微服务迁移记（五）：WEB层搭建(4)-简单的权限管理

一、redis搭建

二、WEB层主要依赖包

三、FeignClient通用接口

以上三项，参考《微服务迁移记（五）：WEB层搭建(1)》

四、SpringSecurity集成

参考：《微服务迁移记（五）：WEB层搭建(2)-SpringSecurity集成》

五、FreeMarker集成

参考：《微服务迁移记（五）：WEB层搭建(3)-FreeMarker集成》

六、简单权限管理

实现一个简单的到按钮级权限管理，基于数据库扩展。不支持数据级权限，菜单只到二级（可以扩展至无限级，一般MIS系统，三级应该够了）

1. 数据库设计

用户表：tb_user

角色表：tb_role

用户角色：tb_user_role，外键：user_id,role_id

菜单表：tb_tree

菜单功能按钮表：tb_tree_func，外键：tree_id

角色菜单权限：tb_role_right(应该叫tb_role_tree更合适点），外键：role_id，tree_id

角色菜单下功能按钮：tb_roletree_func，外键：role_right_id，tree_id,role_tree_func（这个键没有拉外键过来），三个外键组成联合主键。

外键关系见下图

2. 用户登录后，左侧二级菜单展示

数据源：获取所有菜单及按钮的权限，前文提到的SpringSecurity里，MyUserDetail里我加过一个roletree的字段，会一起扔到session里（用户更换权限后，需要退出重新登录才能生效）

//获取所有树及按钮，含当前角色是否有权限
    public Map<String,Object> getAllTreeWithRoleRight(int role_id){
        String sql = "SELECT a.tree_id,a.tree_name,a.sup_tree_id,a.taxis,IFNULL(b.tree_id,0) as perm FROM  " +
                " tb_tree a left JOIN  " +
                "(SELECT rr.tree_id FROM tb_role_right rr  " +
                "WHERE rr.role_id=?) b " +
                "ON b.tree_id=a.tree_id " +
                " WHERE a.del_flag=0 AND enable_flag=1 " +
                " ORDER BY sup_tree_id ASC,taxis ASC;";
        List<Map<String,Object>> tree = this.jdbcTemplate.queryForList(sql,role_id);
        //再查询所有按钮
        sql = "SELECT a.tree_id,b.tree_func_name,b.tree_func_namedesc,IFNULL(c.tree_id,0) as perm FROM tb_tree a INNER JOIN tb_tree_func b ON b.tree_id=a.tree_id " +
                "left JOIN  " +
                "(SELECT rt.tree_id,rt.role_id,rt.tree_func_name FROM tb_role_treefunc rt WHERE rt.role_id=?) c " +
                "ON c.tree_id=a.tree_id AND c.tree_func_name=b.tree_func_name";
        List<Map<String,Object>> func = jdbcTemplate.queryForList(sql,role_id);
        Map<String,Object> map = new HashMap<String,Object>();
        map.put("tree",tree);
        map.put("func",func);
        return map;
    }

freemarker前台展示二级菜单：

<div id="sidebar-collapse" class="col-sm-3 col-lg-2 sidebar">
    <ul class="nav menu">
        <li class="active"><a href="javascript:goto('0000','/home');"><span class="glyphicon glyphicon-home"></span> 首页</a></li>
            <#list treelist as tree>
                <#if tree.sup_tree_id == >
                <li class="parent ">
                    <a data-toggle="collapse" href="#sub-item-${tree.tree_id?c}">
                        <span class="glyphicon ${tree.tree_icon}"></span> ${tree.tree_name}
                    </a>
                    <ul class="children collapse" id="sub-item-${tree.tree_id?c}">
                <#list treelist as tree_c>
                    <#if tree_c.sup_tree_id==tree.tree_id>
                        <li><a href="javascript:goto(${tree_c.tree_id?c},'${tree_c.link_addr!}')"><span class="glyphicon ${tree_c.tree_icon}"></span> ${tree_c.tree_name}</a></li>
                    </#if>
                </#list>
                    </ul>
                </li>
                </#if>
            </#list>
        <li role="presentation" class="divider"></li>
        <li><a href="/manage/Login/logout"><span class="glyphicon glyphicon-user"></span> 注销</a></li>
    </ul>
</div><!--/.sidebar-->

