Skip to content

Commit d2eba56

Browse files
zhou-haozhou-hao
committed
优化权限,修复controller重写父类导致注解失效的问题
1 parent 47ebcbc commit d2eba56

File tree

17 files changed

+115
-153
lines changed

17 files changed

+115
-153
lines changed

‎hsweb-authorization/hsweb-authorization-shiro/src/main/java/org/hswebframework/web/authorization/shiro/ShiroAutoconfiguration.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,8 @@ public MethodInterceptorHolderAdvisor methodInterceptorHolderAdvisor() {
184184
static class MethodInterceptorHolderAdvisor {
185185
@Around(value = "@annotation(org.hswebframework.web.authorization.annotation.RequiresExpression)" +
186186
"||@annotation(org.hswebframework.web.authorization.annotation.RequiresDataAccess)" +
187-
"||@annotation(org.hswebframework.web.authorization.annotation.Authorize)")
187+
"||@annotation(org.hswebframework.web.authorization.annotation.Authorize)" +
188+
"||within(@org.hswebframework.web.authorization.annotation.Authorize *)")
188189
public Object around(ProceedingJoinPoint pjp) throws Throwable {
189190
MethodSignature signature = (MethodSignature) pjp.getSignature();
190191
String methodName = AopUtils.getMethodBody(pjp);
@@ -202,14 +203,14 @@ public static class UnAuthControllerAdvice {
202203
@ResponseStatus(HttpStatus.FORBIDDEN)
203204
@ResponseBody
204205
ResponseMessage handleException(AuthorizationException exception) {
205-
return ResponseMessage.error(exception.getMessage(), 403);
206+
return ResponseMessage.error(403, exception.getMessage());
206207
}
207208

208209
@ExceptionHandler(UnauthenticatedException.class)
209210
@ResponseStatus(HttpStatus.UNAUTHORIZED)
210211
@ResponseBody
211212
ResponseMessage handleException(UnauthenticatedException exception) {
212-
return ResponseMessage.error(exception.getMessage() == null ? "{access_denied}" : exception.getMessage(), 401);
213+
return ResponseMessage.error(401, exception.getMessage() == null ? "{access_denied}" : exception.getMessage());
213214
}
214215
}
215216

‎hsweb-authorization/hsweb-authorization-shiro/src/main/java/org/hswebframework/web/authorization/shiro/boost/BoostAuthorizationAttributeSourceAdvisor.java

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@
2828
import org.hswebframework.web.authorization.annotation.RequiresExpression;
2929
import org.hswebframework.web.authorization.annotation.RequiresFieldAccess;
3030
import org.springframework.aop.support.StaticMethodMatcherPointcutAdvisor;
31-
import org.springframework.beans.factory.annotation.Autowired;
3231
import org.springframework.core.annotation.AnnotationUtils;
3332

3433
import java.lang.annotation.Annotation;
3534
import java.lang.reflect.Method;
35+
import java.util.Arrays;
3636

3737
/**
3838
* @author zhouhao
@@ -100,16 +100,28 @@ public void setSecurityManager(org.apache.shiro.mgt.SecurityManager securityMana
100100
*/
101101
public boolean matches(Method method, Class targetClass) {
102102
Method m = method;
103-
104103
if (isAuthzAnnotationPresent(m)) {
105104
return true;
106105
}
107-
108106
//The 'method' parameter could be from an interface that doesn't have the annotation.
109107
//Check to see if the implementation has it.
110108
if (targetClass != null) {
111109
try {
112-
m = targetClass.getMethod(m.getName(), m.getParameterTypes());
110+
//尝试解决由于被拦截的方法使用了泛型,并且重写了方法，导致无法获取父类方法的问题
111+
Class[] parameter = Arrays
112+
.stream(m.getParameterTypes())
113+
.map(type -> {
114+
if (type.isInterface()) return type;
115+
Class<?>[] interfaces = type.getInterfaces();
116+
if (interfaces.length > 0) return interfaces[0];
117+
Class superclass = type.getSuperclass();
118+
if (null != superclass && superclass != Object.class) {
119+
return superclass;
120+
}
121+
return type;
122+
})
123+
.toArray(Class[]::new);
124+
m = targetClass.getMethod(m.getName(), parameter);
113125
if (isAuthzAnnotationPresent(m)) {
114126
return true;
115127
}
@@ -131,5 +143,4 @@ private boolean isAuthzAnnotationPresent(Method method) {
131143
}
132144
return false;
133145
}
134-
135146
}

‎hsweb-authorization/hsweb-authorization-shiro/src/main/java/org/hswebframework/web/authorization/shiro/boost/DefaultFieldAccessController.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import org.hswebframework.web.authorization.access.FieldAccessController;
77
import org.hswebframework.web.authorization.access.ParamContext;
88
import org.hswebframework.web.commons.entity.Entity;
9+
import org.hswebframework.web.commons.entity.RecordCreationEntity;
910
import org.hswebframework.web.commons.entity.param.QueryParamEntity;
1011
import org.slf4j.Logger;
1112
import org.slf4j.LoggerFactory;
@@ -64,6 +65,11 @@ protected boolean doUpdateAccess(Set<FieldAccess> accesses, ParamContext params)
6465
} catch (Exception e) {
6566
}
6667
}
68+
if (entity instanceof RecordCreationEntity) {
69+
RecordCreationEntity creationEntity = ((RecordCreationEntity) entity);
70+
creationEntity.setCreateTime(null);
71+
creationEntity.setCreatorId(null);
72+
}
6773
} else {
6874
logger.warn("doUpdateAccess skip ,because can not found any entity in param!");
6975
}

‎hsweb-commons/hsweb-commons-controller/src/main/java/org/hswebframework/web/controller/CreateController.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
package org.hswebframework.web.controller;
1919

