Spring Security6中@PostAuthorize注解的具体使用

@Configuration
@EnableMethodSecurity(prePostEnabled = true) // 启用 pre 和 post 注解
public class SecurityConfig {
    // 配置细节...
}

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {
    
    // 确保用户只能访问自己的信息或具有管理员角色
    @PostAuthorize("returnObject.userId == authentication.principal.userId or hasRole('ADMIN')")
    public UserDTO getUserById(Long userId) {
        // 从数据库获取用户信息
        UserDTO user = userRepository.findById(userId);
        return user;
    }
}

// 数据传输对象
class UserDTO {
    private Long userId;
    private String username;
    private String email;
    
    // getter 和 setter 方法
    public Long getUserId() {
        return userId;
    }
}
    

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;
import java.util.List;

@Service
public class DocumentService {
    
    // 确保用户只能获取自己有权访问的文档
    @PostAuthorize("hasRole('ADMIN') or " +
                  "returnObject.ownerId == authentication.principal.userId or " +
                  "@documentSecurityService.isSharedWithUser(returnObject.id, authentication.principal.userId)")
    public Document getDocument(Long documentId) {
        // 从数据库获取文档
        return documentRepository.findById(documentId);
    }
    
    // 结合@PostFilter使用，过滤集合中用户无权访问的元素a
    @PostAuthorize("hasRole('ADMIN')")
    @PostFilter("filterObject.ownerId == authentication.principal.userId or " +
               "@documentSecurityService.isSharedWithUser(filterObject.id, authentication.principal.userId)")
    public List<Document> searchDocuments(String keyword) {
        // 搜索文档
        return documentRepository.findByKeyword(keyword);
    }
}
    

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

@Service
public class OrderService {
    
    // 订单金额超过10000时需要特殊权限
    @PostAuthorize("returnObject.totalAmount <= 10000 or " +
                  "hasAuthority('PROCESS_LARGE_ORDER') or " +
                  "@orderSecurityService.isOrderManager(authentication, returnObject.id)")
    public OrderDTO getOrderDetails(Long orderId) {
        // 获取订单详情
        return orderRepository.findById(orderId);
    }
}

// 订单数据传输对象
class OrderDTO {
    private Long id;
    private Long userId;
    private double totalAmount;
    
    // getter 和 setter 方法
    public double getTotalAmount() {
        return totalAmount;
    }
    
    public Long getId() {
        return id;
    }
}

// 订单安全服务
@Component
class OrderSecurityService {
    public boolean isOrderManager(Authentication authentication, Long orderId) {
        // 复杂的业务逻辑判断
        String username = authentication.getName();
        return orderManagerRepository.isManagerForOrder(username, orderId);
    }
}