Explorar o código

越权问题修复

raojiang hai 4 meses
pai
achega
36d4dcf198

+ 165 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/aspect/CountryPermissionAspect.java

@@ -0,0 +1,165 @@
+package com.hdkj.lt.bf.aspect;
+
+import cn.hutool.core.collection.CollUtil;
+import com.hdkj.lt.base.exception.BusinessException;
+import com.hdkj.lt.bf.service.StruService;
+import com.hdkj.lt.core.bizms.modle.po.DwdShbDsFeederBase;
+import com.hdkj.lt.core.sys.model.dto.StruTreeCacheDTO;
+import com.hdkj.lt.core.sys.service.DwdShbDsFeederBaseService;
+import com.hdkj.lt.core.sys.service.ISysStruService;
+import com.ruoyi.common.security.utils.SecurityUtils;
+import com.ruoyi.system.api.model.LoginUser;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
+import org.aspectj.lang.JoinPoint;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+/**
+ * @author rj
+ * @date 2026/4/1 14:37
+ * @description
+ */
+@Slf4j
+@Component
+@Aspect
+@RequiredArgsConstructor
+public class CountryPermissionAspect {
+
+
+    private final StruService struService;
+    private final ISysStruService sysStruService;
+
+    private final DwdShbDsFeederBaseService dwdShbDsFeederBaseService;
+
+    private static final String PROVINCE = "1";//省
+    private static final String CITY = "4";//市
+    private static final String COUNTY = "5";//区县
+    private static final String FEEDER = "0";//线路
+    private static final String STATION = "10";//变电站
+
+    @Before("@annotation(requiresCountryPermissions)")
+    public void beforeCountryPermissions(JoinPoint joinPoint, RequiresCountryPermissions requiresCountryPermissions) {
+        List<String> countyList = this.getCountyList();
+        List<Long> deptList = this.getDeptList();
+        String countryFields = requiresCountryPermissions.countryFields();
+        String lineFields = requiresCountryPermissions.lineFields();
+        String deptCodeFields = requiresCountryPermissions.lineFields();
+
+        String lineId = "";
+        String countryId = "";
+        Long deptId = -1L;
+        Object[] args = joinPoint.getArgs();
+        for (Object arg : args) {
+            try {
+                if (StringUtils.isNotEmpty(lineFields)) {
+                    String getterName = "get" + lineFields.substring(0, 1).toUpperCase() + lineFields.substring(1);
+                    Method method = arg.getClass().getMethod(getterName);
+                    lineId = (String) method.invoke(arg);
+                }
+                if (StringUtils.isNotEmpty(countryFields)) {
+                    String getterName2 = "get" + countryFields.substring(0, 1).toUpperCase() + countryFields.substring(1);
+                    Method method2 = arg.getClass().getMethod(getterName2);
+                    countryId = (String) method2.invoke(arg);
+                }
+                if (StringUtils.isNotEmpty(deptCodeFields)) {
+                    String getterName2 = "get" + deptCodeFields.substring(0, 1).toUpperCase() + deptCodeFields.substring(1);
+                    Method method2 = arg.getClass().getMethod(getterName2);
+                    deptId = (Long) method2.invoke(arg);
+                }
+            } catch (IllegalAccessException | InvocationTargetException | NoSuchMethodException e) {
+                throw new BusinessException("系统异常,请联系管理员");
+            }
+        }
+        DwdShbDsFeederBase feederBase = dwdShbDsFeederBaseService.getByPsrId(lineId);
+        String feederCountryId = "";
+        if (feederBase != null) {
+            feederCountryId = feederBase.getMaintOrg();
+        }
+        if (StringUtils.isNotEmpty(countryId) && !countyList.contains(countryId)) {
+            throw new BusinessException("当前用户无权限访问");
+        }
+        if (StringUtils.isNotEmpty(feederCountryId) && !countyList.contains(feederCountryId)) {
+            throw new BusinessException("当前用户无权限访问");
+        }
+        if (deptId != -1L && !deptList.contains(deptId)) {
+            throw new BusinessException("当前用户无权限访问");
+        }
+
+
+    }
+
+    //查询登录人的所有机构区县信息
+    private List<String> getCountyList() {
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        if (loginUser == null) {
+            throw new BusinessException("请先登录");
+        }
+        Long struId = loginUser.getSysUser().getDeptId();
+        return this.getCountyCodeListByStruId(struId);
+    }
+
+    //查询登录人的所有机构区县信息
+    private List<Long> getDeptList() {
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        if (loginUser == null) {
+            throw new BusinessException("请先登录");
+        }
+        Long struId = loginUser.getSysUser().getDeptId();
+        return struService.getCountyCodeListByStruId(struId);
+    }
+
+    public List<String> getCountyCodeListByStruId(Long struId) {
+        List<String> result = new ArrayList<>();
+        if (Objects.isNull(struId)) {
+            return result;
+        }
+        StruTreeCacheDTO struTreeCacheDTO = sysStruService.getStruTreeByCache(struId);
+        if (Objects.isNull(struTreeCacheDTO)) {
+            return result;
+        }
+        String struType = struTreeCacheDTO.getStruType();
+        switch (struType) {
+            case PROVINCE:
+                // 1.用户如果是省公司,获取所有市所有区县
+                List<StruTreeCacheDTO> children = struTreeCacheDTO.getChildren();
+                Optional.ofNullable(children).ifPresent(child -> {
+                    List<String> childrenStruIdList = child.stream().filter(e -> e != null && CollUtil.isNotEmpty(e.getChildren()))
+                            .flatMap(grand -> grand.getChildren().stream())
+                            .filter(grand -> !Objects.isNull(grand.getStruId()))
+                            .map(StruTreeCacheDTO::getIscOrgId)
+                            .distinct().collect(Collectors.toList());
+                    Optional.of(childrenStruIdList).ifPresent(result::addAll);
+                });
+                break;
+            case CITY:
+                // 2.用户如果是市公司,获取市下级所有区县
+                Optional.ofNullable(struTreeCacheDTO.getChildren()).ifPresent(e -> {
+                    List<String> childrenStruIdList = e.stream().filter(child -> !Objects.isNull(child.getIscOrgId())).map(StruTreeCacheDTO::getIscOrgId)
+                            .distinct().collect(Collectors.toList());
+                    Optional.of(childrenStruIdList).ifPresent(result::addAll);
+                });
+                break;
+            case COUNTY:
+                // 3.用户如果是区县 只查询当前区县
+                result.add(struTreeCacheDTO.getIscOrgId());
+                break;
+            default:
+                log.error("当前组织类型不正确!");
+                throw new BusinessException("当前组织类型不正确!");
+        }
+        return result;
+    }
+
+}
+

