0x0 背景
在项目中，权限校验服务是一个独立的组件，因此采用传统的shiro框架或者spring security框架和我们的项目不太适配；
为了简化权限校验业务，本文使用spring的aop，利用注解和spel表达式，实现了精细的权限控制。
0x1 代码
1.注解
@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface Permission {
/**
* SPEL表达式
*/
String value() default "";
/**
* 权限码
*/
String[] permissions() default {};
/**
* 资源类型，默认为区域资源
*/
String resourceType() default "region";
}
2.切面
@Component
@Aspect
@Slf4j
public class PermissionAspect {
/**
* spel解析器
*/
private final SpelExpressionParser parser= new SpelExpressionParser();
private final ParameterNameDiscoverer parameterNameDiscoverer = new DefaultParameterNameDiscoverer();
/**
* spel缓存
*/
private final ConcurrentHashMap<Method, Expression> expressionMap = new ConcurrentHashMap<>(256);
private final Map<String, Method> methodMap = new HashMap<>(16);
private final BeanFactory beanFactory;
private final PermissionUtils permissionUtils;
/**
* 初始化
*
* @param beanFactory spring上下文
* @param permissionUtils 用户实现的权限校验工具类
*/
public PermissionAspect(BeanFactory beanFactory, PermissionUtils permissionUtils) {
this.beanFactory = beanFactory;
this.permissionUtils = permissionUtils;
//用于将用户自定义的静态方法注册到el上下文，注意方法不能重载！
Method[] methods = permissionUtils.getClass().getDeclaredMethods();
for (Method method : methods) {
int modifiers = method.getModifiers();
if (Modifier.isStatic(modifiers)) {
methodMap.put(method.getName(), method);
}
}
}
@Before("@annotation(permission)")
@SuppressWarnings("unchecked")
public void check(JoinPoint joinPoint, Permission permission) throws Throwable {
Method targetMethod = getTargetMethod(joinPoint);
Expression expression = getExpression(targetMethod, permission);
EvaluationContext evaluationContext = getEvaluationContext(joinPoint, targetMethod);
Object expressionValue = expression.getValue(evaluationContext);
if (expressionValue == null) {
throw new RuntimeException("expressionValue is null, please check your el expression");
}
boolean hasPermission = false;
//如果是函数校验，返回boolean
if (expressionValue instanceof Boolean) {
hasPermission = (Boolean) expressionValue;
}
//如果是传入了id或id list，采用其他方式校验
else if (expressionValue instanceof String) {
hasPermission = permissionUtils.hasPermission(expressionValue.toString(), permission.resourceType());
}
else if (expressionValue instanceof Collection) {
hasPermission = permissionUtils.hasAllPermission((Collection<String>) expressionValue, permission.resourceType());
}
if (!hasPermission) {
throw new PermissionException();
}
}
/**
* 从缓存中获取spel编译表达式
*
* @param method method
* @param permission 注解
* @return SpelExpression
*/
private Expression getExpression(Method method, Permission permission) {
Expression expression = expressionMap.get(method);
if (expression != null) {
return expression;
}
String value = permission.value();
return expressionMap.computeIfAbsent(method, k -> parser.parseRaw(value));
}
/**
* 获取Spel上下文
*
* @param joinPoint joinPoint
* @param method method
* @return spel上下文
*/
EvaluationContext getEvaluationContext(JoinPoint joinPoint, Method method) {
Object[] args = joinPoint.getArgs();
PermissionRootObject root = new PermissionRootObject(args, permissionUtils);
MethodBasedEvaluationContext evaluationContext =
new MethodBasedEvaluationContext(root, method, args, parameterNameDiscoverer);
evaluationContext.setBeanResolver(new BeanFactoryResolver(beanFactory));
if (methodMap.isEmpty()) {
return evaluationContext;
}
//将用户自定义的方法注册到上下文
methodMap.forEach(evaluationContext::registerFunction);
return evaluationContext;
}
/**
* 获取目标方法
*
* @param joinPoint join point
* @return 目标方法
*/
private Method getTargetMethod(JoinPoint joinPoint) {
Signature signature = joinPoint.getSignature();
MethodSignature methodSignature = (MethodSignature) signature;
return methodSignature.getMethod();
}
}
3.SPEL根对象
public interface PermissionUtils {
boolean hasPermission(String resourceId, String resourceType, String... permissions);
boolean hasRegionPermission(String regionId);
boolean hasAllRegionPermission(Collection<String> idList);
boolean hasAllPermission(Collection<String> idList, String resourceType, String... permissions);
}
@Data
public class PermissionRootObject implements PermissionUtils {
private Object[] args;
private PermissionUtils permissionUtils;
public PermissionRootObject(Object[] args, PermissionUtils permissionUtils) {
this.args = args;
this.permissionUtils = permissionUtils;
}
@Override
public boolean hasPermission(String resourceId, String resourceType, String... permissions) {
return permissionUtils.hasPermission(resourceId, resourceType, permissions);
}
@Override
public boolean hasRegionPermission(String regionId) {
return permissionUtils.hasRegionPermission(regionId);
}
@Override
public boolean hasAllRegionPermission(Collection<String> idList) {
return permissionUtils.hasAllRegionPermission(idList);
}
@Override
public boolean hasAllPermission(Collection<String> idList, String resourceType, String... permissions) {
return permissionUtils.hasAllPermission(idList, resourceType, permissions);
}
}
0x2 使用案例
首先要实现一个PermissionUtils的spring bean，这个根据用户的实际情况来开发；
然后再对应的方法上加上我们自定义的注解，如下所示：
@RestController
@RequestMapping("security")
public class SecurityController {
/**
* 自定义静态方法校验
*/
@GetMapping("/test")
@Permission("#test(#id)")
public String test1(String id) {
return "query";
}
/**
* 校验某种资源
*/
@GetMapping("/query")
@Permission(value = "#idList", resourceType = "camera")
public String test3(List<String> idList) {
return "query";
}
/**
* 使用根对象的方法进行校验
*/
@GetMapping("/update")
@Permission("hasRegionPermission(#id)")
public String test2(String id, String name) {
return "update";
}
}
