
	}
}

PrivilegeAspect：

package com.tgb.spring.aop.xml.privilege.aspect;

import java.util.ArrayList;
import java.util.List;

import org.aspectj.lang.ProceedingJoinPoint;

import com.tgb.spring.aop.xml.privilege.annotation.AnnotationParse;
import com.tgb.spring.aop.xml.privilege.bean.Privilege;

public class PrivilegeAspect {
	/**
	 * 用户拥有的权限
	 */
	private List<Privilege> privileges = new ArrayList<Privilege>();
	

    public List<Privilege> getPrivileges() {
		return privileges;
	}

	public void setPrivileges(List<Privilege> privileges) {
		this.privileges = privileges;
	}


public void isAccessMethod(ProceedingJoinPoint joinPoint) throws Throwable{
        /**
         * 1.获取访问目标方法应该具备的权限
         *      得到：
         *        1.目标类的class形式
         *        2.方法的名称	  
         */
 	  Class targetClass = joinPoint.getTarget().getClass();
 	  String methodName=joinPoint.getSignature().getName();
 	  
 	  //得到访问该方法的权限
 	  String methodAccess= AnnotationParse.parse(targetClass, methodName);
 	  
 	  boolean flag=false;
	  //遍历用户所有权限，查看是否有访问该方法的权限
 	  for (Privilege privilege : privileges){
 		  //该用户能访问目标方法
 		  if(methodAccess.equals(privilege.getName())){
 			  flag=true;
 			  
 		  }
 	  }
	  
 	  if(flag){
 		  //开放访问权限
 		  joinPoint.proceed();
 		  
 	  }else{
 		  System.out.println("无权限访问！");
 	  }
	  
  };
	
	
}

PersonService：

package com.tgb.spring.aop.xml.privilege.service;

public interface PersonService {
        public void savePerson();
        public void updatePerson();
}

PersonServiceImpl：

package com.tgb.spring.aop.xml.privilege.serviceImpl;

import com.tgb.spring.aop.xml.privilege.annotation.PrivlegeInfo;
import com.tgb.spring.aop.xml.privilege.service.PersonService;

public class PersonServiceImpl implements PersonService {
    @PrivlegeInfo(name="savePerson")
	public void savePerson() {
		// TODO Auto-generated method stub
		System.out.println("save person!");
	}
     @PrivlegeInfo(name="updatePerson")
	public void updatePerson() {
		// TODO Auto-generated method stub
		System.out.println("update person!");
	}
       
}

PrivilegeTest：

package com.tgb.spring.aop.xml.privilege.test;

import org.junit.Test;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import com.tgb.spring.aop.xml.privilege.aspect.PrivilegeAspect;
import com.tgb.spring.aop.xml.privilege.bean.Privilege;
import com.tgb.spring.aop.xml.privilege.service.PersonService;

public class PrivilegeTest {

	@Test
	public void testPrivilege(){
		ApplicationContext context= new ClassPathXmlApplicationContext("applicationContext.xml");
		
		/**
		 * 初始化用户权限
		 */
		PrivilegeAspect privilegeAspect =(PrivilegeAspect)context.getBean("privilegeAspect");
		Privilege privilege1=new Privilege();
		privilege1.setName("savePerson");
		
		Privilege privilege2=new Privilege();
		privilege2.setName("updatePerson");
		
		privilegeAspect.getPrivileges().add(privilege1);
		privilegeAspect.getPrivileges().add(privilege2);
		
		
		PersonService personSerive =(PersonService)context.getBean("personService");
		
		personSerive.savePerson();
	}
}

applicationContext.xml：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	   xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
           http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
           http://www.springframework.org/schema/aop 
           http://www.springframework.org/schema/aop/spring-aop-2.5.xsd">
  	
  	<bean id="personService" class="com.tgb.spring.aop.xml.privilege.serviceImpl.PersonServiceImpl"></bean>
 
    <bean id="privilegeAspect" class="com.tgb.spring.aop.xml.privilege.aspect.PrivilegeAspect"></bean>
    
    <aop:config>
      <aop:pointcut expression="execution(* com.tgb.spring.aop.xml.privilege.serviceImpl.*.*(..))" id="perform"/>
      
      <aop:aspect ref="privilegeAspect">
          <aop:around method="isAccessMethod" pointcut-ref="perform"/>
      </aop:aspect>   
    
    </aop:config>
 
</beans>