Spring AOP切入点与接口上的注释匹配

问题描述:

我有一个在Java 6 / Spring 3中实现的服务类,它需要一个注释来限制按角色访问。

I have a service class implemented in Java 6 / Spring 3 that needs an annotation to restrict access by role.

我已经定义了一个名为RequiredPermission的注释,其中包含as它的value属性来自枚举的一个或多个值,名为OperationType:

I have defined an annotation called RequiredPermission that has as its value attribute one or more values from an enum called OperationType:

public @interface RequiredPermission {

/**
 * One or more {@link OperationType}s that map to the permissions required
 * to execute this method.
 * 
 * @return
 */
OperationType[] value();}

public enum OperationType {
      TYPE1,
      TYPE2;
}

package com.mycompany.myservice;
public interface MyService{
   @RequiredPermission(OperationType.TYPE1)
   void myMethod( MyParameterObject obj );
}

package com.mycompany.myserviceimpl;
public class MyServiceImpl implements MyService{
   public myMethod( MyParameterObject obj ){
       // do stuff here
   }
}

我还有以下方面定义:

/**
 * Security advice around methods that are annotated with
 * {@link RequiredPermission}.
 * 
 * @param pjp
 * @param param
 * @param requiredPermission
 * @return
 * @throws Throwable
 */
@Around(value = "execution(public *"
        + " com.mycompany.myserviceimpl.*(..))"
        + " && args(param)" + // parameter object
        " && @annotation( requiredPermission )" // permission annotation

, argNames = "param,requiredPermission")
public Object processRequest(final ProceedingJoinPoint pjp,
        final MyParameterObject param,
        final RequiredPermission requiredPermission) throws Throwable {
    if(userService.userHasRoles(param.getUsername(),requiredPermission.values()){
        return pjp.proceed();
    }else{
        throw new SorryButYouAreNotAllowedToDoThatException(
            param.getUsername(),requiredPermission.value());
    }
}

参数对象包含用户名,我想看看你在允许访问方法之前,用户所需的角色。

The parameter object contains a user name and I want to look up the required role for the user before allowing access to the method.

当我在MyServiceImpl中的方法上放置注释时,一切正常,切入点匹配并且方面的开头。但是,我认为注释是服务合同的一部分,应该在单独的API包中与接口一起发布。很明显,我不想将注释放在服务定义和实现(DRY)上。

When I put the annotation on the method in MyServiceImpl, everything works just fine, the pointcut is matched and the aspect kicks in. However, I believe the annotation is part of the service contract and should be published with the interface in a separate API package. And obviously, I would not like to put the annotation on both service definition and implementation (DRY).

我知道Spring AOP中存在哪些方面是由注释触发的一种接口方法(例如Transactional)。这里是否有特殊的语法,或者只是开箱即用。

I know there are cases in Spring AOP where aspects are triggered by annotations one interface methods (e.g. Transactional). Is there a special syntax here or is it just plain impossible out of the box.

PS:我没有发布我的弹簧配置,因为它似乎工作得很好。不,那些既不是我的原始类也不是方法名。

PS: I have not posted my spring config, as it seems to be working just fine. And no, those are neither my original class nor method names.

PPS:实际上,这是我的spring配置的相关部分:

PPS: Actually, here is the relevant part of my spring config:

<aop:aspectj-autoproxy proxy-target-class="false" />

<bean class="com.mycompany.aspect.MyAspect">
    <property name="userService" ref="userService" />
</bean>


如果我理解你的错误,你需要一个切入点查找扩展MyService的类中的所有方法,并使用首选参数进行注释。

If I understand you correct, you want a pointcut that finds all methods in classes that extends MyService and is annotated and with the preferred arguments.

我建议您替换:

execution(public * com.mycompany.myserviceimpl.*(..))

with:

execution(public * com.mycompany.myservice.MyService+.*(..))

如果希望连接点与MyService类或扩展的类匹配,则使用加号它。

The plus sign is used if you want a joinpoint to match the MyService class or a class that extends it.

我希望它有所帮助!