springboot实现用户的CRUD和用自定义注解实现接口权限控制最简单的demo

一.前期配置

1.pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.5</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.example</groupId>
    <artifactId>demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>demo</name>
    <description>demo</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <!--SMS-->
        <dependency>
            <groupId>com.aliyun</groupId>
            <artifactId>aliyun-java-sdk-core</artifactId>
            <version>4.5.16</version>
        </dependency>
        <dependency>
            <groupId>com.aliyun</groupId>
            <artifactId>aliyun-java-sdk-dysmsapi</artifactId>
            <version>2.1.0</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <scope>compile</scope>
        </dependency>

        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.4.2</version>
        </dependency>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.18.20</version>
        </dependency>

        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
            <version>1.2.76</version>
        </dependency>

        <dependency>
            <groupId>commons-lang</groupId>
            <artifactId>commons-lang</artifactId>
            <version>2.6</version>
        </dependency>

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>

        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid-spring-boot-starter</artifactId>
            <version>1.1.23</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.6.0</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <version>2.7.5</version>
            </plugin>
        </plugins>
    </build>

</project>

2.统一返回类R

package com.example.common;

import lombok.Data;

import java.util.HashMap;
import java.util.Map;

/**
 * 通用返回结果，服务端响应的数据最终都会封装成此对象
 * @param <T>
 */
@Data
public class R<T> {

    private Integer code; //编码：1成功，0和其它数字为失败

    private String msg; //错误信息

    private T data; //数据

    private Map map = new HashMap(); //动态数据

    public static <T> R<T> success(T object) {
        R<T> r = new R<T>();
        r.data = object;
        r.code = 1;
        return r;
    }

    public static <T> R<T> error(String msg) {
        R r = new R();
        r.msg = msg;
        r.code = 0;
        return r;
    }

    public R<T> add(String key, Object value) {
        this.map.put(key, value);
        return this;
    }

}

3.分页插件

package com.example.config;

import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * 配置MP的分页插件
 */
@Configuration
public class MybatisPlusConfig {
    @Bean
    public MybatisPlusInterceptor mybatisPlusInterceptor(){
        MybatisPlusInterceptor mybatisPlusInterceptor = new MybatisPlusInterceptor();
        mybatisPlusInterceptor.addInnerInterceptor(new PaginationInnerInterceptor());
        return mybatisPlusInterceptor;
    }
}

 4.JwtUtils

package com.example.utils;

import io.jsonwebtoken.*;
import lombok.Data;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

import java.security.SignatureException;
import java.util.Date;
import java.util.Map;

/**
 * @author: Ljb
 * @time: 2023/12/28
 * @description:
 */
@Data
@ConfigurationProperties("jwt.config")
@Component
public class JwtUtils {
    /**
     * 加密私钥
     */
    private String key;
    /**
     * 有限时间，单位-秒
     */
    private Long ttl;

    /**
     * 生成token
     *
     * @param id   存储的用户id
     * @param name 存储的用户名
     * @param map  存储的额外数据
     * @return token
     */
    public String createJwt(String id, String name, Map<String, Object> map) {
        // 计算失效时间
        long now = System.currentTimeMillis();
        long exp = now + ((ttl != null && ttl.longValue() > 0) ? ttl * 1000 : 0);
        // 创建
        JwtBuilder builder = Jwts.builder().setId(id) // 存储id
                .setSubject(name)                       // 存储
                .setIssuedAt(new Date())         // 发布时间
                .signWith(SignatureAlgorithm.HS256, key);  // 设置加密算法以及私钥
        // builder.setClaims(map); 这样好像会直接取代原本已经赋值的id，subject那些值（也就是在上面赋值的全没有了）
        if (map != null) {
            for (Map.Entry<String, Object> entry : map.entrySet()) {
                builder.claim(entry.getKey(), entry.getValue());
            }
        }


        builder.setExpiration(new Date(exp));
        return builder.compact();
    }

    /**
     * 解析token
     *
     * @param token token
     * @return 装载数据的实体
     */
    public Claims parseJwt(String token) throws ExpiredJwtException, UnsupportedJwtException, MalformedJwtException, SignatureException, IllegalArgumentException {
        Claims claims = Jwts.parser().setSigningKey(key).parseClaimsJws(token).getBody();
        return claims;
    }
}

 5.JwtInterceptor拦截器

package com.example.intercepter;

import com.example.annotation.AdminPermission;
import com.example.entity.User;
import com.example.service.UserService;
import com.example.utils.JwtUtils;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.ExpiredJwtException;
import io.jsonwebtoken.MalformedJwtException;
import io.jsonwebtoken.UnsupportedJwtException;
import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.security.SignatureException;

