使用MyBatis拦截器实现sql查询权限动态修改代码实例

public class AccountInfo implements Serializable {
    int id;
    String account;
    String name;
    BigDecimal money;
    public AccountInfo(){}
    public AccountInfo(int id, String account, String name, BigDecimal money){
        this.id = id;
        this.account = account;
        this.name = name;
        this.money = money;
}

@Mapper
public interface AccountMapper {
    @Permission
    @Select("select * from account")
    public List<AccountInfo> getAccountInfoList();
}

@Controller
public class MainController {
    @Autowired
    AccountMapper accountMapper;
    @RequestMapping("/getAccountInfo")
    @ResponseBody
    public String getAccountInfo() throws JsonProcessingException {
        ObjectMapper objectMapper = new ObjectMapper();
        List<AccountInfo> accounts  = accountMapper.getAccountInfoList();
        return objectMapper.writeValueAsString(accounts);
    }
    @RequestMapping("/setPermission")
    @ResponseBody
    public String setPermission(HttpServletRequest request, String permission){
        request.getSession().setAttribute("permission", permission);
        return permission;
    }
}

permission:
  permissionMap:
    develop: "\"develop\""
    advertise: "\"advertise\""
    finance: "\"develop\", \"advertise\", \"finance\""

// 从配置文件中读取permission层次范围
@Configuration
@ConfigurationProperties(prefix = "permission")
@EnableConfigurationProperties(PermissionConfig.class)
public class PermissionConfig {
    private Map<String, String> permissionMap = new HashMap<>();
    public Map<String, String> getPermissionMap() {
        return permissionMap;
    }
    public void setPermissionMap(Map<String, String> permissionMap) {
        this.permissionMap = permissionMap;
    }
}

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
// 指名数据库查询方法需要和权限挂钩
public @interface Permission {}

@Intercepts({
        @Signature(type = StatementHandler.class, method = "prepare", args = {Connection.class, Integer.class})
})
@Component
public class PermissionInterceptor implements Interceptor {

    private static final ObjectFactory DEFAULT_OBJECT_FACTORY = new DefaultObjectFactory();
    private static final ObjectWrapperFactory DEFAULT_OBJECT_WRAPPER_FACTORY = new DefaultObjectWrapperFactory();
    private static final ReflectorFactory REFLECTOR_FACTORY = new DefaultReflectorFactory();
    @Autowired
    private PermissionConfig permissionConfig;
    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 获取sql信息
        StatementHandler statementHandler = (StatementHandler) invocation.getTarget();
        BoundSql boundSql = statementHandler.getBoundSql();
        String sql = boundSql.getSql();
        System.out.println("原sql为: " + sql);
        // 获取元数据
        MetaObject metaResultSetHandler = MetaObject.forObject(statementHandler, DEFAULT_OBJECT_FACTORY, DEFAULT_OBJECT_WRAPPER_FACTORY, REFLECTOR_FACTORY);
        MappedStatement mappedStatement = (MappedStatement) metaResultSetHandler.getValue("delegate.mappedStatement");

        // 获取调用方法
        String id = mappedStatement.getId();
        String className = id.substring(0, id.lastIndexOf("."));
        String methodName = id.substring(id.lastIndexOf(".") + 1);
        System.out.println("调用方法为: " + id);

        // 注解查询
        Class clazz = Class.forName(className);
        Method method = clazz.getDeclaredMethod(methodName);
        boolean needPermission = method.isAnnotationPresent(Permission.class);
        // 对注解方法进行权限处理
        if(needPermission){
            System.out.println("需要进行sql权限变化");

// 获取权限信息
	HttpSession session = HttpUtil.getSession();
	String permission = (String) session.getAttribute("permission");
	Map<String, String> map = permissionConfig.getPermissionMap();
	for(String key:map.keySet()){
		System.out.println(key);
	}
	String canSelectPermission = null;
	if(map.containsKey(permission)){
		canSelectPermission = map.get(permission);
	}
	System.out.printf("当前权限:%s, 可查询范围:%s%n", permission, canSelectPermission);
// 修改sql
	String newSql = String.format("select * from (%s) `range` where `range`.permission in (%s)", sql, canSelectPermission);
	// String newSql = "select * from account where permission in (\"advertise\")";
	System.out.println("修改后的sql为: " + newSql);

  // 反射修改handler中的sql以执行
  Class boundClass = boundSql.getClass();
  Field field = boundClass.getDeclaredField("sql");
  field.setAccessible(true);
  field.set(boundSql, newSql);