@PreAuthorize、@PostAuthorize、@PreFilter、@PostFilter注解的用法详解

@Configuration //声明为配置类的bean
@EnableResourceServer //开启资源服务
@EnableOAuth2Client //开启OAuth2Client客户端
@EnableConfigurationProperties //开启读取配置文件的功能
//开启全局方法调用权限验证
// 当@EnableGlobalMethodSecurity(prePostEnabled=true)的时候，@PreAuthorize @PostAuthorize才可以使用
@EnableGlobalMethodSecurity(prePostEnabled = true)

@Service
public class UserServiceImpl implements UserService {
   @PreAuthorize("hasRole('ROLE_ADMIN')")
   public void addUser(User user) {
      System.out.println("addUser................" + user);
   }
   @PreAuthorize("hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')")
   public User find(int id) {
      System.out.println("find user by id............." + id);
      return null;
   }
}

org.springframework.security.access.expression.SecurityExpressionOperations.class

public class UserServiceImpl implements UserService {
   /**
    * 限制只能查询Id小于10的用户
   */
   @PreAuthorize("#id<10")
   public User find(int id) {
      System.out.println("find user by id........." + id);
      return null;
   }
   /**
    * 限制只能查询自己的信息
    */
   @PreAuthorize("principal.username.equals(#username)")
   public User find(String username) {
      System.out.println("find user by username......" + username);
      return null;
   }
   /**
    * 限制只能新增用户名称为abc的用户
    */
   @PreAuthorize("#user.name.equals('abc')")
   public void add(User user) {
      System.out.println("addUser............" + user);
   }
}

@PostAuthorize("returnObject.id%2==0")
   public User find(int id) {
      User user = new User();
      user.setId(id);
      return user;
   }

 @PostFilter("filterObject.id%2==0"）
  public List<User> findAll() {
      List<User> userList = new ArrayList<User>();
      User user;
      for (int i=0; i<10; i++) {
         user = new User();
         user.setId(i);
         userList.add(user);
      }
      return userList;
   }

   @PreFilter(filterTarget="ids", value="filterObject%2==0")
   public void delete(List<Integer> ids, List<String> usernames) {
      ...
   }