浅谈spring security中的权限控制

/**
 * 权限标识
 */
@Data
public class SysPermission implements Serializable {

   private static final long serialVersionUID = 280565233032255804L;

   private Long id; //权限id
   private String permission; //具体的权限
   private String name; //权限名称
   private Date createTime;
   private Date updateTime;

}

@Mapper
public interface SysPermissionDao {

   @Options(useGeneratedKeys = true, keyProperty = "id")
   @Insert("insert into sys_permission(permission, name, createTime, updateTime) values(#{permission}, #{name}, #{createTime}, #{createTime})")
   int save(SysPermission sysPermission);

   @Update("update sys_permission t set t.name = #{name}, t.permission = #{permission}, t.updateTime = #{updateTime} where t.id = #{id}")
   int update(SysPermission sysPermission);

   @Delete("delete from sys_permission where id = #{id}")
   int delete(Long id);

   @Select("select * from sys_permission t where t.id = #{id}")
   SysPermission findById(Long id);

   @Select("select * from sys_permission t where t.permission = #{permission}")
   SysPermission findByPermission(String permission);

   int count(Map<String, Object> params);

   List<SysPermission> findData(Map<String, Object> params);

}

/**
 * 管理后台添加权限
 * 
 * @param sysPermission
 * @return
 */
@LogAnnotation(module = LogModule.ADD_PERMISSION)
@PreAuthorize("hasAuthority('back:permission:save')")
@PostMapping("/permissions")
public SysPermission save(@RequestBody SysPermission sysPermission) {
   if (StringUtils.isBlank(sysPermission.getPermission())) {
      throw new IllegalArgumentException("权限标识不能为空");
   }
   if (StringUtils.isBlank(sysPermission.getName())) {
      throw new IllegalArgumentException("权限名不能为空");
   }

   sysPermissionService.save(sysPermission);

   return sysPermission;
}

@Data
public class SysRole implements Serializable {

   private static final long serialVersionUID = -2054359538140713354L;

   private Long id; //角色id
   private String code; //角色编码
   private String name; //角色名称
   private Date createTime;
   private Date updateTime;
}

我们来看一下    @PreAuthorize 标签的源码，它位于org.springframework.security.access.prepost包下   

/**
 * 用于指定将计算为的方法访问控制表达式的批注
 * 决定是否允许方法调用。
 *
 * @author Luke Taylor
 * @since 3.0
 */
@Target({ ElementType.METHOD, ElementType.TYPE })
@Retention(RetentionPolicy.RUNTIME)
@Inherited
@Documented
public @interface PreAuthorize {
   /**
    * @return 在执行这个受保护的方法前进行Spring EL表达式的解析
    */
   String value();
}

public class SpringELTest {
    public static void main(String[] args) {
        ExpressionParser parser = new SpelExpressionParser();
        //解析字符串，该字符串具有一段代码的味道
        Expression expression = parser.parseExpression("'Hello World'.bytes.length");
        int length = (int)expression.getValue();
        System.out.println(length);
    }
}

/**
 * 资源服务配置
 */
@EnableResourceServer
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true,securedEnabled = true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

   @Override
   public void configure(HttpSecurity http) throws Exception {
      http.csrf().disable().exceptionHandling()
            .authenticationEntryPoint(
                  (request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
            .and().authorizeRequests().antMatchers(PermitAllUrl.permitAllUrl("/users-anon/**", "/sys/login","/wechat/**")).permitAll()
            .anyRequest().authenticated().and().httpBasic();
   }
   @Override
   public void configure(ResourceServerSecurityConfigurer resource) throws Exception {
      //这里把自定义异常加进去
      resource.authenticationEntryPoint(new AuthExceptionEntryPoint())
            .accessDeniedHandler(new CustomAccessDeniedHandler());
   }


   @Bean
   public BCryptPasswordEncoder bCryptPasswordEncoder() {
      return new BCryptPasswordEncoder();
   }

}

public final boolean hasAuthority(String authority) {
   return hasAnyAuthority(authority);
}

public final boolean hasAnyAuthority(String... authorities) {
   return hasAnyAuthorityName(null, authorities);
}

private boolean hasAnyAuthorityName(String prefix, String... roles) {
   //获取所有的用户角色权限
   Set<String> roleSet = getAuthoritySet();
   //由于我们这里传入的roles只有"back:permission:save"
   //所以role即为"back:permission:save"，prefix则为null
   for (String role : roles) {
      //defaultedRole依然为"back:permission:save"
      String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
      //在权限集合中是否包含"back:permission:save"的该权限
      //根据我们之前登录的返回信息，可以看到"authority": "back:permission:save"的存在
      //所以此处是可以通过权限验证的。
      if (roleSet.contains(defaultedRole)) {
         return true;
      }
   }

   return false;
}

private Set<String> getAuthoritySet() {
   //Set<String> roles是SecurityExpressionRoot的属性
   //我们可以看到它是从一系列用户认证里面获取到的权限集合
   if (roles == null) {
      roles = new HashSet<>();
      //authentication是SecurityExpressionRoot极为重要的一个属性，它本身是一个接口
      //管理着用户认证信息的各个方法
      Collection<? extends GrantedAuthority> userAuthorities = authentication
            .getAuthorities();

      if (roleHierarchy != null) {
         userAuthorities = roleHierarchy
               .getReachableGrantedAuthorities(userAuthorities);
      }
      
      roles = AuthorityUtils.authorityListToSet(userAuthorities);
   }

   return roles;
}

private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
   if (role == null) {
      return role;
   }
   //由于defaultRolePrefix为null，所以此处返回的就是"back:permission:save"
   if (defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
      return role;
   }
   if (role.startsWith(defaultRolePrefix)) {
      return role;
   }
   return defaultRolePrefix + role;
}

public static Set<String> authorityListToSet(
      Collection<? extends GrantedAuthority> userAuthorities) {
   Set<String> set = new HashSet<>(userAuthorities.size());
   //很明显这里是把认证用户的所有权限给转化为Set集合
   for (GrantedAuthority authority : userAuthorities) {
      set.add(authority.getAuthority());
   }

   return set;
}