Spring Security实现基于RBAC的权限表达式动态访问控制的操作方法

/**
 * 开启方法安全注解
 *
 * @author felord.cn
 */
@EnableGlobalMethodSecurity(prePostEnabled = true,
        securedEnabled = true,
        jsr250Enabled = true)
public class MethodSecurityConfig {
    
}

public interface PermissionEvaluator extends AopInfrastructureBean {
	boolean hasPermission(Authentication authentication, 
                          Object targetDomainObject, Object permission);
                          Serializable targetId, String targetType, Object permission);
}

/**
 * 资源权限评估
 * 
 * @author felord.cn
 */
public class ResourcePermissionEvaluator implements PermissionEvaluator {
    private final BiFunction<String, String, Collection<? extends GrantedAuthority>> permissionFunction;

    public ResourcePermissionEvaluator(BiFunction<String, String, Collection<? extends GrantedAuthority>> permissionFunction) {
        this.permissionFunction = permissionFunction;
    }
    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        //查询方法标注对应的角色
        Collection<? extends GrantedAuthority> resourceAuthorities = permissionFunction.apply((String) targetDomainObject, (String) permission);
        // 用户对应的角色
        Collection<? extends GrantedAuthority> userAuthorities = authentication.getAuthorities();
         // 对比 true 就能访问  false 就不能访问
        return userAuthorities.stream().anyMatch(resourceAuthorities::contains);
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
        //todo
        System.out.println("targetId = " + targetId);
        return true;
}

@Bean
    PermissionEvaluator resourcePermissionEvaluator() {
        return new ResourcePermissionEvaluator((targetDomainObject, permission) -> {
            //TODO 这里形式其实可以不固定
            String key = targetDomainObject + ":" + permission;
            //TODO  查询 key 和  authority 的关联关系
            //  模拟 permission 关联角色   根据key 去查 grantedAuthorities
            Set<SimpleGrantedAuthority> grantedAuthorities = new HashSet<>();
            grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
            return "USER:READ".equals(key) ? grantedAuthorities : new HashSet<>();
        });
    }

 @GetMapping("/postfilter")
    @PreAuthorize("hasPermission('USER','READ')")
    public Collection<String> postfilter(){
        List<String> list = new ArrayList<>();
        list.add("felord.cn");
        list.add("码农小胖哥");
        list.add("请关注一下");
        return list;
    }

  @Bean
    UserDetailsService users() {
        UserDetails user = User.builder()
                .username("felord")
                .password("123456")
      .passwordEncoder(PasswordEncoderFactories.createDelegatingPasswordEncoder()::encode)
                .roles("USER")
                .authorities("ROLE_ADMIN","ROLE_USER")
                .build();
        return new InMemoryUserDetailsManager(user);
    }

@PreAuthorize("hasPermission('1234','USER','READ')")

@PreAuthorize("hasPermission('USER','READ') or hasRole('ADMIN')")

 @PreAuthorize("hasPermission(#id,'USER','READ')")
    public Collection<String> postfilter(String id){
        
    }