java - 如何将RequestBody中的对象传递给注释

Question

我有一个自定义注释，它检查当前用户是否具有作为注释参数传递的所需权限。有一个异常(exception):如果一个用户想要更改另一个用户的数据，他必须具有更高的级别。所以我需要传递应该更改的用户(或用户对象)的ID。在下面的其余调用中，这将是 userDto 的 ID。问题是，我无法传递 userDto.getId() 因为 userDto 尚无法解析。请参阅下面的代码:

使用相关注释在其余 Controller 中调用方法:(@RequiresPrivileges)

  @RequiresPrivileges(value = {PrivilegeType.USRMGA, PrivilegeType.USRMGO}, usrMgmntObj = User.class, usrMgmntObjId = userDto.getId()) // at this stage, userDto is not known
  @PutMapping
  public ResponseEntity<List<DetailedUserDto>> update(@RequestBody UserDto userDto) {
    return new ResponseEntity<>(userService.update(userDto), HttpStatus.OK);
  }

@interface 需要权限:

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface RequiresPrivileges {

  /**
   * Required privileges to access the method
   */
  PrivilegeType[] value();

  /**
   * If user wants to make changes to another user or usergroup, the rank needs to be checked. To do so,
   * the object class (user or usergroup) and the suiting id needs to be provided
   */
  Class usrMgmntObj() default Object.class;
  long usrMgmntObjId() default -1;
}

@注释的方面

@Around("@annotation(RequiresPrivileges)")
public Object requiresPrivileges(ProceedingJoinPoint joinPoint) throws Throwable {

  MethodSignature signature = (MethodSignature) joinPoint.getSignature();
  Method method = signature.getMethod();

  PrivilegeType[] privileges = method.getAnnotation(RequiresPrivileges.class).value();
  Class usrMgmntObjClass = method.getAnnotation(RequiresPrivileges.class).usrMgmntObj();
  long usrMgmntObjId = method.getAnnotation(RequiresPrivileges.class).usrMgmntObjId();

  boolean authorized = false;

  // if the user wants to change a user management object (user or usergroup), the rank has to be higher than the
  // one the user wants to change. BUT user with the privilege PrivilegeType.USRMGA may edit without checking the
  // rank
  if ((usrMgmntObjClass == User.class || usrMgmntObjClass == Usergroup.class) && usrMgmntObjId > -1) {

    if (usrMgmntObjClass == User.class) {
      if (!authorizationService.hasHigherRank(currentUserService.getCurrentUserId(), usrMgmntObjId)) {
        if (authorizationService.hasPrivileges(privileges, currentUserService.getCurrentUserId())) {
          // user is authorized
          authorized = true;
        }
      }
    }
  }

  // check for privileges if user is not authorized already
  if (!authorized) {
    if (authorizationService.hasPrivileges(privileges, currentUserService.getCurrentUserId())) {
      // user is authorized
      return joinPoint.proceed();
    } else {
      // user is not authorized
      throw new AccessNotAllowedException(currentUserService.getCurrentUserId());
    }
  } else {
    return joinPoint.proceed();
  }
}

如何将UserDto(或整个对象)的ID传递给注释？是否可以使用 ElementType.PARAMETER 为参数 userDto 创建另一个注释并在那里执行逻辑？

Answer 1

如果您的应用程序使用 Spring Security，那么您可以简单地使用 Spring 的 @PreAuthorize，而不用编写自己的注释。另外，如果您不想按照现在的方式执行此操作，则可以使用 JoinPoint#getArgs() 从方法的参数中获取 UserDto。