ACL design of dashboard

Issue Description

Version 1.6.0 introduces authorization and it's an awesome feature. That helps dashboard to be more complete.

My discussion here is focused on the actual authorizing design.

Interface Design

First i think here is a little fuzzy on AuthUser. authTarget.

        /**
         * Query whether current user has the specific privilege to the target, the target
         * may be an app name or an ip address, or other destination.
         * <p>
         * This method will use return value to represent  whether user has the specific
         * privileges to the target, but to throw a RuntimeException to represent no auth
         * is also a good way.
         * </p>
         *
         * @param target        the target to check
         * @param privilegeType the privilege type to check
         * @return if current user has the specific privileges to the target, return true,
         * otherwise return false.
         */
        boolean authTarget(String target, PrivilegeType privilegeType);

If throwing an exception is an option it's better to include in declaration like:

 boolean authTarget(String target, PrivilegeType privilegeType) throws RuntimeException;

But i don't think it's a good idea throwing an exception because we have a boolean value returned already to mark it success or fail.

Integrating

For function integrating we can find following lines everywhere:

AuthUser authUser = authService.getAuthUser(request);
authUser.authTarget(app, PrivilegeType.READ_RULE);

It includes two intents:

1. Get the current logged user information
2. Check if he has the specific privilege.

But it's a little inconvenient. I have a proposal on it like:

@AuthAction(privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action() {
}

or

@AuthAction(app = app, privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action() {
}

or even a parent privilege like

@AuthAction(privilege = PrivilegeType.RULES)
@RequestMapping("/rules")
@Controller
public class RulesController() {
}

When you want user information we can inject it by Spring Argument Resolver like:

@AuthAction(app = app, privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action(AuthUser authUser) {
}

I think we can make more discussions.