// *) 判断是否拥有该角色
boolean hasRole(String role);
// *) 判断是否拥有该权限
boolean hasPermission(String permission); 

@MyEvaluateExpression(expr="hasRole('developer') || hasPermission('blog:write')")

@MyEvaluateExpression(expr="!hasRole('developer') && hasPermission('blog:write')")

public class MyShiroGroovyHelper {private static ConcurrentHashMap<String, Class<Script>> zlassMaps= new ConcurrentHashMap<String, Class<Script>>();// *) 具体执行groovy代码public static Object invoke(String scriptText, Map<String, Object> params) {String key = fingerKey(scriptText);Class<Script> script = zlassMaps.get(key);if ( script == null ) {synchronized (key.intern()) {// Double Checkscript = zlassMaps.get(key);if ( script == null ) {GroovyClassLoader classLoader = new GroovyClassLoader();script = classLoader.parseClass(scriptText);zlassMaps.put(key, script);}}}Binding binding = new Binding();for ( Map.Entry<String, Object> ent : params.entrySet() ) {binding.setVariable(ent.getKey(), ent.getValue());}Script scriptObj = InvokerHelper.createScript(script, binding);return scriptObj.run();}// *) 为脚本代码生成md5指纹private static String fingerKey(String scriptText) {try {MessageDigest md = MessageDigest.getInstance("MD5");byte[] bytes = md.digest(scriptText.getBytes("utf-8"));final char[] HEX_DIGITS = "0123456789ABCDEF".toCharArray();StringBuilder ret = new StringBuilder(bytes.length * 2);for (int i=0; i<bytes.length; i++) {ret.append(HEX_DIGITS[(bytes[i] >> 4) & 0x0f]);ret.append(HEX_DIGITS[bytes[i] & 0x0f]);}return ret.toString();} catch (Exception e) {throw new RuntimeException(e);}}}

@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface MyEvaluateExpression {String expr();
}

public class MyShiroHelper {private static final String MY_SHIRO_AUTHRIZE_KEY = "my_shiro_authorize_key";// *) 评估复杂表达式public static boolean validateExpression(String expr) throws Exception {if ( expr == null ) {throw new Exception("invalid expression");}try {HttpSession session = getSession();MyAuthorizeInfo authorizeInfo = (MyAuthorizeInfo)session.getAttribute(MY_SHIRO_AUTHRIZE_KEY);if ( authorizeInfo == null ) {return false;}String scriptText = expr.replaceAll("hasRole", "roleSet.contains");scriptText = scriptText.replaceAll("hasPermission", "permissionSet.contains");Map<String, Object> params = new TreeMap<String, Object>();params.put("roleSet", authorizeInfo.getRoles());params.put("permissionSet", authorizeInfo.getPermissions());return (Boolean) MyShiroGroovyHelper.invoke(scriptText, params);} catch (Exception e) {throw new Exception("permission invalid state");} finally {}}private static HttpSession getSession() {HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();return request.getSession();}}

@Aspect
@Component
public class MyShiroAdvice {/*** 定义切点*/@Pointcut("@annotation(com.springapp.mvc.myshiro.MyEvaluateExpression)")public void checkExprs() {}@Before("checkExprs()")public void doCheckExprs(JoinPoint jp) throws Exception {// *) 获取对应的注解MyEvaluateExpression mrp = extractAnnotation((MethodInvocationProceedingJoinPoint)jp,MyEvaluateExpression.class);boolean res = true;try {res = MyShiroHelper.validateExpression(mrp.expr());} catch (Exception e) {throw new Exception("invalid state");}if ( !res ) {throw new Exception("access disallowed");}}// *) 获取注解信息private static <T extends Annotation> T extractAnnotation(MethodInvocationProceedingJoinPoint mp, Class<T> clazz) throws Exception {Field proxy = mp.getClass().getDeclaredField("methodInvocation");proxy.setAccessible(true);ReflectiveMethodInvocation rmi = (ReflectiveMethodInvocation) proxy.get(mp);Method method = rmi.getMethod();return (T) method.getAnnotation(clazz);}}

@RestController
@RequestMapping("/")
public class HelloController {@RequestMapping(value="/login", method={RequestMethod.POST, RequestMethod.GET})public String login() {// 1) 完成登陆验证// TODO// 2) 查询权限信息// TODO// 3) 注册权限信息MyAuthorizeInfo authorizeInfo = new MyAuthorizeInfo();authorizeInfo.addRole("admin");authorizeInfo.addPermission("blog:write");authorizeInfo.addPermission("blog:read");// *) 授权MyShiroHelper.authorize(authorizeInfo);return "ok";}@RequestMapping(value="/test3", method={RequestMethod.GET, RequestMethod.POST})@MyEvaluateExpression(expr="hasRole('admin') && !hasPermission('blog:write')")public String test3() {return "test3";}}