CRM 四层数据权限方案

CREATE TABLE `crm_biz_object_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT '主键',
    `biz_type` INT NOT NULL COMMENT '业务对象类型(1线索/2客户/3联系人/4商机/5合同)',
    `biz_type_name` VARCHAR(50) NOT NULL COMMENT '业务对象名称',
    `operation_type` VARCHAR(20) NOT NULL COMMENT '操作类型(CREATE/READ/UPDATE/DELETE/TRANSFER)',
    `operation_name` VARCHAR(50) NOT NULL COMMENT '操作名称',
    `role_id` BIGINT DEFAULT NULL COMMENT '角色ID',
    `post_id` BIGINT DEFAULT NULL COMMENT '岗位ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT '部门ID',
    `user_id` BIGINT DEFAULT NULL COMMENT '用户ID',
    `status` TINYINT DEFAULT 1 COMMENT '状态(0禁用/1启用)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT '创建者',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
    `updater` VARCHAR(64) DEFAULT '' COMMENT '更新者',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT '是否删除',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT '租户编号',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='业务对象操作权限表';

CREATE TABLE `crm_data_scope_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT '主键',
    `biz_type` INT NOT NULL COMMENT '业务对象类型',
    `scope_type` VARCHAR(20) NOT NULL COMMENT '数据范围类型(ALL/SELF/DEPT/DEPT_AND_CHILD/CUSTOM)',
    `scope_value` TEXT COMMENT '自定义范围值(JSON格式)',
    `max_customer_level` INT DEFAULT NULL COMMENT '最大客户等级(NULL=不限制)',
    `role_id` BIGINT DEFAULT NULL COMMENT '角色ID',
    `post_id` BIGINT DEFAULT NULL COMMENT '岗位ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT '部门ID',
    `user_id` BIGINT DEFAULT NULL COMMENT '用户ID',
    `status` TINYINT DEFAULT 1 COMMENT '状态(0禁用/1启用)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT '创建者',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
    `updater` VARCHAR(64) DEFAULT '' COMMENT '更新者',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT '是否删除',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT '租户编号',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='数据权限范围表';

@Service
public class CrmPermissionEngineServiceImpl implements CrmPermissionEngineService {

    @Override
    public boolean hasBizOperationPermission(Long userId, Integer bizType, String operationType) {
        // 按优先级从高到低检查：用户 → 角色 → 岗位 → 部门
        if (hasUserPermission(userId, bizType, operationType)) return true;
        if (hasRolePermission(userId, bizType, operationType)) return true;
        if (hasPostPermission(userId, bizType, operationType)) return true;
        if (hasDeptPermission(userId, bizType, operationType)) return true;
        return false;
    }

    @Override
    public String buildDataScopeSql(Long userId, Integer bizType) {
        DataScopePermissionDO scope = getDataScope(userId, bizType);
        if (scope == null) return "1=0";

        StringBuilder sqlBuilder = new StringBuilder();

        // 数据范围过滤
        switch (scope.getScopeType()) {
            case "ALL": break;
            case "SELF": sqlBuilder.append("owner_user_id = ").append(userId); break;
            case "DEPT": sqlBuilder.append("dept_id = ").append(getUserDeptId(userId)); break;
            case "DEPT_AND_CHILD": sqlBuilder.append("dept_id IN (").append(getUserDeptAndChildIds(userId)).append(")"); break;
            case "CUSTOM": sqlBuilder.append(scope.getScopeValue()); break;
            default: return "1=0";
        }

        // 客户等级过滤（AND 叠加）
        Integer maxLevel = scope.getMaxCustomerLevel();
        if (maxLevel != null) {
            if (sqlBuilder.length() > 0) sqlBuilder.append(" AND ");
            sqlBuilder.append("level <= ").append(maxLevel);
        }

        return sqlBuilder.toString();
    }
}

@Component
@Intercepts({@Signature(type = Executor.class, method = "query",
        args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class})})
public class CrmDataPermissionInterceptor implements Interceptor {

    // 需要通过 customer_id 关联客户表进行等级级联过滤的表
    private static final Set<String> CASCADE_CUSTOMER_LEVEL_TABLES = Set.of(
        "crm_business", "crm_contract", "crm_contact",
        "crm_receivable", "crm_receivable_plan"
    );

    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 1. 判断是否需要数据权限过滤
        // 2. 获取当前用户ID
        // 3. 解析业务类型
        // 4. 构建数据权限过滤条件
        // 5. 修改 SQL，添加 WHERE 过滤条件
        // 6. 执行查询
    }
}