多租户数据隔离解决方案

一、背景
saas环境下,会采用不用的数据存储方案，主要分为以下三种。
1.完全的数据隔离
即一个租户，一套数据库系统。优点：完全隔离，数据无任何交叉，缺点：可想而知，成本高。

2.同一个数据库系统，不同schema（oracle中的表空间概念）
即在同一个数据库系统下，建立不同的schema，oracle下为不同表空间，mysql即不同数据库。个人在曾经的项目多租户短信平台里面，见识过这种解决方案。优点：数据隔离程度较高，缺点：维护成本较高，涉及到跨租户的数据相关需求时，难以实现。

3.同一个数据库系统，同一个schema
即多租户数据在同一个数据库下，使用数据隔离字段进行标识，如corp_code。优点：数据集中，方便统计查询，缺点：无隔离，数据crud存在困难，例如查询时，都需要将corp_code值作为参数传递到数据库查询中。

二、如何解决在同一个schema多租户情况下，数据隔离问题
1.本人项目持久层采用mybatis框架，也是目前最流行的持久层框架之一，本方案只在mybatis框架基础上进行实现，其他框架，可以参考思想。废话不多说（开始上代码）。

此工程作为单独的工程，作为jar包被其他工程所引用，创建META-INF/spring.factories
将工程纳入到spring开发环境中，与业务工程实现解耦。

# Auto Configure
org.springframework.boot.autoconfigure.EnableAutoConfiguration=com.example.core.data.isolation.config.DataIsolationConfiguration

二、自定义mybatis拦截器
自定义mybatis拦截器，将获取到的sl进行修改，添加对应的隔离字段和隔离值，如
where 1=1 and corp_code = ‘1222’。实现如下：

1.创建配置对象，从对应的工程中读取配置信息，主要配置信息如下：
数据库方言，数据库需要进行隔离的表集合，隔离字段。

@Data
@Component
@ConfigurationProperties(prefix = "data-isolation")
@RefreshScope
public class DataIsolationProperties {
    /**
	 * 数据隔离方言
	 */
	private String dialect = JdbcConstants.MYSQL;

    /**
	 * 数据隔离表集合
	 */
	private List<String> tableNames = Arrays.asList("uc_staff", "uc_dept", "uc_sys_role");

    /**
	 * 数据隔离字段
	 */
	private String tenantIdField = "org_id";

}

2.自定义拦截器

package com.example.core.data.isolation.interceptor;

import cn.hutool.core.util.ReflectUtil;
import cn.hutool.core.util.StrUtil;
import com.alibaba.druid.sql.SQLUtils;
import com.alibaba.druid.sql.ast.SQLStatement;
import com.example.core.data.isolation.model.AuthUser;
import com.example.core.data.isolation.utils.ITableFieldConditionDecision;
import com.example.core.data.isolation.utils.SqlConditionHelper;
import com.example.framework.common.utils.LogUtil;
import org.apache.commons.lang.StringUtils;
import org.apache.ibatis.executor.statement.StatementHandler;
import org.apache.ibatis.mapping.BoundSql;
import org.apache.ibatis.plugin.*;
import org.slf4j.Logger;

import java.sql.Connection;
import java.util.Arrays;
import java.util.List;
import java.util.Properties;

/**
 * 多租户数据隔离
 *
 * @author 
 */
@Intercepts({
	@Signature(type = StatementHandler.class,
		method = "prepare",
		args = {Connection.class, Integer.class})})
public class DataIsolationInterceptor implements Interceptor {

	private Logger log = LogUtil.getLogger(DataIsolationInterceptor.class);

	/**
	 * 数据隔离方言
	 */
	private String dialect;

	/**
	 * 数据隔离表集合
	 */
	private List<String> tableNames;

	/**
	 * 数据隔离字段
	 */
	private String tenantIdField;

	/**
	 * 数据隔离辅助类
	 */
	private SqlConditionHelper conditionHelper;


	@Override
	public Object intercept(Invocation invocation) throws Throwable {
		AuthUser authUser = AuthUser.getUser();
		if (authUser == null) {
			return invocation.proceed();
		}
		StatementHandler statementHandler = (StatementHandler) invocation.getTarget();
		BoundSql boundSql = statementHandler.getBoundSql();

		String originalSql = boundSql.getSql();


		// 数据隔离
		String originalSql2 = addTenantCondition(originalSql, authUser.getCurrentOrgId());

		log.info("数据隔离之前sql :{}", originalSql);
		log.info("数据隔离之后sql :{}", originalSql2);


