Browse Source
将 PermissionServiceImpl（双职责、无接口、吞异常、混合返回类型）重构为深模块： - PermissionResolver 接口：resolve(userId) + visibleMenuTree(userId) - PermissionGrant 不可变值对象：结构化分离 permCodes / roleCodes，asAuthorities() 幂等归一 ROLE_ 前缀 - resolve 变纯函数：不装载 DataVisibilityContext，由过滤器负责 - fail-closed：删除 try/catch 吞异常，解析失败即请求失败（ADR-0006） - 查询链 locality：resolve 与 visibleMenuTree 共用 userRolesOf + authorizedMenus - JwtAuthenticationFilter / SystemController 切换到新接口 - DataScopeIntegrationTest 迁移到 resolve()，新增 6 个权限码并集场景master
7 changed files with 357 additions and 149 deletions
@ -0,0 +1,67 @@ |
|||||
|
package com.crm.auth.security; |
||||
|
|
||||
|
import com.crm.base.security.DataVisibility; |
||||
|
import com.crm.base.security.DataVisibilityContext; |
||||
|
import org.springframework.security.core.authority.SimpleGrantedAuthority; |
||||
|
|
||||
|
import java.util.ArrayList; |
||||
|
import java.util.List; |
||||
|
import java.util.Set; |
||||
|
|
||||
|
/** |
||||
|
* 权限解析结果：一次 resolve 拿齐一个用户的三份授权事实（ADR-0011）。 |
||||
|
* |
||||
|
* <p>不可变。纯取值对象——装载 {@link DataVisibilityContext} 是请求生命周期所有者 |
||||
|
* （JWT 过滤器）的职责，本对象不产生副作用。</p> |
||||
|
* |
||||
|
* <ul> |
||||
|
* <li>{@link #getVisibility()} 数据可见性（部门集合 + 档位 + 子树展开）</li> |
||||
|
* <li>{@link #getPermCodes()} 权限码并集（停用权限点已全局断路，不进并集）</li> |
||||
|
* <li>{@link #getRoleCodes()} 角色编码集合</li> |
||||
|
* </ul> |
||||
|
*/ |
||||
|
public final class PermissionGrant { |
||||
|
|
||||
|
/** Spring Security 角色 authority 前缀（hasRole('X') 实际匹配 ROLE_X） */ |
||||
|
private static final String ROLE_PREFIX = "ROLE_"; |
||||
|
|
||||
|
private final DataVisibility visibility; |
||||
|
private final Set<String> permCodes; |
||||
|
private final Set<String> roleCodes; |
||||
|
|
||||
|
public PermissionGrant(DataVisibility visibility, Set<String> permCodes, Set<String> roleCodes) { |
||||
|
this.visibility = visibility; |
||||
|
this.permCodes = permCodes == null ? Set.of() : Set.copyOf(permCodes); |
||||
|
this.roleCodes = roleCodes == null ? Set.of() : Set.copyOf(roleCodes); |
||||
|
} |
||||
|
|
||||
|
public DataVisibility getVisibility() { |
||||
|
return visibility; |
||||
|
} |
||||
|
|
||||
|
/** 权限码并集：button 节点 perms 的去重集合，已排除停用权限点 */ |
||||
|
public Set<String> getPermCodes() { |
||||
|
return permCodes; |
||||
|
} |
||||
|
|
||||
|
/** 角色编码集合（原样，不带 ROLE_ 前缀约定） */ |
||||
|
public Set<String> getRoleCodes() { |
||||
|
return roleCodes; |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* 合成 Spring Security authorities：权限码原样注入；角色编码幂等归一到 ROLE_ 前缀 |
||||
|
* （已带前缀的不重复加），使 hasAuthority / hasRole 各自按约定匹配。 |
||||
|
* 前缀约定由本模块保证，调用方与 DB 数据无需理解它。 |
||||
|
*/ |
||||
|
public List<SimpleGrantedAuthority> asAuthorities() { |
||||
|
List<SimpleGrantedAuthority> authorities = new ArrayList<>(permCodes.size() + roleCodes.size()); |
||||
|
