package com.jykj.demo.filter;
import java.io.PrintWriter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import com.alibaba.fastjson.JSON;
import com.jykj.demo.util.Helper;
import com.jykj.demo.util.Result;

public class SecurityInterceptor implements HandlerInterceptor{
 @Override
 public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
   throws Exception {
  System.out.println("SecurityInterceptor:"+request.getContextPath()+","+request.getRequestURI()+","+request.getMethod());
  HttpSession session = request.getSession();
  if (session.getAttribute(Helper.SESSION_USER) == null) {
   System.out.println("AuthorizationException:未登錄！"+request.getMethod());
   if("POST".equalsIgnoreCase(request.getMethod())){
    response.setContentType("text/html; charset=utf-8"); 
    PrintWriter out = response.getWriter(); 
    out.write(JSON.toJSONString(new Result(false,"未登錄！")));
    out.flush();
    out.close();
   }else{
    response.sendRedirect(request.getContextPath()+"/login"); 
   }
   return false;
  } else {
   return true;
  }
 }

 @Override
 public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
   ModelAndView modelAndView) throws Exception {
  // TODO Auto-generated method stub
 }

 @Override
 public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
   throws Exception {
  // TODO Auto-generated method stub
 }
}

<!-- Handles HTTP GET requests for /resources/** by efficiently serving up static resources in the ${webappRoot}/resources directory -->
 <mvc:resources mapping="/resources/**" location="/resources/" />
<mvc:interceptors>
  <mvc:interceptor>
   <mvc:mapping path="/*"/> <!-- 攔截/ /test /login 等等單層結(jié)構(gòu)的請(qǐng)求 --> 
   <mvc:mapping path="/**/*.aspx"/><!-- 攔截后綴為.aspx的請(qǐng)求 -->
   <mvc:mapping path="/**/*.do"/><!-- 攔截后綴為 .do的請(qǐng)求 -->
   <mvc:exclude-mapping path="/login"/>
   <mvc:exclude-mapping path="/signIn"/>
   <mvc:exclude-mapping path="/register"/>
   <bean class="com.jykj.demo.filter.SecurityInterceptor">
   </bean>
  </mvc:interceptor>
 </mvc:interceptors>

package com.jykj.demo.filter;
import java.io.IOException;
import java.lang.reflect.Method;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.beans.factory.annotation.Autowired;
import com.jykj.demo.annotation.ValidatePermission;
import com.jykj.demo.exception.AccessDeniedException;
import com.jykj.demo.service.SysUserRolePermService;
/**
 * 事件日志 切面,凡是帶有 @ValidatePermission 以及@ResponseBody注解 控制器 都要進(jìn)行 功能權(quán)限檢查，
 * 若無(wú)權(quán)限，則拋出AccessDeniedException 異常，該異常將請(qǐng)求轉(zhuǎn)發(fā)至一個(gè)控制器，然后將異常結(jié)果返回
 * @author Administrator
 *
 */
public class PermissionAspect {
 @Autowired
 SysUserRolePermService sysUserRolePermService;
 public void doBefore(JoinPoint jp) throws IOException{
  System.out.println(
    "log PermissionAspect Before method: " + jp.getTarget().getClass().getName() + "." + jp.getSignature().getName());
  Method soruceMethod = getSourceMethod(jp);
  if(soruceMethod!=null){
   ValidatePermission oper = soruceMethod.getAnnotation(ValidatePermission.class);
   if (oper != null) {
    int fIdx = oper.idx();
    Object[] args = jp.getArgs();
    if (fIdx>= 0 &&fIdx<args.length){
     int functionId = (Integer) args[fIdx];
     String rs = sysUserRolePermService.permissionValidate(functionId);
     System.out.println("permissionValidate:"+rs);
     if(rs.trim().isEmpty()){
      return ;//正常
     }
    }
   }
  }
  throw new AccessDeniedException("您無(wú)權(quán)操作！");
 }
 private Method getSourceMethod(JoinPoint jp){
  Method proxyMethod = ((MethodSignature) jp.getSignature()).getMethod();
  try {
   return jp.getTarget().getClass().getMethod(proxyMethod.getName(), proxyMethod.getParameterTypes());
  } catch (NoSuchMethodException e) {
   e.printStackTrace();
  } catch (SecurityException e) {
   e.printStackTrace();
  }
  return null;
 }
}

package com.jykj.demo.annotation;
import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
/**
 * @Descrption該注解是標(biāo)簽型注解，被此注解標(biāo)注的方法需要進(jìn)行權(quán)限校驗(yàn)
 */
@Target(value = ElementType.METHOD)
@Retention(value = RetentionPolicy.RUNTIME)
@Documented
public @interface ValidatePermission {
 /**
  * @Description功能Id的參數(shù)索引位置 默認(rèn)為0，表示功能id在第一個(gè)參數(shù)的位置上，-1則表示未提供，無(wú)法進(jìn)行校驗(yàn)
  */
 int idx() default 0;
}

