1. 统一包名修改
This commit is contained in:
chenbowen
@@ -0,0 +1,56 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<parent>
|
||||
<artifactId>zt-framework</artifactId>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<version>${revision}</version>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<artifactId>zt-spring-boot-starter-biz-data-permission</artifactId>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
<name>${project.artifactId}</name>
|
||||
<description>数据权限</description>
|
||||
<url>https://github.com/YunaiV/ruoyi-vue-pro</url>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-common</artifactId>
|
||||
</dependency>
|
||||
|
||||
<!-- Web 相关 -->
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-spring-boot-starter-security</artifactId>
|
||||
<optional>true</optional> <!-- 可选，如果使用 DeptDataPermissionRule 必须提供 -->
|
||||
</dependency>
|
||||
|
||||
<!-- DB 相关 -->
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-spring-boot-starter-mybatis</artifactId>
|
||||
</dependency>
|
||||
|
||||
<!-- RPC 远程调用相关 -->
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-spring-boot-starter-rpc</artifactId>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
|
||||
<!-- Test 测试相关 -->
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-spring-boot-starter-test</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>com.zt.plat</groupId>
|
||||
<artifactId>zt-spring-boot-starter-biz-tenant</artifactId>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
</project>
|
||||
@@ -0,0 +1,54 @@
|
||||
package com.zt.plat.framework.datapermission.config;
|
||||
|
||||
import cn.hutool.extra.spring.SpringUtil;
|
||||
import com.zt.plat.framework.common.biz.system.permission.PermissionCommonApi;
|
||||
import com.zt.plat.framework.datapermission.core.rule.company.CompanyDataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.company.CompanyDataPermissionRuleCustomizer;
|
||||
import com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRuleCustomizer;
|
||||
import com.zt.plat.framework.security.core.LoginUser;
|
||||
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
|
||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* 基于部门的数据权限 AutoConfiguration
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@AutoConfiguration
|
||||
@ConditionalOnClass(LoginUser.class)
|
||||
@ConditionalOnBean(value = {CompanyDataPermissionRuleCustomizer.class, DeptDataPermissionRuleCustomizer.class})
|
||||
public class CloudBusinessDataPermissionAutoConfiguration {
|
||||
|
||||
@Bean
|
||||
public CompanyDataPermissionRule companyDataPermissionRule(List<CompanyDataPermissionRuleCustomizer> customizers) {
|
||||
|
||||
// 创建 CompanyDataPermissionRule 对象
|
||||
CompanyDataPermissionRule rule = new CompanyDataPermissionRule();
|
||||
// 补全表配置
|
||||
customizers.forEach(customizer -> customizer.customize(rule));
|
||||
return rule;
|
||||
}
|
||||
|
||||
@Bean
|
||||
public DeptDataPermissionRule deptBusinessDataPermissionRule(PermissionCommonApi permissionApi, List<DeptDataPermissionRuleCustomizer> customizers) {
|
||||
// Cloud 专属逻辑：优先使用本地的 PermissionApi 实现类，而不是 Feign 调用
|
||||
// 原因：在创建租户时，租户还没创建好，导致 Feign 调用获取数据权限时，报“租户不存在”的错误
|
||||
try {
|
||||
PermissionCommonApi permissionApiImpl = SpringUtil.getBean("permissionApiImpl", PermissionCommonApi.class);
|
||||
if (permissionApiImpl != null) {
|
||||
permissionApi = permissionApiImpl;
|
||||
}
|
||||
} catch (Exception ignored) {}
|
||||
|
||||
// 创建 DeptDataPermissionRule 对象
|
||||
DeptDataPermissionRule rule = new DeptDataPermissionRule(permissionApi);
|
||||
// 补全表配置
|
||||
customizers.forEach(customizer -> customizer.customize(rule));
|
||||
return rule;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
package com.zt.plat.framework.datapermission.config;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionAnnotationAdvisor;
|
||||
import com.zt.plat.framework.datapermission.core.db.DataPermissionRuleHandler;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRuleFactory;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRuleFactoryImpl;
|
||||
import com.zt.plat.framework.mybatis.core.util.MyBatisUtils;
|
||||
import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
|
||||
import com.baomidou.mybatisplus.extension.plugins.inner.DataPermissionInterceptor;
|
||||
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* 数据权限的自动配置类
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@AutoConfiguration
|
||||
public class CloudDataPermissionAutoConfiguration {
|
||||
|
||||
@Bean
|
||||
public DataPermissionRuleFactory dataPermissionRuleFactory(List<DataPermissionRule> rules) {
|
||||
return new DataPermissionRuleFactoryImpl(rules);
|
||||
}
|
||||
|
||||
@Bean
|
||||
public DataPermissionRuleHandler dataPermissionRuleHandler(MybatisPlusInterceptor interceptor,
|
||||
DataPermissionRuleFactory ruleFactory) {
|
||||
// 创建 DataPermissionInterceptor 拦截器
|
||||
DataPermissionRuleHandler handler = new DataPermissionRuleHandler(ruleFactory);
|
||||
DataPermissionInterceptor inner = new DataPermissionInterceptor(handler);
|
||||
// 添加到 interceptor 中
|
||||
// 需要加在首个，主要是为了在分页插件前面。这个是 MyBatis Plus 的规定
|
||||
MyBatisUtils.addInterceptor(interceptor, inner, 0);
|
||||
return handler;
|
||||
}
|
||||
|
||||
@Bean
|
||||
public DataPermissionAnnotationAdvisor dataPermissionAnnotationAdvisor() {
|
||||
return new DataPermissionAnnotationAdvisor();
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
package com.zt.plat.framework.datapermission.config;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.rpc.DataPermissionRequestInterceptor;
|
||||
import com.zt.plat.framework.datapermission.core.rpc.DataPermissionRpcWebFilter;
|
||||
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
|
||||
import org.springframework.boot.web.servlet.FilterRegistrationBean;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
|
||||
import static com.zt.plat.framework.common.enums.WebFilterOrderEnum.TENANT_CONTEXT_FILTER;
|
||||
|
||||
/**
|
||||
* 数据权限针对 RPC 的自动配置类
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@AutoConfiguration
|
||||
@ConditionalOnClass(name = "feign.RequestInterceptor")
|
||||
public class CloudDataPermissionRpcAutoConfiguration {
|
||||
|
||||
@Bean
|
||||
public DataPermissionRequestInterceptor dataPermissionRequestInterceptor() {
|
||||
return new DataPermissionRequestInterceptor();
|
||||
}
|
||||
|
||||
@Bean
|
||||
public FilterRegistrationBean<DataPermissionRpcWebFilter> dataPermissionRpcFilter() {
|
||||
FilterRegistrationBean<DataPermissionRpcWebFilter> registrationBean = new FilterRegistrationBean<>();
|
||||
registrationBean.setFilter(new DataPermissionRpcWebFilter());
|
||||
registrationBean.setOrder(TENANT_CONTEXT_FILTER - 1); // 顺序没有绝对的要求，在租户 Filter 前面稳妥点
|
||||
return registrationBean;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
package com.zt.plat.framework.datapermission.config;
|
||||
|
||||
import cn.hutool.extra.spring.SpringUtil;
|
||||
import com.zt.plat.framework.common.biz.system.permission.PermissionCommonApi;
|
||||
import com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRuleCustomizer;
|
||||
import com.zt.plat.framework.security.core.LoginUser;
|
||||
import org.springframework.beans.factory.annotation.Qualifier;
|
||||
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
|
||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* 基于部门的数据权限 AutoConfiguration
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@AutoConfiguration
|
||||
@ConditionalOnClass(LoginUser.class)
|
||||
@ConditionalOnBean(value = {PermissionCommonApi.class, DeptDataPermissionRuleCustomizer.class})
|
||||
public class CloudDeptDataPermissionAutoConfiguration {
|
||||
|
||||
@Bean
|
||||
public DeptDataPermissionRule deptDataPermissionRule(PermissionCommonApi permissionApi, List<DeptDataPermissionRuleCustomizer> customizers) {
|
||||
// Cloud 专属逻辑：优先使用本地的 PermissionApi 实现类，而不是 Feign 调用
|
||||
// 原因：在创建租户时，租户还没创建好，导致 Feign 调用获取数据权限时，报“租户不存在”的错误
|
||||
try {
|
||||
PermissionCommonApi permissionApiImpl = SpringUtil.getBean("permissionApiImpl", PermissionCommonApi.class);
|
||||
if (permissionApiImpl != null) {
|
||||
permissionApi = permissionApiImpl;
|
||||
}
|
||||
} catch (Exception ignored) {}
|
||||
|
||||
// 创建 DeptDataPermissionRule 对象
|
||||
DeptDataPermissionRule rule = new DeptDataPermissionRule(permissionApi);
|
||||
// 补全表配置
|
||||
customizers.forEach(customizer -> customizer.customize(rule));
|
||||
return rule;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
package com.zt.plat.framework.datapermission.core.annotation;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
|
||||
import java.lang.annotation.*;
|
||||
|
||||
/**
|
||||
* 数据权限注解
|
||||
* 可声明在类或者方法上，标识使用的数据权限规则
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@Target({ElementType.TYPE, ElementType.METHOD})
|
||||
@Retention(RetentionPolicy.RUNTIME)
|
||||
@Documented
|
||||
public @interface DataPermission {
|
||||
|
||||
/**
|
||||
* 当前类或方法是否开启数据权限
|
||||
* 即使不添加 @DataPermission 注解，默认是开启状态
|
||||
* 可通过设置 enable 为 false 禁用
|
||||
*/
|
||||
boolean enable() default true;
|
||||
|
||||
/**
|
||||
* 生效的数据权限规则数组，优先级高于 {@link #excludeRules()}
|
||||
*/
|
||||
Class<? extends DataPermissionRule>[] includeRules() default {};
|
||||
|
||||
/**
|
||||
* 排除的数据权限规则数组，优先级最低
|
||||
*/
|
||||
Class<? extends DataPermissionRule>[] excludeRules() default {};
|
||||
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
package com.zt.plat.framework.datapermission.core.aop;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import lombok.EqualsAndHashCode;
|
||||
import lombok.Getter;
|
||||
import org.aopalliance.aop.Advice;
|
||||
import org.springframework.aop.Pointcut;
|
||||
import org.springframework.aop.support.AbstractPointcutAdvisor;
|
||||
