优化数据权限代码

ruoyi-common/src/main/java/com/ruoyi/common/core/text/Convert.java

@@ -6,9 +6,11 @@ import java.nio.ByteBuffer;
 import java.nio.charset.Charset;
 import java.text.NumberFormat;
 import java.util.Set;
-import com.ruoyi.common.utils.StringUtils;
+
 import org.apache.commons.lang3.ArrayUtils;
 
+import com.ruoyi.common.utils.StringUtils;
+
 /**
  * 类型转换器
  *
@@ -364,6 +366,10 @@ public class Convert
      */
     public static String[] toStrArray(String str)
     {
+        if (StringUtils.isEmpty(str))
+        {
+            return new String[] {};
+        }
         return toStrArray(",", str);
     }
 

ruoyi-framework/src/main/java/com/ruoyi/framework/aspectj/DataScopeAspect.java

@@ -2,10 +2,12 @@ package com.ruoyi.framework.aspectj;
 
 import java.util.ArrayList;
 import java.util.List;
+
 import org.aspectj.lang.JoinPoint;
 import org.aspectj.lang.annotation.Aspect;
 import org.aspectj.lang.annotation.Before;
 import org.springframework.stereotype.Component;
+
 import com.ruoyi.common.annotation.DataScope;
 import com.ruoyi.common.core.domain.BaseEntity;
 import com.ruoyi.common.core.domain.entity.SysRole;
@@ -23,8 +25,7 @@ import com.ruoyi.framework.security.context.PermissionContextHolder;
  */
 @Aspect
 @Component
-public class DataScopeAspect
+public class DataScopeAspect {
-{
     /**
      * 全部数据权限
      */
@@ -56,23 +57,20 @@ public class DataScopeAspect
     public static final String DATA_SCOPE = "dataScope";
 
     @Before("@annotation(controllerDataScope)")
-    public void doBefore(JoinPoint point, DataScope controllerDataScope) throws Throwable
+    public void doBefore(JoinPoint point, DataScope controllerDataScope) throws Throwable {
-    {
         clearDataScope(point);
         handleDataScope(point, controllerDataScope);
     }
 
-    protected void handleDataScope(final JoinPoint joinPoint, DataScope controllerDataScope)
+    protected void handleDataScope(final JoinPoint joinPoint, DataScope controllerDataScope) {
-    {
         // 获取当前的用户
         LoginUser loginUser = SecurityUtils.getLoginUser();
-        if (StringUtils.isNotNull(loginUser))
+        if (StringUtils.isNotNull(loginUser)) {
-        {
             SysUser currentUser = loginUser.getUser();
             // 如果是超级管理员，则不过滤数据
-            if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin())
+            if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin()) {
-            {
+                String permission = StringUtils.defaultIfEmpty(controllerDataScope.permission(),
-                String permission = StringUtils.defaultIfEmpty(controllerDataScope.permission(), PermissionContextHolder.getContext());
+                        PermissionContextHolder.getContext());
                 dataScopeFilter(joinPoint, currentUser, controllerDataScope.deptAlias(),
                         controllerDataScope.userAlias(), permission);
             }
@@ -88,53 +86,51 @@ public class DataScopeAspect
      * @param userAlias  用户别名
      * @param permission 权限字符
      */
-    public static void dataScopeFilter(JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias, String permission)
+    public static void dataScopeFilter(JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias,
-    {
+            String permission) {
         StringBuilder sqlString = new StringBuilder();
         List<String> conditions = new ArrayList<String>();
+        List<String> scopeCustomIds = new ArrayList<String>();
+        user.getRoles().forEach(role -> {
+            if (DATA_SCOPE_CUSTOM.equals(role.getDataScope())
+                    && StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission))) {
+                scopeCustomIds.add(Convert.toStr(role.getRoleId()));
+            }
+        });
 
