1、组织套餐下的权限菜单id支持缓存、修改套餐内容或组织更换套餐时刷新对应缓存；2、增加组织套餐下菜单的过滤：登录系统展现菜单、接口权限串校验、角色管理给角色授权的可选菜单列表；

cf-framework/cf-spring-boot-starter-biz-organ/src/main/java/com/cf/imes/framework/organ/core/redis/OrganRedisCacheManager.java

@@ -1,5 +1,6 @@
 package com.cf.imes.framework.organ.core.redis;
 
+import cn.hutool.core.text.CharSequenceUtil;
 import com.cf.imes.framework.redis.core.TimeoutRedisCacheManager;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import lombok.extern.slf4j.Slf4j;
@@ -8,6 +9,9 @@ import org.springframework.data.redis.cache.RedisCacheConfiguration;
 import org.springframework.data.redis.cache.RedisCacheManager;
 import org.springframework.data.redis.cache.RedisCacheWriter;
 
+import java.util.ArrayList;
+import java.util.List;
+
 /**
  * 多组织的 {@link RedisCacheManager} 实现类
  *
@@ -18,6 +22,13 @@ import org.springframework.data.redis.cache.RedisCacheWriter;
 @Slf4j
 public class OrganRedisCacheManager extends TimeoutRedisCacheManager {
 
+    // 不需要拼接组织id的redis-key列表
+    private static final List<String> ignoreOrganIdKeyList = new ArrayList<>();
+
+    static {
+        ignoreOrganIdKeyList.add("tenant_package_menu_ids");
+    }
+
     public OrganRedisCacheManager(RedisCacheWriter cacheWriter,
                                   RedisCacheConfiguration defaultCacheConfiguration) {
         super(cacheWriter, defaultCacheConfiguration);
@@ -25,9 +36,14 @@ public class OrganRedisCacheManager extends TimeoutRedisCacheManager {
 
     @Override
     public Cache getCache(String name) {
+        // key带#代表设置了ttl，只保留#前的部分作为key
+        if (name.contains("#")) {
+            name = CharSequenceUtil.subBefore(name, "#", false);
+        }
         // 如果开启多组织，则 name 拼接组织后缀
         if (!OrganContextHolder.isIgnore()
-            && OrganContextHolder.getOrganId() != null) {
+                && OrganContextHolder.getOrganId() != null
+                && !ignoreOrganIdKeyList.contains(name)) {
             name = name + ":" + OrganContextHolder.getOrganId();
         }
 

cf-framework/cf-spring-boot-starter-redis/src/main/java/com/cf/imes/framework/redis/core/TimeoutRedisCacheManager.java

@@ -41,12 +41,15 @@ public class TimeoutRedisCacheManager extends RedisCacheManager {
         // 核心：通过修改 cacheConfig 的过期时间，实现自定义过期时间
         if (cacheConfig != null) {
             // 移除 # 后面的 : 以及后面的内容，避免影响解析
-            names[1] = CharSequenceUtil.subBefore(names[1], StrPool.COLON, false);
+            String ttlStr = CharSequenceUtil.subBefore(names[1], StrPool.COLON, false); // 获得 ttlStr 时间部分
+            names[1] = CharSequenceUtil.subAfter(names[1], ttlStr, false); // 移除掉 ttlStr 时间部分
             // 解析时间
-            Duration duration = parseDuration(names[1]);
+            Duration duration = parseDuration(ttlStr);
             cacheConfig = cacheConfig.entryTtl(duration);
         }
-        return super.createRedisCache(name, cacheConfig);
+
+        // 创建 RedisCache 对象，需要忽略掉 ttlStr
+        return super.createRedisCache(names[0] + names[1], cacheConfig);
     }
 
     /**

cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java

@@ -35,6 +35,8 @@ public class ErrorCodeConstants {
     public static final ErrorCode ROLE_ADMIN_CODE_ERROR = new ErrorCode(1_002_002_005, "编码【{}】不能使用");
     public static final ErrorCode ROLE_ME_ERROR = new ErrorCode(1_002_002_006, "不可为自身分配角色");
     public static final ErrorCode ROLE_NOT_SUPERADMIN_NO_ORGAN_ID_OPER_ERROR = new ErrorCode(1_002_002_007, "非超管分配权限");
+    public static final ErrorCode BUILDIN_ROLE_MODIFY_PERMISSION_ERROR = new ErrorCode(1_002_002_008, "修改内置角色下菜单权限的权限不足");
+    public static final ErrorCode SELF_ROLE_MODIFY_PERMISSION_ERROR = new ErrorCode(1_002_002_009, "无法修改自身的角色菜单权限");
 
