Merge remote-tracking branch 'origin/main'

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/constants/permission/InternalRoleConstants.java

@@ -0,0 +1,26 @@
+package com.cf.imes.module.system.constants.permission;
+
+/**
+ * 内部角色常量
+ *
+ * @author Gqr
+ * @since 2024/6/22 11:44
+ */
+public final class InternalRoleConstants {
+
+    /**
+     * 组织管理员角色id
+     */
+    public static final Long ORGAN_ADMIN_ROLE_ID = 165L;
+
+
+    /**
+     * 组织员工角色id
+     */
+    public static final Long ORGAN_STAFF_ROLE_ID = 166L;
+
+    /**
+     * 内置角色组织id
+     */
+    public static final Long INTERNAL_ROLE_ORGAN_ID = 0L;
+}

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/auth/AuthController.java

@@ -8,7 +8,6 @@ import com.cf.imes.framework.common.pojo.CommonResult;
 import com.cf.imes.framework.operatelog.core.annotations.OperateLog;
 import com.cf.imes.framework.security.config.SecurityProperties;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
-import com.cf.imes.module.system.controller.admin.auth.vo.*;
 import com.cf.imes.module.system.controller.admin.auth.vo.AuthLoginReqVO;
 import com.cf.imes.module.system.controller.admin.auth.vo.AuthPermissionInfoRespVO;
 import com.cf.imes.module.system.controller.admin.auth.vo.AuthSocialLoginReqVO;
@@ -118,9 +117,7 @@ public class AuthController {
         roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
 
         // 1.3 获得菜单列表
-        //Set<Long> menuIds = permissionService.getRoleMenuListByRoleId(convertSet(roles, RoleDO::getId));
         Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
-        //List<MenuDO> menuList = menuService.getMenuList(menuIds);
         List<MenuDO> menuList = menuService.getMenuList1(menuIds);
         menuList.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java

@@ -6,6 +6,7 @@ import com.cf.imes.framework.common.pojo.CommonResult;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.security.core.LoginUser;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleDataScopeReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleMenuReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
@@ -25,8 +26,6 @@ import java.util.Objects;
 import java.util.Set;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
 /**
  * 权限 Controller，提供赋予用户、角色的权限的 API 接口
@@ -56,7 +55,8 @@ public class PermissionController {
     @PreAuthorize("@ss.hasPermission('system:permission:assign-role-menu')")
     public CommonResult<Boolean> assignRoleMenu(@Validated @RequestBody PermissionAssignRoleMenuReqVO reqVO) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
-        if(!loginUser.getIsSupAdmin() && ( Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID))) {
+        boolean isOrganRole = Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
+        if(!loginUser.getIsSupAdmin() && (isOrganRole)) {
             throw new ServiceException(11541, "内置角色无权修改菜单权限");
         }
         if(Objects.equals(reqVO.getRoleId(), 1L)) {
@@ -67,16 +67,14 @@ public class PermissionController {
             throw new ServiceException(11541, "无法修改自身的角色菜单权限");
         }
 
-        if(Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID)) {
-        } else {
+        if (!isOrganRole) {
             // 开启多组织的情况下，需要过滤掉未开通的菜单
             organService.handleOrganMenu(menuIds -> {
                 reqVO.getMenuIds().removeIf(menuId -> !CollUtil.contains(menuIds, menuId));
             });
         }
-        Long organId = reqVO.getOrganId() == null? OrganContextHolder.getOrganId(): reqVO.getOrganId();
         // 执行菜单的分配
-        permissionService.assignRoleMenu(reqVO.getRoleId(), reqVO.getMenuIds(), organId);
+        permissionService.assignRoleMenu(reqVO.getRoleId(), reqVO.getMenuIds(), reqVO.getOrganId());
         return success(true);
     }
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java

@@ -10,7 +10,7 @@ import com.cf.imes.framework.excel.core.util.ExcelUtils;
 import com.cf.imes.framework.operatelog.core.annotations.OperateLog;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
-import com.cf.imes.module.system.controller.admin.permission.vo.role.*;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.permission.vo.role.RolePageReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.role.RoleRespVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.role.RoleSaveReqVO;
@@ -32,12 +32,9 @@ import java.io.IOException;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Objects;
-import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
 import static com.cf.imes.framework.operatelog.core.enums.OperateTypeEnum.EXPORT;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 import static java.util.Collections.singleton;
 
