Public/cf_imes_server
6
0
Fork 0
mirror of http://192.168.1.205:9980/cf_devdept2/cf_imes_server.git synced 2026-08-12 21:02:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

1、组织套餐下的权限菜单id支持缓存、修改套餐内容或组织更换套餐时刷新对应缓存；2、增加组织套餐下菜单的过滤：登录系统展现菜单、接口权限串校验、角色管理给角色授权的可选菜单列表；

Browse Source
This commit is contained in:
gaoqr
2024-11-05 14:38:34 +08:00
parent e16583e3a8
commit eadb7f7633
16 changed files with 216 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/auth/AuthController.java
+12 -3
View File
@@ -1,12 +1,16 @@
package com.cf.imes.module.system.controller.admin.auth;
import cn.hutool.core.collection.CollUtil;
import cn.hutool.core.util.ObjectUtil;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.enums.UserTypeEnum;
import com.cf.imes.framework.common.exception.ServiceException;
import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
import com.cf.imes.framework.common.pojo.CommonResult;
import com.cf.imes.framework.common.validation.Mobile;
import com.cf.imes.framework.operatelog.core.annotations.OperateLog;
import com.cf.imes.framework.security.config.SecurityProperties;
import com.cf.imes.framework.security.core.LoginUser;
import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
import com.cf.imes.module.system.api.sms.dto.code.SmsCodeSendReqDTO;
import com.cf.imes.module.system.controller.admin.auth.vo.AuthLoginReqVO;
@@ -129,14 +133,19 @@ public class AuthController {
@GetMapping("/get-permission-info")
@Operation(summary = "获取登录用户的权限信息")
public CommonResult<AuthPermissionInfoRespVO> getPermissionInfo() {
LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
if (ObjectUtil.isNull(loginUser)) {
throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
}
Long userId = loginUser.getId();
// 1.1 获得用户信息
AdminUserDO user = userService.getUser(getLoginUserId());
AdminUserDO user = userService.getUser(userId);
if (user == null) {
return null;
}
// 1.2 获得角色列表
Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(getLoginUserId());
Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(userId);
if (CollUtil.isEmpty(roleIds)) {
return success(AuthConvert.INSTANCE.convert(user, Collections.emptyList(), Collections.emptyList()));
}
@@ -144,7 +153,7 @@ public class AuthController {
roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
// 1.3 获得菜单列表
Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
List<MenuDO> menuList = menuService.getMenuList1(menuIds);
menuList.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/MenuController.java
+14 -7
View File
@@ -1,7 +1,10 @@
package com.cf.imes.module.system.controller.admin.permission;
import cn.hutool.core.collection.CollUtil;
import cn.hutool.core.util.ObjectUtil;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.exception.ServiceException;
import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
import com.cf.imes.framework.common.pojo.CommonResult;
import com.cf.imes.framework.common.util.object.BeanUtils;
import com.cf.imes.framework.security.core.LoginUser;
@@ -30,7 +33,6 @@ import java.util.*;
import static com.cf.imes.framework.common.pojo.CommonResult.success;
import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUser;
import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
@Tag(name = "管理后台 - 菜单")
@RestController
@@ -79,24 +81,29 @@ public class MenuController {
@Operation(summary = "获取菜单列表", description = "用于【菜单管理】界面")
//@PreAuthorize("@ss.hasPermission('system:menu:query')")
public CommonResult<List<MenuRespVO>> getMenuList(MenuListReqVO reqVO) {
List <MenuDO> list = null;
List <MenuDO> list;
LoginUser loginUser = getLoginUser();
if (ObjectUtil.isNull(loginUser)) {
throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
}
if(loginUser.getIsSupAdmin()) {
list = menuService.getMenuList(reqVO);
}else {
AdminUserDO user = userService.getUser(getLoginUserId());
AdminUserDO user = userService.getUser(loginUser.getId());
if (user == null) {
return success(new ArrayList<>());
}
Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(getLoginUserId());