+ 21 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/aspect/RequiresCountryPermissions.java

@@ -0,0 +1,21 @@
+package com.hdkj.lt.bf.aspect;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * @author rj
+ * @date 2026/4/1 14:37
+ * @description
+ */
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface RequiresCountryPermissions {
+    String lineFields() default "";
+    //部门对应区县的isc编码
+    String countryFields() default "";
+    //部分接口传的是部门编码
+    String deptCodeFields() default "";
+}

+ 2 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/FhzgFaultPowerCutController.java

@@ -1,6 +1,7 @@
 package com.hdkj.lt.bf.controller;
 
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.entity.FhzgDistCustomer;
 import com.hdkj.lt.bf.entity.dto.FhzgDistCustomerCountDTO;
 import com.hdkj.lt.bf.entity.dto.HasDataTagDTO;
@@ -49,6 +50,7 @@ public class FhzgFaultPowerCutController extends BaseController {
      */
     @PostMapping("/getSchemeList")
     @ApiOperation(value = "获取故障停电方案列表")
+    @RequiresCountryPermissions(deptCodeFields = "countyCode")
     public ApiResponse<Page<FhzgFaultPowerCutVO>> getSchemeList(@RequestBody FaultPowerCut faultPowerCut) {
         return ApiResponse.success(faultPowerCutService.getSchemeList(faultPowerCut));
     }

