feat:下载接口增加权限校验

adc-da-report/src/main/java/com/adc/da/report/constant/PowerApplyConstants.java

@@ -26,4 +26,9 @@ public class PowerApplyConstants {
      * 下载权限
      */
     public static final Integer DOWNLOAD = 3;
+
+    /**
+     * 总监levelId值 暂定 <=0.5
+     */
+    public static final Double DIRECTOR_LEVEL = 0.5;
 }

adc-da-report/src/main/java/com/adc/da/report/controller/ReportManageConroller.java

@@ -15,6 +15,7 @@ import com.adc.da.report.util.ObsBootUtil;
 import com.adc.da.report.util.WaterMarkUtil;
 import com.adc.da.report.vo.ReportQueryVo;
 import com.adc.da.report.vo.ReportVo;
+import com.adc.da.util.exception.AdcDaBaseException;
 import com.adc.da.util.http.ResponseMessage;
 import com.adc.da.util.http.Result;
 import com.adc.da.util.utils.FileUtil;
@@ -434,6 +435,11 @@ public class ReportManageConroller {
     @GetMapping("/download")
     public void downloadPic(HttpServletResponse response, String fileId,String repostId) throws IOException {
 
+        //校验权限
+        if (!reportService.isAllowDownload(UserUtils.getUserId(), repostId)) {
+            throw new AdcDaBaseException("无此报告下载权限");
+        }
+
         try  {
             FileEntity entity = fileService.getFile(fileId);
             String fileName = entity.getFileName();

adc-da-report/src/main/java/com/adc/da/report/service/IReportService.java

@@ -68,4 +68,12 @@ public interface IReportService {
      * @return
      */
     ResponseMessage reportDetail(String reportId);
+
+    /**
+     * 判断用户是否允许下载指定报告
+     * @param userId 用户id
+     * @param reportId 报告id
+     * @return 是否有下载权限
+     */
+    Boolean isAllowDownload(String userId, String reportId);
 }

adc-da-report/src/main/java/com/adc/da/report/service/impl/IReportServiceImpl.java

@@ -410,7 +410,7 @@ public class IReportServiceImpl extends ServiceImpl<ReportDao, ReportEntity>
         //用户级别
         double level = Double.parseDouble(levelId);
         //总监拥有全部报告的预览和下载权力
-        if (level <= 0.5) {
+        if (level <= DIRECTOR_LEVEL) {
             list.getRecords().forEach(reportVo -> {
                 reportVo.setPower(PREVIEW_DOWNLOAD);
             });
@@ -426,6 +426,10 @@ public class IReportServiceImpl extends ServiceImpl<ReportDao, ReportEntity>
                         reportVo.setPower(NONE);
                     }
                 }
+                //如果上传人是自己也有预览下载权限
+                if (UserUtils.getUserId().equals(reportVo.getCreateUserId())) {
+                    reportVo.setPower(PREVIEW_DOWNLOAD);
+                }
             });
         }
 
@@ -547,6 +551,41 @@ public class IReportServiceImpl extends ServiceImpl<ReportDao, ReportEntity>
         return list;
     }
 
+    @Override
+    public Boolean isAllowDownload(String userId, String reportId) {
+        //校验权限
+        //总监(levelId)
+        UserEO userEo = userEODao.selectById(userId);
+        Double levelId = Double.parseDouble(userEo.getLevelId() == null ? "1.0" : userEo.getLevelId());
+        if (levelId <= DIRECTOR_LEVEL) {
+            return true;
+        }
+        //本人
+        ReportEntity report = getById(reportId);
+        if (userId.equals(report.getCreateUserId())) {
+            return true;
+        }
+        //管理员
+        //判断是不是管理员
+        List<RoleEO> roleEOList = roleEODao.selectByuserId(userId);
+        for (RoleEO roleEO : roleEOList) {
+            if ("管理员".equals(roleEO.getName())){
+                return true;
+            }
+        }
+        //权限申请
+        List<Object> dowonPowerList = new ArrayList<>();
+        dowonPowerList.add(PREVIEW_DOWNLOAD);
+        dowonPowerList.add(DOWNLOAD);
+        List<PowerApply> list = iPowerApplyService.query().eq("user_id", userId)
+                .eq("report_id", reportId)
+                .in("power", dowonPowerList).list();
+        if (CollectionUtils.isNotEmpty(list)) {
+            return true;
+        }
+        return false;
+    }
+
     @Override
     public List<String> isAct(ReportQueryVo vo) {
         boolean flag = false;