ci: 增加check owner注解

framework/sdk-parent/sdk/src/main/java/io/metersphere/base/mapper/ext/ExtCheckOwnerMapper.java

@@ -0,0 +1,7 @@
+package io.metersphere.base.mapper.ext;
+
+import org.apache.ibatis.annotations.Param;
+
+public interface ExtCheckOwnerMapper {
+    boolean checkoutOwner(@Param("table") String resourceType, @Param("projectId") String projectId, @Param("id") String id);
+}

framework/sdk-parent/sdk/src/main/java/io/metersphere/base/mapper/ext/ExtCheckOwnerMapper.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
+<mapper namespace="io.metersphere.base.mapper.ext.ExtCheckOwnerMapper">
+    <select id="checkoutOwner" resultType="boolean">
+        SELECT 1
+        FROM ${table}
+        WHERE id = #{id}
+          AND project_id = #{projectId}
+    </select>
+</mapper>

framework/sdk-parent/sdk/src/main/java/io/metersphere/security/CheckOwner.java

@@ -0,0 +1,12 @@
+package io.metersphere.security;
+
+import java.lang.annotation.*;
+
+@Target({ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface CheckOwner {
+    String resourceId();
+
+    String resourceType();
+}

framework/sdk-parent/sdk/src/main/java/io/metersphere/security/CheckOwnerAspect.java

@@ -0,0 +1,84 @@
+package io.metersphere.security;
+
+
+import io.metersphere.base.mapper.ext.ExtCheckOwnerMapper;
+import io.metersphere.commons.constants.UserGroupConstants;
+import io.metersphere.commons.exception.MSException;
+import io.metersphere.commons.utils.LogUtil;
+import io.metersphere.commons.utils.SessionUtils;
+import io.metersphere.i18n.Translator;
+import jakarta.annotation.Resource;
+import org.apache.commons.lang3.StringUtils;
+import org.aspectj.lang.JoinPoint;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.aspectj.lang.annotation.Pointcut;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.core.StandardReflectionParameterNameDiscoverer;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.expression.ExpressionParser;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.Method;
+
+
+@Aspect
+@Component
+public class CheckOwnerAspect {
+
+    private ExpressionParser parser = new SpelExpressionParser();
+    private StandardReflectionParameterNameDiscoverer discoverer = new StandardReflectionParameterNameDiscoverer();
+
+    @Resource
+    private ExtCheckOwnerMapper extCheckOwnerMapper;
+
+    @Pointcut("@annotation(io.metersphere.security.CheckOwner)")
+    public void pointcut() {
+    }
+
+    @Before("pointcut()")
+    public void before(JoinPoint joinPoint) {
+        try {
+            //从切面织入点处通过反射机制获取织入点处的方法
+            MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+            //获取切入点所在的方法
+            Method method = signature.getMethod();
+            //获取参数对象数组
+            Object[] args = joinPoint.getArgs();
+            CheckOwner checkOwner = method.getAnnotation(CheckOwner.class);
+            long count = SessionUtils.getUser().getGroups()
+                    .stream()
+                    .filter(g -> StringUtils.equals(g.getId(), UserGroupConstants.SUPER_GROUP))
+                    .count();
+
+            if (count > 0) {
+                return;
+            }
+
+            // 操作内容
+            //获取方法参数名
+            String[] params = discoverer.getParameterNames(method);
+            //将参数纳入Spring管理
+            EvaluationContext context = new StandardEvaluationContext();
+            for (int len = 0; len < params.length; len++) {
+                context.setVariable(params[len], args[len]);
+            }
+
+            String resourceId = checkOwner.resourceId();
+            String resourceType = checkOwner.resourceType();
+            Expression titleExp = parser.parseExpression(resourceId);
+            Object v = titleExp.getValue(context, Object.class);
+            if (v instanceof String id) {
+                if (!extCheckOwnerMapper.checkoutOwner(resourceType, SessionUtils.getCurrentProjectId(), id)) {
+                    MSException.throwException(Translator.get("check_owner_case"));
+                }
+            }
+        } catch (Exception e) {
+            LogUtil.error(e.getMessage(), e);
+        }
+    }
+
+}