如何在spring boot中实现行级授权?

oknrviil  于 2021-07-24  发布在  Java
关注(0)|答案(1)|浏览(344)

假设我在springboot中有以下端点

GET /todo

DELETE /todo/{id}

如何确保只返回userid的条目,并且用户只能更新自己的todo?我有个朋友 Authentication 对象。有什么我可以用的方法吗?或者只要确保总是调用findxyzbyidanduserid,其中userid总是从 Principal ?
我有点担心忘记检查和显示来自其他用户的条目的可能性。

p4tfgftt

p4tfgftt1#

我的方法是3路实现:(使用jpa和hibernate)
用户请求上下文
获取上下文的Map超类
一个语句检查器来注入你的用户ID
例如:

public final class UserRequestContext {
  public static String getUserId() {
    // code to retrieve your userid and throw when there is none!
    if (userId == null) throw new IllegalStateException("userid null");
    return userId;
  }
}
@MappedSuperclass
public class UserResolver {
  public static final String USER_RESOLVER = "USER_RESOLVER";

  @Access(AccessType.PROPERTY)
  public String getUserId() {
    return UserRequestContext.getUserId();
  }

}
@Component
public class UserInspector implements StatementInspector {
  @Override
  public String inspect(String statement) {
    if (statement.contains(UserResolver.USER_RESOLVER)) {
       statement = statement.replace(UserResolver.USER_RESOLVER, "userId = '" + UserRequestContext.getUserId() + "'" );
    }
    return sql;
  }

  @Bean
  public HibernatePropertyCustomizer hibernatePropertyCustomizer() {
    return hibernateProperies -> hibernateProperties.put("hibernate.session_factory.statement_inspector", 
    UserInspector.class.getName());
  }
}

所以你的实体看起来像这样:

@Entity
...
@Where(clause = UserResolver.USER_RESOLVER)
public class Todo extends UserResolver {
   ...
}

相关问题