init

src/main/java/com/newyetai/security/decision/manager/SecurityDecisionManager.java

@@ -0,0 +1,45 @@
+package com.newyetai.security.decision.manager;
+
+import java.util.Collection;
+
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import com.newyetai.usercenter.authority.dto.PermissionQueryDTO;
+import com.newyetai.usercenter.dto.Resource;
+
+/**
+ * 权限决策管理器。<br>
+ * 实现{@link org.springframework.security.access.SecurityMetadataSource}来<br>
+ * 提供自己定义资源的权限信息，就可以实现权限决策判断
+ * 
+ * @author on 2019-11-05
+ */
+public interface SecurityDecisionManager {
+
+  /**
+   * 决策给定的资源，当前登录用户是否有权限
+   * 
+   * @param resource 资源
+   * @return 结果。true为有权限，否则没有
+   */
+  boolean decide(Resource resource, PermissionQueryDTO permissionQueryDTO);
+
+  /**
+   * 根据资源获取权限信息
+   * 
+   * @param resource 资源
+   * @return 权限列表
+   */
+  Collection<ConfigAttribute> findConfigAttributes(Resource resource, PermissionQueryDTO permissionQueryDTO);
+
+  /**
+   * 决策给定的资源，给定用户是否有权限
+   * 
+   * @param userDetails 用户实体
+   * @param resource 资源
+   * @return 结果。true为有权限，否则没有
+   * @author sr on 2019-10-16
+   */
+  boolean decide(UserDetails userDetails, Resource resource, PermissionQueryDTO permissionQueryDTO);
+}

src/main/java/com/newyetai/security/decision/manager/impl/SecurityDecisionManagerImpl.java

@@ -0,0 +1,86 @@
+package com.newyetai.security.decision.manager.impl;
+
+import java.util.Collection;
+import java.util.Collections;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.AccessDecisionManager;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.authentication.InsufficientAuthenticationException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Service;
+import org.springframework.util.CollectionUtils;
+
+import com.newyetai.security.access.metadata.ResourceSecurityMetadataSource;
+import com.newyetai.security.decision.manager.SecurityDecisionManager;
+import com.newyetai.usercenter.authority.dto.PermissionQueryDTO;
+import com.newyetai.usercenter.dto.Resource;
+
+/**
+ * 权限决策管理器
+ * 
+ * @author on 2019-11-05
+ */
+@Service
+public class SecurityDecisionManagerImpl implements SecurityDecisionManager {
+
+  @Autowired
+  private ResourceSecurityMetadataSource resourceSecurityMetadataSource;
+
+  @Autowired
+  private AccessDecisionManager accessDecisionManager;
+
+  @Override
+  public boolean decide(Resource resource, PermissionQueryDTO permissionQueryDTO) {
+    return decide(SecurityContextHolder.getContext().getAuthentication(), resource, permissionQueryDTO);
+  }
+
+
+  @Override
+  public boolean decide(UserDetails userDetails, Resource resource,
+      PermissionQueryDTO permissionQueryDTO) {
+    return decide(getAuthentication(userDetails), resource, permissionQueryDTO);
+  }
+
+  private boolean decide(Authentication authentication, Resource resource,
+      PermissionQueryDTO permissionQueryDTO) {
+    try {
+      Collection<ConfigAttribute> attributes = findConfigAttributes(resource, permissionQueryDTO);
+      accessDecisionManager.decide(authentication, resource, attributes);
+      return true;
+    } catch (AccessDeniedException e) {
+      return false;
+    } catch (InsufficientAuthenticationException e) {
+      return false;
+    }
+  }
+
+  /**
+   * 获取用户认证信息
+   * 
+   * @return
+   * @author sr on 2019-10-16
+   */
+  protected Authentication getAuthentication(UserDetails userDetails) {
+    return userDetails != null ? new UsernamePasswordAuthenticationToken(userDetails, null)
+        : SecurityContextHolder.getContext().getAuthentication();
+  }
+
+  @Override
+  public Collection<ConfigAttribute> findConfigAttributes(Resource resource,
+      PermissionQueryDTO permissionQueryDTO) {
+    Collection<ConfigAttribute> attributes = resource.getAttributes();
+    if (CollectionUtils.isEmpty(attributes)
+        && resourceSecurityMetadataSource.supports(resource.getClass())) {
+      return resourceSecurityMetadataSource.getAttributes(resource, permissionQueryDTO);
+    }
+    return Collections.emptyList();
+  }
+
+
+
+}