Apache Shiro is a mature Java security framework and library, not an end-user application. It provides authentication, authorization, session management, and cryptography through a modular Maven multi-module architecture. The central abstractions are SecurityManager, Subject, Realm, Authenticator, Authorizer, and SessionManager, backed by pluggable implementations such as JDBC, LDAP, Active Directory, and text-based realms. The web module adds servlet filters, filter-chain management, JSP/JSF tags, and path-matching URL security, while support modules integrate with Spring, Spring Boot, Guice, CDI, JAX-RS, AspectJ, Quartz, and Jakarta EE. The crypto modules offer modern password hashing (Argon2, BCrypt), legacy SHA hashing, symmetric ciphers, and hash format serialization. The framework is embeddable via programmatic configuration, annotation-driven AOP interceptors, or the legacy INI-based configuration path, which is now deprecated in favor of environment-based setup. The codebase is heavily tested with unit tests and container-based integration tests, and core interfaces remain small and clean; however, it carries noticeable legacy baggage including deprecated factories, duplicated JSP/JSF tag implementations, mixed mocking frameworks, and numerous support modules that require ongoing maintenance to avoid drift. It has no data pipelines or research components; all data-related code is limited to security data sources, caching, and test fixtures.
RuoYi is a production‑ready Java rapid‑development framework for building enterprise back‑office management systems (CMS, CRM, OA, etc.). It is a monolithic Spring Boot application using Apache Shiro for authentication/authorization, MyBatis for persistence, Thymeleaf for server‑side rendering, and a jQuery/Bootstrap frontend with numerous third‑party plugins. The system provides a complete RBAC module (user, role, department, menu management), dictionary and configuration management, operation and login auditing, online user monitoring, Quartz‑based scheduled tasks, and a Velocity‑powered code generator that produces full CRUD modules from database tables. Additional features include dynamic data source switching, XSS/CSRF protection, captcha, file upload/download, Excel import/export with annotation‑driven mapping, and a demo suite for UI components. The architecture follows a modular Maven structure (admin, common, framework, system, generator, quartz) with a shared common module providing utilities, annotations, and exception hierarchy. While the framework is mature and widely adopted, its frontend stack (jQuery, Bootstrap 3‑era plugins) and use of Shiro represent technical drift compared to modern SPA or Spring Security approaches. The codebase is well‑organized and contains several reusable components, but is tightly coupled to its own conventions and lacks microservice readiness.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
This is a multi-module Spring Boot application for a Chinese-language novel reading and publishing platform (原创文å¦CMS). It comprises four interconnected modules: novel-admin (back-office management with Layui/Shiro RBAC), novel-front (user-facing reader/author portal with JWT auth), novel-crawl (automated content ingestion from external novel sites), and novel-common (shared entities, mappers, utilities). The system provides full CRUD for books, chapters, comments, users, and payments; templated front-end themes (blue, green, orange, dark); Alipay/WeChat integration; AI-assisted writing via Spring AI (SiliconFlow); and a MyBatis-based data layer with Sharding-JDBC for sharding. While functionally rich and actively maintained, the codebase suffers from significant static asset duplication, mixed javax/jakarta imports, and multiple legacy third-party front-end libraries bundled directly.
This repository provides a full-stack demonstration of a permission management system using Spring Boot for the backend and Vue.js for the frontend. Despite its name, it does not use Apache Shiro; instead, it implements a custom, annotation-based permission control via AOP (RequiresPermissions annotation and PermissionAspect) and token-based authentication using Caffeine local cache. The backend is a monolithic Spring Boot 2.3.10 application with MyBatis for database access, serving a REST API. The frontend is a Vue 2 application (based on vueAdmin-template) with dynamic routing and ElementUI, featuring a custom directive for button-level permission checks. The system supports multi-role users, role-based menu and permission assignment, and a clean separation of concerns between backend and frontend permission enforcement. The codebase is well-structured and serves as a clear reference for implementing RBAC-like permission systems in Java+Vue projects, though it is not intended for production use without significant hardening and updates.