Deadbolt 2 Java
源http://deadbolt-2-java.herokuapp.com/
Configuration
user拥有下面两种角色：
foo
bar
user有下面一项permissions:
printers.edit
Controller authorisation
保护你的Controller免于未授权使用是一个好的application安全系统的关键因素。
例如
SubjectPresent
这是一个最简单的约束，它请求显示是否有用户登录。
SpecificationResult
@SubjectPresent
public static Result subjectPresent() {
return ok(accessOk.render());
}@SubjectPresent(handler = NoUserDeadboltHandler.class)
public static Result subjectPresent_notLoggedIn() {
return ok(accessOk.render());
}SubjectNotPresent
这个约束请求一个用户都没有登录
SpecificationResult
@SubjectNotPresent
public static Result subjectNotPresent_loggedIn() {
return ok(accessOk.render());
}@SubjectNotPresent(handler = NoUserDeadboltHandler.class)
public static Result subjectNotPresent() {
return ok(accessOk.render());
}Restrict
Restrict使用roles的ANDed集合决定是否能访问action。例如，有 “foo”和”bar”的角色的用户可以访问Restrict-protected的action，这个action指定下面任何一种：
foo
bar
foo AND bar
然而，需要 “foo”, “bar” 和”hurdy”的Restrict 将会拒绝user访问。
SpecificationResult
@Restrict({"foo", "bar"})
public class RestrictController extends Controller@Restrict("foo")
public static Result restrictOne() {
return ok(accessOk.render());
}@Restrict({"foo", "bar"})
public static Result restrictTwo() {
return ok(accessOk.render());
}@Restrict({"foo", "!bar"})
public static Result restrictThree() {
return ok(accessOk.render());
}@Restrict({"hurdy"})
public static Result restrictFour() {
return ok(accessOk.render());
}@CustomRestrict(value = {MyRoles.foo, MyRoles.bar}, config = @Restrict(""))
public static Result customRestrictionOne() {
return ok(accessOk.render());
}@CustomRestrict(value = MyRoles.hurdy, config = @Restrict(""))
public static Result customRestrictionOne() {
return ok(accessOk.render());
}Restrictions
Restrictions 约束允许你使用OR角色组。例如，你可以允许访问匹配下面restrictions中的任何一项的user：
foo
hurdy AND gurdy
SpecificationResult
@Restrictions({@And("foo"),
@And("bar")})
public class RestrictionsController extends Controller@Restrictions({@And({"foo", "bar"})})
public static Result restrictionsOne() {
return ok(accessOk.render());
}@Restrictions({@And({"hurdy", "gurdy"}), @And("foo")})
public static Result restrictionsTwo() {
return ok(accessOk.render());
}@Restrictions({@And("foo"), @And("!bar")})
public static Result restrictionsThree() {
return ok(accessOk.render());
}@Restrictions(@And({"hurdy", "foo"}))
public static Result restrictionsFour() {
return ok(accessOk.render());
}@Restrictions(@And({"foo", "!bar"}))
public static Result restrictionsFive() {
return ok(accessOk.render());
}@CustomRestrictions(value = { @RoleGroup({MyRoles.foo, MyRoles.bar}),
@RoleGroup(MyRoles.hurdy)},
config = @Restrictions({}))
public static Result customRestrictionOne() {
return ok(accessOk.render());
}@CustomRestrictions(value = { @RoleGroup({MyRoles.hurdy, MyRoles.foo}),
@RoleGroup({MyRoles.hurdy, MyRoles.bar})},
config = @Restrictions({}))
public static Result customRestrictionOne() {
return ok(accessOk.render());
}Dynamic
Dynamic 是Deadbolt的最强约束。它强行执行有力的规则。参考整体概述的文档。
在这些例子里面，第一项是action，接下来是相关的DynamicResourceHandler。
SpecificationRuleResult
@Dynamic("pureLuck")
public static Result pureLuck() {
return ok(accessOk.render());
}
public boolean isAllowed(String name,
String meta,
DeadboltHandler deadboltHandler,
Http.Context context) {
return System.currentTimeMillis() % 2 == 0;
}@Dynamic(value = "pureLuck", handler = MyAlternativeDeadboltHandler.class)
public static Result noWayJose() {
return ok(accessOk.render());
}
public boolean checkPermission(String permissionValue,
DeadboltHandler deadboltHandler,
Http.Context ctx) {
// Computer says no
return false;
}@Dynamic(value = "pureLuck", handler = MyAlternativeDeadboltHandler.class)
public static Result noWayJose() {
return ok(accessOk.render());
}
public boolean isAllowed(String name,
String meta,
DeadboltHandler deadboltHandler,
Http.Context context) {
Subject subject = deadboltHandler.getSubject(context);
boolean allowed;
if (DeadboltAnalyzer.hasRole(subject, "admin")) {
allowed = true;
} else {
// a call to view profile is probably a get request, so
// the query string is used to provide info
// See the Deadbolt documentation on why this is harder to do with path parameters
Map queryStrings = context.request().queryString();
String[] requestedNames = queryStrings.get("userName");
allowed = requestedNames != null
&& requestedNames.length == 1
&& ((AuthorisedUser)subject).userName.equals(requestedNames[0]);
}
return allowed;
}@Dynamic(value = "viewProfile")
public static Result viewProfile(String userName) {
return ok(accessOk.render());
}
public boolean isAllowed(String name,
String meta,
DeadboltHandler deadboltHandler,
Http.Context context) {
Subject subject = deadboltHandler.getSubject(context);
boolean allowed;
if (DeadboltAnalyzer.hasRole(subject, "admin")) {
allowed = true;
} else {
// a call to view profile is probably a get request, so
// the query string is used to provide info
