添加公共的权限鉴定接口

src/main/java/com/uas/platform/b2c/common/account/controller/ResourceController.java

@@ -1,13 +1,26 @@
 package com.uas.platform.b2c.common.account.controller;
 
+import com.uas.platform.b2c.common.account.dao.ResourceItemDao;
 import com.uas.platform.b2c.common.account.model.Resource;
+import com.uas.platform.b2c.common.account.model.User;
 import com.uas.platform.b2c.common.account.service.ResourceService;
+import com.uas.platform.b2c.common.account.service.UserService;
+import com.uas.platform.b2c.trade.support.ResultMap;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 
+import javax.servlet.http.HttpServletRequest;
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Iterator;
 import java.util.List;
 
 
@@ -26,6 +39,8 @@ public class ResourceController {
     @Autowired
     private ResourceService resourceService;
 
+
+
     /**
      * 取系统资源
      *
@@ -37,4 +52,21 @@ public class ResourceController {
         return resourceService.findAll();
     }
 
+    /**
+     * 根据访问url和方法查询权限;
+     * @param request
+     * @param user
+     */
+    @RequestMapping(value = "/validateRes", method = RequestMethod.GET)
+    @ResponseBody
+    public ResultMap validateResources(HttpServletRequest request, String resUrl,String method) {
+        String currUrl;
+        try {
+            currUrl = URLDecoder.decode(resUrl, "UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            throw new IllegalArgumentException("URL编码错误!");
+        }
+        return resourceService.getAccessResources(request,currUrl,method);
+    }
+
 }

src/main/java/com/uas/platform/b2c/common/account/dao/ResourceItemDao.java

@@ -3,8 +3,11 @@ package com.uas.platform.b2c.common.account.dao;
 import com.uas.platform.b2c.common.account.model.ResourceItem;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.stereotype.Repository;
+import java.util.List;
 
 @Repository
 public interface ResourceItemDao extends JpaRepository<ResourceItem, Long>{
 
+    List<ResourceItem> findByMethodAndUrl(String method, String url);
+
 }

src/main/java/com/uas/platform/b2c/common/account/service/impl/ResourceServiceImpl.java

@@ -1,17 +1,24 @@
 package com.uas.platform.b2c.common.account.service.impl;
 
-import java.util.Iterator;
-import java.util.List;
+import java.util.*;
 
 import com.uas.platform.b2c.common.account.dao.ResourceDao;
+import com.uas.platform.b2c.common.account.dao.ResourceItemDao;
 import com.uas.platform.b2c.common.account.model.Resource;
+import com.uas.platform.b2c.common.account.model.ResourceItem;
+import com.uas.platform.b2c.common.account.model.Role;
+import com.uas.platform.b2c.common.account.model.User;
 import com.uas.platform.b2c.common.account.service.ResourceService;
+import com.uas.platform.b2c.common.account.service.UserService;
 import com.uas.platform.b2c.core.support.SystemSession;
+import com.uas.platform.b2c.trade.support.ResultMap;
 import org.apache.commons.collections.CollectionUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
+import javax.servlet.http.HttpServletRequest;
+
 
 @Service
 public class ResourceServiceImpl implements ResourceService {
@@ -19,6 +26,11 @@ public class ResourceServiceImpl implements ResourceService {
     @Autowired
     private ResourceDao resourceDao;
 
+    @Autowired
+    private UserService userService;
+    @Autowired
+    private ResourceItemDao resourceItemDao;
+
     /**
      * 商城运营商企业UU号
      */
@@ -53,4 +65,46 @@ public class ResourceServiceImpl implements ResourceService {
         return resourceList;
     }
 
+    @Override
+    public ResultMap getAccessResources(HttpServletRequest request, String currUrl, String method) {
+        HashMap<String, Boolean> dataMap = new HashMap<>();
+        dataMap.put("isManager",  Boolean.FALSE);
+        dataMap.put("isOpenApi",  Boolean.FALSE);
+        dataMap.put("access", Boolean.FALSE);
+        ResultMap resultMap = new ResultMap();
+        resultMap.setData(dataMap);
+        //判断当前用户是否是管理员isManager;
+        User user = (User) request.getSession().getAttribute("user");
+        Long enAdminuu = user.getEnterprise().getEnAdminuu();
+        if (enAdminuu.equals(user.getUserUU()) ) {
+            dataMap.put("isManager", Boolean.TRUE);
+            dataMap.put("access", Boolean.TRUE);
+            return resultMap;
+        }
+        //根据当前权限的url和访问方法到resources表中查询是否有受权限控制
+        List<ResourceItem> currResourceItems = resourceItemDao.findByMethodAndUrl(method, currUrl);
+        if (currResourceItems == null || currResourceItems.size() == 0) {
+            dataMap.put("isOpenApi",  Boolean.TRUE);
+            resultMap.setSuccess(true);
+            return resultMap;
+        }
+        ResourceItem currResourceItem = currResourceItems.get(0);
+        //查找用户是否拥有当前资源
+        User curUser = userService.findUserByUserUU(user.getUserUU());
+        Set<Role> roles = curUser.getRoles();
+        HashMap<String, ResourceItem> authItems = new HashMap<>();
+        for (Role role : roles) {
+            if (role.getEnUU().equals(user.getEnterprise().getUu())) {
+                Set<ResourceItem> resourceItems = role.getResourceItems();
+                for (ResourceItem resourceItem : resourceItems) {
+                    authItems.put(resourceItem.getDesc(), resourceItem);
+                    if (currResourceItem.getMethod().equals(resourceItem.getMethod()) && currResourceItem.getDesc().equals(resourceItem.getDesc()))  {
+                        dataMap.put("access", Boolean.TRUE);
+                    }
+                }
+            }
+        }
+        resultMap.setSuccess(true);
+        return resultMap;
+    }
 }