Spring ACL 是一个好的 ACL 实现吗 [关闭]

java
public class Product {
    private Long id;
    private String name;
    private String description;
    // getters and setters
}
public enum Permission {
    READ, WRITE, DELETE
}

java
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class AclConfig extends GlobalMethodSecurityConfiguration {
    @Autowired
    private DataSource dataSource;
    @Autowired
    private DefaultPermissionEvaluator permissionEvaluator;
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(permissionEvaluator);
        return expressionHandler;
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication().dataSource(dataSource);
    }
    @Bean
    public JdbcMutableAclService aclService() {
        return new JdbcMutableAclService(dataSource, new DefaultLookupStrategy(dataSource, new SimpleJdbcCache()));
    }
    @Bean
    public JdbcMutableAclService aclService() {
        return new JdbcMutableAclService(dataSource, new DefaultLookupStrategy(dataSource, new SimpleJdbcCache()));
    }
    @Bean
    public MethodSecurityExpressionHandler expressionHandler() {
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setPermissionEvaluator(permissionEvaluator);
        return handler;
    }
    @Bean
    public DefaultPermissionEvaluator permissionEvaluator() {
        return new DefaultPermissionEvaluator(aclService());
    }
}

java
@Service
public class ProductService {
    @PreAuthorize("hasPermission(#productId, 'com.example.Product', 'READ')")
    public Product getProduct(Long productId) {
        // 查询产品信息
    }
    @PreAuthorize("hasPermission(#productId, 'com.example.Product', 'WRITE')")
    public void updateProduct(Long productId, Product product) {
        // 更新产品信息
    }
    @PreAuthorize("hasPermission(#productId, 'com.example.Product', 'DELETE')")
    public void deleteProduct(Long productId) {
        // 删除产品
    }
}