授权事件

DeepSeek V3 中英对照 Authorization Events

每当授权被拒绝时，系统会触发一个 AuthorizationDeniedEvent 事件。同时，对于已授予的授权，也可以触发一个 AuthorizationGrantedEvent 事件。

要监听这些事件，您必须先发布一个 AuthorizationEventPublisher。

Spring Security 的 SpringAuthorizationEventPublisher 应该就能满足需求。它通过 Spring 的 ApplicationEventPublisher 来发布授权事件：

Java

@Bean
public AuthorizationEventPublisher authorizationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    return new SpringAuthorizationEventPublisher(applicationEventPublisher);
}

Kotlin

@Bean
fun authorizationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthorizationEventPublisher {
    return SpringAuthorizationEventPublisher(applicationEventPublisher)
}

然后，你可以使用 Spring 的 @EventListener 支持：

Java

@Component
public class AuthenticationEvents {

    @EventListener
    public void onFailure(AuthorizationDeniedEvent failure) {
		// ...
    }
}

Kotlin

@Component
class AuthenticationEvents {

    @EventListener
    fun onFailure(failure: AuthorizationDeniedEvent?) {
        // ...
    }
}

授权授予事件

由于 AuthorizationGrantedEvent 可能产生较多冗余信息，默认情况下不会发布该事件。

事实上，发布这些事件可能需要您自行实现一些业务逻辑，以确保您的应用程序不会被大量杂乱的授权事件淹没。

您可以提供自定义的谓词来筛选成功事件。例如，以下发布者仅发布需要 ROLE_ADMIN 权限的授权授予：

Java

@Bean
AuthorizationEventPublisher authorizationEventPublisher() {
    SpringAuthorizationEventPublisher eventPublisher = new SpringAuthorizationEventPublisher();
    eventPublisher.setShouldPublishEvent((result) -> {
        if (!result.isGranted()) {
            return true;
        }
        if (result instanceof AuthorityAuthorizationDecision decision) {
            Collection<GrantedAuthority> authorities = decision.getAuthorities();
            return AuthorityUtils.authorityListToSet(authorities).contains("ROLE_ADMIN");
        }
        return false;
    });
    return eventPublisher;
}

Kotlin

@Bean
fun authorizationEventPublisher(): AuthorizationEventPublisher {
    val eventPublisher = SpringAuthorizationEventPublisher()
    eventPublisher.setShouldPublishEvent { (result) ->
        if (!result.isGranted()) {
            return true
        }
        if (decision is AuthorityAuthorizationDecision) {
            val authorities = decision.getAuthorities()
            return AuthorityUtils.authorityListToSet(authorities).contains("ROLE_ADMIN")
        }
        return false
    }
    return eventPublisher
}