+ 4 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/FhzgOperationAbnormalityController.java

@@ -1,6 +1,7 @@
 package com.hdkj.lt.bf.controller;
 
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.entity.dto.AbnormalContrastInfoDTO;
 import com.hdkj.lt.bf.entity.dto.FhzgAbnormalityWithVolVO;
 import com.hdkj.lt.bf.entity.dto.OperationAbnormalityQueryDTO;
@@ -46,12 +47,14 @@ public class FhzgOperationAbnormalityController extends BaseController {
      */
     @PostMapping("/getOperationAbnormalityList")
     @ApiOperation(value = "获取运行异常转供列表")
+    @RequiresCountryPermissions(deptCodeFields = "countyCode")
     public ApiResponse<Page<FhzgGridOperationAbnormalityVO>> getOperationAbnormalityList(@ApiParam("查看运行异常转供dto") @RequestBody FhzgGridOperationAbnormalityDTO queryDTO) {
         return ApiResponse.success(fhzgOperationAbnormalityService.getOperationAbnormalityList(queryDTO));
     }
 
     @PostMapping("/getAllOperationAbnormalityList")
     @ApiOperation(value = "获取运行异常转供列表(含成片电压越限)")
+    @RequiresCountryPermissions(deptCodeFields = "countyCode")
     public ApiResponse<Page<FhzgAbnormalityWithVolVO>> getOperationAbnormalityListNew(@ApiParam("查看运行异常转供dto") @RequestBody FhzgGridOperationAbnormalityDTO queryDTO) {
         return ApiResponse.success(fhzgOperationAbnormalityService.getOperationAbnormalityListNew(queryDTO));
     }
@@ -132,6 +135,7 @@ public class FhzgOperationAbnormalityController extends BaseController {
 
     @PostMapping("/getDefaultOverviewSwitch")
     @ApiOperation(value = "通过事件ID查询默认态开关段")
+    @RequiresCountryPermissions(lineFields = "feederId")
     public ApiResponse<List<BreakerAreaVO>> getDefaultOverviewSwitch(@RequestBody OperationAbnormalityQueryDTO request) {
         Boolean assertFlag = ObjectUtils.isNotEmpty(request) && StringUtils.isNotEmpty(request.getFeederId());
         Assert.isTrue(assertFlag, "线路ID不允许为空!");

+ 2 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/FhzgPlanPowerCutController.java

@@ -1,6 +1,7 @@
 package com.hdkj.lt.bf.controller;
 
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.entity.FhzgPlanPowerCut;
 import com.hdkj.lt.bf.entity.dto.CreatePlanPowerCutDTO;
 import com.hdkj.lt.bf.entity.dto.HasDataTagDTO;
@@ -47,6 +48,7 @@ public class FhzgPlanPowerCutController extends BaseController {
      */
     @PostMapping("/getSchemeList")
     @ApiOperation(value = "获取计划停电方案列表")
+    @RequiresCountryPermissions(deptCodeFields = "countyCode")
     public ApiResponse<Page<FhzgPlanPowerCutVO>> getSchemeList(@RequestBody FhzgPlanPowerCut planPowerCut) {
         return ApiResponse.success(planPowerCutService.getSchemeList(planPowerCut));
     }

+ 4 - 1
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/FhzgSvgBreakerController.java

@@ -1,5 +1,6 @@
 package com.hdkj.lt.bf.controller;
 
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.entity.dto.BeakerStatusDTO;
 import com.hdkj.lt.bf.entity.dto.SwitchOrTransformerDTO;
 import com.hdkj.lt.bf.entity.vo.*;
@@ -49,6 +50,7 @@ public class FhzgSvgBreakerController extends BaseController {
 
