Skip to content

Commit c0c4829

Browse files
zhou-haozhou-hao
committed
1 parent eab4ce0 commit c0c4829

File tree

2 files changed

+56
-20
lines changed

2 files changed

+56
-20
lines changed

‎hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/handler/DefaultAuthorizingHandler.java

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,7 @@ protected void handleRBAC(Authentication authentication, AuthorizeDefinition def
160160
// 控制权限
161161
if (!definition.getPermissions().isEmpty()) {
162162
if (logger.isInfoEnabled()) {
163-
logger.info("执行权限控制:权限{}({}),操作{}.",
164-
definition.getPermissionDescription(),
163+
logger.info("执行权限控制:权限{},操作{}.",
165164
permissionsDef,
166165
actionsDef);
167166
}
@@ -192,35 +191,39 @@ protected void handleRBAC(Authentication authentication, AuthorizeDefinition def
192191
CollectionUtils.isNotEmpty(permissions) :
193192
//权限数量和配置的数量相同
194193
permissions.size() == permissionsDef.size();
194+
} else {
195+
access = false;
195196
}
196197
//控制角色
197198
if (!rolesDef.isEmpty()) {
198-
if (logger.isInfoEnabled()) {
199-
logger.info("do role access handle : roles{} , definition:{}", rolesDef, definition.getRoles());
200-
}
201-
Function<Predicate<Role>, Boolean> func = logicalIsOr
202-
? authentication.getRoles().stream()::anyMatch
203-
: authentication.getRoles().stream()::allMatch;
199+
Set<String> roleIds = authentication.getRoles().stream().map(Role::getId).collect(Collectors.toSet());
200+
201+
Function<Predicate<String>, Boolean> func = logicalIsOr
202+
? roleIds.stream()::anyMatch
203+
: roleIds.stream()::allMatch;
204204

205205
access = logicalIsOr
206-
? access || func.apply(role -> rolesDef.contains(role.getId()))
207-
: access && func.apply(role -> rolesDef.contains(role.getId()));
206+
? access || func.apply(rolesDef::contains)
207+
: access && func.apply(rolesDef::contains);
208+
if (logger.isInfoEnabled()) {
209+
logger.info("执行角色权限控制{},当前角色:{},限制角色:{}.", access ? "通过" : "拒绝", roleIds, rolesDef);
210+
}
208211
}
209212
//控制用户
210213
if (!usersDef.isEmpty()) {
211-
if (logger.isInfoEnabled()) {
212-
logger.info("do user access handle : users{} , definition:{} ", usersDef, definition.getUser());
213-
}
214+
String username = authentication.getUser().getUsername();
214215
Function<Predicate<String>, Boolean> func = logicalIsOr
215216
? usersDef.stream()::anyMatch
216217
: usersDef.stream()::allMatch;
217218
access = logicalIsOr
218-
? access || func.apply(authentication.getUser().getUsername()::equals)
219-
: access && func.apply(authentication.getUser().getUsername()::equals);
220-
221-
}
222-
if (!access) {
223-
throw new AccessDenyException(definition.getMessage());
219+
? access || func.apply(username::equals)
220+
: access && func.apply(username::equals);
221+
if (logger.isInfoEnabled()) {
222+
logger.info("执行用户权限控制{},当前用户:{},限制用户:{}.", access ? "通过" : "拒绝", username, usersDef);
223+
}
224+
if (!access) {
225+
throw new AccessDenyException(definition.getMessage());
226+
}
224227
}
225228
}
226229
}

‎hsweb-authorization/hsweb-authorization-basic/src/test/groovy/org/hswebframework/web/authorization/AuthorizeTests.java

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import org.hswebframework.web.authorization.define.AuthorizeDefinition;
1313
import org.hswebframework.web.authorization.define.AuthorizingContext;
1414
import org.hswebframework.web.authorization.define.Phased;
15+
import org.hswebframework.web.authorization.exception.AccessDenyException;
1516
import org.hswebframework.web.authorization.simple.*;
1617
import org.hswebframework.web.boost.aop.context.MethodInterceptorContext;
1718
import org.hswebframework.web.commons.entity.param.QueryParamEntity;
@@ -37,6 +38,9 @@ public class AuthorizeTests {
3738
@Mock
3839
private MethodInterceptorContext dynamicQuery;
3940

41+
@Mock
42+
private MethodInterceptorContext handleRole;
43+
4044
@Mock
4145
private Authentication authentication;
4246

@@ -67,6 +71,12 @@ public void init() throws NoSuchMethodException {
6771
when(dynamicQuery.getParams()).thenReturn(Collections.singletonMap("paramEntity", entity));
6872
when(dynamicQuery.getParameter("paramEntity")).thenReturn(Optional.of(entity));
6973

74+
//mock MethodInterceptorContext
75+
when(handleRole.getMethod()).thenReturn(TestClass.class.getMethod("handleRoleDeny", QueryParamEntity.class));
76+
when(handleRole.getTarget()).thenReturn(testClass);
77+
when(handleRole.getParams()).thenReturn(Collections.singletonMap("paramEntity", entity));
78+
when(handleRole.getParameter("paramEntity")).thenReturn(Optional.of(entity));
79+
7080

7181
//过滤字段
7282
AbstractDataAccessConfig fieldFilter = new SimpleFieldFilterDataAccessConfig("password", "salt");
@@ -110,9 +120,26 @@ public void testAuthorizingHandler() {
110120
authorizingContext.setDefinition(definition);
111121
authorizingContext.setParamContext(queryById);
112122

113-
handler.handRBAC(authorizingContext);
123+
try {
124+
handler.handRBAC(authorizingContext);
125+
Assert.fail("role access handle fail");
126+
} catch (AccessDenyException ignore) {
127+
128+
}
129+
}
130+
131+
@Test
132+
public void testIssue164() {
133+
DefaultAuthorizingHandler handler = new DefaultAuthorizingHandler();
134+
135+
AuthorizeDefinition definition = parser.parse(handleRole.getTarget().getClass(), handleRole.getMethod());
114136

137+
AuthorizingContext authorizingContext = new AuthorizingContext();
138+
authorizingContext.setAuthentication(authentication);
139+
authorizingContext.setDefinition(definition);
140+
authorizingContext.setParamContext(handleRole);
115141

142+
handler.handRBAC(authorizingContext);
116143
}
117144

118145
/**
@@ -190,6 +217,12 @@ public void dynamicQuery(QueryParamEntity paramEntity) {
190217
System.out.println(JSON.toJSON(paramEntity));
191218
}
192219

220+
221+
@Authorize(role = "admin")
222+
public void handleRoleDeny(QueryParamEntity paramEntity) {
223+
System.out.println(JSON.toJSON(paramEntity));
224+
}
225+
193226
}
194227

195228
public interface TestClassSuper {

0 commit comments

Comments
 (0)