sync: 同步 v1.0.4 并脱敏配置与镜像

2026-10-29 14:36:49 +08:00
parent 743e8e6e6e
commit 2206a393f7
516 changed files with 18119 additions and 2253 deletions
@@ -42,11 +42,17 @@ func init() {
 }

 func (s *sAgentDept) DeptList(ctx context.Context, in *model.AgentDeptListParam) (list []*model.AgentEnterpriseCustomerModel, total int, err error) {
+	if in == nil {
+		in = &model.AgentDeptListParam{}
+	}
+	in.NormalizePagination()
+	list = make([]*model.AgentEnterpriseCustomerModel, 0)
 	currentDeptId := contexts.GetDeptId(ctx)
 	if currentDeptId == 0 {
 		return nil, 0, gerror.New("当前用户未绑定组织")
 	}
 	m := s.deptModel(ctx).
+		Where(dao.SysDept.Columns().TenantId, contexts.GetTenantId(ctx)).
 		Where(dao.SysDept.Columns().ParentId, currentDeptId).
 		Where(dao.SysDept.Columns().DeptType, 1)
 	if in.DeptName != "" {
@@ -56,14 +62,15 @@ func (s *sAgentDept) DeptList(ctx context.Context, in *model.AgentDeptListParam)
 		m = m.Where(dao.SysDept.Columns().Status, in.Status)
 	}
 	err = m.Order(dao.SysDept.Columns().DeptId, "ASC").
-		Scan(&list)
+		Page(in.Page, in.PageSize).
+		ScanAndCount(&list, &total, false)
 	if err != nil {
 		return nil, 0, err
 	}
 	if err = s.fillEnterpriseDefaultUsers(ctx, list); err != nil {
 		return nil, 0, err
 	}
-	return list, len(list), nil
+	return list, total, nil
 }

 func (s *sAgentDept) DeptView(ctx context.Context, deptId int64) (res *model.AgentEnterpriseCustomerModel, err error) {
@@ -124,63 +131,25 @@ func (s *sAgentDept) DeptSave(ctx context.Context, in *model.AgentDeptSaveParam)
 	return deptId, nil
 }

-// EnsureCurrentDeptDefaultRole upgrades legacy child enterprises that did not
-// receive an inherited administrator role when they were created.
 func (s *sAgentDept) EnsureCurrentDeptDefaultRole(ctx context.Context) error {
-	user := contexts.GetUser(ctx)
-	if user == nil {
+	if contexts.GetUser(ctx) == nil {
 		return gerror.New("登录已过期")
 	}
-	deptId := contexts.GetDeptId(ctx)
-	if deptId == 0 {
+	deptID := contexts.GetDeptId(ctx)
+	if deptID <= 0 {
 		return gerror.New("当前用户未绑定组织")
 	}
-
 	var dept *entity.SysDept
-	if err := s.deptModel(ctx).
-		Where(dao.SysDept.Columns().DeptId, deptId).
-		Scan(&dept); err != nil {
+	if err := s.deptModel(ctx).Where(dao.SysDept.Columns().DeptId, deptID).Scan(&dept); err != nil {
 		return err
 	}
-	if dept == nil || dept.DeptId == 0 {
+	if dept == nil {
 		return gerror.New("组织不存在")
 	}
-	if dept.DeptType != 1 || dept.DeptRole != 0 {
-		return nil
+	if dept.DeptType == 1 && dept.DeptRole <= 0 {
+		return gerror.Newf("机构%d未关联默认角色，请联系平台管理员核对机构角色绑定", deptID)
 	}
-
-	sourceRole, menuIds, err := s.passRoleByDept(ctx, dept.ParentId)
-	if err != nil {
-		return err
-	}
-	return g.DB().Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
-		var current *entity.SysDept
-		if err := tx.Ctx(ctx).Model(dao.SysDept.Table()).
-			Where(dao.SysDept.Columns().DeptId, deptId).
-			Scan(&current); err != nil {
-			return err
-		}
-		if current == nil || current.DeptId == 0 {
-			return gerror.New("组织不存在")
-		}
-		if current.DeptRole != 0 {
-			return nil
-		}
-
-		roleId, err := s.createEnterpriseRole(ctx, tx, user, deptId, sourceRole, menuIds)
-		if err != nil {
-			return err
-		}
-		if err := s.updateDeptRole(ctx, tx, deptId, roleId, user.ID); err != nil {
-			return err
-		}
-		// Keep the legacy role for the active session. After re-login, this role
-		// becomes the department's selected default administrator role.
-		_, err = tx.Ctx(ctx).Model(dao.SysUserRole.Table()).
-			Data(do.SysUserRole{UserId: user.ID, RoleId: roleId}).
-			OmitNil().Insert()
-		return err
-	})
+	return nil
 }

