springboot 整合 SA-Token 使用示例详解

-- 用户表
create table `user` (
  `user_id` int not null,
  `user_name` varchar(32) collate utf8mb4_bin default null,
  `password` varchar(32) collate utf8mb4_bin default null,
  `real_name` varchar(32) collate utf8mb4_bin default null,
  `dept_name` varchar(255) collate utf8mb4_bin default null,
  primary key (`user_id`)
) engine=innodb default charset=utf8mb4 collate=utf8mb4_bin;
insert into `db_sky`.`user`(`user_id`, `user_name`, `password`, `real_name`, `dept_name`) values (1, 'zhangsan', '123456', '张三', '技术部');
insert into `db_sky`.`user`(`user_id`, `user_name`, `password`, `real_name`, `dept_name`) values (2, 'lishi', '123456', '李四', '测试部');
-- 角色表
create table `role` (
  `role_id` int not null,
  `role_code` varchar(32) collate utf8mb4_bin not null,
  `role_name` varchar(32) collate utf8mb4_bin not null,
  primary key (`role_id`)
) engine=innodb default charset=utf8mb4 collate=utf8mb4_bin;
insert into `db_sky`.`role`(`role_id`, `role_code`, `role_name`) values (1, 'admin', '管理员');
insert into `db_sky`.`role`(`role_id`, `role_code`, `role_name`) values (2, 'guest', '游客');
-- 权限表
create table `permission` (
  `permission_id` int not null,
  `permission_code` varchar(32) collate utf8mb4_bin default null,
  primary key (`permission_id`)
) engine=innodb default charset=utf8mb4 collate=utf8mb4_bin;
insert into `db_sky`.`permission`(`permission_id`, `permission_code`) values (1, 'user-read');
insert into `db_sky`.`permission`(`permission_id`, `permission_code`) values (2, 'user-write');
insert into `db_sky`.`permission`(`permission_id`, `permission_code`) values (3, 'product-read');
insert into `db_sky`.`permission`(`permission_id`, `permission_code`) values (4, 'product-write');
-- 用户角色关联表
create table `role_user` (
  `id` int not null,
  `role_id` int default null,
  `user_id` int default null,
  primary key (`id`)
) engine=innodb default charset=utf8mb4 collate=utf8mb4_bin;
insert into `db_sky`.`role_user`(`id`, `role_id`, `user_id`) values (1, 1, 1);
insert into `db_sky`.`role_user`(`id`, `role_id`, `user_id`) values (2, 2, 1);
insert into `db_sky`.`role_user`(`id`, `role_id`, `user_id`) values (3, 2, 2);
-- 角色权限表
create table `role_permission` (
  `id` int not null,
  `role_id` int default null,
  `permission_id` int default null,
  primary key (`id`)
) engine=innodb default charset=utf8mb4 collate=utf8mb4_bin;
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (1, 1, 1);
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (2, 1, 2);
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (3, 1, 3);
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (4, 1, 4);
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (7, 2, 1);
insert into `db_sky`.`role_permission`(`id`, `role_id`, `permission_id`) values (8, 2, 3);

    <parent>
        <groupid>org.springframework.boot</groupid>
        <artifactid>spring-boot-starter-parent</artifactid>
        <version>2.5.5</version>
        <relativepath/>
    </parent>
    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceencoding>utf-8</project.build.sourceencoding>
    </properties>
    <dependencies>
        <dependency>
            <groupid>com.alibaba</groupid>
            <artifactid>druid-spring-boot-starter</artifactid>
            <version>1.1.17</version>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-web</artifactid>
        </dependency>
        <!-- mybatis starter -->
        <dependency>
            <groupid>org.mybatis.spring.boot</groupid>
            <artifactid>mybatis-spring-boot-starter</artifactid>
            <version>2.2.2</version>
        </dependency>
        <dependency>
            <groupid>org.projectlombok</groupid>
            <artifactid>lombok</artifactid>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-jdbc</artifactid>
        </dependency>
        <dependency>
            <groupid>mysql</groupid>
            <artifactid>mysql-connector-java</artifactid>
        </dependency>
        <dependency>
            <groupid>cn.dev33</groupid>
            <artifactid>sa-token-spring-boot-starter</artifactid>
            <version>1.38.0</version>
        </dependency>
    </dependencies>

server:
  port: 8081
spring:
  application:
    name: user-service
  datasource:
    url: jdbc:mysql://ip:3306/db_sky
    driverclassname: com.mysql.jdbc.driver
    username: root
    password: 123456
mybatis:
  mapper-locations: classpath:mapper/*.xml
  #目的是为了省略resulttype里的代码量
  type-aliases-package: com.congge.entity
  configuration:
    log-impl: org.apache.ibatis.logging.stdout.stdoutimpl
sa-token:
  #token的名称，也即cookie的名称
  token-name: satoken
  #token的有效期（单位/秒），默认30天，-1代表永久有效
  timeout: 2592000
  #token最低活跃频率（单位/秒），如果token超过次时间没有访问系统就会被冻结，默认-1表示不限制
  active-timeout: -1
  #是否允许同一账号多地登录 （为true允许一起登录，为false表示新登录挤掉旧的）
  is-concurrent: true
  #在多人登录同一个账号的同时，是否共用一个token
  is-share: true
  #token的风格形式（可选值：uuid，simple-uuid，random-32，random-64，random-128，tik）
  token-style: uuid
  #是否输出日志
  is-log: true

