sync: 同步 v1.0.4 开源代码并脱敏

internal/library/rolepolicy/template.go

@@ -0,0 +1,151 @@
+package rolepolicy
+
+import (
+	"context"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"git.5iot.com/iotlcm-public/iotlcm-worker-svr/internal/consts"
+	"git.5iot.com/iotlcm-public/iotlcm-worker-svr/internal/dao"
+	"git.5iot.com/iotlcm-public/iotlcm-worker-svr/internal/model/entity"
+	"strconv"
+	"strings"
+)
+
+const TemplateConfigKey = "agent.role.template.role_id"
+
+func Template(ctx context.Context) (*entity.SysRole, error) {
+	var configs []*entity.SysConfig
+	if err := dao.SysConfig.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("config_key", TemplateConfigKey).Scan(&configs); err != nil {
+		return nil, err
+	}
+	if len(configs) == 0 {
+		return nil, nil
+	}
+	if len(configs) != 1 {
+		return nil, gerror.New("代理模板角色系统参数重复")
+	}
+	return ValidateTemplate(ctx, configs[0].ConfigValue)
+}
+
+func ValidateTemplate(ctx context.Context, value string) (*entity.SysRole, error) {
+	roleID, err := strconv.ParseInt(strings.TrimSpace(value), 10, 64)
+	if err != nil || roleID <= 0 || roleID == consts.SuperAdminRoleId {
+		return nil, gerror.New("代理模板参数必须填写非超级管理员的有效角色ID")
+	}
+	var role *entity.SysRole
+	if err = dao.SysRole.Ctx(ctx).Master().Where("role_id", roleID).Where("tenant_id", consts.DefaultSystemTenantCode).Scan(&role); err != nil {
+		return nil, err
+	}
+	if role == nil || role.Status != "0" || (role.CreatedDept > 0 && role.CreatedDept != role.DeptId) || role.DeptId <= 0 {
+		return nil, gerror.New("代理模板参数对应角色须正常启用、绑定本级机构且非上级继承角色")
+	}
+	if role.DataScope != consts.SysRoleDataScopeDeptAndBelow {
+		return nil, gerror.New("代理模板数据范围必须为本机构及下级")
+	}
+	var dept *entity.SysDept
+	if err := dao.SysDept.Ctx(ctx).Master().Where("tenant_id", role.TenantId).Where("dept_id", role.DeptId).Where("status", "0").Scan(&dept); err != nil {
+		return nil, err
+	}
+	if dept == nil {
+		return nil, gerror.New("代理模板所属机构不存在或已停用")
+	}
+	invalidScopes, err := dao.SysRoleMenu.Ctx(ctx).Master().Where("tenant_id", role.TenantId).Where("role_id", role.RoleId).WhereIn("data_scope", []string{consts.SysRoleDataScopeAll, consts.SysRoleDataScopeCustom}).Count()
+	if err != nil {
+		return nil, err
+	}
+	if invalidScopes > 0 {
+		return nil, gerror.New("代理模板按钮不允许全部或自定义数据范围")
+	}
+	return role, nil
+}
+
+func MenuIDs(ctx context.Context, roleID int64) ([]int64, error) {
+	var menus []*entity.SysRoleMenu
+	if err := dao.SysRoleMenu.Ctx(ctx).Master().Where("role_id", roleID).Scan(&menus); err != nil {
+		return nil, err
+	}
+	ids := make([]int64, 0, len(menus))
+	for _, menu := range menus {
+		ids = append(ids, menu.MenuId)
+	}
+	return ids, nil
+}
+
+func Intersect(left, right []int64) []int64 {
+	allowed := make(map[int64]bool, len(right))
+	for _, id := range right {
+		allowed[id] = true
+	}
+	result := make([]int64, 0, len(left))
+	for _, id := range left {
+		if allowed[id] {
+			result = append(result, id)
+		}
+	}
+	return result
+}
+
+func CurrentSuperAdmin(ctx context.Context, userID int64) (bool, error) {
+	if userID <= 0 {
+		return false, nil
+	}
+	var relations []*entity.SysUserRole
+	if err := dao.SysUserRole.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("user_id", userID).Where("role_id", consts.SuperAdminRoleId).Scan(&relations); err != nil {
+		return false, err
+	}
+	if len(relations) == 0 {
+		return false, nil
+	}
+	var role *entity.SysRole
+	if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("role_id", consts.SuperAdminRoleId).Where("status", "0").Scan(&role); err != nil {
+		return false, err
+	}
+	return role != nil, nil
+}
+
+// RestrictMenus validates organization membership and role bindings. Templates are
+// overwrite sources, not runtime permission ceilings: platform role edits must
+// remain effective until the next explicit template distribution.
+func RestrictMenus(ctx context.Context, tenantID string, deptID int64, ids []int64) ([]int64, error) {
+	template, err := Template(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if template == nil {
+		return ids, nil
+	}
+	seen := make(map[int64]bool)
+	for deptID > 0 {
+		if seen[deptID] {
+			return nil, gerror.New("机构上下级存在循环")
+		}
+		seen[deptID] = true
+		var dept *entity.SysDept
+		if err := dao.SysDept.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Scan(&dept); err != nil {
+			return nil, err
+		}
+		if dept == nil || dept.Status != "0" {
+			return []int64{}, nil
+		}
+		if tenantID == template.TenantId && deptID == template.DeptId {
+			break
+		}
+		if dept.DeptRole == consts.SuperAdminRoleId {
+			return nil, gerror.Newf("机构%d不能使用超级管理员角色作为代理权限上限，请核对机构角色绑定", dept.DeptId)
+		}
+		if dept.DeptRole <= 0 {
+			return nil, gerror.Newf("机构%d未关联默认角色，请联系平台管理员核对机构角色绑定", dept.DeptId)
+		}
+		var role *entity.SysRole
+		if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Where("role_id", dept.DeptRole).Where("status", "0").Scan(&role); err != nil {
+			return nil, err
+		}
+		if role == nil {
+			return nil, gerror.Newf("机构%d默认角色不存在、已停用或归属不匹配，请联系平台管理员核对", dept.DeptId)
+		}
+		deptID = dept.ParentId
+	}
+	if tenantID == template.TenantId && !seen[template.DeptId] {
+		return []int64{}, nil
+	}
+	return ids, nil
+}