权限系统的设计与实现

/**
 * 继承配置类以完成拦截.
 * @author yuhanliu
 * @since 1.8
 *
 */
@EnableConfigurationProperties(WwpjwConfig.class)
@EnableGlobalMethodSecurity(prePostEnabled = true)  // 重点是开启注解配置
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  // Security 基本配置**省略**

@RestController
@RequestMapping("/admin/user") 
public class UserController {
    // ......
    @PreAuthorize("hasAuthority('ROLE_ADMIN') or #reqVo.sysUser.username == #userDetails.username")
    @PostMapping("/findUsers")
    public Result<List<SysUser>> findUsers(@Validated @RequestBody FindUsersReqVo reqVo, @AuthenticationPrincipal UserDetails userDetails) {
        PageInfo<SysUser> pageInfo = userService.findUsers(reqVo);
        return new Result<>(pageInfo.getList(), pageInfo.getTotal());
    }
}

public interface PermissionRepository extends JpaRepository<Permission, String> {

  /**
   * 获取指定角色id的所有权限.
   * 结果一定是没有重复元素的.
   * @param roleId 角色信息
   * @param type 1表示后端接口，0表示前端url
   * @return 权限列表
   */
  @Query(nativeQuery = true,
  value = "SELECT p.* FROM role r LEFT JOIN role_permission rp ON  r.id = rp.role_id AND r.id = ?1 "
    + "INNER JOIN permission p ON rp.permission_id = p.id AND p.type = ?2")
  List<Permission> findAllByRoleId(String roleId, boolean type);


  /**
   * 获取指定角色id列表的所有权限.
   * @param roleIdList 角色id列表
   * @param type 1表示后端接口，0表示前端url
   * @return 权限列表
   */
  @Query(nativeQuery = true,
  value = "SELECT DISTINCT p.id, p.name, p.code, p.url, p.type, p.method, p.sort, p.parent FROM role r LEFT JOIN role_permission rp ON  r.id = rp.role_id AND r.id in (:roleIdList) "
    + "INNER JOIN permission p ON rp.permission_id = p.id AND p.type = :type")
  List<Permission> findAllByRoleIdList(@Param("roleIdList") List<String> roleIdList, @Param("type") boolean type);
}

public interface RoleRepository extends JpaRepository<Role, String> {

  /**
   * 获取指定用户id的所有角色信息包含inactive_time、delete_time.
   * @param userId 用户id
   * @return 未经处理的角色信息列表
   */
  @Query(nativeQuery = true ,
  value = "SELECT r.id, r.name, r.code, r.description, r.delete_time, r.create_time, ur.inactive_time, ur.associate_time, ur.unlock_time " +
  "FROM user u LEFT JOIN user_role ur ON u.id = ur.user_id AND u.id = ?1 " +
  "INNER JOIN role r ON r.id = ur.role_id")
  List<RoleRelatedVo> findAllByUserId(String userId);
}

@Service
public class PermissionServiceImpl implements PermissionService {

  @Resource
  private PermissionRepository permissionRepository;

  @Override
  public List<Permission> getAllByRoleId(String roleId, boolean api) {
    return permissionRepository.findAllByRoleId(roleId, api);
  }

  @Override
  public List<Permission> getAllByRoleIdList(List<String> roleIdList, boolean api) {
    return permissionRepository.findAllByRoleIdList(roleIdList, api);
  }
}

@Service
public class RoleServiceImpl implements RoleService {

  @Resource
  private RoleRepository roleRepository;

  /**
   * 通过用户id获取用户所有角色（是否删除，是否有效）.
   * @param userId 用户id
   * @param excludeInactive user_role 中 inactive_time 是否为 null
   * @param excludeDeleted role 中 delete_time 是否为 null
   * @param excludeLock user_role 中 unlock_time 是否小于当前时间
   * @return {@code List<RoleRelatedVo>} 用户角色相关信息列表
   */
  @Override
  public List<RoleRelatedVo> getAllByUserId(String userId, boolean excludeInactive, boolean excludeDeleted, boolean excludeLock) {
    List<RoleRelatedVo> roleRelatedVos = roleRepository.findAllByUserId(userId);
    // 没有一个角色就直接返回包含0个值的列表，这没有什么问题，同时避免之后 stream 的为空问题。
    if (roleRelatedVos.isEmpty()) {
      return roleRelatedVos;
    }
    if (excludeInactive) {
      // 留下的角色都是：1 失效时间为 null 表示永不失效，2 失效时间在当前时间之后【开通一个月会员功能】
      roleRelatedVos = roleRelatedVos.stream().filter(roleRelatedVo -> roleRelatedVo.getInactiveTime() == null
        || roleRelatedVo.getInactiveTime().isAfter(LocalDateTime.now())).collect(Collectors.toList());
    }
    if (excludeDeleted) {
      // 留下的角色都是：删除时间为 null 表示未删除
      roleRelatedVos = roleRelatedVos.stream().filter(roleRelatedVo -> roleRelatedVo.getDeleteTime() == null)
        .collect(Collectors.toList());
    }
    if (excludeLock) {
      // 留下的角色都是：解锁时间小于当前时间【禁言功能】
      roleRelatedVos = roleRelatedVos.stream().filter(roleRelatedVo -> LocalDateTime.now().isAfter(roleRelatedVo.getUnlockTime()))
        .collect(Collectors.toList());
    }
    return roleRelatedVos;
  }

  @Override
  public List<RoleRelatedVo> getAllByUserId(String userId) {
    return getAllByUserId(userId, true, true, true);
  }