SaasAuthHandler.java 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245
  1. package com.persagy.account.manage;
  2. import java.util.HashMap;
  3. import java.util.List;
  4. import java.util.Map;
  5. import java.util.concurrent.TimeUnit;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.data.redis.core.RedisTemplate;
  8. import org.springframework.stereotype.Component;
  9. import com.alibaba.fastjson.JSONObject;
  10. import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
  11. import com.google.common.collect.Lists;
  12. import com.persagy.account.pojo.dto.SaasAccount;
  13. import com.persagy.account.pojo.dto.SaasArea;
  14. import com.persagy.account.pojo.dto.SaasGroup;
  15. import com.persagy.account.service.ISaasAccountService;
  16. import com.persagy.account.service.ISaasGroupService;
  17. import com.persagy.common.constant.SaasCommonConstant;
  18. import com.persagy.common.enums.ResponseCode;
  19. import com.persagy.common.exception.BusinessException;
  20. import com.persagy.common.utils.StringUtil;
  21. import cn.hutool.core.util.BooleanUtil;
  22. import cn.hutool.crypto.digest.MD5;
  23. /**
  24. * @version
  25. * @description
  26. * @company persagy
  27. * @author zhangqiankun
  28. * @since 2021年3月18日: 上午10:20:22
  29. */
  30. @Component
  31. public class SaasAuthHandler {
  32. private static MD5 md5 = MD5.create();
  33. @Autowired
  34. private ISaasGroupService saasGroupService;
  35. @Autowired
  36. private ISaasAccountService saasAccountService;
  37. @Autowired
  38. private SaasAreaProjectHandler saasAreaProjectHandler;
  39. @Autowired
  40. private RedisTemplate<String, Object> redisTemplate;
  41. /**
  42. * 验证此账号的集团项目权限
  43. *
  44. * @param accountId
  45. * @param groupCode
  46. * @return
  47. * 权限鉴定通过时:
  48. * 若有返回集团编码,则此返回值必须作为代码向下执行的sql条件;
  49. * 若有返回accountType,需进行 SaasCommonConstant.STR_STATUS_2.equals(accountType) 账号类型的判断
  50. */
  51. public Map<String, String> validGroupProjectAuth(String accountId, String groupCode) {
  52. // 获取此账号对应的集团权限
  53. SaasAccount account = this.saasAccountService.getOne(accountId, null, null);
  54. if (account == null) {
  55. throw new BusinessException("账号信息为空");
  56. }
  57. // 添加数据访问控制,账号类型,0-所有集团项目,1-单集团所有项目,2-其他
  58. String accountType = account.getAccountType();
  59. // 1时,判断是否有权限
  60. Map<String, String> result = new HashMap<String, String>(2);
  61. if (SaasCommonConstant.STR_STATUS_1.equals(accountType)) {
  62. String allowGroupCode = account.getGroupCode();
  63. if (StringUtil.isNotBlank(groupCode) && !groupCode.equals(allowGroupCode)) {
  64. throw new BusinessException("账号无该集团的访问权限");
  65. }
  66. result.put(SaasCommonConstant.GROUP_CODE, allowGroupCode);
  67. }
  68. result.put(SaasCommonConstant.ACCOUNT_TYPE, accountType);
  69. return result;
  70. }
  71. /**
  72. * 返回允许此账号访问的集团信息
  73. *
  74. * @param accountId
  75. * @param groupCode
  76. * @return 允许此账号访问的集团信息
  77. */
  78. public List<SaasGroup> getAllowGroupList(String accountId, String groupCode) {
  79. // 获取此账号对应的集团权限
  80. SaasAccount account = this.saasAccountService.getOne(accountId, null, null);
  81. if (account == null) {
  82. throw new BusinessException("账号信息为空");
  83. }
  84. // 添加数据访问控制,账号类型,0-所有集团项目,1-单集团所有项目,2-其他
  85. String accountType = account.getAccountType();
  86. // 1时,判断是否有权限
  87. if (SaasCommonConstant.STR_STATUS_1.equals(accountType)) {
  88. String allowGroupCode = account.getGroupCode();
  89. if (StringUtil.isNotBlank(groupCode) && !groupCode.equals(allowGroupCode)) {
  90. throw new BusinessException("账号无该集团的访问权限");
  91. }
  92. groupCode = allowGroupCode;
  93. }
  94. return this.getAllowGroupList(accountId, groupCode, accountType);
  95. }
  96. /**
  97. * 返回允许此账号访问的集团信息
  98. *
  99. * @param accountId
  100. * @param groupCode
  101. * @param accountType
  102. * @return 允许此账号访问的集团信息
  103. */
  104. public List<SaasGroup> getAllowGroupList(String accountId, String groupCode, String accountType) {
  105. List<SaasGroup> groups = null;
  106. if (SaasCommonConstant.STR_STATUS_2.equals(accountType)) {
  107. SaasGroup saasGroup = new SaasGroup();
  108. saasGroup.setGroupCode(groupCode);
  109. saasGroup.setValid(SaasCommonConstant.STATUS_1);
  110. groups = this.saasGroupService.queryAllowGroupInfo(saasGroup, accountId);
  111. } else {
  112. LambdaQueryWrapper<SaasGroup> queryWrapper = new SaasGroup.Builder().createQueryWrapper().validEq(SaasCommonConstant.STATUS_1).builderQueryWrapper();