import org.springframework.aop.support.ComposablePointcut;
|
||||
import org.springframework.aop.support.annotation.AnnotationMatchingPointcut;
|
||||
|
||||
/**
|
||||
* {@link com.zt.plat.framework.datapermission.core.annotation.DataPermission} 注解的 Advisor 实现类
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@Getter
|
||||
@EqualsAndHashCode(callSuper = true)
|
||||
public class DataPermissionAnnotationAdvisor extends AbstractPointcutAdvisor {
|
||||
|
||||
private final Advice advice;
|
||||
|
||||
private final Pointcut pointcut;
|
||||
|
||||
public DataPermissionAnnotationAdvisor() {
|
||||
this.advice = new DataPermissionAnnotationInterceptor();
|
||||
this.pointcut = this.buildPointcut();
|
||||
}
|
||||
|
||||
protected Pointcut buildPointcut() {
|
||||
Pointcut classPointcut = new AnnotationMatchingPointcut(DataPermission.class, true);
|
||||
Pointcut methodPointcut = new AnnotationMatchingPointcut(null, DataPermission.class, true);
|
||||
return new ComposablePointcut(classPointcut).union(methodPointcut);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
package com.zt.plat.framework.datapermission.core.aop;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import lombok.Getter;
|
||||
import org.aopalliance.intercept.MethodInterceptor;
|
||||
import org.aopalliance.intercept.MethodInvocation;
|
||||
import org.springframework.core.MethodClassKey;
|
||||
import org.springframework.core.annotation.AnnotationUtils;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Map;
|
||||
import java.util.concurrent.ConcurrentHashMap;
|
||||
|
||||
/**
|
||||
* {@link DataPermission} 注解的拦截器
|
||||
* 1. 在执行方法前，将 @DataPermission 注解入栈
|
||||
* 2. 在执行方法后，将 @DataPermission 注解出栈
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@DataPermission // 该注解，用于 {@link DATA_PERMISSION_NULL} 的空对象
|
||||
public class DataPermissionAnnotationInterceptor implements MethodInterceptor {
|
||||
|
||||
/**
|
||||
* DataPermission 空对象，用于方法无 {@link DataPermission} 注解时，使用 DATA_PERMISSION_NULL 进行占位
|
||||
*/
|
||||
static final DataPermission DATA_PERMISSION_NULL = DataPermissionAnnotationInterceptor.class.getAnnotation(DataPermission.class);
|
||||
|
||||
@Getter
|
||||
private final Map<MethodClassKey, DataPermission> dataPermissionCache = new ConcurrentHashMap<>();
|
||||
|
||||
@Override
|
||||
public Object invoke(MethodInvocation methodInvocation) throws Throwable {
|
||||
// 入栈
|
||||
DataPermission dataPermission = this.findAnnotation(methodInvocation);
|
||||
if (dataPermission != null) {
|
||||
DataPermissionContextHolder.add(dataPermission);
|
||||
}
|
||||
try {
|
||||
// 执行逻辑
|
||||
return methodInvocation.proceed();
|
||||
} finally {
|
||||
// 出栈
|
||||
if (dataPermission != null) {
|
||||
DataPermissionContextHolder.remove();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private DataPermission findAnnotation(MethodInvocation methodInvocation) {
|
||||
// 1. 从缓存中获取
|
||||
Method method = methodInvocation.getMethod();
|
||||
Object targetObject = methodInvocation.getThis();
|
||||
Class<?> clazz = targetObject != null ? targetObject.getClass() : method.getDeclaringClass();
|
||||
MethodClassKey methodClassKey = new MethodClassKey(method, clazz);
|
||||
DataPermission dataPermission = dataPermissionCache.get(methodClassKey);
|
||||
if (dataPermission != null) {
|
||||
return dataPermission != DATA_PERMISSION_NULL ? dataPermission : null;
|
||||
}
|
||||
|
||||
// 2.1 从方法中获取
|
||||
dataPermission = AnnotationUtils.findAnnotation(method, DataPermission.class);
|
||||
// 2.2 从类上获取
|
||||
if (dataPermission == null) {
|
||||
dataPermission = AnnotationUtils.findAnnotation(clazz, DataPermission.class);
|
||||
}
|
||||
// 2.3 添加到缓存中
|
||||
dataPermissionCache.put(methodClassKey, dataPermission != null ? dataPermission : DATA_PERMISSION_NULL);
|
||||
return dataPermission;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
package com.zt.plat.framework.datapermission.core.aop;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.alibaba.ttl.TransmittableThreadLocal;
|
||||
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* {@link DataPermission} 注解的 Context 上下文
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionContextHolder {
|
||||
|
||||
/**
|
||||
* 使用 List 的原因，可能存在方法的嵌套调用
|
||||
*/
|
||||
private static final ThreadLocal<LinkedList<DataPermission>> DATA_PERMISSIONS =
|
||||
TransmittableThreadLocal.withInitial(LinkedList::new);
|
||||
|
||||
/**
|
||||
* 获得当前的 DataPermission 注解
|
||||
*
|
||||
* @return DataPermission 注解
|
||||
*/
|
||||
public static DataPermission get() {
|
||||
return DATA_PERMISSIONS.get().peekLast();
|
||||
}
|
||||
|
||||
/**
|
||||
* 入栈 DataPermission 注解
|
||||
*
|
||||
* @param dataPermission DataPermission 注解
|
||||
*/
|
||||
public static void add(DataPermission dataPermission) {
|
||||
DATA_PERMISSIONS.get().addLast(dataPermission);
|
||||
}
|
||||
|
||||
/**
|
||||
* 出栈 DataPermission 注解
|
||||
*
|
||||
* @return DataPermission 注解
|
||||
*/
|
||||
public static DataPermission remove() {
|
||||
DataPermission dataPermission = DATA_PERMISSIONS.get().removeLast();
|
||||
// 无元素时，清空 ThreadLocal
|
||||
if (DATA_PERMISSIONS.get().isEmpty()) {
|
||||
DATA_PERMISSIONS.remove();
|
||||
}
|
||||
return dataPermission;
|
||||
}
|
||||
|
||||
/**
|
||||
* 获得所有 DataPermission
|
||||
*
|
||||
* @return DataPermission 队列
|
||||
*/
|
||||
public static List<DataPermission> getAll() {
|
||||
return DATA_PERMISSIONS.get();
|
||||
}
|
||||
|
||||
/**
|
||||
* 清空上下文
|
||||
*
|
||||
* 目前仅仅用于单测
|
||||
*/
|
||||
public static void clear() {
|
||||
DATA_PERMISSIONS.remove();
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
package com.zt.plat.framework.datapermission.core.db;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRuleFactory;
|
||||
import com.zt.plat.framework.mybatis.core.util.MyBatisUtils;
|
||||
import com.baomidou.mybatisplus.extension.plugins.handler.MultiDataPermissionHandler;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
import net.sf.jsqlparser.expression.operators.conditional.AndExpression;
|
||||
import net.sf.jsqlparser.schema.Table;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
import static com.zt.plat.framework.security.core.util.SecurityFrameworkUtils.skipPermissionCheck;
|
||||
|
||||
/**
|
||||
* 基于 {@link DataPermissionRule} 的数据权限处理器
|
||||
*
|
||||
* 它的底层，是基于 MyBatis Plus 的 <a href="https://baomidou.com/plugins/data-permission/">数据权限插件</a>
|
||||
* 核心原理：它会在 SQL 执行前拦截 SQL 语句，并根据用户权限动态添加权限相关的 SQL 片段。这样，只有用户有权限访问的数据才会被查询出来
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@RequiredArgsConstructor
|
||||
public class DataPermissionRuleHandler implements MultiDataPermissionHandler {
|
||||
|
||||
private final DataPermissionRuleFactory ruleFactory;
|
||||
|
||||
@Override
|
||||
public Expression getSqlSegment(Table table, Expression where, String mappedStatementId) {
|
||||
// 特殊：跨租户访问
|
||||
if (skipPermissionCheck()) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// 获得 Mapper 对应的数据权限的规则
|
||||
List<DataPermissionRule> rules = ruleFactory.getDataPermissionRule(mappedStatementId);
|
||||
if (CollUtil.isEmpty(rules)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// 生成条件
|
||||
Expression allExpression = null;
|
||||
for (DataPermissionRule rule : rules) {
|
||||
// 判断表名是否匹配
|
||||
String tableName = MyBatisUtils.getTableName(table);
|
||||
if (!rule.getTableNames().contains(tableName)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// 单条规则的条件
|
||||
Expression oneExpress = rule.getExpression(tableName, table.getAlias());
|
||||
if (oneExpress == null) {
|
||||
continue;
|
||||
}
|
||||
// 拼接到 allExpression 中
|
||||
allExpression = allExpression == null ? oneExpress
|
||||
: new AndExpression(allExpression, oneExpress);
|
||||
}
|
||||
return allExpression;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
package com.zt.plat.framework.datapermission.core.rpc;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import feign.RequestInterceptor;
|
||||
import feign.RequestTemplate;
|
||||
|
||||
/**
|
||||
* DataPermission 的 RequestInterceptor 实现类：Feign 请求时，将 {@link DataPermission} 设置到 header 中，继续透传给被调用的服务
|
||||
*
|
||||
* 注意：由于 {@link DataPermission} 不支持序列化和反序列化，所以暂时只能传递它的 enable 属性
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionRequestInterceptor implements RequestInterceptor {
|
||||
|
||||
public static final String ENABLE_HEADER_NAME = "data-permission-enable";
|
||||
|
||||
@Override
|
||||
public void apply(RequestTemplate requestTemplate) {
|
||||
DataPermission dataPermission = DataPermissionContextHolder.get();
|
||||
if (dataPermission != null && Boolean.FALSE.equals(dataPermission.enable())) {
|
||||
requestTemplate.header(ENABLE_HEADER_NAME, "false");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
package com.zt.plat.framework.datapermission.core.rpc;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import com.zt.plat.framework.datapermission.core.util.DataPermissionUtils;
|
||||
import jakarta.servlet.FilterChain;
|
||||
import jakarta.servlet.ServletException;
|
||||
import jakarta.servlet.http.HttpServletRequest;
|
||||
import jakarta.servlet.http.HttpServletResponse;
|
||||
import org.springframework.web.filter.OncePerRequestFilter;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* 针对 {@link DataPermissionRequestInterceptor} 的 RPC 调用，设置 {@link DataPermissionContextHolder} 的上下文
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionRpcWebFilter extends OncePerRequestFilter {
|
||||
|
||||
@Override
|
||||
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
|
||||
throws ServletException, IOException {
|
||||
String enable = request.getHeader(DataPermissionRequestInterceptor.ENABLE_HEADER_NAME);
|
||||
if (Objects.equals(enable, Boolean.FALSE.toString())) {
|
||||
DataPermissionUtils.executeIgnore(() -> {
