基于SpringBoot实现请求的数据权限验证

1.实现方案

对需要进行数据权限的请求添加自定义注解，通过拦截器对请求进行拦截，判断是否需要进行数据权限验证和执行数据权限验证的逻辑。（GET请求没问题，POST请求因为HttpRequest的流getReader只能读取一次,如果在拦截器处理后,进入Handler会抛异常。此问题后面单独说）

2.代码实现

2.1 抽象数据权限验证类

/**
 * @Description 抽象的数据权限类
 * @Author zouxiaodong
 * @Date 2022/03/01 15:36
 */
public abstract class AbstractDataAuth {

    /**
     * @Author zouxiaodong
     * @Description 数据权限控制逻辑
     * @Date 2022/03/01 15:42
     * @Param [httpServletRequest, httpServletResponse]
     * @return boolean
     **/
    public abstract boolean checkDataAuth(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse);
}

2.2 自定义注解,增加在需要进行数据权限验证的Handler上

/**
 * @Author zouxiaodong
 * @Description 数据权限认证的注解
 * @Date 2022/03/01 15:16
 **/
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface DataAuthValid {

    /**
     * 名称
     **/
    String name() default "";

    /**
     * 数据权限开关,默认开启
     **/
    boolean switchAuth() default true;

    /**
     * 数据权限处理类
     **/
    Class<? extends AbstractDataAuth> dataAuthClass();
}

2.3 自定义拦截器，判断请求对应的handler是否有注解(是否需要进行权限验证)

/**
 * @Description 数据权限拦截器
 * @Author zouxiaodong
 * @Date 2022/03/01 16:18
 */
@Component
@Slf4j
public class DataAuthInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler){
        try {
            // 如果不是方法
            if(!(handler instanceof HandlerMethod)){
                return true;
            }
            DataAuthValid dataAuthValid = ((HandlerMethod) handler).getMethodAnnotation(DataAuthValid.class);
            if(dataAuthValid == null || !dataAuthValid.switchAuth()){
                return true;
            }else{
                Class<? extends AbstractDataAuth> dataAuthClass = dataAuthValid.dataAuthClass();
//                return dataAuthClass.newInstance().checkDataAuth(request,response);
                return SpringUtil.getBean(dataAuthClass).checkDataAuth(request,response);
            }
        }catch (Exception e){
            log.error("DataAuthInterceptor执行请求:{}拦截异常。异常信息为:{}",request.getRequestURI(),e.getMessage());
            return false;
        }
    }
}

2.4 自定义Filter（对特定请求的HttpRequest进行Wrapper处理,避免Post请求对流进行二次读取时的异常）

/**
 * @Description 需要对post或者put请求进行数据权限验证时的filter
 * @Author zouxiaodong
 * @Date 2022/03/02 16:07
 */
@Slf4j
public class PostMethodFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        CustomHttpServletRequestWrapper customHttpServletRequestWrapper = null;
        HttpServletRequest req = (HttpServletRequest)request;
        try {
            customHttpServletRequestWrapper = new CustomHttpServletRequestWrapper(req);
        }catch (Exception e){
            log.warn("请求({})执行filter异常。异常信息为:{}",req.getRequestURI(), e.getMessage());
        }
        chain.doFilter((Objects.isNull(customHttpServletRequestWrapper) ? request : customHttpServletRequestWrapper), response);
    }
}

2.5 自定义HttpServletRequestWrapper，对HttpRequest进行处理

/**
 * @Description 自定义请求wrapper
 * @Author zouxiaodong
 * @Date 2022/03/02 10:34
 */
@Slf4j
public class CustomHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private byte[] body;

    public byte[] getBody() {
        return body;
    }

    public String getBodyAsString(){
        return new String(body,StandardCharsets.UTF_8);
    }

    /**
     * Constructs a request object wrapping the given request.
     *
     * @param request The request to wrap
     * @throws IllegalArgumentException if the request is null
     */
    public CustomHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        StringBuilder sb = new StringBuilder();
        String line;
        BufferedReader reader = request.getReader();
        while ((line=reader.readLine()) != null){
            sb.append(line);
        }
        this.body = sb.toString().getBytes(StandardCharsets.UTF_8);
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(body);
        return new ServletInputStream() {

            @Override
            public int read() throws IOException {
                return byteArrayInputStream.read();
            }

            @Override
            public void setReadListener(ReadListener listener) {
            }

            @Override
            public boolean isReady() {
                return true;
            }

            @Override
            public boolean isFinished() {
                return false;
            }
        };
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(this.getInputStream()));
    }
}

