安全元信息源

基于安全元信息上下文获得安全元信息。

定义

export interface SecurityMetadataSource {
    load(context: SecurityMetadataContext): Promise<SecurityMetadata>;
}

默认实现

@Component(SecurityMetadataSource)
export class MethodSecurityMetadataSource implements SecurityMetadataSource {
    @Autowired(SecurityExpressionContextHandler) @Optional
    protected readonly securityExpressionContextHandler: SecurityExpressionContextHandler;
    async load(context: MethodSecurityMetadataContext): Promise<SecurityMetadata> {
        const classMetadatas: AuthorizeMetadata[] = getOwnMetadata(METADATA_KEY.authorize, context.target.constructor);
        const methodMetadatas: AuthorizeMetadata[] = getOwnMetadata(METADATA_KEY.authorize, context.target.constructor, context.method);
        const ctx = {
            ...context,
            ...SecurityContext.getAuthentication()
        };
        Context.setAttr(SECURITY_EXPRESSION_CONTEXT_KEY, ctx);
        if (this.securityExpressionContextHandler) {
            await this.securityExpressionContextHandler.handle(ctx);
        }
        const policies = classMetadatas.concat(...methodMetadatas)
            .filter(item => item.authorizeType === context.authorizeType)
            .map(item => ({
                type: PolicyType.El,
                authorizeType: item.authorizeType,
                el: item.el
            }));
        const resource = context.target.name;
        return {
            authorizeType: context.authorizeType,
            principal: SecurityContext.getAuthentication().principal,
            action: context.method,
            resource,
            policies: policies
        };
    }
}