// 获取登录用户所属角色
Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
if (CollUtil.isEmpty(roleIds)) {
return success(new ArrayList<>());
}
//List<RoleDO> roles = roleService.getRoleList(roleIds);
// 查询角色并过滤无效的
List<RoleDO> roles = roleService.getRoleList1(roleIds);
roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
//List<MenuDO> menuList = menuService.getMenuList(menuIds);
// 查询角色拥有权限的菜单id
Set<Long> menuIds = permissionService.getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
list = menuService.getMenuList1(menuIds);
list.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
+4 -3
View File
@@ -11,6 +11,7 @@ import com.cf.imes.module.system.controller.admin.permission.vo.permission.Permi
import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleMenuReqVO;
import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
import com.cf.imes.module.system.enums.ErrorCodeConstants;
import com.cf.imes.module.system.service.permission.PermissionService;
import com.cf.imes.module.system.service.organ.OrganService;
import io.swagger.v3.oas.annotations.Operation;
@@ -59,14 +60,14 @@ public class PermissionController {
LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
boolean isOrganRole = Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
if(!loginUser.getIsSupAdmin() && (isOrganRole)) {
throw new ServiceException(11541, "内置角色无权修改菜单权限");
throw new ServiceException(ErrorCodeConstants.BUILDIN_ROLE_MODIFY_PERMISSION_ERROR);
}
if(Objects.equals(reqVO.getRoleId(), 1L)) {
throw new ServiceException(11541, "内置角色无权修改菜单权限");
throw new ServiceException(ErrorCodeConstants.BUILDIN_ROLE_MODIFY_PERMISSION_ERROR);
}
Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
if (roleIds.contains(reqVO.getRoleId())) {
throw new ServiceException(11541, "无法修改自身的角色菜单权限");
throw new ServiceException(ErrorCodeConstants.SELF_ROLE_MODIFY_PERMISSION_ERROR);
}
if (!isOrganRole) {
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/redis/RedisKeyConstants.java
+7 -1
View File
@@ -108,4 +108,10 @@ public class RedisKeyConstants {
* 短信验证码次数上限的缓存
*/
public static final String SMS_CAPTCHA_VERIFICATION_LIMIT = "sms_captcha_verification_limit:%s";
}
/**
* 套餐下的权限菜单id：12h代表key的ttl为12小时
* ！！！！注意同步修改OrganRedisCacheManager中的key字符串
*/
public static final String TENANT_PACKAGE_MENU_IDS = "tenant_package_menu_ids#12h";
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/redis/listener/SystemPermissionRefreshRedisListener.java
+3
View File
@@ -3,6 +3,7 @@ package com.cf.imes.module.system.dal.redis.listener;
import com.cf.imes.framework.mq.redis.core.pubsub.AbstractRedisSimpleMessageListener;
import com.cf.imes.framework.security.core.service.SecurityFrameworkService;
import com.cf.imes.module.system.dal.redis.RedisRefreshChannelTopicConstants;
import lombok.extern.slf4j.Slf4j;
import org.springframework.data.redis.connection.Message;
import org.springframework.data.redis.listener.ChannelTopic;
import org.springframework.stereotype.Component;
@@ -14,6 +15,7 @@ import org.springframework.stereotype.Component;
* @since 2024/6/13 10:32
*/
@Component
@Slf4j
public class SystemPermissionRefreshRedisListener extends AbstractRedisSimpleMessageListener {
private final SecurityFrameworkService securityFrameworkService;
@@ -25,6 +27,7 @@ public class SystemPermissionRefreshRedisListener extends AbstractRedisSimpleMes
@Override
public void onMessage(Message message, byte[] bytes) {
log.info("[SystemPermissionRefreshRedisListener][onMessage][{}收到刷新本地权限缓存]", message);
securityFrameworkService.invalidateAllPermissionsCache();
}
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganService.java
+1 -1
View File
@@ -131,7 +131,7 @@ public interface OrganService {
*
* @param id 组织编号
*/
void validOrgan(Long id);
OrganizationDO validOrgan(Long id);
List<OrganSimpleRespVO> getSimpleOrganList(String name);
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java
+6 -2
View File