 @Tag(name = "管理后台 - 角色")
@@ -64,7 +61,7 @@ public class RoleController {
     @Operation(summary = "修改角色")
     @PreAuthorize("@ss.hasPermission('system:role:update')")
     public CommonResult<Boolean> updateRole(@Valid @RequestBody RoleSaveReqVO updateReqVO) {
-        if(Objects.equals(updateReqVO.getId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(updateReqVO.getId(), ORGAN_STAFF_ROLE_ID)) {
+        if (Objects.equals(updateReqVO.getId(), InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || Objects.equals(updateReqVO.getId(), InternalRoleConstants.ORGAN_STAFF_ROLE_ID)) {
             throw new ServiceException(11541, "内置角色无法修改");
         }
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMenuMapper.java

@@ -3,7 +3,7 @@ package com.cf.imes.module.system.dal.mysql.permission;
 import com.cf.imes.framework.mybatis.core.mapper.BaseMapperX;
 import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
 import com.cf.imes.framework.organ.core.aop.OrganIgnore;
-import com.cf.imes.framework.organ.core.context.OrganContextHolder;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.dal.dataobject.permission.RoleMenuDO;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import org.apache.ibatis.annotations.Mapper;
@@ -11,8 +11,6 @@ import org.apache.ibatis.annotations.Mapper;
 import java.util.Collection;
 import java.util.List;
 
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
 @Mapper
 public interface RoleMenuMapper extends BaseMapperX<RoleMenuDO> {
@@ -25,6 +23,19 @@ public interface RoleMenuMapper extends BaseMapperX<RoleMenuDO> {
         return selectList(RoleMenuDO::getRoleId, roleIds);
     }
 
+    /**
+     * 基于角色id列表和组织id查询角色菜单列表
+     *
+     * @param roleIds
+     * @param organId
+     * @return
+     */
+    default List<RoleMenuDO> selectListByRoleIdsAndOrganId(Collection<Long> roleIds, Long organId) {
+        return selectList(new LambdaQueryWrapperX<RoleMenuDO>()
+                .eq(RoleMenuDO::getOrganId, organId)
+                .in(RoleMenuDO::getRoleId, roleIds));
+    }
+
     default List<RoleMenuDO> selectListByMenuId(Long menuId) {
         return selectList(RoleMenuDO::getMenuId, menuId);
     }
@@ -44,9 +55,7 @@ public interface RoleMenuMapper extends BaseMapperX<RoleMenuDO> {
     }
 
     @OrganIgnore
-    default List<RoleMenuDO> selectListByRoleIdWithOrganAdmin(Collection<Long> roleIds){
-        return selectList(new LambdaQueryWrapperX<RoleMenuDO>()
-                .eq(RoleMenuDO::getOrganId, 0)
-                .in(RoleMenuDO::getRoleId, roleIds));
+    default List<RoleMenuDO> selectListByRoleIdWithOrganAdmin(Collection<Long> roleIds) {
+        return selectListByRoleIdsAndOrganId(roleIds, InternalRoleConstants.INTERNAL_ROLE_ORGAN_ID);
     }
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java

@@ -14,12 +14,12 @@ import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
 import com.cf.imes.framework.organ.config.OrganProperties;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.organ.core.util.OrganUtils;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.organ.vo.organ.OrganSimpleRespVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.role.RoleSaveReqVO;
 import com.cf.imes.module.system.controller.admin.organ.vo.organ.OrganPageReqVO;
 import com.cf.imes.module.system.controller.admin.organ.vo.organ.OrganSaveReqVO;
 import com.cf.imes.module.system.controller.admin.user.vo.user.UserSaveReqVO;
-import com.cf.imes.module.system.controller.admin.user.vo.user.UserSimpleRespVO;
 import com.cf.imes.module.system.convert.organ.OrganConvert;
 import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
 import com.cf.imes.module.system.dal.dataobject.permission.RoleDO;
@@ -79,10 +79,6 @@ public class OrganServiceImpl implements OrganService {
     private MenuService menuService;
     @Resource
     private PermissionService permissionService;
-    //组织管理员角色id
-    public static final Long ORGAN_ADMIN_ROLE_ID = 165L;
-    //组织员工角色id
-    public static final Long ORGAN_STAFF_ROLE_ID = 166L;
 
