Merge branch 'main' of ssh://192.168.1.205:9922/cf_devdept2/cf_imes_server

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java

@@ -63,4 +63,10 @@ public class OAuth2TokenApiImpl implements OAuth2TokenApi {
         return success(BeanUtils.toBean(accessTokenDO, OAuth2AccessTokenRespDTO.class));
     }
 
+    @Override
+    public CommonResult<Long> getOrganIdByToken(String accessToken) {
+        OAuth2AccessTokenDO accessTokenDO = oauth2TokenService.checkAccessToken(accessToken);
+        return success(accessTokenDO.getOrganId());
+    }
+
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/dept/DeptController.java

@@ -58,7 +58,7 @@ public class DeptController {
 
     @GetMapping("/list")
     @Operation(summary = "获取部门列表")
-    @PreAuthorize("@ss.hasPermission('system:dept:query')")
+    //@PreAuthorize("@ss.hasPermission('system:dept:query')")
     public CommonResult<List<DeptRespVO>> getDeptList(DeptListReqVO reqVO) {
         List<DeptDO> list = deptService.getDeptList(reqVO);
         return success(BeanUtils.toBean(list, DeptRespVO.class));

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java

@@ -87,7 +87,7 @@ public class LabelTemplateController {
     @GetMapping("/getDefault")
     @Operation(summary = "获得默认标签模板")
     @Parameter(name = "type", description = "标签类型", required = true, example = "1024")
-    @PreAuthorize("@ss.hasPermission('system:label-template:query')")
+    //@PreAuthorize("@ss.hasPermission('system:label-template:query')")
     @OperateLog(enable = false)
     public CommonResult<LabelTemplateRespVO> getDefaultLabelTemplate(@RequestParam("type") String type) {
         return success(labelTemplateService.getDefaultLabelTemplate(type));

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java

@@ -26,6 +26,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
@@ -58,8 +59,16 @@ public class PermissionController {
     public CommonResult<Boolean> assignRoleMenu(@Validated @RequestBody PermissionAssignRoleMenuReqVO reqVO) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         if(!loginUser.getIsSupAdmin() && ( Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID))) {
-            throw new ServiceException(11541, "内置角色无权修改");
+            throw new ServiceException(11541, "内置角色无权修改菜单权限");
         }
+        if(Objects.equals(reqVO.getRoleId(), 1L)) {
+            throw new ServiceException(11541, "内置角色无权修改菜单权限");
+        }
+        Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
+        if (roleIds.contains(reqVO.getRoleId())) {
+            throw new ServiceException(11541, "无法修改自身的角色菜单权限");
+        }
+
         if(Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID)) {
         } else {
             // 开启多组织的情况下，需要过滤掉未开通的菜单
@@ -100,9 +109,14 @@ public class PermissionController {
     @PostMapping("/bath-assign-user-role")
     @PreAuthorize("@ss.hasPermission('system:permission:assign-user-role')")
     public CommonResult<Boolean> bathAssignUserRole(@Validated @RequestBody List<PermissionAssignUserRoleReqVO> listReqVO) {
+        LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
+        Set<Long> userIds = listReqVO.stream().map(PermissionAssignUserRoleReqVO::getUserId).collect(Collectors.toSet());
+        if (userIds.contains(loginUser.getId())) {
+            throw new ServiceException(ROLE_ME_ERROR);
+        }
         Set<Long> roleIds = listReqVO.stream().flatMap(e -> e.getRoleIds().stream()).collect(Collectors.toSet());
-        if(!SecurityFrameworkUtils.getLoginUser().getIsSupAdmin()) {
-            if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) || roleIds.contains(ORGAN_STAFF_ROLE_ID)) {
+        if(!loginUser.getIsSupAdmin()) {
+            if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) ) {
                 throw new ServiceException(11541, "内置角色无权修改");
             }
         }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java

@@ -32,6 +32,7 @@ import java.io.IOException;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Objects;
+import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
 import static com.cf.imes.framework.operatelog.core.enums.OperateTypeEnum.EXPORT;
@@ -109,8 +110,9 @@ public class RoleController {
 
