java

关注公众号 jb51net

关闭
首页 > 软件编程 > java > MyBatisPlus权限控制

MyBatisPlus数据权限控制实现的三种方式

作者:Lee_SmallNorth

数据权限是保障数据安全的重要手段,本文主要介绍了MyBatisPlus数据权限控制实现的三种方式,具有一定的参考价值,具有一定的参考价值,感兴趣的可以了解一下

一、场景

在数据权限控制时,希望是全局的,比如每个sql都根据当前登录人查询,因此希望每个sql都在最后拼接 “create_user = ‘admin’”

二、实现方式(提供两种,自行选择)

注意:每张表都必须保证create_user 的字段存在,否则要重写ignoreTable方法

2.1 模仿租户实现方式

@Bean
public MybatisPlusInterceptor paginationInterceptor() {
    MybatisPlusInterceptor interceptor = new MybatisPlusInterceptor();
    PaginationInnerInterceptor paginationInnerInterceptor = new PaginationInnerInterceptor();
    paginationInnerInterceptor.setDbType(DbType.MYSQL);
    paginationInnerInterceptor.setMaxLimit(1000L);
    paginationInnerInterceptor.setOverflow(true);
    interceptor.addInnerInterceptor(paginationInnerInterceptor);
    interceptor.addInnerInterceptor(new CustomLineInnerInterceptor(new com.szls.config.DataPermissionHandler() {
        @Override
        public Expression getCreateUser() {
            //这里直接写死admin,实际按需获取
            return new StringValue("admin");
        }

        @Override
        public String getCreateUserColumn() {
            return DataPermissionHandler.super.getCreateUserColumn();
        }

        @Override
        public boolean ignoreTable(String tableName) {
            //这是案例,多表需要过滤时,可从配置文件或者static代码块中获取
            List<String> ignoreTables = Collections.singletonList("sys_model_relation");
            //判断当前表是否在过滤列表中
            return ignoreTables.stream().anyMatch(tableName::equalsIgnoreCase);
        }
    }));
    return interceptor;
}
/**
 * @description:
 * @author: SmallNorth_Lee
 * @date: 2024/5/7 15:29
 * @version: 1.0
 */
public interface DataPermissionHandler {

    /**
     * 获取用户 ID 值表达式,只支持单个 ID 值
     * <p>
     *
     * @return 用户 ID 值表达式
     */
    Expression getCreateUser();

    /**
     * 获取用户字段名
     * <p>
     * 默认字段名叫: create_user
     *
     * @return 用户字段名
     */
    default String getCreateUserColumn() {
        return "create_user";
    }

    /**
     * 根据表名判断是否忽略拼接多用户条件
     * <p>
     * 默认都要进行解析并拼接多用户条件
     *
     * @param tableName 表名
     * @return 是否忽略, true:表示忽略,false:需要解析并拼接多用户条件
     */
    default boolean ignoreTable(String tableName) {
        return false;
    }

    /**
     * 忽略插入用户字段逻辑
     *
     * @param columns        插入字段
     * @param createUserColumn 用户 ID 字段
     * @return
     */
    default boolean ignoreInsert(List<Column> columns, String createUserColumn) {
        return columns.stream().map(Column::getColumnName).anyMatch(i -> i.equalsIgnoreCase(createUserColumn));
    }
}
/**
 * @description:
 * @author: SmallNorth_Lee
 * @date: 2024/5/7 14:14
 * @version: 1.0
 */
@Data
@NoArgsConstructor
@AllArgsConstructor
@ToString(callSuper = true)
@EqualsAndHashCode(callSuper = true)
public class CustomLineInnerInterceptor extends BaseMultiTableInnerInterceptor implements InnerInterceptor {

    private DataPermissionHandler dataPermissionHandler;

    @Override
    public void beforeQuery(Executor executor, MappedStatement ms, Object parameter, RowBounds rowBounds, ResultHandler resultHandler, BoundSql boundSql) throws SQLException {
        if (InterceptorIgnoreHelper.willIgnoreTenantLine(ms.getId())) {
            return;
        }
        PluginUtils.MPBoundSql mpBs = PluginUtils.mpBoundSql(boundSql);
        mpBs.sql(parserSingle(mpBs.sql(), null));
    }

