java - 基于用户角色的反应式 REST API 响应过滤

Question

除了阻止一种基于用户角色的反应性 JSON 响应过滤方式 - 使用带有 @JsonFilter 注释的 Pojos 和覆盖 SimpleBeanPropertyFilter.serializeAsField 的 jackson-databind 吗？

阻塞属性过滤示例：

SecureFieldFilter.class：

public class SecureFieldFilter extends SimpleBeanPropertyFilter {

    @Override
    public void serializeAsField(Object pojo, JsonGenerator jgen, SerializerProvider provider, PropertyWriter writer) throws Exception {

        SecureField secureField = writer.findAnnotation(SecureField.class);

        //TODO: Get user authorities from ReactiveSpringSecurityContext
        //TODO: Filter properties which not mention particular roles in SecureField annotation
        }
    }
}

SecureField 注释：

@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
public @interface SecureField {

    UserAuthority[] value();

}

SecureFieldFilter 配置：

@Configuration
public class SecureFieldFilterConfiguration {

    @Bean
    public Jackson2ObjectMapperBuilderCustomizer addFieldFilters() {
        return jacksonObjectMapperBuilder -> {
            jacksonObjectMapperBuilder.filters(new SimpleFilterProvider().addFilter("securityFilter", new SecureFieldFilter()));
        };
    }

}

Foo.class：

@JsonFilter("securityFilter")
public class Banner {

    private UUID id;

    @NotNull
    @SecureField(value={UserAuthority.ROLE_AGENT})
    private String field1;

    @NotNull
    @SecureField(value = {UserAuthority.ROLE_PLAYER, UserAuthority.ROLE_AGENT})
    private String field2;

...
}

如何以反应方式根据来自 REST API 响应的用户角色过滤某些属性？

标签： javaspring-webfluxjackson-databind