public class JWTInterceptor implements HandlerInterceptor {
    @Autowired
    private UserService userService;
    @Resource
    private JwtUtils jwtUtils;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        //1.获取token
        String authorization = request.getHeader("Authorization");
        //2.验证token,不为null并且开头为"Bearer "开头，后面才是token的实际值
        if (!StringUtils.isEmpty(authorization) && authorization.startsWith("Bearer ")) {
            String token = authorization.replace("Bearer ", "");
            Claims claims = jwtUtils.parseJwt(token);//claims相当于token里的一个hashmap容器,可以存储一些信息，比如用户id
            HandlerMethod h = (HandlerMethod) handler;
            //获取接口上的@RequestMapping注解
            Object annotation = h.getMethodAnnotation(AdminPermission.class);
            //获取请求类型
            boolean pass = false;
            String userId = claims.getId();
            User user = userService.getById(userId);
            if (user != null) {
                request.getSession().setAttribute("userId", user.getId());
            }
            if (annotation == null) {
                pass = true;
            } else {
                //需要admin角色才能访问，判断用户是否有admin权限
                if (user.getType() == 1) {
                    pass = true;
                }
            }
            return pass;
        }

        return HandlerInterceptor.super.preHandle(request, response, handler);
    }
}

 6.WebConfiguration

package com.example.config;

import com.example.intercepter.JWTInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfiguration implements WebMvcConfigurer {

    @Bean
    public JWTInterceptor jwtInterceptor(){
        return new JWTInterceptor();
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        //添加拦截器
        registry.addInterceptor(jwtInterceptor())
                .addPathPatterns("/**")
                .excludePathPatterns("/user/login/**");//登录请求不用拦截
    }
}

二. 实体类

1.用户类

package com.example.entity;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;

@Data
@NoArgsConstructor
@AllArgsConstructor
public class User {

    private Long id;
    private String name;
    private String pwd;
    private int type;
    private String descri;

}

2.用户dto类用于登录功能

package com.example.dto;


import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;

@Data
@NoArgsConstructor
@AllArgsConstructor
public class UserDto {

    private Long id;

    private String pwd;

    private String descri;
}

三. Mapper、Service、ServiceImpl

省略..........

接下来就是重头戏

四.自定义注解和控制器

1. annotation包下的AdminPermission（自定义注解）

package com.example.annotation;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;


@Retention(RetentionPolicy.RUNTIME)
// 定义注解作用的元素类型
@Target({ElementType.METHOD, ElementType.TYPE})
public @interface AdminPermission {

    String value() default "";

}

2.控制器

 需要权限的功能在类上加@AdminPermission就可以了

package com.example.controller;

import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.example.annotation.AdminPermission;
import com.example.common.R;
import com.example.dto.UserDto;
import com.example.entity.User;
import com.example.service.UserService;
import com.example.utils.JwtUtils;
import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.HttpServletRequest;
import java.util.HashMap;

@RestController
@RequestMapping("/user")
public class UserController {

    @Autowired
    private UserService userService;

    @Autowired
    private JwtUtils jwtUtils;

    @PostMapping("/save")
    @AdminPermission
    public R<String> save(@RequestBody User user){
        userService.save(user);
        return R.success("新增成功");
    }

    @DeleteMapping("/delete/{id}")
    @AdminPermission
    public R<String> delete(@PathVariable Long id){
        User user = userService.getById(id);
        if(user !=null&user.getType()!=(1)) {
            userService.removeById(id);
            return R.success("删除成功");
        }
        return R.error("不能删除自己");
    }

    @PostMapping("update")
    @AdminPermission
    public R<String> update(@RequestBody User user){
        userService.updateById(user);
        return R.success("修改成功");
    }

    @PostMapping("/updatePwd")
    public R<String> updatePwd(HttpServletRequest request,@RequestBody UserDto userDto){
        long userId = (long) request.getSession().getAttribute("userId");
        if(userId!=userDto.getId()){
            return R.error("禁止修改他人密码");
        }
        User user=new User();
        user.setId(userDto.getId());
        user.setPwd(userDto.getPwd());
        user.setDescri(userDto.getDescri());
        userService.updateById(user);
        return R.success("修改成功");
    }

    @GetMapping("/{id}")
    public R<User> getById(@PathVariable Long id){
        User user = userService.getById(id);
        if(user!=null){
            return R.success(user);
        }
        return R.error("没有查询到用户");
    }

    @GetMapping("/page")
    public R<Page> getAllUser(int pageNum, int pageSize, String name){
        Page pageInfo=new Page(pageNum,pageSize);
        LambdaQueryWrapper<User> lambdaQueryWrapper=new LambdaQueryWrapper<>();
        lambdaQueryWrapper.like(StringUtils.isNotEmpty(name),User::getName,name);
        userService.page(pageInfo,lambdaQueryWrapper);
        return R.success(pageInfo);
    }

    @PostMapping("/login")
    public R<String> login(HttpServletRequest request,@RequestBody User user){
        //1.获取页面提交的密码
        String pwd = user.getPwd();
        //2.根据页面的name查询数据库
        LambdaQueryWrapper<User> lambdaQueryWrapper=new LambdaQueryWrapper<>();
        lambdaQueryWrapper.eq(User::getName,user.getName());
        User user1 = userService.getOne(lambdaQueryWrapper);
        //3.如果没有查询到则返回登录失败
        if(user1==null){
            return R.error("登录失败");
        }
        //4.查询到，进行密码比对，不一致则返回登录失败
        if(!user1.getPwd().equals(pwd)){
            return R.error("密码错误");
        }
        //5.登录成功，将id存入jwt中
        String jwt = jwtUtils.createJwt(user1.getId().toString(), user1.getName(), new HashMap<String, Object>());
        return R.success(jwt);
    }
}