boolean isUserHasPerm(String user, String url)

  if (!isUserHasPerm(...))
	response.sendError(403, "Forbidden");

isUserHasPerm接口已经初步实现，？？？现在的问题是Filter好像不是放权限判断的地方？？？，因为签名是这样的：

public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)

其中request 是ServletRequest， 不是HttpServletRequest，
response是ServletResponse，不是HttpServletResponse
这样就没有request.getSession().getAttribute("userinfo")，//得到权限判断的who要素
没有response.sendError() //这样没有权限，该如何处理？
？？？当然可以强行转换，tomcat下也不会cast错误，但始终不是个办法……？？？

-----------------------------------------------
另外，说明一下isUserHasPerm的实现
相关联的对象图


核心是ACL表，实际操作给出role，function，resource三要素，如果ACL表中有记录，说明可以访问，因为三要素唯一确定一条ACL记录（function通过resoure type和operate type确定）

优化后，剩三个表，User,Role,ACL(当然，因为User,Role是多对多，还要一个关联表)
ACL表包含四个字段：
Role, Component, Instance, OP（参考了PostNuke的权限设置）
Component就是resource type,
Instance就是resource
OP就是function

合并进Component和OP，而不是functionID的好处是，可以通过通配符来设置权限，比如设置一个全局的管理权限，只需要一条记录

role=admins, component=*, instance=*, OP=*

另外，OP字段还可以等于DENY，有优先权，如果找到一条匹配的DENY记录，直接就是没有权限了。有了DENY，如果需要赋大部分权限，排除一小部分，也比较容易配置

isUserHasPerm的伪码

(1)
select * from ACL
where Role in (user.getRoles())
  and Component in (url.getComponent, *)
  and Instance in (url.getInst, *)
  and OP = DENY

(2)
if (结果集>=0)
  return false;

(3)
将(1)的OP条件改为
  and OP in (url.getOP, *)

(4)
if (结果集>0)
  return true;
else
  return false;

*注：从url中得到权限判断的要素，当然需要一些规则了，比如
category.do?op=add&id=1
表示component是category
op是add
instance是1
role当然是从session中拿

drop table hive_acl;
drop table hive_account_role;
drop table hive_account;
drop table hive_role;

create table hive_account (
    id int identity,
    account varchar(50) unique not null,
    password varchar(16) not null,
    primary key (id),
);

create table hive_role (
    id int identity,
    role varchar(50) unique not null,
    primary key (id),
);

create table hive_account_role (
    account_id int,
    role_id int,
    primary key (account_id, role_id),
    foreign key (account_id) references hive_account(id),
    foreign key (role_id) references hive_role(id),
);

create table hive_acl (
    role_id int,
    component varchar(50),
    instance varchar(50),
    op varchar(50),
    primary key (role_id, component, instance, op),
    foreign key (role_id) references hive_role(id),
);

insert into hive_account (account, password) values ('admin', 'abc');
insert into hive_account (account, password) values ('amen', 'abc');
insert into hive_account (account, password) values ('anonymous', '');

insert into hive_role (role) values ('admins');
insert into hive_role (role) values ('users');
insert into hive_role (role) values ('guests');

insert into hive_account_role (account_id, role_id) values (1,1);
insert into hive_account_role (account_id, role_id) values (1,2);
insert into hive_account_role (account_id, role_id) values (2,2);
insert into hive_account_role (account_id, role_id) values (3,3);

insert into hive_acl (role_id, component, instance, op) values (1, '*', '*', '*');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', 'manager', 'none');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', '*', 'read');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', 'public', 'write');
insert into hive_acl (role_id, component, instance, op) values (3, 'category', 'public', 'read');

-- 判断是否有op=none的acl记录
declare @account varchar(50);
declare @component varchar(50);
declare @instance varchar(50);
declare @op varchar(50);

select @account = 'anonymous';
select @component = 'category';
select @instance = 'manager';
select @op = 'write';

select * from hive_acl
where role_id in (
        select role_id
        from hive_account_role inner join hive_account
            on hive_account_role.account_id = hive_account.id
        where account = @account
    )
    and component in (@component, '*')
    and instance in (@instance, '*')
    and op ='none'
;


