<bean id="usersPermissionsAdvice"
     class="com.thundersoft.metadata.aop.UsersPermissionsAdvice"/>
  <aop:config>
    <!--定义切面 -->
    <aop:aspect id="authAspect" ref="usersPermissionsAdvice">
      <!-- 定义切入点 (配置在com.thundersoft.metadata.web.controller下所有的类在调用之前都会被拦截) -->
      <aop:pointcut
          expression="(execution(* com.thundersoft.metadata.web.controller.*.add*(..)) or
          execution(* com.thundersoft.metadata.web.controller.*.edit*(..)) or
          execution(* com.thundersoft.metadata.web.controller.*.del*(..)) or
          execution(* com.thundersoft.metadata.web.controller.*.update*(..)) or
          execution(* com.thundersoft.metadata.web.controller.*.insert*(..)) or
          execution(* com.thundersoft.metadata.web.controller.*.modif*(..))) or
          execution(* com.thundersoft.metadata.web.controller.*.down*(..))) and (
          !execution(* com.thundersoft.metadata.web.controller.FindPasswordController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.SelfServiceController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.HomeController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.UserStatusController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.DashboardController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.MainController.*(..))))"
          id="authPointCut"/>
      <!--方法被调用之前执行的 -->
      <aop:before method="readOnly"
            pointcut-ref="authPointCut"/>
    </aop:aspect>
  </aop:config>

/**
   * 对只读管理员以及其复合管理员进行aop拦截判断.
   * @param joinPoint 切入点.
   * @throws IOException
   */
  public void readOnly(JoinPoint joinPoint) throws IOException {

    /**
     * 获取被拦截的方法.
     */
    String methodName = joinPoint.getSignature().getName();

    /**
     * 获取被拦截的对象.
     */
    Object object = joinPoint.getTarget();
    logger.info("权限管理aop,方法名称" + methodName);
    HttpServletRequest request =((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
    HttpServletResponse response =((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getResponse();
    String roleFlag = GetLoginUserInfor.getLoginUserRole(request);

    /**
     * 超级管理员
     */
    if (PermissionsLabeled.super_Admin.equals(roleFlag)) {
      return;
    }

    /**
     * 只读管理员做数据更改权限的判断
     */
    if (PermissionsLabeled.reader_Admin.equals(roleFlag)) {
      logger.error("只读管理员无操作权限!");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    }

    /**
     * 部门管理员,且为只读管理员,
     */
    if (PermissionsLabeled.dept_reader_Admin.equals(roleFlag)) {
      if (object instanceof DepartmentController) {
        return;
      }
      if (object instanceof UserController) {
        if (methodName.contains("addAdmin")) {
          response.sendRedirect(request.getContextPath() + "/auth/readOnly");
        }
        if (methodName.contains("deleteAdmin")) {
          response.sendRedirect(request.getContextPath() + "/auth/readOnly");
        }
        if (methodName.contains("updateAdmin")) {
          response.sendRedirect(request.getContextPath() + "/auth/readOnly");
        }
        return;
      }
      if (object instanceof GroupController) {
        return;
      }
      logger.error("部门管理员,且为只读管理员无操作权限!");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    }

    /**
     * 应用管理员,且为只读管理员
     */
    if (PermissionsLabeled.app_reader_Admin.equals(roleFlag)) {
      if (object instanceof AppController) {
        return;
      }
      if (object instanceof AppPolicyController) {
        return;
      }
      logger.error("应用管理员,且为只读管理员无操作权限!");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    }

    /**
     * 部门管理员,且为应用管理员,且为只读管理员
     */
    if (PermissionsLabeled.dept_app_reader_Admin.equals(roleFlag)) {
      if (object instanceof DepartmentController) {
        return;
      }
      if (object instanceof UserController) {
        return;
      }
      if (object instanceof GroupController) {
        return;
      }
      if (object instanceof AppController) {
        return;
      }
      if (object instanceof AppPolicyController) {
        return;
      }
      logger.error("部门管理员,且为应用管理员,且为只读管理员无操作权限");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    }
  }

<aop:config>
    <!--定义切面 -->
    <aop:aspect id="authAspect" ref="usersPermissionsAdvice">
      <!-- 定义切入点 (配置在com.thundersoft.metadata.web.controller下所有的类在调用之前都会被拦截) -->
      <aop:pointcut
          expression="(execution(* com.thundersoft.metadata.web.controller.*.*(..)) and (
          !execution(* com.thundersoft.metadata.web.controller.FindPasswordController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.SelfServiceController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.HomeController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.UserStatusController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.DashboardController.*(..)) and
          !execution(* com.thundersoft.metadata.web.controller.MainController.*(..))))"
          id="appAuthPointCut"/>
      <!--方法被调用之前执行的 -->
      <aop:before method="appDeptAuth"
            pointcut-ref="appAuthPointCut"/>
    </aop:aspect>
  </aop:config>

/**
   * 对应用管理员以及部门管理员进行aop拦截判断.
   * @param joinPoint 切入点.
   * @throws IOException
   */
  public void appDeptAuth(JoinPoint joinPoint) throws IOException {
    /**
     * 获取被拦截的方法.
     */
    String methodName = joinPoint.getSignature().getName();

    /**
     * 获取被拦截的对象.
     */
    Object object = joinPoint.getTarget();
    logger.info("权限管理aop,方法名称",methodName);
    HttpServletRequest request =((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
    HttpServletResponse response =((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getResponse();
    String roleFlag = GetLoginUserInfor.getLoginUserRole(request);

    /**
     * 超级管理员
     */
    if (PermissionsLabeled.super_Admin.equals(roleFlag)) {
      return;
    }

    /**
     * 应用管理员做数据更改权限的判断
     */
    if (PermissionsLabeled.app_Admin.equals(roleFlag)) {
      if (object instanceof AppController) {
        return;
      }
      if (object instanceof AppPolicyController) {
        return;
      }
      logger.error("应用管理员无操作权限");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    } else if (PermissionsLabeled.dept_Admin.equals(roleFlag)) {
      if (object instanceof DepartmentController) {
        return;
      }
      if (object instanceof UserController) {
        return;
      }

      if (object instanceof GroupController) {
        return;
      }
      if ("getAllDepartments".equals(methodName)) {
        return;
      }
      logger.error("应用管理员无操作权限");
      response.sendRedirect(request.getContextPath() + "/auth/readOnly");
    } else {
      return;
    }
  }