Custom permission verification method

We can also define our own permission verification methods , stay @PreAuthorize Use our method in the annotation .

@Component("ex")
public class SGExpressionRoot {

    public boolean hasAuthority(String authority){
        // Get the permission of the current user 
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
        List<String> permissions = loginUser.getPermissions();
        // Judge whether there exists in the user permission set authority
        return permissions.contains(authority);
    }
}

stay SPEL Use in expressions @ex It's equivalent to getting... In the container bean Your name is not ex The object of . And then call the object's hasAuthority Method

    @RequestMapping("/hello")
    @PreAuthorize("@ex.hasAuthority('system:dept:list')")
    public String hello(){
        return "hello";
    }