|
|
@@ -3,17 +3,19 @@ package com.uas.platform.b2b.support;
|
|
|
import java.util.ArrayList;
|
|
|
import java.util.Collection;
|
|
|
import java.util.HashMap;
|
|
|
-import java.util.Iterator;
|
|
|
+import java.util.List;
|
|
|
|
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
|
|
|
import org.apache.log4j.Logger;
|
|
|
+import org.springframework.beans.factory.annotation.Autowired;
|
|
|
import org.springframework.security.access.ConfigAttribute;
|
|
|
import org.springframework.security.access.SecurityConfig;
|
|
|
import org.springframework.security.web.FilterInvocation;
|
|
|
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
|
|
|
-import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
|
|
-import org.springframework.security.web.util.matcher.RequestMatcher;
|
|
|
+
|
|
|
+import com.uas.platform.b2b.dao.ResourceDao;
|
|
|
+import com.uas.platform.b2b.model.Resource;
|
|
|
|
|
|
/**
|
|
|
* 资源数据定义,将所有的资源和权限对应关系建立起来,即定义某一资源可以被哪些角色访问
|
|
|
@@ -23,26 +25,35 @@ import org.springframework.security.web.util.matcher.RequestMatcher;
|
|
|
*/
|
|
|
public class CustomSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
|
|
|
|
|
|
+ @Autowired
|
|
|
+ private ResourceDao resourceDao;
|
|
|
+
|
|
|
/**
|
|
|
* LOGGER 日志对象
|
|
|
*/
|
|
|
private final static Logger LOGGER = Logger.getLogger(CustomSecurityMetadataSource.class);
|
|
|
|
|
|
- private HashMap<String, Collection<ConfigAttribute>> map = new HashMap<String, Collection<ConfigAttribute>>();
|
|
|
+ private HashMap<String, Collection<ConfigAttribute>> resourceMap;
|
|
|
|
|
|
/**
|
|
|
* 加载资源,初始化资源变量
|
|
|
*
|
|
|
*/
|
|
|
private void loadResourceDefine() {
|
|
|
- Collection<ConfigAttribute> array = new ArrayList<ConfigAttribute>(4);
|
|
|
- ConfigAttribute cfg = new SecurityConfig("ROLE_USER");
|
|
|
- array.add(cfg);
|
|
|
- map.put("/**", array);
|
|
|
+ if (resourceMap == null) {
|
|
|
+ resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
|
|
|
+ List<Resource> resources = resourceDao.findAll();
|
|
|
+ for (Resource resource : resources) {
|
|
|
+ Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
|
|
|
+ ConfigAttribute configAttribute = new SecurityConfig(resource.getName());
|
|
|
+ configAttributes.add(configAttribute);
|
|
|
+ resourceMap.put(resource.getLink(), configAttributes);
|
|
|
+ }
|
|
|
+ }
|
|
|
}
|
|
|
|
|
|
public CustomSecurityMetadataSource() {
|
|
|
- loadResourceDefine();
|
|
|
+
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
@@ -55,20 +66,18 @@ public class CustomSecurityMetadataSource implements FilterInvocationSecurityMet
|
|
|
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
|
|
|
|
|
|
LOGGER.info(object);
|
|
|
+ if (resourceMap == null)
|
|
|
+ loadResourceDefine();
|
|
|
+ String requestUrl = getRequestPath(((FilterInvocation) object).getRequest());
|
|
|
+ System.out.println("请求:" + requestUrl);
|
|
|
+ return resourceMap.get(requestUrl);
|
|
|
+ }
|
|
|
|
|
|
- HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
|
|
|
-
|
|
|
- RequestMatcher matcher = null;
|
|
|
- String resUrl = null;
|
|
|
- for (Iterator<String> iter = map.keySet().iterator(); iter.hasNext();) {
|
|
|
- resUrl = iter.next();
|
|
|
- matcher = new AntPathRequestMatcher(resUrl);
|
|
|
- if (null != resUrl && matcher.matches(request)) {
|
|
|
- return map.get(resUrl);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return null;
|
|
|
+ private String getRequestPath(HttpServletRequest request) {
|
|
|
+ String url = request.getServletPath();
|
|
|
+ if (request.getPathInfo() != null)
|
|
|
+ url = url + request.getPathInfo();
|
|
|
+ return url;
|
|
|
}
|
|
|
|
|
|
/**
|