简单实现登录权限效验

主要核心类：

上代码：
所需依赖：

  <!-- jwt -->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>${jwt.version}</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.0</version>
        </dependency>

**UserLoginToken** 加上该注解 必须登录才能访问

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface UserLoginToken {
    boolean required() default true;
}

PassToken 方法上使用 无需验证

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface PassToken {
    boolean required() default true;
}

@Configuration
public class InterceptorConfig  implements WebMvcConfigurer {
    /**
     *  拦截所有请求，通过判断是否有 @LoginRequired 注解 决定是否需要登录
     * @param registry
     */
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authenticationInterceptor())
                .addPathPatterns("/**")
                .excludePathPatterns("/user/**","/BackRoleMenu/getRoleMenuMany",
                        "/swagger-resources/**",
                        "/swagger-ui.html/**","/doc.html","/webjars/**");//放行登录
    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        //配置拦截器访问静态资源
        registry.addResourceHandler("/doc.html").addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/favicon.ico").addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
        registry.addResourceHandler("swagger-ui.html")
                .addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**")
                .addResourceLocations("classpath:/META-INF/resources/webjars/");
        WebMvcConfigurer.super.addResourceHandlers(registry);
    }



    @Bean
    public AuthenticationInterceptor authenticationInterceptor() {
        return new AuthenticationInterceptor();
    }

public class AuthenticationInterceptor implements HandlerInterceptor {


    @Autowired
    private DoctorMapper doctorMapper;

    @Autowired
    private BackUserRoleService userRoleService;
    @Autowired
    private BackRoleService roleService;


    @Override
    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse response, Object object) throws Exception {
        String token ="";
       token = this.getToken(httpServletRequest);

        System.out.println("Token为："+token);
        // 验证 token
        Map<String,String> map=new HashMap<>();


        // 如果不是映射到方法直接通过
        if(!(object instanceof HandlerMethod)){
            return true;
        }

        HandlerMethod handlerMethod=(HandlerMethod)object;
        PassToken handlePass = handlerMethod.getBean().getClass().getDeclaredAnnotation(PassToken.class);
        //判断如果请求的类是swagger的控制器，直接通行。
        if(handlerMethod.getBean().getClass().getName().equals("springfox.documentation.swagger.web.ApiResourceController")){
            return  true;
        }

        Method method=handlerMethod.getMethod();
        //检查是否有passtoken注释，有则跳过认证
        if (method.isAnnotationPresent(PassToken.class)) {
            PassToken passToken = method.getAnnotation(PassToken.class);
            if (passToken.required()) {
                return true;
            }
        }
        //检查有没有需要用户权限的注解
        if (method.isAnnotationPresent(UserLoginToken.class)) {

            if(StrUtil.isEmptyOrUndefined(token)){
                token= this.getCookies(httpServletRequest);
            }
            UserLoginToken userLoginToken = method.getAnnotation(UserLoginToken.class);
            if (userLoginToken.required()) {

                    //权限验证
                    System.out.println("开始验证Token权限。。。。");
                    HttpServletRequest request= ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
                    String url=this.getURL(request);
                    String askMethod=this.getMethod(request);
//                    String cookies = this.getCookies(request);
//                    System.out.println("Token为："+cookies);
                    System.out.println("URL为："+url);
                    System.out.println("Method为："+askMethod);
                    //判断token是否为空
                    if(StrUtil.isEmptyOrUndefined(token)){
                        throw new CustomException(301, "无token,请重新登录");
                    }else{
                        Map mapToken = JWTUtils.getUserNameFromToken(token);
                        String phone = (String)mapToken.get("phone");
                        //数据库中查询用户角色的权限
                        DoctorExample example=new DoctorExample();
                        DoctorExample.Criteria criteria = example.createCriteria();
                        criteria.andPhoneEqualTo(phone);
                        List<Doctor> doctors = doctorMapper.selectByExample(example);
                        if(doctors.size()>0&&doctors!=null){
                            BaseResult userRoleList = userRoleService.getUserRoleList(doctors.get(0).getId());
                            if(userRoleList.getData()==null){
                                System.out.println("用户角色");
                                throw  new CustomException(304,"该用户没有未分配角色权限");
                            }else{
                                List<SysUserRole> data = (List<SysUserRole>)userRoleList.getData();
                                List<Long> idList=new ArrayList<>();
                                data.forEach(e->{
                                    idList.add(e.getRoleId());
                                });
                                //根据角色获取角色请求权限
                                BaseResult roleMenuListMany = roleService.getRoleASKUrlList(idList);
                                if(roleMenuListMany.getData()==null){
                                    System.out.println("请求角色权限");
                                    throw new CustomException(304,"该用户没有角色权限");
                                }else{
                                    Set<String> data1 = (Set<String>)roleMenuListMany.getData();
                                    if(!data1.contains(url)){
                                        System.out.println("该用户分配的权限不包含该权限");
                                        throw new CustomException(304,"该用户拥有权限不包含此操作");
                                    }
                                }
                            }
                        }else{
                            throw new CustomException(303,"用户不存在");
                        }
                    }
                }

        }

        return true;
    }

    @Override
    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {

    }
    @Override
    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {

    }


    public String getToken(HttpServletRequest request){
        return request.getHeader("token");
    }
    public String getURL(HttpServletRequest request){
        String requestURI = request.getRequestURI();
      //  String s = StrUtil.removePreAndLowerFirst(requestURI, 1);
        return requestURI;
    }
    public String getMethod(HttpServletRequest request){
        return request.getMethod();
    }

    public String getCookies(HttpServletRequest request){
        String token="";
        Cookie[] cookies = request.getCookies();
       for(int i=0;i<cookies.length;i++){
           if(cookies[i].getName().equals("zvfptoken")){
             token=  cookies[i].getValue();
             break;
           }
       }
        return token;
    }