|
||||
try {
|
||||
chain.doFilter(request, response);
|
||||
} catch (IOException | ServletException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
});
|
||||
} else {
|
||||
chain.doFilter(request, response);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule;
|
||||
|
||||
import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
|
||||
import net.sf.jsqlparser.expression.Alias;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* 数据权限规则接口
|
||||
* 通过实现接口，自定义数据规则。例如说，
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public interface DataPermissionRule {
|
||||
|
||||
/**
|
||||
* 返回需要生效的表名数组
|
||||
* 为什么需要该方法？Data Permission 数组基于 SQL 重写，通过 Where 返回只有权限的数据
|
||||
*
|
||||
* 如果需要基于实体名获得表名，可调用 {@link TableInfoHelper#getTableInfo(Class)} 获得
|
||||
*
|
||||
* @return 表名数组
|
||||
*/
|
||||
Set<String> getTableNames();
|
||||
|
||||
/**
|
||||
* 根据表名和别名，生成对应的 WHERE / OR 过滤条件
|
||||
*
|
||||
* @param tableName 表名
|
||||
* @param tableAlias 别名，可能为空
|
||||
* @return 过滤条件 Expression 表达式
|
||||
*/
|
||||
Expression getExpression(String tableName, Alias tableAlias);
|
||||
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule;
|
||||
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* {@link DataPermissionRule} 工厂接口
|
||||
* 作为 {@link DataPermissionRule} 的容器，提供管理能力
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public interface DataPermissionRuleFactory {
|
||||
|
||||
/**
|
||||
* 获得所有数据权限规则数组
|
||||
*
|
||||
* @return 数据权限规则数组
|
||||
*/
|
||||
List<DataPermissionRule> getDataPermissionRules();
|
||||
|
||||
/**
|
||||
* 获得指定 Mapper 的数据权限规则数组
|
||||
*
|
||||
* @param mappedStatementId 指定 Mapper 的编号
|
||||
* @return 数据权限规则数组
|
||||
*/
|
||||
List<DataPermissionRule> getDataPermissionRule(String mappedStatementId);
|
||||
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import cn.hutool.core.util.ArrayUtil;
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import lombok.RequiredArgsConstructor;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* 默认的 DataPermissionRuleFactoryImpl 实现类
|
||||
* 支持通过 {@link DataPermissionContextHolder} 过滤数据权限
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@RequiredArgsConstructor
|
||||
public class DataPermissionRuleFactoryImpl implements DataPermissionRuleFactory {
|
||||
|
||||
/**
|
||||
* 数据权限规则数组
|
||||
*/
|
||||
private final List<DataPermissionRule> rules;
|
||||
|
||||
@Override
|
||||
public List<DataPermissionRule> getDataPermissionRules() {
|
||||
return rules;
|
||||
}
|
||||
|
||||
@Override // mappedStatementId 参数，暂时没有用。以后，可以基于 mappedStatementId + DataPermission 进行缓存
|
||||
public List<DataPermissionRule> getDataPermissionRule(String mappedStatementId) {
|
||||
// 1. 无数据权限
|
||||
if (CollUtil.isEmpty(rules)) {
|
||||
return Collections.emptyList();
|
||||
}
|
||||
// 2. 未配置，则默认开启
|
||||
DataPermission dataPermission = DataPermissionContextHolder.get();
|
||||
if (dataPermission == null) {
|
||||
return rules;
|
||||
}
|
||||
// 3. 已配置，但禁用
|
||||
if (!dataPermission.enable()) {
|
||||
return Collections.emptyList();
|
||||
}
|
||||
|
||||
// 4. 已配置，只选择部分规则
|
||||
if (ArrayUtil.isNotEmpty(dataPermission.includeRules())) {
|
||||
return rules.stream().filter(rule -> ArrayUtil.contains(dataPermission.includeRules(), rule.getClass()))
|
||||
.collect(Collectors.toList()); // 一般规则不会太多，所以不采用 HashSet 查询
|
||||
}
|
||||
// 5. 已配置，只排除部分规则
|
||||
if (ArrayUtil.isNotEmpty(dataPermission.excludeRules())) {
|
||||
return rules.stream().filter(rule -> !ArrayUtil.contains(dataPermission.excludeRules(), rule.getClass()))
|
||||
.collect(Collectors.toList()); // 一般规则不会太多，所以不采用 HashSet 查询
|
||||
}
|
||||
// 6. 已配置，全部规则
|
||||
return rules;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule.company;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import cn.hutool.core.util.StrUtil;
|
||||
import com.zt.plat.framework.common.util.collection.CollectionUtils;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
import com.zt.plat.framework.mybatis.core.util.MyBatisUtils;
|
||||
import lombok.AllArgsConstructor;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.sf.jsqlparser.expression.*;
|
||||
import net.sf.jsqlparser.expression.operators.relational.ExpressionList;
|
||||
import net.sf.jsqlparser.expression.operators.relational.InExpression;
|
||||
import net.sf.jsqlparser.expression.operators.relational.ParenthesedExpressionList;
|
||||
|
||||
import java.util.*;
|
||||
|
||||
import static com.zt.plat.framework.security.core.util.SecurityFrameworkUtils.getLoginUserCompanyId;
|
||||
|
||||
/**
|
||||
* 基于公司类型部门的 {@link DataPermissionRule} 数据权限规则实现
|
||||
* 注意，使用 CompanyDataPermissionRule 时，需要保证表中有 company_id 公司编号的字段，可自定义。
|
||||
*
|
||||
* @author chenbowen
|
||||
*/
|
||||
@AllArgsConstructor
|
||||
@Slf4j
|
||||
public class CompanyDataPermissionRule implements DataPermissionRule {
|
||||
static final Expression EXPRESSION_NULL = new NullValue();
|
||||
|
||||
/**
|
||||
* 基于部门的表字段配置
|
||||
* 一般情况下，每个表的部门编号字段是 dept_id，通过该配置自定义。
|
||||
* key：表名
|
||||
* value：字段名
|
||||
*/
|
||||
private final Map<String, String> companyColumns = new HashMap<>();
|
||||
/**
|
||||
* 所有表名，是 {@link #companyColumns} 的合集
|
||||
*/
|
||||
private final Set<String> TABLE_NAMES = new HashSet<>();
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return TABLE_NAMES;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
// 业务拼接 Company 的条件
|
||||
if (getLoginUserCompanyId() == null) {
|
||||
// 如果没有登录用户的公司编号，则不需要拼接条件
|
||||
return null;
|
||||
}
|
||||
Expression companyExpression = buildCompanyExpression(tableName, tableAlias, Collections.singleton(getLoginUserCompanyId()));
|
||||
return Objects.requireNonNullElse(companyExpression, EXPRESSION_NULL);
|
||||
}
|
||||
|
||||
private Expression buildCompanyExpression(String tableName, Alias tableAlias, Set<Long> companyIds) {
|
||||
// 如果不存在配置，则无需作为条件
|
||||
String columnName = companyColumns.get(tableName);
|
||||
if (StrUtil.isEmpty(columnName)) {
|
||||
return null;
|
||||
}
|
||||
// 如果为空，则无条件
|
||||
if (CollUtil.isEmpty(companyIds)) {
|
||||
return null;
|
||||
}
|
||||
// 拼接条件
|
||||
return new InExpression(MyBatisUtils.buildColumn(tableName, tableAlias, columnName),
|
||||
// Parenthesis 的目的，是提供 (1,2,3) 的 () 左右括号
|
||||
new ParenthesedExpressionList<>(new ExpressionList<>(CollectionUtils.convertList(companyIds, LongValue::new))));
|
||||
}
|
||||
|
||||
public void addCompanyColumn(String tableName, String columnName) {
|
||||
companyColumns.put(tableName, columnName);
|
||||
TABLE_NAMES.add(tableName);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule.company;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRule;
|
||||
|
||||
/**
|
||||
* {@link DeptDataPermissionRule} 的自定义配置接口
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@FunctionalInterface
|
||||
public interface CompanyDataPermissionRuleCustomizer {
|
||||
|
||||
/**
|
||||
* 自定义该权限规则
|
||||
* 1. 调用 {@link CompanyDataPermissionRule#addCompanyColumn(Class, String)} 方法，配置基于 dept_id 的过滤规则
|
||||
*
|
||||
* @param rule 权限规则
|
||||
*/
|
||||
void customize(CompanyDataPermissionRule rule);
|
||||
|
||||
}
|
||||
@@ -0,0 +1,260 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule.dept;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import cn.hutool.core.util.ObjectUtil;
|
||||
import cn.hutool.core.util.StrUtil;
|
||||
import com.zt.plat.framework.common.biz.system.permission.PermissionCommonApi;
|
||||
import com.zt.plat.framework.common.biz.system.permission.dto.DeptDataPermissionRespDTO;
|
||||
import com.zt.plat.framework.common.enums.UserTypeEnum;
|
||||
import com.zt.plat.framework.common.util.collection.CollectionUtils;
|
||||
import com.zt.plat.framework.common.util.json.JsonUtils;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
import com.zt.plat.framework.mybatis.core.dataobject.BaseDO;
|
||||
import com.zt.plat.framework.mybatis.core.util.MyBatisUtils;
|
||||
import com.zt.plat.framework.security.core.LoginUser;
|
||||
import com.zt.plat.framework.security.core.util.SecurityFrameworkUtils;
|
||||
import com.zt.plat.framework.tenant.core.context.CompanyContextHolder;
|
||||
import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
|
||||
import lombok.AllArgsConstructor;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.sf.jsqlparser.expression.Alias;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
import net.sf.jsqlparser.expression.LongValue;
|
||||
import net.sf.jsqlparser.expression.NullValue;
|
||||
import net.sf.jsqlparser.expression.operators.conditional.AndExpression;
|
||||
import net.sf.jsqlparser.expression.operators.conditional.OrExpression;
|
||||
import net.sf.jsqlparser.expression.operators.relational.*;
|
||||
import net.sf.jsqlparser.schema.Column;
|
||||
import net.sf.jsqlparser.schema.Table;
|
||||
import net.sf.jsqlparser.statement.select.ParenthesedSelect;
|
||||
import net.sf.jsqlparser.statement.select.PlainSelect;
|
||||
import net.sf.jsqlparser.statement.select.SelectItem;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
import static java.util.Collections.singletonList;
|
||||
|
||||
/**
|
||||
* 基于部门的 {@link DataPermissionRule} 数据权限规则实现
|
||||
*
|
||||
* 注意，使用 DeptDataPermissionRule 时，需要保证表中有 dept_id 部门编号的字段，可自定义。
|
||||
*
|
||||
* 实际业务场景下，会存在一个经典的问题？当用户修改部门时，冗余的 dept_id 是否需要修改？
|
||||
* 1. 一般情况下，dept_id 不进行修改，则会导致用户看不到之前的数据。【cloud-server 采用该方案】
|
||||
* 2. 部分情况下，希望该用户还是能看到之前的数据，则有两种方式解决：【需要你改造该 DeptDataPermissionRule 的实现代码】
|
||||
* 1）编写洗数据的脚本，将 dept_id 修改成新部门的编号；【建议】
|
||||
* 最终过滤条件是 WHERE dept_id = ?
|
||||
* 2）洗数据的话，可能涉及的数据量较大，也可以采用 user_id 进行过滤的方式，此时需要获取到 dept_id 对应的所有 user_id 用户编号；
|
||||
* 最终过滤条件是 WHERE user_id IN (?, ?, ? ...)
|
||||
* 3）想要保证原 dept_id 和 user_id 都可以看的到，此时使用 dept_id 和 user_id 一起过滤；
|
||||
* 最终过滤条件是 WHERE dept_id = ? OR user_id IN (?, ?, ? ...)
