增加权限系统
This commit is contained in:
yml2213
@@ -11,9 +11,17 @@ type AdminDTO struct {
|
||||
Username string `json:"username"`
|
||||
Nickname string `json:"nickname"`
|
||||
Status string `json:"status"`
|
||||
Roles []RoleDTO `json:"roles"`
|
||||
Permissions []string `json:"permissions"`
|
||||
LastLoginAt *time.Time `json:"last_login_at"`
|
||||
}
|
||||
|
||||
type RoleDTO struct {
|
||||
ID uint64 `json:"id"`
|
||||
Code string `json:"code"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
type LoginRequest struct {
|
||||
Username string `json:"username" binding:"required"`
|
||||
Password string `json:"password" binding:"required"`
|
||||
|
||||
@@ -4,6 +4,7 @@ import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"html"
|
||||
@@ -87,7 +88,9 @@ func (r *Repository) Login(username string, password string, captchaID string, c
|
||||
if err != nil {
|
||||
return LoginResult{}, err
|
||||
}
|
||||
return LoginResult{Admin: toDTO(admin), Tokens: tokens}, nil
|
||||
dto := toDTO(admin)
|
||||
r.loadRolesAndPerms(&dto)
|
||||
return LoginResult{Admin: dto, Tokens: tokens}, nil
|
||||
}
|
||||
|
||||
func (r *Repository) verifyCaptcha(captchaID string, captchaCode string) error {
|
||||
@@ -119,6 +122,7 @@ func (r *Repository) FindByID(id uint64) (*AdminDTO, error) {
|
||||
return nil, ErrAdminDisabled
|
||||
}
|
||||
dto := toDTO(admin)
|
||||
r.loadRolesAndPerms(&dto)
|
||||
return &dto, nil
|
||||
}
|
||||
|
||||
@@ -153,6 +157,37 @@ func toDTO(admin model.AdminUser) AdminDTO {
|
||||
}
|
||||
}
|
||||
|
||||
func (r *Repository) loadRolesAndPerms(dto *AdminDTO) {
|
||||
if r.db == nil {
|
||||
return
|
||||
}
|
||||
// 加载角色
|
||||
var roles []RoleDTO
|
||||
r.db.Table("roles").
|
||||
Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
|
||||
Where("aur.admin_user_id = ?", dto.ID).
|
||||
Find(&roles)
|
||||
dto.Roles = roles
|
||||
|
||||
// 加载权限
|
||||
var permCodes []string
|
||||
r.db.Table("permissions").
|
||||
Select("DISTINCT permissions.code").
|
||||
Joins("JOIN role_permissions rp ON rp.permission_id = permissions.id").
|
||||
Joins("JOIN admin_user_roles aur ON aur.role_id = rp.role_id").
|
||||
Where("aur.admin_user_id = ?", dto.ID).
|
||||
Pluck("code", &permCodes)
|
||||
dto.Permissions = permCodes
|
||||
|
||||
// 缓存权限到 Redis
|
||||
if r.redis != nil && len(permCodes) > 0 {
|
||||
ctx := context.Background()
|
||||
key := fmt.Sprintf("admin:perms:%d", dto.ID)
|
||||
raw, _ := json.Marshal(permCodes)
|
||||
r.redis.Set(ctx, key, string(raw), 2*time.Hour)
|
||||
}
|
||||
}
|
||||
|
||||
func captchaKey(id string) string {
|
||||
return "admin:captcha:" + id
|
||||
}
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
package adminmgr
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
"hfb_sys/backend/internal/modules/adminrole"
|
||||
)
|
||||
|
||||
type AdminUserDTO struct {
|
||||
ID uint64 `json:"id"`
|
||||
Username string `json:"username"`
|
||||
Nickname string `json:"nickname"`
|
||||
Status string `json:"status"`
|
||||
Roles []adminrole.RoleDTO `json:"roles"`
|
||||
LastLoginAt *time.Time `json:"last_login_at"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
UpdatedAt time.Time `json:"updated_at"`
|
||||
}
|
||||
|
||||
type PaginatedResult struct {
|
||||
Items []AdminUserDTO `json:"items"`
|
||||
Total int64 `json:"total"`
|
||||
Page int `json:"page"`
|
||||
PageSize int `json:"page_size"`
|
||||
}
|
||||
|
||||
type CreateAdminRequest struct {
|
||||
Username string `json:"username" binding:"required"`
|
||||
Password string `json:"password" binding:"required"`
|
||||
Nickname string `json:"nickname"`
|
||||
}
|
||||
|
||||
type UpdateAdminRequest struct {
|
||||
Nickname string `json:"nickname"`
|
||||
Status string `json:"status"`
|
||||
}
|
||||
|
||||
type AssignRolesRequest struct {
|
||||
RoleIDs []uint64 `json:"role_ids"`
|
||||
}
|
||||
|
||||
type ChangePasswordRequest struct {
|
||||
OldPassword string `json:"old_password" binding:"required"`
|
||||
NewPassword string `json:"new_password" binding:"required"`
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
package adminmgr
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"hfb_sys/backend/internal/middleware"
|
||||
