@Configuration
@EnableMethodSecurity(prePostEnabled = true) // 啟用 pre 和 post 注解
public class SecurityConfig {
    // 配置細(xì)節(jié)...
}

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {
    
    // 確保用戶只能訪問自己的信息或具有管理員角色
    @PostAuthorize("returnObject.userId == authentication.principal.userId or hasRole('ADMIN')")
    public UserDTO getUserById(Long userId) {
        // 從數(shù)據(jù)庫獲取用戶信息
        UserDTO user = userRepository.findById(userId);
        return user;
    }
}

// 數(shù)據(jù)傳輸對(duì)象
class UserDTO {
    private Long userId;
    private String username;
    private String email;
    
    // getter 和 setter 方法
    public Long getUserId() {
        return userId;
    }
}
    

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;
import java.util.List;

@Service
public class DocumentService {
    
    // 確保用戶只能獲取自己有權(quán)訪問的文檔
    @PostAuthorize("hasRole('ADMIN') or " +
                  "returnObject.ownerId == authentication.principal.userId or " +
                  "@documentSecurityService.isSharedWithUser(returnObject.id, authentication.principal.userId)")
    public Document getDocument(Long documentId) {
        // 從數(shù)據(jù)庫獲取文檔
        return documentRepository.findById(documentId);
    }
    
    // 結(jié)合@PostFilter使用，過濾集合中用戶無權(quán)訪問的元素a
    @PostAuthorize("hasRole('ADMIN')")
    @PostFilter("filterObject.ownerId == authentication.principal.userId or " +
               "@documentSecurityService.isSharedWithUser(filterObject.id, authentication.principal.userId)")
    public List<Document> searchDocuments(String keyword) {
        // 搜索文檔
        return documentRepository.findByKeyword(keyword);
    }
}
    

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

@Service
public class OrderService {
    
    // 訂單金額超過10000時(shí)需要特殊權(quán)限
    @PostAuthorize("returnObject.totalAmount <= 10000 or " +
                  "hasAuthority('PROCESS_LARGE_ORDER') or " +
                  "@orderSecurityService.isOrderManager(authentication, returnObject.id)")
    public OrderDTO getOrderDetails(Long orderId) {
        // 獲取訂單詳情
        return orderRepository.findById(orderId);
    }
}

// 訂單數(shù)據(jù)傳輸對(duì)象
class OrderDTO {
    private Long id;
    private Long userId;
    private double totalAmount;
    
    // getter 和 setter 方法
    public double getTotalAmount() {
        return totalAmount;
    }
    
    public Long getId() {
        return id;
    }
}

// 訂單安全服務(wù)
@Component
class OrderSecurityService {
    public boolean isOrderManager(Authentication authentication, Long orderId) {
        // 復(fù)雜的業(yè)務(wù)邏輯判斷
        String username = authentication.getName();
        return orderManagerRepository.isManagerForOrder(username, orderId);
    }
}