Implementing Data Permission Interceptor in MyBatis-Plus Using Annotations

The article demonstrates a solution for adding data‑permission filtering in MyBatis‑Plus by using a custom annotation and an interceptor that modifies the SQL before execution, ensuring that only the required interfaces are intercepted.

Steps to implement:

Create a custom annotation class @interface UserDataPermission {} Implement an interceptor class that extends JsqlParserSupport and implements InnerInterceptor, overriding beforeQuery and processSelect to inject WHERE conditions.

Develop a handler class ( MyDataPermissionHandler) that builds the appropriate SQL segment based on the current user and role.

Register the interceptor in the MyBatis‑Plus plugin configuration.

Basic code examples:

Custom annotation:

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface UserDataPermission {}

Interceptor implementation (simplified):

public class MyDataPermissionInterceptor extends JsqlParserSupport implements InnerInterceptor {
    private MyDataPermissionHandler dataPermissionHandler;
    @Override
    public void beforeQuery(Executor executor, MappedStatement ms, Object parameter, RowBounds rowBounds, ResultHandler resultHandler, BoundSql boundSql) throws SQLException {
        if (InterceptorIgnoreHelper.willIgnoreDataPermission(ms.getId())) return;
        PluginUtils.MPBoundSql mpBs = PluginUtils.mpBoundSql(boundSql);
        mpBs.sql(this.parserSingle(mpBs.sql(), ms.getId()));
    }
    @Override
    protected void processSelect(Select select, int index, String sql, Object obj) {
        // modify SELECT ...
    }
    private void setWhere(PlainSelect plainSelect, String whereSegment) {
        // build where clause
    }
}

Handler example (basic version):

public class MyDataPermissionHandler {
    public Expression getSqlSegment(PlainSelect plainSelect, String whereSegment) {
        // obtain current user, build equality expression on creator_code
    }
}

Registering the interceptor:

@Bean
public MybatisPlusInterceptor mybatisPlusInterceptor() {
    MybatisPlusInterceptor interceptor = new MybatisPlusInterceptor();
    MyDataPermissionInterceptor dataPermissionInterceptor = new MyDataPermissionInterceptor();
    dataPermissionInterceptor.setDataPermissionHandler(new MyDataPermissionHandler());
    interceptor.addInnerInterceptor(dataPermissionInterceptor);
    interceptor.addInnerInterceptor(new PaginationInnerInterceptor(DbType.MYSQL));
    return interceptor;
}

Advanced version adds role‑based scope handling. It defines DataScope and DataPermission enums, retrieves the current user's roles via remote services, and constructs different WHERE clauses (ALL, DEPT, MYSELF) using AndExpression, InExpression, or EqualsTo as appropriate.

Usage: annotate mapper methods with @UserDataPermission to enable automatic data‑permission filtering.

Key reminders:

Ensure the interceptor is added to the MyBatis‑Plus plugin.

The filtering field (e.g., creator_code) must exist in the target tables.