基于 Struts 2 拦截器实现细粒度的基于角色的存取控制

 @Entity 
 public class UserRole { 
  private Long id; 
  private User user; 
  private String objectType; 
  private Long objectId; 
  private String role; 
  public UserRole(Long userId, String role, String objectType, Long objectId) { 
    User user = new User(); 
    user.setId(userId); 
    this.user = user; 
    this.role = role; 
    this.objectType = objectType; 
    this.objectId = objectId; 
  } 
  @Id 
  @GeneratedValue(strategy = GenerationType.AUTO) 
  public Long getId() { 
    return id; 
  } 
  public void setId(Long id) { 
    this.id = id; 
  } 
  @ManyToOne 
  @JoinColumn(name = "userId", nullable = false) 
  public User getUser() { 
    return user; 
  } 
  public void setUser(User user) { 
    this.user = user; 
  } 
  public String getObjectType() { 
    return objectType; 
  } 
  public void setObjectType(String objectType) { 
    this.objectType = objectType; 
  } 
  public Long getObjectId() { 
    return objectId; 
  } 
  public void setObjectId(Long objectId) { 
    this.objectId = objectId; 
  } 
  public String getRole() { 
    return role; 
  } 
  public void setRole(String role) { 
    this.role = role; 
  } 
 }

public interface UserRoleDao { 
 public void create(UserRole userRole); 
 public void update(UserRole userRole); 
 public UserRole find(Long userId, String objectType, Long objectId); 
 }

public class UserRoleDaoImpl implements UserRoleDao { 
  private EntityManager entityManager; 
  public EntityManager getEntityManager() { 
    return entityManager; 
  } 

  @PersistenceContext 
  public void setEntityManager(EntityManager entityManager) { 
    this.entityManager = entityManager; 
  } 

  public void create(UserRole userRole) { 
    entityManager.persist(userRole); 
  } 

  public UserRole find(Long userId, String objectType, Long objectId) { 
    Query query = entityManager.createQuery(
      "FROM UserRole ur WHERE ur.user.id=" + 
      userId + 
      " AND ur.objectType='" + 
      objectType + 
      "' AND ur.objectId=" + 
      objectId); 
    List result = query.getResultList(); 
    if (result.size() == 0) 
      return null; 
    return (UserRole)result.get(0); 
  } 

  public void update(UserRole userRole) { 
    entityManager.merge(userRole); 
  } 
 }

public interface RoleService { 
    public void setUserRole(Long userId, String role, String objectType, Long objectId); 
    public String findRole(Long userId, String objectType, Long objectId); 
 }

@Transactional(readOnly = true) 
 public class RoleServiceImpl implements RoleService { 

 private UserRoleDao userRoleDao; 

 public void setUserRoleDao(UserRoleDao userRoleDao) { 
    this.userRoleDao = userRoleDao; 
 } 

  @Transactional(readOnly = false) 
  public void setUserRole(Long userId, String role, String objectType, Long objectId) { 
    UserRole userRole = new UserRole(userId, role, objectType, objectId); 
    UserRole userRoleInDB = userRoleDao.find(userId, objectType, objectId); 
    if (null == userRoleInDB) { 
      userRoleDao.create(userRole); 
    } else { 
      userRole.setId(userRoleInDB.getId()); 
      userRoleDao.update(userRole); 
    } 
  } 

  public String findRole(Long userId, String objectType, Long objectId) { 
    UserRole userRole = userRoleDao.find(userId, objectType, objectId); 
    if (userRole == null) { 
      return null; 
    } 
    return userRole.getRole(); 
  } 
 }

public class RBACInterceptor implements Interceptor { 
   public static final String FORBIDDEN = "forbidden"; 
   private List<String> allowedRoles = new ArrayList<String>(); 
   private List<String> disallowedRoles = new ArrayList<String>(); 
   private RoleService roleService; 
   private String objectType; 
   private String objectIdKey;   
    
   public void setRoleService(RoleService roleService) { 
  this.roleService = roleService; 
   } 

