Spring Security 自定义后台权限过滤的方案

1
@Service
2
@RequiredArgsConstructor
3
public class InyaaAccessDecisionManager implements AuthorizationManager<RequestAuthorizationContext> {
4

5
    private final SecurityMetadataSource securityMetadataSource;
6

7
    @Override
8
    public AuthorizationDecision check(Supplier<Authentication> authentication, RequestAuthorizationContext context) {
9
        Collection<ConfigAttribute> collection = this.securityMetadataSource.getAttributes(context);
10
        // 遍历角色
11
        for (ConfigAttribute ca : collection) {
12
            // ① 当前url请求需要的权限
13
            String needRole = ca.getAttribute();
14
            if ("ROLE_ANY".equals(needRole)) {
15
                return new AuthorizationDecision(true);
16
            } else {
17
                // ② 当前用户所具有的角色
18
                Collection<? extends GrantedAuthority> authorities = authentication.get().getAuthorities();
19
                for (GrantedAuthority authority : authorities) {
20
                    if ("ROLE_ANONYMOUS".equals(authority.getAuthority())) {
21
                        return new AuthorizationDecision(false);
22
                    } else {
23
                        return new AuthorizationDecision(true);
24
                    }
25
                }
26
            }
27
        }
28
        return new AuthorizationDecision(false);
29
    }
30
}

1
@Service
2
@RequiredArgsConstructor
3
public class InyaaFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
4

5
    private final CacheService cacheService;
6

7
    /***
8
     * 返回该url所需要的用户权限信息
9
     *
10
     * @param object: 储存请求url信息
11
     * @return: null：标识不需要任何权限都可以访问
12
     */
13
    @Override
14
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
15
        HttpServletRequest request = ((RequestAuthorizationContext) object).getRequest();
16
        Map<String, Collection<ConfigAttribute>> cacheMap = cacheService.getConfigAttributeMap();
17
        for (String url : cacheMap.keySet()) {
18
            if (new AntPathRequestMatcher(url).matches(request)) {
19
                return cacheMap.get(url);
20
            }
21
        }
22
        throw new AccessDeniedException("当前访问没有权限！");
23
    }
24

25
    @Override
26
    public Collection<ConfigAttribute> getAllConfigAttributes() {
27
        return null;
28
    }
29

30
    @Override
31
    public boolean supports(Class<?> aClass) {
32
        return FilterInvocation.class.isAssignableFrom(aClass);
33
    }
34
}

1
public Map<String, Collection<ConfigAttribute>> getConfigAttributeMap() {
2
    if (AuthCache.size() < 1) {
3
        List<InyawSysApi> list = inyawSysApiDao.findAll();
4
        for (InyawSysApi api : list) {
5
            List<ConfigAttribute> configAttributeList = new ArrayList<>();
6
            ConfigAttribute configAttribute;
7
            switch (api.getType()) {
8
                case 0 -> configAttribute = new SecurityConfig("ROLE_ANY");
9
                case 1 -> configAttribute = new SecurityConfig("ROLE_LOGIN");
10
                case 2 -> {
11
                    InyawSysRole role = inyawSysRoleService.getById(api.getId());
12
                    configAttribute = new SecurityConfig(role.getRoleKey());
13
                }
14
                default -> throw new IllegalStateException("错误的类型: " + api.getType());
15
            }
16
            configAttributeList.add(configAttribute);
17
            AuthCache.put(api.getUrl(), configAttributeList);
18
        }
19
    }
20
    return AuthCache;
21
}