permCodes.forEach(perm -> authorities.add(new SimpleGrantedAuthority(perm))); |
||||
|
roleCodes.forEach(role -> authorities.add(new SimpleGrantedAuthority(normalizeRole(role)))); |
||||
|
return List.copyOf(authorities); |
||||
|
} |
||||
|
|
||||
|
private static String normalizeRole(String roleCode) { |
||||
|
return roleCode.startsWith(ROLE_PREFIX) ? roleCode : ROLE_PREFIX + roleCode; |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,35 @@ |
|||||
|
package com.crm.auth.security; |
||||
|
|
||||
|
import com.crm.auth.domain.entity.SysMenu; |
||||
|
|
||||
|
import java.util.List; |
||||
|
|
||||
|
/** |
||||
|
* 权限解析引擎：每请求把一个用户的全部授权事实一次算清（ADR-0011）。 |
||||
|
* |
||||
|
* <p>深模块：调用方只见两个方法，「用户 → 角色 → 授权 → 资源」的查询链、 |
||||
|
* 档位取舍、子树展开、权限码并集的断路规则全部藏在实现里。</p> |
||||
|
* |
||||
|
* <p>fail-closed（ADR-0006）：解析失败即抛异常，由请求入口拒绝该请求； |
||||
|
* 不存在「部分成功」的第三状态。</p> |
||||
|
*/ |
||||
|
public interface PermissionResolver { |
||||
|
|
||||
|
/** |
||||
|
* 解析用户的数据可见性与全部授权码。纯取值——不装载任何线程上下文， |
||||
|
* 装载 {@link com.crm.base.security.DataVisibilityContext} 由调用方按请求生命周期负责。 |
||||
|
* |
||||
|
* @param userId 本地用户 ID |
||||
|
* @return 可见性 + 权限码并集 + 角色编码；无角色用户返回最窄档可见性与空授权集合 |
||||
|
*/ |
||||
|
PermissionGrant resolve(Long userId); |
||||
|
|
||||
|
/** |
||||
|
* 用户可见菜单树（catalog/menu 节点，按角色授权过滤、排除 button、按 sort 排序）。 |
||||
|
* 登录后渲染侧边栏用，不参与每请求解析。 |
||||
|
* |
||||
|
* @param userId 本地用户 ID |
||||
|
* @return 组好父子关系的菜单树；无任何授权时返回空列表 |
||||
|
*/ |
||||
|
List<SysMenu> visibleMenuTree(Long userId); |
||||
|
} |
||||
@ -0,0 +1,139 @@ |
|||||
|
package com.crm.auth.security; |
||||
|
|
||||
|
import cn.hutool.core.collection.CollUtil; |
||||
|
import cn.hutool.core.util.StrUtil; |
||||
|
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; |
||||
|
import com.crm.auth.domain.entity.AuthUser; |
||||
|
import com.crm.auth.domain.entity.SysMenu; |
||||
|
import com.crm.auth.domain.entity.SysRole; |
||||
|
import com.crm.auth.domain.entity.SysRoleMenu; |
||||
|
import com.crm.auth.domain.entity.SysUserDept; |
||||
|
import com.crm.auth.domain.entity.SysUserRole; |
||||
|
import com.crm.auth.domain.enums.MenuType; |
||||
|
import com.crm.auth.mapper.AuthUserMapper; |
||||
|
import com.crm.auth.mapper.SysMenuMapper; |
||||
|
import com.crm.auth.mapper.SysRoleMapper; |
||||
|
import com.crm.auth.mapper.SysRoleMenuMapper; |
||||
|
import com.crm.auth.mapper.SysUserDeptMapper; |
||||
|
import com.crm.auth.mapper.SysUserRoleMapper; |
||||
|
import com.crm.auth.service.DeptTreeCache; |
||||
|
import com.crm.base.security.DataScopeLevel; |
||||
|
import com.crm.base.security.DataVisibility; |
||||
|
import com.crm.base.utils.TreeUtils; |
||||
|
import lombok.RequiredArgsConstructor; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.springframework.stereotype.Component; |
||||
|
|
||||
|
