1. 根据部门控制 数据权限, 部门只能看到自己的数据, 具体查看部门数据看角色的数据权限分配, 可选择当前部门数据, 全部数据, 部门及以下数据或者多部门数据

This commit is contained in:
ant 2024-05-31 18:26:36 +08:00
parent 7ece014b7a
commit 37ff2f23b1
26 changed files with 62 additions and 77 deletions

View File

@ -1,6 +1,5 @@
package com.chushang.datascope.annotation;
import com.baomidou.mybatisplus.core.enums.SqlKeyword;
import com.chushang.datascope.enums.ScopeKeyWord;
import java.lang.annotation.*;
@ -11,12 +10,12 @@ import java.lang.annotation.*;
public @interface DataScope
{
/**
* 部门表的别名
* 主表的别名, 用于查询部门id
*/
String deptAlias() default "";
String tableAlias() default "";
/**
* 用户表的别名
* 用户表的别名, 用于查询userId
*/
String userAlias() default "";

View File

@ -1,7 +1,6 @@
package com.chushang.datascope.aspect;
import cn.hutool.core.collection.CollectionUtil;
import com.chushang.common.core.exception.ResultException;
import com.chushang.common.core.text.Convert;
import com.chushang.common.mybatis.page.CommonParam;
import com.chushang.common.core.util.StringUtils;
@ -22,9 +21,7 @@ import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.stereotype.Component;
import java.lang.reflect.Method;
import java.sql.SQLException;
import java.util.*;
import java.util.stream.Collectors;
@Aspect
@Slf4j
@ -59,7 +56,7 @@ public class DataScopeAspect {
String permission = StringUtils.defaultIfEmpty(dataScope.permission(),
SecurityContextHolder.getPermission());
ScopeKeyWord scopeKeyWord = dataScope.scopeKey();
dataScopeFilter(joinPoint, scopes, dataScope.deptAlias(),
dataScopeFilter(joinPoint, scopes, dataScope.tableAlias(),
dataScope.userAlias(), permission, userId, scopeKeyWord);
}
}
@ -70,14 +67,13 @@ public class DataScopeAspect {
*
* @param joinPoint 切点
* @param dataScopes 用户角色数据权限
* @param deptAlias 部门别名
* @param tableAlias 主表别名, 用于查询按照部门分数据
* @param userAlias 用户别名
* @param userId 用户id
*/
public void dataScopeFilter(JoinPoint joinPoint, List<DataScopeEntity> dataScopes, String deptAlias, String userAlias, String permission, Long userId, ScopeKeyWord scopeKeyWord) {
public void dataScopeFilter(JoinPoint joinPoint, List<DataScopeEntity> dataScopes, String tableAlias, String userAlias, String permission, Long userId, ScopeKeyWord scopeKeyWord) {
StringBuilder dataScopeSqlString = new StringBuilder();
// 根据部门过滤role 显示
StringBuilder roleSqlString = new StringBuilder();
List<String> conditions = new ArrayList<>();
for (DataScopeEntity scope : dataScopes) {
String dataScope = scope.getScope();
@ -101,11 +97,11 @@ public class DataScopeAspect {
dataScopeSqlString
.append(ScopeKeyWord.OR.getCode())
.append(StringUtils.format(
"{}.dept_id IN ({}) ", deptAlias, String.join(",",scope.getDeptIds())));
"{}.dept_id IN ({}) ", tableAlias, String.join(",",scope.getDeptIds())));
}
// 部门数据
else if (ScopeConstants.DATA_SCOPE_DEPT.equals(dataScope)) {
dataScopeSqlString.append(StringUtils.format(" OR {}.dept_id = {} ", deptAlias, scope.getDeptId()));
dataScopeSqlString.append(StringUtils.format(" OR {}.dept_id = {} ", tableAlias, scope.getDeptId()));
}
// 部门及以下
else if (ScopeConstants.DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope)) {
@ -113,12 +109,7 @@ public class DataScopeAspect {
.append(ScopeKeyWord.OR.getCode())
.append(StringUtils.format(
"{}.dept_id IN ({})",
deptAlias, String.join(",",scope.getDeptIds())));
// 当且仅当用在角色列表页面, 并且角色为 部门及以下 -- 用于控制 角色的显示, 每个部门下有自己的角色不同
roleSqlString
.append(ScopeKeyWord.OR.getCode())
.append(StringUtils.format("{}.dept_id IN ({}) ",
"r", String.join(",",scope.getDeptIds())));
tableAlias, String.join(",",scope.getDeptIds())));
}
// 仅本人
else if (ScopeConstants.DATA_SCOPE_SELF.equals(dataScope)) {
@ -130,7 +121,7 @@ public class DataScopeAspect {
// 数据权限为仅本人且没有userAlias别名不查询任何数据
dataScopeSqlString
.append(ScopeKeyWord.OR.getCode())
.append(StringUtils.format("{}.dept_id = {} ", deptAlias, scope.getDeptId()));
.append(StringUtils.format("{}.dept_id = {} ", tableAlias, scope.getDeptId()));
}
}
conditions.add(dataScope);
@ -147,7 +138,6 @@ public class DataScopeAspect {
Map<String, Object> sqlParam = getSqlParam(joinPoint);
if (null == sqlParam) return;
sqlParam.put(ScopeConstants.DATA_SCOPE, v);
sqlParam.put(ScopeConstants.ROLE_SCOPE, roleSqlString.toString());
}
}
@ -158,7 +148,6 @@ public class DataScopeAspect {
Map<String, Object> sqlParam = getSqlParam(joinPoint);
if (null == sqlParam) return;
sqlParam.put(ScopeConstants.DATA_SCOPE, "");
sqlParam.put(ScopeConstants.ROLE_SCOPE, "");
}
private Map<String, Object> getSqlParam(final JoinPoint joinPoint){

