java 基于Security自定义注解跳过权限判断

清疚 2023-09-27 23:46 1阅读 0赞

*  **需求**：客户端接口有的需要权限控制，有的不需要权限控制
 *  **技术栈**：Spring Security

### 步骤一：自定义注解 ###

@Documented
    @Target({
        ElementType.TYPE, ElementType.METHOD})
    @Retention(RetentionPolicy.RUNTIME)
    @Import(AuthControlRegistrar.class)
    @Component
    public @interface ClientAuthControl {
        
    
        String value() default "";
    
    }

### 步骤二：扫描指定注解 ###

@Slf4j
    @Component
    public class AuthControlRegistrar implements ImportBeanDefinitionRegistrar, EnvironmentAware {
        
    
        private Environment environment;
    
        private static Set<BeanDefinition> candidateComponents = new HashSet<>();
    
        public static Set<String> URL_NOT_AUTH = new HashSet<>();
    
        @Override
        public void setEnvironment(Environment environment) {
        
              this.environment = environment;
        }
    
    
        @Override
        public void registerBeanDefinitions(AnnotationMetadata annotationMetadata, BeanDefinitionRegistry registry) {
        
    
            // 筛选指定注解
            ClassPathScanningCandidateComponentProvider scan = new ClassPathScanningCandidateComponentProvider(false, this.environment);
    
            scan.addIncludeFilter(new AnnotationTypeFilter(ClientAuthControl.class));
    
            String packageName = ClassUtils.getPackageName(annotationMetadata.getClassName());
    
            candidateComponents.addAll(scan.findCandidateComponents(packageName));
        }
    
    
        @SneakyThrows
        @PostConstruct
        private void getNotAuthInfo() {
        
    
            // 根据筛选的注解进行 权限控制
            for (BeanDefinition candidateComponent : candidateComponents) {
        
    
                // 反射获取注解类的方法属性
                String beanClassName = candidateComponent.getBeanClassName();
                Class<?> aClass = Class.forName(beanClassName);
                RequestMapping annotation = aClass.getAnnotation(RequestMapping.class);
    
                String classUrl = "";
                if (annotation != null) {
        
                    String[] classUrls = annotation.value();
                    classUrl = arrToString(classUrls);
                }
    
    
                Method[] methods = aClass.getDeclaredMethods();
    
                for (Method method : methods) {
        
    
                    if (!method.isAnnotationPresent(ClientAuthControl.class)){
        
                        continue;
                    }
    
                    String mode;
                    String url ;
    
                    RequestMapping requestMapping;
                    GetMapping getMapping;
                    PostMapping postMapping;
                    PutMapping putMapping;
                    DeleteMapping deleteMapping;
                    PatchMapping patchMapping;
    
                    if (null != (requestMapping = method.getAnnotation(RequestMapping.class))){
        
                        String[] value = requestMapping.value();
                        RequestMethod[] requestMethods = requestMapping.method();
                        mode = arrToString(requestMethods);
                        url = arrToString(value);
                    }else if (null != (getMapping = method.getAnnotation(GetMapping.class))) {
        
                        String[] value = getMapping.value();
                        mode = RequestMethod.GET.name();
                        url = arrToString(value);
                    }else if (null != (postMapping = method.getAnnotation(PostMapping.class))) {
        
                        String[] value = postMapping.value();
                        mode = RequestMethod.POST.name();
                        url = arrToString(value);
                    }else if (null != (putMapping = method.getAnnotation(PutMapping.class))) {
        
                        String[] value = putMapping.value();
                        mode = RequestMethod.PUT.name();
                        url = arrToString(value);
                    }else if (null != (deleteMapping = method.getAnnotation(DeleteMapping.class))) {
        
                        String[] value = deleteMapping.value();
                        mode = RequestMethod.DELETE.name();
                        url = arrToString(value);
                    }else if (null != (patchMapping = method.getAnnotation(PatchMapping.class))) {
        
                        String[] value = patchMapping.value();
                        mode = RequestMethod.PATCH.name();
                        url = arrToString(value);
                    }else continue;
    
    
                    // 判断是否以"/"开头 不是则加上
                    if (!url.startsWith("/")) {
        
                        url = "/" + url;
                    }
    
    
                    // 判断URL上是否有动态参数/{}
                    if (url.contains("{") && url.contains("}")) {
        
                        url = url.substring(0,url.indexOf("{"));
                    }
    
    
                    url = classUrl + url;
    
                    URL_NOT_AUTH.add(String.format("%s_%s",mode,url));
                }
            }
        }
    
    
        private String arrToString(Object[] arr) {
        
            StringBuilder sb = new StringBuilder();
    
            for (int i = 0; i < arr.length; i++) {
        
                sb.append(arr[i].toString());
                if (i != (arr.length -1)) {
        
                    sb.append(",");
                }
            }
    
            return sb.toString();
        }

### 步骤三：权限判断 ###

@Slf4j
    @Component
    public class TokenOncePerRequestFilter extends OncePerRequestFilter {
        
