@@ -7,6 +7,7 @@ import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before ;
import org.springframework.stereotype.Component ;
import com.ruoyi.common.annotation.DataScope ;
import com.ruoyi.common.constant.Constants ;
import com.ruoyi.common.constant.UserConstants ;
import com.ruoyi.common.core.domain.BaseEntity ;
import com.ruoyi.common.core.domain.entity.SysRole ;
@@ -26,31 +27,6 @@ import com.ruoyi.framework.security.context.PermissionContextHolder;
@Component
public class DataScopeAspect
{
/**
* 全部数据权限
*/
public static final String DATA_SCOPE_ALL = " 1 " ;
/**
* 自定数据权限
*/
public static final String DATA_SCOPE_CUSTOM = " 2 " ;
/**
* 部门数据权限
*/
public static final String DATA_SCOPE_DEPT = " 3 " ;
/**
* 部门及以下数据权限
*/
public static final String DATA_SCOPE_DEPT_AND_CHILD = " 4 " ;
/**
* 仅本人数据权限
*/
public static final String DATA_SCOPE_SELF = " 5 " ;
/**
* 数据权限过滤关键字
*/
@@ -74,7 +50,7 @@ public class DataScopeAspect
if ( StringUtils . isNotNull ( currentUser ) & & ! currentUser . isAdmin ( ) )
{
String permission = StringUtils . defaultIfEmpty ( controllerDataScope . permission ( ) , PermissionContextHolder . getContext ( ) ) ;
dataScopeFilter ( joinPoint , currentUser , controllerDataScope . deptAlias ( ) , controllerDataScope . userAlias ( ) , permission ) ;
dataScopeFilter ( joinPoint , currentUser , controllerDataScope . userAlias ( ) , controllerDataScope . deptAlias( ) , controllerDataScope . userField ( ) , controllerDataScope . deptField ( ) , permission ) ;
}
}
}
@@ -88,13 +64,13 @@ public class DataScopeAspect
* @param userAlias 用户别名
* @param permission 权限字符
*/
public static void dataScopeFilter ( JoinPoint joinPoint , SysUser user , String deptAlias , String userAlias , String permission )
public static void dataScopeFilter ( JoinPoint joinPoint , SysUser user , String userAlias , String deptAlias , String userField , String deptField , String permission )
{
StringBuilder sqlString = new StringBuilder ( ) ;
List < String > conditions = new ArrayList < String > ( ) ;
List < String > scopeCustomIds = new ArrayList < String > ( ) ;
user . getRoles ( ) . forEach ( role - > {
if ( DATA_SCOPE_CUSTOM . equals ( role . getDataScope ( ) ) & & StringUtils . equals ( role . getStatus ( ) , UserConstants . ROLE_NORMAL ) & & ( StringUtils . isEmpty ( permission ) | | StringUtils . containsAny ( role . getPermissions ( ) , Convert . toStrArray ( permission ) ) ) )
if ( Constants . Dept . DATA_SCOPE_CUSTOM. equals ( role . getDataScope ( ) ) & & StringUtils . equals ( role . getStatus ( ) , UserConstants . ROLE_NORMAL ) & & ( StringUtils . isEmpty ( permission ) | | StringUtils . containsAny ( role . getPermissions ( ) , Convert . toStrArray ( permission ) ) ) )
{
scopeCustomIds . add ( Convert . toStr ( role . getRoleId ( ) ) ) ;
}
@@ -111,42 +87,42 @@ public class DataScopeAspect
{
continue ;
}
if ( DATA_SCOPE_ALL . equals ( dataScope ) )
if ( Constants . Dept . DATA_SCOPE_ALL. equals ( dataScope ) )
{
sqlString = new StringBuilder ( ) ;
conditions . add ( dataScope ) ;
break ;
}
else if ( DATA_SCOPE_CUSTOM . equals ( dataScope ) )
else if ( Constants . Dept . DATA_SCOPE_CUSTOM. equals ( dataScope ) )
{
if ( scopeCustomIds . size ( ) > 1 )
{
// 多个自定数据权限使用in查询, 避免多次拼接。
sqlString . append ( StringUtils . format ( " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id in ({}) ) " , deptAlias , String . join ( " , " , scopeCustomIds ) ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} IN ( SELECT dept_id FROM sys_role_dept WHERE role_id in ({}) ) " , deptAlias , deptField , String . join ( " , " , scopeCustomIds ) ) ) ;
}
else
{
sqlString . append ( StringUtils . format ( " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) " , deptAlias , role . getRoleId ( ) ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) " , deptAlias , deptField , role . getRoleId ( ) ) ) ;
}
}
else if ( DATA_SCOPE_DEPT . equals ( dataScope ) )
else if ( Constants . Dept . DATA_SCOPE_DEPT. equals ( dataScope ) )
{
sqlString . append ( StringUtils . format ( " OR {}.dept_id = {} " , deptAlias , user . getDeptId ( ) ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} = {} " , deptAlias , deptField , user . getDeptId ( ) ) ) ;
}
else if ( DATA_SCOPE_DEPT_AND_CHILD . equals ( dataScope ) )
else if ( Constants . Dept . DATA_SCOPE_DEPT_AND_CHILD. equals ( dataScope ) )
{
sqlString . append ( StringUtils . format ( " OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) ) " , deptAlias , user . getDeptId ( ) , user . getDeptId ( ) ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) ) " , deptAlias , deptField , user . getDeptId ( ) , user . getDeptId ( ) ) ) ;
}
else if ( DATA_SCOPE_SELF . equals ( dataScope ) )
else if ( Constants . Dept . DATA_SCOPE_SELF. equals ( dataScope ) )
{
if ( StringUtils . isNotBlank ( userAlias ) )
{
sqlString . append ( StringUtils . format ( " OR {}.user_id = {} " , userAlias , user . getUserId ( ) ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} = {} " , userAlias , userField , user . getUserId ( ) ) ) ;
}
else
{
// 数据权限为仅本人且没有userAlias别名不查询任何数据
sqlString . append ( StringUtils . format ( " OR {}.dept_id = 0 " , deptAlias ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} = 0 " , deptAlias , deptField )) ;
}
}
conditions . add ( dataScope ) ;
@@ -155,7 +131,7 @@ public class DataScopeAspect
// 角色都不包含传递过来的权限字符, 这个时候sqlString也会为空, 所以要限制一下,不查询任何数据
if ( StringUtils . isEmpty ( conditions ) )
{
sqlString . append ( StringUtils . format ( " OR {}.dept_id = 0 " , deptAlias ) ) ;
sqlString . append ( StringUtils . format ( " OR {}.{} = 0 " , deptAlias , deptField )) ;
}
if ( StringUtils . isNotBlank ( sqlString . toString ( ) ) )