   public void setObjectType(String objectType) { 
    this.objectType = objectType; 
  } 
  public void setObjectIdKey(String objectIdKey) { 
    this.objectIdKey = objectIdKey; 
  } 

  public void setAllowedRoles(String roles) { 
    if (roles != null) 
      allowedRoles = Arrays.asList(roles.split("[ ]*,[ ]*")); 
  } 

  public void setDisallowedRoles(String roles) { 
    if (roles != null) 
      disallowedRoles = Arrays.asList(roles.split("[ ]*,[ ]*")); 
  } 

  public void init() { 
  } 
    
  public void destroy() { 
  } 
    
  public String intercept(ActionInvocation actionInvocation) throws Exception { 
    HttpServletRequest request = ServletActionContext.getRequest(); 
    // Get object id 
    Long objectId = Long.valueOf(request.getParameter(objectIdKey)); 
    Map session = actionInvocation.getInvocationContext().getSession(); 
    // Get current user id 
    Long userId = (Long) session.get(Constant.KEY_CURRENT_USER); 
    // Get the user role 
    String userRole = roleService.findRole(userId, objectType, objectId); 

    if (!isAllowed(userRole)) { 
      // forbid invoking the action 
      return FORBIDDEN; 
    } else { 
      // allow invoking the action 
      return actionInvocation.invoke(); 
    } 
  } 

  // Check if the current user has correct role to invoke the action 
  protected boolean isAllowed(String userRole) { 
    if (allowedRoles.size() > 0) { 
      if (userRole == null) 
        return false; 
      return allowedRoles.contains(userRole); 
    } else if (disallowedRoles.size() > 0) { 
      if (userRole == null) 
        return true; 
      return !disallowedRoles.contains(userRole); 
    } 
    return true; 
  } 
 }

<!-- Data Access Objects --> 
  <bean id="userRoleDao" class="com.sample.security.dao.impl.UserRoleDaoImpl"/> 
   
  <!-- Service Objects --> 
  <bean id="roleService" 
    class="com. sample.security.service.impl.RoleServiceImpl" > 
    <property name="userRoleDao" ref="userRoleDao" /> 
  </bean> 
  
  <!-- Interceptor Objects --> 
  <bean id="RBACInterceptor" scope="prototype" 
    class="com. sample.security.interceptor. RBACInterceptor "> 
    <property name="roleService"  ref="roleService" /> 
  </bean>

<interceptor name="RBAC ” class="RBACInterceptor" />

<action name="deleteMeeting" class="com.demo.action.DeleteMeetingAction"> 
 <result>/WEB-INF/jsp/deleteMeetingResult.jsp</result> 
 <result name="forbidden">/WEB-INF/jsp/forbidden.jsp</result> 
    <interceptor-ref name="RBAC"> 
        <param name="allowedRoles">admin, owner</param> 
        <param name="objectType">calendar</param> 
 <param name="objectIdKey">id</param> 
 </interceptor-ref> 
 <interceptor-ref name="defaultStack" /> 
 </action>

<action name="assignCalendarRole" class="com.demo.action.AssignCalendarRoleAction"> 
 <result>/WEB-INF/jsp/deleteMeetingResult.jsp</result> 
 <result name="forbidden">/WEB-INF/jsp/forbidden.jsp</result> 
    <interceptor-ref name="RBAC"> 
        <param name="allowedRoles">owner</param> 
        <param name="objectType">calendar</param> 
 <param name="objectIdKey">id</param> 
 </interceptor-ref> 
 <interceptor-ref name="defaultStack" /> 
 </action>

public class AssignCalendarRoleAction extends ActionSupport { 
  private RoleService roleService; 
  private Long userId = 0; 
  private String userRole = "reader"; 
 private Long id = 0; 

  public AssignCalendarRoleAction (RoleService roleService) { 
    this.roleService = roleService; 
  } 

 public String execute() { 
 roleService.setUserRole(userId, userRole, "calendar", id); 
 return SUCCESS; 
  } 
 }