授权接口设计

说明

实现基本功能

1. 登录token签名
2. 用户身份认证（验签）
3. 资源访问权限授权

不限于具体技术，支持Shiro+JWT实现，也可以自己实现，框架提供自实现抽象类（最少依赖）
https://github.com/sparrowzoo/sparrow-protocol/blob/develop/src/main/java/com/sparrow/protocol/AuthorizingSupport.java

接口定义如下：

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.sparrow.protocol;

/**
 * 谁证授权接口
 * @author harry
 */
public interface AuthorizingSupport {
    /**
     * 签名(登录)
     *
     * @param login login token 
     * @param secret user's password
     * @return
     */
    String sign(LoginToken login, String secret);

    /**
     * 认证，需要验证当前token所在设备
     * 用户password 需要在token中解析
     * @param permission 
     * @return
     */
    LoginToken authenticate(String token, String deviceId);

    /**
     * 授权某资源
     *
     * @param user
     * @param url
     * @param code
     * @return
     * @throws BusinessException
     */
    boolean isAuthorized(LoginToken user,
                         String url, String code) throws BusinessException;
}

参考资料

1. https://jwt.io/introduction
   

   JWT结构示例

2. https://shiro.apache.org