001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.authz.annotation;
020
021import java.lang.annotation.ElementType;
022import java.lang.annotation.Retention;
023import java.lang.annotation.RetentionPolicy;
024import java.lang.annotation.Target;
025
026/**
027 * Requires the currently executing {@link org.apache.shiro.subject.Subject Subject} to have all of the 
028 * specified roles. If they do not have the role(s), the method will not be executed and
029 * an {@link org.apache.shiro.authz.AuthorizationException AuthorizationException} is thrown.
030 * <p/>
031 * For example,
032 * <p/>
033 * <code>&#64;RequiresRoles("aRoleName");<br/>
034 * void someMethod();</code>
035 * <p/>
036 * means <tt>someMethod()</tt> could only be executed by subjects who have been assigned the
037 * 'aRoleName' role.
038 *
039 * <p><b>*Usage Note*:</b> Be careful using this annotation if your application has a <em>dynamic</em>
040 * security model where roles can be added and deleted at runtime.  If your application allowed the
041 * annotated role to be deleted during runtime, the method would not be able to
042 * be executed by anyone (at least until a new role with the same name was created again).
043 *
044 * <p>If you require such dynamic functionality, only the
045 * {@link RequiresPermissions RequiresPermissions} annotation makes sense - Permission
046 * types will not change during runtime for an application since permissions directly correspond to how
047 * the application's functionality is programmed (that is, they reflect the application's functionality only, not
048 * <em>who</em> is executing the the functionality).
049 *
050 * @see org.apache.shiro.subject.Subject#hasRole(String)
051 * @since 0.1
052 */
053@Target({ElementType.TYPE, ElementType.METHOD})
054@Retention(RetentionPolicy.RUNTIME)
055public @interface RequiresRoles {
056
057    /**
058     * A single String role name or multiple comma-delimited role names required in order for the method
059     * invocation to be allowed.
060     */
061    String[] value();
062    
063    /**
064     * The logical operation for the permission check in case multiple roles are specified. AND is the default
065     * @since 1.1.0
066     */
067    Logical logical() default Logical.AND; 
068}