Activiti源码浅析：Activiti的活动授权机制

http://blog.csdn.net/bluejoe2000/article/details/40663419

1. IdentityLink与TaskEntity

An identity link is used to associate a task with a certain identity. For example: - a user can be an assignee (= identity link type) for a task - a group can be a candidate-group (= identity link type) for a task

TaskEntity包含了一系列的IdentityLink操作方法：

[html] view
plaincopy





public IdentityLinkEntity addIdentityLink(String userId, String groupId, String type) {

IdentityLinkEntity identityLinkEntity = new IdentityLinkEntity();

getIdentityLinks().add(identityLinkEntity);

identityLinkEntity.setTask(this);

identityLinkEntity.setUserId(userId);

identityLinkEntity.setGroupId(groupId);

identityLinkEntity.setType(type);

identityLinkEntity.insert();

if (userId != null && processInstanceId != null) {

getProcessInstance().involveUser(userId, IdentityLinkType.PARTICIPANT);

}

return identityLinkEntity;

}

注意，IdentityLink有一个Type，有一些默认的Type：

[java] view
plaincopy





public void addCandidateUser(String userId) {

addIdentityLink(userId, null, IdentityLinkType.CANDIDATE);

}

[html] view
plaincopy





public void addCandidateGroup(String groupId) {

addIdentityLink(null, groupId, IdentityLinkType.CANDIDATE);

}

2. IdentityLink与权限过滤

如下查询语句对应于“用户kermit待签收任务列表”的调用过程：

[html] view
plaincopy





Preparing: select distinct RES.* from AC

T_RU_TASK RES inner join ACT_RU_IDENTITYLINK I on I.TASK_ID_ = RES.ID_ WHERE RES.ASSIGNEE_ is null and I.TYPE_ = 'candidate' and ( I.USER_ID_ = ? or I.GROUP_ID_ IN ( ? , ? ) )

Parameters: kermit(String), admin(String), management(String)

其中admin和management来自于用户群组关系查询接口：

UserEntityManager.findGroupsByUser("kermit")