实习小结（三）--- 权限管理（RBAC）

　　这一周，大多数时间用来做需求分析，细化每个页面需要实现的功能。由于这个项目需要四种身份登录查看，分别是学生，老师，领导，管理员。每个身份登入系统显示得页面都不相同，四个角色分析完成后，统计了一下页面，居然达到40多个。。。数据库中表一共只有六七个，存在多个页面之间数据重复显示得现象。这时候就需要加入权限管理，一个页面，每个人登录进来后只要显示得页面不同即可。

　　设计理念参照了RBAC，这里不多详细介绍。核心内容主要为加入了角色的概念，赋予角色一定的权限，再将角色赋给用户，易于扩展和维护。

表结构图

表之前的关联如上图：

下面列出每个表的结构和数据

用户表 user

角色表 role

用户角色关系表 user_role

权限表 power

表中的pid为该权限对应的上一级的权限id

角色权限关系表 role_power

下面为测试权限管理做的demo

注：本项目只能实现二级权限，三级权限以及以下本文中的方法不再适用

展示效果

程序的展示效果是，若登录者是老师时，显示得导航栏数据为

学生登录显示得内容为

项目代码

本项目沿用了之前搭建的SSM框架，配置文件的部分就不再赘述

项目的目录结构如下

实体类

Power.java

package com.sysystem.model.entity;

public class Power {

    private Integer power_id;

    private String power_name;

    private Integer pid;

    private Power prwer;

    public Power getPrwer() {

        return prwer;

    }

    public void setPrwer(Power prwer) {

        this.prwer = prwer;

    }

    public Integer getPid() {

        return pid;

    }

    public void setPid(Integer pid) {

        this.pid = pid;

    }

    public Integer getPower_id() {

        return power_id;

    }

    public void setPower_id(Integer power_id) {

        this.power_id = power_id;

    }

    public String getPower_name() {

        return power_name;

    }

    public void setPower_name(String power_name) {

        this.power_name = power_name;

    }

    public Power(Integer power_id, String power_name) {

        super();

        this.power_id = power_id;

        this.power_name = power_name;

    }

    public Power() {

    }

    public Power(Integer power_id, String power_name, Integer pid, Power prwer) {

        super();

        this.power_id = power_id;

        this.power_name = power_name;

        this.pid = pid;

        this.prwer = prwer;

    }

}

Role.java

package com.sysystem.model.entity;

public class Role {

    private Integer role_id;

    private String role_name;

    private String remark;

    public Integer getRole_id() {

        return role_id;

    }

    public void setRole_id(Integer role_id) {

        this.role_id = role_id;

    }

    public String getRole_name() {

        return role_name;

    }

    public void setRole_name(String role_name) {

        this.role_name = role_name;

    }

    public String getRemark() {

        return remark;

    }

    public void setRemark(String remark) {

        this.remark = remark;

    }

    public Role(Integer role_id, String role_name, String remark) {

        super();

        this.role_id = role_id;

        this.role_name = role_name;

        this.remark = remark;

    }

    public Role(String role_name, String remark) {

        super();

        this.role_name = role_name;

        this.remark = remark;

    }

}

RoleAndPower.java

package com.sysystem.model.entity;

public class RoleAndPower {

    private Role role;

    private Power power;

    public Role getRole() {

        return role;

    }

    public void setRole(Role role) {

        this.role = role;

    }

    public Power getPower() {

        return power;

    }

    public void setPower(Power power) {

        this.power = power;

    }

    public RoleAndPower(Role role, Power power) {

        super();

        this.role = role;

        this.power = power;

    }

    public RoleAndPower() {

    }

}

User.java

package com.sysystem.model.entity;

import java.util.Set;

public class User {

    private Integer user_id;

    private String user_name;

    private String user_pass;

    private Set<UserAndRole> userRoles;

    public User(Integer user_id, String user_name, String user_pass,

            Set<UserAndRole> userRoles) {

        super();

        this.user_id = user_id;

        this.user_name = user_name;

        this.user_pass = user_pass;

        this.userRoles = userRoles;