2.6 针对自定义的Interceptor和Filter进行系统配置

/**
 * @Description 数据权限filter和interceptor配置
 * @Author zouxiaodong
 * @Date 2022/03/01 16:36
 */
@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Bean
    public FilterRegistrationBean servletRegistrationBean() {
        PostMethodFilter postMethodFilter = new PostMethodFilter();
        FilterRegistrationBean<PostMethodFilter> bean = new FilterRegistrationBean<>();
        bean.setFilter(postMethodFilter);
        bean.setName("postMethodFilter");
        bean.addUrlPatterns("/snapshot/updatePolicy");
        bean.setOrder(Ordered.LOWEST_PRECEDENCE);
        return bean;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry){
        //对所有请求进行拦截
        registry.addInterceptor(new DataAuthInterceptor()).addPathPatterns("/**").
                //解决swagger无法访问的问题
                excludePathPatterns("/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**");
    }

    //解决swagger无法访问的问题
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
    }

}

2.7 将注解加到需要进行数据权限验证的方法上

 /**
     * @Author zouxiaodong
     * @Description 更新虚拟机的快照策略(如果之前没有策略则新增,有则更新策略)
     * @Date 2021/12/08 9:51
     * @Param [vmID, snapshotPolicy]
     * @return com.zkxy.common.returnUtil.OperationResult<java.lang.Boolean>
     **/
    @ApiOperation("更新虚拟机的快照策略(如果之前没有策略则新增,有则更新策略;如果之前有策略,新的策略为空则进行策略禁用或停止)")
    @RequestMapping(value = "/updatePolicy",method = RequestMethod.POST)
    @DataAuthValid(name = "updatePolicy",switchAuth = true,dataAuthClass = UpdatePolicyDataAuth.class)
    public OperationResult<Boolean> updatePolicy(@ApiParam(name = "policy",value = "新的虚拟机快照策略",required = true) @RequestBody UpdateSnapshotPolicy policy){
        ......
    }

2.8 实现注解中具体数据权限认证类

/**
 * @Description 快照策略升级的数据权限认证
 * @see VMSnapshotController#updatePolicy(com.zkxy.eda.vmware.vcenter.pojo.UpdateSnapshotPolicy)
 * @Author zouxiaodong
 * @Date 2022/03/02 9:15
 */
@Slf4j
@Component
public class UpdatePolicyDataAuth extends AbstractDataAuth{

    @Autowired
    private VirtualMachineService virtualMachineService;

    @Override
    public boolean checkDataAuth(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) {
        if(RequestMethod.POST.name().equals(httpServletRequest.getMethod())){
            try{
                String body = ((CustomHttpServletRequestWrapper)httpServletRequest).getBodyAsString();
                UpdateSnapshotPolicy updateSnapshotPolicy = JSONObject.parseObject(body, UpdateSnapshotPolicy.class);
                if(updateSnapshotPolicy == null){
                    return false;
                }
                String vmId = updateSnapshotPolicy.getVmId();
                List<ZkxyVirtualMachine> zkxyVirtualMachines = virtualMachineService.getVirtualMachinesByUserSession();
                if(!CollectionUtils.isEmpty(zkxyVirtualMachines)){
                    for (ZkxyVirtualMachine zkxyVirtualMachine:zkxyVirtualMachines){
                        if(zkxyVirtualMachine.getVmId().equals(vmId)){
                            return true;
                        }
                    }
                }
                httpServletResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                OperationResult<ZkxyVirtualMachine> result = OperationResult.fail(null,String.format("您没有权限访问此云主机(%s)",vmId),null);
                httpServletResponse.setHeader("Content-Type","application/json;charset=UTF-8");
                httpServletResponse.getWriter().write(JSONObject.toJSONString(result));
                httpServletResponse.getWriter().flush();
                log.warn("请求({})已拒绝!vmId:{}",httpServletRequest.getRequestURI(),vmId);
            }catch (Exception e){
                log.error("请求({})处理异常.异常信息为:{}",httpServletRequest.getRequestURI(),e.getMessage());
            }
        }
        return false;
    }
}

 3.开发过程中的问题

一开始的时候只自定义了Interceptor，在对POST请求拦截器中读取了HttpRequest的getReader，导致执行到Handler时，系统提示：

java.lang.IllegalStateException: getReader() has already been called for this request
    org.apache.catalina.connector.Request.getInputStream(Request.java:1032)
    org.apache.catalina.connector.RequestFacade.getInputStream(RequestFacade.java:364)

 此时就需要自定义Filter（步骤2.4,Filter的配置在步骤2.6）对需要的请求进行HttpRequest处理（步骤2.5），转为HttpServletRequestWrapper,然后将该HttpServletRequestWrapper放入过滤链中传递下去。

如果系统中有swagger，新增自定义拦截器后可能会导致swagger不可用,步骤2.6中增加注释的两个配置代码即可