ocr增加创建者权限校验

jero-boot/jero-boot-modules/src/main/java/com/jero/modules/ocr/controller/OcrRecordEOController.java

@@ -2,12 +2,14 @@ package com.jero.modules.ocr.controller;
 
 import cn.hutool.core.collection.CollectionUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.jero.common.api.vo.Result;
 import com.jero.common.aspect.annotation.AutoLog;
 import com.jero.common.constant.enums.CutEnum;
 import com.jero.common.system.base.controller.JeroController;
+import com.jero.common.system.vo.LoginUser;
 import com.jero.modules.document.service.IBussDocumentLibraryEOService;
 import com.jero.modules.ocr.entity.OcrRecordEO;
 import com.jero.modules.ocr.enums.FileSyncStateEnum;
@@ -19,6 +21,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang.StringUtils;
+import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
@@ -30,6 +33,7 @@ import javax.servlet.http.HttpServletResponse;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 
 
 /**
@@ -61,6 +65,10 @@ public class OcrRecordEOController extends JeroController<OcrRecordEO, IOcrRecor
 	@PostMapping(value = "/page")
 	@RequiresPermissions("ocr:ocrRecord:page")
 	public Result<?> queryPageList(@RequestBody OcrRecordEOPage ocrRecordEOPage) {
+		//查询创建者为当前用户的数据
+		LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String loginUser = sysUser.getUsername();
+
 		LambdaQueryWrapper<OcrRecordEO> queryWrapper = new LambdaQueryWrapper<>();
 		if (StringUtils.isNotEmpty(ocrRecordEOPage.getStandNumber())) {
 			ocrRecordEOPage.setStandNumber(ocrRecordEOPage.getStandNumber().replace("%","\\%"));
@@ -70,6 +78,7 @@ public class OcrRecordEOController extends JeroController<OcrRecordEO, IOcrRecor
 				.like(StringUtils.isNotEmpty(ocrRecordEOPage.getStandName()) && CutEnum.EN.getValue().equals(ocrRecordEOPage.getCut()), OcrRecordEO::getStandNameEn, ocrRecordEOPage.getStandName())
 				.like(StringUtils.isNotEmpty(ocrRecordEOPage.getStandNumber()), OcrRecordEO::getStandNumber, ocrRecordEOPage.getStandNumber())
 				.eq(StringUtils.isNotEmpty(ocrRecordEOPage.getResultContent()), OcrRecordEO::getResultContent, ocrRecordEOPage.getResultContent())
+				.eq(OcrRecordEO::getCreateBy,loginUser)
 				.orderBy(StringUtils.isNotBlank(ocrRecordEOPage.getOrderByField()), "1".equals(ocrRecordEOPage.getOrderBy())?true:false, OcrRecordEO::getUpdateTime)
 				.orderByDesc(OcrRecordEO::getCreateTime);
 		Page<OcrRecordEO> page = new Page<OcrRecordEO>(ocrRecordEOPage.getPageNo(), ocrRecordEOPage.getPageSize());
@@ -234,13 +243,31 @@ public class OcrRecordEOController extends JeroController<OcrRecordEO, IOcrRecor
 	@ApiOperation(value="OCR识别转换记录表-通过id删除", notes="OCR识别转换记录表-通过id删除")
 	@GetMapping(value = "/delete")
 	@RequiresPermissions("ocr:ocrRecord:delete")
-	public Result<?> delete(@RequestParam(name="id",required=true) String id) {
+	public Result<?> delete(@RequestParam(name="id",required=true) String id,
+							@RequestParam(name="cut",required=true) String cut) {
 		if (StringUtils.isBlank(id)) {
 			return Result.error("删除数据不能为空");
 		}
+
+		//增加创建者校验
+		LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String loginUser = sysUser.getUsername();
+		QueryWrapper<OcrRecordEO> ocrRecordEOQueryWrapper = new QueryWrapper<>();
+		ocrRecordEOQueryWrapper.eq("id",id);
+		String ocrRecordEOCreateBy = ocrRecordService.list(ocrRecordEOQueryWrapper).stream().map(e -> e.getCreateBy()).collect(Collectors.toList()).get(0);
+		if (loginUser.equals(ocrRecordEOCreateBy)) {
 			ocrRecordService.deleteById(id);
+
 			//TODO 删除上传的pdf文件，转换成功的将doc文件一并删除
 			return Result.OK("删除成功!");
+
+		}else {
+			if (CutEnum.CN.getValue().equals(cut)) {
+				return Result.error("当前用户非创建者,无法下载");
+			}else{
+				return Result.error("The current user is not the creator and cannot be downloaded.");
+			}
+		}
 	}
 
 	/**

jero-boot/jero-boot-modules/src/main/java/com/jero/modules/ocr/controller/OcrRestfulController.java

@@ -1,9 +1,11 @@
 package com.jero.modules.ocr.controller;
 
 import cn.hutool.core.util.ObjectUtil;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.jero.common.api.vo.Result;
 import com.jero.common.constant.enums.CutEnum;
 import com.jero.common.exception.JeroBootException;
+import com.jero.common.system.vo.LoginUser;
 import com.jero.modules.ocr.entity.OcrRecordEO;
 import com.jero.modules.ocr.enums.ResultContentEnum;
 import com.jero.modules.ocr.service.IOcrRecordEOService;
@@ -17,6 +19,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang.StringUtils;
 import org.apache.http.entity.ContentType;
+import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -29,6 +32,7 @@ import javax.servlet.http.HttpServletResponse;
 import java.io.*;
 import java.text.SimpleDateFormat;
 import java.util.Date;
+import java.util.stream.Collectors;
 
 /**
  * @program: OcrDemo
@@ -67,7 +71,14 @@ public class OcrRestfulController{
     @ApiOperation(value = "下载word文件")
     @GetMapping("/downFile")
     @RequiresPermissions("ocr:ocrRestful:downFile")
-    public void downFile(String fileName, HttpServletResponse response, HttpServletRequest request) throws Exception {
+    public void downFile(String fileName, HttpServletResponse response, HttpServletRequest request,String cut) throws Exception {
+       //增加创建者校验
+        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+        String loginUser = sysUser.getUsername();
+        QueryWrapper<OcrRecordEO> ocrRecordEOQueryWrapper = new QueryWrapper<>();
+        ocrRecordEOQueryWrapper.eq("doc_real_name",fileName);
+        String ocrRecordEOCreateBy = ocrRecordEOService.list(ocrRecordEOQueryWrapper).stream().map(e -> e.getCreateBy()).collect(Collectors.toList()).get(0);
+        if (loginUser.equals(ocrRecordEOCreateBy)) {
             InputStream is = null;
             OutputStream os = null;
             response.reset();
@@ -89,6 +100,13 @@ public class OcrRestfulController{
                 is.close();
                 os.close();
             }
+        }else{
+            if (CutEnum.CN.getValue().equals(cut)) {
+                throw new JeroBootException("当前用户非创建者,无法下载");
+            }else{
+                throw new JeroBootException("The current user is not the creator and cannot be downloaded.");
+            }
+        }
     }
 
     /**