import java.util.Collections; |
||||
|
import java.util.Comparator; |
||||
|
import java.util.LinkedHashSet; |
||||
|
import java.util.List; |
||||
|
import java.util.Objects; |
||||
|
import java.util.Set; |
||||
|
import java.util.stream.Collectors; |
||||
|
|
||||
|
/** |
||||
|
* 权限解析引擎实现：数据可见性、权限码并集、可见菜单树共用同一条 |
||||
|
* 「用户 → 角色 → 授权 → 资源」查询链（ADR-0011）。 |
||||
|
*/ |
||||
|
@Slf4j |
||||
|
@Component |
||||
|
@RequiredArgsConstructor |
||||
|
public class PermissionResolverImpl implements PermissionResolver { |
||||
|
|
||||
|
private final SysUserRoleMapper sysUserRoleMapper; |
||||
|
private final SysRoleMapper sysRoleMapper; |
||||
|
private final SysRoleMenuMapper sysRoleMenuMapper; |
||||
|
private final SysMenuMapper sysMenuMapper; |
||||
|
private final AuthUserMapper authUserMapper; |
||||
|
private final DeptTreeCache deptTreeCache; |
||||
|
private final SysUserDeptMapper sysUserDeptMapper; |
||||
|
|
||||
|
@Override |
||||
|
public PermissionGrant resolve(Long userId) { |
||||
|
// ── 数据可见性：无角色取最窄档（仅本人），多角色取最宽档（ADR-0008）──
|
||||
|
List<SysUserRole> userRoles = userRolesOf(userId); |
||||
|
DataScopeLevel widest = DataScopeLevel.SELF; |
||||
|
List<SysRole> roles = Collections.emptyList(); |
||||
|
if (CollUtil.isNotEmpty(userRoles)) { |
||||
|
roles = sysRoleMapper.selectBatchIds(roleIdsOf(userRoles)); |
||||
|
for (SysRole role : roles) { |
||||
|
// 未配档位的角色按最窄档处理，不放宽任何人的可见范围
|
||||
|
if (role.getDataScope() == null) continue; |
||||
|
DataScopeLevel level = DataScopeLevel.fromCode(role.getDataScope()); |
||||
|
if (level.getCode() > widest.getCode()) { |
||||
|
widest = level; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
AuthUser user = authUserMapper.selectById(userId); |
||||
|
Long primaryDeptId = user != null ? user.getDeptId() : null; |
||||
|
// 部门集合 = 主部门 + 兼职部门并集，集合内地位平等（ADR-0005）；兼职关系每请求实时查
|
||||
|
Set<Long> deptIds = new LinkedHashSet<>(); |
||||
|
if (primaryDeptId != null) { |
||||
|
deptIds.add(primaryDeptId); |
||||
|
} |
||||
|
sysUserDeptMapper.selectList( |
||||
|
new LambdaQueryWrapper<SysUserDept>().eq(SysUserDept::getUserId, userId)) |
||||
|
.forEach(ud -> deptIds.add(ud.getDeptId())); |
||||
|
List<Long> expandedDeptIds = null; |
||||
|
if (widest == DataScopeLevel.DEPT_AND_CHILDREN) { |
||||
|
// 子树展开在缓存树上完成，多部门共享同一棵树；无部门可展开时为空集合，即一律不可见
|
||||
|
expandedDeptIds = deptIds.isEmpty() ? List.of() : deptTreeCache.expandWithChildren(deptIds); |
||||
|
} |
||||
|
DataVisibility visibility = new DataVisibility( |
||||
|
userId, primaryDeptId, List.copyOf(deptIds), widest, expandedDeptIds); |
||||
|
|
||||
|
// ── 权限码并集（ADR-0011）：button 且 status=enabled 的 perms，去重 ──
|
||||
|
Set<String> permCodes = CollUtil.isEmpty(userRoles) |
||||
|
? Set.of() |
||||
|
: authorizedMenus(roleIdsOf(userRoles)).stream() |
||||
|