-- 判断是否有匹配的acl记录
declare @account varchar(50);
declare @component varchar(50);
declare @instance varchar(50);
declare @op varchar(50);

select @account = 'amen';
select @component = 'category';
select @instance = 'manager';
select @op = 'write';

select * from hive_acl
where role_id in (
        select role_id
        from hive_account_role inner join hive_account
            on hive_account_role.account_id = hive_account.id
        where account = @account
    )
    and component in (@component, '*')
    and instance in (@instance, '*')
    and op in (@op, '*')
;

public interface PermissionManager {

    public boolean isUserHasPerm(HttpServletRequest request);

}

public class PermissionFilter implements Filter {
    public void doFilter(
        ServletRequest request,
        ServletResponse response,
        FilterChain filterChain)
        throws IOException, ServletException {

        try {
            HttpServletRequest req = (HttpServletRequest)request;
            if (!HiveFactory.getDefaultHive().getPermissionManager().isUserHasPerm(req)) {
            	HttpServletResponse rep = (HttpServletResponse)response;
            	rep.sendError(403);
            }

        } catch (Exception e) {
        }

        try {

            filterChain.doFilter(request, response);
        } catch (Exception e) {
        }
    }
}

public class PermissionManagerImpl implements PermissionManager {

    public boolean isUserHasPerm(HttpServletRequest request) {
        HttpSession session = request.getSession();
        Account user = (Account)session.getAttribute("userinfo");
        if (user == null)
            user =
                HiveFactory
                    .getDefaultHive()
                    .getUserManager()
                    .getAnonymousUser();

        String component, instance, op;
        // get component from URI
        {
            String uri = request.getRequestURI();
            int i, j;
            i = uri.lastIndexOf("/");
            j = uri.indexOf(".do", i);
            component = uri.substring(i+1, j).toLowerCase();
        }
        // get instance
        instance = request.getParameter("id");
        // get op
        op = request.getParameter("op");
        return isUserHasPerm(user.getAccount(), component, instance, op);
    }


    private boolean isUserHasPerm(
        String account,
        String component,
        String instance,
        String op) {
        try {
            Connection cn = HiveFactory.getDefaultHive().getConnection();
            if (cn == null)
                return false;
            String sql;
            PreparedStatement pstm;
            ResultSet rs;
            int count;

            sql =
                "select count(*) from hive_acl"
                    + " where role_id in ("
                    + "        select role_id"
                    + "        from hive_account_role inner join hive_account"
                    + "            on hive_account_role.account_id = hive_account.id"
                    + "        where account = ?"
                    + "    )"
                    + "    and component in (?, '*')"
                    + "    and instance in (?, '*')"
                    + "    and op ='none'";
            pstm = cn.prepareStatement(sql);
            pstm.setString(1, account);
            pstm.setString(2, component);
            pstm.setString(3, instance);
            rs = pstm.executeQuery();
            rs.next();
            count = rs.getInt(1);
            if (count >= 1) {
                cn.close();
                return false;
            }

            sql =
                "select count(*) from hive_acl"
                    + " where role_id in ("
                    + "        select role_id"
                    + "        from hive_account_role inner join hive_account"
                    + "            on hive_account_role.account_id = hive_account.id"
                    + "        where account = ?"
                    + "    )"
                    + "    and component in (?, '*')"
                    + "    and instance in (?, '*')"
                    + "    and op in (?, '*')";
            pstm = cn.prepareStatement(sql);
            pstm.setString(1, account);
            pstm.setString(2, component);
            pstm.setString(3, instance);
            pstm.setString(4, op);
            rs = pstm.executeQuery();
            rs.next();
            count = rs.getInt(1);

            cn.close();
            if (count == 0) {
                return false;
            }
            return true;

        } catch (SQLException e) {
            e.printStackTrace();
            return false;
        }
    }

}

<web-app>
  <filter>
    <filter-name>permissionfilter</filter-name>
    <filter-class>com.stalent.hive.permission.PermissionFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>permissionfilter</filter-name>
    <url-pattern>/secu/*</url-pattern>
  </filter-mapping>

insert into hive_acl (role_id, component, instance, op) values (1, '*', '*', '*');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', 'manager', 'none');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', '*', 'read');
insert into hive_acl (role_id, component, instance, op) values (2, 'category', 'public', 'write');
insert into hive_acl (role_id, component, instance, op) values (3, 'category', 'public', 'read');