@@ -101,7 +101,7 @@ public class OrganServiceImpl implements OrganService {
}
@Override
public void validOrgan(Long id) {
public OrganizationDO validOrgan(Long id) {
OrganizationDO organizationDO = getOrgan(id);
if (organizationDO == null) {
throw exception(ORGAN_NOT_EXISTS);
@@ -112,6 +112,10 @@ public class OrganServiceImpl implements OrganService {
if (DateUtils.isExpired(organizationDO.getExpireTime())) {
throw exception(ORGAN_EXPIRE, organizationDO.getName());
}
if (ObjectUtil.isNull(organizationDO.getPackageId())) {
throw exception(TENANT_PACKAGE_NOT_EXISTS);
}
return organizationDO;
}
@Override
@@ -216,7 +220,7 @@ public class OrganServiceImpl implements OrganService {
organMapper.updateById(updateObj);
// 如果套餐发生变化，则修改其角色的权限
if (ObjectUtil.notEqual(tenant.getPackageId(), updateReqVO.getPackageId())) {
updateOrganRoleMenu(tenant.getId(), tenantPackage.getMenuIds());
permissionService.flushCacheWhenTenantPackageChange(List.of(tenant.getId()));
}
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java
+8
View File
@@ -7,6 +7,7 @@ import com.cf.imes.module.system.dal.dataobject.organ.TenantPackageDO;
import javax.validation.Valid;
import java.util.List;
import java.util.Set;
/**
* 组织套餐 Service 接口
@@ -72,4 +73,11 @@ public interface TenantPackageService {
*/
List<TenantPackageDO> getTenantPackageListByStatus(Integer status);
/**
* 获取组织套餐下的权限菜单id
*
* @param id 组织套餐id
* @return
*/
Set<Long> getTenantPackageMenuIds(Long id);
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java
+24 -1
View File
@@ -5,6 +5,7 @@ import cn.hutool.core.util.ObjectUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.pojo.PageResult;
import com.cf.imes.framework.common.util.collection.CollectionUtils;
import com.cf.imes.framework.common.util.object.BeanUtils;
import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
@@ -14,6 +15,10 @@ import com.cf.imes.module.system.dal.dataobject.organ.OrganizationDO;
import com.cf.imes.module.system.dal.dataobject.organ.TenantPackageDO;
import com.cf.imes.module.system.dal.mysql.organ.TenantPackageMapper;
import com.baomidou.dynamic.datasource.annotation.DSTransactional;
import com.cf.imes.module.system.dal.redis.RedisKeyConstants;
import com.cf.imes.module.system.service.permission.PermissionService;
import org.springframework.cache.annotation.CacheEvict;
import org.springframework.cache.annotation.Cacheable;
import org.springframework.context.annotation.Lazy;
import org.springframework.stereotype.Service;
import org.springframework.validation.annotation.Validated;
@@ -21,6 +26,7 @@ import org.springframework.validation.annotation.Validated;
import javax.annotation.Resource;
import java.util.List;
import java.util.Objects;
import java.util.Set;
import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
import static com.cf.imes.module.system.enums.ErrorCodeConstants.*;
@@ -41,7 +47,11 @@ public class TenantPackageServiceImpl implements TenantPackageService {
@Lazy // 避免循环依赖的报错
private OrganService organService;
@Resource
private PermissionService permissionService;
@Override
@CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#createReqVO.id")
public Long createTenantPackage(TenantPackageSaveReqVO createReqVO) {
// 唯一性校验
validateTenantPackageUnique(createReqVO);
@@ -54,6 +64,7 @@ public class TenantPackageServiceImpl implements TenantPackageService {
@Override
@DSTransactional // 多数据源，使用 @DSTransactional 保证本地事务，以及数据源的切换
@CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#updateReqVO.id")
public void updateTenantPackage(TenantPackageSaveReqVO updateReqVO) {
// 唯一性校验
validateTenantPackageUnique(updateReqVO);
@@ -70,11 +81,12 @@ public class TenantPackageServiceImpl implements TenantPackageService {
// 如果菜单发生变化，则修改每个组织的菜单
if (!CollUtil.isEqualList(tenantPackage.getMenuIds(), updateReqVO.getMenuIds())) {
List<OrganizationDO> tenants = organService.getOrganListByPackageId(tenantPackage.getId());
tenants.forEach(tenant -> organService.updateOrganRoleMenu(tenant.getId(), updateReqVO.getMenuIds()));
