shiro 注释在 grails 中不起作用。有人可以建议我有什么问题吗？

Question

当我使用@RequiresPermissions 时，我得到了无法解析符号“RequiresPermissions”的错误。我已经导入了org.apache.shiro.authz.annotation.RequiresPermissions。 注解用作@RequiresPermissions("module:books:list")

我的授权类

class AuthController {

    def shiroSecurityManager

    def index = { redirect(action: "login", params: params) }

    def login = {
        return [ username: params.username, rememberMe: (params.rememberMe != null), targetUri: params.targetUri ]
    }

    def signIn = {
        def authToken = new UsernamePasswordToken(params.username, params.password as String)

        // Support for "remember me"
        if (params.rememberMe) {
            authToken.rememberMe = true
        }

        // If a controller redirected to this page, redirect back
        // to it. Otherwise redirect to the root URI.
        def targetUri = params.targetUri ?: "/"

        // Handle requests saved by Shiro filters.
        SavedRequest savedRequest = WebUtils.getSavedRequest(request)
        if (savedRequest) {
            targetUri = savedRequest.requestURI - request.contextPath
            if (savedRequest.queryString) targetUri = targetUri + '?' + savedRequest.queryString
        }

        try{
            // Perform the actual login. An AuthenticationException
            // will be thrown if the username is unrecognised or the
            // password is incorrect.
            SecurityUtils.subject.login(authToken)

            log.info "Redirecting to '${targetUri}'."
            redirect(uri: targetUri)
        }
        catch (AuthenticationException ex){
            // Authentication failed, so display the appropriate message
            // on the login page.
            log.info "Authentication failure for user '${params.username}'."
            flash.message = message(code: "login.failed")

            // Keep the username and "remember me" setting so that the
            // user doesn't have to enter them again.
            def m = [ username: params.username ]
            if (params.rememberMe) {
                m["rememberMe"] = true
            }

            // Remember the target URI too.
            if (params.targetUri) {
                m["targetUri"] = params.targetUri
            }

            // Now redirect back to the login page.
            redirect(action: "login", params: m)
        }
    }

    def signOut = {
        // Log the user out of the application.
        SecurityUtils.subject?.logout()
        webRequest.getCurrentRequest().session = null

        // For now, redirect back to the home page.
        redirect(uri: "/")
    }

    def unauthorized = {
        render "You do not have permission to access this page."
    }
}

我的应用程序运行但当我使用我设置的用户登录时，它直接将我发送到未经授权的页面。我已授予用户一些权限。

Answer 1

如果您查看 the Javadoc 的注释（或源代码），您会发现它允许分配给类型（类级别）和方法（@Target(value={TYPE,METHOD})）。您将控制器操作定义为闭包，这在 Grails 2.0+ 中仍受支持，但现在首选方法。您不能在闭包上使用该注解，因为即使 Grails 和 Groovy 允许您像方法一样使用它们，它们也不是方法。如果Target 注释除了包含其他类型之外还包含FIELD，它会起作用，但它不会因为Shiro 库不直接支持Grails 控制器中的闭包。

因此，将所有操作从闭包更改为方法，例如

def index() { redirect(action: "login", params: params) }

def login() {
   ...
}

....

然后你可以注释它们。