/**
 * 接口權(quán)限枚舉定義類
 */
public enum AuthPermission {
    /**
     * 四級(jí)權(quán)限樹
     * 1 模塊
     * - 2 功能
     * - - 3 接口集（一般是Controller）
     * - - - 4 具體接口（@RequestMapping）
     *
     */

    // 用戶管理
    User("user", "用戶", Type.Module),

    SysUser(User, "系統(tǒng)用戶", Type.Unit),
    SysUserManager(SysUser, "系統(tǒng)用戶管理", Type.Bunch),
    SysUserManagerSelect(SysUserManager, "系統(tǒng)用戶查詢", Type.Function),
    SysUserManagerAdd(SysUserManager, "系統(tǒng)用戶新增", Type.Function),
    SysUserManagerUpdate(SysUserManager, "系統(tǒng)用戶修改", Type.Function),
    SysUserManagerDelete(SysUserManager, "系統(tǒng)用戶刪除", Type.Function),

    NormalUser(User, "普通用戶", Type.Unit),
    NormalUserManager(NormalUser, "普通用戶管理", Type.Bunch),
    NormalUserManagerSelect(NormalUserManager, "普通用戶查詢", Type.Function),
    NormalUserManagerAdd(NormalUserManager, "普通用戶新增", Type.Function),
    NormalUserManagerUpdate(NormalUserManager, "普通用戶修改", Type.Function),
    NormalUserManagerDelete(NormalUserManager, "普通用戶刪除", Type.Function),

    // 訂單管理
    Order("order", "訂單", Type.Module),

    OrderConfirm(Order, "下單管理", Type.Unit),
    OrderConfirmKill(OrderConfirm, "秒殺下單管理", Type.Bunch),
    OrderConfirmKillAdd(OrderConfirmKill, "秒殺訂單新增", Type.Function),
    OrderConfirmKillDelete(OrderConfirmKill, "秒殺訂單刪除", Type.Function),

    OrderConfirmNormal(OrderConfirm, "普通下單管理", Type.Bunch),
    OrderConfirmNormalAdd(OrderConfirmNormal, "普通訂單新增", Type.Function),
    OrderConfirmNormalDelete(OrderConfirmNormal, "普通訂單刪除", Type.Function),

    // ...其他
    ;


    /**
     * 功能權(quán)限類型
     */
    public enum Type {
        Module, // 功能模塊
        Unit, // 功能單元
        Bunch, // 功能接口集
        Function, // 功能接口
    }

    // 模塊
    private final String module;
    // 名稱
    private final String title;
    // 父
    private final AuthPermission parent;
    // 類型
    private final Type type;

    AuthPermission(AuthPermission parent, String title, Type type) {
        this(parent.module, parent, title, type);
    }

    AuthPermission(String title, String module, Type type) {
        this(module, null, title, type);
    }

    AuthPermission(String module, AuthPermission parent, String title, Type type) {
        this.module = module;
        this.title = title;
        this.parent = parent;
        this.type = type;
    }

    public String getModule() {
        return module;
    }

    public String getTitle() {
        return title;
    }

    public AuthPermission getParent() {
        return parent;
    }

    public Type getType() {
        return type;
    }
}

import org.springframework.util.CollectionUtils;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

/**
 * 接口權(quán)限管理類
 */
public class AuthPermissionManagement {

    private static List<AuthArchetype> permissionTree = new ArrayList<>();

    private static Map<AuthPermission, AuthArchetype> permissionMap = new HashMap<>();

    static {
        // 遞歸設(shè)置樹
        // 設(shè)置子樹
        recursePermissions(permissionTree, permissionMap, null);
    }

    public static void main(String[] args) {
    	// 獲取權(quán)限樹（到時(shí)候給前端展示樹）
        System.out.println(Json.toJson(getPermissionTree()));

		// 校驗(yàn)權(quán)限
        System.out.println(checkPermission(AuthPermission.NormalUserManagerDelete, AuthPermission.NormalUser));
        System.out.println(checkPermission(AuthPermission.NormalUserManagerDelete, AuthPermission.OrderConfirm));
        System.out.println(checkPermission(AuthPermission.NormalUserManagerDelete, AuthPermission.NormalUserManagerDelete));

    }

    /**
     * 校驗(yàn)權(quán)限 遞歸
     * @param userPermission 用戶角色權(quán)限
     * @param interfacePermission 接口權(quán)限
     * @return
     */
    public static boolean checkPermission(AuthPermission userPermission, AuthPermission interfacePermission) {
        if (userPermission == interfacePermission) {
            return true;
        }
        // 有子接口權(quán)限也可
        AuthArchetype authArchetype = permissionMap.get(interfacePermission);
        if (authArchetype == null) {
            return false;
        }
        return checkChildrenPermission(userPermission, authArchetype);
    }

    private static boolean checkChildrenPermission(AuthPermission userPermission, AuthArchetype authArchetype) {
        if (authArchetype.getName().equals(userPermission.name())) {
            return true;
        }
        if (!CollectionUtils.isEmpty(authArchetype.getSubPermissions())) {
            for (AuthArchetype subPermission : authArchetype.getSubPermissions()) {
                if (subPermission.getName().equals(userPermission.name())) {
                    return true;
                }
                // 遞歸
                if (checkChildrenPermission(userPermission, subPermission)) {
                    return true;
                }
            }
        }
        return false;
    }