最终展示效果如下：

2. 模块中按钮权限控制

通过自定义FreeMarker标签，实现前台按钮展示或隐藏

PermissionTagDirective 继承自TemplateDirectiveModel ，引用时需要传递tree_id和permissiontype两个字段进来。

package com.zyproject.web.freemarker;

import com.zyproject.entity.RoleTreefuncEntity;
import com.zyproject.entity.UserEntity;
import com.zyproject.web.secrity.MyUserDetails;
import freemarker.core.Environment;
import freemarker.template.TemplateDirectiveBody;
import freemarker.template.TemplateDirectiveModel;
import freemarker.template.TemplateException;
import freemarker.template.TemplateModel;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;

import java.io.IOException;
import java.util.List;
import java.util.Map;

/**
 * @program: zyproject
 * @description: freemarker自定义标签，实现按钮级权限控制
 * @author: zhouyu(zhouyu629 # qq.com)
 * @create: 2020-02-18
 **/
@Component
public class PermissionTagDirective implements TemplateDirectiveModel {
    private static String permissionType = "ptype"; //A新增，D删除等，与数据库对应
    private static String Tree = "tree_id"; //菜单id
    @Override
    public void execute(Environment environment, Map map,
                        TemplateModel[] templateModels,
                        TemplateDirectiveBody templateDirectiveBody) throws TemplateException, IOException {
        String ptype = map.get(permissionType).toString();
        String tree_id = map.get(Tree).toString();
        //当前登录用户
        MyUserDetails myUserDetails = (MyUserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        //判断权限，当前tree下，是否有ptype权限
        if(this.checkRight(myUserDetails.getTreefuncEntities(),ptype,tree_id)) {
            templateDirectiveBody.render(environment.getOut());
        }
    }

    private boolean checkRight(List<RoleTreefuncEntity> roleTreefuncEntities,String ptype,String tree_id){
        for (RoleTreefuncEntity roleTreefuncEntity :roleTreefuncEntities) {
            if(roleTreefuncEntity.getTree_id() == Integer.valueOf(tree_id) && roleTreefuncEntity.getTree_func_name().equals(ptype)){
                return true;
            }
        }
        return false;
    }
}

然后把这个标签注册到FreeMarker

package com.zyproject.web.freemarker;

import freemarker.template.Configuration;
import freemarker.template.TemplateException;
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.stereotype.Component;

import javax.annotation.PostConstruct;
import java.io.IOException;

/**
 * @program: zyproject
 * @description: 注册标签到Freemarker
 * @author: zhouyu(zhouyu629 # qq.com)
 * @create: 2020-02-18
 **/
@Component
public class CustomeFreemakerConfigure implements ApplicationContextAware {
    @Autowired
    Configuration configuration;

    @Autowired
    private PermissionTagDirective permissionTagDirective;

    @Override
    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {

    }

    @PostConstruct
    public void setSharedVariable() throws IOException, TemplateException{
        configuration.setSharedVariable("perm",permissionTagDirective);
    }
}

前台引用标签，标签里的参数tree_id，是在BaseController里扔到前台的，所有Controller都继承自BaseController（这部分代码略）

<@perm tree_id="${tree_id}" ptype="M">
      <button name="btnModify" onclick="edit(${roles.role_id})" type="button" class="btn btn-primary btn-sm"><span class="glyphicon glyphicon-th" aria-hidden="true"></span>修改</button>
</@perm>
<@perm tree_id="${tree_id}" ptype="D">
     <button name="btnDel" type="button" onclick="del(${roles.role_id})" class="btn btn-danger btn-sm"><span class="glyphicon glyphicon-remove" aria-hidden="true"></span>删除</button>
</@perm>
 <@perm tree_id="${tree_id}" ptype="R">
     <button name="btnRight" type="button" onclick="setRight(${roles.role_id})" class="btn btn-success btn-sm"><span class="glyphicon glyphicon-tags" aria-hidden="true"></span>权限</button>
 </@perm>

最终展示效果如下，后面三个按钮根据角色权限分配得来：

待完善：

1. BaseController里还要判断下进入每个模块是否有相应的权限，防止用户通过直接输入url地址绕过自定义标签的判断

2. 目前权限只到菜单和按钮级别，如果这个功能模块有多个子界面，权限都跟主界面保持一致