SpringBoot+拦截器+自定义异常+自定义注解+全局异常处理简单实现接口权限管理

public class Constant {
    /**
     * 权限管理
     */
    public static Map<Integer,String[]> permission=new HashMap<>();
    static {
        String[] frist={"/url1","/url2","/url3","/url4","/url5","/url6","/url7"};//用户1所拥有的URL权限
        String[] second={"/url1","/url2","/url3","/url4","/url5"};//用户2所拥有的URL权限
        String[] third={"/url1","/url2","/url3"};//用户3所拥有的URL权限
        permission.put(1,frist);
        permission.put(2,second);
        permission.put(3,third);

    }
}

public class APIException extends RuntimeException {
    private static final long serialVersionUID = 1L;
    private String msg;
    public APIException(String msg) {
        super(msg);
        this.msg = msg;
    }
}

@RestControllerAdvice
public class WebExceptionControl {
    
    @ExceptionHandler(APIException.class)
    public String APIExceptionHandler(APIException e) {
        return e.getMessage();
    }
}

/**
 * 权限管理URL拦截器
 */
public class URLInterceptor implements HandlerInterceptor {

    // 预处理回调方法，在接口调用之前使用  true代表放行  false代表不放行
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        String token = httpServletRequest.getHeader("token");
        String requestURL = httpServletRequest.getRequestURI();
        //1.根据token判断用户是否登录
        if (token==null){   //正常情况下这里还需判断与redis中的token是否匹配
            // 如果没有token或者token不匹配, 直接抛出异常  提示未登录
            throw  new APIException("当前用户未登录");
        }
        //2.登录成功后 根据用户token中的信息获取到用户对应的URL权限集合
        String[] strings = Constant.permission.get(Integer.valueOf(token));
        boolean hasPermission = false;
        //3.再根据用户对应的URL集合去与当前请求的URL对比  有匹配的则放行  反之则抛出异常
        for (int i =0;i<strings.length;i++) {
            if (strings[i].equals(requestURL)){
                hasPermission = true;
                break;
            }
        }
        if (hasPermission){
            return true;
        }else {
            throw  new APIException("当前用户没有访问路径" + requestURL + "的权限");
        }
    }
}

@Configuration
public class WebMvcConfg implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        //权限拦截器
        registry.addInterceptor(urlInterceptor()).addPathPatterns("/**");
    }
    @Bean
    public URLInterceptor urlInterceptor(){
        return new URLInterceptor();
    }
}

public class Constant {
    /**
     * 权限管理
     */
    public static Map<Integer,String[]> permission=new HashMap<>();
    static {
        String[] frist={"insert","delete","select","update"};//用户1所拥有的操作权限
        String[] second={"insert","select","update"};//用户2所拥有的URL权限
        String[] third={"select"};//用户3所拥有的URL权限
        permission.put(1,frist);
        permission.put(2,second);
        permission.put(3,third);

    }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface UrlAnnotation {
    /**
     * 操作类型(type):添加,删除,修改,插入
     * 
     */
    String type();
}

public class Constant {
    /**
     * 权限管理
     */
    public static Map<Integer,String[]> permission=new HashMap<>();
    static {
        String[] frist={"test","test1"};//用户1所拥有的模块权限  这里的test是模块URL入口  例如：test模块下所有URL都是/test/**
        String[] second={"test"};//用户2所拥有的模块权限
        permission.put(1,frist); //这里的1其实是用户对应ID为1的角色
        permission.put(2,second);//这个2同理

    }
}