From 044ae6c4ea5bc095625183625bb64f5726aaa90a Mon Sep 17 00:00:00 2001 From: LQS <2506203757@qq.com> Date: Wed, 24 Jul 2024 20:46:04 +0800 Subject: [PATCH] =?UTF-8?q?=E5=88=9D=E5=A7=8B=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .idea/.gitignore | 8 + .idea/misc.xml | 18 +++ pom.xml | 27 ++++ .../datascope/annotation/DataScope.java | 28 ++++ .../datascope/aspect/DataScopeAspect.java | 149 ++++++++++++++++++ ...ot.autoconfigure.AutoConfiguration.imports | 1 + ...ot.autoconfigure.AutoConfiguration.imports | 1 + .../datascope/annotation/DataScope.class | Bin 0 -> 582 bytes .../datascope/aspect/DataScopeAspect.class | Bin 0 -> 5858 bytes target/cloud-common-datascope-3.6.3.jar | Bin 0 -> 6127 bytes target/maven-archiver/pom.properties | 5 + .../compile/default-compile/createdFiles.lst | 2 + .../compile/default-compile/inputFiles.lst | 2 + 13 files changed, 241 insertions(+) create mode 100644 .idea/.gitignore create mode 100644 .idea/misc.xml create mode 100644 pom.xml create mode 100644 src/main/java/com/muyu/common/datascope/annotation/DataScope.java create mode 100644 src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java create mode 100644 src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports create mode 100644 target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports create mode 100644 target/classes/com/muyu/common/datascope/annotation/DataScope.class create mode 100644 target/classes/com/muyu/common/datascope/aspect/DataScopeAspect.class create mode 100644 target/cloud-common-datascope-3.6.3.jar create mode 100644 target/maven-archiver/pom.properties create mode 100644 target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst create mode 100644 target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..9e1cc11 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,18 @@ + + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..a7681bb --- /dev/null +++ b/pom.xml @@ -0,0 +1,27 @@ + + + + com.muyu + cloud-common + 3.6.3 + + 4.0.0 + + cloud-common-datascope + + + cloud-common-datascope权限范围 + + + + + + + com.muyu + cloud-common-security + + + + diff --git a/src/main/java/com/muyu/common/datascope/annotation/DataScope.java b/src/main/java/com/muyu/common/datascope/annotation/DataScope.java new file mode 100644 index 0000000..498f06b --- /dev/null +++ b/src/main/java/com/muyu/common/datascope/annotation/DataScope.java @@ -0,0 +1,28 @@ +package com.muyu.common.datascope.annotation; + +import java.lang.annotation.