SpringBoot 自定义注解实现的权限管理

import java.lang.annotation.*; 
  
@Target({ElementType.METHOD, ElementType.TYPE}) 
@Retention(RetentionPolicy.RUNTIME) 
@Documented  
public @interface Permission { 
    /** 
     * SPEL表达式 
     */  
    String value() default ""; 
  
    /** 
     * 权限码 
     */  
    String[] permissions() default {}; 
  
    /** 
     * 资源类型, 默认为区域资源 
     */  
    String resourceType() default "region"; 
}

import org.aspectj.lang.JoinPoint; 
import org.aspectj.lang.ProceedingJoinPoint; 
import org.aspectj.lang.annotation.Around; 
import org.aspectj.lang.annotation.Aspect; 
import org.aspectj.lang.annotation.Before; 
import org.springframework.beans.factory.annotation.Autowired; 
import org.springframework.context.BeanFactory; 
import org.springframework.context.annotation.Bean; 
import org.springframework.context.annotation.Configuration; 
import org.springframework.core.ParameterNameDiscoverer; 
import org.springframework.expression.Expression; 
import org.springframework.expression.ExpressionParser; 
import org.springframework.expression.spel.standard.SpelExpressionParser; 
import org.springframework.expression.spel.support.StandardEvaluationContext; 
import org.springframework.stereotype.Component; 
  
import java.lang.reflect.Method; 
import java.util.HashMap; 
import java.util.Map; 
import java.util.concurrent.ConcurrentHashMap; 
  
@Aspect  
@Component  
public class PermissionAspect { 
      
    private final SpelExpressionParser parser = new SpelExpressionParser(); 
    private final ParameterNameDiscoverer parameterNameDiscoverer = new DefaultParameterNameDiscoverer(); 
      
    private final ConcurrentHashMap<Method, Expression> expressionMap = new ConcurrentHashMap<>(256); 
    private final Map<String, Method> methodMap = new HashMap<>(16); 
      
    private final BeanFactory beanFactory; 
    private final PermissionUtils permissionUtils; 
      
    @Autowired  
    public PermissionAspect(BeanFactory beanFactory, PermissionUtils permissionUtils) { 
        this.beanFactory = beanFactory; 
        this.permissionUtils = permissionUtils; 
          
        // 用于将用户自定义的静态方法注册到EL上下文，注意方法不能重载！
        Method[] methods = permissionUtils.getClass().getDeclaredMethods(); 
        for (Method method : methods) { 
            int modifiers = method.getModifiers(); 
            if (Modifier.isStatic(modifiers)) { 
                methodMap.put(method.getName(), method); 
            } 
        } 
    } 
      
    @Around("@annotation(permission)") 
    public Object check(ProceedingJoinPoint joinPoint, Permission permission) throws Throwable { 
        Method targetMethod = getTargetMethod(joinPoint); 
        Expression expression = getExpression(targetMethod, permission); 
        EvaluationContext evaluationContext = getEvaluationContext(joinPoint, targetMethod); 
          
        Object expressionValue = expression.getValue(evaluationContext); 
        if (expressionValue == null) { 
            throw new RuntimeException("expressionValue is null, please check your EL expression"); 
        } 
          
        boolean hasPermission = false; 
        if (expressionValue instanceof Boolean) { 
            hasPermission = (Boolean) expressionValue; 
        } else if (expressionValue instanceof String) { 
            hasPermission = permissionUtils.hasPermission(expressionValue.toString(), permission.resourceType()); 
        } else if (expressionValue instanceof Collection) { 
            hasPermission = permissionUtils.hasAllPermission((Collection<String>) expressionValue, permission.resourceType()); 
        } 
          
        if (!hasPermission) { 
            throw new PermissionException(); 
        } 
          
        return joinPoint.proceed(); 
    } 
      
    private Method getTargetMethod(JoinPoint joinPoint) { 
        // 获取目标方法 
        return ((ProceedingJoinPoint) joinPoint).getSignature().toShortString().split("\\.")[1].replace("()", "").trim(); 
    } 
      
    private Expression getExpression(Method method, Permission permission) { 
        Expression expression = expressionMap.get(method); 
        if (expression != null) { 
            return expression; 
        } 
        String value = permission.value(); 
        return expressionMap.computeIfAbsent(method, k -> parser.parseRaw(value)); 
    } 
      
    private EvaluationContext getEvaluationContext(JoinPoint joinPoint, Method method) { 
        StandardEvaluationContext context = new StandardEvaluationContext(); 
          
        // 设置方法参数名和值为SpEL变量 
        Object[] args = ((ProceedingJoinPoint) joinPoint).getArgs(); 
        for (int i = 0; i < args.length; i++) { 
            // 这里可以使用更复杂的逻辑来获取参数名，如使用Spring的MethodParameter等 
            String paramName = "arg" + i; 
            context.setVariable(paramName, args[i]); 
        } 
          
        // 注册自定义的静态方法到EL上下文 
        methodMap.forEach((name, m) -> context.registerFunction(name, m)); 
          
        return context; 
    } }

import org.springframework.stereotype.Component; 
  
import java.util.Collection; 
import java.util.HashSet; 
import java.util.Set; 
  
@Component  
public class PermissionUtils { 
      
    // 假设这里有一个方法用于从数据库中获取用户的权限码 
    public static Set<String> getUserPermissions(String userId) { 
        // 模拟从数据库中获取用户权限码 
        Set<String> permissions = new HashSet<>(); 
        permissions.add("READ_USER"); 
        permissions.add("WRITE_USER"); 
        return permissions; 
    } 
      
    public boolean hasPermission(String permissionCode, String resourceType) { 
        // 这里可以添加具体的权限校验逻辑 
        // 假设当前用户具有所有权限，仅作示例 
        return true; 
    } 
      
    public boolean hasAllPermission(Collection<String> permissionCodes, String resourceType) { 
        // 这里可以添加具体的权限校验逻辑 
        // 假设当前用户具有所有权限，仅作示例 
        return true; 
    } 
}

import org.springframework.context.annotation.Bean; 
import org.springframework.context.annotation.Configuration; 
import org.springframework.context.annotation.EnableAspectJAutoProxy; 
  
@Configuration  
@EnableAspectJAutoProxy  
public class AppConfig { 
      
    @Bean  
    public PermissionUtils permissionUtils() { 
        return new PermissionUtils(); 
    } 
      
    // 其他Bean的配置... 
}

import org.springframework.web.bind.annotation.GetMapping; 
import org.springframework.web.bind.annotation.RequestMapping; 
import org.springframework.web.bind.annotation.RestController; 
  
@RestController  
@RequestMapping("/api") 
public class UserController { 
      
    @Permission(value = "#userId == 'admin'") 
    @GetMapping("/admin") 
    public String admin() { 
        return "This is admin page."; 
    } 
      
    @Permission(value = "#userId in getUserPermissions(#userId)") 
    @GetMapping("/user") 
    public String user(String userId) { 
        return "This is user page."; 
    } 
}