     @GetMapping({"/list-all-simple", "/simple-list"})
     @Operation(summary = "获取角色精简信息列表", description = "只包含被开启的角色，主要用于前端的下拉选项")
-    public CommonResult<List<RoleSimpleRespVO>> getSimpleRoleList() {
-        List<RoleDO> list = roleService.getRoleListByStatus(singleton(CommonStatusEnum.ENABLE.getStatus()));
+    public CommonResult<List<RoleSimpleRespVO>> getSimpleRoleList(@RequestParam(value = "organId", required = false) Long organId) {
+        List<RoleDO> list = roleService.getRoleListByStatus(singleton(CommonStatusEnum.ENABLE.getStatus()), organId);
+        //List<RoleDO> roleDOS = list.stream().filter(f -> !Objects.equals(f.getId(), 1L)).sorted(Comparator.comparing(RoleDO::getSort)).toList();
         list.sort(Comparator.comparing(RoleDO::getSort));
         return success(BeanUtils.toBean(list, RoleSimpleRespVO.class));
     }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/role/RoleSaveReqVO.java

@@ -31,6 +31,9 @@ public class RoleSaveReqVO {
     @Schema(description = "备注", example = "我是一个角色")
     private String remark;
 
+    @Schema(description = "状态 0开启1关闭" )
+    private Integer status;
+
     private Long organId;
 
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMapper.java

@@ -39,7 +39,8 @@ public interface RoleMapper extends BaseMapperX<RoleDO> {
         lambdaQueryWrapperX.likeIfPresent(RoleDO::getName, reqVO.getName())
                 .likeIfPresent(RoleDO::getCode, reqVO.getCode())
                 .eqIfPresent(RoleDO::getStatus, reqVO.getStatus())
-                .betweenIfPresent(BaseDO::getCreateTime, reqVO.getCreateTime())
+                .betweenIfPresent(RoleDO::getCreateTime, reqVO.getCreateTime())
+                .ne(RoleDO::getId, 1)
                 .orderByDesc(RoleDO::getId);
 
         return selectPage(reqVO, lambdaQueryWrapperX);
@@ -53,8 +54,12 @@ public interface RoleMapper extends BaseMapperX<RoleDO> {
         return selectOne(RoleDO::getCode, code, RoleDO::getOrganId, organId);
     }
 
-    default List<RoleDO> selectListByStatus(@Nullable Collection<Integer> statuses) {
-        return selectList(RoleDO::getStatus, statuses);
+    default List<RoleDO> selectListByStatus(@Nullable Collection<Integer> statuses, Long organId) {
+        return selectList(new LambdaQueryWrapperX<RoleDO>()
+                .eqIfPresent(RoleDO::getOrganId, organId)
+                .eq(RoleDO::getStatus, statuses)
+                .ne(RoleDO::getId, 1)
+        );
     }
 
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java

@@ -242,8 +242,8 @@ public class OrganServiceImpl implements OrganService {
     public void updateOrganRoleMenu(Long organId, Set<Long> menuIds) {
         OrganUtils.execute(organId, () -> {
             // 获得所有角色
-            List<RoleDO> roles = roleService.getRoleList();
-            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()), "角色({}/{}) 组织不匹配",
+            List<RoleDO> roles = roleService.getMeAndDefaultRoleList();
+            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()) || role.getOrganId().equals(0L), "角色({}/{}) 组织不匹配",
                     role.getId(), role.getOrganId(), organId)); // 兜底校验
             // 重新分配每个角色的权限
             roles.forEach(role -> {

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java

@@ -15,6 +15,9 @@ import java.util.List;
  */
 public interface TenantPackageService {
 
+    long SYSTEM_ORGAN_PACKAGE_ID = 116;
+    long SYSTEM_SUPER_PACKAGE_ID = 0;
+
     /**
      * 创建组织套餐
      *

