业务系统中基于角色的访问控制RBAC

@Data
@RequiredArgsConstructor
public class UserPrincipal implements Principal {
    @NonNull
    private String name;
    @NonNull
    private Set permissions;
}

User user = em
    .createQuery("SELECT u FROM User u LEFT JOIN FETCH u.roles r LEFT JOIN FETCH r.permissions p WHERE u.account = :account", User.class)
    .setParameter("account", account)
    .getSingleResult();
 
    session.put("account", account);
    Set<Permission> permissions = new HashSet<>();
    user.getRoles().stream()
        .map(Role::getPermissions)
        .forEach(permissionsInRole -> permissions.addAll(permissionsInRole));
 
    session.put("permissions", permissions.stream().map(Permission::getName)
        .collect(Collectors.joining(",")));

Session session = context.getSession();
if (session.get("account") == null) {
    return Results.redirect("/login");
}
Set<String> permissions = new HashSet<>();
 
if (session.get("permissions") != null) {
    permissions = ImmutableSet.copyOf(Splitter.on(',').split(session.get("permissions")));
}
context.setAttribute("principal", new UserPrincipal(session.get("account"), permissions));

    @UnitOfWork
    @RolesAllowed("readIssue")
    public Result list(Context context) {
        EntityManager em = entityManagerProvider.get();
        List<Issue> issues = em
                .createQuery("SELECT i FROM Issue i", Issue.class)
                .getResultList();
 
        Map<String, Object> bindings = VariablesHelper.create(context);
        bindings.put("issues", issues);
        return Results.html().render(bindings);
    }
 
    @UnitOfWork
    @RolesAllowed("writeIssue")
    public Result newIssue(Context context) {
        return Results.html().render(VariablesHelper.create(context));
    }

Method method = context.getRoute().getControllerMethod();
RolesAllowed rolesAllowed = method.getAnnotation(RolesAllowed.class);
PermitAll permitAll = method.getAnnotation(PermitAll.class);
 
UserPrincipal principal = (UserPrincipal) context.getAttribute("principal");
 
if (permitAll != null ||
        (rolesAllowed != null && contains(principal.getPermissions(), rolesAllowed.value()))) {
    return filterChain.next(context);
} else {
    return Results.forbidden().html().template("views/403forbidden.ftl.html");
}

<a href="#" class="header item">
    RBAC Example
</a>
<#if principal??>
    <a href="/" class="item">Home</a>
</#if>
<#if principal?? && principal.permissions?seq_contains("readIssue")>
    <a href="/issues/" class="item">Issue</a>
</#if>
<#if principal?? && principal.permissions?seq_contains("manageUser")>
    <a href="/users/" class="item">Users</a>
</#if>

% git clone https://github.com/kawasima/rbac-example.git
% cd rbac-example
% mvn compile
% mvn waitt:run