*; + +/** + * 数据权限过滤注解 + * + * @author muyu + */ +@Target(ElementType.METHOD) +@Retention(RetentionPolicy.RUNTIME) +@Documented +public @interface DataScope { + /** + * 部门表的别名 + */ + public String deptAlias () default ""; + + /** + * 用户表的别名 + */ + public String userAlias () default ""; + + /** + * 权限字符（用于多个角色匹配符合要求的权限）默认根据权限注解@RequiresPermissions获取，多个权限用逗号分隔开来 + */ + public String permission () default ""; +} diff --git a/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java b/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java new file mode 100644 index 0000000..3d66b0d --- /dev/null +++ b/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java @@ -0,0 +1,149 @@ +package com.muyu.common.datascope.aspect; + +import com.muyu.common.core.context.SecurityContextHolder; +import com.muyu.common.core.text.Convert; +import com.muyu.common.core.utils.StringUtils; +import com.muyu.common.core.web.domain.BaseEntity; +import com.muyu.common.datascope.annotation.DataScope; +import com.muyu.common.security.utils.SecurityUtils; +import com.muyu.common.system.domain.SysRole; +import com.muyu.common.system.domain.SysUser; +import com.muyu.common.system.domain.LoginUser; +import org.aspectj.lang.JoinPoint; +import org.aspectj.lang.annotation.Aspect; +import org.aspectj.lang.annotation.Before; +import org.springframework.stereotype.Component; + +import java.util.ArrayList; +import java.util.List; + +/** + * 数据过滤处理 + * + * @author muyu + */ +@Aspect +@Component +public class DataScopeAspect { + /** + * 全部数据权限 + */ + public static final String DATA_SCOPE_ALL = "1"; + + /** + * 自定数据权限 + */ + public static final String DATA_SCOPE_CUSTOM = "2"; + + /** + * 部门数据权限 + */ + public static final String DATA_SCOPE_DEPT = "3"; + + /** + * 部门及以下数据权限 + */ + public static final String DATA_SCOPE_DEPT_AND_CHILD = "4"; + + /** + * 仅本人数据权限 + */ + public static final String DATA_SCOPE_SELF = "5"; + + /** + * 数据权限过滤关键字 + */ + public static final String DATA_SCOPE = "dataScope"; + + /** + * 数据范围过滤 + * + * @param joinPoint 切点 + * @param user 用户 + * @param deptAlias 部门别名 + * @param userAlias 用户别名 + * @param permission 权限字符 + */ + public static void dataScopeFilter (JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias, String permission) { + StringBuilder sqlString = new StringBuilder(); + List conditions = new ArrayList(); + + for (SysRole role : user.getRoles()) { + String dataScope = role.getDataScope(); + if (!DATA_SCOPE_CUSTOM.equals(dataScope) && conditions.contains(dataScope)) { + continue; + } + if (StringUtils.isNotEmpty(permission) && StringUtils.isNotEmpty(role.getPermissions()) + && !StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission))) { + continue; + } + if (DATA_SCOPE_ALL.equals(dataScope)) { + sqlString = new StringBuilder(); + conditions.add(dataScope); + break; + } else if (DATA_SCOPE_CUSTOM.equals(dataScope)) { + sqlString.append(StringUtils.format( + " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias, + role.getRoleId())); + } else if (DATA_SCOPE_DEPT.equals(dataScope)) { + sqlString.append(StringUtils.format(" OR {}.dept_id = {} ", deptAlias, user.getDeptId())); + } else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope)) { + sqlString.append(StringUtils.format( + " OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )", + deptAlias, user.getDeptId(), user.getDeptId())); + } else if (DATA_SCOPE_SELF.equals(dataScope)) { + if (StringUtils.isNotBlank(userAlias)) { + sqlString.append(StringUtils.format(" OR {}.user_id = {} ", userAlias, user.getUserId())); + } else { + // 数据权限为仅本人且没有userAlias别名不查询任何数据 + sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias)); + } + } + conditions.add(dataScope); + } + + // 多角色情况下，所有角色都不包含传递过来的权限字符，这个时候sqlString也会为空，所以要限制一下,不查询任何数据 + if (StringUtils.isEmpty(conditions)) { + sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias)); + } + + if (StringUtils.isNotBlank(sqlString.toString())) { + Object params = joinPoint.getArgs()[0]; + if (StringUtils.isNotNull(params) && params instanceof BaseEntity) { + BaseEntity baseEntity = (BaseEntity) params; + baseEntity.getParams().put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")"); + } + } + } + + @Before("@annotation(controllerDataScope)") + public void doBefore (JoinPoint point, DataScope controllerDataScope) throws Throwable { + clearDataScope(point); + handleDataScope(point, controllerDataScope); + } + + protected void handleDataScope (final JoinPoint joinPoint, DataScope controllerDataScope) { + // 获取当前的用户 + LoginUser loginUser = SecurityUtils.getLoginUser(); + if (StringUtils.isNotNull(loginUser)) { + SysUser currentUser = loginUser.getSysUser(); + // 如果是超级管理员，则不过滤数据 + if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin()) { + String permission = StringUtils.defaultIfEmpty(controllerDataScope.permission(), SecurityContextHolder.getPermission()); + dataScopeFilter(joinPoint, currentUser, controllerDataScope.deptAlias(), + controllerDataScope.userAlias(), permission); + } + } + } + + /** + * 拼接权限sql前先清空params.dataScope参数防止注入 + */ + private void clearDataScope (final JoinPoint joinPoint) { + Object params = joinPoint.getArgs()[0]; + if (StringUtils.isNotNull(params) && params instanceof BaseEntity) { + BaseEntity baseEntity = (BaseEntity) params; + baseEntity.getParams().put(DATA_SCOPE, ""); + } + } +} diff --git a/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports new file mode 100644 index 0000000..8f4967b --- /dev/null +++ b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -0,0 +1 @@ +com.muyu.common.datascope.aspect.DataScopeAspect diff --git a/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports new file mode 100644 index 0000000..8f4967b --- /dev/null +++ b/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -0,0 +1 @@ +com.muyu.common.datascope.aspect.DataScopeAspect diff --git a/target/classes/com/muyu/common/datascope/annotation/DataScope.class