mybatis拦截器处理
1.自定义注释
package com.hsfw.backyard.biz.security.authority; import java.lang.annotation.*; /** * 数据权限过滤自定义注解 * * @Description * @Author: liucq * @Date: 2018/12/14 */ @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) @Documented public @interface UserPermissionAop { String value() default ""; }
2.Utils
package com.hsfw.backyard.biz.security.authority.util; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.lang.reflect.Method; public class ReflectUtil { /** * 利用反射获取指定对象的指定属性 * * @param obj 目标对象 * @param fieldName 目标属性 * @return 目标属性的值 */ public static Object getFieldValue(Object obj, String fieldName) { Object result = null; Field field = ReflectUtil.getField(obj, fieldName); if (field != null) { field.setAccessible(true); try { result = field.get(obj); } catch (IllegalArgumentException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (IllegalAccessException e) { // TODO Auto-generated catch block e.printStackTrace(); } } return result; } /** * 利用反射获取指定对象里面的指定属性 * * @param obj 目标对象 * @param fieldName 目标属性 * @return 目标字段 */ private static Field getField(Object obj, String fieldName) { Field field = null; for (Class<?> clazz = obj.getClass(); clazz != Object.class; clazz = clazz.getSuperclass()) { try { field = clazz.getDeclaredField(fieldName); break; } catch (NoSuchFieldException e) { // 这里不用做处理，子类没有该字段可能对应的父类有，都没有就返回null。 } } return field; } /** * 利用反射设置指定对象的指定属性为指定的值 * * @param obj 目标对象 * @param fieldName 目标属性 * @param fieldValue 目标值 */ public static void setFieldValue(Object obj, String fieldName, String fieldValue) { Field field = ReflectUtil.getField(obj, fieldName); if (field != null) { try { field.setAccessible(true); field.set(obj, fieldValue); } catch (IllegalArgumentException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (IllegalAccessException e) { // TODO Auto-generated catch block e.printStackTrace(); } } } /** * 根据文件路径 获取反射对象并执行对应方法 * * @author GaoYuan * @date 2018/4/17 上午9:51 */ public static Object reflectByPath(String path) { try { //获取类名 String className = path.substring(0, path.lastIndexOf(".")); //获取方法名 String methodName = path.substring(path.lastIndexOf(".") + 1, path.length()); // 获取字节码文件对象 Class c = Class.forName(className); Constructor con = c.getConstructor(); Object obj = con.newInstance(); // public Method getMethod(String name,Class<?>... parameterTypes) // 第一个参数表示的方法名，第二个参数表示的是方法的参数的class类型 Method method = c.getMethod(methodName); // 调用obj对象的 method 方法 return method.invoke(obj); } catch (Exception e) { e.printStackTrace(); } return null; } }
package com.hsfw.backyard.biz.security.authority.util;//package com.foruo.sc.permission.example.util; import com.hsfw.backyard.biz.security.authority.UserPermissionAop; import org.apache.ibatis.mapping.MappedStatement; import java.lang.reflect.Method; public class PermissionUtils { public static UserPermissionAop getPermissionByDelegate(MappedStatement mappedStatement) { UserPermissionAop permissionAop = null; try { String id = mappedStatement.getId(); String className = id.substring(0, id.lastIndexOf(".")); String methodName = id.substring(id.lastIndexOf(".") + 1, id.length()); final Class cls = Class.forName(className); final Method[] method = cls.getMethods(); for (Method me : method) { if (me.getName().equals(methodName) && me.isAnnotationPresent(UserPermissionAop.class)) { permissionAop = me.getAnnotation(UserPermissionAop.class); } } } catch (Exception e) { e.printStackTrace(); } return permissionAop; } }
3.mybatis
package com.hsfw.backyard.biz.security.authority.mybatis; import com.hsfw.backyard.biz.ContextHolder; import com.hsfw.backyard.biz.model.sys.User; import com.hsfw.backyard.biz.security.authority.UserPermissionAop; import com.hsfw.backyard.biz.security.authority.util.PermissionUtils; import com.hsfw.backyard.biz.security.authority.util.ReflectUtil; import com.hsfw.backyard.dal.mapper.model.UserDataManageDO; import org.apache.ibatis.executor.statement.RoutingStatementHandler; import org.apache.ibatis.executor.statement.StatementHandler; import org.apache.ibatis.mapping.BoundSql; import org.apache.ibatis.mapping.MappedStatement; import org.apache.ibatis.plugin.*; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Component; import java.sql.Connection; import java.util.List; import java.util.Properties; @Intercepts({ @Signature(type = StatementHandler.class, method = "prepare", args = {Connection.class, Integer.class}) }) @Component public class PrepareInterceptor implements Interceptor { private static final Logger log = LoggerFactory.getLogger(PrepareInterceptor.class); @Override public Object plugin(Object target) { return Plugin.wrap(target, this); } @Override public void setProperties(Properties properties) { } @Override public Object intercept(Invocation invocation) throws Throwable { if (log.isInfoEnabled()) { log.info("进入 PrepareInterceptor 拦截器..."); } if (invocation.getTarget() instanceof RoutingStatementHandler) { RoutingStatementHandler handler = (RoutingStatementHandler) invocation.getTarget(); StatementHandler delegate = (StatementHandler) ReflectUtil.getFieldValue(handler, "delegate"); //通过反射获取delegate父类BaseStatementHandler的mappedStatement属性 MappedStatement mappedStatement = (MappedStatement) ReflectUtil.getFieldValue(delegate, "mappedStatement"); BoundSql boundSql = delegate.getBoundSql(); ReflectUtil.setFieldValue(boundSql, "sql", permissionSql(boundSql.getSql(), mappedStatement)); } return invocation.proceed(); } /** * 权限sql包装，以及是否需要包装 * * @param sql * @return */ protected String permissionSql(String sql, MappedStatement mappedStatement) { UserPermissionAop permissionAop = PermissionUtils.getPermissionByDelegate(mappedStatement); StringBuilder sbSql = new StringBuilder(sql); if (permissionAop != null) { String id = mappedStatement.getId(); String methodName = id.substring(id.lastIndexOf(".") + 1, id.length()); //方法过滤,待讨论 if (methodName.equals("countByCondition") || methodName.equals("pageByCondition")) { return getAppendSql(sbSql, methodName); } } return sbSql.toString(); } /** * sql拼接 * * @param sbSql * @param methodName * @return */ public String getAppendSql(StringBuilder sbSql, String methodName) { //当前用户信息 User user = ContextHolder.user(); List<UserDataManageDO> managedUserList = user.getUserDatalist(); String findUserList = String.valueOf(user.getId()); for (int i = 0; i < managedUserList.size(); i++) { findUserList.concat("," + String.valueOf(managedUserList.get(i).getManagedUserId())); } if (methodName.equals("countByCondition")) { sbSql = sbSql.append(" and operate_user_id in (" + findUserList + ") "); } else { sbSql = new StringBuilder("select * from (").append(sbSql).append(" ) temp where temp.operate_user_id in (" + findUserList + ") "); } return sbSql.toString(); } }
package com.hsfw.backyard.biz.security.authority.mybatis; import com.hsfw.backyard.biz.security.authority.UserPermissionAop; import com.hsfw.backyard.biz.security.authority.util.PermissionUtils; import com.hsfw.backyard.biz.security.authority.util.ReflectUtil; import org.apache.ibatis.executor.resultset.ResultSetHandler; import org.apache.ibatis.mapping.MappedStatement; import org.apache.ibatis.plugin.*; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Component; import java.lang.reflect.Method; import java.sql.Statement; import java.util.ArrayList; import java.util.Properties; @Intercepts({ @Signature(type = ResultSetHandler.class, method = "handleResultSets", args = {Statement.class}) }) @Component public class ResultInterceptor implements Interceptor { /** * 日志 */ private static final Logger log = LoggerFactory.getLogger(ResultInterceptor.class); @Override public Object plugin(Object target) { return Plugin.wrap(target, this); } @Override public void setProperties(Properties properties) { } @Override public Object intercept(Invocation invocation) throws Throwable { if (log.isInfoEnabled()) { log.info("进入 ResultInterceptor 拦截器..."); } ResultSetHandler resultSetHandler1 = (ResultSetHandler) invocation.getTarget(); //通过java反射获得mappedStatement属性值 //可以获得mybatis里的resultype MappedStatement mappedStatement = (MappedStatement) ReflectUtil.getFieldValue(resultSetHandler1, "mappedStatement"); //获取切面对象 UserPermissionAop permissionAop = PermissionUtils.getPermissionByDelegate(mappedStatement); //执行请求方法，并将所得结果保存到result中 Object result = invocation.proceed(); if (permissionAop != null) { if (result instanceof ArrayList) { ArrayList resultList = (ArrayList) result; for (int i = 0; i < resultList.size(); i++) { Object oi = resultList.get(i); Class c = oi.getClass(); Class[] types = {String.class}; Method method = c.getMethod("setRegionCd", types); // 调用obj对象的 method 方法 method.invoke(oi, ""); if (log.isInfoEnabled()) { log.info("数据权限处理【过滤结果】..."); } } } } return result; } }
