（十）权限表达式进阶：SpEL在安全控制中的高阶魔法

@PreAuthorize("hasAuthority('USER_CREATE')")
public void createUser(User user) { /*...*/ }

@PreAuthorize("hasRole('ADMIN') or hasRole('AUDITOR')")
public void auditSystem() { /*...*/ }

public record Project(Long id, String owner, String status) {}

// 校验项目所有者且项目状态为可编辑
@PreAuthorize("#project.owner == authentication.name and #project.status == 'EDITABLE'")
public void updateProject(Project project) {
    // 更新逻辑
}

// 校验用户ID与当前认证用户匹配
@PreAuthorize("#userId == authentication.principal.id")
public User getUserProfile(Long userId) {
    return userService.findById(userId);
}

// 集合参数过滤
@PostFilter("filterObject.department == authentication.principal.department")
public List<Document> getAllDocuments() {
    return documentRepository.findAll();
}

// 判断传递用户名是否当前认证信息中的用户
@PreAuthorize("authentication.principal.username == #username")
public void getUserDetails(String username) { /*...*/ }

// 判断当前用户是否启用
@PreAuthorize("principal.enabled")
public void sensitiveOperation() { /*...*/ }

@PreAuthorize("permitAll") // 等价于 @PermitAll
public String publicApi() { /*...*/ }

@PreAuthorize("#this.isFeatureEnabled()")
public void usePremiumFeature() { /*...*/ }

@PreAuthorize("#user.id == principal.id")
public void updateUser(User user) { /*...*/ }

// 返回Document对象中owner = 当前用户名 才允许访问该接口
@PostAuthorize("returnObject.owner == principal.username")
public Document getConfidentialDoc() { /*...*/ }

@PreAuthorize("target.isFeatureEnabled('ADVANCED_MODE')")
public void adminOperation() { /*...*/ }

@PreAuthorize("@riskEvaluator.isLowRisk(#request)")
public void processRequest(Request request) { /*...*/ }

@Component("authz")
@RequiredArgsConstructor
public class AuthorizationLogic {
    
    private final SpelExpressionParser parser = new SpelExpressionParser();
    private final SysPolicyMapper sysPolicyMapper;
    
    public boolean check(MethodSecurityExpressionOperations operations, String permission) {
        SysUser userDetails = (SysUser) operations.getAuthentication().getPrincipal();
        
        // 加载策略集
        LambdaQueryWrapper<SysPolicy> queryWrapper = new LambdaQueryWrapper<>();
        queryWrapper.eq(SysPolicy::getTargetResource, permission);
        List<SysPolicy> policies = sysPolicyMapper.selectList(queryWrapper);
        if (policies.isEmpty()) {
            return false;
        }
        
        // 构建评估上下文
        EvaluationContext context = new StandardEvaluationContext();
        // 将用户传入表达式上下文 如：#user.attrs['department'] == 'IT'
        // 其中user前缀就是我们传入的user
        context.setVariable("user", userDetails);
        return policies.stream().allMatch(policy ->
                parser.parseExpression(policy.getConditionExpression()).getValue(context, Boolean.class)
        );
    }
}

@PreAuthorize("hasRole('ADMIN') and @authz.check(authentication, 'admin:menu')")
@GetMapping("/admin/test")
public ResponseEntity<?> test() {
    return ResponseEntity.ok("RBAC角色 + ABAC属性的混合校验");
}

// 调用示例
@PreAuthorize("hasRole('ADMIN') and @abacDecisionEngine.check(authentication, 'admin:menu')")
@GetMapping("/admin/test")
public ResponseEntity<?> test() {
    return ResponseEntity.ok("RBAC角色 + ABAC属性的混合校验");
}

// 复杂逻辑组合
@PreAuthorize("(hasRole('ADMIN') and @env.isProduction()) or #forceOverride")
public void systemReboot(boolean forceOverride) {
    // 系统重启操作
}

// 限制工作时间访问
@PreAuthorize("@timeValidator.isWorkHour()")
public void accessFinancialSystem() {
    // 财务系统操作
}

// 定时权限校验
public class TimeValidator {
    public boolean isWorkHour() {
        LocalTime now = LocalTime.now();
        return now.isAfter(LocalTime.of(9, 0))  
            && now.isBefore(LocalTime.of(18, 0));
    }
}

// 权限校验与审计联动
@PreAuthorize("hasAuthority('DATA_EXPORT') and @auditLogger.logExportAttempt(#request)")
public void exportData(ExportRequest request) {
    // 数据导出逻辑
}

@PreFilter("filterObject.owner == authentication.principal.username")
@PostFilter("filterObject.visibility == 'PUBLIC' or filterObject.owner == authentication.principal.username")
@GetMapping("/documents")
public List<Document> getDocuments(@RequestBody List<Document> docs) {
    return docs;
}

@Component("resourceChecker")
public class ResourceChecker {
    
    public boolean canAccess(Long resourceId, String operation) {
        // 从数据库查询资源权限配置
        // 根据资源ID、操作类型、当前用户等动态判断
        return true; // 示例返回
    }
}

// 使用示例
@PreAuthorize("@resourceChecker.canAccess(#resourceId, 'EDIT')")
public void editResource(Long resourceId) {
    // 编辑资源逻辑
}