且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何通过角色限制对Spring Data REST投影的访问?

更新时间:2023-09-02 22:37:58

您可以使用带有条件SpEL表达式的@Value重载投影中的属性-如

You can overload properties in projections using @Value with conditional SpEL expressions - as in this already answered similar question.

考虑其他替代方法(已经提到的其他方法):

Consider other alternatives (others already mentioned):

  1. 模型重构.通过访问逻辑(例如Person<-> Account)
  2. 来拆分实体
  3. 添加用于特殊逻辑和访问检查的自定义端点.例如,当前用户位于"/people/me".
  4. 定制标准端点.例如,为"/people","/people/{id}"添加自定义控制器,这些控制器将根据用户权限进行预处理并返回自定义Resource类型(DTO)(例如,返回PublicPerson而不是Person).然后,您可以编写用于添加这些类型的自定义链接和自定义投影的自定义资源处理器.
  1. Model refactoring. Split entity by access logic (e.g. Person <-> Account)
  2. Adding custom endpoints for special logic and access checks. For example, the current user at "/people/me".
  3. Customising standard endpoints. For example, add custom controller for "/people", "/people/{id}" that would preprocess and return custom Resource type (DTO) depending on on user authorities (e.g. returning PublicPerson instead Person). Then you can write custom resource processors for adding custom links and custom projections for these types.

另请参阅:spring-data-rest DATAREST-428 .

See also: issue on this subject from spring-data-rest DATAREST-428.