001 /*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements. See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership. The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License. You may obtain a copy of the License at
009 *
010 * http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied. See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019 package org.apache.shiro.authz.annotation;
020
021 import java.lang.annotation.ElementType;
022 import java.lang.annotation.Retention;
023 import java.lang.annotation.RetentionPolicy;
024 import java.lang.annotation.Target;
025
026 /**
027 * Requires the currently executing {@link org.apache.shiro.subject.Subject Subject} to have one or more specified roles
028 * in order to execute the annotated method. If they do not have the role(s), the method will not be executed and
029 * an {@link org.apache.shiro.authz.AuthorizationException AuthorizationException} is thrown.
030 * <p/>
031 * For example,
032 * <p/>
033 * <code>@RequiresRoles("aRoleName");<br/>
034 * void someMethod();</code>
035 * <p/>
036 * means <tt>someMethod()</tt> could only be executed by subjects who have been assigned the
037 * 'aRoleName' role.
038 *
039 * <p><b>*Usage Note*:</b> Be careful using this annotation if your application has a <em>dynamic</em>
040 * security model where roles can be added and deleted at runtime. If your application allowed the
041 * annotated role to be deleted during runtime, the method would not be able to
042 * be executed by anyone (at least until a new role with the same name was created again).
043 *
044 * <p>If you require such dynamic functionality, only the
045 * {@link RequiresPermissions RequiresPermissions} annotation makes sense - Permission
046 * types will not change during runtime for an application since permissions directly correspond to how
047 * the application's functionality is programmed (that is, they reflect the application's functionality only, not
048 * <em>who</em> is executing the the functionality).
049 *
050 * @author Jeremy Haile
051 * @author Les Hazlewood
052 * @see org.apache.shiro.subject.Subject#hasRole(String)
053 * @since 0.1
054 */
055 @Target(ElementType.METHOD)
056 @Retention(RetentionPolicy.RUNTIME)
057 public @interface RequiresRoles {
058
059 /**
060 * A single String role name or multiple comma-delimitted role names required in order for the method
061 * invocation to be allowed.
062 */
063 String value();
064
065 }