chore: 并入 iotlcm-admin-svr 历史到 admin-svr/（原提交 49818c6）

admin-svr/server/internal/library/rolepolicy/assignment.go

@@ -0,0 +1,54 @@
+package rolepolicy
+
+import (
+	"context"
+	"slices"
+
+	"github.com/gogf/gf/v2/errors/gerror"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
+)
+
+// ValidateUserRoleAssignment prevents local operators from obtaining platform-only
+// permissions by binding a more privileged role instead of editing its menus.
+// Existing bindings may be retained when editing unrelated user information.
+func ValidateUserRoleAssignment(ctx context.Context, tenantID string, deptID int64, requested, existing []int64) error {
+	if contexts.IsSuperAdmin(ctx) {
+		return nil
+	}
+	template, err := Template(ctx)
+	if err != nil {
+		return err
+	}
+	if template == nil || tenantID != template.TenantId {
+		return nil
+	}
+	if contexts.GetTenantId(ctx) != tenantID {
+		return gerror.New("不能跨租户分配角色")
+	}
+	for _, roleID := range requested {
+		if roleID == consts.SuperAdminRoleId {
+			return gerror.New("不能分配平台超级管理员角色")
+		}
+		if slices.Contains(existing, roleID) {
+			continue
+		}
+		var role *entity.SysRole
+		if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Where("role_id", roleID).Where("status", "0").Scan(&role); err != nil {
+			return err
+		}
+		if role == nil {
+			return gerror.Newf("角色%d不存在、已停用或不属于用户所在机构", roleID)
+		}
+		menus, err := MenuIDs(ctx, roleID)
+		if err != nil {
+			return err
+		}
+		if _, err := NormalizeAssignableMenus(ctx, tenantID, contexts.GetDeptId(ctx), contexts.GetUserId(ctx), menus); err != nil {
+			return gerror.Wrapf(err, "角色%d包含超出当前账号可分配范围的权限，请联系平台管理员绑定", roleID)
+		}
+	}
+	return nil
+}