     // ========== 用户模块 1-002-003-000 ==========
     public static final ErrorCode USER_USERNAME_EXISTS = new ErrorCode(1_002_003_000, "手机号已经存在");

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/auth/AuthController.java

@@ -1,12 +1,16 @@
 package com.cf.imes.module.system.controller.admin.auth;
 
 import cn.hutool.core.collection.CollUtil;
+import cn.hutool.core.util.ObjectUtil;
 import com.cf.imes.framework.common.enums.CommonStatusEnum;
 import com.cf.imes.framework.common.enums.UserTypeEnum;
+import com.cf.imes.framework.common.exception.ServiceException;
+import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
 import com.cf.imes.framework.common.pojo.CommonResult;
 import com.cf.imes.framework.common.validation.Mobile;
 import com.cf.imes.framework.operatelog.core.annotations.OperateLog;
 import com.cf.imes.framework.security.config.SecurityProperties;
+import com.cf.imes.framework.security.core.LoginUser;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
 import com.cf.imes.module.system.api.sms.dto.code.SmsCodeSendReqDTO;
 import com.cf.imes.module.system.controller.admin.auth.vo.AuthLoginReqVO;
@@ -129,14 +133,19 @@ public class AuthController {
     @GetMapping("/get-permission-info")
     @Operation(summary = "获取登录用户的权限信息")
     public CommonResult<AuthPermissionInfoRespVO> getPermissionInfo() {
+        LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
+        if (ObjectUtil.isNull(loginUser)) {
+            throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
+        }
+        Long userId = loginUser.getId();
         // 1.1 获得用户信息
-        AdminUserDO user = userService.getUser(getLoginUserId());
+        AdminUserDO user = userService.getUser(userId);
         if (user == null) {
             return null;
         }
 
         // 1.2 获得角色列表
-        Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(getLoginUserId());
+        Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(userId);
         if (CollUtil.isEmpty(roleIds)) {
             return success(AuthConvert.INSTANCE.convert(user, Collections.emptyList(), Collections.emptyList()));
         }
@@ -144,7 +153,7 @@ public class AuthController {
         roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
 
         // 1.3 获得菜单列表
-        Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
+        Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
         List<MenuDO> menuList = menuService.getMenuList1(menuIds);
         menuList.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/MenuController.java

@@ -1,7 +1,10 @@
 package com.cf.imes.module.system.controller.admin.permission;
 
 import cn.hutool.core.collection.CollUtil;
+import cn.hutool.core.util.ObjectUtil;
 import com.cf.imes.framework.common.enums.CommonStatusEnum;
+import com.cf.imes.framework.common.exception.ServiceException;
+import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
 import com.cf.imes.framework.common.pojo.CommonResult;
 import com.cf.imes.framework.common.util.object.BeanUtils;
 import com.cf.imes.framework.security.core.LoginUser;
@@ -30,7 +33,6 @@ import java.util.*;
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUser;
-import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
 
 @Tag(name = "管理后台 - 菜单")
 @RestController
@@ -79,24 +81,29 @@ public class MenuController {
     @Operation(summary = "获取菜单列表", description = "用于【菜单管理】界面")
     //@PreAuthorize("@ss.hasPermission('system:menu:query')")
     public CommonResult<List<MenuRespVO>> getMenuList(MenuListReqVO reqVO) {
-        List <MenuDO> list = null;
+        List <MenuDO> list;
         LoginUser loginUser = getLoginUser();
+        if (ObjectUtil.isNull(loginUser)) {
+            throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
+        }
+
         if(loginUser.getIsSupAdmin()) {
             list = menuService.getMenuList(reqVO);
         }else {
-            AdminUserDO user = userService.getUser(getLoginUserId());
+            AdminUserDO user = userService.getUser(loginUser.getId());
             if (user == null) {
                 return success(new ArrayList<>());
             }
-            Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(getLoginUserId());
+            // 获取登录用户所属角色
+            Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
             if (CollUtil.isEmpty(roleIds)) {
                 return success(new ArrayList<>());
             }
-            //List<RoleDO> roles = roleService.getRoleList(roleIds);
+            // 查询角色并过滤无效的
             List<RoleDO> roles = roleService.getRoleList1(roleIds);
             roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
-            Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
-            //List<MenuDO> menuList = menuService.getMenuList(menuIds);
+            // 查询角色拥有权限的菜单id
+            Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
             list = menuService.getMenuList1(menuIds);
             list.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
         }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java

