repository·5.0.x·Indexed 27 days ago
https://github.com/hs-web/hsweb-frameworkhsweb4 is a fully reactive administrative management framework built on Spring Boot 2, Spring WebFlux, and R2DBC. It provides a modular approach to building enterprise-grade back-office systems with built-in support for RBAC, reactive CRUD, and system management. Key features include the FastBeanCopier for high-performance bean copying, EnumDict for data dictionary definitions, a comprehensive authorization module for RBAC and data-level permission control, dynamic data source switching, and an AOP-based access logging system.
The hsweb-system module contains the core system functionalities of the framework. Its sub-modules are organized by functional domains.
Key modules include:
hsweb-system-authorization: Handles permission management.hsweb-system-file: Handles file management.hsweb4 is a fully reactive administrative management framework built on top of Spring Boot 2 and Spring WebFlux. It is designed for building modular, extensible, and decoupled (frontend-backend separation) administrative systems.
r2dbc and easy-orm for universal reactive CRUD operations. Supports H2, MySQL, SQL Server, and PostgreSQL.The hsweb-authorization module provides the authorization and authentication management for the entire system. It is divided into two primary components:
The hsweb-starter module integrates common system startup mechanisms for the hsweb framework. It provides support for:
The hsweb-system-authorization module provides a comprehensive permission management system with the following capabilities:
Enable Two-Factor Authentication by configuring application.yml and annotating specific controller methods.
1. Enable in configuration:
hsweb:
authorize:
two-factor:
enable: true2. Apply to controller methods:
Use the @TwoFactor annotation on the target endpoint. Provide a unique identifier (e.g., "update-password") for the verification step.
@PostMapping
@TwoFactor("update-password")
public ResponseMessage<Boolean> updatePassword(String password){
// implementation
}@PostMapping
@TwoFactor("update-password")
public ResponseMessage<Boolean> updatePassword(String password){
//
}@AccessLogger annotation. Provide a functional description as the argument. If you are using Swagger, you can also use the standard Swagger @Api annotation (e.g., @Api(tags="...")) to provide functional descriptions.Data permissions work by intercepting AOP method arguments and reconstructing them based on the user's permission scope.
Requirements:
QueryParamEntity parameter.hsweb-commons-controller.Example Logic:
If a user has permission (org) to query only their own organization and subordinates, the framework intercepts the QueryParamEntity and modifies the SQL condition.
Original client query:
where name like ? or full_name like
Reconstructed query:
where u_id in(?,?,?) and (name like ? or full_name like)
Before using hsweb, you should have a working knowledge of:
Do not clone and modify the entire repository directly. Instead, use hsweb as a Maven dependency. You should select only the specific modules you need for your project. Once released, all modules will be available in the Maven Central Repository.
To use the authorization and permission management features, include the hsweb-system-authorization-starter dependency in your pom.xml file.
<dependency>
<groupId>org.hswebframework.web</groupId>
<artifactId>hsweb-system-authorization-starter</artifactId>
<version>${hsweb.framework.version}</version>
</dependency>To extend the data access control system with custom logic, you must implement two components: a configuration converter and a data access handler. This allows you to transform frontend configuration strings into structured configuration objects and then apply authorization logic during API execution.
Implement the DataAccessConfigConvert interface to define how a specific configuration type is parsed. The isSupport method determines if the converter should handle a given type, action, and config string, while convert transforms the raw string into a DataAccessConfig object.
Implement the DataAccessHandler interface to define the actual authorization logic. The isSupport method checks if the provided DataAccessConfig matches your custom type. The handle method is called during the request intercept; it provides a MethodInterceptorParamContext which contains the method arguments (via getNamedArguments()). Return true to allow the request or false to deny it.
// 1. Implement the converter
@org.springframework.stereotype.Component
public class MyDataAccessConfigConvert implements DataAccessConfigConvert {
@Override
public boolean isSupport(String type, String action, String config) {
return "custom_type".equals(type);
}
@Override
public DataAccessConfig convert(String type, String action, String config) {
MyDataAccessConfig accessConfig = JSON.parseObject(config, MyDataAccessConfig.class);
accessConfig.setAction(action);
accessConfig.setType(type);
return accessConfig;
}
}
// 2. Implement the handler
@org.springframework.stereotype.Component
public class MyDataAccessHandler implements org.hswebframework.web.authorization.access.DataAccessHandler {
@Override
public boolean isSupport(DataAccessConfig access) {
return "custom_type".equals(access.getType());
}
@Override
public boolean handle(DataAccessConfig access, MethodInterceptorParamContext context) {
// Access method arguments via context
Map<String, Object> param = context.getNamedArguments();
// Implement authorization logic here
return true;
}
}To handle user authorization events, implement the UserOnSignIn listener provided by hsweb-authorization-api. This listener reacts to the AuthorizationSuccessEvent after a user successfully authenticates.
Workflow:
AuthorizationSuccessEvent.UserOnSignIn receives the event and retrieves the token_type (defaults to sessionId) and authorization info.token_type.userId from the authorization info into the UserTokenManager.