mirror of
http://git.pig4cloud.com/pig/pigx.git
synced 2026-11-10 21:19:00 +08:00
refactor(data): 支持多角色数据权限计算
This commit is contained in:
冷冷 committed
1 parent
85f58a8122
commit
e461518a23
3 files changed
+165
-120
No files matched your search
+163
@@ -0,0 +1,163 @@
|
||||
/*
|
||||
* Copyright (c) 2018-2025, lengleng All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
*
|
||||
* Redistributions of source code must retain the above copyright notice,
|
||||
* this list of conditions and the following disclaimer.
|
||||
* Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* Neither the name of the pig4cloud.com developer nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
* Author: lengleng (wangiegie@gmail.com)
|
||||
*/
|
||||
|
||||
package com.pig4cloud.pigx.common.data.datascope;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import cn.hutool.core.util.StrUtil;
|
||||
import com.pig4cloud.pigx.admin.api.entity.SysDept;
|
||||
import com.pig4cloud.pigx.admin.api.entity.SysRole;
|
||||
import com.pig4cloud.pigx.admin.api.feign.RemoteDataScopeService;
|
||||
import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
|
||||
import com.pig4cloud.pigx.common.core.constant.enums.UserTypeEnum;
|
||||
import com.pig4cloud.pigx.common.core.util.RetOps;
|
||||
import com.pig4cloud.pigx.common.security.service.PigxUser;
|
||||
import com.pig4cloud.pigx.common.security.util.SecurityUtils;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Objects;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* @author lengleng
|
||||
* @date 2019-09-07
|
||||
* <p>
|
||||
* 默认data scope 判断处理器
|
||||
*/
|
||||
|
||||
/**
|
||||
* @author lengleng
|
||||
* @date 2019-09-07
|
||||
* <p>
|
||||
* 默认data scope 判断处理器
|
||||
*/
|
||||
@RequiredArgsConstructor
|
||||
public class PigxDefaultDataScopeHandle implements DataScopeHandle {
|
||||
|
||||
private final RemoteDataScopeService dataScopeService;
|
||||
|
||||
@Override
|
||||
public Boolean calcScope(DataScope dataScope) {
|
||||
// 对于TOC客户端，不进行数据权限校验
|
||||
PigxUser user = SecurityUtils.getUser();
|
||||
if (UserTypeEnum.TOC.getStatus().equals(user.getUserType())) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// 业务代码里的规则，覆盖计算规则
|
||||
if (StrUtil.isNotBlank(dataScope.getUsername()) || CollUtil.isNotEmpty(dataScope.getDeptList())) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// 获取用户角色ID列表
|
||||
List<String> roleIdList = user.getAuthorities().stream()
|
||||
.map(GrantedAuthority::getAuthority)
|
||||
.filter(authority -> authority.startsWith(SecurityConstants.ROLE))
|
||||
.map(authority -> authority.split(StrUtil.UNDERLINE)[1])
|
||||
.collect(Collectors.toList());
|
||||
if (CollUtil.isEmpty(roleIdList)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// 获取角色列表
|
||||
List<SysRole> roleList = RetOps.of(dataScopeService.getRoleList(roleIdList))
|
||||
.getData()
|
||||
.orElseGet(Collections::emptyList);
|
||||
if (CollUtil.isEmpty(roleList)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// 处理数据权限
|
||||
return processDataScope(user, dataScope, roleList);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* 处理数据权限
|
||||
*/
|
||||
private boolean processDataScope(PigxUser user, DataScope dataScope, List<SysRole> roleList) {
|
||||
List<Long> deptList = dataScope.getDeptList();
|
||||
|
||||
for (SysRole role : roleList) {
|
||||
Integer dsType = role.getDsType();
|
||||
|
||||
// 处理不同数据权限类型
|
||||
switch (Objects.requireNonNull(DataScopeTypeEnum.getByType(dsType))) {
