SpringBoot使用拦截器Interceptor实现统一角色权限校验

@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface Role {
    /**
     * 角色id数组，默认1-管理员
     **/
    int[] roleIds() default { 1 };
}

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    。。。省略一大堆用户身份认证代码。。。
    // TODO 校验角色：写在这！
    // 校验成功, 保存至认证上下文
    AuthContextInfo.setAuthInfo(authInfo);
    return true;
}

HandlerMethod handlerMethod = (HandlerMethod) handler;
Role role = handlerMethod.getMethod().getAnnotation(Role.class);
if (role != null) {
    // 走到这，说明方法上加了@Role
}

private Integer roleId;

authContextInfo.setRoleId(user.getRole());

// payload的自定义字段r
private static final String CLAIM_ROLE = "r";

// 自定义 role
.withClaim(CLAIM_ROLE, authContextInfo.getRoleId())

// 校验角色
HandlerMethod handlerMethod = (HandlerMethod) handler;
Role role = handlerMethod.getMethod().getAnnotation(Role.class);
if (role != null) {
    // 走到这，说明方法上加了@Role
    boolean isAdmin = false;
    for (int roleId : role.roleIds()) {
        if (authInfo.getRoleId().equals(roleId)) {
            isAdmin = true;
            break;
        }
    }
    if (!isAdmin) {
        log.info("[403]无权限, token={}", token);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        // 别忘了返回false
        return false;
    }
}