SpringSecurity-SpirngBoot-方法级授权（SpringSecurity6.3新特性）（四）

SpringSecurity-SpirngBoot-方法级授权（SpringSecurity6.3新特性）（四）

本章使用SpringSecurity6.3新特性实现数据级别的鉴权，主要的目的是实现不同权限的用户查询同一个方法，限制一些内容只能拥有特定权限的用户才能看到，其他没有该权限的用户显示为空。

在上一节的基础上，新建spring-security-authorization-data分支。

1. 修改SecurityConfiguration类，添加rob用户，权限为"message:read", “user:read”；新建luke用户，权限为"message:read"

   @Bean
   CustomUserRepository customUserRepository() {
        
        
       String password = new BCryptPasswordEncoder().encode("password");
   
       CustomUser customUser1 = new CustomUser(1L, "rob", password, "message:read", "user:read");
       CustomUser customUser2 = new CustomUser(2L, "luke", password, "message:read");
       Map<String, CustomUser> emailToCustomUser = new HashMap<>();
       emailToCustomUser.put(customUser1.getEmail(), customUser1);
       emailToCustomUser.put(customUser2.getEmail(), customUser2);
       return new MapCustomUserRepository(emailToCustomUser);
   }
   

   修改CustomUser、CustomUserRepositoryUserDetailsService类，以适配修改后的SecurityConfiguration：

   public class CustomUser {
        
        
       private final long id;
   
       private final String email;
   
       @JsonIgnore
       private final String password;
   	
       // 用户权限
       private final String[] authoritie;
   
       @JsonCreator
       public CustomUser(long id, String email, String password, String ...authoritie) {
        
        
           this.id = id;
           this.email = email;
           this.password = password;
           this.authoritie = authoritie;
       }
       public long getId() {
        
        
           return this.id;
       }
   
       public String getEmail() {
        
        
           return this.email;
       }
   
       public String getPassword() {
        
        
           return this.password;
       }
   
       public String[] getAuthoritie() {
        
        
           return authoritie;
       }
   
       @Override
       public String toString() {
        
        
           return email;
       }
   
       @Override
       public int hashCode() {
        
        
           return email.hashCode();
       }
   
       @Override
       public boolean equals(Object obj) {
        
        
           return this.toString().equals(obj.toString());
       }
   }
   

   @Service
   public class CustomUserRepositoryUserDetailsService implements UserDetailsService {
        
        
       private final CustomUserRepository userRepository;
   
   
       public CustomUserRepositoryUserDetailsService(CustomUserRepository userRepository) {
        
        
           this.userRepository = userRepository;
       }
       @Override
       public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        
        
           // 查询用户名对应的用户
           CustomUser customUser = this.userRepository.findCustomUserByEmail(username);
           if (customUser == null) {
        
        
               // 用户不存在 抛出异常
               throw new UsernameNotFoundException("username " + username + " is not found");
           }
           return new CustomUserDetails(customUser);
       }
   
       static final class CustomUserDetails extends CustomUser implements UserDetails {
        
        
   
           private final List<GrantedAuthority> ROLE_USER;
   
           CustomUserD