// *) 逻辑与或
public enum MyLogic {AND,OR;
}// *) 定义权限校验注解
@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface MyRequiresPermissions {String[] value();MyLogic logic() default MyLogic.AND;
}// *) 定义角色校验注解
@Target({ElementType.TYPE, ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface MyRequiresRoles {String[] value();MyLogic logic() default MyLogic.AND;
}

@Getter
public class MyAuthorizeInfo {private Set<String> roles = new TreeSet<String>();private Set<String> permissions = new TreeSet<String>();public void addRole(String role) {roles.add(role);}public void addPermission(String permission) {permissions.add(permission);}}public class MyShiroHelper {private static final String MY_SHIRO_AUTHRIZE_KEY = "my_shiro_authorize_key";// 授权权限列表public static void authorize(MyAuthorizeInfo authorizeInfo) {HttpSession session = getSession();session.setAttribute(MY_SHIRO_AUTHRIZE_KEY, authorizeInfo);}// 验证角色public static boolean validateRoles(String[] roles, MyLogic logic) throws Exception {if ( roles == null || roles.length == 0 ) {return true;}try {HttpSession session = getSession();MyAuthorizeInfo authorizeInfo = (MyAuthorizeInfo)session.getAttribute(MY_SHIRO_AUTHRIZE_KEY);if ( authorizeInfo == null ) {return false;}return evaluateExpression(roles, logic, authorizeInfo.getRoles());} catch (Exception e) {throw new Exception("permission invalid state");} finally {}}// 验证权限public static boolean validatePermssion(String[] permissions, MyLogic logic) throws Exception {if ( permissions == null || permissions.length == 0 ) {return true;}try {HttpSession session = getSession();MyAuthorizeInfo authorizeInfo = (MyAuthorizeInfo)session.getAttribute(MY_SHIRO_AUTHRIZE_KEY);if ( authorizeInfo == null ) {return false;}return evaluateExpression(permissions, logic, authorizeInfo.getPermissions());} catch (Exception e) {throw new Exception("permission invalid state");} finally {}}// *) 与或操作, 布尔表达式的计算public static boolean evaluateExpression(String[] values, MyLogic logic, Set<String> sets) {if ( MyLogic.AND == logic ) {for ( String val : values ) {if ( !sets.contains(val) ) {return false;}}return true;} else if ( MyLogic.OR == logic ) {for ( String val : values ) {if ( sets.contains(val) ) {return true;}}return false;}return true;}// *) 获取Http Sessionprivate static HttpSession getSession() {HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();return request.getSession();}}

@Aspect
@Component
public class MyShiroAdvice {/*** 定义切点, 用于权限的校验*/@Pointcut("@annotation(com.springapp.mvc.myshiro.MyRequiresPermissions)")public void checkPermissions() {}/*** 定义切点, 用于角色的校验*/@Pointcut("@annotation(com.springapp.mvc.myshiro.MyRequiresRoles)")public void checkRoles() {}@Before("checkPermissions()")public void doCheckPermission(JoinPoint jp) throws Exception {// *) 获取对应的注解MyRequiresPermissions mrp = extractAnnotation((MethodInvocationProceedingJoinPoint)jp,MyRequiresPermissions.class);try {if ( !MyShiroHelper.validatePermssion(mrp.value(), mrp.logic()) ) {throw new Exception("access disallowed");}} catch (Exception e) {throw new Exception("invalid state");}}@Before("checkRoles()")public void doCheckRole(JoinPoint jp) throws Exception {// *) 获取对应的注解MyRequiresRoles mrp = extractAnnotation((MethodInvocationProceedingJoinPoint)jp,MyRequiresRoles.class);try {if ( !MyShiroHelper.validateRoles(mrp.value(), mrp.logic()) ) {throw new Exception("access disallowed");}} catch (Exception e) {throw new Exception("invalid state");}}// *) 获取注解信息private static <T extends Annotation> T extractAnnotation(MethodInvocationProceedingJoinPoint mp, Class<T> clazz) throws Exception {Field proxy = mp.getClass().getDeclaredField("methodInvocation");proxy.setAccessible(true);ReflectiveMethodInvocation rmi = (ReflectiveMethodInvocation) proxy.get(mp);Method method = rmi.getMethod();return (T) method.getAnnotation(clazz);}}

<aop:aspectj-autoproxy proxy-target-class="true"/>
<context:component-scan base-package="com.xxx.myshiro"/> <!-- 切面类所在的package -->

@Controller
@RequestMapping("/")
public class HelloController {@RequestMapping(value="/login", method={RequestMethod.POST, RequestMethod.GET})@ResponseBodypublic String login() {// 1) 完成登陆验证// TODO// 2) 查询权限信息// TODO// 3) 注册权限信息MyAuthorizeInfo authorizeInfo = new MyAuthorizeInfo();authorizeInfo.addRole("admin");authorizeInfo.addPermission("blog:write");authorizeInfo.addPermission("blog:read");// *) 授权赋予MyShiroHelper.authorize(authorizeInfo);return "ok";}@RequestMapping(value = "/test1", method = {RequestMethod.GET, RequestMethod.POST})@ResponseBody@MyRequiresPermissions(value={"blog:write", "blog:update"}, logic=MyLogic.AND)public String test1() {return "test1";}@RequestMapping(value = "/test2", method = {RequestMethod.GET, RequestMethod.POST})@ResponseBody@MyRequiresPermissions(value={"blog:write", "blog:update"}, logic=MyLogic.OR)public String test2() {return "test2";}}