// 会话登录：参数填写要登录的账号id，建议的数据类型：long | int | string， 不可以传入复杂类型，如：user、admin 等等
stputil.login(object id);     

// 当前会话注销登录
stputil.logout();
// 获取当前会话是否已经登录，返回true=已登录，false=未登录
stputil.islogin();
// 检验当前会话是否已经登录, 如果未登录，则抛出异常：`notloginexception`
stputil.checklogin();

import cn.dev33.satoken.filter.saservletfilter;
import cn.dev33.satoken.interceptor.sainterceptor;
import org.springframework.context.annotation.bean;
import org.springframework.context.annotation.configuration;
import org.springframework.web.servlet.config.annotation.interceptorregistry;
import org.springframework.web.servlet.config.annotation.webmvcconfigurer;
@configuration
public class satokenconfigure implements webmvcconfigurer {
    /**
     * 注册sa-token 拦截器，打开注解鉴权的功能
     * @param registry
     */
    @override
    public void addinterceptors(interceptorregistry registry) {
        registry.addinterceptor(new sainterceptor()).addpathpatterns("/**");
    }
    /**
     * 注册sa-token的全局过滤器
     * @return
     */
    @bean
    public saservletfilter getsaservletfilter(){
        return new saservletfilter()
                .addinclude("/**");
    }
}

import cn.dev33.satoken.exception.disableserviceexception;
import cn.dev33.satoken.exception.notloginexception;
import cn.dev33.satoken.exception.notpermissionexception;
import cn.dev33.satoken.exception.notroleexception;
import org.springframework.http.httpstatus;
import org.springframework.http.responseentity;
import org.springframework.web.bind.annotation.controlleradvice;
import org.springframework.web.bind.annotation.exceptionhandler;
import org.springframework.web.bind.annotation.responsebody;
import javax.servlet.http.httpservletrequest;
import java.util.hashmap;
import java.util.map;
@controlleradvice
public class globalbizexception {
    @responsebody
    @exceptionhandler
    public responseentity handleexception(exception e, httpservletrequest request) throws exception{
        map<string,object> resultmap = new hashmap<>();
        if(e instanceof notloginexception){
            notloginexception exception = (notloginexception) e;
            resultmap.put("code",exception.getcode());
            resultmap.put("message",exception.getmessage());
        } else if(e instanceof notroleexception){
            notroleexception exception = (notroleexception) e;
            resultmap.put("code",exception.getcode());
            resultmap.put("message",exception.getmessage());
        } else if(e instanceof notpermissionexception){
            notpermissionexception exception = (notpermissionexception) e;
            resultmap.put("code",exception.getcode());
            resultmap.put("message",exception.getmessage());
        }else if(e instanceof disableserviceexception){
            disableserviceexception exception = (disableserviceexception) e;
            resultmap.put("code",exception.getcode());
            resultmap.put("message",exception.getmessage());
        }else {
            resultmap.put("message",e.getmessage());
        }
        return new responseentity<>(resultmap, httpstatus.internal_server_error);
    }
}

import cn.dev33.satoken.stp.satokeninfo;
import cn.dev33.satoken.stp.stputil;
import com.congge.entity.user;
import com.congge.service.userservice;
import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.requestparam;
import org.springframework.web.bind.annotation.restcontroller;
import javax.annotation.resource;
import java.util.objects;
@restcontroller
public class logincontroller {
    @resource
    private userservice userservice;
    //localhost:8081/login?name=zhangsan&pwd=123456
    @getmapping("/login")
    public object login(@requestparam("name") string name, @requestparam("pwd") string pwd){
        user dbuser = userservice.querybynameandpwd(name,pwd);
        if(objects.isnull(dbuser)){
            throw new runtimeexception("用户名或密码错误");
        }
        stputil.login(dbuser.getuserid());
        return "login success";
    }
    //localhost:8081/gettoken
    @getmapping("/gettoken")
    public object gettoken(){
        satokeninfo tokeninfo = stputil.gettokeninfo();
        return tokeninfo;
    }
    //localhost:8081/logout
    @getmapping("/logout")
    public object logout(){
        stputil.logout();
        return "logout success";
    }
}

import com.congge.entity.user;
import com.congge.service.userservice;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.requestmapping;
import org.springframework.web.bind.annotation.requestparam;
import org.springframework.web.bind.annotation.restcontroller;
@requestmapping("/user")
@restcontroller
public class usercontroller {
    @autowired
    private userservice userservice;
    //localhost:8081/user/detail?userid=1
    @getmapping("/detail")
    public user getbyid(@requestparam integer userid){
        return userservice.getbyid(userid);
    }
}