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@AllArgsConstructor
|
||||
@Slf4j
|
||||
public class DeptDataPermissionRule implements DataPermissionRule {
|
||||
|
||||
/**
|
||||
* LoginUser 的 Context 缓存 Key
|
||||
*/
|
||||
protected static final String CONTEXT_KEY = DeptDataPermissionRule.class.getSimpleName();
|
||||
|
||||
private static final String DEPT_COLUMN_NAME = "dept_id";
|
||||
private static final String USER_COLUMN_NAME = "user_id";
|
||||
|
||||
static final Expression EXPRESSION_NULL = new NullValue();
|
||||
public static final String SYSTEM_USERS = "system_users";
|
||||
|
||||
private final PermissionCommonApi permissionApi;
|
||||
|
||||
/**
|
||||
* 基于部门的表字段配置
|
||||
* 一般情况下，每个表的部门编号字段是 dept_id，通过该配置自定义。
|
||||
* key：表名
|
||||
* value：字段名
|
||||
*/
|
||||
private final Map<String, String> deptColumns = new HashMap<>();
|
||||
/**
|
||||
* 基于用户的表字段配置
|
||||
* 一般情况下，每个表的部门编号字段是 dept_id，通过该配置自定义。
|
||||
* key：表名
|
||||
* value：字段名
|
||||
*/
|
||||
private final Map<String, String> userColumns = new HashMap<>();
|
||||
/**
|
||||
* 所有表名，是 {@link #deptColumns} 和 {@link #userColumns} 的合集
|
||||
*/
|
||||
private final Set<String> TABLE_NAMES = new HashSet<>();
|
||||
private static final String SYSTEM_USER_DEPT = "system_user_dept";
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return TABLE_NAMES;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
// 只有有登陆用户的情况下，才进行数据权限的处理
|
||||
LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
|
||||
if (loginUser == null) {
|
||||
return null;
|
||||
}
|
||||
// 只有管理员类型的用户，才进行数据权限的处理
|
||||
if (ObjectUtil.notEqual(loginUser.getUserType(), UserTypeEnum.ADMIN.getValue())) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// 获得数据权限
|
||||
DeptDataPermissionRespDTO deptDataPermission = loginUser.getContext(CONTEXT_KEY, DeptDataPermissionRespDTO.class);
|
||||
// 从上下文中拿不到，则调用逻辑进行获取
|
||||
if (deptDataPermission == null) {
|
||||
deptDataPermission = permissionApi.getDeptDataPermission(loginUser.getId()).getCheckedData();
|
||||
if (deptDataPermission == null) {
|
||||
log.error("[getExpression][LoginUser({}) 获取数据权限为 null]", JsonUtils.toJsonString(loginUser));
|
||||
throw new NullPointerException(String.format("LoginUser(%d) Table(%s/%s) 未返回数据权限",
|
||||
loginUser.getId(), tableName, tableAlias.getName()));
|
||||
}
|
||||
// 添加到上下文中，避免重复计算
|
||||
loginUser.setContext(CONTEXT_KEY, deptDataPermission);
|
||||
}
|
||||
// 如果不归属任何部门，且无可查询所有部门的权限，提示当前用户未关联任何部门
|
||||
// if (CollUtil.isEmpty(deptDataPermission.getDeptIds()) && !deptDataPermission.getAll()) {
|
||||
// log.error("[getExpression][LoginUser({}) Table({}/{}) DeptDataPermission({}) 未关联任何部门]", JsonUtils.toJsonString(loginUser), tableName, tableAlias.getName(), JsonUtils.toJsonString(deptDataPermission));
|
||||
// throw new NullPointerException("当前登录用户未关联任何部门，请先联系管理员进行部门关联");
|
||||
// }
|
||||
// 如果开启了公司上下文，且缓存的公司编号不等于 CompanyContextHolder 的公司编号，则更新缓存
|
||||
if(!CompanyContextHolder.isIgnore()) {
|
||||
Long companyId = CompanyContextHolder.getCompanyId();
|
||||
if (companyId != null && !companyId.equals(deptDataPermission.getCompanyId())) {
|
||||
deptDataPermission.setCompanyId(companyId);
|
||||
// 更新到上下文中
|
||||
loginUser.setContext(CONTEXT_KEY, deptDataPermission);
|
||||
}
|
||||
}
|
||||
|
||||
// 情况一，如果是 ALL 可查看全部，则无需拼接条件
|
||||
if (deptDataPermission.getAll()) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// 情况二，即不能查看部门，又不能查看自己，则说明 100% 无权限
|
||||
if (CollUtil.isEmpty(deptDataPermission.getDeptIds())
|
||||
&& Boolean.FALSE.equals(deptDataPermission.getSelf())) {
|
||||
return new EqualsTo(null, null); // WHERE null = null，可以保证返回的数据为空
|
||||
}
|
||||
|
||||
// 情况三，拼接 Dept 和 Company User 的条件，最后组合
|
||||
Expression deptExpression = buildDeptExpression(tableName, tableAlias, deptDataPermission.getDeptIds());
|
||||
// Expression deptExpression = buildDeptExpression(tableName, tableAlias, deptDataPermission.getDeptIds());
|
||||
Expression userExpression = buildUserExpression(tableName, tableAlias, deptDataPermission.getSelf(), loginUser.getId());
|
||||
if (deptExpression == null && userExpression == null) {
|
||||
// TODO 芋艿：获得不到条件的时候，暂时不抛出异常，而是不返回数据
|
||||
log.warn("[getExpression][LoginUser({}) Table({}/{}) DeptDataPermission({}) 构建的条件为空]",
|
||||
JsonUtils.toJsonString(loginUser), tableName, tableAlias, JsonUtils.toJsonString(deptDataPermission));
|
||||
// throw new NullPointerException(String.format("LoginUser(%d) Table(%s/%s) 构建的条件为空",
|
||||
// loginUser.getId(), tableName, tableAlias.getName()));
|
||||
return EXPRESSION_NULL;
|
||||
}
|
||||
if (deptExpression == null) {
|
||||
return userExpression;
|
||||
}
|
||||
if (userExpression == null) {
|
||||
return deptExpression;
|
||||
}
|
||||
// 目前，如果有指定部门 + 可查看自己，采用 OR 条件。即，WHERE (dept_id IN ? OR user_id = ?)
|
||||
return new ParenthesedExpressionList(new OrExpression(deptExpression, userExpression));
|
||||
}
|
||||
|
||||
private Expression buildDeptExpression(String tableName, Alias tableAlias, Set<Long> deptIds) {
|
||||
// 如果不存在配置，则无需作为条件
|
||||
String columnName = deptColumns.get(tableName);
|
||||
// 特殊处理：system_users 表没有 dept_id 字段,已经迁移到了 user_dept 表
|
||||
if (SYSTEM_USERS.equals(tableName)) {
|
||||
// system_users 走 exists 子查询 user_dept
|
||||
if (CollUtil.isEmpty(deptIds)) {
|
||||
return null;
|
||||
}
|
||||
// 构造 exists (select 1 from user_dept where user_dept.user_id = system_users.id and user_dept.dept_id in (...))
|
||||
PlainSelect plainSelect = new PlainSelect();
|
||||
plainSelect.setSelectItems(singletonList(new SelectItem<>(new LongValue(1))));
|
||||
Table userDept = new Table(SYSTEM_USER_DEPT);
|
||||
// 使用 user 表别名避免语法错误
|
||||
Table user = new Table(tableAlias == null ? tableName : tableAlias.getName());
|
||||
plainSelect.setFromItem(userDept);
|
||||
// where user_dept.user_id = system_users.id and user_dept.dept_id in (...)