.filter(m -> m.getMenuType() != null && m.getMenuType() == MenuType.BUTTON.getCode()) |
||||
|
.filter(m -> "enabled".equals(m.getStatus())) |
||||
|
.map(SysMenu::getPerms) |
||||
|
.filter(StrUtil::isNotBlank) |
||||
|
.collect(Collectors.toCollection(LinkedHashSet::new)); |
||||
|
|
||||
|
// ── 角色编码（原样持有，ROLE_ 前缀归一由 PermissionGrant 负责）──
|
||||
|
Set<String> roleCodes = roles.stream() |
||||
|
.map(SysRole::getRoleCode) |
||||
|
.filter(Objects::nonNull) |
||||
|
.collect(Collectors.toCollection(LinkedHashSet::new)); |
||||
|
|
||||
|
return new PermissionGrant(visibility, permCodes, roleCodes); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public List<SysMenu> visibleMenuTree(Long userId) { |
||||
|
List<SysUserRole> userRoles = userRolesOf(userId); |
||||
|
if (CollUtil.isEmpty(userRoles)) return Collections.emptyList(); |
||||
|
List<SysMenu> visibleMenus = authorizedMenus(roleIdsOf(userRoles)).stream() |
||||
|
.filter(m -> Boolean.TRUE.equals(m.getVisible())) |
||||
|
.filter(m -> m.getMenuType() == null || m.getMenuType() != MenuType.BUTTON.getCode()) |
||||
|
.sorted(Comparator.comparingInt(m -> m.getSort() != null ? m.getSort() : 0)) |
||||
|
.collect(Collectors.toList()); |
||||
|
return TreeUtils.buildTree(visibleMenus, SysMenu::getId, SysMenu::getParentId, SysMenu::setChildren); |
||||
|
} |
||||
|
|
||||
|
// ==================== 共享查询链 ====================
|
||||
|
|
||||
|
private List<SysUserRole> userRolesOf(Long userId) { |
||||
|
return sysUserRoleMapper.selectList( |
||||
|
new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); |
||||
|
} |
||||
|
|
||||
|
private static List<Long> roleIdsOf(List<SysUserRole> userRoles) { |
||||
|
return userRoles.stream().map(SysUserRole::getRoleId).distinct().collect(Collectors.toList()); |
||||
|
} |
||||
|
|
||||
|
/** 角色授权的资源节点全集（含 button / menu / catalog），过滤规则由调用方决定 */ |
||||
|
private List<SysMenu> authorizedMenus(List<Long> roleIds) { |
||||
|
List<SysRoleMenu> roleMenus = sysRoleMenuMapper.selectList( |
||||
|
new LambdaQueryWrapper<SysRoleMenu>().in(SysRoleMenu::getRoleId, roleIds)); |
||||
|
if (CollUtil.isEmpty(roleMenus)) { |
||||
|
return Collections.emptyList(); |
||||
|
} |
||||
|
Set<Long> menuIds = roleMenus.stream().map(SysRoleMenu::getMenuId).collect(Collectors.toSet()); |
||||
|
return sysMenuMapper.selectBatchIds(menuIds); |
||||
|
} |
||||
|
} |
||||
@ -1,123 +0,0 @@ |
|||||
package com.crm.auth.service.impl; |
|
||||
|
|
||||
import cn.hutool.core.collection.CollUtil; |
|
||||
import cn.hutool.core.util.StrUtil; |
|
||||
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; |
|
||||
import com.crm.auth.domain.entity.*; |
|
||||
import com.crm.auth.domain.enums.MenuType; |
|
||||
import com.crm.auth.mapper.*; |
|
||||
import com.crm.auth.service.DeptTreeCache; |
|
||||