|
||||
case ALL:
|
||||
return true;
|
||||
case CUSTOM:
|
||||
handleCustomScope(role, deptList);
|
||||
break;
|
||||
case OWN_CHILD_LEVEL:
|
||||
handleOwnChildLevelScope(user, deptList);
|
||||
break;
|
||||
case OWN_LEVEL:
|
||||
handleOwnLevelScope(user, deptList);
|
||||
break;
|
||||
case SELF_LEVEL:
|
||||
handleSelfLevelScope(user, dataScope);
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* 处理自定义数据权限
|
||||
*/
|
||||
private void handleCustomScope(SysRole role, List<Long> deptList) {
|
||||
if (StrUtil.isNotBlank(role.getDsScope())) {
|
||||
deptList.addAll(Arrays.stream(role.getDsScope().split(StrUtil.COMMA))
|
||||
.map(Long::parseLong)
|
||||
.collect(Collectors.toList()));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 处理本级及下级数据权限
|
||||
*/
|
||||
private void handleOwnChildLevelScope(PigxUser user, List<Long> deptList) {
|
||||
List<Long> descendantDeptIds = RetOps.of(dataScopeService.getDescendantList(user.getDeptId()))
|
||||
.getData()
|
||||
.orElseGet(Collections::emptyList)
|
||||
.stream()
|
||||
.map(SysDept::getDeptId)
|
||||
.collect(Collectors.toList());
|
||||
deptList.addAll(descendantDeptIds);
|
||||
}
|
||||
|
||||
/**
|
||||
* 处理本级数据权限
|
||||
*/
|
||||
private void handleOwnLevelScope(PigxUser user, List<Long> deptList) {
|
||||
deptList.add(user.getDeptId());
|
||||
}
|
||||
|
||||
/**
|
||||
* 处理个人数据权限
|
||||
*/
|
||||
private void handleSelfLevelScope(PigxUser user, DataScope dataScope) {
|
||||
dataScope.setUsername(user.getUsername());
|
||||
}
|
||||
}
|
||||
-118
@@ -1,118 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2018-2025, lengleng All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
*
|
||||
* Redistributions of source code must retain the above copyright notice,
|
||||
* this list of conditions and the following disclaimer.
|
||||
* Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* Neither the name of the pig4cloud.com developer nor the names of its
|
||||
* contributors may be used to endorse or promote products derived from
|
||||
* this software without specific prior written permission.
|
||||
* Author: lengleng (wangiegie@gmail.com)
|
||||
*/
|
||||
|
||||
package com.pig4cloud.pigx.common.data.datascope;
|
||||
|
||||
import cn.hutool.core.collection.CollectionUtil;
|
||||
import cn.hutool.core.util.StrUtil;
|
||||
import com.pig4cloud.pigx.admin.api.entity.SysDept;
|
||||
import com.pig4cloud.pigx.admin.api.entity.SysRole;
|
||||
import com.pig4cloud.pigx.admin.api.feign.RemoteDataScopeService;
|
||||
import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
|
||||
import com.pig4cloud.pigx.common.core.constant.enums.UserTypeEnum;
|
||||
import com.pig4cloud.pigx.common.core.util.RetOps;
|
||||
import com.pig4cloud.pigx.common.security.service.PigxUser;
|
||||
import com.pig4cloud.pigx.common.security.util.SecurityUtils;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.Comparator;
|
||||
import java.util.List;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* @author lengleng
|
||||
* @date 2019-09-07
|
||||
* <p>
|
||||
* 默认data scope 判断处理器
|
||||
*/
|
||||
@RequiredArgsConstructor
|
||||
public class PigxDefaultDatascopeHandle implements DataScopeHandle {
|
||||
|
||||
private final RemoteDataScopeService dataScopeService;
|
||||
|
||||
/**
|
||||
* 计算用户数据权限
|
||||
* @param dataScope 数据权限范围
|
||||
* @return
|
||||
*/
|
||||
@Override
|
||||
public Boolean calcScope(DataScope dataScope) {
|
||||
