4670101279
1 year ago
17 changed files with 281 additions and 45 deletions
@ -0,0 +1,24 @@
@@ -0,0 +1,24 @@
|
||||
package com.ruoyi.common.annotation; |
||||
|
||||
import java.lang.annotation.*; |
||||
|
||||
/** |
||||
* 数据权限过滤注解 |
||||
* |
||||
* @author ruoyi |
||||
*/ |
||||
@Target(ElementType.METHOD) |
||||
@Retention(RetentionPolicy.RUNTIME) |
||||
@Documented |
||||
public @interface DeptDataScope |
||||
{ |
||||
/** |
||||
* 部门表的别名 |
||||
*/ |
||||
public String deptAlias() default ""; |
||||
|
||||
/** |
||||
* 用户表的别名 |
||||
*/ |
||||
public String userAlias() default ""; |
||||
} |
||||
@ -0,0 +1,166 @@
@@ -0,0 +1,166 @@
|
||||
package com.ruoyi.framework.aspectj; |
||||
|
||||
import com.ruoyi.common.annotation.DataScope; |
||||
import com.ruoyi.common.annotation.DeptDataScope; |
||||
import com.ruoyi.common.core.domain.BaseEntity; |
||||
import com.ruoyi.common.core.domain.entity.SysRole; |
||||
import com.ruoyi.common.core.domain.entity.SysUser; |
||||
import com.ruoyi.common.core.domain.model.LoginUser; |
||||
import com.ruoyi.common.utils.SecurityUtils; |
||||
import com.ruoyi.common.utils.StringUtils; |
||||
import org.aspectj.lang.JoinPoint; |
||||
import org.aspectj.lang.annotation.Aspect; |
||||
import org.aspectj.lang.annotation.Before; |
||||
import org.springframework.stereotype.Component; |
||||
|
||||
import java.util.Map; |
||||
|
||||
/** |
||||
* 数据过滤处理 |
||||
* |
||||
* @author ruoyi |
||||
*/ |
||||
@Aspect |
||||
@Component |
||||
public class DeptDataScopeAspect |
||||
{ |
||||
/** |
||||
* 全部数据权限 |
||||
*/ |
||||
public static final String DATA_SCOPE_ALL = "1"; |
||||
|
||||
/** |
||||
* 自定数据权限 |
||||
*/ |
||||
public static final String DATA_SCOPE_CUSTOM = "2"; |
||||
|
||||
/** |
||||
* 部门数据权限 |
||||
*/ |
||||
public static final String DATA_SCOPE_DEPT = "3"; |
||||
|
||||
/** |
||||
* 部门及以下数据权限 |
||||
*/ |
||||
public static final String DATA_SCOPE_DEPT_AND_CHILD = "4"; |
||||
|
||||
/** |
||||
* 仅本人数据权限 |
||||
*/ |
||||
public static final String DATA_SCOPE_SELF = "5"; |
||||
|
||||
/** |
||||
* 数据权限过滤关键字 |
||||
*/ |
||||
public static final String DATA_SCOPE = "dataScope"; |
||||
|
||||
@Before("@annotation(controllerDataScope)") |
||||
public void doBefore(JoinPoint point, DeptDataScope controllerDataScope) throws Throwable |
||||
{ |
||||
clearDataScope(point); |
||||
handleDataScope(point, controllerDataScope); |
||||
} |
||||
|
||||
protected void handleDataScope(final JoinPoint joinPoint, DeptDataScope controllerDataScope) |
||||
{ |
||||
// 获取当前的用户
|
||||
LoginUser loginUser = SecurityUtils.getLoginUser(); |
||||
if (StringUtils.isNotNull(loginUser)) |
||||
{ |
||||
SysUser currentUser = loginUser.getUser(); |
||||
// 如果是超级管理员，则不过滤数据
|
||||
if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin()) |
||||
{ |
||||
dataScopeFilter(joinPoint, currentUser, controllerDataScope.deptAlias(), |
||||
controllerDataScope.userAlias()); |
||||
} |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* 数据范围过滤 |
||||
* |
||||
* @param joinPoint 切点 |
||||
* @param user 用户 |
||||
* @param userAlias 别名 |
||||
*/ |
||||
public static void dataScopeFilter(JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias) |
||||
{ |
||||
StringBuilder sqlString = new StringBuilder(); |
||||
|
||||
|
||||
for (SysRole role : user.getRoles()) |
||||
{ |
||||
String dataScope = role.getDataScope(); |
||||
if (DATA_SCOPE_ALL.equals(dataScope)) |
||||
{ |
||||
sqlString = new StringBuilder(); |
||||
break; |
||||
} |
||||
else if (DATA_SCOPE_CUSTOM.equals(dataScope)) |
||||
{ |
||||
if(StringUtils.isNotBlank(deptAlias)){ |
||||
sqlString.append(StringUtils.format( |
||||
" OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias, |
||||
role.getRoleId())); |
||||
}else{ |
||||
sqlString.append(StringUtils.format( |
||||
" OR dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", role.getRoleId())); |
||||
} |
||||
} |
||||
else if (DATA_SCOPE_DEPT.equals(dataScope)) |
||||
{ |
||||
if(StringUtils.isNotBlank(deptAlias)){ |
||||
sqlString.append(StringUtils.format(" OR {}.dept_id = {} ", deptAlias, user.getDeptId())); |
||||
}else{ |
||||
sqlString.append(StringUtils.format(" OR dept_id = {} ", user.getDeptId())); |
||||
} |
||||
} |
||||
else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope)) |
||||
{ |
||||
if(StringUtils.isNotBlank(deptAlias)){ |
||||
sqlString.append(StringUtils.format( |
||||
" OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )", |
||||
deptAlias, user.getDeptId(), user.getDeptId())); |
||||
}else{ |
||||
sqlString.append(StringUtils.format( |
||||
" OR dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )", |
||||
user.getDeptId(), user.getDeptId())); |
||||
} |
||||
} |
||||
else if (DATA_SCOPE_SELF.equals(dataScope)) |
||||
{ |
||||
if (StringUtils.isNotBlank(userAlias)) |
||||
{ |
||||
sqlString.append(StringUtils.format(" OR {}.user_id = {} ", userAlias, user.getUserId())); |
||||
} |
||||
else |
||||
{ |
||||
// 数据权限为仅本人且没有userAlias别名不查询任何数据
|
||||
sqlString.append(" OR 1=0 "); |
||||
} |
||||
} |
||||
} |
||||
|
||||
if (StringUtils.isNotBlank(sqlString.toString())) |
||||
{ |
||||
Map<String,Object> params = (Map<String, Object>) joinPoint.getArgs()[0]; |
||||
if (params != null) |
||||
{ |
||||
params.put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")"); |
||||
} |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* 拼接权限sql前先清空params.dataScope参数防止注入 |
||||
*/ |
||||
private void clearDataScope(final JoinPoint joinPoint) |
||||
{ |
||||
Map<String,Object> params = (Map<String, Object>) joinPoint.getArgs()[0]; |
||||
if (params != null) |
||||
{ |
||||
params.put(DATA_SCOPE, ""); |
||||
} |
||||
} |
||||
} |
||||
Loading…
Reference in new issue