b/target/classes/com/muyu/common/datascope/annotation/DataScope.class new file mode 100644 index 0000000000000000000000000000000000000000..ff3a9fec38445384d49f029922b46e4146c74fbd GIT binary patch literal 582 zcmaix%}xR_6opSg7)3=;{972*1!mGLP0emRq zoy0I`NL)1SJ^9Y*N&ETr{sG_yCl(30$US`Ojj$J2sEy)A9BOU#44C}1nN2O z(3?!P5db^WgyJ7(C8F3@Ny5DZDx)xsJ-Stz1gguL?JQd0beIN4`ShX^HP)18bAhv! z>sR`^GM zEL&p5G&@5B#-_-$x%(iR1;mOFmLaBKxr#HfVw&Ca)MHDqtSY zQn5;62NRa*&|r25XX6|N=c;HytH9!!%q6U>9+Pfi$MV-~lWT#HVfR>0XFB7I&bZH$ zwPB~!&KebK@fuo~+S#gS(}ryumP!2M3aWQqF0MPRl9M*c#yWwBCxH91-AbjX7UH!^ zq8;c|uwKOmY!o=PEWZw|8*8`By?U0$4>=Zja=lt$iC;AZRxk9a%R7_YY*KMPx&>+r z%4#zyZ1c7bI6u0jH+uP%%aVG=88DL3uAXRp zG~U_W+1?i|oUQNOvN_5S8_3e#2IOh9e`9BFXVl#jX$>hv8=_Lz+f-~vzd(%_dR<9h z?76PcZJ9%^o_DC&i3{m5gH|@JQAg*NQHx)od}?X+0@)=tr6>g#skj&eB&TIEy2)#o zmLXS)>m{MqAT%mzWe^F*%?zcu^2r>es~9Xu*FimWQHjGuJ1dCY0)sQqj;c$a8Vh=M zud%YxLBmWA80LVjJM~ht%~8!v=r%KvO)WPBk>ZuBq;r@mEMy9Su#PGj5jfc|cl)rG zjWZ;5QlRGs!E9C#FUKS)Z9XNQqas%jPi9al-ae+~8FH+ekRwYUmbE4W6*8*r__d@DQTrI_9Mg0aam%&q*<0Ten-TXx7z9t~wI zFE71b#T%su*SN9YlS`!(yh)(3Yz*$xcNL1lI?dKQO~-IXL%0DqsdzJP&b#SWEvuzV zvcYC8L!Y>nATl+&302B>yNWw-Cr|C%F59hQGV^qm`c-R~m2$s|x8g3AzO*)?GZ!Q@ zr{8dfxw0M2ba?4vzp)CbpfnTI;%O03z%L^7CsWRc? z9fi<%!4xt*m@$DrI8Ee!rOWUL)OP`YsfJ3{XrA+ ze+hwUt;7^CGuB7(F$Eu2@dGymI9_k0*ue>0@&EZID`07p+3Mrp3*Tco zY1kgbQv#r>I@?_?X~?`sh0e_b zx*e!Hvv3rduK&?Y!3Jl{fL&d3N$XnjF)Qw9i4j%}&ve10wN7UTMiW$J@@4pV8TYhG zO83`+>l@Bm`|=(Y>CLe&r}gcIZP2CKrf5+C zXOvn&n|dG1GfttZ_U6MPdS3BueHkelWFMW&W_8oaSAd#Su^JqEEuds^E0;~^%p}y? zypBR<$B@a>1V|E6z0!u_{=`&;ZWnbn#Az}ElNb0L_}ar zoF`Wc1#9%_Ex|}|9E)0N!cCEyaV$N6aHKj?Gl`WI7(?~Jm!66QCh+PpoGRf~PvE>U z)VWJ}-adh@0}|?Bc(aQ>hR75Pc{*Dv(0>q5d*mgZs&H@BL#WtM*&N>ykfi$J6S!a; zuOr-8_!5s!lyJL>a16dHy^l0$3?BjPHU;wD&PKS#@Zut(g>q463Au zV5L}wAK-`lx_2*5!jJG{uJ+TVe}bQKR-#|xXZSg>8>B9pK5|@OQ3ix%vlx|FrQh9&;q(Mqd4l8}Pt}34EZ3zDT!N zyL24)wghA}ako4Y7{`4FP~SX>PYbs9lM{IO5iDz|YKjDS_BnPsllVMahpGvDQF2}B zy2@f20i3V{xSF?L!_TAFGLv106}TR&IViXDxgIyV(yXQGR`45;RCN_0SK;3@Nr3np zrX<|p8ca&K!ILmR8qeWByick<2=M~eE1ZQY*Z021^`ANCa{un-+~@r7xqp`-$B0i7;74}OC!>ER|9+gneQT-e zEAp#rs|j5GSB#V(3n$i4?Rdor_ita^1N>P`OHo^0O;t}HtfjW8)z_;D;Rg?pL-;}c zeb@@9;IPQdf-9d!|5H8)zY;0Qd^RkG?tC+cS8YlN^fUyj=avd80y2})M2kRay-)W- zH-Vua`nE#RwJ91RD2?WFslrLxT34VA-K#+MT2x6Rf zRtWgM|G!G$!^BI#-O=txh*AA4hLeXQoR5$`^BZYvOE*iD6#{8<1dj7aoTalf!p+jn z;YibLN2@>~ZLHjW^5AgR@p0~F9ffptaJJi*CjDo7d0&V#T_hwRP$MEB5Ix%1fxjxa z;PvpqgRPt_QK-AR5N#qwVBv8~;O+EJCJe)X0df?