  113. groups = this.saasGroupService.list(queryWrapper);
  114. }
  115. return groups == null ? Lists.newArrayList() : groups;
  116. }
  117. /**
  118. * 返回被允许访问的区域树
  119. *
  120. * @param accountId
  121. * @param groupCode
  122. * @return 允许此账号访问的集团信息
  123. */
  124. public List<SaasArea> getAllowAreaList(String accountId, String groupCode) {
  125. // 获取此账号对应的集团权限
  126. SaasAccount account = this.saasAccountService.getOne(accountId, null, null);
  127. if (account == null) {
  128. throw new BusinessException("账号信息为空");
  129. }
  130. // 添加数据访问控制,账号类型,0-所有集团项目,1-单集团所有项目,2-其他
  131. String accountType = account.getAccountType();
  132. // 1时,判断是否有权限
  133. if (SaasCommonConstant.STR_STATUS_1.equals(accountType)) {
  134. String allowGroupCode = account.getGroupCode();
  135. if (StringUtil.isNotBlank(groupCode) && !groupCode.equals(allowGroupCode)) {
  136. throw new BusinessException("账号无该集团的访问权限");
  137. }
  138. groupCode = allowGroupCode;
  139. }
  140. return this.getAllowAreaList(accountId, groupCode, accountType);
  141. }
  142. /**
  143. * 返回被允许访问的区域树
  144. *
  145. * @param accountId
  146. * @param groupCode
  147. * @param accountType
  148. * @return
  149. */
  150. public List<SaasArea> getAllowAreaList(String accountId, String groupCode, String accountType) {
  151. List<SaasArea> topList = this.saasAreaProjectHandler.getTopAreaList(groupCode);
  152. if (SaasCommonConstant.STR_STATUS_2.equals(accountType)) {
  153. // 其他类型时,需要根据权限表数据,去匹配区域树
  154. this.saasAreaProjectHandler.queryAllowAreaTree(topList, accountId, groupCode);
  155. } else {
  156. this.saasAreaProjectHandler.querySaasAreaTree(topList, false);
  157. }
  158. return topList;
  159. }
  160. /**
  161. * 验证此账号的菜单权限
  162. *
  163. * @param accountId
  164. * @param groupCode
  165. * @return
  166. * 权限鉴定通过时:
  167. * 有accountbelong 账号所属字段
  168. * 若有返回集团编码,则此返回值必须作为代码向下执行的sql条件;
  169. * 若有返回accountType,需进行 SaasCommonConstant.STR_STATUS_2.equals(accountType) 账号类型的判断
  170. */
  171. public Map<String, String> validSaasMenuAuth(String accountId, String groupCode) {
  172. // 获取此账号对应的集团权限
  173. SaasAccount account = this.saasAccountService.getOne(accountId, null, null);
  174. if (account == null) {
  175. throw new BusinessException("账号信息为空");
  176. }
  177. // 添加数据访问控制,账号类型,0-所有集团项目,1-单集团所有项目,2-其他
  178. String accountType = account.getAccountType();
  179. // 1时,判断是否有权限
  180. Map<String, String> result = new HashMap<String, String>(2);
  181. if (SaasCommonConstant.STR_STATUS_1.equals(accountType)) {
  182. String allowGroupCode = account.getGroupCode();
  183. if (StringUtil.isNotBlank(groupCode) && !groupCode.equals(allowGroupCode)) {
  184. throw new BusinessException("账号无该集团的访问权限");
  185. }
  186. result.put(SaasCommonConstant.GROUP_CODE, allowGroupCode);
  187. }
  188. result.put(SaasCommonConstant.ACCOUNT_TYPE, accountType);
  189. result.put(SaasCommonConstant.ACCOUNT_BELONG, account.getAccountBelong());
  190. return result;
  191. }
  192. /**
  193. * 申请授权码
  194. */
  195. public String getCode(String clientId, String redirectUrl) {
  196. // 验证客户端ID是否存在
  197. Boolean member = this.redisTemplate.opsForSet().isMember(SaasCommonConstant.SAAS_CLIENT_ID_REDIS_KEY, clientId);
  198. if (!BooleanUtil.isTrue(member)) {
  199. throw new BusinessException(ResponseCode.A0001.getCode(), "非法客户端");
  200. }
  201. // 生成新的授权码,并验证授权码是否已存在
  202. String redisKey = this.getCodeRediskey(clientId, redirectUrl);
  203. JSONObject temp = new JSONObject();
  204. temp.put("time", System.currentTimeMillis());
  205. temp.put("redirectUrl", redirectUrl);
  206. String code = md5.digestHex(temp.toJSONString());
  207. Boolean setIfAbsent = this.redisTemplate.opsForValue().setIfAbsent(redisKey, code, 300000L, TimeUnit.MILLISECONDS);
  208. if (!BooleanUtil.isTrue(setIfAbsent)) {
  209. throw new BusinessException(ResponseCode.A0302.getCode(), ResponseCode.A0302.getDesc());
  210. }
  211. return code;
  212. }
  213. /**
  214. * 客户端ID
  215. * @param clientId 不可为空
  216. * @param redirectUrl 可为空
  217. * @return
  218. */
  219. public String getCodeRediskey(String clientId, String redirectUrl) {
  220. if (StringUtil.isBlank(redirectUrl)) {
  221. redirectUrl = "";
  222. }
  223. return clientId + SaasCommonConstant.UNDERLINE_JOIN_SYMBOL + md5.digestHex(redirectUrl);
  224. }
  225. }