PreAuthorize

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface PreAuthorize {
    String value();  // SpEL 表达式
}

// Spring Security 在 SpEL 中提供的方法（SecurityExpressionRoot）
hasRole(String role)                    // 是否有 ROLE_xxx
hasAnyRole(String... roles)             // 是否有任一角色
hasAuthority(String authority)          // 是否有指定权限
hasAnyAuthority(String... authorities)  // 是否有任一权限
isAuthenticated()                       // 是否已认证
isFullyAuthenticated()                  // 是否完整认证（非 RememberMe）
isAnonymous()                           // 是否匿名
isRememberMe()                          // 是否 RememberMe 登录
permitAll()                             // 总是 true
denyAll()                               // 总是 false
principal                               // 当前主体
authentication                          // 当前认证对象

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class UserSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("admin").password("{noop}admin").roles("ADMIN")
            .and()
            .withUser("alice").password("{noop}alice").roles("USER")
            .and()
            .withUser("bob").password("{noop}bob").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(withDefaults());
    }
}

@Service
public class UserService {

    // 场景：修改用户信息
    @PreAuthorize("hasRole('ADMIN') or #userDto.username == authentication.name")
    public void updateUser(UserDto userDto) {
        userRepository.save(userDto);
    }
}

public class UserDto {
    private String username;
    private String email;
    // getters/setters
}

@Service
public class UserService {

    @Autowired
    private UserRepository userRepository;

    // 修改用户：ADMIN 可以修改任何人；用户只能修改自己
    @PreAuthorize("hasRole('ADMIN') or #userDto.username == authentication.name")
    public void updateUser(UserDto userDto) {
        userRepository.save(userDto);
    }

    // 删除用户：只有 ADMIN 可以删除，且不能删除自己
    @PreAuthorize("hasRole('ADMIN') and #username != authentication.name")
    public void deleteUser(String username) {
        userRepository.deleteByUsername(username);
    }

    // 修改密码：必须是自己，且新密码不能和旧密码相同
    @PreAuthorize("#username == authentication.name and #newPassword != #oldPassword")
    public void changePassword(String username, String oldPassword, String newPassword) {
        // 修改密码逻辑
    }
}

@Component("permissionService")
public class PermissionService {

    @Autowired
    private UserDepartmentRepository deptRepository;

    // 检查用户是否属于指定部门
    public boolean belongsToDepartment(String username, String deptCode) {
        return deptRepository.existsByUsernameAndDeptCode(username, deptCode);
    }

    // 检查用户是否有文档的审批权限
    public boolean canApproveDocument(String username, Long documentId) {
        Document doc = documentRepository.findById(documentId).orElseThrow();
        return doc.getApprover().equals(username) || 
               deptRepository.isManagerOf(username, doc.getDeptCode());
    }
}

@Service
public class DocumentService {

    // 引用 Bean 方法：只有所属部门成员才能创建
    @PreAuthorize("@permissionService.belongsToDepartment(authentication.name, #document.deptCode)")
    public Document createDocument(Document document) {
        return documentRepository.save(document);
    }

    // 引用 Bean 方法：审批权限判断
    @PreAuthorize("@permissionService.canApproveDocument(authentication.name, #documentId)")
    public void approveDocument(Long documentId) {
        Document doc = documentRepository.findById(documentId).orElseThrow();
        doc.setStatus("APPROVED");
        documentRepository.save(doc);
    }

    // 组合表达式：ADMIN 或审批人
    @PreAuthorize("hasRole('ADMIN') or @permissionService.canApproveDocument(authentication.name, #documentId)")
    public void rejectDocument(Long documentId) {
        Document doc = documentRepository.findById(documentId).orElseThrow();
        doc.setStatus("REJECTED");
        documentRepository.save(doc);
    }
}

@Component("permissionService")
public class PermissionService {

    // 缓存权限结果，避免重复查询
    @Cacheable(value = "userDept", key = "#username + '-' + #deptCode")
    public boolean belongsToDepartment(String username, String deptCode) {
        return deptRepository.existsByUsernameAndDeptCode(username, deptCode);
    }
}

@Service
public class OrderService {
    @PreAuthorize("#orderId == 1")  // 如果编译未保留参数名，可能报错
    public Order getOrder(Long orderId) { ... }
}

// 方案一：编译时保留参数名（推荐）
// Maven 配置：
// <compilerArgs><arg>-parameters</arg></compilerArgs>
// 或 Gradle：compileJava { options.compilerArgs += ['-parameters'] }

// 方案二：使用 @P 或 @Param 注解显式命名
@Service
public class OrderService {
    @PreAuthorize("#id == 1")
    public Order getOrder(@P("id") Long orderId) { ... }
}

// 方案三：使用 args 数组引用（不需要参数名）
@Service
public class OrderService {
    @PreAuthorize("#args[0] == 1")
    public Order getOrder(Long orderId) { ... }
}