    }

    public User() {

        super();

        // TODO Auto-generated constructor stub

    }

    public User(String user_name, String user_pass) {

        super();

        this.user_name = user_name;

        this.user_pass = user_pass;

    }

    public User(String user_name, String user_pass, Set<UserAndRole> userRoles) {

        super();

        this.user_name = user_name;

        this.user_pass = user_pass;

        this.userRoles = userRoles;

    }

    public Set<UserAndRole> getUserRoles() {

        return userRoles;

    }

    public void setUserRoles(Set<UserAndRole> userRoles) {

        this.userRoles = userRoles;

    }

    public Integer getUser_id() {

        return user_id;

    }

    public void setUser_id(Integer user_id) {

        this.user_id = user_id;

    }

    public String getUser_name() {

        return user_name;

    }

    public void setUser_name(String user_name) {

        this.user_name = user_name;

    }

    public String getUser_pass() {

        return user_pass;

    }

    public void setUser_pass(String user_pass) {

        this.user_pass = user_pass;

    }

    public User(Integer user_id, String user_name, String user_pass) {

        super();

        this.user_id = user_id;

        this.user_name = user_name;

        this.user_pass = user_pass;

    }

}

UserAndRole.java

package com.sysystem.model.entity;

public class UserAndRole {

    private User user;

    private Role role;

    public User getUser() {

        return user;

    }

    public void setUser(User user) {

        this.user = user;

    }

    public Role getRole() {

        return role;

    }

    public void setRole(Role role) {

        this.role = role;

    }

    public UserAndRole(User user, Role role) {

        this.user = user;

        this.role = role;

    }

    public UserAndRole() {

    }

}

dao层

IPowerDao.java

package com.sysystem.model.dao;

import java.util.List;

import java.util.Map;

import com.sysystem.model.entity.Power;

import com.sysystem.model.entity.User;

public interface IPowerDao {

    // 根据姓名查询用户

    List<User> getUserbyName(String name);

    // 根据姓名获取该用户的所有一级标题

    List<Power> getfirstPow(String name);

    // 根据一级标题获取子标题

    List<Power> getChildbyName(Map<String, Object> map);

    // 根据姓名获得所有二级权限

    List<Power> getSecPow(String name);

}

IPowerDao.xml

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

  PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

  "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.sysystem.model.dao.IPowerDao">

    <!-- 根据姓名获取用户 -->

    <select id="getUserbyName" parameterType="java.lang.String"

        resultType="User">

        select * from user where user_name = #{name}

    </select>

    <!-- 根据姓名获取该用户的一级权限 -->

    <select id="getfirstPow" parameterType="java.lang.String"

        resultType="Power">

        SELECT

            p.power_id,

            p.power_name,

            p.pid

        FROM

            power p,

            role_power rp,

            USER u,

            role r,

            user_role ur

        WHERE

            p.power_id = rp.power_id

        AND r.role_id = rp.role_id

        AND u.user_id = ur.user_id

        AND r.role_id = ur.role_id

        AND u.user_name = #{name}

        AND p.pid IS NULL

    </select>

    <!-- 根据姓名获取该用户的二级权限 -->

    <select id="getSecPow" parameterType="java.lang.String"  resultType="Power">

        SELECT

            p.power_id,

            p.power_name,

            p.pid

        FROM

            power p,

            role_power rp,

            USER u,

            role r,

            user_role ur

        WHERE

            p.power_id = rp.power_id

        AND r.role_id = rp.role_id

        AND u.user_id = ur.user_id

        AND r.role_id = ur.role_id

        AND u.user_name = #{name}

        AND p.pid IS NOT NULL

    </select>

    <!-- 获得指定具体人名的二级权限-->

    <select id="getChildbyName" parameterType="java.util.Map" resultType="Power">

        SELECT

            p.power_id,p.power_name

        FROM

            user u,

            role r,

            user_role ru,

            power p,

            role_power rp

        WHERE

            u.user_id = ru.user_id

        AND ru.role_id = r.role_id

        AND p.power_id = rp.power_id

        AND r.role_id = rp.role_id

        AND u.user_name = #{name}

        and p.pid = #{pid}

    </select>

</mapper>

service层

service层中的方法和dao层中的一样，调用了dao层中的方法

controller

PowerController.java

package com.sysystem.controller;