    
        @Resource
        private JwtProperties jwtProperties;
    
        @Resource
        JwtUser jwtUser;
    
        @Resource
        private MyUserDetailsService myUserDetailsService;
    
        /**
         *
         * @param request
         * @return
         */
        private boolean notRequiresAuthentication(HttpServletRequest request) {
        
            String uri = request.getRequestURI();
    
            for (String s : START_WITH_PERMIT_ALL_URL){
        
                if (uri.startsWith(s)) {
        
                    return true;
                }
            }
    
    
            return false;
        }
    
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        
    
            BaseRes<String> res = new BaseRes<>(TOKEN_INVALID);
    
            out: if (!this.notRequiresAuthentication(request)) {
        
    
                // 获取请求的token
                String authToken = request.getHeader(jwtProperties.getHeader());
                if (StringUtils.isBlank(authToken)) {
        
                    authToken = request.getParameter("access_token");
                }
    
                String tokenHead = "Bearer ";
                String uri = request.getRequestURI();
    
    
                // 判断接口是否需要权限
                String method = request.getMethod();
                String urlFlag = String.format("%s_%s",method,uri);
    
                for (String authUrl : AuthControlRegistrar.URL_NOT_AUTH) {
        
                    if (authUrl.contains(urlFlag) || urlFlag.contains(authUrl)) {
        
                        break out;
                    }
                }
    
                if (StringUtils.isBlank(authToken) || !authToken.startsWith(tokenHead)) {
        
    
                    log.error("token is null uri={}, url={}", request.getRequestURI(), request.getRequestURL());
                    CommUtils.printObjJson(response, res);
                    return;
                }
    
    
                authToken = authToken.substring(tokenHead.length());
    
                try {
        
                    // 验证token是否有效
                    String rawJson = jwtUser.getClaimByToken(authToken);
    
                    /**
                     * 登录用户信息设置
                     */
                    TokenUser tokenUser = myUserDetailsService.loadUserByUsername(rawJson);
    
                    String type = tokenUser.getType();
    
                    String s = String.format("/%s", type).toLowerCase();
    
                    // 判断用户类型 是否请求对应的接口
                    if (!uri.startsWith(s)) {
        
                        CommUtils.printObjJson(response, res);
                        return;
                    }
    
    
                    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(tokenUser, null, tokenUser.getAuthorities());
                    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authentication);
    
                } catch (Exception e) {
         // JWTDecodeException SignatureVerificationException
                    ExceptionUtils.setExceptionMsg(e, res);
                    CommUtils.printObjJson(response, res);
                    return;
                }
            }
    
            filterChain.doFilter(request, response);
        }
    }

### 步骤四：因为只做了后台动态权限，客户端则需要把所有权限添加进去 ###

public static final String CLIENT_START_URL = "/client";
    
     	@Override
        protected void configure(HttpSecurity http) throws Exception {
        
    
            http.headers().frameOptions().disable();
            http.csrf().disable();
    
            initAuth(http); // 初始化权限
            http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); // 无session状态
    
            http
                    .authorizeRequests()
                    .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                    .antMatchers(CLIENT_START_URL + "/**").permitAll()
                    .anyRequest().authenticated()
            ;
    
            http.addFilterAfter(tokenOncePerRequestFilter, SecurityContextPersistenceFilter.class);
    
            // handling
            http.exceptionHandling()
                    .authenticationEntryPoint(entryPointUnauthorizedHandler)// 身份认证
                    .accessDeniedHandler(restAccessDeniedHandler) // 授权
            ;
    
        }

### 步骤五：添加注解到Controller 的类上和指定方法上 ###

@RestController
    @RequestMapping("/client/policy")
    @ClientAuthControl
    public class PartyPolicyClientController {
        
        @Resource
        private PartyPolicyService partyPolicyService;
    
    
        @PostMapping("/list")
        @ClientAuthControl
        public BaseRes<IPage<PartyPolicyVo>> selectPartyPolicyList(@RequestBody PageMessage<PartyPolicyVo> pageMessage) {
        
            return partyPolicyService.selectPartyPolicyList(pageMessage.getT(),pageMessage.getPage());
        }
    
        @GetMapping("/info")
        @ClientAuthControl
        public BaseRes<PartyPolicy> getPartyPolicyDetail(@RequestParam("id") Integer id) {
        
            return partyPolicyService.getPartyPolicyDetail(id);
        }
    
    }

### 大功告成。客户端请求该接口时则跳过权限判断 ###