1

实际上我在数据库中有角色，如 ROLE_USER、ROLE_MAKER、ROLE_CHECKER。现在我通过提及 @PreAutorize(hasRole('ROLE_USER','ROLE_MAKER') 来使用方法级别限制，

在此先感谢维努

这可以使用Mockito优雅地完成。假设该类已命名ThreadLauncher，您可以确保该startThread()方法导致调用myLongProcess()with：

public void testStart() throws Exception {
    // creates a decorator spying on the method calls of the real instance
    ThreadLauncher launcher = Mockito.spy(new ThreadLauncher());

    launcher.startThread();
    Thread.sleep(500);

    // verifies the myLongProcess() method was called
    Mockito.verify(launcher).myLongProcess();
}
4

1 回答 1

0

在http://static.springsource.org/spring-security/site/docs/3.0.x/reference/el-access.html检查权限评估器

第 1 步：告诉 spring 你将使用权限评估器。

<beans:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
    <beans:property name="permissionEvaluator">
        <beans:bean id="permissionEvaluator" class="com.npacemo.permissions.SomePermissionsEvaluator"/>
    </beans:property>
</beans:bean>

Step2：在 com.npacemo.permissions.SomePermissionsEvaluator 实现 PermissionEvaluator

class SomePermissionsEvaluator implements PermissionEvaluator {

boolean hasPermission(Authentication authentication,
                      java.lang.Object targetDomainObject,
                      java.lang.Object permission){

if(permission.equals("check role")){
//ok I need to check for roles from DB..
if matching then return true else false..

    //write logic as per ur requirement

    }

boolean hasPermission(Authentication authentication,
                      java.io.Serializable targetId,
                      java.lang.String targetType,
                      java.lang.Object permission){

//write logic as per ur requirement
}

}

第 3 步：在 PreAuthorize 中调用 hasPermission 以检查您的角色

@PreAuthorize("hasPermission(#contact, 'check role')")
  public void deleteApplication(Contact contact);
于 2012-06-18T10:27:41.670 回答