public class PermissionConstants {/*** 管理员-产品列表查询*/public static final String ADMIN_PRODUCT_LIST = "admin_product_list";/*** 管理员-产品详情*/public static final String ADMIN_PRODUCT_DETAIL = "admin_product_detail";}

@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
@Documented
public @interface RequiredPermission {String value();
}

public class SecurityInterceptor implements HandlerInterceptor {@Autowiredprivate AdminUserService adminUserService;@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {// 验证权限if (this.hasPermission(handler)) {return true;}//  null == request.getHeader("x-requested-with") TODO 暂时用这个来判断是否为ajax请求// 如果没有权限 则抛403异常 springboot会处理，跳转到 /error/403 页面response.sendError(HttpStatus.FORBIDDEN.value(), "无权限");return false;}/*** 是否有权限** @param handler* @return*/private boolean hasPermission(Object handler) {if (handler instanceof HandlerMethod) {HandlerMethod handlerMethod = (HandlerMethod) handler;// 获取方法上的注解RequiredPermission requiredPermission = handlerMethod.getMethod().getAnnotation(RequiredPermission.class);// 如果方法上的注解为空 则获取类的注解if (requiredPermission == null) {requiredPermission = handlerMethod.getMethod().getDeclaringClass().getAnnotation(RequiredPermission.class);}// 如果标记了注解，则判断权限if (requiredPermission != null && StringUtils.isNotBlank(requiredPermission.value())) {// redis或数据库 中获取该用户的权限信息 并判断是否有权限Set<String> permissionSet = adminUserService.getPermissionSet();if (CollectionUtils.isEmpty(permissionSet) ){return false;}return permissionSet.contains(requiredPermission.value());}}return true;}@Overridepublic void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {// TODO
    }@Overridepublic void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {// TODO
    }
}

@Configuration
public class MVCConfig extends WebMvcConfigurerAdapter {@Beanpublic SecurityInterceptor securityInterceptor() {return new SecurityInterceptor();}@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(securityInterceptor()).excludePathPatterns("/static/*").excludePathPatterns("/error").addPathPatterns("/**");}}

@Controller
@RequestMapping("/product")
// @PermissionConstants.ADMIN_PRODUCT_MANAGEMENT
public class ProductController {/*** 产品列表** @return*/@RequestMapping("/list")@RequiredPermission(PermissionConstants.ADMIN_PRODUCT_LIST) // 权限注解public String list() {// 省略产品列表查询逻辑return "/product/list";}/*** 产品详情** @return*/@RequestMapping("/detail")@RequiredPermission(PermissionConstants.ADMIN_PRODUCT_DETAIL) // 权限注解public String detail() {// 省略查询产品详情的逻辑return "/product/edit";}/*** 删除产品** @return*/@RequestMapping("/delete")public String delete() {// 省略删除产品的逻辑return "/product/list";}}