import java.util.HashMap;

import java.util.LinkedHashMap;

import java.util.List;

import java.util.Map;

import javax.annotation.Resource;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

import com.sysystem.model.entity.Power;

import com.sysystem.model.entity.User;

import com.sysystem.model.service.IPowerService;

@Controller

@RequestMapping("/power")

public class PowerController extends BaseController {

    @Resource

    private IPowerService powerService;

    /**

     * 进行登录验证

     *

     */

    @RequestMapping("/login")

    public String login(HttpServletRequest request,

            HttpServletResponse response, User u) throws Exception {

        String error = "";

        // 根据姓名获得用户集合判断用户是否存在

        List<User> list = powerService.getUserbyName(u.getUser_name());

        if (list.size() == 0) {

            error = "用户不存在";

            request.setAttribute("error", error);

            return "login";

            // 根据账号密码判断是否输入正确

        } else if (!(u.getUser_name().equals(list.get(0).getUser_name()) && u

                .getUser_pass().equals(list.get(0).getUser_pass()))) {

            error = "密码错误";

            request.setAttribute("error", error);

            return "login";

        }

        // 将用户名存放在session中

        HttpSession session = request.getSession();

        session.setAttribute("user", u);

        return "main";

    }

    /**

     * 获得所有标题的json对象

     *

     */

    @RequestMapping("/findMenu")

    public void findMenu(HttpServletRequest request,

            HttpServletResponse response) throws Exception {

        User user = (User) request.getSession().getAttribute("user");

        String user_name = user.getUser_name();

        // 获得指定用户的一级权限

        List<Power> firstpow = powerService.getfirstPow(user_name);

        // 获得用户的二级权限

        List<Power> secPow = powerService.getSecPow(user_name);

        // LinkedHashMap为有序的HashMap

        Map<String, Object> map = new LinkedHashMap<String, Object>();

        // 遍历一级权限

        for (int i = 0; i < firstpow.size(); i++) {

            Map<String, Object> map2 = new HashMap<String, Object>();

            map2.put("name", user_name);

            map2.put("pid", secPow.get(i).getPid());

            // 获取一级权限下的子权限

            List<Power> getchild = powerService.getChildbyName(map2);

            // 将一级权限名和子权限放入map中

            map.put(firstpow.get(i).getPower_name(), getchild);

        }

        // 想响应的输出流中写json数据

        writeToRes(response, map);

    }

}

jsp页面

<body>

      ${error }

   <form action="<%=path %>/power/login.do" method="post">

       用户名:<input type="text" name="user_name"/><br/>

       密码:<input type="password" name="user_pass"/><br/>

       <input type="submit" value="登录"/>

   </form>

  </body>

main.jsp

<script type="text/javascript" src="<%=path%>/js/jquery-1.11.1.js"></script>

  <script type="text/javascript">

  $(function(){

      window.location.href="<%=path%>/power/findMenu.do";

  });

  </script>

  <body>

  </body>

项目部署运行之后，登入zhangsan的账户（老师）浏览器中输出

json在线解析后为

登入lisi账户（学生）

项目总结

项目的主要思路如下：

　　首先通过用户名获取到一级权限和二级权限（注意，这里的一级和二级权限并没有关联起来，只是单纯的查询出来）；

　　然后创建一个LinkedHashMap<String,Object>，遍历一级权限，获得一级权限名当做Map的键，遍历二级权限，获得权限中的pid，即该权限的对应的上级权限的id，通过用户名和pid获得该一级权限下的二级权限，把二级权限当做Map的值；

　　最后将map数据转为json数据输出。