Question

I have some actions that requires a specific user permission to be accessed, so I created a method annotation @RequiredPermission and a interceptor to verify if the method that is going to be executed have or not the annotation and if it have verify if the logged user have the permission.

The problem is that I don’t know how to get this information from ActionInvocation and neither from ActionContext.

I’m sure that should be one way to do it, cause if not I’d say its probably a not good framework to work with.

Any tip?

Answer 1

The information you need is contained in the ActionProxy, available via ActionInvocation.getProxy().

Once you have the proxy, you have access to the action itself (from the ActionInvocation) and the method name (ActionProxy.getMethod()) as a string.

From then on out it’s normal Java reflection.

Method method = action.getClass().getDeclaredMethod(actionmethod);
RequiredPermission permission = method.getAnnotation(RequiredPermission.class);
if (sessionUser.inRoles(permission.getRoles()) {
    return invocation.invoke();
}

return Constants.LOGIN_REQUIRED_RESULT;

Or however you want to handle the actual logic.