		ReflectUtil.setFieldValue(boundSql, "sql", originalSql2);
		return invocation.proceed();
	}

	@Override
	public Object plugin(Object target) {
		return Plugin.wrap(target, this);
	}

	@Override
	public void setProperties(Properties properties) {

		dialect = properties.getProperty("dialect");
		tableNames = Arrays.asList(properties.getProperty("tableNames").split(StrUtil.COMMA));
		tenantIdField = properties.getProperty("tenantIdField");

		/**
		 * 多租户条件字段决策器
		 */
		ITableFieldConditionDecision conditionDecision = new ITableFieldConditionDecision() {
			@Override
			public boolean isAllowNullValue() {
				return false;
			}

			@Override
			public boolean adjudge(String tableName, String fieldName) {
				if (tableNames != null && tableNames.contains(tableName)) return true;
				return false;
			}
		};
		conditionHelper = new SqlConditionHelper(conditionDecision);
	}

	/**
	 * 给sql语句where添加租户id过滤条件
	 *
	 * @param sql      要添加过滤条件的sql语句
	 * @param tenantId 当前的租户id
	 * @return 添加条件后的sql语句
	 */
	private String addTenantCondition(String sql, String tenantId) {
		if (StringUtils.isBlank(sql) || StringUtils.isBlank(tenantId))
			return sql;
		List<SQLStatement> statementList = SQLUtils.parseStatements(sql, dialect);

		if (statementList == null || statementList.size() == 0)
			return sql;

		SQLStatement sqlStatement = statementList.get(0);

		conditionHelper.addStatementCondition(sqlStatement, tenantIdField, tenantId);

		return SQLUtils.toSQLString(statementList, dialect);
	}

}

3.自定义条件判断接口

/**
 * 数据隔离决策接口
 * @author 
 * @create 2020-06-02
 **/
public interface ITableFieldConditionDecision {

	/**
	 * 条件字段是否运行null值
	 * @return
	 */
	boolean isAllowNullValue();
	/**
	 * 判决某个表是否需要添加某个字段过滤
	 *
	 * @param tableName   表名称
	 * @param fieldName   字段名称
	 * @return
	 */
	boolean adjudge(String tableName, String fieldName);
}

4.sql处理器

/**
 * @Description sql语句where条件处理辅助类
 * @Author 
 * @Date 2020/6/2 8:32
 * @Version v1.0-SNAPSHOT
 **/
public class SqlConditionHelper {

	private ITableFieldConditionDecision conditionDecision;

	public SqlConditionHelper(ITableFieldConditionDecision conditionDecision) {
		this.conditionDecision = conditionDecision;
	}

	/**
	 * 为sql'语句添加指定where条件
	 *
	 * @param sqlStatement
	 * @param fieldName
	 * @param fieldValue
	 */
	public void addStatementCondition(SQLStatement sqlStatement, String fieldName, String fieldValue) {
		if (sqlStatement instanceof SQLSelectStatement) {
			SQLSelectQueryBlock queryObject = (SQLSelectQueryBlock) ((SQLSelectStatement) sqlStatement).getSelect().getQuery();
			addSelectStatementCondition(queryObject, queryObject.getFrom(), fieldName, fieldValue);
		} else if (sqlStatement instanceof SQLUpdateStatement) {
			SQLUpdateStatement updateStatement = (SQLUpdateStatement) sqlStatement;
			addUpdateStatementCondition(updateStatement, fieldName, fieldValue);
		} else if (sqlStatement instanceof SQLDeleteStatement) {
			SQLDeleteStatement deleteStatement = (SQLDeleteStatement) sqlStatement;
			addDeleteStatementCondition(deleteStatement, fieldName, fieldValue);
		} else if (sqlStatement instanceof SQLInsertStatement) {
			SQLInsertStatement insertStatement = (SQLInsertStatement) sqlStatement;
			addInsertStatementCondition(insertStatement, fieldName, fieldValue);
		}
	}

