Collection<ConfigAttribute> v=new ArrayList<>();
for(String role : roles){
v.add(new SecurityConfig(role));
}
//POST
RequestMatcher key=new AntPathRequestMatcher(url,"POST");
requestMap.put(key, v);
//GET
key=new AntPathRequestMatcher(url,"GET");
requestMap.put(key, v);
}
//格式2：超级管理员 或是 普通管理员都可以访问
else{
//POST
RequestMatcher key=new AntPathRequestMatcher(url,"POST");
requestMap.put(key, value);
//GET
key=new AntPathRequestMatcher(url,"GET");
requestMap.put(key, value);
}
}
//2、动态指定系统中模块及命令的url访问规则
//遍历所有的Command对象
for(Command command : serviceFacade.query(Command.class).getModels()){
List<String> paths=ModuleService.getCommandPath(command);
//命令访问路径到角色名称的映射
Map<String,String> map=ModuleService.getCommandPathToRole(command);
for(String path : paths){
//POST
RequestMatcher key=new AntPathRequestMatcher(path.toString().toLowerCase()+".action*","POST");
value=new ArrayList<>();
//要把路径转换为角色
//如：命令路径：/**/security/user!query 映射角色：_SECURITY_USER_QUERY
value.add(new SecurityConfig("ROLE_MANAGER"+map.get(path)));
value.add(superManager);
requestMap.put(key, value);
//GET
key=new AntPathRequestMatcher(path.toString().toLowerCase()+".action*","GET");
requestMap.put(key, value);
}
}
//3、超级管理员对所有的POST操作具有权限
RequestMatcher key=new AntPathRequestMatcher("/**","POST");
//value为超级管理员
value=new ArrayList<>();
value.add(superManager);
requestMap.put(key, value);
//4、超级管理员对所有的GET操作具有权限
key=new AntPathRequestMatcher("/**","GET");
requestMap.put(key, value);
DefaultFilterInvocationSecurityMetadataSource source=new DefaultFilterInvocationSecurityMetadataSource(requestMap);
filterSecurityInterceptor.setSecurityMetadataSource(source);