以下是一个简化的Spring Security权限系统设计示例，包括用户实体、角色实体和权限实体。
// 用户实体
@Entity
public class User {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
private String username;
private String password;
// 用户拥有多个角色
@ManyToMany(cascade = CascadeType.ALL)
private Collection<Role> roles;
// 省略getter和setter
}
// 角色实体
@Entity
public class Role {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
private String name;
// 角色拥有多个权限
@ManyToMany(cascade = CascadeType.ALL)
private Collection<Permission> permissions;
// 省略getter和setter
}
// 权限实体
@Entity
public class Permission {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
private String name;
// 省略getter和setter
}
// Spring Security配置
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService)
.passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
// 其他配置...
}
// UserDetailsService实现
@Service
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("User not found."));
List<GrantedAuthority> authorities = user.getRoles()
.stream()
.flatMap(role -> role.getPermissions().stream())
.map(permission -> new SimpleGrantedAuthority(permission.getName()))
.collect(Collectors.toList());
return new org.springframework.security.core.userdetails.User(
user.getUsername(),
user.getPassword(),
authorities
);
}
}在这个例子中，我们定义了用户、角色和权限实体，并通过UserDetailsService自定义了用户认证逻辑。在CustomUserDetailsService中，我们查询用户，并将用户的角色权限转换为Spring Security可以识别的GrantedAuthority集合。这样，Spring Security就可以使用这些权限来控制