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java

@@ -16,6 +16,7 @@ import org.springframework.validation.annotation.Validated;
 
 import javax.annotation.Resource;
 import java.util.List;
+import java.util.Objects;
 
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.*;
@@ -50,6 +51,10 @@ public class TenantPackageServiceImpl implements TenantPackageService {
     public void updateTenantPackage(TenantPackageSaveReqVO updateReqVO) {
         // 校验存在
         TenantPackageDO tenantPackage = validateTenantPackageExists(updateReqVO.getId());
+        if(Objects.equals(tenantPackage.getId(), SYSTEM_ORGAN_PACKAGE_ID) || Objects.equals(tenantPackage.getId(), SYSTEM_SUPER_PACKAGE_ID)) {
+            throw exception(TENANT_PACKAGE_DEPT_EXIT);
+        }
+
         // 更新
         TenantPackageDO updateObj = BeanUtils.toBean(updateReqVO, TenantPackageDO.class);
         tenantPackageMapper.updateById(updateObj);
@@ -64,6 +69,10 @@ public class TenantPackageServiceImpl implements TenantPackageService {
     public void deleteTenantPackage(Long id) {
         // 校验存在
         validateTenantPackageExists(id);
+        if(Objects.equals(id, SYSTEM_ORGAN_PACKAGE_ID) || Objects.equals(id, SYSTEM_SUPER_PACKAGE_ID)) {
+            throw exception(TENANT_PACKAGE_DELETED_EXIT);
+        }
+
         // 校验正在使用
         validateOrganUsed(id);
         // 删除

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/MenuServiceImpl.java

@@ -19,6 +19,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import javax.annotation.Resource;
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
@@ -136,6 +137,9 @@ public class MenuServiceImpl implements MenuService {
     @Override
     @OrganIgnore
     public List<MenuDO> getMenuList1(Collection<Long> ids) {
+        if(CollUtil.isEmpty(ids)) {
+            return new ArrayList<>();
+        }
         return menuMapper.selectBatchIds(ids);
     }
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java

@@ -11,6 +11,7 @@ import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
 import com.cf.imes.framework.organ.core.aop.OrganIgnore;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.organ.core.db.OrganBaseDO;
+import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
 import com.cf.imes.module.system.api.permission.dto.DeptDataPermissionRespDTO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
 import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
@@ -39,8 +40,10 @@ import java.util.*;
 import java.util.function.Function;
 import java.util.function.Supplier;
 
+import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.framework.common.util.json.JsonUtils.toJsonString;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
@@ -251,7 +254,9 @@ public class PermissionServiceImpl implements PermissionService {
     @Cacheable(value = RedisKeyConstants.MENU_ROLE_ID_LIST, key = "#menuId")
     @OrganIgnore
     public Set<Long> getMenuRoleIdListByMenuIdFromCache1(Long menuId) {
-        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>().in(RoleMenuDO::getOrganId, 0l, OrganContextHolder.getOrganId())
+       //todo 这里应该过滤组织id为0的和自己的
+        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>()
+                //.in(RoleMenuDO::getOrganId, 0l, organId)
                 .eq(RoleMenuDO::getMenuId, menuId)
         );
         return convertSet(roleMenuDOS, RoleMenuDO::getRoleId);
@@ -264,6 +269,9 @@ public class PermissionServiceImpl implements PermissionService {
     @DSTransactional // 多数据源，使用 @DSTransactional 保证本地事务，以及数据源的切换
     @CacheEvict(value = RedisKeyConstants.USER_ROLE_ID_LIST, key = "#userId")
     public void assignUserRole(Long userId, Set<Long> roleIds, Long organId) {
+        if(Objects.equals(userId, SecurityFrameworkUtils.getLoginUserId())) {
+            throw exception(ROLE_ME_ERROR);
+        }
         // 获得用户拥有角色编号
         Set<Long> dbRoleIds = convertSet(userRoleMapper.selectListByUserId(userId),
                 UserRoleDO::getRoleId);

