Project to obtain information about the current logged-in user through Spring Security (6)

The above registration process added “assign roles”, and each role is corresponding to some rights, so “assign roles” process is “assign rights” process! When the user logs in, the user’s permissions should be read to complete Spring Security’s authorization during the authentication process to ensure that subsequent access decisions are made so that some users can perform certain operations that others may not be able to perform because they do not have permissions!

First, you need to implement the function of “query the permission of the user based on the user ID”. The SQL statement to be executed is roughly as follows:

SELECT 
	DISTINCT permission.*
FROM
	permission
LEFT JOIN role_permission ON permission.id=role_permission.permission_id
LEFT JOIN role ON role_permission.role_id=role.id
LEFT JOIN user_role ON role.id=user_role.role_id
LEFT JOIN user ON user_role.user_id=user.id
WHERE 
	user.id=1;
Copy the code

Add abstract methods to the PermissionMapper interface of the persistence layer that handles permission data:

/** * Query the permission of a user *@paramUserId userId *@returnList of permissions for this user */
List<Permission> selectByUserId(Integer userId);
Copy the code

Then, configure the SQL statement corresponding to the above abstract method in permissionmapper.xml:

<select id="selectByUserId" resultMap="BaseResultMap">
    SELECT
        DISTINCT permission.id, permission.name, permission.description
    FROM
        permission
    LEFT JOIN role_permission ON permission.id=role_permission.permission_id
    LEFT JOIN role ON role_permission.role_id=role.id
    LEFT JOIN user_role ON role.id=user_role.role_id
    LEFT JOIN user ON user_role.user_id=user.id
    WHERE
        user.id=#{userId}
</select>
Copy the code

When done, create the PermissionMapperTests test class at the test location and write and execute the unit tests:

package cn.tedu.straw.portal.mapper;

@SpringBootTest
@Slf4j
public class PermissionMapperTests {

    @Autowired
    PermissionMapper mapper;

    @Test
    void selectByUserId(a) {
        Integer userId = 1;
        List<Permission> permissions = mapper.selectByUserId(userId);
        log.debug("permissions count={}", permissions.size());
        for (Permission permission : permissions) {
            log.debug("permission > {}", permission); }}}Copy the code

Next, in the business that handles login, in UserServiceImpl first add:

@Autowired
private PermissionMapper permissionMapper;
Copy the code

And add in the login() method:

// An array of permission strings
List<Permission> permissions = permissionMapper.selectByUserId(user.getId());
String[] authorities = new String[permissions.size()];
for (int i = 0; i < permissions.size(); i++) {
    authorities[i] = permissions.get(i).getName();
}
// Organize the User Details object
UserDetails userDetails = org.springframework.security.core.userdetails.User
        .builder()
        .username(user.getUsername())
        .password(user.getPassword())
        .authorities(authorities)
        .disabled(user.getEnabled() == 0)
        .accountLocked(user.getLocked() == 1)
        .build();
Copy the code

Due to the modification of the registered service (” Assigning roles to student accounts “was just added), the original test data may be unavailable. In order to facilitate the use of subsequent tests, the original data should be cleared first:

TRUNCATE user;
Copy the code

And through the registration business or registration page to register some new accounts.

Also, some data should be identified as teacher:

UPDATE user SET type=1 WHERE id IN (1.2.3);
Copy the code

In the user role assignment table, clear the original data and change the roles of some accounts to administrator and teacher:

Clear the user role assignment table
TRUNCATE user_role;
-- Assign some users to administrators, teachers, and students
INSERT INTO user_role (user_id, role_id) VALUES (1.1), (1.2), (1.3);
-- Assign some users as teachers
INSERT INTO user_role (user_id, role_id) VALUES (2.3), (3.3);
-- Assign some users to students
INSERT INTO user_role (user_id, role_id) VALUES (4.2), (5.2), (6.2);
Copy the code

You can retrieve user information by injecting @authenticationPricipal UserDetails above. However, the information encapsulated in the object may not be enough to satisfy programming requirements, such as the lack of user ID or some other attributes! If you want these attributes to exist, you need a custom class that extends from UserDetails!

In cn. Tedu. Straw. Portal. The security package created under the UserInfo class, inherited from the User class, and in this class is declared in the custom attributes:

package cn.tedu.straw.portal.security;

@Setter
@Getter
@ToString
public class UserInfo extends User {

    private Integer id;
    private String nickname;
    private Integer gender;
    private Integer type;

    public UserInfo(String username, String password, Collection
        authorities) {
        super(username, password, authorities);
    }

    public UserInfo(String username, String password,
                    boolean enabled, boolean accountNonExpired,
                    boolean credentialsNonExpired, boolean accountNonLocked,
                    Collection<? extends GrantedAuthority> authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities); }}Copy the code

Note: due to the parent classUserThere is no no-argument constructor, so you need to add matching parameters constructor after inheritance!

Note: due to the parent classUserThere are no parameterless constructors in Lombok, so you can’t use Lombok@DataAnnotations can only be added on demand@Setter,@GetterSuch as annotations.

Then, when the business layer processes the user login, use the object of type UserInfo created above as the return value object:

// Organize the User Details object
UserDetails userDetails = org.springframework.security.core.userdetails.User
        .builder()
        .username(user.getUsername())
        .password(user.getPassword())
        .authorities(authorities)
        .disabled(user.getEnabled() == 0)
        .accountLocked(user.getLocked() == 1)
        .build();
UserInfo userInfo = new UserInfo(
        userDetails.getUsername(),
        userDetails.getPassword(),
        userDetails.isEnabled(),
        userDetails.isAccountNonExpired(),
        userDetails.isCredentialsNonExpired(),
        userDetails.isAccountNonLocked(),
        userDetails.getAuthorities()
);
userInfo.setId(user.getId());
userInfo.setNickname(user.getNickname());
userInfo.setGender(user.getGender());
userInfo.setType(user.getType());
return userInfo;
Copy the code

In the future, when you need to obtain the information of the currently logged user, you can directly inject the parameter object of UserInfo into the controller’s request processing method:

// http://localhost:8080/test/user/current/info
@GetMapping("/user/current/info")
public UserInfo getUserInfo(@AuthenticationPrincipal UserInfo userInfo) {
    System.out.println("user id = " + userInfo.getId());
    System.out.println("user nickname = " + userInfo.getNickname());
    return userInfo;
}
Copy the code