import com.crm.base.security.DataScopeLevel; |
|
||||
import com.crm.base.security.DataVisibility; |
|
||||
import com.crm.base.security.DataVisibilityContext; |
|
||||
import com.crm.base.utils.TreeUtils; |
|
||||
import lombok.RequiredArgsConstructor; |
|
||||
import lombok.extern.slf4j.Slf4j; |
|
||||
import org.springframework.stereotype.Service; |
|
||||
|
|
||||
import java.util.*; |
|
||||
import java.util.stream.Collectors; |
|
||||
|
|
||||
@Slf4j |
|
||||
@Service |
|
||||
@RequiredArgsConstructor |
|
||||
public class PermissionServiceImpl { |
|
||||
|
|
||||
private final SysUserRoleMapper sysUserRoleMapper; |
|
||||
private final SysRoleMapper sysRoleMapper; |
|
||||
private final SysRoleMenuMapper sysRoleMenuMapper; |
|
||||
private final SysMenuMapper sysMenuMapper; |
|
||||
private final AuthUserMapper authUserMapper; |
|
||||
private final DeptTreeCache deptTreeCache; |
|
||||
private final SysUserDeptMapper sysUserDeptMapper; |
|
||||
|
|
||||
/** |
|
||||
* 装入当前用户的数据可见性范围，并返回其角色编码集合。 |
|
||||
* <p>角色编码由 JWT 过滤器填充为 Spring Security authority，使 {@code @PreAuthorize(hasRole(...))} |
|
||||
* 生效（ADR-0008）；无角色返回空集。</p> |
|
||||
*/ |
|
||||
public List<String> initDataScopeContext(Long userId) { |
|
||||
List<SysUserRole> userRoles = sysUserRoleMapper.selectList( |
|
||||
new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); |
|
||||
// 初值取最窄档（仅本人），无角色用户不会被放行全部数据；多角色取最宽档
|
|
||||
DataScopeLevel widest = DataScopeLevel.SELF; |
|
||||
List<SysRole> roles = Collections.emptyList(); |
|
||||
if (CollUtil.isNotEmpty(userRoles)) { |
|
||||
List<Long> roleIds = userRoles.stream().map(SysUserRole::getRoleId).collect(Collectors.toList()); |
|
||||
roles = sysRoleMapper.selectBatchIds(roleIds); |
|
||||
for (SysRole role : roles) { |
|
||||
// 未配档位的角色按最窄档处理，不放宽任何人的可见范围
|
|
||||
if (role.getDataScope() == null) continue; |
|
||||
DataScopeLevel level = DataScopeLevel.fromCode(role.getDataScope()); |
|
||||
if (level.getCode() > widest.getCode()) { |
|
||||
widest = level; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
AuthUser user = authUserMapper.selectById(userId); |
|
||||
Long primaryDeptId = user != null ? user.getDeptId() : null; |
|
||||
// 部门集合 = 主部门 + 兼职部门并集，集合内地位平等（ADR 0005）；兼职关系每请求实时查
|
|
||||
Set<Long> deptIds = new LinkedHashSet<>(); |
|
||||
if (primaryDeptId != null) { |
|
||||
deptIds.add(primaryDeptId); |
|
||||
} |
|
||||
sysUserDeptMapper.selectList( |
|
||||
new LambdaQueryWrapper<SysUserDept>().eq(SysUserDept::getUserId, userId)) |
|
||||
.forEach(ud -> deptIds.add(ud.getDeptId())); |
|
||||
List<Long> expandedDeptIds = null; |
|
||||
if (widest == DataScopeLevel.DEPT_AND_CHILDREN) { |
|
||||
// 子树展开在缓存树上完成，多部门共享同一棵树（工单 05）；无部门可展开时为空集合，即一律不可见
|
|
||||
expandedDeptIds = deptIds.isEmpty() ? List.of() : deptTreeCache.expandWithChildren(deptIds); |