@D(j5kd7mu$8aytmK3J+ooPk3hP>CJiC_w#~*fJmrY zVXK2ldfXDrjmXY1B8yygo^KwoMIZ@Cz46@ntf%c~U+_F2_JE0*I8-)wKMODhY-Q7k zZS(dnCJbG5HaG0l8=T6njA(rIEX3PvEccGmd+_V_S=XlJX$ofF3hxgQq9KfB)jRj+ z**0QptTV*C>pfRLoB3{fhnz-p@he7q=&i*Cdu#00sD5K7TV9$TDnJBq z65+ETdEzZ0S=fWEvLkIhyRECk-AYK|LhMcSH3Nas#G>aC{M?mRi9&Qx5p6URVF%*iEJFnhmd0@Vqh@1Ar*}z z=Y60jyzQO&12L%j3kv1PdJwVphG2PdWIm!C4u8~!oDyv1A)iy}(-k!AkX0d$<0^FX zk(P-mdd&t;{LmjU_jc)XcI@b>3OTuXCzPAXU&AF&%wQUx#OGoSSkNm`E>?iWIcor! zeu|$SKs#kOaX7GGGRZM=z)yYny<7@2-K;1eL_a0mP`A?!NNA&glK#+ZhNYI_RMqUD zNnxWBys)WK3GYZ!rj6GgsUreWC#OMQBP8sU1GqzaJA617+ zMde>b2@j{=^3#g;q|AUR6rQvKyrnJFcM*qa1>X#pnJZrHzRr7NcfM!IR-L4;OA0i4 z>FwoKVKd{|fb}ye1v9d=ff7V|!FG#x3EcJ4y;Ly?tdKy+h~flQ8P zzhN0giA}&#YEfOPICEF2<{&m1IQn=+Tth1<`^+*RGZw&_T%;dN7twDu;Rgf2LE;u! z%~6@3>q5cZeGPROo*=UjY4jET()xsadYvG3xOm=UDi$Kzx&G_I-5J|Fb+neyDvw&1PqQ+>0r*8p`ne>jDJ_DsV2c&U7Qe~>$}S}%;2ZST|~jwQkOUj#LA8P zyV3g0jaIE$$)rjul%tfM^FQ;HZRA7FaR|k+EQ|D6msoB~*O~AtRtaG=-%w26Qx-71 z8GlVpkON=7;r#{t^sE1#ehD(3jqQ<>}aOE(v7#yPkXU*|s!Pv(|+B#L02 z+z|CF3{_uJ1{Fu#&148S^cOy9nD^M&BQqj?bqfI~ZmBw1thcUaDp2~Y{L5Fm3Ypwj zT)l!d8~0D7Uv`duu_|^y|6F9e5<-8SE3suEtvhvGU!x@%kRLKSBj+>bRbyHrb)#VE z3>1@$3<<888BNJC5i^14EFVvUG8BLRU2MO{)a|$6w^WhfJTYeF! zXP;o8=8&t{`0z&7)97tBX8kowTGp0}<0QFZmo7wBG0v~MyfXjl%l6tTXatc^`!zj~ z`T@FA`>&yktZiMi-bx+Z>%7%#R|d<(c~RHc^Q0fDuvY1g&iRAn`02^$jP!)z3ACU1 z)PT%TA&{d}$2$6czBSiFa|X&+rG7yMvgfW8fsEx`=b!S5uXHR<`DAg*a8)1&Wn(*b zq-gKIa^cd2t`3#+)-+&Q`;)^bqQfT&!nYNrU!9=U(WvURfn3*MOk&S4*I$nzi4DW} z_e|}U2j{NSE-tFD)G+cIzP&xNzF@m9sZ}yEu8?0Hv=&P6CO_`s%EM`|&A6hX1}zrm zt;nV4ZXdjQpBLwphtAg%s8+#Mw(5_lt~ANI#hFNVEm;g2qp%9==E zL6gQ0*`8OILP?*}TkU)3x#Uq(eLe^Bp)eqBqIf*8{!8;68H>_-7)BqfI;N3C7hyt7 z_V)R=xG%&fTAy$kOEEQzmS;)a8jQ2qwPj751|&*8*{rZ1(5zJ~sYVbnN)_J`Oss+~{?! z^|VjK)X7+Irb>DH1l^_L4CYxVXCsP9{#b6gQgz&2ez*2(mKFpVX}vII@;u6?op~s1 zn#%K0lUM?#Zwkvr-Q&dPcPo@-+HRmQ2kIhM%cSfle)rltgEEblzw_Qd%$vmUVqDxV zQZINjU^QG+^-1fm+vlk~U*wk-wLVWX^X-h-kM+9(6VD4)& z;Nz|7CIckv{MSjq$4RPrsY_BsFWIuwnwW`6VXS^$&B{B)xq-xKfvfB0VnKIS=SX(> zt7w2^M6i^q(F&IAaha6C&_i4{@-1a<&6Dvgk855}p2 z1Jz0^Gi0Hs`B@cT5UOO_3~UG$f?EW8C>l33MFoQmDXs3co5%!{1(r3-Xn1Y%Oi*4b z^pC`x-4V<@4VwSt#H)x^lwGcf_x6h{o?+)1*EME(NgYvGH<$I;p16d28aXe_Dxg+x zhL%l=?8_RDyu}Ka8VD`#wwLjXE;BjjFXy5Bf@e@_`lf6Bva5>r*_(v&E99S;ee8XC zFP;sL3!B||HS5(vZMt;N$mBwx1d`31^Mzb6Q=l%3!PzdYHc9q;*}!DiTTN1~CZdl* zXTpQlU>2tk0;=~zeVRkQUNGvpZNjhwQz<1ZD5EB~?}9lgF|#mOKvz_`14(PsR(DJW zRFfpb?o2J ztIJ)}V*rjd18bUTzU)-iQ{HU<>MbhQ5}(o6aSHTIp=UC2aKVTlHWT!TTB%)%R=!im zYXTedjrUe(4b3Kve3!r_PMxOq66>>@TO1CM`XN2p*c-XJX+%8qLFrXX(JpUKT&M~&z9M-(U?2=}_nHG(HcLl7%{6uIAjq1F1%IoT$l3k{6{M$C_>xqxL z0fm*|Z*dy7Bd2zsrDJ@1U->9Ai>jZ|Rp7;2#|coB0-ar;uwJrgn_oYlZ;i z*tN!}hzJdv9q1~}WHUNVPPL78mbUst6l8-0nnxMO-!K-iqH3o1AQ*#wc2DREF!Ez6 zJt=XGpS1_G3va`ui7h{B1@(P2W#L#nvm3;A;!+hC-_#61(VVdXAzUSa+_=O`^E?(uJE@MCY|r zlwcu9iTtvcdbLST^g^P-71li0xqwCMwESI+SF2;^M+#uFRo`FV-BuM4+-NE=pIz%mJ39@XeegyWUI-OE-JLZ zs%uKiS+!FkHyK`|!#BW#wtkdZkNgoA+k}#X1C;U#vx4sl61bz$>{@S3c~ta_*L?hY zL#XAHbg45r%gXJ1+A?g1cM@*DZ2@<-ZqNjz1qGuRZi+-f*<(VO?1Y7+Ay{;un_rYu zBDEt%SYyJVNrF0LOV zZQ*&++nk3W>-4ixtK+;=Di){KFm>nqi{@#z=RM9{(#T24PlP-1KnSn=EoSdy2j?Hp z(`YL7F}vYX?}d9V{Qr*tK5Ix#u3?K`?U*Pzn;) z1`QN2R1+9_s!&t2=#(Zf#b5ajGyCbQ#ao%XgG5;1jBg`#epA zh4w9nVDM#-guIRfXBkJCq*T*ivGE0bRgWY^