SpringSecurity(十二)—-基于表达式的访问控制

 public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasAuthority(String authority) {
   
            return this.access(ExpressionUrlAuthorizationConfigurer.hasAuthority(authority));
        }

    private static String hasAuthority(String authority) {
   
        return "hasAuthority('" + authority + "')";
    }

    private static String hasAnyRole(String... authorities) {
   
        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','ROLE_");
        return "hasAnyRole('ROLE_" + anyAuthorities + "')";
    }

    private static String hasRole(String role) {
   
        Assert.notNull(role, "role cannot be null");
        if (role.startsWith("ROLE_")) {
   
            throw new IllegalArgumentException("role should not start with 'ROLE_' since it is automatically inserted. Got '" + role + "'");
        } else {
   
            return "hasRole('ROLE_" + role + "')";
        }
    }

    private static String hasAuthority(String authority) {
   
        return "hasAuthority('" + authority + "')";
    }

    private static String hasAnyAuthority(String... authorities) {
   
        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','");
        return "hasAnyAuthority('" + anyAuthorities + "')";
    }

    private static String hasIpAddress(String ipAddressExpression) {
   
        return "hasIpAddress('" + ipAddressExpression + "')";
    }

public interface MyService  {
   
    boolean hasPermission(HttpServletRequest request, Authentication authentication);
}

@Service
public class MyServiceImpl implements MyService {
   

    @Override
    public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
   
        Object principal = authentication.getPrincipal();
        String requestURI = request.getRequestURI();
        System.out.println(requestURI);
        if(principal instanceof User){
   
            User user=(User)principal;
            Collection<GrantedAuthority> authorities = user.getAuthorities();
            boolean contains = authorities.contains(new SimpleGrantedAuthority(requestURI));
            System.out.println(contains);
            return authorities.contains(new SimpleGrantedAuthority(requestURI));

        }

        return false;
    }
}

 http.authorizeRequests()
 .antMatchers("/testaccess").access("@myServiceImpl.hasPermission(request,authentication)")

    @RequestMapping("/testaccess")
    @ResponseBody
    public String toaccess(){
   
        return "testaccess";
    }