    @Override
    public void beforePrepare(StatementHandler sh, Connection connection, Integer transactionTimeout) {
        PluginUtils.MPStatementHandler mpSh = PluginUtils.mpStatementHandler(sh);
        MappedStatement ms = mpSh.mappedStatement();
        SqlCommandType sct = ms.getSqlCommandType();
        if (sct == SqlCommandType.INSERT || sct == SqlCommandType.UPDATE || sct == SqlCommandType.DELETE) {
            if (InterceptorIgnoreHelper.willIgnoreTenantLine(ms.getId())) {
                return;
            }
            PluginUtils.MPBoundSql mpBs = mpSh.mPBoundSql();
            mpBs.sql(parserMulti(mpBs.sql(), null));
        }
    }

    @Override
    protected void processSelect(Select select, int index, String sql, Object obj) {
        final String whereSegment = (String) obj;
        processSelectBody(select.getSelectBody(), whereSegment);
        List<WithItem> withItemsList = select.getWithItemsList();
        if (!CollectionUtils.isEmpty(withItemsList)) {
            withItemsList.forEach(withItem -> processSelectBody(withItem, whereSegment));
        }
    }

    @Override
    protected void processInsert(Insert insert, int index, String sql, Object obj) {
        if (dataPermissionHandler.ignoreTable(insert.getTable().getName())) {
            // 过滤退出执行
            return;
        }
        List<Column> columns = insert.getColumns();
        if (CollectionUtils.isEmpty(columns)) {
            // 针对不给列名的insert 不处理
            return;
        }
        String createUserColumn = dataPermissionHandler.getCreateUserColumn();
        if (dataPermissionHandler.ignoreInsert(columns, createUserColumn)) {
            // 针对已给出租户列的insert 不处理
            return;
        }
        columns.add(new Column(createUserColumn));

        // fixed gitee pulls/141 duplicate update
        List<Expression> duplicateUpdateColumns = insert.getDuplicateUpdateExpressionList();
        if (CollectionUtils.isNotEmpty(duplicateUpdateColumns)) {
            EqualsTo equalsTo = new EqualsTo();
            equalsTo.setLeftExpression(new StringValue(createUserColumn));
            equalsTo.setRightExpression(dataPermissionHandler.getCreateUser());
            duplicateUpdateColumns.add(equalsTo);
        }

        Select select = insert.getSelect();
        if (select != null && (select.getSelectBody() instanceof PlainSelect)) { //fix github issue 4998  修复升级到4.5版本的问题
            this.processInsertSelect(select.getSelectBody(), (String) obj);
        } else if (insert.getItemsList() != null) {
            // fixed github pull/295
            ItemsList itemsList = insert.getItemsList();
            Expression createUser = dataPermissionHandler.getCreateUser();
            if (itemsList instanceof MultiExpressionList) {
                ((MultiExpressionList) itemsList).getExpressionLists().forEach(el -> el.getExpressions().add(createUser));
            } else {
                List<Expression> expressions = ((ExpressionList) itemsList).getExpressions();
                if (CollectionUtils.isNotEmpty(expressions)) {//fix github issue 4998 jsqlparse 4.5 批量insert ItemsList不是MultiExpressionList 了,需要特殊处理
                    int len = expressions.size();
                    for (int i = 0; i < len; i++) {
                        Expression expression = expressions.get(i);
                        if (expression instanceof RowConstructor) {
                            ((RowConstructor) expression).getExprList().getExpressions().add(createUser);
                        } else if (expression instanceof Parenthesis) {
                            RowConstructor rowConstructor = new RowConstructor()
                                    .withExprList(new ExpressionList(((Parenthesis) expression).getExpression(), createUser));
                            expressions.set(i, rowConstructor);
                        } else {
                            if (len - 1 == i) { // (?,?) 只有最后一个expre的时候才拼接tenantId
                                expressions.add(createUser);
                            }
                        }
                    }
                } else {
                    expressions.add(createUser);
                }
            }
        } else {
            throw ExceptionUtils.mpe("Failed to process multiple-table update, please exclude the tableName or statementId");
        }
    }

    /**
     * update 语句处理
     */
    @Override
    protected void processUpdate(Update update, int index, String sql, Object obj) {
        final Table table = update.getTable();
        if (dataPermissionHandler.ignoreTable(table.getName())) {
            // 过滤退出执行
            return;
        }
        ArrayList<UpdateSet> sets = update.getUpdateSets();
        if (!CollectionUtils.isEmpty(sets)) {
            sets.forEach(us -> us.getExpressions().forEach(ex -> {
                if (ex instanceof SubSelect) {
                    processSelectBody(((SubSelect) ex).getSelectBody(), (String) obj);
                }
            }));
        }
        update.setWhere(this.andExpression(table, update.getWhere(), (String) obj));
    }