View File

@ -26,8 +26,4 @@ public interface ScopeConstants {
* 数据权限过滤关键字
*/
String DATA_SCOPE = "dataScope";
/**
* 部门角色权限过滤
*/
String ROLE_SCOPE = "roleScope";
}

View File

@ -16,7 +16,7 @@ import lombok.*;
import java.time.LocalDateTime;
/**
* 系统日志
* 系统操作日志
*/
@Data
@ToString
@ -114,8 +114,4 @@ public class SysLogEntity {
*/
@TableField(value = "application_name")
private String applicationName;
/**
* 部门id -- 根据部门划分不同的数据?
*/
private Integer deptId;
}

View File

@ -58,7 +58,7 @@ public class BaseEntity implements Serializable {
update = "%s+1",
fill = FieldFill.INSERT
)
protected Integer version;
protected Long version;
@TableField(exist = false)
private transient Map<String, Object> sqlParam;

View File

@ -24,7 +24,6 @@ public class LoginUser<T, D> implements Serializable
* 用户名id
*/
private Long userId;
/**
* 用户名
*/

View File

@ -46,7 +46,7 @@ public class UserService {
}
if (ObjectUtils.isEmpty(rLoginUser) || ObjectUtils.isEmpty(rLoginUser.getData()) ){
recordLoginInfo(username, LoginStatusEnum.LOGIN_FAIL_STATUS, "登录用户不存在");
recordLoginInfo(username, LoginStatusEnum.ACCOUNT_EMPTY);
throw new ResultException("登录用户:" + username + " 不存在");
}
LoginUser<SysUser, DataScopeEntity> loginUser = rLoginUser.getData();
@ -54,16 +54,16 @@ public class UserService {
Boolean status = sysUser.getStatus();
if (!status)
{
recordLoginInfo(username, LoginStatusEnum.LOGIN_FAIL_STATUS, "用户已停用,请联系管理员");
recordLoginInfo(username, LoginStatusEnum.ACCOUNT_STATUS_ERROR);
throw new ResultException("对不起,您的账号:" + username + " 已停用");
}
// 进行比较了
if (!SecurityUtils.matchesPassword(password, sysUser.getSalt(), sysUser.getPassword()))
{
recordLoginInfo(username, LoginStatusEnum.LOGIN_FAIL_STATUS, "用户密码错误");
recordLoginInfo(username, LoginStatusEnum.LOGIN_FAIL_STATUS);
throw new ResultException("用户不存在/密码错误");
}
recordLoginInfo(username, LoginStatusEnum.LOGIN_SUCCESS, "登录成功");
recordLoginInfo(username, LoginStatusEnum.LOGIN_SUCCESS);
loginUser.setSysUser(sysUser);
return loginUser;
}
@ -74,7 +74,7 @@ public class UserService {
}
public void logout(String username) {
recordLoginInfo(username, LoginStatusEnum.LOGOUT_SUCCESS, "退出成功");
recordLoginInfo(username, LoginStatusEnum.LOGOUT_SUCCESS);
}
/**
@ -82,19 +82,17 @@ public class UserService {
*
* @param username 用户名
* @param loginStatus 状态
* @param message 消息内容
*/
public void recordLoginInfo(String username, LoginStatusEnum loginStatus, String message) {
public void recordLoginInfo(String username, LoginStatusEnum loginStatus) {
SysLoginInfo loginInfo = new SysLoginInfo();
HttpServletRequest request = ServletUtils.getRequest();
//获取request
String ipAddr = IPUtils.clientIp(request);
loginInfo.setUserName(username);
loginInfo.setUsername(username);
loginInfo.setIpaddr(ipAddr);
loginInfo.setMsg(message);
loginInfo.setMsg(loginStatus.getDesc());
loginInfo.setStatus(loginStatus);
try {
loginInfoService.saveLoginInfo(loginInfo, SecurityConstants.INNER);
} catch (Exception e) {

