+ * This method will use return value to represent whether user has the specific + * privileges to the target, but to throw a RuntimeException to represent no auth + * is also a good way. + *
+ * + * @param target the target to check + * @param privilegeType the privilege type to check + * @return if current user has the specific privileges to the target, return true, + * otherwise return false. + */ + boolean authTarget(String target, PrivilegeType privilegeType); + + /** + * Check whether current user is a super-user. + * + * @return if current user is super user return true, else return false. + */ + boolean isSuperUser(); + + /** + * Get current user's nick name. + * + * @return current user's nick name. + */ + String getNickName(); + + /** + * Get current user's login name. + * + * @return current user's login name. + */ + String getLoginName(); + + /** + * Get current user's ID. + * + * @return ID of current user + */ + String getId(); + } +} diff --git a/ruoyi-modules/ruoyi-sentinel/src/main/java/com/alibaba/csp/sentinel/dashboard/auth/AuthorizationInterceptor.java b/ruoyi-modules/ruoyi-sentinel/src/main/java/com/alibaba/csp/sentinel/dashboard/auth/AuthorizationInterceptor.java new file mode 100644 index 00000000..19472521 --- /dev/null +++ b/ruoyi-modules/ruoyi-sentinel/src/main/java/com/alibaba/csp/sentinel/dashboard/auth/AuthorizationInterceptor.java @@ -0,0 +1,72 @@ +/* + * Copyright 1999-2018 Alibaba Group Holding Ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.alibaba.csp.sentinel.dashboard.auth; + +import com.alibaba.csp.sentinel.dashboard.domain.Result; +import com.alibaba.fastjson.JSON; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.stereotype.Component; +import org.springframework.web.method.HandlerMethod; +import org.springframework.web.servlet.HandlerInterceptor; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import java.lang.reflect.Method; + +/** + * The web interceptor for privilege-based authorization. + * + * @author lkxiaolou + * @since 1.7.1 + */ +@Component +public class AuthorizationInterceptor implements HandlerInterceptor { + + @Autowired + private AuthServiceThe Servlet filter for authentication.
+ * + *Note: some urls are excluded as they needn't auth, such as:
+ *Dashboard local config support.
+ *
+ * Dashboard supports configuration loading by several ways by order:
+ * 1. System.properties
+ * 2. Env
+ *