提交 3c47f7fa 编写于 作者: zhouweidong's avatar zhouweidong

补充save鉴权

上级 8914f35a
...@@ -199,7 +199,11 @@ public class ${itemCodeName}Resource { ...@@ -199,7 +199,11 @@ public class ${itemCodeName}Resource {
} }
<#elseif deaction.codeName?lower_case == 'save'> <#elseif deaction.codeName?lower_case == 'save'>
<#if noDEPrefield>
<@outputHasAnyAuthorityAnnotation '${sys.codeName}-${de.codeName}-${deaction.codeName}-all'/> <@outputHasAnyAuthorityAnnotation '${sys.codeName}-${de.codeName}-${deaction.codeName}-all'/>
<#else>
@PreAuthorize("hasPermission('','Save',{'${deStorageMode}',this.${itemCodeNameLC}Mapping,#${itemCodeNameLC}dto})")
</#if>
@ApiOperation(value = "${deaction.getLogicName()}", tags = {"${itemCodeName}" }, notes = "${deaction.getLogicName()}") @ApiOperation(value = "${deaction.getLogicName()}", tags = {"${itemCodeName}" }, notes = "${deaction.getLogicName()}")
@RequestMapping(method = RequestMethod.${reqMtd}, value = "${fullPath}/${deactionCodeName?lower_case}") @RequestMapping(method = RequestMethod.${reqMtd}, value = "${fullPath}/${deactionCodeName?lower_case}")
public ResponseEntity<Boolean> save(${etParams}) { public ResponseEntity<Boolean> save(${etParams}) {
...@@ -534,7 +538,11 @@ public class ${itemCodeName}Resource { ...@@ -534,7 +538,11 @@ public class ${itemCodeName}Resource {
} }
<#elseif deaction.codeName?lower_case == 'save'> <#elseif deaction.codeName?lower_case == 'save'>
<#if noDEPrefield>
<@outputHasAnyAuthorityAnnotation '${sys.codeName}-${de.codeName}-${deaction.codeName}-all'/> <@outputHasAnyAuthorityAnnotation '${sys.codeName}-${de.codeName}-${deaction.codeName}-all'/>
<#else>
@PreAuthorize("hasPermission('','Save',{'${deStorageMode}',this.${itemCodeNameLC}Mapping,#${itemCodeNameLC}dto})")
</#if>
@ApiOperation(value = "${deaction.getLogicName()}${byParams}", tags = {"${itemCodeName}" }, notes = "${deaction.getLogicName()}${byParams}") @ApiOperation(value = "${deaction.getLogicName()}${byParams}", tags = {"${itemCodeName}" }, notes = "${deaction.getLogicName()}${byParams}")
@RequestMapping(method = RequestMethod.${reqMtd}, value = "${fullPath}/${deactionCodeName?lower_case}") @RequestMapping(method = RequestMethod.${reqMtd}, value = "${fullPath}/${deactionCodeName?lower_case}")
public ResponseEntity<Boolean> ${deactionCodeName?uncap_first}${byParams}(${etParams}) { public ResponseEntity<Boolean> ${deactionCodeName?uncap_first}${byParams}(${etParams}) {
......
...@@ -107,6 +107,9 @@ public class AuthPermissionEvaluator implements PermissionEvaluator { ...@@ -107,6 +107,9 @@ public class AuthPermissionEvaluator implements PermissionEvaluator {
if(action.equalsIgnoreCase("create")){ if(action.equalsIgnoreCase("create")){
return createBatchActionPermissionValid(entityList,dataRangeList); return createBatchActionPermissionValid(entityList,dataRangeList);
} }
else if(action.equalsIgnoreCase("save")){
return saveBatchActionPermissionValid(deStorageMode, entityList, dataRangeList);
}
else{ else{
if(!action.equalsIgnoreCase("remove")){ if(!action.equalsIgnoreCase("remove")){
ids=getIds(entity,entityList); ids=getIds(entity,entityList);
...@@ -117,6 +120,43 @@ public class AuthPermissionEvaluator implements PermissionEvaluator { ...@@ -117,6 +120,43 @@ public class AuthPermissionEvaluator implements PermissionEvaluator {
} }
} }
/**
* save校验
* @param deStorageMode
* @param entityList
* @param dataRangeList
* @return
*/
private boolean saveBatchActionPermissionValid(String deStorageMode, List<EntityBase> entityList, JSONArray dataRangeList) {
if(entityList==null || entityList.size()==0)
return false;
EntityBase tempEntity=entityList.get(0);
Map<String,String> permissionField=getPermissionField(tempEntity);
String keyFieldName=permissionField.get(keyFieldTag);
List createList=new ArrayList();
List<String> updateList =new ArrayList();
for(EntityBase entity : entityList){
Object id = entity.get(keyFieldName);
if(ObjectUtils.isEmpty(id))
createList.add(entity);
else
updateList.add(String.valueOf(id));
}
if(updateList.size()>0){
boolean isUpdate = otherBatchActionPermissionValidRouter(deStorageMode, tempEntity ,updateList, dataRangeList);
if(!isUpdate)
return false;
}
if(createList.size()>0){
boolean isCreate=createBatchActionPermissionValid(entityList,dataRangeList);
if(!isCreate)
return false;
}
return true;
}
/** /**
* 实体行为权限检查 :用于检查当前用户是否拥有实体的新建、编辑、删除权限 * 实体行为权限检查 :用于检查当前用户是否拥有实体的新建、编辑、删除权限
* *
...@@ -160,6 +200,15 @@ public class AuthPermissionEvaluator implements PermissionEvaluator { ...@@ -160,6 +200,15 @@ public class AuthPermissionEvaluator implements PermissionEvaluator {
if(dataRangeList.size()==0) if(dataRangeList.size()==0)
return false; return false;
if(action.equalsIgnoreCase("save")){
Map<String,String> permissionField=getPermissionField(entity);
String keyFieldName=permissionField.get(keyFieldTag);
Object srfKey=entity.get(keyFieldName);
if(ObjectUtils.isEmpty(srfKey))
action="create";
else
action="update";
}
if(action.equalsIgnoreCase("create")){ if(action.equalsIgnoreCase("create")){
return createActionPermissionValid(entity,dataRangeList); return createActionPermissionValid(entity,dataRangeList);
} }
......
Markdown 格式
0% or
您添加了 0 到此讨论。请谨慎行事。
先完成此消息的编辑!
想要评论请 注册