permissionService.flushCacheWhenTenantPackageChange(CollectionUtils.convertList(tenants, OrganizationDO::getId));
}
}
@Override
@CacheEvict(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#id")
public void deleteTenantPackage(Long id) {
// 校验存在
validateTenantPackageExists(id);
@@ -144,4 +156,15 @@ public class TenantPackageServiceImpl implements TenantPackageService {
return tenantPackageMapper.selectListByStatus(status);
}
@Override
@Cacheable(value = RedisKeyConstants.TENANT_PACKAGE_MENU_IDS, key = "#id", unless = "#result == null", cacheManager = "redisCacheManager")
public Set<Long> getTenantPackageMenuIds(Long id) {
validateTenantPackageExists(id);
TenantPackageDO tenantPackageDO = tenantPackageMapper.selectOne(new LambdaQueryWrapper<TenantPackageDO>().eq(TenantPackageDO::getId, id).select(TenantPackageDO::getMenuIds));
if (ObjectUtil.isNotNull(tenantPackageDO)) {
return tenantPackageDO.getMenuIds();
} else {
return null;
}
}
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionService.java
+15 -1
View File
@@ -154,7 +154,14 @@ public interface PermissionService {
*/
DeptDataPermissionRespDTO getDeptDataPermission(Long userId);
Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds);
/**
* 查询角色id列表下所拥有的权限菜单，通过组织所配的菜单做过滤
*
* @param roleIds 角色id列表
* @param organId 组织id
* @return
*/
Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds,Long organId);
void bathAssignUserRole(List<PermissionAssignUserRoleReqVO> listReqVO);
@@ -181,4 +188,11 @@ public interface PermissionService {
* 判断用户是否拥有相对应的权限
*/
Boolean hasPermission(Long userId, String permission);
/**
* 组织套餐发生改变刷新缓存
*
* @param organIds 组织id列表
*/
void flushCacheWhenTenantPackageChange(List<Long> organIds);
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
+82 -18
View File
@@ -6,6 +6,7 @@ import cn.hutool.core.util.ObjectUtil;
import cn.hutool.extra.spring.SpringUtil;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.exception.ServiceException;
import com.cf.imes.framework.common.exception.enums.GlobalErrorCodeConstants;
import com.cf.imes.framework.common.util.collection.CollectionUtils;
import com.cf.imes.framework.common.util.json.JsonUtils;
import com.cf.imes.framework.datapermission.core.annotation.DataPermission;
@@ -19,10 +20,12 @@ import com.cf.imes.module.system.constants.permission.InternalRoleConstants;
import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignRoleUserReqVO;
import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
import com.cf.imes.module.system.dal.dataobject.oauth2.OAuth2AccessTokenDO;
import com.cf.imes.module.system.dal.dataobject.organ.OrganizationDO;
import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
import com.cf.imes.module.system.dal.dataobject.permission.RoleDO;
import com.cf.imes.module.system.dal.dataobject.permission.RoleMenuDO;
import com.cf.imes.module.system.dal.dataobject.permission.UserRoleDO;
import com.cf.imes.module.system.dal.dataobject.user.AdminUserDO;
import com.cf.imes.module.system.dal.mysql.permission.RoleMenuMapper;
import com.cf.imes.module.system.dal.mysql.permission.UserRoleMapper;
import com.cf.imes.module.system.dal.redis.RedisKeyConstants;
@@ -30,6 +33,8 @@ import com.cf.imes.module.system.dal.redis.RedisRefreshChannelTopicConstants;
import com.cf.imes.module.system.enums.ErrorCodeConstants;
import com.cf.imes.module.system.enums.permission.DataScopeEnum;
import com.cf.imes.module.system.service.dept.DeptService;
import com.cf.imes.module.system.service.organ.OrganService;
import com.cf.imes.module.system.service.organ.TenantPackageService;
import com.cf.imes.module.system.service.user.AdminUserService;
import com.baomidou.dynamic.datasource.annotation.DSTransactional;
import com.cf.imes.module.system.util.organ.OrganUtils;
@@ -40,6 +45,7 @@ import lombok.extern.slf4j.Slf4j;
import org.springframework.cache.annotation.CacheEvict;
import org.springframework.cache.annotation.Cacheable;
import org.springframework.cache.annotation.Caching;