View File

@ -11,7 +11,7 @@ import javax.validation.constraints.NotNull;
@Data
public class CancelUserRole {
@NotNull(message = "role id is null")
private Integer roleId;
private Long roleId;
@NotNull(message = "user id is null")
private Integer[] userIds;
private Long[] userIds;
}

View File

@ -12,11 +12,11 @@ import lombok.EqualsAndHashCode;
public class ListUserDTO extends CommonParam {
private String username;
private Integer roleId;
private Long roleId;
/**
* 部门id
*/
private Integer deptId;
private Long deptId;
private Integer status;
private String phone;

View File

@ -14,9 +14,12 @@ import lombok.Getter;
@AllArgsConstructor
public enum LoginStatusEnum implements IEnum<Integer> {
LOGIN_SUCCESS(0, "登录成功"),
LOGOUT_SUCCESS(1, "登录失败"),
LOGOUT_SUCCESS(1, "退出成功"),
REGISTER_SUCCESS(2, "注册成功"),
LOGIN_FAIL_STATUS(3, "注销成功"),
LOGIN_FAIL_STATUS(6, "注销失败"),
ACCOUNT_EMPTY(3, "登录用户不存在"),
ACCOUNT_STATUS_ERROR(4, "用户已停用,请联系管理员"),
ACCOUNT_PASS_ERROR(5, "用户密码错误"),
;
@JsonValue

View File

@ -28,7 +28,7 @@ public class SysLoginInfo extends BaseEntity {
private Long infoId;
@TableField(value = "username")
private String userName;
private String username;
@TableField(value = "status")
private LoginStatusEnum status;

View File

@ -41,7 +41,7 @@ public class SysMenu extends BaseEntity {
/**
* 父级菜单id
*/
private Integer parentId;
private Long parentId;
/**
* 排序显示用
*/

View File

@ -30,12 +30,12 @@ public class SysUserPost implements Serializable {
/**
* 岗位Id
*/
private Integer postId;
private Long postId;
/**
* 用户Id
*/
private Integer userId;
private Long userId;
}

View File

@ -40,9 +40,12 @@ public class SysLogController {
return AjaxResult.success(page);
}
/**
* 清空全部操作日志数据
*/
@DeleteMapping(value = "/clean")
@SysLog(value = "日志",businessType = BusinessType.CLEAR)
@RequiresPermissions(value = "system:log:delete")
@RequiresPermissions(value = "system:log:clear")
public AjaxResult cleanLog(){
sysLogService.cleanLog();
return AjaxResult.success();

View File

@ -18,7 +18,7 @@ import java.util.List;
* @date: 2024/5/9 15:53
*/
public interface ISysPostService extends IService<SysPost> {
@DataScope(deptAlias = "d")
@DataScope(tableAlias = "d")
default PageResult pagePostList(SysPost sysPost, CommonParam commonParam){
IPage<SysPost> page = this.page(
new com.baomidou.mybatisplus.extension.plugins.pagination.Page<>(commonParam.getPage(), commonParam.getLimit()),

View File

@ -14,7 +14,7 @@ import java.util.stream.Collectors;
*/
public interface ISysUserPostService extends IService<SysUserPost> {
@Transactional
default void saveOrUpdate(Integer userId, Integer[] roleIdList){
default void saveOrUpdate(Long userId, Long[] roleIdList){
//先删除用户与岗位
this.remove(new LambdaQueryWrapper<SysUserPost>()
.eq(SysUserPost::getUserId, userId));

