使用Spring AOP做权限控制。Service提供的方法拥有自定义注解信息做权限控制,根据请求的权限,匹配方法上的权限。
权限信息类:Privilege
自定义注解类:PrivlegeInfo
注解解析类 : AnnotationParse
权限控制切面类:PrivilegeAspect
方法的接口/实现类:PersonService/PersonServiceImpl
调用测试类:PrivilegeTest
Spring AOP配置文件:applicationContext.xml
Privilege:
package com.tgb.spring.aop.xml.privilege.bean;
public class Privilege {
private String name ;
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}
PrivlegeInfo:
package com.tgb.spring.aop.xml.privilege.annotation;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
//zheg 只能出现在方法上
//作用域范围
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface PrivlegeInfo {
String name () default "";
}
AnnotationParse:
package com.tgb.spring.aop.xml.privilege.annotation;
import java.lang.reflect.Method;
public class AnnotationParse {
/**
* targetClass 目标类的class字节码文件
* methodName 在客户端调用哪个 方法,methodname
* @throws SecurityException
* @throws NoSuchMethodException
*/
public static String parse(Class targetClass,String mthodName) throws NoSuchMethodException, SecurityException{
String methodAccess="";
/**
* 该方法没有参数
*/
Method method= targetClass.getMethod(mthodName);
//判断传入的字节码文件的方法上是否 有 PrivilegeInfo注解
if(method.isAnnotationPresent(PrivlegeInfo.class)){
//得到方法上面的注解
PrivlegeInfo privlegeInfo= method.getAnnotation(PrivlegeInfo.class);
methodAccess = privlegeInfo.name();
}
return methodAccess;
}
}
PrivilegeAspect:
package com.tgb.spring.aop.xml.privilege.aspect;
import java.util.ArrayList;
import java.util.List;
import org.aspectj.lang.ProceedingJoinPoint;
import com.tgb.spring.aop.xml.privilege.annotation.AnnotationParse;
import com.tgb.spring.aop.xml.privilege.bean.Privilege;
public class PrivilegeAspect {
/**
* 用户拥有的权限
*/
private List<Privilege> privileges = new ArrayList<Privilege>();
public List<Privilege> getPrivileges() {
return privileges;
}
public void setPrivileges(List<Privilege> privileges) {
this.privileges = privileges;
}
public void isAccessMethod(ProceedingJoinPoint joinPoint) throws Throwable{
/**
* 1.获取访问目标方法应该具备的权限
* 得到:
* 1.目标类的class形式
* 2.方法的名称
*/
Class targetClass = joinPoint.getTarget().getClass();
String methodName=joinPoint.getSignature().getName();
//得到访问该方法的权限
String methodAccess= AnnotationParse.parse(targetClass, methodName);
boolean flag=false;
//遍历用户所有权限,查看是否有访问该方法的权限
for (Privilege privilege : privileges){
//该用户能访问目标方法
if(methodAccess.equals(privilege.getName())){
flag=true;
}
}
if(flag){
//开放访问权限
joinPoint.proceed();
}else{
System.out.println("无权限访问!");
}
};
}
PersonService:
package com.tgb.spring.aop.xml.privilege.service;
public interface PersonService {
public void savePerson();
public void updatePerson();
}
PersonServiceImpl:
package com.tgb.spring.aop.xml.privilege.serviceImpl;
import com.tgb.spring.aop.xml.privilege.annotation.PrivlegeInfo;
import com.tgb.spring.aop.xml.privilege.service.PersonService;
public class PersonServiceImpl implements PersonService {
@PrivlegeInfo(name="savePerson")
public void savePerson() {
// TODO Auto-generated method stub
System.out.println("save person!");
}
@PrivlegeInfo(name="updatePerson")
public void updatePerson() {
// TODO Auto-generated method stub
System.out.println("update person!");
}
}
PrivilegeTest:
package com.tgb.spring.aop.xml.privilege.test;
import org.junit.Test;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import com.tgb.spring.aop.xml.privilege.aspect.PrivilegeAspect;
import com.tgb.spring.aop.xml.privilege.bean.Privilege;
import com.tgb.spring.aop.xml.privilege.service.PersonService;
public class PrivilegeTest {
@Test
public void testPrivilege(){
ApplicationContext context= new ClassPathXmlApplicationContext("applicationContext.xml");
/**
* 初始化用户权限
*/
PrivilegeAspect privilegeAspect =(PrivilegeAspect)context.getBean("privilegeAspect");
Privilege privilege1=new Privilege();
privilege1.setName("savePerson");
Privilege privilege2=new Privilege();
privilege2.setName("updatePerson");
privilegeAspect.getPrivileges().add(privilege1);
privilegeAspect.getPrivileges().add(privilege2);
PersonService personSerive =(PersonService)context.getBean("personService");
personSerive.savePerson();
}
}
applicationContext.xml:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/aop
http://www.springframework.org/schema/aop/spring-aop-2.5.xsd">
<bean id="personService" class="com.tgb.spring.aop.xml.privilege.serviceImpl.PersonServiceImpl"></bean>
<bean id="privilegeAspect" class="com.tgb.spring.aop.xml.privilege.aspect.PrivilegeAspect"></bean>
<aop:config>
<aop:pointcut expression="execution(* com.tgb.spring.aop.xml.privilege.serviceImpl.*.*(..))" id="perform"/>
<aop:aspect ref="privilegeAspect">
<aop:around method="isAccessMethod" pointcut-ref="perform"/>
</aop:aspect>
</aop:config>
</beans>