20+
import org.hswebframework.web.authorization.Permission;
2021
import org.hswebframework.web.authorization.annotation.Authorize;
2122
import org.hswebframework.web.controller.message.ResponseMessage;
2223
import org.hswebframework.web.logging.AccessLogger;
@@ -39,13 +40,13 @@
3940
* @author zhouhao
4041
* @since 3.0
4142
*/
42-
public interface CreateController<E, PK> {
43+
public interface CreateController<E, PK> {
4344

4445
InsertService<E, PK> getService();
4546

46-
@Authorize(action = "add")
47+
@Authorize(action = Permission.ACTION_ADD)
4748
@PostMapping
48-
@AccessLogger("添加数据")
49+
@AccessLogger("{action_add}")
4950
@ResponseStatus(HttpStatus.CREATED)
5051
default ResponseMessage add(@RequestBody E data) {
5152
return ok(getService().insert(data));

‎hsweb-commons/hsweb-commons-controller/src/main/java/org/hswebframework/web/controller/DeleteController.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
package org.hswebframework.web.controller;
1919

20+
import org.hswebframework.web.authorization.Permission;
2021
import org.hswebframework.web.authorization.annotation.Authorize;
2122
import org.hswebframework.web.controller.message.ResponseMessage;
2223
import org.hswebframework.web.logging.AccessLogger;
@@ -35,9 +36,9 @@ public interface DeleteController<PK> {
3536

3637
DeleteService<PK> getService();
3738

38-
@Authorize(action = "delete")
39+
@Authorize(action = Permission.ACTION_DELETE)
3940
@DeleteMapping(path = "/{id}")
40-
@AccessLogger("根据主键删除数据")
41+
@AccessLogger("{delete_by_primary_key}")
4142
default ResponseMessage deleteByPrimaryKey(@PathVariable PK id) {
4243
return ok(getService().deleteByPk(id));
4344
}

‎hsweb-commons/hsweb-commons-controller/src/main/java/org/hswebframework/web/controller/GenericEntityUpdateController.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
package org.hswebframework.web.controller;
1919

20+
import org.hswebframework.web.authorization.Permission;
2021
import org.hswebframework.web.authorization.annotation.Authorize;
2122
import org.hswebframework.web.commons.entity.GenericEntity;
2223
import org.hswebframework.web.controller.message.ResponseMessage;
@@ -37,9 +38,9 @@ public interface GenericEntityUpdateController<E extends GenericEntity<PK>, PK>
3738

3839
UpdateService<E> getService();
3940

40-
@Authorize(action = "update")
41+
@Authorize(action = Permission.ACTION_UPDATE)
4142
@PutMapping(path = "/{id}")
42-
@AccessLogger("根据主键修改数据")
43+
@AccessLogger("{update_by_primary_key}")
4344
default ResponseMessage updateByPrimaryKey(@PathVariable PK id, @RequestBody E data) {
4445
data.setId(id);
4546
return ResponseMessage.ok(getService().updateByPk(data));

‎hsweb-commons/hsweb-commons-controller/src/main/java/org/hswebframework/web/controller/QueryController.java

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
package org.hswebframework.web.controller;
1919

20+
import org.hswebframework.web.authorization.Permission;
2021
import org.hswebframework.web.authorization.annotation.Authorize;
2122
import org.hswebframework.web.commons.entity.Entity;
2223
import org.hswebframework.web.commons.entity.param.QueryParamEntity;
@@ -39,7 +40,7 @@
3940
* @see QueryParamEntity
4041
* @see 3.0
4142
*/
42-
public interface QueryController<E, PK, Q extends Entity> {
43+
public interface QueryController<E, PK, Q extends Entity> {
4344

4445
/**
4546
* 获取实现了{@link QueryByEntityService}和{@link QueryService}的服务类
@@ -59,16 +60,16 @@ public interface QueryController<E, PK, Q extends Entity> {
5960
* @param param 参数
6061
* @return 查询结果
6162
*/
62-
@Authorize(action = "read")
63+
@Authorize(action = Permission.ACTION_QUERY)
6364
@GetMapping
64-
@AccessLogger("根据条件查询")
65+
@AccessLogger("{dynamic_query}")
6566
default ResponseMessage list(Q param) {
6667
return ok(getService().selectPager(param));
6768
}
6869

69-
@Authorize(action = "read")
70+
@Authorize(action = Permission.ACTION_GET)
7071
@GetMapping(path = "/{id}")
71-
@AccessLogger("根据主键查询")
72+
@AccessLogger("{get_by_id}")
7273
default ResponseMessage getByPrimaryKey(@PathVariable PK id) {
7374
return ok(getService().selectByPk(id));
7475
}

‎hsweb-commons/hsweb-commons-controller/src/main/java/org/hswebframework/web/controller/UpdateController.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
package org.hswebframework.web.controller;
1919

20+
import org.hswebframework.web.authorization.Permission;
2021
import org.hswebframework.web.authorization.annotation.Authorize;
2122
import org.hswebframework.web.controller.message.ResponseMessage;
2223
import org.hswebframework.web.logging.AccessLogger;
@@ -30,8 +31,8 @@
3031
* @author zhouhao
3132
*/
3233
public interface UpdateController<E, PK> {
33-
@Authorize(action = "update")
34+
@Authorize(action = Permission.ACTION_UPDATE)
3435
@PutMapping(path = "/{id}")
35-
@AccessLogger("根据主键修改数据")
36+
@AccessLogger("{update_by_primary_key}")
3637
ResponseMessage updateByPrimaryKey(@PathVariable PK id, @RequestBody E data);
3738
}

0 commit comments

Comments
 (0)