springboot使用注解实现鉴权功能

@Documented
@Target({ElementType.METHOD})  // 用在方法上
@Retention(RetentionPolicy.RUNTIME)  //注解保留到运行时
public @interface RoleType {
    String[] value() default {};
}

public class UserContext {
    private static final ThreadLocal<List<String>> role = new ThreadLocal<>();
    private static final ThreadLocal<String> username = new ThreadLocal<>();
    private static final ThreadLocal<Boolean> loginStatus = new ThreadLocal<>();
    public static boolean loginStatus() {
        return loginStatus.get();
    }
    public static void login() {
        UserContext.loginStatus.set(true);
    }
    public static void logout() {
        UserContext.loginStatus.set(false);
    }
    public static String getUsername() {
        return username.get();
    }
    public static void setUsername(String username) {
        UserContext.username.set(username);
    }
    public static void clearUsername() {
        username.remove();
    }
    public static List<String> getRole() {
        return role.get();
    }
    public static void setRole(List<String> role) {
        UserContext.role.set(role);
    }
    public static void setRole(String role) {
        UserContext.role.set(List.of(role));
    }
    public static void clearRole() {
        role.remove();
    }
}

@Component
public class AuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain ) throws ServletException, IOException {
        //将用户信息写入上下文，可以从session或redis或者从关系型数据库获取用户信息及角色信息
        UserContext.setUsername(username);
        UserContext.setRole(roles);
        UserContext.login();
        filterChain.doFilter(request,response);
    }
}

@Aspect
@Component
public class AuthAspect extends HttpServlet {
    @Pointcut("@annotation(RoleType)")
    public void annotatedMethod() {
    }
    //注解存在时，需要在登陆情况下v爱可以访问接口
    @Around("annotatedMethod()")
    public Object aroundAnnotatedMethod(ProceedingJoinPoint joinPoint) throws Throwable {
        //访问接口时需要的权限标识集合
        List<String> apiRole = Arrays.asList(AnnotationUtils.findAnnotation(((MethodSignature) joinPoint.getSignature()).getMethod(), RoleType.class).value());
        //用户拥有的权限标识集合
        List<String> userRole = UserContext.getRole();
        //注解存在，并且登陆情况下可以访问接口
        if (UserContext.loginStatus()){
            //如果任意接口标识中元素在用户权限标识中存在，则有权访问该接口
            if (apiRole.isEmpty() || apiRole.stream().anyMatch(userRole::contains)) {
                return joinPoint.proceed();
            } else {
                throw new MallException(403, "无权限访问！");
            }
        }else {
            throw new MallException(500,"请先登陆再访问！");
        }
    }
    //程序运行结束后清楚上下文
    @After("annotatedMethod()")
    public void afterAnnotatedMethod(JoinPoint joinPoint) {
        UserContext.clearRole();
        UserContext.clearUsername();
        UserContext.clearRole();
    }
}

    @RoleType
    public String test(){
        return UserContext.getRole();
    }

    @RoleType("role")
    public String test(){
        return UserContext.getRole();
    }

    @RoleType({"role","test"，...})
    public String test(){
        return UserContext.getRole();
    }