@@ -11,6 +11,7 @@ import com.cf.imes.module.system.controller.admin.permission.vo.permission.Permi
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleMenuReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
+import com.cf.imes.module.system.enums.ErrorCodeConstants;
 import com.cf.imes.module.system.service.permission.PermissionService;
 import com.cf.imes.module.system.service.organ.OrganService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -59,14 +60,14 @@ public class PermissionController {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         boolean isOrganRole = Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
         if(!loginUser.getIsSupAdmin() && (isOrganRole)) {
-            throw new ServiceException(11541, "内置角色无权修改菜单权限");
+            throw new ServiceException(ErrorCodeConstants.BUILDIN_ROLE_MODIFY_PERMISSION_ERROR);
         }
         if(Objects.equals(reqVO.getRoleId(), 1L)) {
-            throw new ServiceException(11541, "内置角色无权修改菜单权限");
+            throw new ServiceException(ErrorCodeConstants.BUILDIN_ROLE_MODIFY_PERMISSION_ERROR);
         }
         Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
         if (roleIds.contains(reqVO.getRoleId())) {
-            throw new ServiceException(11541, "无法修改自身的角色菜单权限");
+            throw new ServiceException(ErrorCodeConstants.SELF_ROLE_MODIFY_PERMISSION_ERROR);
         }
 
         if (!isOrganRole) {

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/redis/RedisKeyConstants.java

@@ -108,4 +108,10 @@ public class RedisKeyConstants {
      * 短信验证码次数上限的缓存
      */
     public static final String SMS_CAPTCHA_VERIFICATION_LIMIT = "sms_captcha_verification_limit:%s";
-}
+
+    /**
+     * 套餐下的权限菜单id：12h代表key的ttl为12小时
+     * ！！！！注意同步修改OrganRedisCacheManager中的key字符串
+     */
+    public static final String TENANT_PACKAGE_MENU_IDS = "tenant_package_menu_ids#12h";
+}

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/redis/listener/SystemPermissionRefreshRedisListener.java

@@ -3,6 +3,7 @@ package com.cf.imes.module.system.dal.redis.listener;
 import com.cf.imes.framework.mq.redis.core.pubsub.AbstractRedisSimpleMessageListener;
 import com.cf.imes.framework.security.core.service.SecurityFrameworkService;
 import com.cf.imes.module.system.dal.redis.RedisRefreshChannelTopicConstants;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.data.redis.connection.Message;
 import org.springframework.data.redis.listener.ChannelTopic;
 import org.springframework.stereotype.Component;
@@ -14,6 +15,7 @@ import org.springframework.stereotype.Component;
  * @since 2024/6/13 10:32
  */
 @Component
+@Slf4j
 public class SystemPermissionRefreshRedisListener extends AbstractRedisSimpleMessageListener {
 
     private final SecurityFrameworkService securityFrameworkService;
@@ -25,6 +27,7 @@ public class SystemPermissionRefreshRedisListener extends AbstractRedisSimpleMes
 
     @Override
     public void onMessage(Message message, byte[] bytes) {
+        log.info("[SystemPermissionRefreshRedisListener][onMessage][{}收到刷新本地权限缓存]", message);
         securityFrameworkService.invalidateAllPermissionsCache();
     }
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganService.java

@@ -131,7 +131,7 @@ public interface OrganService {
      *
      * @param id 组织编号
      */
-    void validOrgan(Long id);
+    OrganizationDO validOrgan(Long id);
 
     List<OrganSimpleRespVO> getSimpleOrganList(String name);
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java

@@ -101,7 +101,7 @@ public class OrganServiceImpl implements OrganService {
     }
 
     @Override
-    public void validOrgan(Long id) {
+    public OrganizationDO validOrgan(Long id) {
         OrganizationDO organizationDO = getOrgan(id);
         if (organizationDO == null) {
             throw exception(ORGAN_NOT_EXISTS);
@@ -112,6 +112,10 @@ public class OrganServiceImpl implements OrganService {
         if (DateUtils.isExpired(organizationDO.getExpireTime())) {
             throw exception(ORGAN_EXPIRE, organizationDO.getName());
         }
+        if (ObjectUtil.isNull(organizationDO.getPackageId())) {
+            throw exception(TENANT_PACKAGE_NOT_EXISTS);
+        }
+        return organizationDO;
     }
 
