PreAuthorize 注释中的 Java 8/Spring 常量

Question

在我的 Spring Boot 项目中，我定义了以下 RestController 方法:

@PreAuthorize("hasAuthority('" + Permission.APPEND_DECISION + "')")
@RequestMapping(value = "/{decisionId}/decisions", method = RequestMethod.PUT)
public DecisionResponse appendDecisionToParent(@PathVariable @NotNull @DecimalMin("0") Long decisionId, @Valid @RequestBody AppendDecisionRequest decisionRequest) {
    ....
    return new DecisionResponse(decision);
}

现在为了提供允许的权限名称，我使用以下代码结构:

@PreAuthorize("hasAuthority('" + Permission.APPEND_DECISION + "')")

其中 Permission.APPEND_DECISION 是常量:

public static final String APPEND_DECISION = "APPEND_DECISION";

在 Java/Spring 中是否有更优雅的方式来定义此类代码？

Answer 1

这是一种在单个位置定义权限的简单方法，不需要任何深入的 Spring Security 配置。

public class Authority {
    public class Plan{
        public static final String MANAGE = "hasAuthority('PLAN_MANAGE')";
        public static final String APPROVE = "hasAuthority('PLAN_APPROVE')";
        public static final String VIEW = "hasAuthority('PLAN_VIEW')";
    }
}

保护服务...

public interface PlanApprovalService {

    @PreAuthorize(Authority.Plan.APPROVE)
        ApprovalInfo approvePlan(Long planId);

    }
}