SpringAOP实现权限管理

最新推荐文章于 2024-08-19 10:06:38 发布

Gvan Yao

最新推荐文章于 2024-08-19 10:06:38 发布

阅读量643

点赞数 1

分类专栏： spring boot

本文链接：https://blog.csdn.net/weixin_42339552/article/details/109365910

版权

SpringAOP 权限管理 JWT 角色验证自定义注解

关键词由CSDN通过智能技术生成

spring boot 专栏收录该内容

17 篇文章 0 订阅

订阅专栏

SpringAOP实现权限管理

1. 创建Aspect类

/**
 * @author flame
 */
@Aspect
@Component
public class AuthorityAspect {
    private static final String TOKEN_PREFIX = "Bearer ";
    @Autowired
    private RsaKeyProperties rsaKeyProperties;

    /**
     * 定义controller切入点拦截挂载，拦截Authority注解的方法
     */
    @Pointcut("@annotation(com.innocent.sams.api.Authority)")
    public void authorityAspect() {

    }

    @Around("authorityAspect()")
    public Result checkAuthority(ProceedingJoinPoint joinPoint) throws Throwable {
        //获取request对象
        HttpServletRequest request = ((ServletRequestAttributes) Objects.requireNonNull(RequestContextHolder.getRequestAttributes())).getRequest();
        String header = request.getHeader("Authorization");
        if (StringUtils.isEmpty(header) || !header.startsWith(TOKEN_PREFIX)) {
            throw new SamsException(false, StatusCode.USER_NOT_LOGIN);
        }
        String token = header.replace(TOKEN_PREFIX, "");
        //获取token中的用户信息

        Payload<UserVO> playLoad = JwtUtils.genInfoFromToken(token, rsaKeyProperties.getPublicKey(), UserVO.class);
        if (playLoad == null) {
            throw new SamsException(false, StatusCode.USER_NOT_LOGIN);
        }
        UserVO userVO = playLoad.getUserInfo();
        if (userVO == null) {
            throw new SamsException(false, StatusCode.USER_NOT_LOGIN);
        }
       //将当前用户信息放到线程域中
   		UserContext.set(userVO);
        //获取连接点目标类型
        String targetName = joinPoint.getTarget().getClass().getName();
        //根据连接点类名获取指定类
        Class<?> targetClass = Class.forName(targetName);
        //获取连接点签名的方法名
        String methodName = joinPoint.getSignature().getName();
        Method[] methodList = targetClass.getMethods();
        for (Method method : methodList) {
            if (method.getName().equals(methodName)) {
                //获取访问该方法所需的角色信息
                List<String> neededRoleList = Arrays.stream(method.getAnnotation(Authority.class).hasAnyRoles().split(",")).collect(Collectors.toList());
                List<String> roleNames = userVO.getRoleName();
                if (CollectionUtils.isEmpty(roleNames)) {
                    throw new SamsException(false, StatusCode.NO_PERMISSION);
                }
                boolean flag = false;
                for (int i = 0; i < roleNames.size(); i++) {
                    if (neededRoleList.contains(roleNames.get(i))) {
                        flag = true;
                        break;
                    } else if (!neededRoleList.contains(roleNames.get(i)) && i == roleNames.size() - 1) {
                        throw new SamsException(false, StatusCode.NO_PERMISSION);
                    }
                }
                if (flag) {
                    break;
                }
            }
        }
       Object proceed = joinPoint.proceed();
        return (Result) proceed;
    }
}

2. 创建自定义注解

/**
 * @author  flame
 */
@Inherited
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD})
public @interface Authority {
    String hasAnyRoles() default "";
}