|
||||
} |
|
||||
DataVisibilityContext.load( |
|
||||
new DataVisibility(userId, primaryDeptId, List.copyOf(deptIds), widest, expandedDeptIds)); |
|
||||
|
|
||||
// ── 权限码并集（ADR-0011）：收集用户所有角色授权的 button 节点 perms ──
|
|
||||
List<String> authorities = new ArrayList<>(); |
|
||||
if (CollUtil.isNotEmpty(userRoles)) { |
|
||||
try { |
|
||||
Set<Long> roleIds = userRoles.stream().map(SysUserRole::getRoleId).collect(Collectors.toSet()); |
|
||||
List<SysRoleMenu> allRoleMenus = sysRoleMenuMapper.selectList( |
|
||||
new LambdaQueryWrapper<SysRoleMenu>().in(SysRoleMenu::getRoleId, roleIds)); |
|
||||
if (CollUtil.isNotEmpty(allRoleMenus)) { |
|
||||
Set<Long> menuIds = allRoleMenus.stream() |
|
||||
.map(SysRoleMenu::getMenuId).collect(Collectors.toSet()); |
|
||||
List<SysMenu> menus = sysMenuMapper.selectBatchIds(menuIds); |
|
||||
menus.stream() |
|
||||
.filter(m -> m.getMenuType() != null && m.getMenuType() == MenuType.BUTTON.getCode()) |
|
||||
.filter(m -> "enabled".equals(m.getStatus())) |
|
||||
.map(SysMenu::getPerms) |
|
||||
.filter(StrUtil::isNotBlank) |
|
||||
.distinct() |
|
||||
.forEach(authorities::add); |
|
||||
} |
|
||||
} catch (Exception e) { |
|
||||
log.debug("权限码并集查询失败（可能 sys_menu/sys_role_menu 表尚未创建），跳过", e); |
|
||||
} |
|
||||
} |
|
||||
// 角色编码追加在权限码之后（两者同为 Spring Security authority，hasRole/hasAuthority 各自匹配）
|
|
||||
roles.stream() |
|
||||
.map(SysRole::getRoleCode) |
|
||||
.filter(Objects::nonNull) |
|
||||
.forEach(authorities::add); |
|
||||
return authorities; |
|
||||
} |
|
||||
|
|
||||
public List<SysMenu> getMenuTree(Long userId) { |
|
||||
List<SysUserRole> userRoles = sysUserRoleMapper.selectList( |
|
||||
new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId)); |
|
||||
if (CollUtil.isEmpty(userRoles)) return Collections.emptyList(); |
|
||||
List<Long> roleIds = userRoles.stream().map(SysUserRole::getRoleId).collect(Collectors.toList()); |
|
||||
List<SysRoleMenu> roleMenus = sysRoleMenuMapper.selectList( |
|
||||
new LambdaQueryWrapper<SysRoleMenu>().in(SysRoleMenu::getRoleId, roleIds)); |
|
||||
if (CollUtil.isEmpty(roleMenus)) return Collections.emptyList(); |
|
||||
Set<Long> menuIds = roleMenus.stream().map(SysRoleMenu::getMenuId).collect(Collectors.toSet()); |
|
||||
List<SysMenu> allMenus = sysMenuMapper.selectBatchIds(menuIds); |
|
||||
List<SysMenu> visibleMenus = allMenus.stream() |
|
||||
.filter(m -> Boolean.TRUE.equals(m.getVisible())) |
|
||||
.filter(m -> m.getMenuType() != MenuType.BUTTON.getCode()) |
|
||||
.sorted(Comparator.comparingInt(m -> m.getSort() != null ? m.getSort() : 0)) |
|
||||
.collect(Collectors.toList()); |
|
||||
return TreeUtils.buildTree(visibleMenus, SysMenu::getId, SysMenu::getParentId, SysMenu::setChildren); |
|
||||
} |
|
||||
} |
|
||||
Loading…
Reference in new issue