import org.springframework.context.annotation.Lazy;
import org.springframework.data.redis.core.Cursor;
import org.springframework.data.redis.core.ScanOptions;
import org.springframework.data.redis.core.StringRedisTemplate;
@@ -56,7 +62,7 @@ import java.util.stream.Collectors;
import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
import static com.cf.imes.framework.common.util.json.JsonUtils.toJsonString;
import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
import static com.cf.imes.framework.security.core.util.SecurityFrameworkUtils.getLoginUser;
import static com.cf.imes.module.system.dal.redis.RedisKeyConstants.OAUTH2_ACCESS_TOKEN;
import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
@@ -86,6 +92,14 @@ public class PermissionServiceImpl implements PermissionService {
@Resource
private StringRedisTemplate stringRedisTemplate;
@Resource
@Lazy // 延迟，避免循环依赖报错
private TenantPackageService tenantPackageService;
@Resource
@Lazy // 延迟，避免循环依赖报错
private OrganService organService;
@Override
public boolean hasAnyPermissions(Long userId, String... permissions) {
// 如果为空，说明已经有权限
@@ -99,9 +113,15 @@ public class PermissionServiceImpl implements PermissionService {
return false;
}
AdminUserDO user = userService.getUser(userId);
if (ObjectUtil.isNull(user)) {
throw new ServiceException(ErrorCodeConstants.USER_NOT_EXISTS);
}
OrganizationDO organizationDO = organService.validOrgan(user.getOrganId());
// 情况一：遍历判断每个权限，如果有一满足，说明有权限
for (String permission : permissions) {
if (hasAnyPermission(roles, permission)) {
if (hasAnyPermission(roles, permission, organizationDO.getPackageId())) {
return true;
}
}
@@ -117,13 +137,16 @@ public class PermissionServiceImpl implements PermissionService {
* @param permission 权限标识
* @return 是否拥有
*/
private boolean hasAnyPermission(List<RoleDO> roles, String permission) {
private boolean hasAnyPermission(List<RoleDO> roles, String permission, Long packageId) {
List<Long> menuIds = menuService.getMenuIdListByPermissionFromCache(permission);
// 采用严格模式，如果权限找不到对应的 Menu 的话，也认为没有权限
if (CollUtil.isEmpty(menuIds)) {
return false;
}
// 组织套餐下的菜单
Set<Long> tenantPackageMenuIds = tenantPackageService.getTenantPackageMenuIds(packageId);
// 判断是否有权限
Set<Long> roleIds = convertSet(roles, RoleDO::getId);
for (Long menuId : menuIds) {
@@ -131,7 +154,8 @@ public class PermissionServiceImpl implements PermissionService {
//Set<Long> menuRoleIds = getSelf().getMenuRoleIdListByMenuIdFromCache(menuId);
Set<Long> menuRoleIds = getSelf().getMenuRoleIdListByMenuIdFromCache1(menuId);
// 如果有交集，说明有权限
if (CollUtil.containsAny(menuRoleIds, roleIds)) {
// 角色下菜单id和组织套餐内菜单id必须同时满足
if (CollUtil.containsAny(menuRoleIds, roleIds) && tenantPackageMenuIds.contains(menuId)) {
return true;
}
}
@@ -241,7 +265,9 @@ public class PermissionServiceImpl implements PermissionService {
} else {
userIds = userRoleMapper.selectOrgRoleUserIds(roleId).stream().map(UserRoleDO::getUserId).toList();
}
scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
if (CollUtil.isNotEmpty(userIds)) {
scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
}
})
.exceptionally(e -> {
log.error("[assignRoleMenu][flushRoleMenuCache]失败, 异常:{}", e);
@@ -353,7 +379,7 @@ public class PermissionServiceImpl implements PermissionService {
@Override
@OrganIgnore
public Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds) {
public Set<Long> getRoleMenuListByRoleId2(Set<Long> roleIds, Long organId) {
if (CollUtil.isEmpty(roleIds)) {
return Collections.emptySet();
}
@@ -361,17 +387,27 @@ public class PermissionServiceImpl implements PermissionService {
// 如果是管理员的情况下，获取全部菜单编号
if (roleService.hasAnySuperAdmin(roleIds)) {
return convertSet(menuService.getMenuList(), MenuDO::getId);
}
List<Long> buildinRoleIdList = new ArrayList<>(){{
add(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID);
add(InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
}};
if (CollUtil.containsAny(roleIds, buildinRoleIdList)) {
// 内置角色不限制组织id
