import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    // 配置內(nèi)容
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@Configuration
@EnableMethodSecurity(prePostEnabled = true) // 啟用@PreAuthorize支持
public class SecurityConfig {
    // 密碼編碼器
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    // 配置用戶信息（示例使用內(nèi)存用戶）
    @Bean
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager(
            User.withUsername("admin")
                .password(passwordEncoder().encode("admin123"))
                .roles("ADMIN")
                .build(),
            User.withUsername("user")
                .password(passwordEncoder().encode("user123"))
                .roles("USER")
                .build(),
            User.withUsername("editor")
                .password(passwordEncoder().encode("editor123"))
                .roles("EDITOR")
                .build()
        );
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class ApiController {
    // 公開(kāi)接口，所有人可訪問(wèn)
    @GetMapping("/public")
    @PreAuthorize("permitAll()")
    public String publicResource() {
        return "This is a public resource";
    }
    // 需認(rèn)證后訪問(wèn)
    @GetMapping("/protected")
    @PreAuthorize("isAuthenticated()")
    public String protectedResource() {
        return "This is a protected resource";
    }
    // 僅管理員可訪問(wèn)
    @GetMapping("/admin")
    @PreAuthorize("hasRole('ADMIN')")
    public String adminResource() {
        return "This is an admin resource";
    }
    // 管理員或編輯可訪問(wèn)
    @GetMapping("/editor")
    @PreAuthorize("hasAnyRole('ADMIN', 'EDITOR')")
    public String editorResource() {
        return "This is an editor resource";
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;
@Service
public class DocumentService {
    // 需要文檔創(chuàng)建權(quán)限
    @PreAuthorize("hasAuthority('DOCUMENT_CREATE')")
    public String createDocument(String content) {
        // 業(yè)務(wù)邏輯：創(chuàng)建文檔
        return "Document created with content: " + content;
    }
    // 需要文檔刪除權(quán)限或管理員角色
    @PreAuthorize("hasAuthority('DOCUMENT_DELETE') or hasRole('ADMIN')")
    public void deleteDocument(Long documentId) {
        // 業(yè)務(wù)邏輯：刪除文檔
        System.out.println("Deleting document with ID: " + documentId);
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;
@Service
public class UserService {
    // 確保用戶只能更新自己的信息
    @PreAuthorize("#userId == authentication.principal.id")
    public void updateUserProfile(Long userId, String newName) {
        // 業(yè)務(wù)邏輯：更新用戶信息
        System.out.println("Updating profile for user " + userId + " to " + newName);
    }
    // 管理員可以查看任何用戶，普通用戶只能查看自己
    @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
    public String getUserDetails(Long userId) {
        // 業(yè)務(wù)邏輯：獲取用戶詳情
        return "Details for user " + userId;
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/projects")
public class ProjectController {
    // 項(xiàng)目所有者或管理員可以更新項(xiàng)目
    @PutMapping("/{projectId}")
    @PreAuthorize("@projectSecurityService.isOwner(#projectId, authentication.principal) or hasRole('ADMIN')")
    public String updateProject(@PathVariable Long projectId, @RequestBody String projectData) {
        return "Project " + projectId + " updated successfully";
    }
}

import org.springframework.stereotype.Component;
@Component("projectSecurityService")
public class ProjectSecurityService {
    /**
     * 檢查用戶是否是項(xiàng)目的所有者
     * @param projectId 項(xiàng)目ID
     * @param principal 當(dāng)前用戶主體
     * @return 是否為所有者
     */
    public boolean isOwner(Long projectId, Object principal) {
        // 在實(shí)際應(yīng)用中，這里會(huì)查詢數(shù)據(jù)庫(kù)驗(yàn)證項(xiàng)目所有權(quán)
        // 這里僅作示例：假設(shè)用戶"user"擁有ID小于100的項(xiàng)目
        String username = principal.toString();
        return "user".equals(username) && projectId < 100;
    }
}

import org.springframework.http.HttpStatus;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestControllerAdvice;
@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(AccessDeniedException.class)
    @ResponseStatus(HttpStatus.FORBIDDEN)
    public String handleAccessDenied(AccessDeniedException ex) {
        return "Access denied: You don't have permission to perform this action";
    }
}