 func (s *sAgentDept) validateEnterpriseSave(ctx context.Context, tenantId string, in *model.AgentDeptSaveParam) error {
@@ -498,7 +467,10 @@ func (s *sAgentDept) passRoleByDept(ctx context.Context, deptId int64) (*entity.
 	if err != nil {
 		return nil, nil, err
 	}
-	if template != nil && contexts.GetTenantId(ctx) == template.TenantId {
+	if template != nil {
+		if contexts.GetTenantId(ctx) != template.TenantId {
+			return nil, nil, gerror.New("当前租户不属于平台代理模板授权范围")
+		}
 		// 配置了平台模板后，下发来源不再依赖 is_pass=1：
 		// 一级代理由平台模板推出，其默认角色是复制来的 is_pass=0 角色；
 		// 各级代理再创建下级时，必须能从本机构默认角色（sys_dept.dept_role）继续传递，
@@ -523,7 +495,7 @@ func (s *sAgentDept) passRoleByDept(ctx context.Context, deptId int64) (*entity.
 			}
 		}
 		var menus []*entity.SysRoleMenu
-		if err := dao.SysRoleMenu.Ctx(ctx).Where("role_id", source.RoleId).Scan(&menus); err != nil {
+		if err := dao.SysRoleMenu.Ctx(ctx).Master().Where("tenant_id", template.TenantId).Where("role_id", source.RoleId).Scan(&menus); err != nil {
 			return nil, nil, err
 		}
 		ids := make([]int64, 0, len(menus))
@@ -690,7 +662,11 @@ func (s *sAgentDept) childDeptAncestors(ctx context.Context, parentId int64) (st
 	if ancestors == "" {
 		ancestors = "0"
 	}
-	return fmt.Sprintf("%s,%d", ancestors, parent.DeptId), nil
+	// ancestors 必须与平台约定格式一致：以本机构结尾并带尾逗号（如 "0,1,172,"）。
+	// 早期实现返回 "0,1,172"（缺尾逗号），而 GetDeptAndSub 按 '%,id,%' 展开
+	// 「本机构及以下」数据权限，缺尾逗号时匹配不到，表现为上级机构看不到下级
+	// （例：一级代理在卡片划拨里选不到下级客户）。
+	return fmt.Sprintf("%s,%d,", ancestors, parent.DeptId), nil
 }

 func (s *sAgentDept) nextCustomerDeptKey(ctx context.Context) (string, error) {
@@ -744,11 +720,68 @@ func (s *sAgentDept) ensureUserNameUnique(ctx context.Context, tenantId, userNam
 }

 func (s *sAgentDept) fillEnterpriseDefaultUsers(ctx context.Context, list []*model.AgentEnterpriseCustomerModel) error {
+	if len(list) == 0 {
+		return nil
+	}
+	var (
+		deptIDs  = make([]int64, 0, len(list))
+		roleIDs  = make([]int64, 0, len(list))
+		bindings []struct {
+			RoleId int64
+			UserId int64
+		}
+		fallbacks []struct {
+			DeptId int64
+			UserId int64
+		}
+	)
 	for _, dept := range list {
-		user, err := s.defaultUserByDept(ctx, dept.DeptId, dept.DeptRole)
-		if err != nil {
+		deptIDs = append(deptIDs, dept.DeptId)
+		if dept.DeptRole > 0 {
+			roleIDs = append(roleIDs, dept.DeptRole)
+		}
+	}
+	tenantID := contexts.GetTenantId(ctx)
+	if len(roleIDs) > 0 {
+		if err := dao.SysUserRole.Ctx(ctx).Where("tenant_id", tenantID).
+			WhereIn("role_id", roleIDs).Fields("role_id", "MIN(user_id) AS user_id").Group("role_id").Scan(&bindings); err != nil {
 			return err
 		}
+	}
+	if err := s.userModel(ctx).Where("tenant_id", tenantID).WhereIn("dept_id", deptIDs).
+		Fields("dept_id", "MIN(user_id) AS user_id").Group("dept_id").Scan(&fallbacks); err != nil {
+		return err
+	}
+	var (
+		roleUsers = make(map[int64]int64, len(bindings))
+		deptUsers = make(map[int64]int64, len(fallbacks))
+		userIDs   = make([]int64, 0, len(bindings)+len(fallbacks))
+		users     []*entity.SysUser
+	)
+	for _, binding := range bindings {
+		roleUsers[binding.RoleId] = binding.UserId
+		userIDs = append(userIDs, binding.UserId)
+	}
+	for _, fallback := range fallbacks {
+		deptUsers[fallback.DeptId] = fallback.UserId
+		userIDs = append(userIDs, fallback.UserId)
+	}
+	if len(userIDs) == 0 {
+		return nil
+	}
+	if err := s.userModel(ctx).Where("tenant_id", tenantID).WhereIn("dept_id", deptIDs).
+		WhereIn("user_id", userIDs).Fields("user_id", "dept_id", "user_name", "nick_name").Scan(&users); err != nil {
+		return err
+	}
+	usersByID := make(map[int64]*entity.SysUser, len(users))
+	for _, user := range users {
+		usersByID[user.UserId] = user
+	}
+	for _, dept := range list {
+		user := usersByID[roleUsers[dept.DeptRole]]
+		if user == nil || user.DeptId != dept.DeptId {
+			user = usersByID[deptUsers[dept.DeptId]]
+		}
 		if user == nil {
 			continue
 		}