permissionList = new ArrayList<>();
+
+ permissionList.addAll(permissions.stream()
.map(info -> {
SimplePermission permission = new SimplePermission();
permission.setId(info.getId());
@@ -88,7 +92,16 @@ public class EmbedAuthenticationProperties {
.build()).collect(Collectors.toSet()));
return permission;
- }).collect(Collectors.toList());
+ })
+ .collect(Collectors.toList()));
+
+ permissionList.addAll(permissionsSimple.entrySet().stream()
+ .map(entry -> {
+ SimplePermission permission = new SimplePermission();
+ permission.setId(entry.getKey());
+ permission.setActions(new HashSet<>(entry.getValue()));
+ return permission;
+ }).collect(Collectors.toList()));
authentication.setPermissions(permissionList);
return authentication;
diff --git a/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/handler/UserAllowPermissionHandler.java b/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/handler/UserAllowPermissionHandler.java
new file mode 100644
index 000000000..68df503aa
--- /dev/null
+++ b/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/handler/UserAllowPermissionHandler.java
@@ -0,0 +1,78 @@
+package org.hswebframework.web.authorization.basic.handler;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.hswebframework.web.authorization.define.AuthorizingContext;
+import org.hswebframework.web.authorization.define.HandleType;
+import org.hswebframework.web.authorization.listener.event.AuthorizingHandleBeforeEvent;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.event.EventListener;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.util.ClassUtils;
+import org.springframework.util.PathMatcher;
+
+import java.util.*;
+
+/**
+ *
+ * hsweb:
+ * authorize:
+ * allows:
+ * users:
+ * admin: *
+ * guest: **.query*
+ * roles:
+ * admin: *
+ *
+ *
+ *
+ * @author zhouhao
+ * @since 3.0.1
+ */
+@ConfigurationProperties("hsweb.authorize")
+public class UserAllowPermissionHandler {
+
+ @Getter
+ @Setter
+ private Map> allows = new HashMap<>();
+
+ private PathMatcher pathMatcher = new AntPathMatcher(".");
+
+ @EventListener
+ public void handEvent(AuthorizingHandleBeforeEvent event) {
+
+ if (allows.isEmpty() || event.getHandleType() == HandleType.DATA) {
+ return;
+ }
+ AuthorizingContext context = event.getContext();
+
+ // class full name.method
+ String path = ClassUtils.getUserClass(context.getParamContext()
+ .getTarget())
+ .getName().concat(".")
+ .concat(context.getParamContext()
+ .getMethod().getName());
+
+ String userId = context.getAuthentication().getUser().getId();
+ boolean allow;
+ allow = Optional.ofNullable(allows.get("users"))
+ .map(users -> users.get(userId))
+ .filter(pattern -> "*".equals(pattern) || pathMatcher.match(pattern, path))
+ .isPresent();
+ if (allow) {
+ event.setAllow(true);
+ return;
+ }
+ allow = context.getAuthentication()
+ .getRoles()
+ .stream()
+ .map(role -> allows.getOrDefault("roles", Collections.emptyMap()).get(role.getId()))
+ .filter(Objects::nonNull)
+ .anyMatch(pattern -> "*".equals(pattern) || pathMatcher.match(pattern, path));
+ if (allow) {
+ event.setAllow(true);
+ return;
+ }
+ }
+
+}
diff --git a/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/web/AuthorizationController.java b/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/web/AuthorizationController.java
index 7282a1dfc..b2c1f1638 100644
--- a/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/web/AuthorizationController.java
+++ b/hsweb-authorization/hsweb-authorization-basic/src/main/java/org/hswebframework/web/authorization/basic/web/AuthorizationController.java
@@ -32,6 +32,7 @@ import org.hswebframework.web.logging.AccessLogger;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.http.MediaType;
+import org.springframework.util.Assert;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
@@ -77,9 +78,8 @@ public class AuthorizationController {
public ResponseMessage