MiFaZhan
243 lines
8.3 KiB
Go
243 lines
8.3 KiB
Go
package rolepolicy
|
|
|
|
import (
|
|
"context"
|
|
"github.com/gogf/gf/v2/errors/gerror"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
const TemplateConfigKey = "agent.role.template.role_id"
|
|
|
|
func TemplateForRoles(ctx context.Context, roleIDs ...int64) (*entity.SysRole, error) {
|
|
var configs []*entity.SysConfig
|
|
if err := dao.SysConfig.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("config_key", TemplateConfigKey).Scan(&configs); err != nil {
|
|
return nil, err
|
|
}
|
|
for _, config := range configs {
|
|
roleID, err := strconv.ParseInt(strings.TrimSpace(config.ConfigValue), 10, 64)
|
|
if err != nil || roleID <= 0 {
|
|
continue
|
|
}
|
|
for _, targetID := range roleIDs {
|
|
if targetID != roleID {
|
|
continue
|
|
}
|
|
if len(configs) != 1 {
|
|
return nil, gerror.New("代理模板角色系统参数重复")
|
|
}
|
|
var role *entity.SysRole
|
|
if err := dao.SysRole.Ctx(ctx).Master().Where("role_id", roleID).Where("tenant_id", consts.DefaultSystemTenantCode).Scan(&role); err != nil {
|
|
return nil, err
|
|
}
|
|
if role == nil {
|
|
role = &entity.SysRole{RoleId: roleID, TenantId: consts.DefaultSystemTenantCode}
|
|
}
|
|
return role, nil
|
|
}
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func Template(ctx context.Context) (*entity.SysRole, error) {
|
|
var configs []*entity.SysConfig
|
|
if err := dao.SysConfig.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("config_key", TemplateConfigKey).Scan(&configs); err != nil {
|
|
return nil, err
|
|
}
|
|
if len(configs) == 0 {
|
|
return nil, nil
|
|
}
|
|
if len(configs) != 1 {
|
|
return nil, gerror.New("代理模板角色系统参数重复")
|
|
}
|
|
return ValidateTemplate(ctx, configs[0].ConfigValue)
|
|
}
|
|
|
|
func ValidateTemplate(ctx context.Context, value string) (*entity.SysRole, error) {
|
|
roleID, err := strconv.ParseInt(strings.TrimSpace(value), 10, 64)
|
|
if err != nil || roleID <= 0 || roleID == consts.SuperAdminRoleId {
|
|
return nil, gerror.New("代理模板参数必须填写非超级管理员的有效角色ID")
|
|
}
|
|
var role *entity.SysRole
|
|
if err = dao.SysRole.Ctx(ctx).Master().Where("role_id", roleID).Where("tenant_id", consts.DefaultSystemTenantCode).Scan(&role); err != nil {
|
|
return nil, err
|
|
}
|
|
if role == nil || role.Status != "0" || (role.CreatedDept > 0 && role.CreatedDept != role.DeptId) || role.DeptId <= 0 {
|
|
return nil, gerror.New("代理模板参数对应角色须正常启用、绑定本级机构且非上级继承角色")
|
|
}
|
|
if role.DataScope != consts.SysRoleDataScopeDeptAndBelow {
|
|
return nil, gerror.New("代理模板数据范围必须为本机构及下级")
|
|
}
|
|
var dept *entity.SysDept
|
|
if err := dao.SysDept.Ctx(ctx).Master().Where("tenant_id", role.TenantId).Where("dept_id", role.DeptId).Where("status", "0").Scan(&dept); err != nil {
|
|
return nil, err
|
|
}
|
|
if dept == nil {
|
|
return nil, gerror.New("代理模板所属机构不存在或已停用")
|
|
}
|
|
invalidScopes, err := dao.SysRoleMenu.Ctx(ctx).Master().Where("tenant_id", role.TenantId).Where("role_id", role.RoleId).WhereIn("data_scope", []string{consts.SysRoleDataScopeAll, consts.SysRoleDataScopeCustom}).Count()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if invalidScopes > 0 {
|
|
return nil, gerror.New("代理模板按钮不允许全部或自定义数据范围")
|
|
}
|
|
return role, nil
|
|
}
|
|
|
|
func MenuIDs(ctx context.Context, roleID int64) ([]int64, error) {
|
|
var menus []*entity.SysRoleMenu
|
|
if err := dao.SysRoleMenu.Ctx(ctx).Master().Where("role_id", roleID).Scan(&menus); err != nil {
|
|
return nil, err
|
|
}
|
|
ids := make([]int64, 0, len(menus))
|
|
for _, menu := range menus {
|
|
ids = append(ids, menu.MenuId)
|
|
}
|
|
return ids, nil
|
|
}
|
|
|
|
func Intersect(left, right []int64) []int64 {
|
|
allowed := make(map[int64]bool, len(right))
|
|
for _, id := range right {
|
|
allowed[id] = true
|
|
}
|
|
result := make([]int64, 0, len(left))
|
|
for _, id := range left {
|
|
if allowed[id] {
|
|
result = append(result, id)
|
|
}
|
|
}
|
|
return result
|
|
}
|
|
|
|
func CurrentSuperAdmin(ctx context.Context, userID int64) (bool, error) {
|
|
if userID <= 0 {
|
|
return false, nil
|
|
}
|
|
var relations []*entity.SysUserRole
|
|
if err := dao.SysUserRole.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("user_id", userID).Where("role_id", consts.SuperAdminRoleId).Scan(&relations); err != nil {
|
|
return false, err
|
|
}
|
|
if len(relations) == 0 {
|
|
return false, nil
|
|
}
|
|
var role *entity.SysRole
|
|
if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", consts.DefaultSystemTenantCode).Where("role_id", consts.SuperAdminRoleId).Where("status", "0").Scan(&role); err != nil {
|
|
return false, err
|
|
}
|
|
return role != nil, nil
|
|
}
|
|
|
|
// RestrictMenus validates organization membership and role bindings. Templates are
|
|
// overwrite sources, not runtime permission ceilings: platform role edits must
|
|
// remain effective until the next explicit template distribution.
