Java注解实现权限管理

一个简单的权限控制场景，已知登录用户id，判断这个用户是否存在数据库中，如果不存在则不允许进行任何操作。

关于java注解介绍请参见 Java自定义注解实现权限管理

基础实现

在每个controller方法中添加用户校验代码，这种可以控制到方法级，但是每个方法都要维护这段重复逻辑。

@RequestMapping(value = "/task/progress", method = RequestMethod.GET)
    public RestRsp getLabelTaskProgress(
            @RequestParam(name = "taskId", defaultValue = "-1") long taskId,
            @Visitor long userId
    ) {
        // 校验用户
        if (!labelService.checkUserValid(userId)) {
            return RestRsp.success(new ListRsp());
        }

        // 获取标注进度
        ... 省略
        return RestRsp.success(listRsp);
    }

拦截器实现

spring的拦截器实现，好处是增加在进入controller方法前提前拦截非法用户，但是设计到不同controller类或方法不同权限时，只能通过api路径区分，不方便。

@Slf4j
public class AuthInterceptor extends HandlerInterceptorAdapter {

    private final static String LABEL_PATH_PATTERN = "^/*webapi/+label/*.*$";
    private static final String ERROR_MSG = "您没有权限，请联系管理";

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
            Object handler) {
        if (debugHost() && hasDebugParam(request)) {
            return true;
        }

        String uri = request.getRequestURI();
        log.info("uri:{}", uri);
        String username = SsoUserInfo.getUserName();

        if (Pattern.matches(LABEL_PATH_PATTERN, uri)) {
            Set<String> managerSet = LABEL_MANAGER_SET.get();
            if (!managerSet.contains(username)) {
                throw new ServiceException(ErrorCode.PERMISSION_DENIED);
            }

        } else {
            Set<String> userSet = USER_SET.get();
            if (!userSet.contains(username)) {
                throw ServiceException.ofMessage(ErrorCode.PERMISSION_DENIED, ERROR_MSG);
            }
        }
        return true;
    }
}

注解实现

注解+拦截器的实现方式，既可以实现不同粒度的权限控制，也可以集中管理权限。

• 定义权限枚举变量

public enum  AuthEnum {

    USER_LABEL("label_user", "标注用户", "非标注用户禁止使用"),
    ;

    private String code;
    private String desc;
    private String info;

    AuthEnum(String code, String desc, String info) {
        this.code = code;
        this.desc = desc;
        this.info = info;
    }

    public String getCode() {
        return this.code;
    }

    public String getDesc() {
        return this.desc;
    }

    public String getInfo() {
        return this.info;
    }
}

• 定义注解

@Documented
@Retention(value = RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD, ElementType.TYPE})
public @interface AuthAnn {
    AuthEnum[] authType();
}

• 定义拦截器

@Slf4j
@Component
public class AuthInterceptor extends HandlerInterceptorAdapter {

    @Autowired
    private LabelService labelService;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
            Object handler) {

        Long userId = SSOHelper.getUserId(request);

        AuthAnn authAnn = ((HandlerMethod) handler).getMethodAnnotation(AuthAnn.class);
        if (authAnn == null || ObjectUtils.isEmpty(authAnn.authType())) {
            authAnn = ((HandlerMethod) handler).getBeanType().getAnnotation(AuthAnn.class);
        }
        if (authAnn == null || ObjectUtils.isEmpty(authAnn.authType())) {
            return true;
        }

        //log.info("userId:{}", userId);
        AuthEnum[] authEnums = authAnn.authType();

        for (AuthEnum authEnum : authEnums) {
            if (AuthEnum.USER_LABEL.equals(authEnum)) {
                if (!labelService.checkUserExist(userId)) {
                    log.info("Invalid Label User, userId:{}", userId);
                    throw ServiceException.ofMessage(ErrorCode.PERMISSION_DENIED, authEnum.getInfo());
                }
            }
        }
        return true;
    }
}

• 注册拦截器

@Configuration
@Slf4j
public class ProphetInterceptorConfiguration implements WebMvcConfigurer {
    @Autowired
    private AuthInterceptor authInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) { 
        String[] paths = passportProperties.urlPaths();
        registry.addInterceptor(AuthInterceptor).addPathPatterns(paths);
    }
}

• 添加权限

@Slf4j
@RestController
@RequestMapping("/api/label")
@AuthAnn(authType = AuthEnum.USER_LABEL)
public class LabelController {

}