"hfb_sys/backend/pkg/response"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type Handler struct {
|
||||
service *Service
|
||||
}
|
||||
|
||||
func NewHandler(service *Service) *Handler {
|
||||
return &Handler{service: service}
|
||||
}
|
||||
|
||||
func (h *Handler) List(c *gin.Context) {
|
||||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||
result, err := h.service.List(page, pageSize)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, result)
|
||||
}
|
||||
|
||||
func (h *Handler) FindByID(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
item, err := h.service.FindByID(id)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Create(c *gin.Context) {
|
||||
var req CreateAdminRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "用户名和密码不能为空")
|
||||
return
|
||||
}
|
||||
item, err := h.service.Create(req)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.Created(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Update(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var req UpdateAdminRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "请求格式不正确")
|
||||
return
|
||||
}
|
||||
item, err := h.service.Update(id, req)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Delete(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
currentAdminID, _ := c.Get(middleware.ContextAdminID)
|
||||
if err := h.service.Delete(id, currentAdminID.(uint64)); err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, gin.H{"deleted": true})
|
||||
}
|
||||
|
||||
func (h *Handler) AssignRoles(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var req AssignRolesRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "请求格式不正确")
|
||||
return
|
||||
}
|
||||
if err := h.service.AssignRoles(id, req); err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, gin.H{"updated": true})
|
||||
}
|
||||
|
||||
func (h *Handler) ChangePassword(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var req ChangePasswordRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "密码不能为空")
|
||||
return
|
||||
}
|
||||
if err := h.service.ChangePassword(id, req); err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, gin.H{"updated": true})
|
||||
}
|
||||
|
||||
func parseID(c *gin.Context) (uint64, bool) {
|
||||
id, err := strconv.ParseUint(c.Param("id"), 10, 64)
|
||||
if err != nil || id == 0 {
|
||||
response.BadRequest(c, "ID 不正确")
|
||||
return 0, false
|
||||
}
|
||||
return id, true
|
||||
}
|
||||
|
||||
func writeError(c *gin.Context, err error) {
|
||||
switch {
|
||||
case errors.Is(err, ErrDependencyUnavailable):
|
||||
response.ServiceUnavailable(c, "数据库未连接")
|
||||
case errors.Is(err, ErrCannotDeleteSelf):
|
||||
response.BadRequest(c, "不能删除自己的账号")
|
||||
case errors.Is(err, ErrLastSuperAdmin):
|
||||
response.BadRequest(c, "不能删除最后一个超级管理员")
|
||||
case errors.Is(err, ErrWrongPassword):
|
||||
response.BadRequest(c, "原密码错误")
|
||||
case IsNotFound(err):
|
||||
response.Error(c, http.StatusNotFound, "not_found", "管理员不存在")
|
||||
default:
|
||||
response.Error(c, http.StatusInternalServerError, "internal_error", "管理员管理服务暂时不可用")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,234 @@
|
||||
package adminmgr
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"hfb_sys/backend/internal/model"
|
||||
"hfb_sys/backend/internal/modules/adminrole"
|
||||
|
||||
"github.com/redis/go-redis/v9"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/clause"
|
||||
)
|
||||
|
||||
type Repository struct {
|
||||
db *gorm.DB
|
||||
redis *redis.Client
|
||||
}
|
||||
|
||||
func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
|
||||
return &Repository{db: db, redis: redis}
|
||||
}
|
||||
|
||||
func (r *Repository) List(page, pageSize int) (*PaginatedResult, error) {
|
||||
var total int64
|
||||
if err := r.db.Model(&model.AdminUser{}).Count(&total).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
offset := (page - 1) * pageSize
|
||||
var admins []model.AdminUser
|
||||
if err := r.db.Order("id DESC").Offset(offset).Limit(pageSize).Find(&admins).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items := make([]AdminUserDTO, 0, len(admins))
|
||||
for _, admin := range admins {
|
||||
roles, _ := r.getAdminRoles(admin.ID)
|
||||
