update 数据权限注解支持 更新与删除 限制

ruoyi-common/src/main/java/com/ruoyi/common/enums/DataScopeType.java

@@ -23,22 +23,22 @@ public enum DataScopeType {
     /**
      * 自定数据权限
      */
-    DATA_SCOPE_CUSTOM("2", " OR #{#deptName} IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = #{#roleId} ) "),
+    DATA_SCOPE_CUSTOM("2", " #{#deptName} IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = #{#roleId} ) "),
 
     /**
      * 部门数据权限
      */
-    DATA_SCOPE_DEPT("3", " OR #{#deptName} = #{#deptId} "),
+    DATA_SCOPE_DEPT("3", " #{#deptName} = #{#deptId} "),
 
     /**
      * 部门及以下数据权限
      */
-    DATA_SCOPE_DEPT_AND_CHILD("4", " OR #{#deptName} IN ( SELECT dept_id FROM sys_dept WHERE dept_id = #{#deptId} OR find_in_set( #{#deptId} , ancestors ) )"),
+    DATA_SCOPE_DEPT_AND_CHILD("4", " #{#deptName} IN ( SELECT dept_id FROM sys_dept WHERE dept_id = #{#deptId} OR find_in_set( #{#deptId} , ancestors ) )"),
 
     /**
      * 仅本人数据权限
      */
-    DATA_SCOPE_SELF("5", " OR #{#userName?:1} = #{#userId?:0} ");
+    DATA_SCOPE_SELF("5", " #{#userName?:1} = #{#userId?:0} ");
 
     private final String code;
 

ruoyi-demo/src/main/java/com/ruoyi/demo/mapper/TestDemoMapper.java

@@ -11,6 +11,8 @@ import com.ruoyi.demo.domain.TestDemo;
 import com.ruoyi.demo.domain.vo.TestDemoVo;
 import org.apache.ibatis.annotations.Param;
 
+import java.io.Serializable;
+import java.util.Collection;
 import java.util.List;
 
 /**
@@ -40,4 +42,18 @@ public interface TestDemoMapper extends BaseMapperPlus<TestDemo> {
         @DataColumn(key = "userName", value = "user_id")
     })
     List<TestDemo> selectList(@Param(Constants.WRAPPER) Wrapper<TestDemo> queryWrapper);
+
+    @Override
+    @DataPermission({
+        @DataColumn(key = "deptName", value = "dept_id"),
+        @DataColumn(key = "userName", value = "user_id")
+    })
+    int updateById(@Param(Constants.ENTITY) TestDemo entity);
+
+    @Override
+    @DataPermission({
+        @DataColumn(key = "deptName", value = "dept_id"),
+        @DataColumn(key = "userName", value = "user_id")
+    })
+    int deleteBatchIds(@Param(Constants.COLLECTION) Collection<? extends Serializable> idList);
 }

ruoyi-demo/src/main/java/com/ruoyi/demo/mapper/TestTreeMapper.java

@@ -8,6 +8,8 @@ import com.ruoyi.common.core.mybatisplus.core.BaseMapperPlus;
 import com.ruoyi.demo.domain.TestTree;
 import org.apache.ibatis.annotations.Param;
 
+import java.io.Serializable;
+import java.util.Collection;
 import java.util.List;
 
 /**
@@ -24,4 +26,18 @@ public interface TestTreeMapper extends BaseMapperPlus<TestTree> {
         @DataColumn(key = "userName", value = "user_id")
     })
     List<TestTree> selectList(@Param(Constants.WRAPPER) Wrapper<TestTree> queryWrapper);
+
+    @Override
+    @DataPermission({
+        @DataColumn(key = "deptName", value = "dept_id"),
+        @DataColumn(key = "userName", value = "user_id")
+    })
+    int updateById(@Param(Constants.ENTITY) TestTree entity);
+
+    @Override
+    @DataPermission({
+        @DataColumn(key = "deptName", value = "dept_id"),
+        @DataColumn(key = "userName", value = "user_id")
+    })
+    int deleteBatchIds(@Param(Constants.COLLECTION) Collection<? extends Serializable> idList);
 }

ruoyi-framework/src/main/java/com/ruoyi/framework/Interceptor/PlusDataPermissionInterceptor.java