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
  <!-- <property name="defaultErrorView" value="rediret:/error"></property> -->
  <property name="exceptionMappings">
   <props>
    <!--<prop key="com.jykj.demo.exception.AuthorizationException">redirect:/login</prop>-->
    <prop key="com.jykj.demo.exception.AccessDeniedException">forward:/accessDenied</prop>
   </props>
  </property>
 </bean>
<bean id="aspectPermission" class="com.jykj.demo.filter.PermissionAspect" />
 <!-- 對(duì)帶有@ValidatePermission和ResponseBody注解的controller包及其子包所有方法執(zhí)行功能權(quán)限校驗(yàn) --> 
 <aop:config proxy-target-class="true"> 
  <aop:aspect ref="aspectPermission"> 
   <aop:pointcut id="pc" 
    expression="@annotation(com.jykj.demo.annotation.ValidatePermission) 
    and @annotation(org.springframework.web.bind.annotation.ResponseBody) 
    and execution(* com.jykj.demo.controller..*.*(..)) " /> 
   <aop:before pointcut-ref="pc" method="doBefore"/> 
  </aop:aspect> 
 </aop:config>

@RequestMapping(value = "/moduleAccess.do", method = RequestMethod.POST, produces="text/html;charset=utf-8")
 @ResponseBody
 @ValidatePermission
 public String moduleAccess(int fid,String action,FrmModule module) {
  System.out.println("fid:"+fid+",action:"+action);
  int rs = -1;
  try{
   if(Helper.F_ACTION_CREATE.equals(action)){
    rs = moduleService.access(module,Helper.DB_ACTION_INSERT);
    //module.setModuleid(rs);
    module = moduleService.selectByPrimaryKey(rs);
   }else if(Helper.F_ACTION_EDIT.equals(action)){
    rs = moduleService.access(module,Helper.DB_ACTION_UPDATE);
    module = moduleService.selectByPrimaryKey(module.getModuleid());
   }else if(Helper.F_ACTION_REMOVE.equals(action)){
    rs = moduleService.access(module,Helper.DB_ACTION_DELETE);
   }else{
    return JSON.toJSONString(new Result(false,"請(qǐng)求參數(shù)錯(cuò)誤：action"));
   }
  }catch(Exception e){
   e.printStackTrace();
   return JSON.toJSONString(new Result(false,"操作失敗,出現(xiàn)異常，請(qǐng)聯(lián)系管理員！"));
  }
  if(rs<0){
   return JSON.toJSONString(new Result(false,"操作失敗，請(qǐng)聯(lián)系管理員！"));
  }
  return JSON.toJSONString(new Result(true,module));
 }

@RequestMapping(value = "/accessDenied",produces = "text/html;charset=UTF-8")
@ResponseBody
public String accessDenied(){
 return JSON.toJSONString(new Result(false,"您沒有權(quán)限對(duì)此進(jìn)行操作！"));
}

/**
  * 校驗(yàn)當(dāng)前用戶在某個(gè)模塊的某個(gè)功能的權(quán)限
  * @param functionId
  * @return 空字符串表示 有權(quán)限 ，否則是錯(cuò)誤信息
  * @throws Exception 
  */
 public String permissionValidate(int functionId){
  Object o = request.getSession().getAttribute(Helper.SESSION_USER);
  //if(o==null) throw new AuthorizationException(); 
  SysUser loginUser= (SysUser)o;
  if(loginUser.getUserid() == 1) return "";
  try{
   return mapper.permissionValidate(loginUser.getUserid(),functionId);
  }catch(Exception ex){
   ex.printStackTrace();
   return "數(shù)據(jù)庫(kù)操作出現(xiàn)異常！";
  }
 }