View File

@ -50,7 +50,7 @@ public interface ISysUserRoleService extends IService<SysUserRole> {
}).collect(Collectors.toList()));
}
default void deleteUserRoleByUserId(Integer userId){
default void deleteUserRoleByUserId(Long userId){
remove(new LambdaQueryWrapper<SysUserRole>()
.eq(SysUserRole::getUserId, userId));
}
@ -60,7 +60,7 @@ public interface ISysUserRoleService extends IService<SysUserRole> {
.eq(SysUserRole::getRoleId, roleId));
}
default void removeByUserIdAndRoleId(Collection<Integer> userIds, Integer roleId){
default void removeByUserIdAndRoleId(Collection<Long> userIds, Long roleId){
remove(new LambdaQueryWrapper<SysUserRole>()
.eq(SysUserRole::getRoleId, roleId)
.in(SysUserRole::getUserId, userIds));

View File

@ -41,7 +41,7 @@ public class SysDeptServiceImpl extends ServiceImpl<SysDeptMapper, SysDept> impl
ISysUserService userService;
@Override
@DataScope(deptAlias = "d")
@DataScope(tableAlias = "d")
public List<SysDept> selectDeptList(ListDeptDTO listDept) {
return baseMapper.selectDeptList(listDept);
}

View File

@ -23,7 +23,7 @@ public class SysLoginInfoServiceImpl extends ServiceImpl<SysLoginInfoMapper, Sys
.orderBy(true, "asc".equals(commonParam.getIsAsc()), commonParam.getOrderBy())
.lambda()
.eq(null != loginInfo.getInfoId(), SysLoginInfo::getInfoId, loginInfo.getInfoId())
.eq(StringUtils.isNotEmpty(loginInfo.getUserName()), SysLoginInfo::getUserName, loginInfo.getUserName())
.eq(StringUtils.isNotEmpty(loginInfo.getUsername()), SysLoginInfo::getUsername, loginInfo.getUsername())
.eq(StringUtils.isNotEmpty(loginInfo.getIpaddr()), SysLoginInfo::getIpaddr, loginInfo.getIpaddr())
.eq(null != loginInfo.getStatus(), SysLoginInfo::getStatus, loginInfo.getStatus());
}

View File

@ -96,7 +96,7 @@ public class SysMenuServiceImpl extends ServiceImpl<SysMenuMapper, SysMenu> impl
{
menus = baseMapper.selectMenuTreeByUserId(sysUser.getUserId());
}
return getChildPerms(menus, 0);
return getChildPerms(menus, 0L);
}
@Override
@ -210,7 +210,7 @@ public class SysMenuServiceImpl extends ServiceImpl<SysMenuMapper, SysMenu> impl
public static void main(String[] args) {
SysMenuServiceImpl sysMenuService = new SysMenuServiceImpl();
SysMenu menu = new SysMenu();
menu.setParentId(0);
menu.setParentId(0L);
menu.setMenuName("系统管理");
menu.setPath("system");
menu.setMenuType(MenuTypeEnum.CATALOG);
@ -276,7 +276,7 @@ public class SysMenuServiceImpl extends ServiceImpl<SysMenuMapper, SysMenu> impl
* @param parentId 传入的父节点ID
* @return String
*/
public List<SysMenu> getChildPerms(List<SysMenu> list, int parentId)
public List<SysMenu> getChildPerms(List<SysMenu> list, long parentId)
{
List<SysMenu> returnList = new ArrayList<>();
for (SysMenu menu : list) {

View File

@ -51,7 +51,7 @@ public class SysRoleServiceImpl extends ServiceImpl<SysRoleMapper, SysRole> impl
ISysUserRoleService userRoleService;
@Override
@DataScope(deptAlias = "d")
@DataScope(tableAlias = "r")
public List<SysRole> selectRoleAll(SysRole sysRole) {
return baseMapper.selectRoleList(sysRole);
}
@ -74,7 +74,7 @@ public class SysRoleServiceImpl extends ServiceImpl<SysRoleMapper, SysRole> impl
}
@Override
@DataScope(deptAlias = "d")
@DataScope(tableAlias = "r")
public AjaxResult selectRoleList(ListRoleDTO listRole) {
com.baomidou.mybatisplus.extension.plugins.pagination.Page<SysRole> page = new com.baomidou.mybatisplus.extension.plugins.pagination.Page<>(listRole.getPage(), listRole.getLimit());
List<SysRole> listAfDataVOList = baseMapper.listRole(listRole, page);
@ -87,7 +87,7 @@ public class SysRoleServiceImpl extends ServiceImpl<SysRoleMapper, SysRole> impl
}
@Override
@DataScope(deptAlias = "d")
@DataScope(tableAlias = "r")
public void checkRoleDataScope(SysRole role) {
// 登录用户非管理员时进行判断 , 判断当前登录用户的角色是否包含以下角色
if (!SecurityUtils.isAdmin()) {