     @Override
@@ -216,7 +220,7 @@ public class OrganServiceImpl implements OrganService {
         organMapper.updateById(updateObj);
         // 如果套餐发生变化，则修改其角色的权限
         if (ObjectUtil.notEqual(tenant.getPackageId(), updateReqVO.getPackageId())) {
-            updateOrganRoleMenu(tenant.getId(), tenantPackage.getMenuIds());
+            permissionService.flushCacheWhenTenantPackageChange(List.of(tenant.getId()));
         }
     }
 

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java

@@ -7,6 +7,7 @@ import com.cf.imes.module.system.dal.dataobject.organ.TenantPackageDO;
 
 import javax.validation.Valid;
 import java.util.List;
+import java.util.Set;
 
 /**
  * 组织套餐 Service 接口
@@ -72,4 +73,11 @@ public interface TenantPackageService {
      */
     List<TenantPackageDO> getTenantPackageListByStatus(Integer status);
 
+    /**
+     * 获取组织套餐下的权限菜单id
+     *
+     * @param id 组织套餐id
+     * @return
+     */
+    Set<Long> getTenantPackageMenuIds(Long id);
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java

@@ -5,6 +5,7 @@ import cn.hutool.core.util.ObjectUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.cf.imes.framework.common.enums.CommonStatusEnum;
 import com.cf.imes.framework.common.pojo.PageResult;
+import com.cf.imes.framework.common.util.collection.CollectionUtils;
 import com.cf.imes.framework.common.util.object.BeanUtils;
 import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
 import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
@@ -14,6 +15,10 @@ import com.cf.imes.module.system.dal.dataobject.organ.OrganizationDO;
 import com.cf.imes.module.system.dal.dataobject.organ.TenantPackageDO;
 import com.cf.imes.module.system.dal.mysql.organ.TenantPackageMapper;
 import com.baomidou.dynamic.datasource.annotation.DSTransactional;
+import com.cf.imes.module.system.dal.redis.RedisKeyConstants;
+import com.cf.imes.module.system.service.permission.PermissionService;
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.stereotype.Service;
 import org.springframework.validation.annotation.Validated;
@@ -21,6 +26,7 @@ import org.springframework.validation.annotation.Validated;
 import javax.annotation.Resource;
 import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.*;
@@ -41,7 +47,11 @@ public class TenantPackageServiceImpl implements TenantPackageService {
     @Lazy // 避免循环依赖的报错
     private OrganService organService;
 
+    @Resource
+    private PermissionService permissionService;
+
     @Override
+    @CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#createReqVO.id")
     public Long createTenantPackage(TenantPackageSaveReqVO createReqVO) {
         // 唯一性校验
         validateTenantPackageUnique(createReqVO);
@@ -54,6 +64,7 @@ public class TenantPackageServiceImpl implements TenantPackageService {
 
     @Override
     @DSTransactional // 多数据源，使用 @DSTransactional 保证本地事务，以及数据源的切换
+    @CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#updateReqVO.id")
     public void updateTenantPackage(TenantPackageSaveReqVO updateReqVO) {
         // 唯一性校验
         validateTenantPackageUnique(updateReqVO);
@@ -70,11 +81,12 @@ public class TenantPackageServiceImpl implements TenantPackageService {
         // 如果菜单发生变化，则修改每个组织的菜单
         if (!CollUtil.isEqualList(tenantPackage.getMenuIds(), updateReqVO.getMenuIds())) {
             List<OrganizationDO> tenants = organService.getOrganListByPackageId(tenantPackage.getId());
-            tenants.forEach(tenant -> organService.updateOrganRoleMenu(tenant.getId(), updateReqVO.getMenuIds()));
+            permissionService.flushCacheWhenTenantPackageChange(CollectionUtils.convertList(tenants, OrganizationDO::getId));
         }
     }
 
     @Override
+    @CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#id")
     public void deleteTenantPackage(Long id) {
         // 校验存在
         validateTenantPackageExists(id);
@@ -144,4 +156,15 @@ public class TenantPackageServiceImpl implements TenantPackageService {
         return tenantPackageMapper.selectListByStatus(status);
     }
 