|
||||
Column userDeptUserIdCol = new Column(userDept, USER_COLUMN_NAME);
|
||||
Column systemUsersIdCol = new Column(user, "id");
|
||||
EqualsTo userIdEquals = new EqualsTo(userDeptUserIdCol, systemUsersIdCol);
|
||||
Column userDeptDeptIdCol = new Column(userDept, DEPT_COLUMN_NAME);
|
||||
InExpression deptIn = new InExpression(userDeptDeptIdCol, new ParenthesedExpressionList<>(new ExpressionList<>(CollectionUtils.convertList(deptIds, LongValue::new))));
|
||||
Expression whereExp = new AndExpression(userIdEquals, deptIn);
|
||||
plainSelect.setWhere(whereExp);
|
||||
//
|
||||
ParenthesedSelect parenthesedSelect = new ParenthesedSelect();
|
||||
parenthesedSelect.setSelect(plainSelect);
|
||||
// 构建 exists 表达式
|
||||
ExistsExpression existsExpr = new ExistsExpression();
|
||||
existsExpr.setRightExpression(parenthesedSelect);
|
||||
return existsExpr;
|
||||
}
|
||||
if (StrUtil.isEmpty(columnName)) {
|
||||
return null;
|
||||
}
|
||||
// 如果为空，则无条件
|
||||
if (CollUtil.isEmpty(deptIds)) {
|
||||
return null;
|
||||
}
|
||||
// 拼接条件
|
||||
return new InExpression(MyBatisUtils.buildColumn(tableName, tableAlias, columnName),
|
||||
// Parenthesis 的目的，是提供 (1,2,3) 的 () 左右括号
|
||||
new ParenthesedExpressionList(new ExpressionList<LongValue>(CollectionUtils.convertList(deptIds, LongValue::new))));
|
||||
}
|
||||
|
||||
private Expression buildUserExpression(String tableName, Alias tableAlias, Boolean self, Long userId) {
|
||||
// 如果不查看自己，则无需作为条件
|
||||
if (Boolean.FALSE.equals(self)) {
|
||||
return null;
|
||||
}
|
||||
String columnName = userColumns.get(tableName);
|
||||
if (StrUtil.isEmpty(columnName)) {
|
||||
return null;
|
||||
}
|
||||
// 拼接条件
|
||||
return new EqualsTo(MyBatisUtils.buildColumn(tableName, tableAlias, columnName), new LongValue(userId));
|
||||
}
|
||||
|
||||
// ==================== 添加配置 ====================
|
||||
|
||||
public void addDeptColumn(Class<? extends BaseDO> entityClass) {
|
||||
addDeptColumn(entityClass, DEPT_COLUMN_NAME);
|
||||
}
|
||||
|
||||
public void addDeptColumn(Class<? extends BaseDO> entityClass, String columnName) {
|
||||
String tableName = TableInfoHelper.getTableInfo(entityClass).getTableName();
|
||||
addDeptColumn(tableName, columnName);
|
||||
}
|
||||
|
||||
public void addDeptColumn(String tableName, String columnName) {
|
||||
deptColumns.put(tableName, columnName);
|
||||
TABLE_NAMES.add(tableName);
|
||||
}
|
||||
|
||||
public void addUserColumn(Class<? extends BaseDO> entityClass) {
|
||||
addUserColumn(entityClass, USER_COLUMN_NAME);
|
||||
}
|
||||
|
||||
public void addUserColumn(Class<? extends BaseDO> entityClass, String columnName) {
|
||||
String tableName = TableInfoHelper.getTableInfo(entityClass).getTableName();
|
||||
addUserColumn(tableName, columnName);
|
||||
}
|
||||
|
||||
public void addUserColumn(String tableName, String columnName) {
|
||||
userColumns.put(tableName, columnName);
|
||||
TABLE_NAMES.add(tableName);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule.dept;
|
||||
|
||||
/**
|
||||
* {@link DeptDataPermissionRule} 的自定义配置接口
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
@FunctionalInterface
|
||||
public interface DeptDataPermissionRuleCustomizer {
|
||||
|
||||
/**
|
||||
* 自定义该权限规则
|
||||
* 1. 调用 {@link DeptDataPermissionRule#addDeptColumn(Class, String)} 方法，配置基于 dept_id 的过滤规则
|
||||
* 2. 调用 {@link DeptDataPermissionRule#addUserColumn(Class, String)} 方法，配置基于 user_id 的过滤规则
|
||||
*
|
||||
* @param rule 权限规则
|
||||
*/
|
||||
void customize(DeptDataPermissionRule rule);
|
||||
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
/**
|
||||
* 基于部门的数据权限规则
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
package com.zt.plat.framework.datapermission.core.rule.dept;
|
||||
@@ -0,0 +1,73 @@
|
||||
package com.zt.plat.framework.datapermission.core.util;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.concurrent.Callable;
|
||||
|
||||
/**
|
||||
* 数据权限 Util
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionUtils {
|
||||
|
||||
private static DataPermission DATA_PERMISSION_DISABLE;
|
||||
|
||||
@DataPermission(enable = false)
|
||||
@SneakyThrows
|
||||
private static DataPermission getDisableDataPermissionDisable() {
|
||||
if (DATA_PERMISSION_DISABLE == null) {
|
||||
DATA_PERMISSION_DISABLE = DataPermissionUtils.class
|
||||
.getDeclaredMethod("getDisableDataPermissionDisable")
|
||||
.getAnnotation(DataPermission.class);
|
||||
}
|
||||
return DATA_PERMISSION_DISABLE;
|
||||
}
|
||||
|
||||
/**
|
||||
* 忽略数据权限，执行对应的逻辑
|
||||
*
|
||||
* @param runnable 逻辑
|
||||
*/
|
||||
public static void executeIgnore(Runnable runnable) {
|
||||
addDisableDataPermission();
|
||||
try {
|
||||
// 执行 runnable
|
||||
runnable.run();
|
||||
} finally {
|
||||
removeDataPermission();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 忽略数据权限，执行对应的逻辑
|
||||
*
|
||||
* @param callable 逻辑
|
||||
* @return 执行结果
|
||||
*/
|
||||
@SneakyThrows
|
||||
public static <T> T executeIgnore(Callable<T> callable) {
|
||||
addDisableDataPermission();
|
||||
try {
|
||||
// 执行 callable
|
||||
return callable.call();
|
||||
} finally {
|
||||
removeDataPermission();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 添加忽略数据权限
|
||||
*/
|
||||
public static void addDisableDataPermission(){
|
||||
DataPermission dataPermission = getDisableDataPermissionDisable();
|
||||
DataPermissionContextHolder.add(dataPermission);
|
||||
}
|
||||
|
||||
public static void removeDataPermission(){
|
||||
DataPermissionContextHolder.remove();
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
/**
|
||||
* 基于 JSqlParser 解析 SQL，增加数据权限的 WHERE 条件
|
||||
*/
|
||||
package com.zt.plat.framework.datapermission;
|
||||
@@ -0,0 +1,4 @@
|
||||
com.zt.plat.framework.datapermission.config.CloudDataPermissionAutoConfiguration
|
||||
com.zt.plat.framework.datapermission.config.CloudDeptDataPermissionAutoConfiguration
|
||||
com.zt.plat.framework.datapermission.config.CloudBusinessDataPermissionAutoConfiguration
|
||||
com.zt.plat.framework.datapermission.config.CloudDataPermissionRpcAutoConfiguration
|
||||
@@ -0,0 +1,108 @@
|
||||
package com.zt.plat.framework.datapermission.core.aop;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.zt.plat.framework.test.core.ut.BaseMockitoUnitTest;
|
||||
import org.aopalliance.intercept.MethodInvocation;
|
||||
import org.junit.jupiter.api.BeforeEach;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.mockito.InjectMocks;
|
||||
import org.mockito.Mock;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.*;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
/**
|
||||
* {@link DataPermissionAnnotationInterceptor} 的单元测试
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionAnnotationInterceptorTest extends BaseMockitoUnitTest {
|
||||
|
||||
@InjectMocks
|
||||
private DataPermissionAnnotationInterceptor interceptor;
|
||||
|
||||
@Mock
|
||||
private MethodInvocation methodInvocation;
|
||||
|
||||
@BeforeEach
|
||||
public void setUp() {
|
||||
interceptor.getDataPermissionCache().clear();
|
||||
}
|
||||
|
||||
@Test // 无 @DataPermission 注解
|
||||
public void testInvoke_none() throws Throwable {
|
||||
// 参数
|
||||
mockMethodInvocation(TestNone.class);
|
||||
|
||||
// 调用
|
||||
Object result = interceptor.invoke(methodInvocation);
|
||||
// 断言
|
||||
assertEquals("none", result);
|
||||
assertEquals(1, interceptor.getDataPermissionCache().size());
|
||||
assertTrue(CollUtil.getFirst(interceptor.getDataPermissionCache().values()).enable());
|
||||
}
|
||||
|
||||
@Test // 在 Method 上有 @DataPermission 注解
|
||||
public void testInvoke_method() throws Throwable {
|
||||
// 参数
|
||||
mockMethodInvocation(TestMethod.class);
|
||||
|
||||
// 调用
|
||||
Object result = interceptor.invoke(methodInvocation);
|
||||
// 断言
|
||||
assertEquals("method", result);
|
||||
assertEquals(1, interceptor.getDataPermissionCache().size());
|
||||
assertFalse(CollUtil.getFirst(interceptor.getDataPermissionCache().values()).enable());
|
||||
}
|
||||
|
||||
@Test // 在 Class 上有 @DataPermission 注解
|
||||
public void testInvoke_class() throws Throwable {
|
||||
// 参数
|
||||
mockMethodInvocation(TestClass.class);
|
||||
|
||||
// 调用
|
||||
Object result = interceptor.invoke(methodInvocation);
|
||||
// 断言
|
||||
assertEquals("class", result);
|
||||
assertEquals(1, interceptor.getDataPermissionCache().size());
|
||||
assertFalse(CollUtil.getFirst(interceptor.getDataPermissionCache().values()).enable());
|
||||
}
|
||||
|
||||
private void mockMethodInvocation(Class<?> clazz) throws Throwable {
|
||||
Object targetObject = clazz.newInstance();
|
||||
Method method = targetObject.getClass().getMethod("echo");
|
||||
when(methodInvocation.getThis()).thenReturn(targetObject);
|
||||
when(methodInvocation.getMethod()).thenReturn(method);
|
||||
when(methodInvocation.proceed()).then(invocationOnMock -> method.invoke(targetObject));
|
||||
}
|
||||
|
||||
static class TestMethod {
|
||||
|
||||
@DataPermission(enable = false)
|
||||
public String echo() {
|
||||
return "method";
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@DataPermission(enable = false)
|
||||
static class TestClass {
|
||||
|
||||
public String echo() {
|
||||
return "class";
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static class TestNone {
|
||||
|
||||
public String echo() {
|
||||
return "none";
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
package com.zt.plat.framework.datapermission.core.aop;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import org.junit.jupiter.api.BeforeEach;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||
import static org.junit.jupiter.api.Assertions.assertSame;
|
||||
import static org.mockito.Mockito.mock;
|
||||
|
||||
/**
|
||||
* {@link DataPermissionContextHolder} 的单元测试
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
class DataPermissionContextHolderTest {
|
||||
|
||||
@BeforeEach
|
||||
public void setUp() {
|
||||
DataPermissionContextHolder.clear();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGet() {
|
||||
// mock 方法
|
||||
DataPermission dataPermission01 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission01);
|
||||
DataPermission dataPermission02 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission02);
|
||||
|
||||
// 调用
|
||||
DataPermission result = DataPermissionContextHolder.get();
|
||||
// 断言
|
||||
assertSame(result, dataPermission02);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testPush() {
|
||||
// 调用
|
||||
DataPermission dataPermission01 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission01);
|
||||
DataPermission dataPermission02 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission02);
|
||||
// 断言
|
||||
DataPermission first = DataPermissionContextHolder.getAll().get(0);
|
||||
DataPermission second = DataPermissionContextHolder.getAll().get(1);
|
||||
assertSame(dataPermission01, first);
|
||||