	/**
	 * 为insert语句添加where条件
	 *
	 * @param insertStatement
	 * @param fieldName
	 * @param fieldValue
	 */
	private void addInsertStatementCondition(SQLInsertStatement insertStatement, String fieldName, String fieldValue) {
		if (insertStatement != null) {
			SQLInsertInto sqlInsertInto = insertStatement;
			SQLSelect sqlSelect = sqlInsertInto.getQuery();
			if (sqlSelect != null) {
				SQLSelectQueryBlock selectQueryBlock = (SQLSelectQueryBlock) sqlSelect.getQuery();
				addSelectStatementCondition(selectQueryBlock, selectQueryBlock.getFrom(), fieldName, fieldValue);
			}
		}
	}


	/**
	 * 为delete语句添加where条件
	 *
	 * @param deleteStatement
	 * @param fieldName
	 * @param fieldValue
	 */
	private void addDeleteStatementCondition(SQLDeleteStatement deleteStatement, String fieldName, String fieldValue) {
		SQLExpr where = deleteStatement.getWhere();
		//添加子查询中的where条件
		addSQLExprCondition(where, fieldName, fieldValue);

		SQLExpr newCondition = newEqualityCondition(deleteStatement.getTableName().getSimpleName(),
			deleteStatement.getTableSource().getAlias(), fieldName, fieldValue, where);
		deleteStatement.setWhere(newCondition);

	}

	/**
	 * where中添加指定筛选条件
	 *
	 * @param where      源where条件
	 * @param fieldName
	 * @param fieldValue
	 */
	private void addSQLExprCondition(SQLExpr where, String fieldName, String fieldValue) {
		if (where instanceof SQLInSubQueryExpr) {
			SQLInSubQueryExpr inWhere = (SQLInSubQueryExpr) where;
			SQLSelect subSelectObject = inWhere.getSubQuery();
			SQLSelectQueryBlock subQueryObject = (SQLSelectQueryBlock) subSelectObject.getQuery();
			addSelectStatementCondition(subQueryObject, subQueryObject.getFrom(), fieldName, fieldValue);
		} else if (where instanceof SQLBinaryOpExpr) {
			SQLBinaryOpExpr opExpr = (SQLBinaryOpExpr) where;
			SQLExpr left = opExpr.getLeft();
			SQLExpr right = opExpr.getRight();
			addSQLExprCondition(left, fieldName, fieldValue);
			addSQLExprCondition(right, fieldName, fieldValue);
		} else if (where instanceof SQLQueryExpr) {
			SQLSelectQueryBlock selectQueryBlock = (SQLSelectQueryBlock) (((SQLQueryExpr) where).getSubQuery()).getQuery();
			addSelectStatementCondition(selectQueryBlock, selectQueryBlock.getFrom(), fieldName, fieldValue);
		}
	}

	/**
	 * 为update语句添加where条件
	 *
	 * @param updateStatement
	 * @param fieldName
	 * @param fieldValue
	 */
	private void addUpdateStatementCondition(SQLUpdateStatement updateStatement, String fieldName, String fieldValue) {
		SQLExpr where = updateStatement.getWhere();
		//添加子查询中的where条件
		addSQLExprCondition(where, fieldName, fieldValue);
		SQLExpr newCondition = newEqualityCondition(updateStatement.getTableName().getSimpleName(),
			updateStatement.getTableSource().getAlias(), fieldName, fieldValue, where);
		updateStatement.setWhere(newCondition);
	}

	/**
	 * 给一个查询对象添加一个where条件
	 *
	 * @param queryObject
	 * @param fieldName
	 * @param fieldValue
	 */
	private void addSelectStatementCondition(SQLSelectQueryBlock queryObject, SQLTableSource from, String fieldName, String fieldValue) {
		if (StringUtils.isBlank(fieldName) || from == null || queryObject == null) return;

		SQLExpr originCondition = queryObject.getWhere();
		if (from instanceof SQLExprTableSource) {
			String tableName = ((SQLIdentifierExpr) ((SQLExprTableSource) from).getExpr()).getName();
			String alias = from.getAlias();
			SQLExpr newCondition = newEqualityCondition(tableName, alias, fieldName, fieldValue, originCondition);
			queryObject.setWhere(newCondition);
		} else if (from instanceof SQLJoinTableSource) {
			SQLJoinTableSource joinObject = (SQLJoinTableSource) from;
			SQLTableSource left = joinObject.getLeft();
			SQLTableSource right = joinObject.getRight();

