diff --git a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java index a73229ffa..2cf27c0ed 100644 --- a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java +++ b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java @@ -33,6 +33,7 @@ public interface ErrorCodeConstants { ErrorCode ROLE_IS_DISABLE = new ErrorCode(1_002_002_004, "名字为【{}】的角色已被禁用"); ErrorCode ROLE_ADMIN_CODE_ERROR = new ErrorCode(1_002_002_005, "编码【{}】不能使用"); ErrorCode ROLE_ME_ERROR = new ErrorCode(1_002_002_006, "不可为自身分配角色"); + ErrorCode ROLE_NOT_SUPERADMIN_NO_ORGAN_ID_OPER_ERROR = new ErrorCode(1_002_002_007, "非超管分配权限"); // ========== 用户模块 1-002-003-000 ========== ErrorCode USER_USERNAME_EXISTS = new ErrorCode(1_002_003_000, "用户账号已经存在"); diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java index bf7ec074f..82f59af63 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java @@ -8,6 +8,7 @@ import com.cf.imes.framework.security.core.LoginUser; import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils; import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleDataScopeReqVO; import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleMenuReqVO; +import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO; import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO; import com.cf.imes.module.system.service.permission.PermissionService; import com.cf.imes.module.system.service.organ.OrganService; @@ -20,13 +21,10 @@ import org.springframework.web.bind.annotation.*; import javax.annotation.Resource; import javax.validation.Valid; -import java.util.List; import java.util.Objects; import java.util.Set; -import java.util.stream.Collectors; import static com.cf.imes.framework.common.pojo.CommonResult.success; -import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR; import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID; import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID; @@ -110,19 +108,8 @@ public class PermissionController { @Operation(summary = "赋予多用户角色") @PostMapping("/bath-assign-user-role") @PreAuthorize("@ss.hasPermission('system:permission:assign-user-role')") - public CommonResult bathAssignUserRole(@Validated @RequestBody List listReqVO) { - LoginUser loginUser = SecurityFrameworkUtils.getLoginUser(); - Set userIds = listReqVO.stream().map(PermissionAssignUserRoleReqVO::getUserId).collect(Collectors.toSet()); - if (userIds.contains(loginUser.getId())) { - throw new ServiceException(ROLE_ME_ERROR); - } - Set roleIds = listReqVO.stream().flatMap(e -> e.getRoleIds().stream()).collect(Collectors.toSet()); - /* if(!loginUser.getIsSupAdmin()) { - if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) ) { - throw new ServiceException(11541, "内置角色无权修改"); - } - }*/ - permissionService.bathAssignUserRole(listReqVO); + public CommonResult bathAssignUserRole(@Validated @RequestBody PermissionAssignRoleUserReqVO reqVO) { +// permissionService.batchAssignRoleUsers(reqVO); return success(true); } diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/permission/PermissionAssignRoleUserReqVO.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/permission/PermissionAssignRoleUserReqVO.java new file mode 100644 index 000000000..3895c75d3 --- /dev/null +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/permission/PermissionAssignRoleUserReqVO.java @@ -0,0 +1,24 @@ +package com.cf.imes.module.system.controller.admin.permission.vo.permission; + +import io.swagger.v3.oas.annotations.media.Schema; +import lombok.Data; + +import javax.validation.constraints.NotNull; +import java.util.Collections; +import java.util.Set; + +@Schema(description = "管理后台 - 分配角色用户 Request VO") +@Data +public class PermissionAssignRoleUserReqVO { + + @Schema(description = "角色编号", requiredMode = Schema.RequiredMode.REQUIRED, example = "1") + @NotNull(message = "角色编号不能为空") + private Long roleId; + + @Schema(description = "用户编号列表", example = "1,3,5") + private Set userIds = Collections.emptySet(); + + @Schema(description = "组织id") + private Long organId; + +} diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/UserRoleMapper.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/UserRoleMapper.java index 205ee50b7..4b3186b86 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/UserRoleMapper.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/UserRoleMapper.java @@ -21,6 +21,18 @@ public interface UserRoleMapper extends BaseMapperX { .in(UserRoleDO::getRoleId, roleIds)); } + /** + * 删除角色下的角色用户 + * + * @param roleId 用户id + * @param userIds 角色id列表 + */ + default void deleteListByRoleIdAndUserIds(Long roleId, Collection userIds) { + delete(new LambdaQueryWrapper() + .eq(UserRoleDO::getRoleId, roleId) + .in(UserRoleDO::getUserId, userIds)); + } + default void deleteListByUserId(Long userId) { delete(new LambdaQueryWrapper().eq(UserRoleDO::getUserId, userId)); } diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java index 8a1019c2c..a25753af1 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java @@ -1,6 +1,7 @@ package com.cf.imes.module.system.service.permission; import