|
|
func RestrictMenus(ctx context.Context, tenantID string, deptID int64, ids []int64) ([]int64, error) {
|
|
template, err := Template(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if template == nil {
|
|
return ids, nil
|
|
}
|
|
seen := make(map[int64]bool)
|
|
for deptID > 0 {
|
|
if seen[deptID] {
|
|
return nil, gerror.New("机构上下级存在循环")
|
|
}
|
|
seen[deptID] = true
|
|
var dept *entity.SysDept
|
|
if err := dao.SysDept.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Scan(&dept); err != nil {
|
|
return nil, err
|
|
}
|
|
if dept == nil || dept.Status != "0" {
|
|
return []int64{}, nil
|
|
}
|
|
if tenantID == template.TenantId && deptID == template.DeptId {
|
|
break
|
|
}
|
|
if dept.DeptRole == consts.SuperAdminRoleId {
|
|
return nil, gerror.Newf("机构%d不能使用超级管理员角色作为代理权限上限，请核对机构角色绑定", dept.DeptId)
|
|
}
|
|
if dept.DeptRole <= 0 {
|
|
return nil, gerror.Newf("机构%d未关联默认角色，请联系平台管理员核对机构角色绑定", dept.DeptId)
|
|
}
|
|
var role *entity.SysRole
|
|
if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Where("role_id", dept.DeptRole).Where("status", "0").Scan(&role); err != nil {
|
|
return nil, err
|
|
}
|
|
if role == nil {
|
|
return nil, gerror.Newf("机构%d默认角色不存在、已停用或归属不匹配，请联系平台管理员核对", dept.DeptId)
|
|
}
|
|
deptID = dept.ParentId
|
|
}
|
|
if tenantID == template.TenantId && !seen[template.DeptId] {
|
|
return []int64{}, nil
|
|
}
|
|
return ids, nil
|
|
}
|
|
|
|
func RestrictAssignableMenus(ctx context.Context, tenantID string, deptID, userID int64, ids []int64) ([]int64, error) {
|
|
allowed, err := RestrictMenus(ctx, tenantID, deptID, ids)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// Local administrators can delegate only their organization's current default
|
|
// role permissions and their own active permissions. Ancestor/template menus
|
|
// do not cap a platform-authorized individual expansion.
|
|
template, err := Template(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if template != nil && (tenantID != template.TenantId || deptID != template.DeptId) {
|
|
var dept *entity.SysDept
|
|
if err := dao.SysDept.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("dept_id", deptID).Scan(&dept); err != nil {
|
|
return nil, err
|
|
}
|
|
if dept == nil {
|
|
return []int64{}, nil
|
|
}
|
|
menus, err := MenuIDs(ctx, dept.DeptRole)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
allowed = Intersect(allowed, menus)
|
|
}
|
|
var relations []*entity.SysUserRole
|
|
if err := dao.SysUserRole.Ctx(ctx).Master().Where("tenant_id", tenantID).Where("user_id", userID).Scan(&relations); err != nil {
|
|
return nil, err
|
|
}
|
|
roleIDs := make([]int64, 0, len(relations))
|
|
for _, relation := range relations {
|
|
if relation.RoleId != consts.SuperAdminRoleId {
|
|
roleIDs = append(roleIDs, relation.RoleId)
|
|
}
|
|
}
|
|
if len(roleIDs) == 0 {
|
|
return []int64{}, nil
|
|
}
|
|
var roles []*entity.SysRole
|
|
if err := dao.SysRole.Ctx(ctx).Master().Where("tenant_id", tenantID).WhereIn("role_id", roleIDs).Where("status", "0").Scan(&roles); err != nil {
|
|
return nil, err
|
|
}
|
|
roleIDs = roleIDs[:0]
|
|
for _, role := range roles {
|
|
roleIDs = append(roleIDs, role.RoleId)
|
|
}
|
|
if len(roleIDs) == 0 {
|
|
return []int64{}, nil
|
|
}
|
|
var menus []*entity.SysRoleMenu
|
|
if err := dao.SysRoleMenu.Ctx(ctx).Master().Where("tenant_id", tenantID).WhereIn("role_id", roleIDs).Scan(&menus); err != nil {
|
|
return nil, err
|
|
}
|
|
owned := make([]int64, 0, len(menus))
|
|
for _, menu := range menus {
|
|
owned = append(owned, menu.MenuId)
|
|
}
|
|
return Intersect(allowed, owned), nil
|
|
}
|