oa_08
创建AclManager接口，并实现
- 理解权限管理子系统与其它系统之间的交互过程
- 理解权限管理子系统的具体实现
package com.bjsxt.oa.manager.impl;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import com.bjsxt.oa.manager.AclManager;
import com.bjsxt.oa.manager.Permission;
import com.bjsxt.oa.model.ACL;
public class AclManagerImpl extends AbstractManager implements AclManager {
public void addOrUpdateExtends(int userId, int moduleId, boolean yes) {
//查询ACL对象
ACL acl = findACL(ACL.TYPE_USER, userId, moduleId);
if(acl != null){
acl.setExtends(yes);
getHibernateTemplate().update(acl);
}else{
acl = new ACL();
acl.setPrincipalType(ACL.TYPE_USER);
acl.setPrincipalId(userId);
acl.setModuleId(moduleId);
acl.setExtends(yes);
getHibernateTemplate().save(acl);
}
}
public void addOrUpdatePermission(String principalType, int principalId,
int moduleId, int permission, boolean yes) {
//查询ACL对象
ACL acl = findACL(principalType, principalId, moduleId);
if(acl != null){
//更新aclState的值
acl.setPermission(permission, yes);
getHibernateTemplate().update(acl);
}else{
acl = new ACL();
acl.setPrincipalType(principalType);
acl.setPrincipalId(principalId);
acl.setModuleId(moduleId);
acl.setPermission(permission, yes);
getHibernateTemplate().save(acl);
}
}
public void delPermission(String principalType, int principalId,
int moduleId) {
//查询ACL对象
ACL acl = findACL(principalType, principalId, moduleId);
if(acl != null){
getHibernateTemplate().delete(acl);
}
}
public boolean hasPermission(int userId, int moduleId, int permission) {
//根据用户标识和模块标识查找授权记录
ACL acl = findACL(ACL.TYPE_USER, userId, moduleId);
if(acl != null){
int yesOrNo = acl.getPermission(permission);
if(yesOrNo != ACL.ACL_NEUTRAL){
return yesOrNo == ACL.ACL_YES ? true : false;
}
}
//继续查找用户拥有的角色的授权
//查找用户拥有的角色，并按优先级从高到低排序
String hql = "select r.id from UsersRoles ur join ur.role r join ur.user u " +
"where u.id = ? order by ur.orderNo";
List roleIds = getHibernateTemplate().find(hql,userId);
for (Iterator iterator = roleIds.iterator(); iterator.hasNext();) {
Integer rid = (Integer) iterator.next();
acl = findACL(ACL.TYPE_ROLE, rid, moduleId);
if(acl != null){
return acl.getPermission(permission) == ACL.ACL_YES ? true : false;
}
}
return false;
}
public List searchModules(int userId) {
//查询用户拥有的角色列表，并按优先级从低到高排序
String hql = "select r.id from UsersRoles ur join ur.role r join ur.user u " +
"where u.id = ? order by ur.orderNo desc";
List roleIds = getHibernateTemplate().find(hql,userId);
Map temp = new HashMap();
for (Iterator iterator = roleIds.iterator(); iterator.hasNext();) {
Integer rid = (Integer) iterator.next();
List acls = findRoleAcls(rid);
for (Iterator iterator2 = acls.iterator(); iterator2.hasNext();) {
ACL acl = (ACL) iterator2.next();
temp.put(acl.getModuleId(), acl);
}
}
//查询针对用户的有效的授权列表
List acls = findUserAcls(userId);
for (Iterator iterator = acls.iterator(); iterator.hasNext();) {
ACL acl = (ACL) iterator.next();
temp.put(acl.getModuleId(), acl);
}
//去掉那些没有读取权限的acl对象
Set entries = temp.entrySet();
for (Iterator iterator = entries.iterator(); iterator.hasNext();) {
Map.Entry entry = (Map.Entry) iterator.next();
ACL acl = (ACL)entry.getValue();
//如果没有读取权限，都应该从最终的授权列表中去除
if(acl.getPermission(Permission.READ) != ACL.ACL_YES){
iterator.remove();
}
}
//最后，得到拥有读取权限的授权列表
Set moduleIds = temp.keySet();
if(moduleIds.isEmpty()){
return null;
}
//得到拥有读取权限的模块列表
hql = "select m from Module m where m.id in (:ids) order by m.orderNo";
return getSession().createQuery(hql)
.setParameterList("ids", moduleIds) //moduleIds集合不能为空
.list();
}
private ACL findACL(String principalType,int principalId,int moduleId){
String hql = "select acl from ACL acl where acl.principalType = ? and " +
"acl.principalId = ? and acl.moduleId = ?";
return (ACL)getSession().createQuery(hql)
.setParameter(0, principalType)
.setParameter(1, principalId)
.setParameter(2, moduleId)
.uniqueResult();
}
private List findRoleAcls(int roleId){
String hql = "select acl from ACL acl where acl.principalType = ? " +
"and acl.principalId = ?";
return getHibernateTemplate().find(hql, new Object[]{ACL.TYPE_ROLE,roleId});
}
private List findUserAcls(int userId){
String hql = "select acl from ACL acl where acl.principalType = ?" +
" and acl.principalId = ? and acl.aclTriState = ?";
return getHibernateTemplate().find(hql, new Object[]{ACL.TYPE_USER,userId,ACL.ACL_TRI_STATE_UNEXTENDS});
}
}
package com.bjsxt.oa.model;
import java.util.Set;
/**
*
* @author Administrator
* @hibernate.class table="T_Module"
*/
public class Module {
/**
* @hibernate.id generator-class="native"
*/
private int id;
/**
* @hibernate.property
*/
private String name;
/**
* @hibernate.property
*/
private String url;
/**
* @hibernate.property unique="true"
*/
private String sn;
/**
* @hibernate.property
*/
private int orderNo;
/**
* @hibernate.many-to-one column="pid"
