利用自定义注解结合Spring AOP实现权限控制、日志记录、统一异常处理、数字签名、数据加解密等功能,实现思路如下:
- 权限控制
定义一个自定义注解@AccessControl
,用于标记需要进行权限控制的方法:
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AccessControl {
String[] roles();
}
在需要进行权限控制的方法上加上该注解,如下所示:
@AccessControl(roles = {"admin"})
public void deleteOrder(String orderId) {
// 删除订单
}
定义一个切面AccessControlAspect
,用于拦截@AccessControl
注解标记的方法,并进行权限校验:
@Aspect
@Component
public class AccessControlAspect {
@Autowired
private UserService userService;
@Before("@annotation(com.example.demo.annotation.AccessControl) && args(..)")
public void checkAccessControl(JoinPoint joinPoint) throws Exception {
MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature();
AccessControl accessControl = methodSignature.getMethod().getAnnotation(AccessControl.class);
String[] roles = accessControl.roles();
User currentUser = userService.getCurrentUser();
if (!Arrays.asList(roles).contains(currentUser.getRole())) {