SpringBoot越权和数据权限控制的实现方案(最新整理)

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
// 该注解作用于方法
@Target(ElementType.METHOD)  
// 运行时生效
@Retention(RetentionPolicy.RUNTIME)  
public @interface PermissionCheck {
	// 操作类型，默认为 READ
    String operation() default "READ";  
    // 资产 ID
    String assetId() default ""; 
    // 资产名称
    String assetName() default "";  
    // 还可以扩展其他的字段
    ... ...
}

@RestController
@RequestMapping("/assets")
public class AssetController {
    // 只允许读取权限
    @PermissionCheck(operation = "READ", assetId = "asset123", assetName = "assetA")
    @GetMapping("/view")
    public Asset viewAsset(@RequestParam String assetId) {
        // 业务逻辑
        return assetService.getAssetById(assetId);
    }
    // 只允许创建操作
    @PermissionCheck(operation = "CREATE", assetId = "asset124", assetName = "assetB")
    @PostMapping("/create")
    public Asset createAsset(@RequestBody Asset asset) {
        // 业务逻辑
        return assetService.createAsset(asset);
    }
}

import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
@Aspect
@Component
public class PermissionAspect {
	// 用于获取当前用户的权限信息
    @Autowired
    private UserService userService;  
	// 切入点，拦截标注 @PermissionCheck 的方法
    @Pointcut("@annotation(permissionCheck)")  
    public void checkPermission(PermissionCheck permissionCheck) {}
    // 在方法执行前进行权限校验
    @Before("checkPermission(permissionCheck)")  
    public void checkPermissionBefore(PermissionCheck permissionCheck) throws Exception {
        String operation = permissionCheck.operation();
        String assetId = permissionCheck.assetId();
        String assetName = permissionCheck.assetName();
        // 获取当前登录用户的 ID
        String userId = SecurityContextHolder.getContext().getAuthentication().getName();
        // 获取当前用户的角色：可以是只读或正常用户等
        User user = userService.getUserById(userId);
        if ("READ".equals(operation) && !user.isReadOnly()) {
            // 如果是只读用户但操作不是 READ，抛出异常
            throw new PermissionException("只读用户不允许进行此操作");
        }
        // 检查操作权限：只允许特定用户对特定资产进行 CREATE/UPDATE/DELETE 操作
        if (!"READ".equals(operation)) {
            if (!hasPermission(userId, assetId, assetName)) {
                throw new PermissionException("用户没有访问该资产的权限");
            }
        }
    }
    private boolean hasPermission(String userId, String assetId, String assetName) {
        // 查询数据库，检查当前用户是否对给定的资产 ID 或资产名称有权限
        return userService.hasAssetPermission(userId, assetId, assetName);
    }
}

@Service
public class UserService {
    // 根据用户 ID 查询用户信息，判断是否为只读用户
    public User getUserById(String userId) {
        // 假设从数据库获取用户信息
        return userRepository.findById(userId).orElseThrow(() -> new UserNotFoundException("用户不存在"));
    }
    // 查询用户是否有访问某个资产的权限
    public boolean hasAssetPermission(String userId, String assetId, String assetName) {
        // 这里我们可以查询数据库，检查当前用户是否有对应资产的权限
        return permissionRepository.existsByUserIdAndAssetIdOrAssetName(userId, assetId, assetName);
    }
}

public class PermissionException extends RuntimeException {
    public PermissionException(String message) {
        super(message);
    }
}
@ControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(PermissionException.class)
    @ResponseStatus(HttpStatus.FORBIDDEN)
    public ResponseEntity<String> handlePermissionException(PermissionException ex) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(ex.getMessage());
    }
}