return convertSet(roleMenuMapper.selectListByRoleId(roleIds), RoleMenuDO::getMenuId);
} else {
// 普通成员只能看组织id下的菜单
return convertSet(roleMenuMapper.selectListByRoleIdsAndOrganId(roleIds, OrganContextHolder.getOrganId()), RoleMenuDO::getMenuId);
List<Long> buildinRoleIdList = new ArrayList<>(){{
add(InternalRoleConstants.ORGAN_ADMIN_ROLE_ID);
add(InternalRoleConstants.ORGAN_STAFF_ROLE_ID);
}};
Set<Long> roleMenuIds;
if (CollUtil.containsAny(roleIds, buildinRoleIdList)) {
// 内置角色不限制组织id
roleMenuIds = convertSet(roleMenuMapper.selectListByRoleId(roleIds), RoleMenuDO::getMenuId);
} else {
// 普通成员只能看组织id下的菜单
roleMenuIds = convertSet(roleMenuMapper.selectListByRoleIdsAndOrganId(roleIds, OrganContextHolder.getOrganId()), RoleMenuDO::getMenuId);
}
// 校验、获取可用的组织
OrganizationDO organ = organService.validOrgan(organId);
Set<Long> tenantPackageMenuIds = tenantPackageService.getTenantPackageMenuIds(organ.getPackageId());
return Sets.intersection(roleMenuIds, tenantPackageMenuIds);
}
}
@@ -677,8 +713,12 @@ public class PermissionServiceImpl implements PermissionService {
*/
@Override
public Set<String> getUserPermissions(Long userId) {
LoginUser loginUser = getLoginUser();
if (ObjectUtil.isNull(loginUser)) {
throw new ServiceException(GlobalErrorCodeConstants.UNAUTHORIZED);
}
// 1.2 获得角色列表
Set<Long> roleIds = getUserRoleIdListByUserId(getLoginUserId());
Set<Long> roleIds = getUserRoleIdListByUserId(loginUser.getId());
if (CollUtil.isEmpty(roleIds)) {
return Collections.emptySet();
}
@@ -686,7 +726,7 @@ public class PermissionServiceImpl implements PermissionService {
roles.removeIf(role -> !CommonStatusEnum.ENABLE.getStatus().equals(role.getStatus())); // 移除禁用的角色
// 1.3 获得菜单列表
Set<Long> menuIds = getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId));
Set<Long> menuIds = getRoleMenuListByRoleId2(convertSet(roles, RoleDO::getId), loginUser.getOrganId());
List<MenuDO> menuList = menuService.getMenuList1(menuIds);
menuList.removeIf(menu -> !CommonStatusEnum.ENABLE.getStatus().equals(menu.getStatus())); // 移除禁用的菜单
@@ -699,4 +739,28 @@ public class PermissionServiceImpl implements PermissionService {
return permissions.contains(permission);
}
@Override
public void flushCacheWhenTenantPackageChange(List<Long> organIds) {
if (CollUtil.isEmpty(organIds)) {
return;
}
CompletableFuture.runAsync(() -> {
for (Long organId : organIds) {
// 清空机构下的用户的token缓存
List<AdminUserDO> organUsers = userService.getOrganUsers(organId);
if (CollUtil.isNotEmpty(organUsers)) {
List<Long> userIds = CollectionUtils.convertList(organUsers, AdminUserDO::getId);
scanAndCompareUserAndDelKeys(String.format(OAUTH2_ACCESS_TOKEN, "*"), userIds);
}
}
})
.thenRunAsync(() -> {
//通知刷新本地权限缓存
stringRedisTemplate.convertAndSend(RedisRefreshChannelTopicConstants.PERMISSION_REFRESH, "");
})
.exceptionally(e -> {
log.error("[PermissionService][flushCacheWhenTenantPackageChange]失败, 异常:{}", e);
return null;
});
}
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserService.java
+8
View File
@@ -281,4 +281,12 @@ public interface AdminUserService {
* @param reqVO 用户个人信息
*/
void updateUserSecurityPhone(Long id, @Valid UserMobileUpdateReqVO reqVO);
/**
* 获取机构下的用户
*
* @param organId
* @return
*/
List<AdminUserDO> getOrganUsers(Long organId);
}
cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java
+7
View File
@@ -4,6 +4,7 @@ import cn.hutool.core.collection.CollUtil;
import cn.hutool.core.date.DateUtil;
import cn.hutool.core.io.IoUtil;
import cn.hutool.core.util.ObjectUtil;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
import com.cf.imes.framework.common.enums.CommonStatusEnum;
import com.cf.imes.framework.common.enums.UserTypeEnum;
@@ -784,4 +785,10 @@ public class AdminUserServiceImpl implements AdminUserService {
// 将时间设置为 0 点
return LocalDateTime.of(firstDayOfMonth, LocalTime.MIDNIGHT);
}
@Override
@OrganIgnore
public List<AdminUserDO> getOrganUsers(Long organId) {
return userMapper.selectList(new LambdaQueryWrapper<AdminUserDO>().eq(AdminUserDO::getOrganId, organId));
}
}