How to Implement StpInterface in Sa-Token for RBAC Permission Control

·1 views

Sa-Token, a Java authentication framework, requires developers to implement the StpInterface by overriding two key methods: getPermissionList and getRoleList. This is necessary because Sa-Token has no built-in knowledge of a project's database structure, so developers must define how permissions and roles are retrieved. The implementation involves creating a StpInterfaceImpl component that queries user-specific permission and role codes from the database using custom service methods. SQL queries use JOIN operations across user-role and role-permission tables to fetch distinct, active records tied to a given user ID. Once configured, access control becomes straightforward through annotations such as @SaCheckLogin, @SaCheckPermission, and @SaCheckRole.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

oxlint outpaces ESLint by 13x on Vue core, even with type-aware rules enabled

A developer benchmarked ESLint and oxlint against Vue's core repository — 445 TypeScript files totalling around 150,000 lines — using both syntactic and type-aware rule sets. ESLint completed the plain syntactic pass in 4.4 seconds and climbed to 12 seconds when type-aware rules were enabled, requiring the TypeScript compiler to run first. oxlint, a Rust-based linter built by VoidZero — the company founded by Vue and Vite creator Evan You — finished the syntactic pass in just 0.24 seconds, with its internal engine time recorded at 75 milliseconds. When oxlint's own type-aware mode was enabled via the --type-aware flag, it completed the same class of analysis in 0.9 seconds, roughly 13 times faster than ESLint's equivalent pass. The author noted that while the rule sets are not identical between the two tools, the results challenge the assumption that oxlint's speed comes from skipping expensive checks rather than from genuine performance gains.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a deprecated cryptographic key exposed a flaw in schema validation design

A developer encountered a validation failure after adding a retired signing key whose scheme was no longer in the accepted set. Rather than widening the live set or discarding the old key, the solution was to introduce a separate 'schemes_retired' field, keeping the two sets distinct by capability rather than by time. The published specification was updated by retiring the old claim and adding a new scoped one alongside it, preserving an auditable record of the change. A pre-existing audit tool flagged the retired key as a violation, but this was logged as a known gap rather than silently patched, to avoid masking an underlying design flaw. The episode highlighted how naming conventions and set boundaries that appear cosmetic can carry real downstream consequences for counters, audits, and published guarantees.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Single Accuracy Score Can't Measure Bot Detection's Real Cost

Bot detection systems that report high overall accuracy can still cause significant harm by wrongly blocking legitimate users, a problem known as false positives. The consequences vary sharply by route — a blocked checkout interrupts revenue, while a failed password reset locks out a real customer. Because most traffic on consumer-facing apps is legitimate, a detector can appear 99.7% accurate while still mishandling thousands of genuine requests daily. Experts recommend evaluating three separate metrics — precision, recall, and false-positive rate — rather than relying on a single aggregate score. Different enforcement actions such as hard blocks, challenges, and monitoring should each be governed by different thresholds based on the cost of each type of error.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Authentication in 2026 Requires Layered Stack, Not a Single Protocol

As AI agents grow more complex, experts warn that no single protocol can handle their full authentication needs. A 2026 IETF Internet-Draft proposed a multi-layer architecture covering agent credentials, delegated user authority, workload identity, authorization, and audit trails. Google separately announced the open Agentic Resource Discovery (ARD) specification to help agents find and verify agentic capabilities without relying on hard-coded endpoints. Together, ARD, Web Bot Auth, OAuth, and workload identity standards each address distinct gaps in the agent identity chain. Collapsing these layers into a single API key, experts note, eliminates the audit trail and exposes systems to serious security risks.

0 comments Read more at DEV Community