+    @Override
+    @Cacheable(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#id", unless = "#result == null", cacheManager = "redisCacheManager")
+    public Set<Long> getTenantPackageMenuIds(Long id) {
+        validateTenantPackageExists(id);
+        TenantPackageDO tenantPackageDO = tenantPackageMapper.selectOne(new LambdaQueryWrapper<TenantPackageDO>().eq(TenantPackageDO::getId, id).select(TenantPackageDO::getMenuIds));
+        if (ObjectUtil.isNotNull(tenantPackageDO)) {
+            return tenantPackageDO.getMenuIds();
+        } else {
+            return null;
+        }
+    }
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java

@@ -154,7 +154,14 @@ public interface PermissionService {
      */
     DeptDataPermissionRespDTO getDeptDataPermission(Long userId);
 
-    Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds);
+    /**
+     * 查询角色id列表下所拥有的权限菜单，通过组织所配的菜单做过滤
+     *
+     * @param roleIds 角色id列表
+     * @param organId 组织id
+     * @return
+     */
+    Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds,Long organId);
 
     void bathAssignUserRole(List<PermissionAssignUserRoleReqVO> listReqVO);
 
@@ -181,4 +188,11 @@ public interface PermissionService {
      * 判断用户是否拥有相对应的权限
      */
     Boolean hasPermission(Long userId, String permission);
+
+    /**
+     * 组织套餐发生改变刷新缓存
+     *
+     * @param organIds 组织id列表
+     */
+    void flushCacheWhenTenantPackageChange(List<Long> organIds);
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java

@@ -6,6 +6,7 @@ import cn.hutool.core.util.ObjectUtil;
 import cn.hutool.extra.spring.SpringUtil;
 import com.cf.imes.framework.common.enums.CommonStatusEnum;
 import com.cf.imes.framework.common.exception.ServiceException;
+import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
 import com.cf.imes.framework.common.util.collection.CollectionUtils;
 import com.cf.imes.framework.common.util.json.JsonUtils;
 import com.cf.imes.framework.datapermission.core.annotation.DataPermission;
@@ -19,10 +20,12 @@ import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
 import com.cf.imes.module.system.dal.dataobject.oauth2.OAuth2AccessTokenDO;
+import com.cf.imes.module.system.dal.dataobject.organ.OrganizationDO;
 import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
 import com.cf.imes.module.system.dal.dataobject.permission.RoleDO;
 import com.cf.imes.module.system.dal.dataobject.permission.RoleMenuDO;
 import com.cf.imes.module.system.dal.dataobject.permission.UserRoleDO;
+import com.cf.imes.module.system.dal.dataobject.user.AdminUserDO;
 import com.cf.imes.module.system.dal.mysql.permission.RoleMenuMapper;
 import com.cf.imes.module.system.dal.mysql.permission.UserRoleMapper;
 import com.cf.imes.module.system.dal.redis.RedisKeyConstants;
@@ -30,6 +33,8 @@ import com.cf.imes.module.system.dal.redis.RedisRefreshChannelTopicConstants;
 import com.cf.imes.module.system.enums.ErrorCodeConstants;
 import com.cf.imes.module.system.enums.permission.DataScopeEnum;
 import com.cf.imes.module.system.service.dept.DeptService;
+import com.cf.imes.module.system.service.organ.OrganService;
+import com.cf.imes.module.system.service.organ.TenantPackageService;
 import com.cf.imes.module.system.service.user.AdminUserService;
 import com.baomidou.dynamic.datasource.annotation.DSTransactional;
 import com.cf.imes.module.system.util.organ.OrganUtils;
@@ -40,6 +45,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Cacheable;
 import org.springframework.cache.annotation.Caching;
+import org.springframework.context.annotation.Lazy;
 import org.springframework.data.redis.core.Cursor;
 import org.springframework.data.redis.core.ScanOptions;
 import org.springframework.data.redis.core.StringRedisTemplate;
@@ -56,7 +62,7 @@ import java.util.stream.Collectors;
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.framework.common.util.json.JsonUtils.toJsonString;
-import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
+import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUser;
 import static com.cf.imes.module.system.dal.redis.RedisKeyConstants.OAUTH2_ACCESS_TOKEN;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
 
@@ -86,6 +92,14 @@ public class PermissionServiceImpl implements PermissionService {
     @Resource
     private StringRedisTemplate stringRedisTemplate;
 
