001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.authz.annotation;
020
021import java.lang.annotation.Documented;
022import java.lang.annotation.ElementType;
023import java.lang.annotation.Retention;
024import java.lang.annotation.RetentionPolicy;
025import java.lang.annotation.Target;
026
027/**
028 * Requires the currently executing {@link org.apache.shiro.subject.Subject Subject} to have all of the
029 * specified roles. If they do not have the role(s), the method will not be executed and
030 * an {@link org.apache.shiro.authz.AuthorizationException AuthorizationException} is thrown.
031 * <p/>
032 * For example,
033 * <p/>
034 * <code>&#64;RequiresRoles("aRoleName");<br/>
035 * void someMethod();</code>
036 * <p/>
037 * means <tt>someMethod()</tt> could only be executed by subjects who have been assigned the
038 * 'aRoleName' role.
039 *
040 * <p><b>*Usage Note*:</b> Be careful using this annotation if your application has a <em>dynamic</em>
041 * security model where roles can be added and deleted at runtime.  If your application allowed the
042 * annotated role to be deleted during runtime, the method would not be able to
043 * be executed by anyone (at least until a new role with the same name was created again).
044 *
045 * <p>If you require such dynamic functionality, only the
046 * {@link RequiresPermissions RequiresPermissions} annotation makes sense - Permission
047 * types will not change during runtime for an application since permissions directly correspond to how
048 * the application's functionality is programmed (that is, they reflect the application's functionality only, not
049 * <em>who</em> is executing the the functionality).
050 *
051 * @see org.apache.shiro.subject.Subject#hasRole(String)
052 * @since 0.1
053 */
054@Target({ElementType.TYPE, ElementType.METHOD})
055@Retention(RetentionPolicy.RUNTIME)
056@Documented
057public @interface RequiresRoles {
058
059    /**
060     * A single String role name or multiple comma-delimited role names required in order for the method
061     * invocation to be allowed.
062     */
063    String[] value();
064
065    /**
066     * The logical operation for the permission check in case multiple roles are specified. AND is the default
067     *
068     * @since 1.1.0
069     */
070    Logical logical() default Logical.AND;
071}