🔄Update: 构建切面类

src/main/java/cn/hezhaohui/pc/aspect/AuthorizeAspect.java

@@ -1,15 +1,28 @@
 package cn.hezhaohui.pc.aspect;
 
+import cn.hezhaohui.pc.annotation.PreAuthorize;
+import cn.hezhaohui.pc.mapper.UserPermissionMapper;
+import jakarta.annotation.Resource;
 import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.Signature;
 import org.aspectj.lang.annotation.Around;
 import org.aspectj.lang.annotation.Aspect;
 import org.aspectj.lang.annotation.Pointcut;
+import org.aspectj.lang.reflect.MethodSignature;
 import org.springframework.stereotype.Component;
 
+import java.lang.reflect.Method;
+import java.util.List;
+
+import static cn.hezhaohui.pc.service.UserService.loginUser;
+
 @Component
 @Aspect
 public class AuthorizeAspect {
 
+    @Resource
+    private UserPermissionMapper userPermissionMapper;
+
     @Pointcut("@annotation(cn.hezhaohui.pc.annotation.PreAuthorize)")
     public void authorizePointCut() {
 
@@ -17,14 +30,24 @@ public class AuthorizeAspect {
 
     /**
      * 对后端接口鉴权
-     *  1. 获取当前用户角色
-     *  2. 获取角色对应权限
-     *  3. 判断当前权限标识符是否被包含
+     * 1. 获取当前用户角色
+     * 2. 获取角色对应权限
+     * 3. 判断当前权限标识符是否被包含
+     *
      * @return
      */
     @Around("authorizePointCut()")
     public Object handle(ProceedingJoinPoint joinPoint) throws Throwable {
-        // TODO
-        return joinPoint.proceed();
+        List<String> permissions = userPermissionMapper.selectPermissionByUserId(loginUser.get().getId());
+
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        Method method = signature.getMethod();
+        String permission = method.getAnnotation(PreAuthorize.class).value();
+
+        if (permissions.contains(permission)) {
+            return joinPoint.proceed();
+        } else {
+            throw new RuntimeException("权限不足");
+        }
     }
 }

src/main/java/cn/hezhaohui/pc/controller/ProductController.java

@@ -1,5 +1,6 @@
 package cn.hezhaohui.pc.controller;
 
+import cn.hezhaohui.pc.annotation.PreAuthorize;
 import cn.hezhaohui.pc.entity.Product;
 import cn.hezhaohui.pc.service.ProductService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -19,30 +20,35 @@ public class ProductController {
 
     @GetMapping
     @Operation(summary = "列出所有商品")
+    @PreAuthorize("PRODUCT_READ")
     public List<Product> listAll() {
         return productService.listAll();
     }
 
     @GetMapping("/{id}")
     @Operation(summary = "通过id查找商品")
+    @PreAuthorize("PRODUCT_READ")
     public Product findById(@PathVariable Long id) {
         return productService.getById(id);
     }
 
     @PostMapping
     @Operation(summary = "添加商品")
+    @PreAuthorize("PRODUCT_CREATE")
     public void add(@RequestBody Product product) {
         productService.saveProduct(product);
     }
 
     @PutMapping
     @Operation(summary = "更新商品")
+    @PreAuthorize("PRODUCT_UPDATE")
     public void update(@RequestBody Product product) {
         productService.updateProduct(product);
     }
 
     @DeleteMapping("/{id}")
     @Operation(summary = "删除商品")
+    @PreAuthorize("PRODUCT_DELETE")
     public void delete(@PathVariable Long id) {
         productService.deleteProduct(id);
     }

src/main/java/cn/hezhaohui/pc/controller/UserController.java

@@ -16,6 +16,12 @@ public class UserController {
     @Resource
     private UserService userService;
 
+    @PostMapping("/login")
+    @Operation(summary = "用户登录")
+    public String login(@RequestBody User user) {
+        return userService.login(user);
+    }
+
     @GetMapping
     @Operation(summary = "列出所有用户")
     public List<User> listAll() {

src/main/java/cn/hezhaohui/pc/mapper/UserPermissionMapper.java

@@ -0,0 +1,10 @@
+package cn.hezhaohui.pc.mapper;
+
+import org.apache.ibatis.annotations.Mapper;
+
+import java.util.List;
+
+@Mapper
+public interface UserPermissionMapper {
+    public List<String> selectPermissionByUserId(Long userId);
+}

src/main/java/cn/hezhaohui/pc/service/UserService.java

@@ -5,10 +5,15 @@ import cn.hezhaohui.pc.entity.User;
 import java.util.List;
 
 public interface UserService {
+
+    ThreadLocal<User> loginUser = new ThreadLocal<>();
+
     List<User> listAll();
     User getById(Long id);
     void saveUser(User user);
     void updateUser(User user);
     void deleteUser(Long id);
 
+    String login(User user);
+    String logout();
 }

src/main/java/cn/hezhaohui/pc/service/impl/UserServiceImpl.java

@@ -3,6 +3,7 @@ package cn.hezhaohui.pc.service.impl;
 import cn.hezhaohui.pc.entity.User;
 import cn.hezhaohui.pc.mapper.UserMapper;
 import cn.hezhaohui.pc.service.UserService;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import jakarta.annotation.Resource;
 import org.springframework.stereotype.Service;
 
@@ -11,6 +12,9 @@ import java.util.List;
 
 @Service
 public class UserServiceImpl implements UserService {
+
+    ThreadLocal<User> loginUser = new ThreadLocal<>();
+
     @Resource
     private UserMapper userMapper;
 
@@ -43,4 +47,17 @@ public class UserServiceImpl implements UserService {
     public void deleteUser(Long id) {
         userMapper.deleteById(id);
     }
+
+    @Override
+    public String login(User user) {
+        User result = userMapper.selectOne(new QueryWrapper<User>().eq("username", user.getUsername()));
+        loginUser.set(result);
+        return "Hello, " + result.getUsername() + "!";
+    }
+
+    @Override
+    public String logout() {
+        loginUser.remove();
+        return "Good bye!";
+    }
 }

src/main/resources/cn/hezhaohui/pc/mapper/UserPermissionMapper.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE mapper
+        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
+        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
+<mapper namespace="cn.hezhaohui.pc.mapper.UserPermissionMapper">
+
+
+    <select id="selectPermissionByUserId" parameterType="Long" resultType="java.lang.String">
+        select distinct p.name
+        from permissions p
+            left join role_permissions rp on p.id = rp.permission_id
+            left join user_roles ur on rp.role_id = ur.role_id
+        where ur.user_id = #{userId}
+    </select>
+</mapper>