+    @Resource
+    @Lazy // 延迟，避免循环依赖报错
+    private TenantPackageService tenantPackageService;
+
+    @Resource
+    @Lazy // 延迟，避免循环依赖报错
+    private OrganService organService;
+
     @Override
     public boolean hasAnyPermissions(Long userId, String... permissions) {
         // 如果为空，说明已经有权限
@@ -99,9 +113,15 @@ public class PermissionServiceImpl implements PermissionService {
             return false;
         }
 
+        AdminUserDO user = userService.getUser(userId);
+        if (ObjectUtil.isNull(user)) {
+            throw new ServiceException(ErrorCodeConstants.USER_NOT_EXISTS);
+        }
+        OrganizationDO organizationDO = organService.validOrgan(user.getOrganId());
+
         // 情况一：遍历判断每个权限，如果有一满足，说明有权限
         for (String permission : permissions) {
-            if (hasAnyPermission(roles, permission)) {
+            if (hasAnyPermission(roles, permission, organizationDO.getPackageId())) {
                 return true;
             }
         }
@@ -117,13 +137,16 @@ public class PermissionServiceImpl implements PermissionService {
      * @param permission 权限标识
      * @return 是否拥有
      */
-    private boolean hasAnyPermission(List<RoleDO> roles, String permission) {
+    private boolean hasAnyPermission(List<RoleDO> roles, String permission, Long packageId) {
         List<Long> menuIds = menuService.getMenuIdListByPermissionFromCache(permission);
         // 采用严格模式，如果权限找不到对应的 Menu 的话，也认为没有权限
         if (CollUtil.isEmpty(menuIds)) {
             return false;
         }
 
+        // 组织套餐下的菜单
+        Set<Long> tenantPackageMenuIds = tenantPackageService.getTenantPackageMenuIds(packageId);
+
         // 判断是否有权限
         Set<Long> roleIds = convertSet(roles, RoleDO::getId);
         for (Long menuId : menuIds) {
@@ -131,7 +154,8 @@ public class PermissionServiceImpl implements PermissionService {
             //Set<Long> menuRoleIds = getSelf().getMenuRoleIdListByMenuIdFromCache(menuId);
             Set<Long> menuRoleIds = getSelf().getMenuRoleIdListByMenuIdFromCache1(menuId);
             // 如果有交集，说明有权限
-            if (CollUtil.containsAny(menuRoleIds, roleIds)) {
+            // 角色下菜单id和组织套餐内菜单id必须同时满足
+            if (CollUtil.containsAny(menuRoleIds, roleIds) && tenantPackageMenuIds.contains(menuId)) {
                 return true;
             }
         }
@@ -241,7 +265,9 @@ public class PermissionServiceImpl implements PermissionService {
                         } else {
                             userIds = userRoleMapper.selectOrgRoleUserIds(roleId).stream().map(UserRoleDO::getUserId).toList();
                         }
-                        scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
+                        if (CollUtil.isNotEmpty(userIds)) {
+                            scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
+                        }
                     })
                     .exceptionally(e -> {
                         log.error("[assignRoleMenu][flushRoleMenuCache]失败, 异常:{}", e);
@@ -353,7 +379,7 @@ public class PermissionServiceImpl implements PermissionService {
 