-        for (SysRole role : user.getRoles())
+        for (SysRole role : user.getRoles()) {
-        {
             String dataScope = role.getDataScope();
-            if (!DATA_SCOPE_CUSTOM.equals(dataScope) && conditions.contains(dataScope))
+            if (conditions.contains(dataScope)) {
-            {
                 continue;
             }
-            if (StringUtils.isNotEmpty(permission) && StringUtils.isNotEmpty(role.getPermissions())
+            if (!StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission))) {
-                    && !StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission)))
-            {
                 continue;
             }
-            if (DATA_SCOPE_ALL.equals(dataScope))
+            if (DATA_SCOPE_ALL.equals(dataScope)) {
-            {
                 sqlString = new StringBuilder();
                 conditions.add(dataScope);
                 break;
-            }
+            } else if (DATA_SCOPE_CUSTOM.equals(dataScope)) {
-            else if (DATA_SCOPE_CUSTOM.equals(dataScope))
+                if (scopeCustomIds.size() > 1) {
-            {
+                    // 多个自定数据权限使用in查询，避免多次拼接。
+                    sqlString.append(StringUtils.format(
+                            " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id in ({}) ) ", deptAlias,
+                            String.join(",", scopeCustomIds)));
+                } else {
                     sqlString.append(StringUtils.format(
                             " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias,
                             role.getRoleId()));
                 }
-            else if (DATA_SCOPE_DEPT.equals(dataScope))
+            } else if (DATA_SCOPE_DEPT.equals(dataScope)) {
-            {
                 sqlString.append(StringUtils.format(" OR {}.dept_id = {} ", deptAlias, user.getDeptId()));
-            }
+            } else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope)) {
-            else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope))
-            {
                 sqlString.append(StringUtils.format(
                         " OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )",
                         deptAlias, user.getDeptId(), user.getDeptId()));
-            }
+            } else if (DATA_SCOPE_SELF.equals(dataScope)) {
-            else if (DATA_SCOPE_SELF.equals(dataScope))
+                if (StringUtils.isNotBlank(userAlias)) {
-            {
-                if (StringUtils.isNotBlank(userAlias))
-                {
                     sqlString.append(StringUtils.format(" OR {}.user_id = {} ", userAlias, user.getUserId()));
-                }
+                } else {
-                else
-                {
                     // 数据权限为仅本人且没有userAlias别名不查询任何数据
                     sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias));
                 }
@@ -143,16 +139,13 @@ public class DataScopeAspect
         }
 
         // 多角色情况下，所有角色都不包含传递过来的权限字符，这个时候sqlString也会为空，所以要限制一下,不查询任何数据
-        if (StringUtils.isEmpty(conditions))
+        if (StringUtils.isEmpty(conditions)) {
-        {
             sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias));
         }
 
-        if (StringUtils.isNotBlank(sqlString.toString()))
+        if (StringUtils.isNotBlank(sqlString.toString())) {
-        {
             Object params = joinPoint.getArgs()[0];
-            if (StringUtils.isNotNull(params) && params instanceof BaseEntity)
+            if (StringUtils.isNotNull(params) && params instanceof BaseEntity) {
-            {
                 BaseEntity baseEntity = (BaseEntity) params;
                 baseEntity.getParams().put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")");
             }
@@ -162,11 +155,9 @@ public class DataScopeAspect
     /**
      * 拼接权限sql前先清空params.dataScope参数防止注入
      */
-    private void clearDataScope(final JoinPoint joinPoint)
+    private void clearDataScope(final JoinPoint joinPoint) {
-    {
         Object params = joinPoint.getArgs()[0];
-        if (StringUtils.isNotNull(params) && params instanceof BaseEntity)
+        if (StringUtils.isNotNull(params) && params instanceof BaseEntity) {
-        {
             BaseEntity baseEntity = (BaseEntity) params;
             baseEntity.getParams().put(DATA_SCOPE, "");
         }

ruoyi-framework/src/main/java/com/ruoyi/framework/web/exception/GlobalExceptionHandler.java

@@ -1,19 +1,25 @@
 package com.ruoyi.framework.web.exception;
 
-import jakarta.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequest;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.validation.BindException;
 import org.springframework.web.HttpRequestMethodNotSupportedException;
 import org.springframework.web.bind.MethodArgumentNotValidException;
+import org.springframework.web.bind.MissingPathVariableException;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.method.annotation.MethodArgumentTypeMismatchException;
+
 import com.ruoyi.common.constant.HttpStatus;
 import com.ruoyi.common.core.domain.AjaxResult;
+import com.ruoyi.common.core.text.Convert;
 import com.ruoyi.common.exception.DemoModeException;
 import com.ruoyi.common.exception.ServiceException;
 import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.common.utils.html.EscapeUtil;
 
 /**
  * 全局异常处理器
@@ -21,16 +27,14 @@ import com.ruoyi.common.utils.StringUtils;
  * @author ruoyi
  */
 @RestControllerAdvice
-public class GlobalExceptionHandler
+public class GlobalExceptionHandler {
-{
     private static final Logger log = LoggerFactory.getLogger(GlobalExceptionHandler.class);
 