assertSame(dataPermission02, second);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testRemove() {
|
||||
// mock 方法
|
||||
DataPermission dataPermission01 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission01);
|
||||
DataPermission dataPermission02 = mock(DataPermission.class);
|
||||
DataPermissionContextHolder.add(dataPermission02);
|
||||
|
||||
// 调用
|
||||
DataPermission result = DataPermissionContextHolder.remove();
|
||||
// 断言
|
||||
assertSame(result, dataPermission02);
|
||||
assertEquals(1, DataPermissionContextHolder.getAll().size());
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,540 @@
|
||||
package com.zt.plat.framework.datapermission.core.db;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRule;
|
||||
import com.zt.plat.framework.datapermission.core.rule.DataPermissionRuleFactory;
|
||||
import com.zt.plat.framework.mybatis.core.util.MyBatisUtils;
|
||||
import com.zt.plat.framework.test.core.ut.BaseMockitoUnitTest;
|
||||
import com.baomidou.mybatisplus.extension.plugins.inner.DataPermissionInterceptor;
|
||||
import net.sf.jsqlparser.expression.Alias;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
import net.sf.jsqlparser.expression.LongValue;
|
||||
import net.sf.jsqlparser.expression.operators.relational.EqualsTo;
|
||||
import net.sf.jsqlparser.expression.operators.relational.ExpressionList;
|
||||
import net.sf.jsqlparser.expression.operators.relational.InExpression;
|
||||
import net.sf.jsqlparser.expression.operators.relational.ParenthesedExpressionList;
|
||||
import net.sf.jsqlparser.schema.Column;
|
||||
import org.junit.jupiter.api.BeforeEach;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.mockito.InjectMocks;
|
||||
import org.mockito.Mock;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Set;
|
||||
|
||||
import static com.zt.plat.framework.common.util.collection.SetUtils.asSet;
|
||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||
import static org.mockito.ArgumentMatchers.any;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
/**
|
||||
* {@link DataPermissionRuleHandler} 的单元测试
|
||||
* 主要复用了 MyBatis Plus 的 TenantLineInnerInterceptorTest 的单元测试
|
||||
* 不过它的单元测试不是很规范，考虑到是复用的，所以暂时不进行修改~
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
public class DataPermissionRuleHandlerTest extends BaseMockitoUnitTest {
|
||||
|
||||
@InjectMocks
|
||||
private DataPermissionRuleHandler handler;
|
||||
|
||||
@Mock
|
||||
private DataPermissionRuleFactory ruleFactory;
|
||||
|
||||
private DataPermissionInterceptor interceptor;
|
||||
|
||||
@BeforeEach
|
||||
public void setUp() {
|
||||
interceptor = new DataPermissionInterceptor(handler);
|
||||
|
||||
// 租户的数据权限规则
|
||||
DataPermissionRule tenantRule = new DataPermissionRule() {
|
||||
|
||||
private static final String COLUMN = "tenant_id";
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return asSet("entity", "entity1", "entity2", "entity3", "t1", "t2", "sys_dict_item", // 支持 MyBatis Plus 的单元测试
|
||||
"t_user", "t_role"); // 满足自己的单元测试
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
Column column = MyBatisUtils.buildColumn(tableName, tableAlias, COLUMN);
|
||||
LongValue value = new LongValue(1L);
|
||||
return new EqualsTo(column, value);
|
||||
}
|
||||
|
||||
};
|
||||
// 部门的数据权限规则
|
||||
DataPermissionRule deptRule = new DataPermissionRule() {
|
||||
|
||||
private static final String COLUMN = "dept_id";
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return asSet("t_user"); // 满足自己的单元测试
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
Column column = MyBatisUtils.buildColumn(tableName, tableAlias, COLUMN);
|
||||
ExpressionList<LongValue> values = new ExpressionList<>(new LongValue(10L),
|
||||
new LongValue(20L));
|
||||
return new InExpression(column, new ParenthesedExpressionList((values)));
|
||||
}
|
||||
|
||||
};
|
||||
// 设置到上下文
|
||||
when(ruleFactory.getDataPermissionRule(any())).thenReturn(Arrays.asList(tenantRule, deptRule));
|
||||
}
|
||||
|
||||
@Test
|
||||
void delete() {
|
||||
assertSql("delete from entity where id = ?",
|
||||
"DELETE FROM entity WHERE id = ? AND entity.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void update() {
|
||||
assertSql("update entity set name = ? where id = ?",
|
||||
"UPDATE entity SET name = ? WHERE id = ? AND entity.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSingle() {
|
||||
// 单表
|
||||
assertSql("select * from entity where id = ?",
|
||||
"SELECT * FROM entity WHERE id = ? AND entity.tenant_id = 1");
|
||||
|
||||
assertSql("select * from entity where id = ? or name = ?",
|
||||
"SELECT * FROM entity WHERE (id = ? OR name = ?) AND entity.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity WHERE (id = ? OR name = ?)",
|
||||
"SELECT * FROM entity WHERE (id = ? OR name = ?) AND entity.tenant_id = 1");
|
||||
|
||||
/* not */
|
||||
assertSql("SELECT * FROM entity WHERE not (id = ? OR name = ?)",
|
||||
"SELECT * FROM entity WHERE NOT (id = ? OR name = ?) AND entity.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubSelectIn() {
|
||||
/* in */
|
||||
assertSql("SELECT * FROM entity e WHERE e.id IN (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id IN (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
// 在最前
|
||||
assertSql("SELECT * FROM entity e WHERE e.id IN " +
|
||||
"(select e1.id from entity1 e1 where e1.id = ?) and e.id = ?",
|
||||
"SELECT * FROM entity e WHERE e.id IN " +
|
||||
"(SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.id = ? AND e.tenant_id = 1");
|
||||
// 在最后
|
||||
assertSql("SELECT * FROM entity e WHERE e.id = ? and e.id IN " +
|
||||
"(select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id = ? AND e.id IN " +
|
||||
"(SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
// 在中间
|
||||
assertSql("SELECT * FROM entity e WHERE e.id = ? and e.id IN " +
|
||||
"(select e1.id from entity1 e1 where e1.id = ?) and e.id = ?",
|
||||
"SELECT * FROM entity e WHERE e.id = ? AND e.id IN " +
|
||||
"(SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.id = ? AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubSelectEq() {
|
||||
/* = */
|
||||
assertSql("SELECT * FROM entity e WHERE e.id = (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id = (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubSelectInnerNotEq() {
|
||||
/* inner not = */
|
||||
assertSql("SELECT * FROM entity e WHERE not (e.id = (select e1.id from entity1 e1 where e1.id = ?))",
|
||||
"SELECT * FROM entity e WHERE NOT (e.id = (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1)) AND e.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e WHERE not (e.id = (select e1.id from entity1 e1 where e1.id = ?) and e.id = ?)",
|
||||
"SELECT * FROM entity e WHERE NOT (e.id = (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.id = ?) AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubSelectExists() {
|
||||
/* EXISTS */
|
||||
assertSql("SELECT * FROM entity e WHERE EXISTS (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE EXISTS (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
|
||||
|
||||
/* NOT EXISTS */
|
||||
assertSql("SELECT * FROM entity e WHERE NOT EXISTS (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE NOT EXISTS (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubSelect() {
|
||||
/* >= */
|
||||
assertSql("SELECT * FROM entity e WHERE e.id >= (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id >= (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
|
||||
|
||||
/* <= */
|
||||
assertSql("SELECT * FROM entity e WHERE e.id <= (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id <= (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
|
||||
|
||||
/* <> */
|
||||
assertSql("SELECT * FROM entity e WHERE e.id <> (select e1.id from entity1 e1 where e1.id = ?)",
|
||||
"SELECT * FROM entity e WHERE e.id <> (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectFromSelect() {
|
||||
assertSql("SELECT * FROM (select e.id from entity e WHERE e.id = (select e1.id from entity1 e1 where e1.id = ?))",
|
||||
"SELECT * FROM (SELECT e.id FROM entity e WHERE e.id = (SELECT e1.id FROM entity1 e1 WHERE e1.id = ? AND e1.tenant_id = 1) AND e.tenant_id = 1)");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectBodySubSelect() {
|
||||
assertSql("select t1.col1,(select t2.col2 from t2 t2 where t1.col1=t2.col1) from t1 t1",
|
||||
"SELECT t1.col1, (SELECT t2.col2 FROM t2 t2 WHERE t1.col1 = t2.col1 AND t2.tenant_id = 1) FROM t1 t1 WHERE t1.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectLeftJoin() {
|
||||
// left join
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"left join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"left join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.name = ?)",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"left join entity1 e1 on e1.id = e.id " +
|
||||
"left join entity2 e2 on e1.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1 " +
|
||||
"WHERE e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectRightJoin() {
|
||||
// right join
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"right join entity1 e1 on e1.id = e.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"RIGHT JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM with_as_1 e " +
|
||||
"right join entity1 e1 on e1.id = e.id",
|
||||
"SELECT * FROM with_as_1 e " +
|
||||
"RIGHT JOIN entity1 e1 ON e1.id = e.id " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"right join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM entity e " +
|
||||
"RIGHT JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e1.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"right join entity1 e1 on e1.id = e.id " +
|
||||
"right join entity2 e2 on e1.id = e2.id ",
|
||||
"SELECT * FROM entity e " +
|
||||
"RIGHT JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 " +
|
||||
"RIGHT JOIN entity2 e2 ON e1.id = e2.id AND e1.tenant_id = 1 " +
|
||||
"WHERE e2.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectMixJoin() {
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"right join entity1 e1 on e1.id = e.id " +
|
||||
"left join entity2 e2 on e1.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"RIGHT JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 " +
|
||||
"LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1 " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"left join entity1 e1 on e1.id = e.id " +
|
||||
"right join entity2 e2 on e1.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"RIGHT JOIN entity2 e2 ON e1.id = e2.id AND e.tenant_id = 1 " +
|
||||
"WHERE e2.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"left join entity1 e1 on e1.id = e.id " +
|
||||
"inner join entity2 e2 on e1.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"INNER JOIN entity2 e2 ON e1.id = e2.id AND e.tenant_id = 1 AND e2.tenant_id = 1");
|
||||
}
|
||||
|
||||
|
||||
@Test
|
