[Java] Spring实现拥有者权限验证的方法示例

@target(elementtype.method)   // 注解使用在方法上
@retention(retentionpolicy.runtime) // 运行时生效
public @interface authorityannotation {
  /**
   * 仓库名
   */
  @required
  class repository();
}

public interface baseentity {
  list<user> getbelongtousers();
}

@entity
public class teacher implements yunzhientity, baseentity {
  ...
  @override
  public list<user> getbelongtousers() {
  list<user> userlist = new arraylist<>();
  userlist.add(this.getuser());
  return userlist;
  }
}

@entity
public class klass implements baseentity {
  ...
  @override
  public list<user> getbelongtousers() {
  list<user> userlist = new arraylist<>();
  for (teacher teacher: this.getteacherlist()) {
    userlist.addall(teacher.getbelongtousers());
  }
 
  return userlist;
  }
}

@entity
public class student implements baseentity {
  ...
  @override
  public list<user> getbelongtousers() {
  return this.getklass().getbelongtousers();
  }
}

@aspect
@component
public class ownerauthorityaspect {
  private static final logger logger = loggerfactory.getlogger(ownerauthorityaspect.class.getname());
 
  /**
   * 使用注解，并第一个参数为id
   */
  @pointcut("@annotation(com.yunzhiclub.alice.annotation.authorityannotation) && args(id,..) && @annotation(authorityannotation)")
  public void doaccesscheck(long id, authorityannotation authorityannotation) {   }
  
  @before("doaccesscheck(id, authorityannotation)")
  public void before(long id, authorityannotation authorityannotation) {
  }

@aspect
@component
public class ownerauthorityaspect implements applicationcontextaware {
  private applicationcontext applicationcontext = null;  // 初始化上下文
  ......
  @before("doaccesscheck(id, authorityannotation)")
  public void before(long id, authorityannotation authorityannotation) {
  logger.debug("获取注解上的repository, 并通过applicationcontext来获取bean");
  class<?> repositoryclass = authorityannotation.repository();
  object object = applicationcontext.getbean(repositoryclass);
 
  logger.debug("将bean转换为crudrepository");
  crudrepository<baseentity, object> crudrepository = (crudrepository<baseentity, object>)object;
  }
 
  @override
  public void setapplicationcontext(applicationcontext applicationcontext) throws beansexception {
  this.applicationcontext = applicationcontext;
  }
}

@before("doaccesscheck(id, authorityannotation)")
public void before(long id, authorityannotation authorityannotation) {
  logger.debug("获取注解上的repository, 并通过applicationcontext来获取bean");
  class<?> repositoryclass = authorityannotation.repository();
  object object = applicationcontext.getbean(repositoryclass);
 
  logger.debug("将bean转换为crudrepository");
  crudrepository<baseentity, object> crudrepository = (crudrepository<baseentity, object>)object;
 
  logger.debug("获取实体对象");
  optional<baseentity> baseentityoptional = crudrepository.findbyid(id);
  if(!baseentityoptional.ispresent()) {
  throw new runtimeexception("对不起，未找到相关的记录");
  }
  baseentity baseentity = baseentityoptional.get();
 
  logger.debug("获取登录用户以及拥有者，并进行比对");
  list<user> belongtotusers = baseentity.getbelongtousers();
  user currentloginuser = userservice.getcurrentloginuser();
  boolean havepermission = false;
  if (currentloginuser != null && belongtotusers.size() != 0) {
  for (user user: belongtotusers) {
    if (user.getid().equals(currentloginuser.getid())) {
    havepermission = true;
    break;
    }
  }
 
  if (!havepermission) {
    throw new runtimeexception("权限不允许");
  }
  }
}

@restcontroller
@requestmapping("/student")
public class studentcontroller {
 
  private final studentservice studentservice;  // 学生
 
  @autowired
  public studentcontroller(studentservice studentservice) {
  this.studentservice = studentservice;
  }
 
  /**
   * 通过id获取学生
   *
   * @param id
   * @return
   */
  @authorityannotation(repository = studentrepository.class)
  @getmapping("/{id}")
  @jsonview(studentjsonview.get.class)
  public student findbyid(@pathvariable long id) {
  return studentservice.findbyid(id);
  }
}

@test
public void update() throws exception {
  logger.info("获取一个保存学生");
  student student = studentservice.getonesavestudent();
  long id = student.getid();
  logger.info("获取一个更新学生");
  student newstudent = studentservice.getoneunsavestudent();
 
  string jsonstring = jsonobject.tojsonstring(newstudent);
  logger.info("发送更新请求");
  this.mockmvc
  .perform(put(baseurl + "/" + id)
    .cookie(this.cookie)
    .content(jsonstring)
    .contenttype(mediatype.application_json_utf8))
  .andexpect(status().isok());
}

@entity
public class student implements baseentity {
  ......
  @jsonignore
  @override
  public list<user> getbelongtousers() {
  return this.getklass().getbelongtousers();
 
  }
}