iotlcm/admin-svr/server/internal/logic/agent/agent_base.go

package agent

import (
	"context"
	"slices"

	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/dao"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/xgorm/handler"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model/entity"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/service"

	"github.com/gogf/gf/v2/database/gdb"
	"github.com/gogf/gf/v2/errors/gerror"
)

type agentBase struct{}

func newAgentBase() *agentBase {
	return &agentBase{}
}

func (s *agentBase) deptModel(ctx context.Context) *gdb.Model {
	return service.SysDept().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
}

func (s *agentBase) roleModel(ctx context.Context) *gdb.Model {
	return service.SysRole().ModelQuery(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
}

func (s *agentBase) userModel(ctx context.Context) *gdb.Model {
	return service.SysUser().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false})
}

// scopeDeptIds 获取当前登录组织本级及下一级组织的部门ID列表
func (s *agentBase) scopeDeptIds(ctx context.Context) (deptIds []int64, err error) {
	currentDeptId := contexts.GetDeptId(ctx)
	if currentDeptId == 0 {
		return nil, gerror.New("当前用户未绑定组织")
	}
	deptIds = []int64{currentDeptId}
	var children []*entity.SysDept
	err = service.SysDept().Model(ctx, &handler.Option{FilterTenant: true, FilterAuth: false}).
		Where(dao.SysDept.Columns().ParentId, currentDeptId).
		Order(dao.SysDept.Columns().OrderNum, "ASC").
		Scan(&children)
	if err != nil {
		return nil, err
	}
	for _, dept := range children {
		deptIds = append(deptIds, dept.DeptId)
	}
	slices.Sort(deptIds)
	return slices.Compact(deptIds), nil
}

// ensureDeptInScope 确保部门在当前机构的权限范围内
func (s *agentBase) ensureDeptInScope(ctx context.Context, deptId int64) error {
	deptIds, err := s.scopeDeptIds(ctx)
	if err != nil {
		return err
	}
	if !slices.Contains(deptIds, deptId) {
		return gerror.New("只能操作本级及下一级组织")
	}
	return nil
}

// ensureRoleInScope 确保角色在当前机构的权限范围内
func (s *agentBase) ensureRoleInScope(ctx context.Context, roleId int64) error {
	if roleId == 0 {
		return nil
	}
	deptIds, err := s.scopeDeptIds(ctx)
	if err != nil {
		return err
	}
	count, err := s.roleModel(ctx).
		Where(dao.SysRole.Columns().RoleId, roleId).
		WhereIn(dao.SysRole.Columns().DeptId, deptIds).
		Count()
	if err != nil {
		return err
	}
	if count == 0 {
		return gerror.New("只能绑定本级及下一级组织的角色")
	}
	return nil
}

// ensureDeptRoleUnchangedForSelf 确保当前机构的权限未被修改
func (s *agentBase) ensureDeptRoleUnchangedForSelf(ctx context.Context, deptId, deptRole int64) error {
	currentDeptId := contexts.GetDeptId(ctx)
	if deptId == 0 || deptId != currentDeptId {
		return nil
	}
	var dept *entity.SysDept
	err := s.deptModel(ctx).
		Where(dao.SysDept.Columns().DeptId, currentDeptId).
		Scan(&dept)
	if err != nil {
		return err
	}
	if dept == nil || dept.DeptId == 0 {
		return gerror.New("组织不存在")
	}
	if dept.DeptRole != deptRole {
		return gerror.New("不能修改本级组织的权限")
	}
	return nil
}

// currentDeptDefaultRoleId 获取当前机构的默认角色ID
func (s *agentBase) currentDeptDefaultRoleId(ctx context.Context) (int64, error) {
	currentDeptId := contexts.GetDeptId(ctx)
	if currentDeptId == 0 {
		return 0, gerror.New("当前用户未绑定组织")
	}
	var dept *entity.SysDept
	err := s.deptModel(ctx).
		Where(dao.SysDept.Columns().DeptId, currentDeptId).
		Scan(&dept)
	if err != nil {
		return 0, err
	}
	if dept == nil || dept.DeptId == 0 {
		return 0, gerror.New("组织不存在")
	}
	return dept.DeptRole, nil
}

// ensureRoleNotCurrentDeptDefault 确保角色不是当前机构的默认角色
func (s *agentBase) ensureRoleNotCurrentDeptDefault(ctx context.Context, roleId int64) error {
	if roleId == 0 {
		return nil
	}
	defaultRoleId, err := s.currentDeptDefaultRoleId(ctx)
	if err != nil {
		return err
	}
	if defaultRoleId != 0 && roleId == defaultRoleId {
		return gerror.New("不能修改本级机构绑定的默认角色权限")
	}
	return nil
}