class PermissionFilter {
        //开启权限过滤
        private boolean enabled = false;
        //越权赋权时处理逻辑
        private UnAuthStrategy unAuthStrategy = UnAuthStrategy.error;

        private Set<String> excludeUsername = new HashSet<>();

        public AuthorizationSettingEntity handleSetting(Authentication authentication,
                                                        AuthorizationSettingEntity setting) {
            if (!enabled || excludeUsername.contains(authentication.getUser().getUsername())) {
                return setting;
            }
            //有全部权限
            if (authentication.hasPermission(setting.getPermission(), setting.getActions())) {
                return setting;
            }
            //交给具体的策略处理
            return unAuthStrategy.handle(authentication, setting);
        }

        public Flux<PermissionEntity> doFilter(Flux<PermissionEntity> flux, Authentication authentication) {<FILL_FUNCTION_BODY>}

        public enum UnAuthStrategy {
            //忽略赋权
            ignore {
                @Override
                public AuthorizationSettingEntity handle(Authentication authentication, AuthorizationSettingEntity setting) {

                    return setting.copy(action -> authentication.hasPermission(setting.getPermission(), action), access -> true);
                }
            },
            //抛出错误
            error {
                @Override
                public AuthorizationSettingEntity handle(Authentication authentication, AuthorizationSettingEntity setting) {
                    Set<String> actions = new HashSet<>(setting.getActions());
                    actions.removeAll(authentication
                                              .getPermission(setting.getPermission())
                                              .map(Permission::getActions)
                                              .orElseGet(Collections::emptySet));

                    throw new AccessDenyException(setting.getPermission(), actions);
                }
            };

            public abstract AuthorizationSettingEntity handle(Authentication authentication,
                                                              AuthorizationSettingEntity setting);
        }
    }

            if (!enabled || excludeUsername.contains(authentication.getUser().getUsername())) {
                return flux;
            }
            return flux
                    .map(entity -> entity
                            .copy(action -> authentication.hasPermission(entity.getId(), action.getAction()),
                                  optionalField -> true))
                    .filter(entity -> !CollectionUtils.isEmpty(entity.getActions()));
        
<no_super_class>