chore: 并入 iotlcm-admin-svr 历史到 admin-svr/（原提交 49818c6）

admin-svr/server/internal/logic/agent/agent_base.go

@@ -0,0 +1,145 @@
+package agent
+
+import (
+	"context"
+	"slices"
+
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/xgorm/handler"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+)
+
+type agentBase struct{}
+
+func newAgentBase() *agentBase {
+	return &agentBase{}
+}
+
+func (s *agentBase) deptModel(ctx context.Context) *gdb.Model {
+	return service.SysDept().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
+}
+
+func (s *agentBase) roleModel(ctx context.Context) *gdb.Model {
+	return service.SysRole().ModelQuery(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
+}
+
+func (s *agentBase) userModel(ctx context.Context) *gdb.Model {
+	return service.SysUser().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
+}
+
+// scopeDeptIds 获取当前登录组织本级及下一级组织的部门ID列表
+func (s *agentBase) scopeDeptIds(ctx context.Context) (deptIds []int64, err error) {
+	currentDeptId := contexts.GetDeptId(ctx)
+	if currentDeptId == 0 {
+		return nil, gerror.New("当前用户未绑定组织")
+	}
+	deptIds = []int64{currentDeptId}
+	var children []*entity.SysDept
+	err = service.SysDept().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false}).
+		Where(dao.SysDept.Columns().ParentId, currentDeptId).
+		Order(dao.SysDept.Columns().OrderNum, "ASC").
+		Scan(&children)
+	if err != nil {
+		return nil, err
+	}
+	for _, dept := range children {
+		deptIds = append(deptIds, dept.DeptId)
+	}
+	slices.Sort(deptIds)
+	return slices.Compact(deptIds), nil
+}
+
+// ensureDeptInScope 确保部门在当前机构的权限范围内
+func (s *agentBase) ensureDeptInScope(ctx context.Context, deptId int64) error {
+	deptIds, err := s.scopeDeptIds(ctx)
+	if err != nil {
+		return err
+	}
+	if !slices.Contains(deptIds, deptId) {
+		return gerror.New("只能操作本级及下一级组织")
+	}
+	return nil
+}
+
+// ensureRoleInScope 确保角色在当前机构的权限范围内
+func (s *agentBase) ensureRoleInScope(ctx context.Context, roleId int64) error {
+	if roleId == 0 {
+		return nil
+	}
+	deptIds, err := s.scopeDeptIds(ctx)
+	if err != nil {
+		return err
+	}
+	count, err := s.roleModel(ctx).
+		Where(dao.SysRole.Columns().RoleId, roleId).
+		WhereIn(dao.SysRole.Columns().DeptId, deptIds).
+		Count()
+	if err != nil {
+		return err
+	}
+	if count == 0 {
+		return gerror.New("只能绑定本级及下一级组织的角色")
+	}
+	return nil
+}
+
+// ensureDeptRoleUnchangedForSelf 确保当前机构的权限未被修改
+func (s *agentBase) ensureDeptRoleUnchangedForSelf(ctx context.Context, deptId, deptRole int64) error {
+	currentDeptId := contexts.GetDeptId(ctx)
+	if deptId == 0 || deptId != currentDeptId {
+		return nil
+	}
+	var dept *entity.SysDept
+	err := s.deptModel(ctx).
+		Where(dao.SysDept.Columns().DeptId, currentDeptId).
+		Scan(&dept)
+	if err != nil {
+		return err
+	}
+	if dept == nil || dept.DeptId == 0 {
+		return gerror.New("组织不存在")
+	}
+	if dept.DeptRole != deptRole {
+		return gerror.New("不能修改本级组织的权限")
+	}
+	return nil
+}
+
+// currentDeptDefaultRoleId 获取当前机构的默认角色ID
+func (s *agentBase) currentDeptDefaultRoleId(ctx context.Context) (int64, error) {
+	currentDeptId := contexts.GetDeptId(ctx)
+	if currentDeptId == 0 {
+		return 0, gerror.New("当前用户未绑定组织")
+	}
+	var dept *entity.SysDept
+	err := s.deptModel(ctx).
+		Where(dao.SysDept.Columns().DeptId, currentDeptId).
+		Scan(&dept)
+	if err != nil {
+		return 0, err
+	}
+	if dept == nil || dept.DeptId == 0 {
+		return 0, gerror.New("组织不存在")
+	}
+	return dept.DeptRole, nil
+}
+
+// ensureRoleNotCurrentDeptDefault 确保角色不是当前机构的默认角色
+func (s *agentBase) ensureRoleNotCurrentDeptDefault(ctx context.Context, roleId int64) error {
+	if roleId == 0 {
+		return nil
+	}
+	defaultRoleId, err := s.currentDeptDefaultRoleId(ctx)
+	if err != nil {
+		return err
+	}
+	if defaultRoleId != 0 && roleId == defaultRoleId {
+		return gerror.New("不能修改本级机构绑定的默认角色权限")
+	}
+	return nil
+}