    // 獲取權(quán)限樹
    public static List<AuthArchetype> getPermissionTree() {
        return permissionTree;
    }

    private static void recursePermissions(List<AuthArchetype> permissionTree, Map<AuthPermission, AuthArchetype> permissionMap, AuthPermission current) {
        for (AuthPermission permission : AuthPermission.values()) {
            if (permission.getParent() == current) {
                AuthArchetype permissionArchetype = new AuthArchetype(permission);
                if (current == null) {
                    permissionTree.add(permissionArchetype);
                } else {
                    permissionMap.get(current).addSubPermission(permissionArchetype);
                }
                permissionMap.put(permission, permissionArchetype);
                recursePermissions(permissionTree, permissionMap, permission);

            }

        }
    }


    public static class AuthArchetype {
        // name
        private String name;
        // 模塊
        private String module;
        // 名稱
        private String title;
        // 父
        private AuthPermission parent;
        // 類型
        private AuthPermission.Type type;
        // 子
        private List<AuthArchetype> subPermissions;

        public AuthArchetype(AuthPermission permission) {
            this.name = permission.name();
            this.module = permission.getModule();
            this.title = permission.getTitle();
            this.parent = permission.getParent();
            this.type = permission.getType();
        }

        public void addSubPermission(AuthArchetype subPermission) {
            if (this.subPermissions == null) {
                this.subPermissions = new ArrayList<>();
            }
            this.subPermissions.add(subPermission);
        }

        public String getName() {
            return name;
        }

        public void setName(String name) {
            this.name = name;
        }

        public String getModule() {
            return module;
        }

        public void setModule(String module) {
            this.module = module;
        }

        public String getTitle() {
            return title;
        }

        public void setTitle(String title) {
            this.title = title;
        }

        public AuthPermission getParent() {
            return parent;
        }

        public void setParent(AuthPermission parent) {
            this.parent = parent;
        }

        public AuthPermission.Type getType() {
            return type;
        }

        public void setType(AuthPermission.Type type) {
            this.type = type;
        }

        public List<AuthArchetype> getSubPermissions() {
            return subPermissions;
        }

        public void setSubPermissions(List<AuthArchetype> subPermissions) {
            this.subPermissions = subPermissions;
        }
    }
}

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface Auth {

    AuthPermission[] value() default {};
}

import org.apache.commons.lang3.ArrayUtils;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.stereotype.Component;

import java.lang.reflect.Method;

@Aspect
@Component
public class AuthAdvice {

    /**
     * 我們希望的是如果方法上有注解，則對(duì)方法進(jìn)行限制，若方法上無注解，單是類上有注解，那么類上的權(quán)限注解對(duì)該類下所有的接口生效。
     */
    @Around("@annotation(com.qstcloud.athena.opencourse.auth.Auth) || @within(com.qstcloud.athena.opencourse.auth.Auth)")
    public Object preAuth(ProceedingJoinPoint point) throws Throwable {
        if (handleAuth(point)) {
            return point.proceed();
        }
        throw new RuntimeException("權(quán)限不足，請(qǐng)求被拒絕");
    }

    /**
     * 邏輯判斷，返回true or false
     * true ：權(quán)限校驗(yàn)通過
     * false ：權(quán)限校驗(yàn)不通過
     */
    private boolean handleAuth(ProceedingJoinPoint point) {
        MethodSignature ms = point.getSignature() instanceof MethodSignature ? (MethodSignature) point.getSignature() : null;
        Method method = ms.getMethod();
        // 讀取權(quán)限注解，優(yōu)先方法上，沒有則讀取類
        Auth Annotation = getAnnotation(method, Auth.class);


        // 判斷權(quán)限
        AuthPermission[] authPermissions = Annotation.value();
        if (ArrayUtils.isEmpty(authPermissions)) {
            // 沒有權(quán)限樹，登錄就可以訪問
            return checkLogin();
        }
        // 校驗(yàn)當(dāng)前登錄用戶，是否包含其中權(quán)限之一
        return checkHasPermission(authPermissions);

    }

    /**
     * 校驗(yàn)當(dāng)前登錄用戶，是否包含其中權(quán)限之一
     */
    private boolean checkHasPermission(AuthPermission[] authPermissions) {
//        User user = UserUtil.getCurrentUser();
//        Role role = user.getRole(); // 獲取角色

        // TODO 判斷角色中的權(quán)限，是否包含接口的權(quán)限
        return ArrayUtils.contains(authPermissions, AuthPermission.NormalUserManagerUpdate);
    }

    /**
     * 判斷是否登錄
     */
    private boolean checkLogin() {
        // TODO 從redis或者session中判斷是否登錄
        return true;
    }

    /**
     * 讀取權(quán)限注解，優(yōu)先方法上，沒有則讀取類
     */
    private Auth getAnnotation(Method method, Class<Auth> authClass) {
        Auth annotation = method.getAnnotation(authClass);
        if (annotation != null) {
            return annotation;
        }

        annotation = method.getDeclaringClass().getAnnotation(authClass);
        return annotation;
    }
}

@RestController
@RequestMapping("/test")
@Auth
public class TestController {


    @GetMapping("/test1")
    public String test1() {
        return "success";
    }

    @GetMapping("/test2")
    @Auth(AuthPermission.NormalUserManagerDelete)
    public String test2() {
        return "success";
    }

    @GetMapping("/test3")
    @Auth(AuthPermission.NormalUserManagerUpdate)
    public String test3() {
        return "success";
    }
}