PigxUser user = SecurityUtils.getUser();
|
||||
// toc 客户端不进行数据权限
|
||||
if (UserTypeEnum.TOC.getStatus().equals(user.getUserType())) {
|
||||
return true;
|
||||
}
|
||||
|
||||
List<String> roleIdList = user.getAuthorities().stream().map(GrantedAuthority::getAuthority)
|
||||
.filter(authority -> authority.startsWith(SecurityConstants.ROLE))
|
||||
.map(authority -> authority.split(StrUtil.UNDERLINE)[1]).collect(Collectors.toList());
|
||||
|
||||
List<Long> deptList = dataScope.getDeptList();
|
||||
|
||||
// 当前用户的角色为空 , 返回false
|
||||
if (CollectionUtil.isEmpty(roleIdList)) {
|
||||
return false;
|
||||
}
|
||||
// @formatter:off
|
||||
SysRole role = RetOps.of(dataScopeService.getRoleList(roleIdList))
|
||||
.getData()
|
||||
.orElseGet(Collections::emptyList)
|
||||
.stream()
|
||||
.min(Comparator.comparingInt(SysRole::getDsType)).orElse(null);
|
||||
// @formatter:on
|
||||
// 角色有可能已经删除了
|
||||
if (role == null) {
|
||||
return false;
|
||||
}
|
||||
Integer dsType = role.getDsType();
|
||||
// 查询全部
|
||||
if (DataScopeTypeEnum.ALL.getType() == dsType) {
|
||||
return true;
|
||||
}
|
||||
// 自定义
|
||||
if (DataScopeTypeEnum.CUSTOM.getType() == dsType && StrUtil.isNotBlank(role.getDsScope())) {
|
||||
String dsScope = role.getDsScope();
|
||||
deptList.addAll(
|
||||
Arrays.stream(dsScope.split(StrUtil.COMMA)).map(Long::parseLong).collect(Collectors.toList()));
|
||||
}
|
||||
// 查询本级及其下级
|
||||
if (DataScopeTypeEnum.OWN_CHILD_LEVEL.getType() == dsType) {
|
||||
// @formatter:off
|
||||
List<Long> deptIdList = RetOps.of(dataScopeService.getDescendantList(user.getDeptId()))
|
||||
.getData()
|
||||
.orElseGet(Collections::emptyList)
|
||||
.stream()
|
||||
.map(SysDept::getDeptId).collect(Collectors.toList());
|
||||
// @formatter:on
|
||||
deptList.addAll(deptIdList);
|
||||
}
|
||||
// 只查询本级
|
||||
if (DataScopeTypeEnum.OWN_LEVEL.getType() == dsType) {
|
||||
deptList.add(user.getDeptId());
|
||||
}
|
||||
|
||||
// 只查询本人
|
||||
if (DataScopeTypeEnum.SELF_LEVEL.getType() == dsType) {
|
||||
dataScope.setUsername(user.getUsername());
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
+2
-2
@@ -25,7 +25,7 @@ import com.pig4cloud.pigx.admin.api.feign.RemoteDataScopeService;
|
||||
import com.pig4cloud.pigx.common.data.datascope.DataScopeInnerInterceptor;
|
||||
import com.pig4cloud.pigx.common.data.datascope.DataScopeInterceptor;
|
||||
import com.pig4cloud.pigx.common.data.datascope.DataScopeSqlInjector;
|
||||
import com.pig4cloud.pigx.common.data.datascope.PigxDefaultDatascopeHandle;
|
||||
import com.pig4cloud.pigx.common.data.datascope.PigxDefaultDataScopeHandle;
|
||||
import com.pig4cloud.pigx.common.data.resolver.SqlFilterArgumentResolver;
|
||||
import com.pig4cloud.pigx.common.data.tenant.PigxTenantConfigProperties;
|
||||
import com.pig4cloud.pigx.common.data.tenant.PigxTenantHandler;
|
||||
@@ -107,7 +107,7 @@ public class MybatisPlusConfiguration implements WebMvcConfigurer {
|
||||
@ConditionalOnClass(PigxUser.class)
|
||||
public DataScopeInterceptor dataScopeInterceptor(RemoteDataScopeService dataScopeService) {
|
||||
DataScopeInnerInterceptor dataScopeInnerInterceptor = new DataScopeInnerInterceptor();
|
||||
dataScopeInnerInterceptor.setDataScopeHandle(new PigxDefaultDatascopeHandle(dataScopeService));
|
||||
dataScopeInnerInterceptor.setDataScopeHandle(new PigxDefaultDataScopeHandle(dataScopeService));
|
||||
return dataScopeInnerInterceptor;
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user