@Documented
@Target({ElementType.METHOD})  // 用在方法上
@Retention(RetentionPolicy.RUNTIME)  //注解保留到運行時
public @interface RoleType {
    String[] value() default {};
}

public class UserContext {
    private static final ThreadLocal<List<String>> role = new ThreadLocal<>();
    private static final ThreadLocal<String> username = new ThreadLocal<>();
    private static final ThreadLocal<Boolean> loginStatus = new ThreadLocal<>();
    public static boolean loginStatus() {
        return loginStatus.get();
    }
    public static void login() {
        UserContext.loginStatus.set(true);
    }
    public static void logout() {
        UserContext.loginStatus.set(false);
    }
    public static String getUsername() {
        return username.get();
    }
    public static void setUsername(String username) {
        UserContext.username.set(username);
    }
    public static void clearUsername() {
        username.remove();
    }
    public static List<String> getRole() {
        return role.get();
    }
    public static void setRole(List<String> role) {
        UserContext.role.set(role);
    }
    public static void setRole(String role) {
        UserContext.role.set(List.of(role));
    }
    public static void clearRole() {
        role.remove();
    }
}

@Component
public class AuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain ) throws ServletException, IOException {
        //將用戶信息寫入上下文，可以從session或redis或者從關(guān)系型數(shù)據(jù)庫獲取用戶信息及角色信息
        UserContext.setUsername(username);
        UserContext.setRole(roles);
        UserContext.login();
        filterChain.doFilter(request,response);
    }
}

@Aspect
@Component
public class AuthAspect extends HttpServlet {
    @Pointcut("@annotation(RoleType)")
    public void annotatedMethod() {
    }
    //注解存在時，需要在登陸情況下v愛可以訪問接口
    @Around("annotatedMethod()")
    public Object aroundAnnotatedMethod(ProceedingJoinPoint joinPoint) throws Throwable {
        //訪問接口時需要的權(quán)限標識集合
        List<String> apiRole = Arrays.asList(AnnotationUtils.findAnnotation(((MethodSignature) joinPoint.getSignature()).getMethod(), RoleType.class).value());
        //用戶擁有的權(quán)限標識集合
        List<String> userRole = UserContext.getRole();
        //注解存在，并且登陸情況下可以訪問接口
        if (UserContext.loginStatus()){
            //如果任意接口標識中元素在用戶權(quán)限標識中存在，則有權(quán)訪問該接口
            if (apiRole.isEmpty() || apiRole.stream().anyMatch(userRole::contains)) {
                return joinPoint.proceed();
            } else {
                throw new MallException(403, "無權(quán)限訪問！");
            }
        }else {
            throw new MallException(500,"請先登陸再訪問！");
        }
    }
    //程序運行結(jié)束后清楚上下文
    @After("annotatedMethod()")
    public void afterAnnotatedMethod(JoinPoint joinPoint) {
        UserContext.clearRole();
        UserContext.clearUsername();
        UserContext.clearRole();
    }
}

    @RoleType
    public String test(){
        return UserContext.getRole();
    }

    @RoleType("role")
    public String test(){
        return UserContext.getRole();
    }

    @RoleType({"role","test"，...})
    public String test(){
        return UserContext.getRole();
    }