    /**
     * delete 语句处理
     */
    @Override
    protected void processDelete(Delete delete, int index, String sql, Object obj) {
        if (dataPermissionHandler.ignoreTable(delete.getTable().getName())) {
            // 过滤退出执行
            return;
        }
        delete.setWhere(this.andExpression(delete.getTable(), delete.getWhere(), (String) obj));
    }

    /**
     * 处理 insert into select
     * <p>
     * 进入这里表示需要 insert 的表启用了多租户,则 select 的表都启动了
     *
     * @param selectBody SelectBody
     */
    protected void processInsertSelect(SelectBody selectBody, final String whereSegment) {
        PlainSelect plainSelect = (PlainSelect) selectBody;
        FromItem fromItem = plainSelect.getFromItem();
        if (fromItem instanceof Table) {
            // fixed gitee pulls/141 duplicate update
            processPlainSelect(plainSelect, whereSegment);
            appendSelectItem(plainSelect.getSelectItems());
        } else if (fromItem instanceof SubSelect) {
            SubSelect subSelect = (SubSelect) fromItem;
            appendSelectItem(plainSelect.getSelectItems());
            processInsertSelect(subSelect.getSelectBody(), whereSegment);
        }
    }

    /**
     * 追加 SelectItem
     *
     * @param selectItems SelectItem
     */
    protected void appendSelectItem(List<SelectItem> selectItems) {
        if (CollectionUtils.isEmpty(selectItems)) {
            return;
        }
        if (selectItems.size() == 1) {
            SelectItem item = selectItems.get(0);
            if (item instanceof AllColumns || item instanceof AllTableColumns) {
                return;
            }
        }
        selectItems.add(new SelectExpressionItem(new Column(dataPermissionHandler.getCreateUserColumn())));
    }

    /**
     * 租户字段别名设置
     * <p>tenantId 或 tableAlias.tenantId</p>
     *
     * @param table 表对象
     * @return 字段
     */
    protected Column getAliasColumn(Table table) {
        StringBuilder column = new StringBuilder();
        // todo 该起别名就要起别名,禁止修改此处逻辑
        if (table.getAlias() != null) {
            column.append(table.getAlias().getName()).append(StringPool.DOT);
        }
        column.append(dataPermissionHandler.getCreateUserColumn());
        return new Column(column.toString());
    }

    @Override
    public void setProperties(Properties properties) {
        PropertyMapper.newInstance(properties).whenNotBlank("dataPermissionHandler",
                ClassUtils::newInstance, this::setDataPermissionHandler);
    }

    /**
     * 构建租户条件表达式
     *
     * @param table        表对象
     * @param where        当前where条件
     * @param whereSegment 所属Mapper对象全路径(在原租户拦截器功能中,这个参数并不需要参与相关判断)
     * @return 租户条件表达式
     * @see BaseMultiTableInnerInterceptor#buildTableExpression(Table, Expression, String)
     */
    @Override
    public Expression buildTableExpression(final Table table, final Expression where, final String whereSegment) {
        if (dataPermissionHandler.ignoreTable(table.getName())) {
            return null;
        }
        return new EqualsTo(getAliasColumn(table), dataPermissionHandler.getCreateUser());
    }
}

2.2 使用DataPermissionInterceptor和MultiDataPermissionHandler

        interceptor.addInnerInterceptor(new DataPermissionInterceptor(new MultiDataPermissionHandler() {
            @Override
            public Expression getSqlSegment(Table table, Expression where, String mappedStatementId) {
                Column aliasColumn = getAliasColumn(table);
                if (null == aliasColumn) {
                    return null;
                }
                return new EqualsTo(getAliasColumn(table), new StringValue(AuthUtils.getUser()));
            }
        }));
    protected Column getAliasColumn(Table table) {
        //这是案例,多表需要过滤时,可从配置文件或者static代码块中获取
        List<String> ignoreTables = Collections.singletonList("sys_model_relation");
        //判断当前表是否在过滤列表中
        boolean match = ignoreTables.stream().anyMatch(table.getName()::equalsIgnoreCase);
        if (match) {
            return null;
        }
        StringBuilder column = new StringBuilder();
        // todo 该起别名就要起别名,禁止修改此处逻辑
        if (table.getAlias() != null) {
            column.append(table.getAlias().getName()).append(StringPool.DOT);
        }
        column.append("create_user");
        return new Column(column.toString());
    }

到此这篇关于MyBatisPlus数据权限控制实现的三种方式的文章就介绍到这了,更多相关MyBatisPlus权限控制内容请搜索脚本之家以前的文章或继续浏览下面的相关文章希望大家以后多多支持脚本之家! 

您可能感兴趣的文章:
阅读全文