     @Value("${chenfeng.organ.use-data-code:imes_prod}")
     private String useDataCode;
@@ -150,7 +146,7 @@ public class OrganServiceImpl implements OrganService {
             // 创建角色
             /*Long roleId = createRole(tenantPackage, organId);*/
             // 创建用户，并分配角色
-            Long userId = createUser(ORGAN_ADMIN_ROLE_ID, createReqVO, organId);
+            Long userId = createUser(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID, createReqVO, organId);
             // 修改组织的管理员
             organMapper.updateById(new OrganizationDO().setId(tenant.getId()).setContactUserId(userId));
         });
@@ -243,7 +239,7 @@ public class OrganServiceImpl implements OrganService {
         OrganUtils.execute(organId, () -> {
             // 获得所有角色
             List<RoleDO> roles = roleService.getMeAndDefaultRoleList();
-            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()) || role.getOrganId().equals(0L), "角色({}/{}) 组织不匹配",
+            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()) || role.getOrganId().equals(InternalRoleConstants.INTERNAL_ROLE_ORGAN_ID), "角色({}/{}) 组织不匹配",
                     role.getId(), role.getOrganId(), organId)); // 兜底校验
             // 重新分配每个角色的权限
             roles.forEach(role -> {

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java

@@ -15,6 +15,7 @@ import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.security.core.LoginUser;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
 import com.cf.imes.module.system.api.permission.dto.DeptDataPermissionRespDTO;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
 import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
@@ -53,8 +54,6 @@ import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.e
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.framework.common.util.json.JsonUtils.toJsonString;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
 /**
  * 权限 Service 实现类
@@ -161,11 +160,22 @@ public class PermissionServiceImpl implements PermissionService {
     public void assignRoleMenu(Long roleId, Set<Long> menuIds, Long organId) {
         // 获得角色拥有菜单编号
         Set<Long> dbMenuIds = null;
-        if (Objects.equals(roleId, ORGAN_ADMIN_ROLE_ID) || Objects.equals(roleId, ORGAN_STAFF_ROLE_ID)) {
+        boolean isOrganRole = Objects.equals(roleId, InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || Objects.equals(roleId, InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
+        if (isOrganRole) {
             dbMenuIds = convertSet(roleMenuMapper.selectListByRoleIdWithOrganAdmin(List.of(roleId)), RoleMenuDO::getMenuId);
         }else {
             dbMenuIds = convertSet(roleMenuMapper.selectListByRoleId(roleId), RoleMenuDO::getMenuId);
         }
+        // 查询角色获取角色的组织id，如果没有传入组织id就跟角色的组织统一
+        RoleDO role = roleService.getRole(roleId);
+        if (Objects.isNull(role)) {
+            throw new ServiceException(ErrorCodeConstants.ROLE_NOT_EXISTS);
+        }
+        // 前端没传或者查一次后切换了组织导致跟角色组织不一致的统一为角色的组织
+        if (Objects.isNull(organId) || ObjectUtil.notEqual(role.getOrganId(), organId)) {
+            organId = role.getOrganId();
+        }
+        final Long finalOrganId = organId;
 