com.cf.imes.module.system.api.permission.dto.DeptDataPermissionRespDTO; +import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO; import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO; import java.util.Collection; @@ -157,6 +158,13 @@ public interface PermissionService { void bathAssignUserRole(List listReqVO); + /** + * 批量分配角色用户 + * + * @param reqVO 请求VO + */ + void batchAssignRoleUsers(PermissionAssignRoleUserReqVO reqVO); + /** * 获得拥有角色的用户列表 * @param roleId diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java index 9d09cf68e..63b8706e7 100644 --- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java +++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java @@ -5,6 +5,7 @@ import cn.hutool.core.collection.CollectionUtil; import cn.hutool.core.util.ArrayUtil; import cn.hutool.extra.spring.SpringUtil; import com.cf.imes.framework.common.enums.CommonStatusEnum; +import com.cf.imes.framework.common.exception.ServiceException; import com.cf.imes.framework.common.util.collection.CollectionUtils; import com.cf.imes.framework.datapermission.core.annotation.DataPermission; import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX; @@ -13,6 +14,7 @@ import com.cf.imes.framework.organ.core.context.OrganContextHolder; import com.cf.imes.framework.security.core.LoginUser; import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils; import com.cf.imes.module.system.api.permission.dto.DeptDataPermissionRespDTO; +import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO; import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO; import com.cf.imes.module.system.dal.dataobject.permission.MenuDO; import com.cf.imes.module.system.dal.dataobject.permission.RoleDO; @@ -22,6 +24,7 @@ import com.cf.imes.module.system.dal.mysql.permission.RoleMenuMapper; import com.cf.imes.module.system.dal.mysql.permission.UserRoleMapper; import com.cf.imes.module.system.dal.redis.RedisKeyConstants; import com.cf.imes.module.system.dal.redis.RedisRefreshChannelTopicConstants; +import com.cf.imes.module.system.enums.ErrorCodeConstants; import com.cf.imes.module.system.enums.permission.DataScopeEnum; import com.cf.imes.module.system.service.dept.DeptService; import com.cf.imes.module.system.service.user.AdminUserService; @@ -257,6 +260,7 @@ public class PermissionServiceImpl implements PermissionService { @Override @DSTransactional + @Deprecated //todo 重写授权角色下的用户，后续计划删除 public void bathAssignUserRole(List listReqVO) { Long contextOrganId = OrganContextHolder.getOrganId(); listReqVO.forEach(e->{ @@ -265,6 +269,69 @@ public class PermissionServiceImpl implements PermissionService { }); } + @Override + @DSTransactional // 多数据源，使用 @DSTransactional 保证本地事务，以及数据源的切换 + @CacheEvict(value = RedisKeyConstants.USER_ROLE_ID_LIST, key = "#userId") + public void batchAssignRoleUsers(PermissionAssignRoleUserReqVO reqVO) { + LoginUser loginUser = SecurityFrameworkUtils.getLoginUser(); + assert loginUser != null; + Boolean isSupAdmin = loginUser.getIsSupAdmin(); + Set userIds = reqVO.getUserIds(); + // 组织id + Long organId = reqVO.getOrganId(); + // 超管不传组织id则操作本机构角色 + // 非超管不传组织id不允许操作 + if (isSupAdmin) { + organId = Optional.ofNullable(organId).orElseGet(loginUser::getOrganId); + } else { + if (organId == null) { + throw new ServiceException(ErrorCodeConstants.ROLE_NOT_SUPERADMIN_NO_ORGAN_ID_OPER_ERROR); + } + } + + Long roleId = reqVO.getRoleId(); + // 当前用户不能操作含有自己的角色 + if (CollectionUtil.isNotEmpty(userIds)) { + Long incloudSelf = userIds.stream().filter(userId -> userId.equals(loginUser.getId())).findAny().orElse(null); + if (incloudSelf != null) { + throw new ServiceException(ROLE_ME_ERROR); + } + } + + // 获得角色下的角色用户列表 + Set roleUserIds = convertSet(userRoleMapper.selectList(new LambdaQueryWrapperX() + .eqIfPresent(UserRoleDO::getOrganId, organId) + .eq(UserRoleDO::getRoleId, roleId) + .select(UserRoleDO::getUserId)), UserRoleDO::getUserId); + + // 筛选要新增的userRole：前端有，数据库没有 + Collection createRoleUserIds = CollUtil.subtract(userIds, roleUserIds); + if (!CollectionUtil.isEmpty(createRoleUserIds)) { + Long finalOrganId = organId; + userRoleMapper.insertBatch(CollectionUtils.convertList(createRoleUserIds, userId -> { + UserRoleDO entity = new UserRoleDO(); + entity.setUserId(userId).setRoleId(roleId).setOrganId(finalOrganId); + return entity; + })); + } + + // 筛选要删除的userRole：前端没有，数据库有 + Collection deleteRoleUserIds = CollUtil.subtract(roleUserIds, userIds); + if (!CollectionUtil.isEmpty(deleteRoleUserIds)) { + userRoleMapper.deleteListByRoleIdAndUserIds(roleId, deleteRoleUserIds); + } + + // 角色菜单权限发生修改，通知刷新本地缓存 + if (CollectionUtil.isNotEmpty(createRoleUserIds) || CollectionUtil.isNotEmpty(deleteRoleUserIds)) { + CompletableFuture.runAsync(() -> { + redisTemplate.convertAndSend(RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, ""); + }).exceptionally(e -> { + log.error("redis message发送失败, topic:{}, 异常:{}", RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, e.getMessage()); + return null; + }); + } + } + @Override public Set getListRoleUsers(Long roleId, Long organId) { // 超管查看时没有选择机构则查看本机构