*/
private Module parent;
/**
* @hibernate.set lazy="extra" inverse="true"
* @hibernate.key column="pid"
* @hibernate.one-to-many class="com.bjsxt.oa.model.Module"
*/
private Set children;
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
public String getUrl() {
return url;
}
public void setUrl(String url) {
this.url = url;
}
public String getSn() {
return sn;
}
public void setSn(String sn) {
this.sn = sn;
}
public int getOrderNo() {
return orderNo;
}
public void setOrderNo(int orderNo) {
this.orderNo = orderNo;
}
public Module getParent() {
return parent;
}
public void setParent(Module parent) {
this.parent = parent;
}
public Set getChildren() {
return children;
}
public void setChildren(Set children) {
this.children = children;
}
}
package com.bjsxt.oa.model;
/**
*
* @author Administrator
* @hibernate.class table="T_ACL"
*/
public class ACL {
public static final String TYPE_ROLE = "Role";
public static final String TYPE_USER = "User";
/**
* 表示本授权记录无效/即继承其角色的授权
*/
public static final int ACL_TRI_STATE_EXTENDS = 0xFFFFFFFF;
/**
* 表示本授权记录有效/即覆盖了其角色的授权定义
*/
public static final int ACL_TRI_STATE_UNEXTENDS = 0;
/**
* 授权允许
*/
public static final int ACL_YES = 1;
/**
* 授权不允许
*/
public static final int ACL_NO = 0;
/**
* 授权不确定
*/
public static final int ACL_NEUTRAL = -1;
/**
* @hibernate.id generator-class="native"
*/
private int id;
/**
* @hibernate.property
*/
private String principalType;
/**
* @hibernate.property
*/
private int principalId;
/**
* @hibernate.property
*/
private int moduleId;
/**
* @hibernate.property
*/
private int aclState;
/**
* @hibernate.property
*/
private int aclTriState;
public void setPermission(int permission,boolean yes){
int temp = 1;
temp = temp << permission;
if(yes){
aclState |= temp;
}else{
aclState &= ~temp;
}
}
public int getPermission(int permission){
if(aclTriState == ACL_TRI_STATE_EXTENDS){
return ACL.ACL_NEUTRAL;
}
int temp = 1;
temp = temp << permission;
temp = aclState & temp;
if(temp != 0){
return ACL_YES;
}
return ACL_NO;
}
public void setExtends(boolean yes){
if(yes){
aclTriState = ACL_TRI_STATE_EXTENDS;
}else{
aclTriState = ACL_TRI_STATE_UNEXTENDS;
}
}
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public String getPrincipalType() {
return principalType;
}
public void setPrincipalType(String principalType) {
this.principalType = principalType;
}
public int getPrincipalId() {
return principalId;
}
public void setPrincipalId(int principalId) {
this.principalId = principalId;
}
public int getModuleId() {
return moduleId;
}
public void setModuleId(int moduleId) {
this.moduleId = moduleId;
}
public int getAclState() {
return aclState;
}
public void setAclState(int aclState) {
this.aclState = aclState;
}
public int getAclTriState() {
return aclTriState;
}
public void setAclTriState(int aclTriState) {
this.aclTriState = aclTriState;
}
}
package com.bjsxt.oa.model;
/**
*
* @author Administrator
* @hibernate.class table="T_Role"
*/
public class Role {
/**
* @hibernate.id generator-class="native"
*/
private int id;
/**
* @hibernate.property
*/
private String name;
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}
package com.bjsxt.oa.model;
import java.util.Date;
/**
*
* @author Administrator
* @hibernate.class table="T_User"
*/
public class User {
/**
* @hibernate.id generator-class="native"
*/
private int id;
/**
* @hibernate.property not-null="true" unique="true"
*/
private String username;
/**
* @hibernate.property not-null="true"
*/
private String password;
/**
* @hibernate.property
*/
private Date expireTime;
/**
* @hibernate.property
*/
private Date createTime;
/**
* @hibernate.many-to-one unique="true"
*/
private Person person;
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public Date getExpireTime() {
return expireTime;
}
public void setExpireTime(Date expireTime) {
this.expireTime = expireTime;
}
public Date getCreateTime() {
return createTime;
}
public void setCreateTime(Date createTime) {
this.createTime = createTime;
}
public Person getPerson() {
return person;
}
public void setPerson(Person person) {
this.person = person;
}
}
package com.bjsxt.oa.model;
/**
*
* @author Administrator
* @hibernate.class table="T_UsersRoles"
*/
public class UsersRoles {
/**
* @hibernate.id generator-class="native"
*/
private int id;
/**
* @hibernate.many-to-one
*/
private Role role;
/**
* @hibernate.many-to-one
*/
private User user;
/**
* @hibernate.property
*/
private int orderNo;
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public Role getRole() {
return role;
}
public void setRole(Role role) {
this.role = role;
}
public User getUser() {
return user;
}
public void setUser(User user) {
this.user = user;
}
public int getOrderNo() {
return orderNo;
}
public void setOrderNo(int orderNo) {
this.orderNo = orderNo;
}
}