|
@@ -56,7 +56,8 @@ public class PermissionAspect implements Interceptor {
|
|
|
//扫描的包路径,需要权限的加在mapper类及方法上
|
|
|
private String packagePath = "com.ims.eval.dao";
|
|
|
private final static String DEPT_ID = "dept_id";
|
|
|
- private final static String DEPT_MARK = "BM0001";
|
|
|
+ private final static String DEPT_MARK = "BM0001";//部门
|
|
|
+ private final static String POS_MARK = "GW0001";//岗位
|
|
|
|
|
|
/** start 以下定义的数据需要和部门表一致 **/
|
|
|
//全部数据权限
|
|
@@ -95,6 +96,65 @@ public class PermissionAspect implements Interceptor {
|
|
|
MyuserResDTO user = getSysUser(code);
|
|
|
DataDictionary dept = getSysDept(user);
|
|
|
if (user == null || dept == null) {
|
|
|
+ try {
|
|
|
+ //反射扫包会比较慢,这里做了个懒加载
|
|
|
+ if (classNames == null) {
|
|
|
+ //扫描指定包路径下所有包含指定注解的类
|
|
|
+ Set<Class<?>> classSet = ClassUtil.scanPackageByAnnotation(packagePath, DataPermission.class);
|
|
|
+ if (classSet == null && classSet.size() == 0) {
|
|
|
+ classNames = new ArrayList<>();
|
|
|
+ } else {
|
|
|
+ //取得类全名
|
|
|
+ classNames = classSet.stream().map(Class::getName).collect(Collectors.toList());
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // 拿到mybatis的一些对象
|
|
|
+ StatementHandler statementHandler = PluginUtils.realTarget(invocation.getTarget());
|
|
|
+ MetaObject metaObject = SystemMetaObject.forObject(statementHandler);
|
|
|
+ MappedStatement mappedStatement = (MappedStatement) metaObject.getValue("delegate.mappedStatement");
|
|
|
+
|
|
|
+ // mappedStatement.getId()为执行的mapper方法的全路径名,newId为执行的mapper方法的类全名
|
|
|
+ String newId = mappedStatement.getId().substring(0, mappedStatement.getId().lastIndexOf("."));
|
|
|
+ // 如果不是指定的方法,直接结束拦截
|
|
|
+ if (!classNames.contains(newId)) {
|
|
|
+ return invocation.proceed();
|
|
|
+ }
|
|
|
+ String newName = mappedStatement.getId().substring(mappedStatement.getId().lastIndexOf(".") + 1, mappedStatement.getId().length());
|
|
|
+ Class<?> clazz = Class.forName(newId);
|
|
|
+
|
|
|
+ if (!methodNames.containsKey(newId + "-" + newName)){
|
|
|
+ for (Method method : clazz.getDeclaredMethods()) {
|
|
|
+ //方法是否含有DataPermission注解,如果含有注解则将数据结果过滤
|
|
|
+ if (method.isAnnotationPresent(DataPermission.class)) {
|
|
|
+ DataPermission dataPermission = method.getAnnotation(DataPermission.class);
|
|
|
+ if (dataPermission != null) {
|
|
|
+ methodNames.put(newId + "-" + method.getName(), dataPermission.isPermission());
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ methodNames.put(newId + "-" + method.getName(), true);
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ //是否开启数据权限
|
|
|
+ boolean isPermission = true;
|
|
|
+ isPermission = methodNames.get(newId + "-" + newName);
|
|
|
+ if (isPermission) {
|
|
|
+ // 获取到原始sql语句
|
|
|
+ String sql = statementHandler.getBoundSql().getSql();
|
|
|
+ // 解析并返回新的SQL语句,只处理查询sql
|
|
|
+ if (mappedStatement.getSqlCommandType().toString().equals("SELECT")) {
|
|
|
+ sql = getSql(sql, "");
|
|
|
+ }
|
|
|
+ // 修改sql
|
|
|
+ metaObject.setValue("delegate.boundSql.sql", sql);
|
|
|
+ }
|
|
|
+ } catch (Exception e) {
|
|
|
+ log.error("数据权限隔离异常:", e);
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
return invocation.proceed();
|
|
|
}
|
|
|
|
|
@@ -147,7 +207,7 @@ public class PermissionAspect implements Interceptor {
|
|
|
|
|
|
//是否开启数据权限
|
|
|
boolean isPermission = true;
|
|
|
- isPermission = methodNames.get(newId + "-" + newName);
|
|
|
+ isPermission = null != methodNames.get(newId + "-" + newName) ?methodNames.get(newId + "-" + newName) :false;
|
|
|
if (isPermission) {
|
|
|
// 获取到原始sql语句
|
|
|
String sql = statementHandler.getBoundSql().getSql();
|
|
@@ -181,6 +241,8 @@ public class PermissionAspect implements Interceptor {
|
|
|
Table table = (Table)plainSelect.getFromItem();
|
|
|
if (table.getAlias() != null){
|
|
|
condition = table.getAlias().getName() + "." + DEPT_ID + "='" + deptId + "'";;
|
|
|
+ }else {
|
|
|
+ condition = table.getAlias().getName() + "." + DEPT_ID + "=''";;
|
|
|
}
|
|
|
|
|
|
//取得原SQL的where条件
|