SpringAOP01 利用AOP实现权限验证、利用权限验证服务实现权限验证

package cn.test.demo.base_demo.security;

/**
 * @author 王杨帅
 * @create 2018-04-29 17:15
 * @desc 模拟用户登录，该类可以设定用户和获取用户
 **/
public class CurrentSetHolder {
    private final static ThreadLocal<String> holder = new ThreadLocal<>();

    /**
     * 获取用户
     * @return
     */
    public static String get() {
        return holder.get() == null ? "unknown" : holder.get();
    }

    /**
     * 设定用户
     * @param user
     */
    public static void set(String user) {
        holder.set(user);
    }
}

package cn.test.demo.base_demo.service;

import cn.test.demo.base_demo.security.CurrentSetHolder;
import org.springframework.stereotype.Component;

/**
 * @author 王杨帅
 * @create 2018-04-29 17:19
 * @desc 权限校验服务类
 **/
@Component
public class AuthService {

    /**
     * 权限检查，如果用户不是 “admin" 就会报错
     */
    public void checkAccess() {
        String user = CurrentSetHolder.get();
        if (!"admin".equals(user)) {
            throw new RuntimeException("operation not allow.");
        }
    }
}

package cn.test.demo.base_demo.entity;

/**
 * @author 王杨帅
 * @create 2018-04-29 17:11
 * @desc 商品实体类
 **/
public class Product {
    private Integer id;
    private String name;

    public Product() {
    }

    public Product(Integer id, String name) {
        this.id = id;
        this.name = name;
    }

    public Integer getId() {
        return id;
    }

    public void setId(Integer id) {
        this.id = id;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    @Override
    public String toString() {
        return "Product{" +
                "id=" + id +
                ", name=‘" + name + ‘\‘‘ +
                ‘}‘;
    }
}

package cn.test.demo.base_demo.security;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface AdminOnly {
}

package cn.test.demo.base_demo.security;

/**
 * @author 王杨帅
 * @create 2018-04-29 17:15
 * @desc 模拟用户登录，该类可以设定用户和获取用户
 **/
public class CurrentSetHolder {
    private final static ThreadLocal<String> holder = new ThreadLocal<>();

    /**
     * 获取用户
     * @return
     */
    public static String get() {
        return holder.get() == null ? "unknown" : holder.get();
    }

    /**
     * 设定用户
     * @param user
     */
    public static void set(String user) {
        holder.set(user);
    }
}

package cn.test.demo.base_demo.security;

import cn.test.demo.base_demo.service.AuthService;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

/**
 * @author 王杨帅
 * @create 2018-04-29 17:37
 * @desc 权限检查的AOP类
 **/
@Aspect
@Component
public class SecurityAspect {
    @Autowired
    AuthService authService;

    @Pointcut("@annotation(AdminOnly)")
    public void adminOnly(){

    }

    @Before("adminOnly()")
    public void check(){
        authService.checkAccess();
    }
}