     /**
      * 权限校验异常
      */
     @ExceptionHandler(AccessDeniedException.class)
-    public AjaxResult handleAccessDeniedException(AccessDeniedException e, HttpServletRequest request)
+    public AjaxResult handleAccessDeniedException(AccessDeniedException e, HttpServletRequest request) {
-    {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',权限校验失败'{}'", requestURI, e.getMessage());
         return AjaxResult.error(HttpStatus.FORBIDDEN, "没有权限，请联系管理员授权");
@@ -41,8 +45,7 @@ public class GlobalExceptionHandler
      */
     @ExceptionHandler(HttpRequestMethodNotSupportedException.class)
     public AjaxResult handleHttpRequestMethodNotSupported(HttpRequestMethodNotSupportedException e,
-            HttpServletRequest request)
+            HttpServletRequest request) {
-    {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',不支持'{}'请求", requestURI, e.getMethod());
         return AjaxResult.error(e.getMessage());
@@ -52,19 +55,43 @@ public class GlobalExceptionHandler
      * 业务异常
      */
     @ExceptionHandler(ServiceException.class)
-    public AjaxResult handleServiceException(ServiceException e, HttpServletRequest request)
+    public AjaxResult handleServiceException(ServiceException e, HttpServletRequest request) {
-    {
         log.error(e.getMessage(), e);
         Integer code = e.getCode();
         return StringUtils.isNotNull(code) ? AjaxResult.error(code, e.getMessage()) : AjaxResult.error(e.getMessage());
     }
 
+    /**
+     * 请求路径中缺少必需的路径变量
+     */
+    @ExceptionHandler(MissingPathVariableException.class)
+    public AjaxResult handleMissingPathVariableException(MissingPathVariableException e, HttpServletRequest request) {
+        String requestURI = request.getRequestURI();
+        log.error("请求路径中缺少必需的路径变量'{}',发生系统异常.", requestURI, e);
+        return AjaxResult.error(String.format("请求路径中缺少必需的路径变量[%s]", e.getVariableName()));
+    }
+
+    /**
+     * 请求参数类型不匹配
+     */
+    @ExceptionHandler(MethodArgumentTypeMismatchException.class)
+    public AjaxResult handleMethodArgumentTypeMismatchException(MethodArgumentTypeMismatchException e,
+            HttpServletRequest request) {
+        String requestURI = request.getRequestURI();
+        String value = Convert.toStr(e.getValue());
+        if (StringUtils.isNotEmpty(value)) {
+            value = EscapeUtil.clean(value);
+        }
+        log.error("请求参数类型不匹配'{}',发生系统异常.", requestURI, e);
+        return AjaxResult.error(String.format("请求参数类型不匹配，参数[%s]要求类型为：'%s'，但输入值为：'%s'", e.getName(),
+                e.getRequiredType().getName(), value));
+    }
+
     /**
      * 拦截未知的运行时异常
      */
     @ExceptionHandler(RuntimeException.class)
-    public AjaxResult handleRuntimeException(RuntimeException e, HttpServletRequest request)
+    public AjaxResult handleRuntimeException(RuntimeException e, HttpServletRequest request) {
-    {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',发生未知异常.", requestURI, e);
         return AjaxResult.error(e.getMessage());
@@ -74,8 +101,7 @@ public class GlobalExceptionHandler
      * 系统异常
      */
     @ExceptionHandler(Exception.class)
-    public AjaxResult handleException(Exception e, HttpServletRequest request)
+    public AjaxResult handleException(Exception e, HttpServletRequest request) {
-    {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',发生系统异常.", requestURI, e);
         return AjaxResult.error(e.getMessage());
@@ -85,8 +111,7 @@ public class GlobalExceptionHandler
      * 自定义验证异常
      */
     @ExceptionHandler(BindException.class)
-    public AjaxResult handleBindException(BindException e)
+    public AjaxResult handleBindException(BindException e) {
-    {
         log.error(e.getMessage(), e);
         String message = e.getAllErrors().get(0).getDefaultMessage();
         return AjaxResult.error(message);
@@ -96,8 +121,7 @@ public class GlobalExceptionHandler
      * 自定义验证异常
      */
     @ExceptionHandler(MethodArgumentNotValidException.class)
-    public Object handleMethodArgumentNotValidException(MethodArgumentNotValidException e)
+    public Object handleMethodArgumentNotValidException(MethodArgumentNotValidException e) {
-    {
         log.error(e.getMessage(), e);
         String message = e.getBindingResult().getFieldError().getDefaultMessage();
         return AjaxResult.error(message);
@@ -107,8 +131,7 @@ public class GlobalExceptionHandler
      * 演示模式异常
      */
     @ExceptionHandler(DemoModeException.class)
-    public AjaxResult handleDemoModeException(DemoModeException e)
+    public AjaxResult handleDemoModeException(DemoModeException e) {
-    {
         return AjaxResult.error("演示模式，不允许操作");
     }
 }