基于角色的spring boot用户创建

Question

我有三个实体用户，机构和角色。1）用户和机构之间的一对多2）用户和角色之间的多对多

-------用户--------

@Entity
@Table(name = "user")
public class User {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name="user_Id")
    private int userId;
    @Column(name="name")
    private String name;
    @Column(name="lastname")
    private String lastname;
    @Column(name="email")
    private String email;
    @Column(name="password")
    private String password;
    @Column(name="isActive")
    private boolean isActive;
    @Column(name="lastActive")
    private String lastActive;
    @Column(name="createdDate")
    private String createdDate;
    @Column(name="isBlocked")
    private boolean isBlocked;
    
    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    @JoinColumn(name = "institution_id", nullable = false)
    @JsonIgnoreProperties(value = {"user"})
    private Institution institution;
    
    @ManyToMany(fetch = FetchType.LAZY)
    @JoinTable(name = "user_has_role",
            joinColumns = {
                    @JoinColumn(name = "user_id", referencedColumnName = "user_id",
                            nullable = false, updatable = true)},
            inverseJoinColumns = {
                    @JoinColumn(name = "role_id", referencedColumnName = "role_id",
                            nullable = false, updatable = true)})
    @JsonIgnoreProperties(value = {"users"})
    private Set<Role> roles = new HashSet<>();

}

-------机构-------

@Getter
@Setter
@NoArgsConstructor
@AllArgsConstructor
@ToString

@Entity
@Table(name = "institution")
public class Institution {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name="institution_Id")
    private int institutionId;
    @Column(name="name")
    private String name;
    @Column(name="type")
    private String type;
    @Column(name="location")
    private String location;
    @OneToMany(mappedBy = "institution", fetch = FetchType.LAZY)
    @JsonIgnoreProperties(value = {"institution" , "user"})
    private Set<User> user;
    }

-------角色-------

@Getter
@Setter
@NoArgsConstructor
@AllArgsConstructor
@ToString

@Entity
@Table(name = "role")
public class Role {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    @Column(name="role_Id")
    private int roleId;
    @Column(name="name")
    private String name;
    @Column(name="description")
    private String description;
    @ManyToMany(mappedBy = "roles", fetch = FetchType.LAZY)
    @JsonIgnoreProperties(value = {"roles"})
    private Set<User> users = new HashSet<>();

}

这是我在MySql中的3个实体和表我有7个角色•超级用户•银行管理•银行支持•银行服务•商户管理•商户支持•商户服务

超级用户可以创建任意角色的用户

@PostMapping("/addUser")
    public String addUser(@RequestBody User user) {
        String rawpassword = user.getPassword();
        String encodedpasswrod = passwordencoder.encode(rawpassword);
        user.setPassword(encodedpasswrod);
        userrepository.save(user);
        return "user saved with name: " + user.getName();
    }

这个api可以工作，我可以将角色设置为api json主体中的任何内容

但是希望如果用户是Bank-Admin，他只能创建Bank-Support和Bank-Service，我试图创建一个新的API，它只能创建一个具有这两个特定角色的用户。然后限制bank admin访问其他可以创建任何类型用户的API。

有没有其他的方法，如果没有，我该怎么做。。。

Answer 1

您必须实现用户权限的自定义实现。

就像根据login person一样，您将获得那个login person角色，并且根据您的标准，只需进行验证，比如检查他试图添加的实体是否有资格创建它。

Map<String, List<String>> roleUserAccessMap = new HashMap<>();
roleUserAccessMap.put("Bank-Admin", Arrays.asList("Bank-Support", "Bank-Service"));

就像下面那样检查一下

        String loginPersonRole="Bank-Admin"; //This value should get from logged-in person context
        if(roleUserAccessMap.containsKey(loginPersonRole)){
            //proceed ahead with Add api
        }else{
            System.out.println("You do not have enough privileage to create Use");
        }

这会帮到你的。