1

src/main/java/com/boot/security/server/config/SecurityConfig.java

@@ -13,7 +13,7 @@ import org.springframework.security.web.authentication.logout.LogoutSuccessHandl
 
 import com.boot.security.server.service.impl.UserDetailsServiceImpl;
 
-@EnableGlobalMethodSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
 	@Autowired

src/main/java/com/boot/security/server/config/SecurityHandlerConfig.java

@@ -81,7 +81,8 @@ public class SecurityHandlerConfig {
 			@Override
 			public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
 					Authentication authentication) throws IOException, ServletException {
-
+				ResponseInfo info = ResponseInfo.builder().code(HttpStatus.OK.value() + "").message("退出成功").build();
+				writeResponse(response, HttpStatus.OK.value(), JSONObject.toJSONString(info));
 			}
 		};
 

src/main/java/com/boot/security/server/controller/RoleController.java

@@ -3,6 +3,7 @@ package com.boot.security.server.controller;
 import java.util.List;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -66,12 +67,14 @@ public class RoleController {
 		}).build().handle(request);
 	}
 
+	@PreAuthorize("hasAuthority('sys:role:query')")
 	@GetMapping("/{id}")
 	@ApiOperation(value = "根据id获取角色")
 	public Role get(@PathVariable Long id) {
 		return roleDao.getById(id);
 	}
 
+	@PreAuthorize("hasAnyAuthority('sys:user:query','sys:role:query')")
 	@GetMapping("/all")
 	@ApiOperation(value = "所有角色")
 	public List<Role> roles() {

src/main/java/com/boot/security/server/controller/UserController.java

@@ -4,6 +4,7 @@ import java.util.List;
 
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -105,6 +106,7 @@ public class UserController {
 		return new SysUser();
 	}
 
+	@PreAuthorize("hasAuthority('sys:user:query')")
 	@ApiOperation(value = "根据用户id获取用户")
 	@GetMapping("/{id}")
 	public SysUser user(@PathVariable Long id) {

src/main/java/com/boot/security/server/service/impl/UserDetailsServiceImpl.java

@@ -1,6 +1,7 @@
 package com.boot.security.server.service.impl;
 
 import java.util.HashSet;
+import java.util.List;
 import java.util.Set;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -14,7 +15,10 @@ import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
 
+import com.boot.security.server.dao.PermissionDao;
+import com.boot.security.server.model.Permission;
 import com.boot.security.server.model.SysUser;
 import com.boot.security.server.model.SysUser.Status;
 import com.boot.security.server.service.UserService;
@@ -24,6 +28,8 @@ public class UserDetailsServiceImpl implements UserDetailsService {
 
 	@Autowired
 	private UserService userService;
+	@Autowired
+	private PermissionDao permissionDao;
 
 	@Override
 	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
@@ -36,9 +42,12 @@ public class UserDetailsServiceImpl implements UserDetailsService {
 			throw new DisabledException("用户已作废");
 		}
 
-		Set<GrantedAuthority> authorities = new HashSet<>();// TODO
+		Set<GrantedAuthority> authorities = new HashSet<>();
-		GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("rrr");
+		List<Permission> permissionList = permissionDao.listByUserId(sysUser.getId());
-		authorities.add(grantedAuthority);
+		permissionList.parallelStream().filter(p -> !StringUtils.isEmpty(p.getPermission())).forEach(p -> {
+			GrantedAuthority grantedAuthority = new SimpleGrantedAuthority(p.getPermission());
+			authorities.add(grantedAuthority);
+		});
 
 		User user = new User(username, sysUser.getPassword(), authorities);
 		return user;