// See the Deadbolt documentation on why this is harder to do with path parameters
Map queryStrings = context.request().queryString();
String[] requestedNames = queryStrings.get("userName");
allowed = requestedNames != null
&& requestedNames.length == 1
&& ((AuthorisedUser)subject).userName.equals(requestedNames[0]);
}
return allowed;
}Pattern
Pattern允许你使用正则表达式（RE）决定访问。
SpecificationResult
@Pattern("printers.edit")
public static Result editPrinter() {
return ok(accessOk.render());
}@Pattern("printers.detonate")
public static Result detonatePrinter() {
return ok(accessOk.render());
}@Pattern(value = "(.)*\\.edit", patternType = PatternType.REGEX)
public static Result editPrinterRegex() {
return ok(accessOk.render());
}Unrestricted
使用Unrestricted允许你忽略更宽泛的约束。例如，一个controller使用Dynamic保护，但是controller里面的方法可以不受以上约束，通过@Unrestrcted注解。
SpecificationResult
@Restrict("hurdy")
public class UnrestrictedController extends Controller {
public static Result index() {
return ok(accessOk.render());
}
}@Restrict("hurdy")
public class UnrestrictedController extends Controller {
@Unrestricted
public static Result unrestrictedWithinAConstrainedController() {
return ok(accessOk.render());
}
}Template 授权
Deadbolt tags does not offer any real protected against misuse on your server side, but it does allow you to customise your UI according to the privileges of the current user.
Each tag has an “Or” variant, e.g. restrictOr, that allows you to pass in a alternative body for when authorisation fails.
For each example, the unprotected content is on the left, the Deadbolt tag is in the center and the result of the authorisation is on the right.
subjectPresent
This is one of the simplest constraints in Deadbolt. It simply requires that a user be present (i.e. logged in).
Unprotected contentSpecificationResult
This content should be visible
@subjectPresent() {
This content should be visible
}This content should be visible
This content should NOT be visible
@subjectPresent(new security.NoUserDeadboltHandler()) {
This content should NOT be visible
}This content should be visible
@subjectPresentOr() {
This content should be visible
}{Sorry, no access}This content should be visible
This content should NOT be visible
@subjectPresentOr(new security.NoUserDeadboltHandler()) {
This content should be NOT visible
}{Sorry, no access}Sorry, no access
subjectNotPresent
The counterpart to subjectPresent. This constraint requires that a user isn’t present (i.e. no-one is logged in).
Unprotected contentSpecificationResult
This content should NOT be visible
@subjectNotPresent() {
This content should NOT be visible
}This content should be visible
@subjectNotPresent(new security.NoUserDeadboltHandler) {
This content should be visible
}This content should be visible
This content should NOT be visible
@subjectNotPresentOr() {
This content should NOT be visible
}{Sorry, no access}Sorry, no access
This content should be visible
@subjectNotPresentOr(new security.NoUserDeadboltHandler) {
This content should be visible
}{Sorry, no access}This content should be visible
restrict
restrict uses an ANDed set of roles within an array to determine if a part of a template is rendered. For example, a user with the roles “foo” and “bar” could see a restrict-protected area of template that required any of the following:
foo
bar
foo AND bar
However, a restrict that required “foo”, “bar” and “hurdy” would not render the protected area.
Giving multiple arrays in the list gives the equivalent of the Restrictions controller action.
As a convenience for creating Array[String] instances, you can use the TemplateUtils#as(String…) method.
内容可见
@restrict(la(as(“foo”, “bar”))) {
This content should be visible
}
内容不可见
@restrict(la(as(“foo”, “bar”, “hurdy”))) {
This content should NOT be visible
}
内容可见
@restrict(List(as(“hurdy”), as(“foo”, “bar”))) {
This content should be visible
}
内容可见
@restrictOr(la(as(“foo”, “bar”))) {
This content should be visible
}{Sorry, you’re not allowed to see this}
内容不可见
@restrictOr(la(as(“foo”, “bar”, “hurdy”))) {
This content should NOT be visible
}{Sorry, you’re not allowed to see this}
dynamic
依赖你的luck，内容可见
@dynamic(handler, “pureLuck”) {
This content may be visible, depending on your luck
}
内容不可见
@dynamic(new MyDeadboltHandler(“pureLuck”, “”, new MyAlternativeDynamicResourceHandler())) {
This content should NOT be visible
}
依赖你的luck，内容可见
@dynamicOr(“pureLuck”) {
This content may be visible, depending on your luck
}{Guess you were unlucky}
内容不可见
@dynamicOr(“pureLuck”, “”, new security.MyAlternativeDeadboltHandler()) {
This content should NOT be visible
}{Guess you were unlucky}
pattern
内容可见
@pattern(handler, “printers.edit”) {
This content should be visible
}
内容不可见
@pattern(handler, “printers.foo”) {
This content should not visible
}
内容可见
@pattern(handler, “(.)*\.edit”, PatternType.REGEX) {
This content should not visible
}