1、权限管理
之前写的权限是写死的,没有根据用户实际生效,如下图:现在做一个真实的权限,主要思路是:
从主体中获取到登录的用户,然后通过自定义jpql,拿到权限
1.1、FilterChainDefinitionMapFactory,自定义拦截器
public class FilterChainDefinitionMapFactory {
@Autowired
private IPermissionService permissionService;
/*
*
* /login = anon
/s/permission.jsp = perms[user:index]
/** = authc
* */
public Map<String, String> createMap() {
Map<String, String> map = new LinkedHashMap<>();
//一定注意顺序
//不拦截的
map.put("/login","anon");
//把所有的静态资源(js,css,图片,...)放行
map.put("*.js","anon");
map.put("*.css","anon");
map.put("/css/**","anon");
map.put("/js/**","anon");
map.put("/easyui/**","anon");
map.put("/images/**","anon");
//添加权限拦截数据,从数据库中获取
List<Permission> permissions = permissionService.findAll();
permissions.forEach(permission -> {
map.put(permission.getUrl(),"perms["+permission.getSn()+"]");
});
//拦截所有
map.put("/**","authc");
return map;
}
}
1.2、PermissionRepository,自定义jpql,连接5张表
public interface PermissionRepository extends BaseRepository<Permission, Long> {
/**
* 根据用户获取权限
* 返回的是Set<String>,与AisellRealm对应
* jpql关连法则:
* 1,关连前面的类的别名,
* 2.不需要消除笛卡尔积
*/
@Query("select p.sn from Employee e join e.roles r join r.permissions p where e.id = ?1")
Set<String> findSnByUser(Long userId);
}
1.3、AisellRealm
public class AisellRealm extends AuthorizingRealm {
@Autowired
private IEmployeeService employeeService;
@Autowired
private IPermissionService permissionService;
//授权功能
protected AuthorizationI