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleService.java

@@ -105,7 +105,7 @@ public interface RoleService {
      * @param statuses 筛选的状态
      * @return 角色列表
      */
-    List<RoleDO> getRoleListByStatus(Collection<Integer> statuses);
+    List<RoleDO> getRoleListByStatus(Collection<Integer> statuses, Long organId);
 
     /**
      * 获得所有角色列表
@@ -114,6 +114,13 @@ public interface RoleService {
      */
     List<RoleDO> getRoleList();
 
+    /**
+     * 获得自己组织与0号组织的所有角色列表
+     *
+     * @return 角色列表
+     */
+    List<RoleDO> getMeAndDefaultRoleList();
+
     /**
      * 获得角色分页
      *

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleServiceImpl.java

@@ -62,7 +62,7 @@ public class RoleServiceImpl implements RoleService {
         // 插入到数据库
         RoleDO role = BeanUtils.toBean(createReqVO, RoleDO.class);
         role.setType(ObjectUtil.defaultIfNull(type, RoleTypeEnum.CUSTOM.getType()));
-        role.setStatus(CommonStatusEnum.ENABLE.getStatus());
+        //role.setStatus(CommonStatusEnum.ENABLE.getStatus());
         role.setDataScope(DataScopeEnum.ALL.getScope()); // 默认可查看所有数据。原因是，可能一些项目不需要项目权限
         role.setOrganId(createReqVO.getOrganId());
         roleMapper.insert(role);
@@ -197,16 +197,17 @@ public class RoleServiceImpl implements RoleService {
 
     @Override
     @OrganIgnore
-    public List<RoleDO> getRoleListByStatus(Collection<Integer> statuses) {
+    public List<RoleDO> getRoleListByStatus(Collection<Integer> statuses, Long organId) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         assert loginUser != null;
         if(!loginUser.getIsSupAdmin()) {
             return roleMapper.selectList(new LambdaQueryWrapperX<RoleDO>()
                     .in(RoleDO::getStatus, statuses)
                     .in(RoleDO::getOrganId, loginUser.getOrganId(), 0L)
+                    .ne(RoleDO::getId, 1)
             );
         }
-        return roleMapper.selectListByStatus(statuses);
+        return roleMapper.selectListByStatus(statuses, organId);
     }
 
     @Override
@@ -214,6 +215,13 @@ public class RoleServiceImpl implements RoleService {
         return roleMapper.selectList();
     }
 
+    @Override
+    public List<RoleDO> getMeAndDefaultRoleList() {
+        return roleMapper.selectList(new LambdaQueryWrapperX<RoleDO>()
+                .in(RoleDO::getOrganId, Arrays.asList(0L, OrganContextHolder.getOrganId()))
+        );
+    }
+
     @Override
     public List<RoleDO> getRoleList(Collection<Long> ids) {
         if (CollectionUtil.isEmpty(ids)) {

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java

@@ -53,6 +53,7 @@ import java.util.stream.Collectors;
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertList;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.USER_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 
 /**
@@ -102,7 +103,7 @@ public class AdminUserServiceImpl implements AdminUserService {
         });
         // 校验正确性
         validateUserForCreateOrUpdate(null, createReqVO.getUsername(),
-                createReqVO.getMobile(), createReqVO.getEmail(), createReqVO.getDeptId(), createReqVO.getPostIds(), createReqVO.getOrganId());
+                createReqVO.getMobile(), createReqVO.getEmail(), createReqVO.getDeptId(), createReqVO.getPostIds(), organId);
         // 插入用户
         AdminUserDO user = BeanUtils.toBean(createReqVO, AdminUserDO.class);
         user.setOrganId(createReqVO.getOrganId());
@@ -229,6 +230,9 @@ public class AdminUserServiceImpl implements AdminUserService {
     @Override
     @Transactional(rollbackFor = Exception.class)
     public void deleteUser(Long id) {
+        if(Objects.equals(id, SecurityFrameworkUtils.getLoginUserId())) {
+            throw exception(USER_ME_ERROR);
+        }
         // 校验用户存在
         validateUserExists(id);
         // 删除用户