||||
void selectJoinSubSelect() {
|
||||
assertSql("select * from (select * from entity) e1 " +
|
||||
"left join entity2 e2 on e1.id = e2.id",
|
||||
"SELECT * FROM (SELECT * FROM entity WHERE entity.tenant_id = 1) e1 " +
|
||||
"LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1");
|
||||
|
||||
assertSql("select * from entity1 e1 " +
|
||||
"left join (select * from entity2) e2 " +
|
||||
"on e1.id = e2.id",
|
||||
"SELECT * FROM entity1 e1 " +
|
||||
"LEFT JOIN (SELECT * FROM entity2 WHERE entity2.tenant_id = 1) e2 " +
|
||||
"ON e1.id = e2.id " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectSubJoin() {
|
||||
|
||||
assertSql("select * FROM " +
|
||||
"(entity1 e1 right JOIN entity2 e2 ON e1.id = e2.id)",
|
||||
"SELECT * FROM " +
|
||||
"(entity1 e1 RIGHT JOIN entity2 e2 ON e1.id = e2.id AND e1.tenant_id = 1) " +
|
||||
"WHERE e2.tenant_id = 1");
|
||||
|
||||
assertSql("select * FROM " +
|
||||
"(entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id)",
|
||||
"SELECT * FROM " +
|
||||
"(entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1) " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
|
||||
|
||||
assertSql("select * FROM " +
|
||||
"(entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id) " +
|
||||
"right join entity3 e3 on e1.id = e3.id",
|
||||
"SELECT * FROM " +
|
||||
"(entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1) " +
|
||||
"RIGHT JOIN entity3 e3 ON e1.id = e3.id AND e1.tenant_id = 1 " +
|
||||
"WHERE e3.tenant_id = 1");
|
||||
|
||||
|
||||
assertSql("select * FROM entity e " +
|
||||
"LEFT JOIN (entity1 e1 right join entity2 e2 ON e1.id = e2.id) " +
|
||||
"on e.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN (entity1 e1 RIGHT JOIN entity2 e2 ON e1.id = e2.id AND e1.tenant_id = 1) " +
|
||||
"ON e.id = e2.id AND e2.tenant_id = 1 " +
|
||||
"WHERE e.tenant_id = 1");
|
||||
|
||||
assertSql("select * FROM entity e " +
|
||||
"LEFT JOIN (entity1 e1 left join entity2 e2 ON e1.id = e2.id) " +
|
||||
"on e.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN (entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1) " +
|
||||
"ON e.id = e2.id AND e1.tenant_id = 1 " +
|
||||
"WHERE e.tenant_id = 1");
|
||||
|
||||
assertSql("select * FROM entity e " +
|
||||
"RIGHT JOIN (entity1 e1 left join entity2 e2 ON e1.id = e2.id) " +
|
||||
"on e.id = e2.id",
|
||||
"SELECT * FROM entity e " +
|
||||
"RIGHT JOIN (entity1 e1 LEFT JOIN entity2 e2 ON e1.id = e2.id AND e2.tenant_id = 1) " +
|
||||
"ON e.id = e2.id AND e.tenant_id = 1 " +
|
||||
"WHERE e1.tenant_id = 1");
|
||||
}
|
||||
|
||||
|
||||
@Test
|
||||
void selectLeftJoinMultipleTrailingOn() {
|
||||
// 多个 on 尾缀的
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 " +
|
||||
"LEFT JOIN entity2 e2 ON e2.id = e1.id " +
|
||||
"ON e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.NAME = ?)",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 " +
|
||||
"LEFT JOIN entity2 e2 ON e2.id = e1.id AND e2.tenant_id = 1 " +
|
||||
"ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.NAME = ?) AND e.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 " +
|
||||
"LEFT JOIN with_as_A e2 ON e2.id = e1.id " +
|
||||
"ON e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.NAME = ?)",
|
||||
"SELECT * FROM entity e " +
|
||||
"LEFT JOIN entity1 e1 " +
|
||||
"LEFT JOIN with_as_A e2 ON e2.id = e1.id " +
|
||||
"ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.NAME = ?) AND e.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
void selectInnerJoin() {
|
||||
// inner join
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"inner join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM entity e " +
|
||||
"INNER JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 AND e1.tenant_id = 1 " +
|
||||
"WHERE e.id = ? OR e.name = ?");
|
||||
|
||||
assertSql("SELECT * FROM entity e " +
|
||||
"inner join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.name = ?)",
|
||||
"SELECT * FROM entity e " +
|
||||
"INNER JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?)");
|
||||
|
||||
// 隐式内连接
|
||||
assertSql("SELECT * FROM entity,entity1 " +
|
||||
"WHERE entity.id = entity1.id",
|
||||
"SELECT * FROM entity, entity1 " +
|
||||
"WHERE entity.id = entity1.id AND entity.tenant_id = 1 AND entity1.tenant_id = 1");
|
||||
|
||||
// 隐式内连接
|
||||
assertSql("SELECT * FROM entity a, with_as_entity1 b " +
|
||||
"WHERE a.id = b.id",
|
||||
"SELECT * FROM entity a, with_as_entity1 b " +
|
||||
"WHERE a.id = b.id AND a.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM with_as_entity a, with_as_entity1 b " +
|
||||
"WHERE a.id = b.id",
|
||||
"SELECT * FROM with_as_entity a, with_as_entity1 b " +
|
||||
"WHERE a.id = b.id");
|
||||
|
||||
// SubJoin with 隐式内连接
|
||||
assertSql("SELECT * FROM (entity,entity1) " +
|
||||
"WHERE entity.id = entity1.id",
|
||||
"SELECT * FROM (entity, entity1) " +
|
||||
"WHERE entity.id = entity1.id " +
|
||||
"AND entity.tenant_id = 1 AND entity1.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM ((entity,entity1),entity2) " +
|
||||
"WHERE entity.id = entity1.id and entity.id = entity2.id",
|
||||
"SELECT * FROM ((entity, entity1), entity2) " +
|
||||
"WHERE entity.id = entity1.id AND entity.id = entity2.id " +
|
||||
"AND entity.tenant_id = 1 AND entity1.tenant_id = 1 AND entity2.tenant_id = 1");
|
||||
|
||||
assertSql("SELECT * FROM (entity,(entity1,entity2)) " +
|
||||
"WHERE entity.id = entity1.id and entity.id = entity2.id",
|
||||
"SELECT * FROM (entity, (entity1, entity2)) " +
|
||||
"WHERE entity.id = entity1.id AND entity.id = entity2.id " +
|
||||
"AND entity.tenant_id = 1 AND entity1.tenant_id = 1 AND entity2.tenant_id = 1");
|
||||
|
||||
// 沙雕的括号写法
|
||||
assertSql("SELECT * FROM (((entity,entity1))) " +
|
||||
"WHERE entity.id = entity1.id",
|
||||
"SELECT * FROM (((entity, entity1))) " +
|
||||
"WHERE entity.id = entity1.id " +
|
||||
"AND entity.tenant_id = 1 AND entity1.tenant_id = 1");
|
||||
|
||||
}
|
||||
|
||||
|
||||
@Test
|
||||
void selectWithAs() {
|
||||
assertSql("with with_as_A as (select * from entity) select * from with_as_A",
|
||||
"WITH with_as_A AS (SELECT * FROM entity WHERE entity.tenant_id = 1) SELECT * FROM with_as_A");
|
||||
}
|
||||
|
||||
|
||||
@Test
|
||||
void selectIgnoreTable() {
|
||||
assertSql(" SELECT dict.dict_code, item.item_text AS \"text\", item.item_value AS \"value\" FROM sys_dict_item item INNER JOIN sys_dict dict ON dict.id = item.dict_id WHERE dict.dict_code IN (1, 2, 3) AND item.item_value IN (1, 2, 3)",
|
||||
"SELECT dict.dict_code, item.item_text AS \"text\", item.item_value AS \"value\" FROM sys_dict_item item INNER JOIN sys_dict dict ON dict.id = item.dict_id AND item.tenant_id = 1 WHERE dict.dict_code IN (1, 2, 3) AND item.item_value IN (1, 2, 3)");
|
||||
}
|
||||
|
||||
private void assertSql(String sql, String targetSql) {
|
||||
assertEquals(targetSql, interceptor.parserSingle(sql, null));
|
||||
}
|
||||
|
||||
// ========== 额外的测试 ==========
|
||||
|
||||
@Test
|
||||
public void testSelectSingle() {
|
||||
// 单表
|
||||
assertSql("select * from t_user where id = ?",
|
||||
"SELECT * FROM t_user WHERE id = ? AND t_user.tenant_id = 1 AND t_user.dept_id IN (10, 20)");
|
||||
|
||||
assertSql("select * from t_user where id = ? or name = ?",
|
||||
"SELECT * FROM t_user WHERE (id = ? OR name = ?) AND t_user.tenant_id = 1 AND t_user.dept_id IN (10, 20)");
|
||||
|
||||
assertSql("SELECT * FROM t_user WHERE (id = ? OR name = ?)",
|
||||
"SELECT * FROM t_user WHERE (id = ? OR name = ?) AND t_user.tenant_id = 1 AND t_user.dept_id IN (10, 20)");
|
||||
|
||||
/* not */
|
||||
assertSql("SELECT * FROM t_user WHERE not (id = ? OR name = ?)",
|
||||
"SELECT * FROM t_user WHERE NOT (id = ? OR name = ?) AND t_user.tenant_id = 1 AND t_user.dept_id IN (10, 20)");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSelectLeftJoin() {
|
||||
// left join
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"left join t_role e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM t_user e " +
|
||||
"LEFT JOIN t_role e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e.tenant_id = 1 AND e.dept_id IN (10, 20)");
|
||||
|
||||
// 条件 e.id = ? OR e.name = ? 带括号
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"left join t_role e1 on e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.name = ?)",
|
||||
"SELECT * FROM t_user e " +
|
||||
"LEFT JOIN t_role e1 ON e1.id = e.id AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e.tenant_id = 1 AND e.dept_id IN (10, 20)");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSelectRightJoin() {
|
||||
// right join
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"right join t_role e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM t_user e " +
|
||||
"RIGHT JOIN t_role e1 ON e1.id = e.id AND e.tenant_id = 1 AND e.dept_id IN (10, 20) " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e1.tenant_id = 1");
|
||||
|
||||
// 条件 e.id = ? OR e.name = ? 带括号
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"right join t_role e1 on e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.name = ?)",
|
||||
"SELECT * FROM t_user e " +
|
||||
"RIGHT JOIN t_role e1 ON e1.id = e.id AND e.tenant_id = 1 AND e.dept_id IN (10, 20) " +
|
||||
"WHERE (e.id = ? OR e.name = ?) AND e1.tenant_id = 1");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSelectInnerJoin() {
|
||||
// inner join
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"inner join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE e.id = ? OR e.name = ?",
|
||||
"SELECT * FROM t_user e " +
|
||||
"INNER JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 AND e.dept_id IN (10, 20) AND e1.tenant_id = 1 " +
|
||||
"WHERE e.id = ? OR e.name = ?");
|
||||
|
||||
// 条件 e.id = ? OR e.name = ? 带括号
|
||||
assertSql("SELECT * FROM t_user e " +
|
||||
"inner join entity1 e1 on e1.id = e.id " +
|
||||
"WHERE (e.id = ? OR e.name = ?)",
|
||||
"SELECT * FROM t_user e " +
|
||||
"INNER JOIN entity1 e1 ON e1.id = e.id AND e.tenant_id = 1 AND e.dept_id IN (10, 20) AND e1.tenant_id = 1 " +
|
||||
"WHERE (e.id = ? OR e.name = ?)");
|
||||
|
||||
// 没有 On 的 inner join
|
||||
assertSql("SELECT * FROM entity,entity1 " +
|
||||
"WHERE entity.id = entity1.id",
|
||||
"SELECT * FROM entity, entity1 " +
|
||||
"WHERE entity.id = entity1.id AND entity.tenant_id = 1 AND entity1.tenant_id = 1");
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,145 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.annotation.DataPermission;
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import com.zt.plat.framework.test.core.ut.BaseMockitoUnitTest;
|
||||
import net.sf.jsqlparser.expression.Alias;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
import org.junit.jupiter.api.BeforeEach;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.mockito.InjectMocks;
|
||||
import org.mockito.Spy;