     @PostMapping("/getBreakerStatusInfoZg")
     @ApiOperation(value = "通过通过线路id查询SVG开关状态信息状估")
+    @RequiresCountryPermissions(lineFields = "linePsrId")
     public ApiResponse<List<BeakerStatusInfoVO>> getBreakerStatusInfoZg(@RequestBody BeakerStatusDTO dto) {
         List<BeakerStatusInfoVO> breakerList = fhzgSvgBreakersService.getBeakerStatusInfoZg(dto);
         return ApiResponse.success(breakerList);
@@ -71,12 +73,12 @@ public class FhzgSvgBreakerController extends BaseController {
 
     @PostMapping("/getBeakerSvgInfoVOByPsrId")
     @ApiOperation(value = "通过通过开关id查询SVG开关状态信息")
+    @RequiresCountryPermissions(lineFields = "linePsrId")
     public ApiResponse<BeakerSvgInfoVO> getBeakerSvgInfoVOByPsrId(@RequestBody BeakerStatusDTO dto) {
         BeakerSvgInfoVO beakerSvgInfoVO = fhzgSvgBreakersService.getBeakerSvgInfoVOByPsrId(dto);
         return ApiResponse.success(beakerSvgInfoVO);
     }
 
-
     @PostMapping("/saveStatusInfoZgList")
     @ApiOperation(value = "批量调用状估接口保存线路pqui数据")
     public ApiResponse<List<BeakerStatusInfoVO>> saveStatusInfoZgList(@RequestBody BeakerStatusDTO dto) {
@@ -94,6 +96,7 @@ public class FhzgSvgBreakerController extends BaseController {
 
     @PostMapping("/getSwitchAndTransformerList")
     @ApiOperation(value = "获取开关配变列表")
+    @RequiresCountryPermissions(lineFields = "feederId")
     public ApiResponse<List<SwitchOrTransformerVO>> getSwitchAndTransformerList(@RequestBody SwitchOrTransformerDTO dto) {
         return ApiResponse.success(fhzgSvgBreakersService.getSwitchAndTransformerList(dto));
     }

+ 2 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/WholeStationPowerCutTempController.java

@@ -2,6 +2,7 @@ package com.hdkj.lt.bf.controller;
 
 import com.alibaba.fastjson.JSON;
 import com.hdkj.lt.base.model.response.PageVO;
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.constants.WholeStationPowerCutConstants;
 import com.hdkj.lt.bf.entity.dto.WholeStationPowerCutReqDTO;
 import com.hdkj.lt.bf.entity.vo.wholestation.*;
@@ -36,6 +37,7 @@ public class WholeStationPowerCutTempController {
      **/
     @PostMapping("/page-list")
     @ApiOperation(value = "故障获取保护定值推荐列表")
+    @RequiresCountryPermissions(deptCodeFields = "countyCode")
     public ApiResponse<PageVO<WholeStationPowerCutVO>> pageList(@RequestBody WholeStationPowerCutReqDTO reqDTO) {
         PageVO<WholeStationPowerCutVO> result = fhzgWholeStationPowerCutTempService.pageList(reqDTO);
         return ApiResponse.success(result);

+ 3 - 0
services/load-transfer-bf/src/main/java/com/hdkj/lt/bf/controller/XlRelController.java

@@ -1,9 +1,11 @@
 package com.hdkj.lt.bf.controller;
 
+import com.hdkj.lt.bf.aspect.RequiresCountryPermissions;
 import com.hdkj.lt.bf.entity.dto.XlRelDTO;
 import com.hdkj.lt.bf.entity.vo.XlRelVO;
 import com.hdkj.lt.bf.service.IXlRelService;
 import com.hdkj.hussar.ApiResponse;
+import com.ruoyi.common.security.annotation.RequiresPermissions;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -36,6 +38,7 @@ public class XlRelController {
      */
     @PostMapping("/getContactSwitchListByFeeder")
     @ApiOperation(value = "根据线路查询联络开关列表")
+    @RequiresCountryPermissions(lineFields = "lineId")
     public ApiResponse<List<XlRelVO>> getContactSwitchListByFeeder(@RequestBody XlRelDTO xlRelDTO) {
         List<XlRelVO> relVOList = xlRelService.getContactSwitchListByFeeder(xlRelDTO);
         return ApiResponse.success(relVOList);