/**
 * 自定义权限加载接口实现类
 */
@component    // 保证此类被 springboot 扫描，完成 sa-token 的自定义权限验证扩展 
public class stpinterfaceimpl implements stpinterface {
    /**
     * 返回一个账号所拥有的权限码集合 
     */
    @override
    public list<string> getpermissionlist(object loginid, string logintype) {
        // 本 list 仅做模拟，实际项目中要根据具体业务逻辑来查询权限
        list<string> list = new arraylist<string>();    
        list.add("101");
        list.add("user.add");
        list.add("user.update");
        list.add("user.get");
        // list.add("user.delete");
        list.add("art.*");
        return list;
    }
    /**
     * 返回一个账号所拥有的角色标识集合 (权限与角色可分开校验)
     */
    @override
    public list<string> getrolelist(object loginid, string logintype) {
        // 本 list 仅做模拟，实际项目中要根据具体业务逻辑来查询角色
        list<string> list = new arraylist<string>();    
        list.add("admin");
        list.add("super-admin");
        return list;
    }
}

import cn.dev33.satoken.stp.stpinterface;
import com.congge.dao.usermapper;
import org.springframework.stereotype.component;
import javax.annotation.resource;
import java.util.list;
/**
 * 自定义权限加载接口实现类
 * 保证此类被 springboot 扫描，完成 sa-token 的自定义权限验证扩展
 */
@component
public class stpinterfaceimpl implements stpinterface {
    @resource
    private usermapper usermapper;
    /**
     * 返回一个账号所拥有的权限码集合
     */
    @override
    public list<string> getpermissionlist(object loginid, string logintype) {
        system.out.println("获取权限列表...");
        list<string> permissionlist = usermapper.getpermissionlist(integer.valueof(loginid.tostring()));
        return permissionlist;
    }
    /**
     * 返回一个账号所拥有的角色标识集合 (权限与角色可分开校验)
     */
    @override
    public list<string> getrolelist(object loginid, string logintype) {
        // 本 list 仅做模拟，实际项目中要根据具体业务逻辑来查询角色
        list<string> list = usermapper.getrolelist(integer.valueof(loginid.tostring()));
        return list;
    }
}

<?xml version="1.0" encoding="utf-8"?>
<!doctype mapper public "-//mybatis.org//dtd mapper 3.0//en"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.congge.dao.usermapper">
    <resultmap id="userresultmap" type="com.congge.entity.user">
        <id property="userid" column="user_id"/>
        <result property="username" column="user_name"/>
        <result property="password" column="password"/>
        <result property="realname" column="real_name"/>
        <result property="deptname" column="dept_name"/>
    </resultmap>
    <select id="getbyid" resultmap="userresultmap">
        select * from `user` where user_id = #{userid}
    </select>
    <select id="querybynameandpwd" resultmap="userresultmap">
        select * from `user` where user_name = #{name} and password = #{pwd}
    </select>
    <select id="getpermissionlist" resulttype="java.lang.string">
        select
            distinct p.permission_code
        from
            role_user ru ,role_permission rp ,permission p
        where
            ru.role_id = rp.role_id and rp.permission_id = p.permission_id and ru.user_id = #{loginid}
    </select>
    <select id="getrolelist" resulttype="java.lang.string">
        select
            distinct r.role_code
        from
            role r ,role_user ru where ru.role_id = r.role_id and ru.user_id =#{loginid}
    </select>
</mapper>

import cn.dev33.satoken.annotation.sacheckpermission;
import cn.dev33.satoken.annotation.sacheckrole;
import cn.dev33.satoken.annotation.samode;
import com.congge.entity.user;
import com.congge.service.userservice;
import org.springframework.beans.factory.annotation.autowired;
import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.requestmapping;
import org.springframework.web.bind.annotation.requestparam;
import org.springframework.web.bind.annotation.restcontroller;
@requestmapping("/user")
@restcontroller
public class usercontroller {
    @autowired
    private userservice userservice;
    //localhost:8081/user/detail?userid=1
    /**
     * 查看用户详情时，只需要拥有 user-read 这个权限即可
     * @param userid
     * @return
     */
    @getmapping("/detail")
    @sacheckpermission("user-read")
    public user getbyid(@requestparam integer userid){
        return userservice.getbyid(userid);
    }
    //localhost:8081/user/create
    /**
     * 创建用户时，需要在user-write 和 write中任意拥有一个即可
     * @return
     */
    @getmapping("/create")
    @sacheckpermission(value = {"user-write","write"},mode = samode.or)
    public object createuser(){
        return "create user success";
    }
    //localhost:8081/user/delete
    /**
     * 删除用户时，必须拥有admin这个角色的才行
     * @return
     */
    @sacheckrole("admin")
    @getmapping("/delete")
    public object deleteuser(){
        return "delete user success";
    }
}