Java如何利用Mybatis进行数据权限控制详解

public class PermissionRule {
private static final Log log = LogFactory.getLog(PermissionRule.class);
/**
* codeName<br>
* 适用角色列表<br>
* 格式如: ,RoleA,RoleB,
*/
private String roles;
/**
* codeValue<br>
* 主实体，多表联合
* 格式如: ,SystemCode,User,
*/
private String fromEntity;
/**
* codeDesc<br>
* 过滤表达式字段, <br>
* <code>{uid}</code>会自动替换为当前用户的userId<br>
* <code>{me}</code> main entity 主实体名称
* <code>{me.a}</code> main entity alias 主实体别名
* 格式如：
* <ul>
* <li>userId = {uid}</li>
* <li>(userId = {uid} AND authType > 3)</li>
* <li>((userId = {uid} AND authType) > 3 OR (dept in (select dept from depts where manager.id = {uid})))</li>
* </ul>
*/
private String exps;

/**
* codeShowName<br>
* 规则说明
*/
private String ruleComment;
}

@Intercepts({@Signature(type = Executor.class, method = "update", args = {MappedStatement.class, Object.class}),
@Signature(type = Executor.class, method = "query", args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class})})
public class PermissionHelper implements Interceptor {
}

private String processSelectSql(String sql, List<PermissionRule> rules, UserDefaultZimpl principal) {
try {
String replaceSql = null;
Select select = (Select) CCJSqlParserUtil.parse(sql);
PlainSelect selectBody = (PlainSelect) select.getSelectBody();
String mainTable = null;
if (selectBody.getFromItem() instanceof Table) {
mainTable = ((Table) selectBody.getFromItem()).getName().replace("`", "");
} else if (selectBody.getFromItem() instanceof SubSelect) {
replaceSql = processSelectSql(((SubSelect) selectBody.getFromItem()).getSelectBody().toString(), rules, principal);
}
if (!ValidUtil.isEmpty(replaceSql)) {
sql = sql.replace(((SubSelect) selectBody.getFromItem()).getSelectBody().toString(), replaceSql);
}
String mainTableAlias = mainTable;
try {
mainTableAlias = selectBody.getFromItem().getAlias().getName();
} catch (Exception e) {
log.debug("当前sql中， " + mainTable + " 没有设置别名");
}
String condExpr = null;
PermissionRule realRuls = null;
for (PermissionRule rule :
rules) {
for (Object roleStr :
principal.getRoles()) {
if (rule.getRoles().indexOf("," + roleStr + ",") != -1) {
if (rule.getFromEntity().indexOf("," + mainTable + ",") != -1) {
// 若主表匹配规则主体，则直接使用本规则
realRuls = rule;
condExpr = rule.getExps().replace("{uid}", UserDefaultUtil.getUserId().toString()).replace("{bid}", UserDefaultUtil.getBusinessId().toString()).replace("{me}", mainTable).replace("{me.a}", mainTableAlias);
if (selectBody.getWhere() == null) {
selectBody.setWhere(CCJSqlParserUtil.parseCondExpression(condExpr));
} else {
AndExpression and = new AndExpression(selectBody.getWhere(), CCJSqlParserUtil.parseCondExpression(condExpr));
selectBody.setWhere(and);
}
}
try {
String joinTable = null;
String joinTableAlias = null;
for (Join j :
selectBody.getJoins()) {
if (rule.getFromEntity().indexOf("," + ((Table) j.getRightItem()).getName() + ",") != -1) {
// 当主表不能匹配时，匹配所有join，使用符合条件的第一个表的规则。
realRuls = rule;
joinTable = ((Table) j.getRightItem()).getName();
joinTableAlias = j.getRightItem().getAlias().getName();
condExpr = rule.getExps().replace("{uid}", UserDefaultUtil.getUserId().toString()).replace("{bid}", UserDefaultUtil.getBusinessId().toString()).replace("{me}", joinTable).replace("{me.a}", joinTableAlias);
if (j.getOnExpression() == null) {
j.setOnExpression(CCJSqlParserUtil.parseCondExpression(condExpr));
} else {
AndExpression and = new AndExpression(j.getOnExpression(), CCJSqlParserUtil.parseCondExpression(condExpr));
j.setOnExpression(and);
}
}
}
} catch (Exception e) {
log.debug("当前sql没有join的部分！");
}
}
}
}
if (realRuls == null) return sql; // 没有合适规则直接退出。
if (sql.indexOf("limit ?,?") != -1 && select.toString().indexOf("LIMIT ? OFFSET ?") != -1) {
sql = select.toString().replace("LIMIT ? OFFSET ?", "limit ?,?");
} else {
sql = select.toString();
}
} catch (JSQLParserException e) {
log.error("change sql error .", e);
}
return sql;
}