基于RBAC的Rest抽象资源权限控制设计及实现

@ApiOperation(value = "用户登录", notes = "用户登录")
    @ApiImplicitParam(name = "model", value = "密码,请传蜜文", required = true, paramType = "body",
        dataType = "LoginUserVo")
    @RequestMapping(value = "/login", method = RequestMethod.POST)
    public BaseResult<Map<String, Object>> doLogin(@RequestBody LoginUserVo model) throws ParameterException {
        String username = model.getUsername();
        String password = model.getPassword();
        BaseUserInfo baseUserInfo = authService.getAuthUser(username, password);
        boolean flag = false;
        Map<String, Object> result = new HashMap<String, Object>();
        
        if (baseUserInfo != null) {
            flag = true;
            result.put("userinfo", baseUserInfo);
            session.setAttribute(Constant.LOGIN_USERINFO, baseUserInfo);

            // 权限处理
            List<BasePermission> allPermissions = authService.getAllPermissions();
            List<BasePermission> userPermissions = authService.getPermissionListByRoleId(baseUserInfo.getRoleid());

            //转化为后端所需要的权限集合。方便做权限过滤
            List<PermissionVm> permissionVms = authService.transToBackendPermissions(allPermissions, userPermissions);
            session.setAttribute(Constant.SESSION_CURRENT_BACK_PERMISSION, permissionVms);

            //转化为前端所需要的权限集合。方便session api 中直接取
            Map<String, Map<String, Integer>> permissions
                = authService.transToFrontendPermissions(allPermissions, userPermissions);
            if (permissions == null) {
                permissions = new HashMap<>();
            }
            session.setAttribute(Constant.SESSION_CURRENT_FRONT_PERMISSION, permissions);
            result.put("permissions", permissions);
        }
        result.put("success", flag);
        return BaseResult.getInstance(ResponseCode.SUCCESS_0, result);
    }

@Override
    public List<PermissionVm> transToBackendPermissions(List<BasePermission> allPermissions, List<BasePermission> userPermissions) {
        List<PermissionVm>  permissionVms = new ArrayList<>();
        if (allPermissions == null
            || allPermissions.size() == 0 ) {
            return permissionVms;
        }

        allPermissions.stream().forEach(p -> {
        	  //判断是否有权限
            boolean isContain = userPermissions ==null ? false: userPermissions.stream()
                .filter(x -> p.getId().longValue() == x.getId().longValue())
                .findAny().isPresent();
            PermissionVm model = new PermissionVm();
            model.setId(p.getId());
            model.setParentCode(p.getParentCode());
            model.setCode(p.getCode());
            model.setUrl(p.getUrl());
            model.setMethod(p.getMethod());
            //增加的Contain字段 *，有权限为1 ，无该权限为0
            model.setContain(isContain ? (byte) 1 : (byte)0);
            permissionVms.add(model);
        });
        return permissionVms;
    }

@Override
    public Map<String, Map<String, Integer>> transToFrontendPermissions(
        List<BasePermission> allPermissions,
        List<BasePermission> permissions) {
        Map<String, Map<String, Integer>> returnMap = new HashMap<>();
        if (allPermissions == null
            || allPermissions.size() == 0) {
            return null;
        }

        List<BasePermission> resources = allPermissions.stream()
            .filter(p -> Constant.PERMISSION_RESOURCE_TYPE.equals(p.getParentCode()))
            .collect(Collectors.toList());

        //[{resource:{create:1,update:1,delete:0}},{resource:{create:1,update:1}}]
        for (BasePermission resource : resources) {
            if (resource.getId() != null && resource.getCode() != null
                && StringUtils.isNotEmpty(resource.getCode())) {
                //封装 前端所需结构
                //1. 从 全量 权限表中取出 resource 相关的权限
                List<BasePermission> _all_permissions = allPermissions.stream()
                    .filter(p -> resource.getCode().equals(p.getParentCode()))
                    .collect(Collectors.toList());
                //2. 从用户权限取出  resource 相关的权限
                List<String> _user_permissions = new ArrayList<>();
                if(permissions != null){
                    _user_permissions = permissions.stream()
                        .filter(p -> resource.getCode().equals(p.getParentCode()))
                        .map(p -> p.getCode()).collect(Collectors.toList());
                }
                //2. 循环 该资源的 权限集，根据用户的权限集进行判断
                Map<String, Integer> _singlePermission = new HashMap<>();
                for (BasePermission p : _all_permissions) {
                    if (_user_permissions.contains(p.getCode())) {
                        _singlePermission.put(p.getCode(), 1);
                    } else {
                        _singlePermission.put(p.getCode(), 0);
                    }
                }
                returnMap.put(resource.getCode(), _singlePermission);
            }
        }
        return returnMap;
    }

@Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String uri = request.getRequestURI();
        String method = request.getMethod();
        logger.info("AuthPermissionPolicy uri:" + uri + " -- method:" + method);
        //  todo 排除配置好的exclude url set
        HttpSession session = request.getSession();
        try {
            BaseUserInfo userInfo = (BaseUserInfo) session.getAttribute(Constant.LOGIN_USERINFO);
            if (userInfo != null) {
                // 权限拦截。在all权限中，不在user已分配的权限中，则权限验证失败
                // uri:/ark/events/1/properties -- method:GET
                // 1. 剔除contextPath
                String _url = uri.replace(contextPath, "");

                List<PermissionVm> permissions = (List<PermissionVm>) session.getAttribute(Constant.SESSION_CURRENT_BACK_PERMISSION);

                // 排除非空
                // method 匹配
                // url 规则匹配
                List<PermissionVm> _perms = permissions.stream()
                    .filter(p -> StringUtils.isNotEmpty(p.getMethod())
                        && p.getMethod().equals(method)
                        && StringUtils.isNotEmpty(p.getUrl())
                        && AntPathMatcherUtil.testUrl(p.getUrl(), _url)).collect(Collectors.toList());

                //如果不存在权限表中，则不做权限校验
                if (_perms == null || _perms.size() == 0) {
                    return true;
                }

                //如果存在权限表中
                //如果perms 判别size >1 ，则权限配置可以改进下
                //例如同时匹配 /events/** 和 /events/virtual/* ，这时候如果严格要求可以考虑最长匹配规则
                if (_perms.size() > 1) {
                    logger.warn("出现权限判别 重复的url:" + uri + ",method:" + method);
                    _perms.forEach(p -> logger.warn("出现权限判别 重复的权限集合:"
                        + ":" + p.getCode() + ":" + p.getUrl() + ":" + p.getMethod()));
                }
                // 只要_perms中存在 对应的权限，则通过权限校验，否则返回false
                for (PermissionVm pvm : _perms) {
                    if (pvm.getContain() == (byte) 1) {
                        return true;
                    }
                }
                BusinessUtil.sendFailedMessage(response, ResponseCode.CODE_104_UN_AUTH);
                return false;
            }

            BusinessUtil.sendFailedMessage(response, ResponseCode.CODE_106_SESSION_TIMEOUT);

        } catch (Exception e) {
            logger.error("AuthPermissionPolicy-exp发生异常", e);
        }
        return false;
    }

/**
 * Description:
 *
 * @author shenlongguang<https://github.com/ifengkou>
 * @date: 2018/4/13 下午7:41.
 */
public class AntPathMatcherUtil {
    private static final PathMatcher MATCHER = new AntPathMatcher();

    /**
     * 按照pattern规则匹配URL，匹配成功返回true
     * @param pattern
     * @param url
     * @return
     */
    public static boolean testUrl(String pattern, String url){
        if(StringUtils.isNotEmpty(pattern) && StringUtils.isNotEmpty(url)){
            return MATCHER.match(pattern,url);
        }
        return false;
    }

    /**
     * 是否在排除的集合中
     * @param urlPatternSet
     * @param url
     * @return
     */
    public static boolean isInExcludeUrlSet(Set<String> urlPatternSet, String url){
        //如果集合为空，直接返回false
        if(urlPatternSet ==null || urlPatternSet.size() ==0){
            return false;
        }
        for (String pattern : urlPatternSet) {
            if(MATCHER.match(pattern,url)){
                //如果匹配上了，返回true
                return true;
            }
        }
        return false;
    }
}