@@ -0,0 +1,96 @@
+package com.ruoyi.framework.Interceptor;
+
+import com.baomidou.mybatisplus.core.plugins.InterceptorIgnoreHelper;
+import com.baomidou.mybatisplus.core.toolkit.PluginUtils;
+import com.baomidou.mybatisplus.extension.parser.JsqlParserSupport;
+import com.baomidou.mybatisplus.extension.plugins.inner.InnerInterceptor;
+import com.ruoyi.framework.handler.PlusDataPermissionHandler;
+import net.sf.jsqlparser.expression.Expression;
+import net.sf.jsqlparser.statement.delete.Delete;
+import net.sf.jsqlparser.statement.select.PlainSelect;
+import net.sf.jsqlparser.statement.select.Select;
+import net.sf.jsqlparser.statement.select.SelectBody;
+import net.sf.jsqlparser.statement.select.SetOperationList;
+import net.sf.jsqlparser.statement.update.Update;
+import org.apache.ibatis.executor.Executor;
+import org.apache.ibatis.executor.statement.StatementHandler;
+import org.apache.ibatis.mapping.BoundSql;
+import org.apache.ibatis.mapping.MappedStatement;
+import org.apache.ibatis.mapping.SqlCommandType;
+import org.apache.ibatis.session.ResultHandler;
+import org.apache.ibatis.session.RowBounds;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.util.List;
+
+public class PlusDataPermissionInterceptor extends JsqlParserSupport implements InnerInterceptor {
+
+    private final PlusDataPermissionHandler dataPermissionHandler = new PlusDataPermissionHandler();
+
+    @Override
+    public void beforeQuery(Executor executor, MappedStatement ms, Object parameter, RowBounds rowBounds, ResultHandler resultHandler, BoundSql boundSql) throws SQLException {
+        if (InterceptorIgnoreHelper.willIgnoreDataPermission(ms.getId())) {
+            return;
+        }
+        PluginUtils.MPBoundSql mpBs = PluginUtils.mpBoundSql(boundSql);
+        mpBs.sql(parserSingle(mpBs.sql(), ms.getId()));
+    }
+
+    @Override
+    public void beforePrepare(StatementHandler sh, Connection connection, Integer transactionTimeout) {
+        PluginUtils.MPStatementHandler mpSh = PluginUtils.mpStatementHandler(sh);
+        MappedStatement ms = mpSh.mappedStatement();
+        SqlCommandType sct = ms.getSqlCommandType();
+        if (sct == SqlCommandType.UPDATE || sct == SqlCommandType.DELETE) {
+            if (InterceptorIgnoreHelper.willIgnoreDataPermission(ms.getId())) {
+                return;
+            }
+            PluginUtils.MPBoundSql mpBs = mpSh.mPBoundSql();
+            mpBs.sql(parserMulti(mpBs.sql(), ms.getId()));
+        }
+    }
+
+    @Override
+    protected void processSelect(Select select, int index, String sql, Object obj) {
+        SelectBody selectBody = select.getSelectBody();
+        if (selectBody instanceof PlainSelect) {
+            this.setWhere((PlainSelect) selectBody, (String) obj);
+        } else if (selectBody instanceof SetOperationList) {
+            SetOperationList setOperationList = (SetOperationList) selectBody;
+            List<SelectBody> selectBodyList = setOperationList.getSelects();
+            selectBodyList.forEach(s -> this.setWhere((PlainSelect) s, (String) obj));
+        }
+    }
+
+    @Override
+    protected void processUpdate(Update update, int index, String sql, Object obj) {
+        Expression sqlSegment = dataPermissionHandler.getSqlSegment(update.getWhere(), (String) obj, false);
+        if (null != sqlSegment) {
+            update.setWhere(sqlSegment);
+        }
+    }
+
+    @Override
+    protected void processDelete(Delete delete, int index, String sql, Object obj) {
+        Expression sqlSegment = dataPermissionHandler.getSqlSegment(delete.getWhere(), (String) obj, false);
+        if (null != sqlSegment) {
+            delete.setWhere(sqlSegment);
+        }
+    }
+
+    /**
+     * 设置 where 条件
+     *
+     * @param plainSelect       查询对象
+     * @param mappedStatementId 执行方法id
+     */
+    protected void setWhere(PlainSelect plainSelect, String mappedStatementId) {
+        Expression sqlSegment = dataPermissionHandler.getSqlSegment(plainSelect.getWhere(), mappedStatementId, true);
+        if (null != sqlSegment) {
+            plainSelect.setWhere(sqlSegment);
+        }
+    }
+
+}
+

