Spring Security权限控制完整实现教程

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- 如果需要Thymeleaf集成 -->
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity6</artifactId>
</dependency>

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity // 启用Spring Security的Web安全功能
@EnableMethodSecurity // 启用方法级别的安全注解，如@PreAuthorize
public class SecurityConfig {

    // 密码编码器，推荐使用BCryptPasswordEncoder
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // 用户认证信息服务，这里使用内存方式，实际项目中通常会从数据库加载
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.withUsername("user")
                .password(passwordEncoder.encode("password"))
                .roles("USER") // 定义角色
                .build();
        UserDetails admin = User.withUsername("admin")
                .password(passwordEncoder.encode("adminpass"))
                .roles("ADMIN", "USER") // 定义多个角色
                .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    // 安全过滤链配置
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/public/**", "/css/**", "/js/**").permitAll() // 允许所有人访问的路径
                .requestMatchers("/admin/**").hasRole("ADMIN") // 只有ADMIN角色才能访问
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN") // USER或ADMIN角色才能访问
                .anyRequest().authenticated() // 任何其他请求都需要认证
            )
            .formLogin(form -> form
                .loginPage("/login") // 自定义登录页面路径
                .defaultSuccessUrl("/home", true) // 登录成功后的跳转页面
                .permitAll() // 登录页面允许所有人访问
            )
            .logout(logout -> logout
                .logoutUrl("/logout") // 登出URL
                .logoutSuccessUrl("/login?logout") // 登出成功后的跳转页面
                .permitAll() // 登出操作允许所有人访问
            )
            .csrf(csrf -> csrf.disable()); // 禁用CSRF保护，生产环境请谨慎考虑

        return http.build();
    }
}

// 假设你从数据库加载用户信息
@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository; // 假设你有这么一个用户仓库

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));

        // 将数据库中的角色/权限转换为Spring Security需要的GrantedAuthority
        List<GrantedAuthority> authorities = user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
                .collect(Collectors.toList());

        return new org.springframework.security.core.userdetails.User(
                user.getUsername(),
                user.getPassword(), // 数据库中通常是BCrypt加密后的密码
                authorities
        );
    }
}

@Service
@PreAuthorize("hasRole('ADMIN')") // 整个Service都需要ADMIN角色
public class AdminService {

    @PreAuthorize("hasAuthority('admin:read')") // 方法需要admin:read权限
    public String getAdminDashboard() {
        return "Welcome to Admin Dashboard!";
    }

    @PreAuthorize("hasRole('ADMIN') and hasAuthority('admin:write')") // 组合条件
    public void createNewUser(UserDto user) {
        // ...
    }
}

import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Component;

import java.io.Serializable;
import java.util.Collection;

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {

    // 假设你有一些服务来获取文档信息或用户与文档的关系
    // @Autowired
    // private DocumentService documentService;

    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        if ((authentication == null) || (targetDomainObject == null) || !(permission instanceof String)) {
            return false;
        }

        String targetType = targetDomainObject.getClass().getSimpleName().toUpperCase();
        return hasPrivilege(authentication, targetType, permission.toString().toUpperCase());
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
        if ((authentication == null) || (targetType == null) || !(permission instanceof String)) {
            return false;
        }

        // 这里可以根据targetId和targetType从数据库加载对象，然后进行更复杂的判断
        // 例如：
        // Document doc = documentService.findById(targetId);
        // if (doc != null && doc.getCreatorId().equals(((MyUserDetails)authentication.getPrincipal()).getUserId())) {
        //     return true; // 如果是创建者，就允许
        // }

        return hasPrivilege(authentication, targetType.toUpperCase(), permission.toString().toUpperCase());
    }

    private boolean hasPrivilege(Authentication authentication, String targetType, String permission) {
        // 示例：检查用户是否拥有 "READ_DOCUMENT" 或 "EDIT_DOCUMENT" 等权限
        // 更复杂的逻辑可以在这里实现，比如：
        // 1. 检查用户是否是管理员
        // 2. 检查用户是否是资源的拥有者
        // 3. 检查用户是否属于某个特定组，该组拥有此权限
        // 4. 结合业务规则进行判断

        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        for (GrantedAuthority authority : authorities) {
            // 简单示例：检查权限字符串是否匹配 "TARGETTYPE_PERMISSION"
            if (authority.getAuthority().equals(targetType + "_" + permission)) {
                return true;
            }
        }
        return false;
    }
}

import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;

// ... 在你的SecurityConfig类中

    @Bean
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler(CustomPermissionEvaluator customPermissionEvaluator) {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(customPermissionEvaluator);
        return expressionHandler;
    }

@Service
public class DocumentService {

    // 假设Document是一个实体类，有id和creatorId等字段
    public Document getDocumentById(Long id) {
        // ...
        return new Document(id, 101L, "Test Document"); // 示例
    }

    @PreAuthorize("hasPermission(#documentId, 'Document', 'read')")
    public Document readDocument(Long documentId) {
        // ... 实际从数据库加载文档
        System.out.println("Reading document with ID: " + documentId);
        return getDocumentById(documentId);
    }

    @PreAuthorize("hasPermission(#document, 'edit')") // #document 是方法参数
    public void updateDocument(Document document) {
        // ... 更新文档逻辑
        System.out.println("Updating document: " + document.getId());
    }
}