         // 计算新增和删除的菜单编号
         Set<Long> menuIdList = CollUtil.emptyIfNull(menuIds);
@@ -177,10 +187,10 @@ public class PermissionServiceImpl implements PermissionService {
                 RoleMenuDO entity = new RoleMenuDO();
                 entity.setRoleId(roleId);
                 entity.setMenuId(menuId);
-                if (Objects.equals(roleId, ORGAN_ADMIN_ROLE_ID) || Objects.equals(roleId, ORGAN_STAFF_ROLE_ID)) {
-                    entity.setOrganId(0L);
+                if (isOrganRole) {
+                    entity.setOrganId(InternalRoleConstants.INTERNAL_ROLE_ORGAN_ID);
                 }else {
-                    entity.setOrganId(organId);
+                    entity.setOrganId(finalOrganId);
                 }
                 return entity;
             };
@@ -195,11 +205,11 @@ public class PermissionServiceImpl implements PermissionService {
         if (CollectionUtil.isNotEmpty(createMenuIds) || CollectionUtil.isNotEmpty(deleteMenuIds)) {
             CompletableFuture.runAsync(() -> {
                 // 当前操作人和所操作的目标菜单机构不同时，清空MENU_ROLE_ID_LIST:目标机构id:菜单id的缓存
-                if (ObjectUtil.notEqual(organId, currentOrganId)) {
+                if (ObjectUtil.notEqual(finalOrganId, currentOrganId)) {
                     // 获取新增和删除菜单id的并集
                     Collection<Long> delMenuIds = CollUtil.union(createMenuIds, deleteMenuIds);
                     // 构建批量删除的key集合
-                    Set<String> delKeys = delMenuIds.stream().map(menuId -> String.format(String.valueOf(new StringBuffer(RedisKeyConstants.MENU_ROLE_ID_LIST).append(":%s:%s")), organId, menuId)).collect(Collectors.toSet());
+                    Set<String> delKeys = delMenuIds.stream().map(menuId -> String.format(String.valueOf(new StringBuffer(RedisKeyConstants.MENU_ROLE_ID_LIST).append(":%s:%s")), finalOrganId, menuId)).collect(Collectors.toSet());
                     Long batchDelNum = redisTemplate.delete(delKeys);
                     log.info("[assignRoleMenu] 批量删除redis[MENU_ROLE_ID_LIST]数量:{}", batchDelNum);
                 }
@@ -244,7 +254,7 @@ public class PermissionServiceImpl implements PermissionService {
         }
         // 如果是非管理员的情况下，获得拥有的菜单编号
         List<RoleMenuDO> from = null;
-        if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) || roleIds.contains(ORGAN_STAFF_ROLE_ID)) {
+        if(roleIds.contains(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || roleIds.contains(InternalRoleConstants.ORGAN_STAFF_ROLE_ID)) {
             from = roleMenuMapper.selectListByRoleIdWithOrganAdmin(roleIds);
         }else {
             from = roleMenuMapper.selectListByRoleId(roleIds);
@@ -264,9 +274,13 @@ public class PermissionServiceImpl implements PermissionService {
         if (roleService.hasAnySuperAdmin(roleIds)) {
             return convertSet(menuService.getMenuList(), MenuDO::getId);
         }
-        // 如果是非管理员的情况下，获得拥有的菜单编号
-        List<RoleMenuDO> from = roleMenuMapper.selectListByRoleId(roleIds);
-        return convertSet(from, RoleMenuDO::getMenuId);
+        if (roleIds.contains(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID)) {
+            // 组织管理员不限制组织id
+            return convertSet(roleMenuMapper.selectListByRoleId(roleIds), RoleMenuDO::getMenuId);
+        } else {
+            // 普通成员只能看组织id下的菜单
+            return convertSet(roleMenuMapper.selectListByRoleIdsAndOrganId(roleIds, OrganContextHolder.getOrganId()), RoleMenuDO::getMenuId);
+        }
     }
 
     @Override

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java

@@ -19,6 +19,7 @@ import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
 import com.cf.imes.module.infra.api.file.FileApi;
 import com.cf.imes.module.system.api.user.dto.OrganAdminUserRespDTO;
+import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.user.vo.profile.UserProfileUpdatePasswordReqVO;
 import com.cf.imes.module.system.controller.admin.user.vo.profile.UserProfileUpdateReqVO;
 import com.cf.imes.module.system.controller.admin.user.vo.user.UserImportExcelVO;
@@ -48,13 +49,11 @@ import javax.annotation.Resource;
 import java.io.InputStream;
 import java.time.LocalDateTime;
 import java.util.*;
-import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertList;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.USER_ME_ERROR;
-import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 
 /**
  * 后台用户 Service 实现类
@@ -518,7 +517,7 @@ public class AdminUserServiceImpl implements AdminUserService {
         }
         MPJLambdaWrapperX<AdminUserDO> wrapperX = new MPJLambdaWrapperX<>();
         wrapperX.leftJoin(UserRoleDO.class, UserRoleDO::getUserId,  AdminUserDO::getId)
-                .eq(UserRoleDO::getRoleId, ORGAN_ADMIN_ROLE_ID)
+                .eq(UserRoleDO::getRoleId, InternalRoleConstants.ORGAN_ADMIN_ROLE_ID)
         ;
         List<OrganAdminUserRespDTO> organAdminUserRespDTOS = userMapper.selectJoinList(OrganAdminUserRespDTO.class, wrapperX);
         return organAdminUserRespDTOS;