ruoyi-framework/src/main/java/com/ruoyi/framework/config/MybatisPlusConfig.java

@@ -6,12 +6,11 @@ import com.baomidou.mybatisplus.core.injector.DefaultSqlInjector;
 import com.baomidou.mybatisplus.core.injector.ISqlInjector;
 import com.baomidou.mybatisplus.core.metadata.TableInfo;
 import com.baomidou.mybatisplus.extension.plugins.MybatisPlusInterceptor;
-import com.baomidou.mybatisplus.extension.plugins.inner.DataPermissionInterceptor;
 import com.baomidou.mybatisplus.extension.plugins.inner.OptimisticLockerInnerInterceptor;
 import com.baomidou.mybatisplus.extension.plugins.inner.PaginationInnerInterceptor;
 import com.ruoyi.common.core.mybatisplus.methods.InsertAll;
+import com.ruoyi.framework.Interceptor.PlusDataPermissionInterceptor;
 import com.ruoyi.framework.handler.CreateAndUpdateMetaObjectHandler;
-import com.ruoyi.framework.handler.PlusDataPermissionHandler;
 import org.mybatis.spring.annotation.MapperScan;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -42,12 +41,10 @@ public class MybatisPlusConfig {
 	}
 
     /**
-     * 分页插件，自动识别数据库类型
+     * 数据权限拦截器
      */
-    public DataPermissionInterceptor dataPermissionInterceptor() {
+    public PlusDataPermissionInterceptor dataPermissionInterceptor() {
-        DataPermissionInterceptor dataPermissionInterceptor = new DataPermissionInterceptor();
+        return new PlusDataPermissionInterceptor();
-        dataPermissionInterceptor.setDataPermissionHandler(new PlusDataPermissionHandler());
-        return dataPermissionInterceptor;
     }
 
 	/**

ruoyi-framework/src/main/java/com/ruoyi/framework/handler/PlusDataPermissionHandler.java

@@ -4,7 +4,6 @@ import cn.hutool.core.annotation.AnnotationUtil;
 import cn.hutool.core.util.ArrayUtil;
 import cn.hutool.core.util.ClassUtil;
 import cn.hutool.core.util.ObjectUtil;
-import com.baomidou.mybatisplus.extension.plugins.handler.DataPermissionHandler;
 import com.ruoyi.common.annotation.DataColumn;
 import com.ruoyi.common.annotation.DataPermission;
 import com.ruoyi.common.core.domain.entity.SysRole;
@@ -37,13 +36,12 @@ import java.util.stream.Collectors;
  * @author Lion Li
  */
 @Slf4j
-public class PlusDataPermissionHandler implements DataPermissionHandler {
+public class PlusDataPermissionHandler {
 
     private final ExpressionParser parser = new SpelExpressionParser();
     private final TemplateParserContext parserContext = new TemplateParserContext();
 
-    @Override
+    public Expression getSqlSegment(Expression where, String mappedStatementId, boolean isSelect) {
-    public Expression getSqlSegment(Expression where, String mappedStatementId) {
         DataColumn[] dataColumns = findAnnotation(mappedStatementId);
         if (ArrayUtil.isEmpty(dataColumns)) {
             return where;
@@ -53,7 +51,7 @@ public class PlusDataPermissionHandler implements DataPermissionHandler {
         if (StringUtils.isNull(currentUser) || currentUser.isAdmin()) {
             return where;
         }
-        String dataFilterSql = buildDataFilter(currentUser, dataColumns);
+        String dataFilterSql = buildDataFilter(currentUser, dataColumns, isSelect);
         if (StringUtils.isBlank(dataFilterSql)) {
             return where;
         }
@@ -72,7 +70,7 @@ public class PlusDataPermissionHandler implements DataPermissionHandler {
     /**
      * 构造数据过滤sql
      */
-    private String buildDataFilter(SysUser user, DataColumn[] dataColumns) {
+    private String buildDataFilter(SysUser user, DataColumn[] dataColumns, boolean isSelect) {
         StringBuilder sqlString = new StringBuilder();
 
         EvaluationContext context = new StandardEvaluationContext();
@@ -93,6 +91,12 @@ public class PlusDataPermissionHandler implements DataPermissionHandler {
                 if (type == DataScopeType.DATA_SCOPE_ALL) {
                     return "";
                 }
+                // 不包含 key 变量 则不处理
+                if (!StringUtils.contains(type.getSql(), "#" + dataColumn.key())) {
+                    continue;
+                }
+                // 更新或删除需满足所有条件
+                sqlString.append(isSelect ? " OR " : " AND ");
                 // 解析sql模板并填充
                 String sql = parser.parseExpression(type.getSql(), parserContext).getValue(context, String.class);
                 sqlString.append(sql);
@@ -100,7 +104,7 @@ public class PlusDataPermissionHandler implements DataPermissionHandler {
         }
 
         if (StringUtils.isNotBlank(sqlString.toString())) {
-            return sqlString.substring(4);
+            return sqlString.substring(isSelect ? 4 : 5);
         }
         return "";
     }