View File

@ -50,7 +50,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
ISysPostService sysPostService;
@Override
@DataScope(deptAlias = "d", userAlias = "u")
@DataScope(tableAlias = "u", userAlias = "u")
public AjaxResult listUser(ListUserDTO listUser) {
com.baomidou.mybatisplus.extension.plugins.pagination.Page<SysUser> page = new com.baomidou.mybatisplus.extension.plugins.pagination.Page<>(listUser.getPage(),listUser.getLimit());
@ -82,7 +82,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
* 判断当前登录用户 有没有 被修改用户的权限
*/
@Override
@DataScope(deptAlias = "d", userAlias = "u")
@DataScope(tableAlias = "d", userAlias = "u")
public void checkUserDataScope(SysUser user)
{
//登录用户非管理员时进行判断 && 待操作的用户也不为管理员
@ -151,7 +151,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
}
@Override
@DataScope(deptAlias = "d", userAlias = "u")
@DataScope(tableAlias = "d", userAlias = "u")
public AjaxResult selectAllocatedList(ListUserDTO listUser) {
com.baomidou.mybatisplus.extension.plugins.pagination.Page<SysUser> page =
new com.baomidou.mybatisplus.extension.plugins.pagination.Page<>(listUser.getPage(),listUser.getLimit());
@ -165,7 +165,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
}
@Override
@DataScope(deptAlias = "d", userAlias = "u")
@DataScope(tableAlias = "d", userAlias = "u")
public AjaxResult selectUnallocatedList(ListUserDTO listUser) {
com.baomidou.mybatisplus.extension.plugins.pagination.Page<SysUser> page = new com.baomidou.mybatisplus.extension.plugins.pagination.Page<>(listUser.getPage(),listUser.getLimit());

View File

@ -100,7 +100,7 @@
<!-- </appender>-->
<!-- Level: FATAL 0 ERROR 3 WARN 4 INFO 6 DEBUG 7 -->
<root level="debug">
<root level="info">
<appender-ref ref="console"/>
<appender-ref ref="info"/>
<appender-ref ref="debug"/>

View File

@ -159,7 +159,7 @@
m.create_time
FROM
sys_menu m
LEFT JOIN sys_role_menu rm ON m.menu_id = rm.menu_id
INNER JOIN sys_role_menu rm ON m.menu_id = rm.menu_id
AND rm.role_id in (
SELECT
ur.role_id

View File

@ -24,7 +24,6 @@
from sys_role r
left join sys_user_role ur on ur.role_id = r.role_id
left join sys_user u on u.user_id = ur.user_id
left join sys_dept d on u.dept_id = d.dept_id
</sql>
<select id="selectRoleList" resultMap="SysRole"
@ -32,9 +31,8 @@
select distinct r.role_id, r.role_name, r.role_key, r.order_num, r.data_scope, r.menu_check_strictly, r.dept_check_strictly,
r.status, r.del_state, r.create_time, r.remark, r.update_time, r.create_by
from sys_role r
left join sys_user_role ur on ur.role_id = r.role_id ${sqlParam.get('roleScope')}
left join sys_user_role ur on ur.role_id = r.role_id
left join sys_user u on u.user_id = ur.user_id
left join sys_dept d on u.dept_id = d.dept_id
where r.del_state = FALSE
<if test="roleId != null and roleId != 0">
@ -58,9 +56,8 @@
select distinct r.role_id, r.role_name, r.role_key, r.order_num, r.data_scope, r.menu_check_strictly, r.dept_check_strictly,
r.status, r.del_state, r.create_time, r.remark, r.update_time, r.create_by
from sys_role r
left join sys_user_role ur on ur.role_id = r.role_id ${listRole.sqlParam.get('roleScope')}
left join sys_user_role ur on ur.role_id = r.role_id
left join sys_user u on u.user_id = ur.user_id
left join sys_dept d on u.dept_id = d.dept_id
where r.del_state = FALSE
<if test="listRole.roleName != null and listRole.roleName != ''">

View File

@ -573,6 +573,11 @@
</resources>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>${maven-jar-plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>