|
||||
import org.springframework.core.annotation.AnnotationUtils;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
import static com.zt.plat.framework.test.core.util.RandomUtils.randomString;
|
||||
import static org.junit.jupiter.api.Assertions.*;
|
||||
|
||||
/**
|
||||
* {@link DataPermissionRuleFactoryImpl} 单元测试
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
class DataPermissionRuleFactoryImplTest extends BaseMockitoUnitTest {
|
||||
|
||||
@InjectMocks
|
||||
private DataPermissionRuleFactoryImpl dataPermissionRuleFactory;
|
||||
|
||||
@Spy
|
||||
private List<DataPermissionRule> rules = Arrays.asList(new DataPermissionRule01(),
|
||||
new DataPermissionRule02());
|
||||
|
||||
@BeforeEach
|
||||
public void setUp() {
|
||||
DataPermissionContextHolder.clear();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetDataPermissionRule_02() {
|
||||
// 准备参数
|
||||
String mappedStatementId = randomString();
|
||||
|
||||
// 调用
|
||||
List<DataPermissionRule> result = dataPermissionRuleFactory.getDataPermissionRule(mappedStatementId);
|
||||
// 断言
|
||||
assertSame(rules, result);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetDataPermissionRule_03() {
|
||||
// 准备参数
|
||||
String mappedStatementId = randomString();
|
||||
// mock 方法
|
||||
DataPermissionContextHolder.add(AnnotationUtils.findAnnotation(TestClass03.class, DataPermission.class));
|
||||
|
||||
// 调用
|
||||
List<DataPermissionRule> result = dataPermissionRuleFactory.getDataPermissionRule(mappedStatementId);
|
||||
// 断言
|
||||
assertTrue(result.isEmpty());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetDataPermissionRule_04() {
|
||||
// 准备参数
|
||||
String mappedStatementId = randomString();
|
||||
// mock 方法
|
||||
DataPermissionContextHolder.add(AnnotationUtils.findAnnotation(TestClass04.class, DataPermission.class));
|
||||
|
||||
// 调用
|
||||
List<DataPermissionRule> result = dataPermissionRuleFactory.getDataPermissionRule(mappedStatementId);
|
||||
// 断言
|
||||
assertEquals(1, result.size());
|
||||
assertEquals(DataPermissionRule01.class, result.get(0).getClass());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetDataPermissionRule_05() {
|
||||
// 准备参数
|
||||
String mappedStatementId = randomString();
|
||||
// mock 方法
|
||||
DataPermissionContextHolder.add(AnnotationUtils.findAnnotation(TestClass05.class, DataPermission.class));
|
||||
|
||||
// 调用
|
||||
List<DataPermissionRule> result = dataPermissionRuleFactory.getDataPermissionRule(mappedStatementId);
|
||||
// 断言
|
||||
assertEquals(1, result.size());
|
||||
assertEquals(DataPermissionRule02.class, result.get(0).getClass());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testGetDataPermissionRule_06() {
|
||||
// 准备参数
|
||||
String mappedStatementId = randomString();
|
||||
// mock 方法
|
||||
DataPermissionContextHolder.add(AnnotationUtils.findAnnotation(TestClass06.class, DataPermission.class));
|
||||
|
||||
// 调用
|
||||
List<DataPermissionRule> result = dataPermissionRuleFactory.getDataPermissionRule(mappedStatementId);
|
||||
// 断言
|
||||
assertSame(rules, result);
|
||||
}
|
||||
|
||||
@DataPermission(enable = false)
|
||||
static class TestClass03 {}
|
||||
|
||||
@DataPermission(includeRules = DataPermissionRule01.class)
|
||||
static class TestClass04 {}
|
||||
|
||||
@DataPermission(excludeRules = DataPermissionRule01.class)
|
||||
static class TestClass05 {}
|
||||
|
||||
@DataPermission
|
||||
static class TestClass06 {}
|
||||
|
||||
static class DataPermissionRule01 implements DataPermissionRule {
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
return null;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static class DataPermissionRule02 implements DataPermissionRule {
|
||||
|
||||
@Override
|
||||
public Set<String> getTableNames() {
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Expression getExpression(String tableName, Alias tableAlias) {
|
||||
return null;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,239 @@
|
||||
package com.zt.plat.framework.datapermission.core.rule.dept;
|
||||
|
||||
import cn.hutool.core.collection.CollUtil;
|
||||
import cn.hutool.core.util.ReflectUtil;
|
||||
import com.zt.plat.framework.common.biz.system.permission.PermissionCommonApi;
|
||||
import com.zt.plat.framework.common.enums.UserTypeEnum;
|
||||
import com.zt.plat.framework.common.util.collection.SetUtils;
|
||||
import com.zt.plat.framework.security.core.LoginUser;
|
||||
import com.zt.plat.framework.security.core.util.SecurityFrameworkUtils;
|
||||
import com.zt.plat.framework.test.core.ut.BaseMockitoUnitTest;
|
||||
import com.zt.plat.framework.common.biz.system.permission.dto.DeptDataPermissionRespDTO;
|
||||
import net.sf.jsqlparser.expression.Alias;
|
||||
import net.sf.jsqlparser.expression.Expression;
|
||||
import org.junit.jupiter.api.BeforeEach;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.mockito.InjectMocks;
|
||||
import org.mockito.Mock;
|
||||
import org.mockito.MockedStatic;
|
||||
|
||||
import java.util.Map;
|
||||
|
||||
import static com.zt.plat.framework.common.pojo.CommonResult.success;
|
||||
import static com.zt.plat.framework.datapermission.core.rule.dept.DeptDataPermissionRule.EXPRESSION_NULL;
|
||||
import static com.zt.plat.framework.test.core.util.RandomUtils.randomPojo;
|
||||
import static com.zt.plat.framework.test.core.util.RandomUtils.randomString;
|
||||
import static org.junit.jupiter.api.Assertions.*;
|
||||
import static org.mockito.ArgumentMatchers.eq;
|
||||
import static org.mockito.ArgumentMatchers.same;
|
||||
import static org.mockito.Mockito.mockStatic;
|
||||
import static org.mockito.Mockito.when;
|
||||
|
||||
/**
|
||||
* {@link DeptDataPermissionRule} 的单元测试
|
||||
*
|
||||
* @author ZT
|
||||
*/
|
||||
class DeptDataPermissionRuleTest extends BaseMockitoUnitTest {
|
||||
|
||||
@InjectMocks
|
||||
private DeptDataPermissionRule rule;
|
||||
|
||||
@Mock
|
||||
private PermissionCommonApi permissionApi;
|
||||
|
||||
@BeforeEach
|
||||
@SuppressWarnings("unchecked")
|
||||
public void setUp() {
|
||||
// 清空 rule
|
||||
rule.getTableNames().clear();
|
||||
((Map<String, String>) ReflectUtil.getFieldValue(rule, "deptColumns")).clear();
|
||||
((Map<String, String>) ReflectUtil.getFieldValue(rule, "deptColumns")).clear();
|
||||
}
|
||||
|
||||
@Test // 无 LoginUser
|
||||
public void testGetExpression_noLoginUser() {
|
||||
// 准备参数
|
||||
String tableName = randomString();
|
||||
Alias tableAlias = new Alias(randomString());
|
||||
// mock 方法
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertNull(expression);
|
||||
}
|
||||
|
||||
@Test // 无数据权限时
|
||||
public void testGetExpression_noDeptDataPermission() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（permissionApi 返回 null）
|
||||
when(permissionApi.getDeptDataPermission(eq(loginUser.getId()))).thenReturn(success(null));
|
||||
|
||||
// 调用
|
||||
NullPointerException exception = assertThrows(NullPointerException.class,
|
||||
() -> rule.getExpression(tableName, tableAlias));
|
||||
// 断言
|
||||
assertEquals("LoginUser(1) Table(t_user/u) 未返回数据权限", exception.getMessage());
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 全部数据权限
|
||||
public void testGetExpression_allDeptDataPermission() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO().setAll(true);
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertNull(expression);
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 即不能查看部门，又不能查看自己，则说明 100% 无权限
|
||||
public void testGetExpression_noDept_noSelf() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO();
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertEquals("null = null", expression.toString());
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 拼接 Dept 和 User 的条件（字段都不符合）
|
||||
public void testGetExpression_noDeptColumn_noSelfColumn() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO()
|
||||
.setDeptIds(SetUtils.asSet(10L, 20L)).setSelf(true);
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertSame(EXPRESSION_NULL, expression);
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 拼接 Dept 和 User 的条件（self 符合）
|
||||
public void testGetExpression_noDeptColumn_yesSelfColumn() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO()
|
||||
.setSelf(true);
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
// 添加 user 字段配置
|
||||
rule.addUserColumn("t_user", "id");
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertEquals("u.id = 1", expression.toString());
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 拼接 Dept 和 User 的条件（dept 符合）
|
||||
public void testGetExpression_yesDeptColumn_noSelfColumn() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO()
|
||||
.setDeptIds(CollUtil.newLinkedHashSet(10L, 20L));
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
// 添加 dept 字段配置
|
||||
rule.addDeptColumn("t_user", "dept_id");
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertEquals("u.dept_id IN (10, 20)", expression.toString());
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
@Test // 拼接 Dept 和 User 的条件（dept + self 符合）
|
||||
public void testGetExpression_yesDeptColumn_yesSelfColumn() {
|
||||
try (MockedStatic<SecurityFrameworkUtils> securityFrameworkUtilsMock
|
||||
= mockStatic(SecurityFrameworkUtils.class)) {
|
||||
// 准备参数
|
||||
String tableName = "t_user";
|
||||
Alias tableAlias = new Alias("u");
|
||||
// mock 方法（LoginUser）
|
||||
LoginUser loginUser = randomPojo(LoginUser.class, o -> o.setId(1L)
|
||||
.setUserType(UserTypeEnum.ADMIN.getValue()));
|
||||
securityFrameworkUtilsMock.when(SecurityFrameworkUtils::getLoginUser).thenReturn(loginUser);
|
||||
// mock 方法（DeptDataPermissionRespDTO）
|
||||
DeptDataPermissionRespDTO deptDataPermission = new DeptDataPermissionRespDTO()
|
||||
.setDeptIds(CollUtil.newLinkedHashSet(10L, 20L)).setSelf(true);
|
||||
when(permissionApi.getDeptDataPermission(same(1L))).thenReturn(success(deptDataPermission));
|
||||
// 添加 user 字段配置
|
||||
rule.addUserColumn("t_user", "id");
|
||||
// 添加 dept 字段配置
|
||||
rule.addDeptColumn("t_user", "dept_id");
|
||||
|
||||
// 调用
|
||||
Expression expression = rule.getExpression(tableName, tableAlias);
|
||||
// 断言
|
||||
assertEquals("(u.dept_id IN (10, 20) OR u.id = 1)", expression.toString());
|
||||
assertSame(deptDataPermission, loginUser.getContext(DeptDataPermissionRule.CONTEXT_KEY, DeptDataPermissionRespDTO.class));
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
package com.zt.plat.framework.datapermission.core.util;
|
||||
|
||||
import com.zt.plat.framework.datapermission.core.aop.DataPermissionContextHolder;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.*;
|
||||
|
||||
public class DataPermissionUtilsTest {
|
||||
|
||||
@Test
|
||||
public void testExecuteIgnore() {
|
||||
DataPermissionUtils.executeIgnore(() -> assertFalse(DataPermissionContextHolder.get().enable()));
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user