     @Override
     @OrganIgnore
-    public Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds) {
+    public Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds, Long organId) {
         if (CollUtil.isEmpty(roleIds)) {
             return Collections.emptySet();
         }
@@ -361,17 +387,27 @@ public class PermissionServiceImpl implements PermissionService {
         // 如果是管理员的情况下，获取全部菜单编号
         if (roleService.hasAnySuperAdmin(roleIds)) {
             return convertSet(menuService.getMenuList(), MenuDO::getId);
-        }
-        List<Long> buildinRoleIdList = new ArrayList<>(){{
-            add(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID);
-            add(InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
-        }};
-        if (CollUtil.containsAny(roleIds, buildinRoleIdList)) {
-            // 内置角色不限制组织id
-            return convertSet(roleMenuMapper.selectListByRoleId(roleIds), RoleMenuDO::getMenuId);
         } else {
-            // 普通成员只能看组织id下的菜单
-            return convertSet(roleMenuMapper.selectListByRoleIdsAndOrganId(roleIds, OrganContextHolder.getOrganId()), RoleMenuDO::getMenuId);
+            List<Long> buildinRoleIdList = new ArrayList<>(){{
+                add(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID);
+                add(InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
+            }};
+
+            Set<Long> roleMenuIds;
+            if (CollUtil.containsAny(roleIds, buildinRoleIdList)) {
+                // 内置角色不限制组织id
+                roleMenuIds = convertSet(roleMenuMapper.selectListByRoleId(roleIds), RoleMenuDO::getMenuId);
+            } else {
+                // 普通成员只能看组织id下的菜单
+                roleMenuIds = convertSet(roleMenuMapper.selectListByRoleIdsAndOrganId(roleIds, OrganContextHolder.getOrganId()), RoleMenuDO::getMenuId);
+            }
+
+            // 校验、获取可用的组织
+            OrganizationDO organ = organService.validOrgan(organId);
+
+            Set<Long> tenantPackageMenuIds = tenantPackageService.getTenantPackageMenuIds(organ.getPackageId());
+
+            return Sets.intersection(roleMenuIds, tenantPackageMenuIds);
         }
     }
 
@@ -677,8 +713,12 @@ public class PermissionServiceImpl implements PermissionService {
      */
     @Override
     public Set<String> getUserPermissions(Long userId) {
+        LoginUser loginUser = getLoginUser();
+        if (ObjectUtil.isNull(loginUser)) {
+            throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
+        }
         // 1.2 获得角色列表
-        Set<Long> roleIds = getUserRoleIdListByUserId(getLoginUserId());
+        Set<Long> roleIds = getUserRoleIdListByUserId(loginUser.getId());
         if (CollUtil.isEmpty(roleIds)) {
             return Collections.emptySet();
         }
@@ -686,7 +726,7 @@ public class PermissionServiceImpl implements PermissionService {
         roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
 
         // 1.3 获得菜单列表
-        Set<Long> menuIds = getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
+        Set<Long> menuIds = getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
         List<MenuDO> menuList = menuService.getMenuList1(menuIds);
         menuList.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
 
@@ -699,4 +739,28 @@ public class PermissionServiceImpl implements PermissionService {
         return permissions.contains(permission);
     }
 
+    @Override
+    public void flushCacheWhenTenantPackageChange(List<Long> organIds) {
+        if (CollUtil.isEmpty(organIds)) {
+            return;
+        }
+        CompletableFuture.runAsync(() -> {
+                    for (Long organId : organIds) {
+                        // 清空机构下的用户的token缓存
+                        List<AdminUserDO> organUsers = userService.getOrganUsers(organId);
+                        if (CollUtil.isNotEmpty(organUsers)) {
+                            List<Long> userIds = CollectionUtils.convertList(organUsers, AdminUserDO::getId);
+                            scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
+                        }
+                    }
+                })
+                .thenRunAsync(() -> {
+                    //通知刷新本地权限缓存
+                    stringRedisTemplate.convertAndSend(RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, "");
+                })
+                .exceptionally(e -> {
+                    log.error("[PermissionService][flushCacheWhenTenantPackageChange]失败, 异常:{}", e);
+                    return null;
+                });
+    }
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserService.java

@@ -281,4 +281,12 @@ public interface AdminUserService {
      * @param reqVO 用户个人信息
      */
     void updateUserSecurityPhone(Long id, @Valid UserMobileUpdateReqVO reqVO);
+
+    /**
+     * 获取机构下的用户
+     *
+     * @param organId
+     * @return
+     */
+    List<AdminUserDO> getOrganUsers(Long organId);
 }

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java

@@ -4,6 +4,7 @@ import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.date.DateUtil;
 import cn.hutool.core.io.IoUtil;
 import cn.hutool.core.util.ObjectUtil;
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.cf.imes.framework.common.enums.CommonStatusEnum;
 import com.cf.imes.framework.common.enums.UserTypeEnum;
@@ -784,4 +785,10 @@ public class AdminUserServiceImpl implements AdminUserService {
         // 将时间设置为 0 点
         return LocalDateTime.of(firstDayOfMonth, LocalTime.MIDNIGHT);
     }
+
+    @Override
+    @OrganIgnore
+    public List<AdminUserDO> getOrganUsers(Long organId) {
+        return userMapper.selectList(new LambdaQueryWrapper<AdminUserDO>().eq(AdminUserDO::getOrganId, organId));
+    }
 }