使用AOP+注解进行用户权限校验

1. 注解

首先自定义注解，主要是对不同的方法定义权限。

元注解：注解的注解

@Target(ElementType.METHOD)//作用于方法上
@Retention(RetentionPolicy.RUNTIME)//作用于运行时

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AuthCheck {
    String requireRole() default "";//设置默认需要的角色为null，根据不同的方法设置角色
}

    /**
     * 用户注册
     *
     * @param userRegisterRequest 用户注册请求对象
     * @return 返回响应封装对象
     */
    @AuthCheck(requireRole = "admin")//假设用户注册时要求为管理员权限
    @PostMapping("/register")
    public BaseResponse<Long> userRegister(@RequestBody UserRegisterRequest userRegisterRequest) {
        ThrowUtils.throwIf(userRegisterRequest == null, ErrorCode.PARAMS_ERROR, "参数为空");
        long userId = userService.userRegister(userRegisterRequest);
        return ResultUtils.success(userId);
    }

2. aop编程

环绕切面编程

import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import java.util.Objects;

@Aspect//JAspect框架，aop框架
@Component//让spring识别到当前的拦截器
public class AuthInterceptor {

    @Resource
    UserService userService;

    @Around("@annotation(authCheck)")
    public Object doInterceptor(ProceedingJoinPoint joinPoint, AuthCheck authCheck) throws Throwable {
        //1. 获取当前方法需要的角色
        String requireRole = authCheck.requireRole();
        UserRoleEnum userRequireRole = UserRoleEnum.getEnumByValue(requireRole);
        //2. 获取当前用户的角色
        HttpServletRequest servletRequest = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
        User user = userService.getLoginUser(servletRequest);
        UserRoleEnum userRoleEnum = UserRoleEnum.getEnumByValue(user.getUserRole());
        //3. 角色校验
        ThrowUtils.throwIf(userRoleEnum == null || !Objects.equals(userRequireRole, userRoleEnum), ErrorCode.NO_AUTH_ERROR);
        return joinPoint.proceed();
    }
}