			addSelectStatementCondition(queryObject, left, fieldName, fieldValue);
//			addSelectStatementCondition(queryObject, right, fieldName, fieldValue);
			addRightJoinSelectStatementCondition(joinObject, right, fieldName, fieldValue);
		} else if (from instanceof SQLSubqueryTableSource) {
			SQLSelect subSelectObject = ((SQLSubqueryTableSource) from).getSelect();
			SQLSelectQueryBlock subQueryObject = (SQLSelectQueryBlock) subSelectObject.getQuery();
			addSelectStatementCondition(subQueryObject, subQueryObject.getFrom(), fieldName, fieldValue);
		} else if (from instanceof SQLUnionQueryTableSource) {
			List<SQLSelectQuery> relations = ((SQLUnionQueryTableSource) from).getUnion().getRelations();
			relations.forEach(sqlSelectQuery -> {
				SQLSelectQueryBlock sqlSelectQueryBlock = (SQLSelectQueryBlock) sqlSelectQuery;
				addSelectStatementCondition(sqlSelectQueryBlock, sqlSelectQueryBlock.getFrom(), fieldName, fieldValue);

			});
		} else {
			throw new NotImplementedException("数据隔离未处理异常");
		}
	}

	/**
	 *
	 * @Description: left join 添加数据条件
	 * @Author: yaorun
	 * @Param:
	 * @Date: 2020/6/4 10:19
	 */
	private void addRightJoinSelectStatementCondition(SQLJoinTableSource joinObject, SQLTableSource right, String fieldName, String fieldValue) {
		SQLExpr condition = joinObject.getCondition();

		String tableName = ((SQLIdentifierExpr) ((SQLExprTableSource) right).getExpr()).getName();

		String alias = right.getAlias();

		SQLExpr newCondition = newEqualityCondition(tableName, alias, fieldName, fieldValue, condition);

		joinObject.setCondition(newCondition);
	}



	/**
	 * 根据原来的condition创建一个新的condition
	 *
	 * @param tableName       表名称
	 * @param tableAlias      表别名
	 * @param fieldName
	 * @param fieldValue
	 * @param originCondition
	 * @return
	 */
	private SQLExpr newEqualityCondition(String tableName, String tableAlias, String fieldName, String fieldValue, SQLExpr originCondition) {
		//如果不需要设置条件
		if (!conditionDecision.adjudge(tableName, fieldName)) return originCondition;
		//如果条件字段不允许为空
		if (fieldValue == null && !conditionDecision.isAllowNullValue()) return originCondition;

		String filedName = StringUtils.isBlank(tableAlias) ? fieldName : tableAlias + "." + fieldName;
		SQLExpr condition = new SQLBinaryOpExpr(new SQLIdentifierExpr(filedName), new SQLCharExpr(fieldValue), SQLBinaryOperator.Equality);
		return SQLUtils.buildCondition(SQLBinaryOperator.BooleanAnd, condition, false, originCondition);
	}




}

5.用户信息获取

@Data
public class AuthUser {
	private String userId;
	private String userName;
	private String currentOrgId;
	private String authId;
	private String oldToken;
	private String orgIds;
	private String staffIds;
	private String currentStaffId;
	private String deptId;
	private Boolean isSuperAdmin;
	private String menu;

	public static AuthUser getUser() {
		try {
			String userId = ContextHandler.getUserId();
			String userName = ContextHandler.getUsername();
			Map<String, Object> result = ContextHandler.getAll();
			AuthUser authUser = new AuthUser();
			authUser.setUserId(userId);
			authUser.setUserName(userName);
			authUser.setCurrentOrgId(Convert.toStr(result.get(ContextConstants.CONTEXT_CURRENT_ORG_ID)));
			authUser.setCurrentStaffId(Convert.toStr(result.get(ContextConstants.CONTEXT_CURRENT_STAFF_ID)));
			authUser.setAuthId(Convert.toStr(result.get(ContextConstants.CONTEXT_AUTH_ID)));
			authUser.setOldToken(Convert.toStr(result.get(ContextConstants.CONTEXT_KEY_OLD_TOKEN)));
			authUser.setOrgIds(Convert.toStr(result.get(ContextConstants.CONTEXT_ORG_IDS)));
			authUser.setStaffIds(Convert.toStr(result.get(ContextConstants.CONTEXT_STAFF_IDS)));
			authUser.setDeptId(Convert.toStr(result.get(ContextConstants.DEPT_ID)));
			authUser.setIsSuperAdmin(false);
			authUser.setMenu(Convert.toStr(result.get(ContextConstants.MENU)));
			return authUser;
		} catch (Exception e) {
			e.printStackTrace();
			return null;
		}
	}

}