如何在 Spring Boot 中针对特定条件或用户角色 @JsonIgnore

Question

您好，我是 Spring Boot 新手。我想实现以下逻辑，我该如何实现， 说我有模特

class Person {

    // Accessible by Level 3 or Few Roles
    private int id;
    private String name;
    private String address;

    // Accessible by Level 2 or Few Roles
    private String phoneNumber;

    //Accessible by Only Level 1 or Admin Roles 
    private String aadharNo;

    @JsonIgnore
    private LocalDateTime deletedAt;
}

级别是需要通过请求将哪些数据导出为 JSON 的说明符。并且角色的优先级很高，例如

phoneNumber 可以作为 JSON 导出到请求，如果它指定 JsonInclude 如果访问级别 2 和角色是特权用户，现在是一个用户 即使指定为 2 级，普通角色也无法访问。

我怎样才能做到这一点。有什么建议吗？

Answer 1

您可以使用@JsonView 和@RestControllerAdvice 来做到这一点.....

class View {
    public static class Level3 {} 
    public static class Level2 extends Level3 {}
    public static class Level1 extends Level2 {}
}

class Person {

    @JsonView(View.Level3.class)
    private int id;
    private String name;
    private String address;

    @JsonView(View.Level2.class)
    private String phoneNumber;

    @JsonView(View.Level1.class) 
    private String aadharNo;

    @JsonIgnore
    private LocalDateTime deletedAt;
}

并添加此配置以检查 spring-security 授权...

@RestControllerAdvice
class SecurityJsonViewControllerAdvice extends AbstractMappingJacksonResponseBodyAdvice {

    @Override
    protected void beforeBodyWriteInternal(
      MappingJacksonValue bodyContainer,
      MediaType contentType,
      MethodParameter returnType,
      ServerHttpRequest request,
      ServerHttpResponse response) {
        if (SecurityContextHolder.getContext().getAuthentication() != null
          && SecurityContextHolder.getContext().getAuthentication().getAuthorities() != null) {
            Collection<? extends GrantedAuthority> authorities
              = SecurityContextHolder.getContext().getAuthentication().getAuthorities();
            List<Class> jsonViews = authorities.stream()
              .map(GrantedAuthority::getAuthority)
              .map(AppConfig.Role::valueOf)
              .map(View.MAPPING::get)
              .collect(Collectors.toList());
            if (jsonViews.size() == 1) {
                bodyContainer.setSerializationView(jsonViews.get(0));
                return;
            }
            throw new IllegalArgumentException("Ambiguous @JsonView declaration for roles "
              + authorities.stream()
              .map(GrantedAuthority::getAuthority).collect(Collectors.joining(",")));
        }
    }
}