Shiro自定义注解扩展@SalmonRequiresPermission

1.自定义注解 @SalmonRequiresPermission

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

import org.apache.shiro.authz.annotation.Logical;

/**
 * SalmonRequiresPermissions is
 *
 * @author zzt
 * @date 2020/2/22 16:25:00
 */
@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface SalmonRequiresPermissions {
    String[] value();

    Logical logical() default Logical.AND;

    // 描述
    String[] description();
}

　　这里只是简单的增加了一个描述，可根据需求自行扩展。

2.自定义注解处理器，继承 AuthorizingAnnotationHandler

import java.lang.annotation.Annotation;

import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.aop.AuthorizingAnnotationHandler;
import org.apache.shiro.subject.Subject;

/**
 * SalmonPermissionAuthorizingAnnotationHandler is
 *
 * @author zzt
 * @date 2020/2/25 11:43:00
 */
public class SalmonPermissionAuthorizingAnnotationHandler extends AuthorizingAnnotationHandler {

    // 继承父类构造器，注入SalmonRequiresPermissions注解
    public SalmonPermissionAuthorizingAnnotationHandler() {
        super(SalmonRequiresPermissions.class);
    }

    protected String[] getAnnotationValue(Annotation annotation) {
        SalmonRequiresPermissions srpAnnotation = (SalmonRequiresPermissions)annotation;
        return srpAnnotation.value();
    }

    @Override
    public void assertAuthorized(Annotation annotation) throws AuthorizationException {
        if (annotation instanceof SalmonRequiresPermissions) {
            SalmonRequiresPermissions srpAnnotation = (SalmonRequiresPermissions)annotation;
            String[] perms = this.getAnnotationValue(annotation);
            Subject subject = this.getSubject();
            if (perms.length == 1) {
                subject.checkPermission(perms[0]);
            } else if (Logical.AND.equals(srpAnnotation.logical())) {
                this.getSubject().checkPermissions(perms);
            } else {
                if (Logical.OR.equals(srpAnnotation.logical())) {
                    boolean hasAtLeastOnePermission = false;

                    for (int i = 0; i < perms.length; ++i) {
                        String permission = perms[i];
                        if (this.getSubject().isPermitted(permission)) {
                            hasAtLeastOnePermission = true;
                        }
                    }
                    if (!hasAtLeastOnePermission) {
                        this.getSubject().checkPermission(perms[0]);
                    }
                }
            }
        }
    }
}

3.自定义Shiro拦截处理类，继承 AuthorizingAnnotationMethodInterceptor

import org.apache.shiro.aop.AnnotationResolver;
import org.apache.shiro.authz.aop.AuthorizingAnnotationMethodInterceptor;

/**
 * SalmonPermissionAuthorizingAnnotationMethodInterceptor is
 *
 * @author zzt
 * @date 2020/2/25 11:44:00
 */
public class SalmonPermissionAuthorizingAnnotationMethodInterceptor extends AuthorizingAnnotationMethodInterceptor {

    public SalmonPermissionAuthorizingAnnotationMethodInterceptor() {
        super(new SalmonPermissionAuthorizingAnnotationHandler());
    }

    public SalmonPermissionAuthorizingAnnotationMethodInterceptor(AnnotationResolver annotationResolver) {
        super(new SalmonPermissionAuthorizingAnnotationHandler(), annotationResolver);
    }
}

4.自定义AOP拦截，继承 AopAllianceAnnotationsAuthorizingMethodInterceptor

import org.apache.shiro.spring.aop.SpringAnnotationResolver;
import org.apache.shiro.spring.security.interceptor.AopAllianceAnnotationsAuthorizingMethodInterceptor;

/**
 * SalmonPermissionAopAllianceAnnotationsAuthorizingMethodInterceptor is
 *
 * @author zzt
 * @date 2020/2/25 11:45:00
 */
public class SalmonAopAllianceAnnotationsAuthorizingMethodInterceptor extends AopAllianceAnnotationsAuthorizingMethodInterceptor {

    public SalmonAopAllianceAnnotationsAuthorizingMethodInterceptor() {
        super();
        this.methodInterceptors.add(
                new SalmonPermissionAuthorizingAnnotationMethodInterceptor(new SpringAnnotationResolver()));
    }
}

5.添加新注解支持，继承 AuthorizationAttributeSourceAdvisor

import java.lang.annotation.Annotation;
import java.lang.reflect.Method;

import org.apache.shiro.authz.annotation.RequiresAuthentication;
import org.apache.shiro.authz.annotation.RequiresGuest;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.authz.annotation.RequiresUser;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.springframework.core.annotation.AnnotationUtils;

/**
 * SalmonPermissionAuthorizationAttributeSourceAdvisor is
 *
 * @author zzt
 * @date 2020/2/25 10:49:00
 */
public class SalmonAuthorizationAttributeSourceAdvisor extends AuthorizationAttributeSourceAdvisor {

    private static final Class<? extends Annotation>[] AUTHZ_ANNOTATION_CLASSES =
            new Class[]{SalmonRequiresPermissions.class, RequiresPermissions.class, RequiresRoles.class,
                    RequiresUser.class, RequiresGuest.class, RequiresAuthentication.class};

    public SalmonAuthorizationAttributeSourceAdvisor() {
        setAdvice(new SalmonAopAllianceAnnotationsAuthorizingMethodInterceptor());
    }

    @Override
    public boolean matches(Method method, Class targetClass) {
        Method m = method;
        if (this.isAuthzAnnotationPresent(method)) {
            return true;
        } else {
            if (targetClass != null) {
                try {
                    m = targetClass.getMethod(m.getName(), m.getParameterTypes());
                    return this.isAuthzAnnotationPresent(m) || this.isAuthzAnnotationPresent(targetClass);
                } catch (NoSuchMethodException var5) {
                }
            }

            return false;
        }
    }

    @SuppressWarnings("Duplicates")
    private boolean isAuthzAnnotationPresent(Class<?> targetClazz) {
        Class[] authzAnnotationClasses = AUTHZ_ANNOTATION_CLASSES;

        for (int i = 0; i < authzAnnotationClasses.length; ++i) {
            Class<? extends Annotation> annClass = authzAnnotationClasses[i];
            Annotation a = AnnotationUtils.findAnnotation(targetClazz, annClass);
            if (a != null) {
                return true;
            }
        }

        return false;
    }

    @SuppressWarnings("Duplicates")
    private boolean isAuthzAnnotationPresent(Method method) {
        Class[] authzAnnotationClasses = AUTHZ_ANNOTATION_CLASSES;

        for (int i = 0; i < authzAnnotationClasses.length; ++i) {
            Class<? extends Annotation> annClass = authzAnnotationClasses[i];
            Annotation a = AnnotationUtils.findAnnotation(method, annClass);
            if (a != null) {
                return true;
            }
        }

        return false;
    }
}

6.ShiroConfig添加配置，使用自定义 AuthorizationAttributeSourceAdvisor

　　// 添加自定义注解支持
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
            DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new SalmonAuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

参考文章：

https://my.oschina.net/cloudcross/blog/1924116 基于shiro的自定义注解扩展

https://blog.csdn.net/weixin_33909059/article/details/88856993 自定义Shiro注解

https://blog.csdn.net/u013219624/article/details/83589863 shiro源码分析之自定义注解RequiredPermission(可代替RequiresPermissions)

https://blog.csdn.net/xiewenfeng520/article/details/89447749 apache shiro框架@RequiresPermissions源码分析