items = append(items, AdminUserDTO{
|
||||
ID: admin.ID,
|
||||
Username: admin.Username,
|
||||
Nickname: admin.Nickname,
|
||||
Status: admin.Status,
|
||||
Roles: roles,
|
||||
LastLoginAt: admin.LastLoginAt,
|
||||
CreatedAt: admin.CreatedAt,
|
||||
UpdatedAt: admin.UpdatedAt,
|
||||
})
|
||||
}
|
||||
return &PaginatedResult{Items: items, Total: total, Page: page, PageSize: pageSize}, nil
|
||||
}
|
||||
|
||||
func (r *Repository) FindByID(id uint64) (*AdminUserDTO, error) {
|
||||
var admin model.AdminUser
|
||||
if err := r.db.First(&admin, id).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
roles, _ := r.getAdminRoles(admin.ID)
|
||||
dto := AdminUserDTO{
|
||||
ID: admin.ID,
|
||||
Username: admin.Username,
|
||||
Nickname: admin.Nickname,
|
||||
Status: admin.Status,
|
||||
Roles: roles,
|
||||
LastLoginAt: admin.LastLoginAt,
|
||||
CreatedAt: admin.CreatedAt,
|
||||
UpdatedAt: admin.UpdatedAt,
|
||||
}
|
||||
return &dto, nil
|
||||
}
|
||||
|
||||
func (r *Repository) Create(req CreateAdminRequest) (*AdminUserDTO, error) {
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
admin := model.AdminUser{
|
||||
Username: req.Username,
|
||||
PasswordHash: string(hash),
|
||||
Nickname: req.Nickname,
|
||||
Status: "active",
|
||||
}
|
||||
if err := r.db.Create(&admin).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return r.FindByID(admin.ID)
|
||||
}
|
||||
|
||||
func (r *Repository) Update(id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
|
||||
var admin model.AdminUser
|
||||
if err := r.db.First(&admin, id).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if req.Nickname != "" {
|
||||
admin.Nickname = req.Nickname
|
||||
}
|
||||
if req.Status != "" {
|
||||
admin.Status = req.Status
|
||||
}
|
||||
if err := r.db.Save(&admin).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return r.FindByID(id)
|
||||
}
|
||||
|
||||
func (r *Repository) Delete(id uint64, currentAdminID uint64) error {
|
||||
if id == currentAdminID {
|
||||
return ErrCannotDeleteSelf
|
||||
}
|
||||
var admin model.AdminUser
|
||||
if err := r.db.First(&admin, id).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
// 检查是否是最后一个 super_admin
|
||||
isLastSuper, err := r.isLastSuperAdmin(id)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if isLastSuper {
|
||||
return ErrLastSuperAdmin
|
||||
}
|
||||
return r.db.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Where("admin_user_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tx.Delete(&model.AdminUser{}, id).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
r.invalidatePermCache(id)
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
func (r *Repository) AssignRoles(adminID uint64, roleIDs []uint64) error {
|
||||
var admin model.AdminUser
|
||||
if err := r.db.First(&admin, adminID).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
err := r.db.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Where("admin_user_id = ?", adminID).Delete(&model.AdminUserRole{}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
for _, rid := range roleIDs {
|
||||
aur := model.AdminUserRole{AdminID: adminID, RoleID: rid}
|
||||
if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&aur).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
r.invalidatePermCache(adminID)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Repository) ChangePassword(id uint64, oldPwd, newPwd string) error {
|
||||
var admin model.AdminUser
|
||||
if err := r.db.First(&admin, id).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(oldPwd)); err != nil {
|
||||
return ErrWrongPassword
|
||||
}
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return r.db.Model(&admin).Update("password_hash", string(hash)).Error
|
||||
}
|
||||
|
||||
func (r *Repository) GetPermissionCodes(adminID uint64) ([]string, error) {
|
||||
var codes []string
|
||||
err := r.db.Table("admin_user_roles aur").
|
||||
Select("DISTINCT p.code").
|
||||
Joins("JOIN role_permissions rp ON rp.role_id = aur.role_id").
|
||||
Joins("JOIN permissions p ON p.id = rp.permission_id").
|
||||
Where("aur.admin_user_id = ?", adminID).
|
||||
Pluck("code", &codes).Error
|
||||
return codes, err
|
||||
}
|
||||
|
||||
func (r *Repository) getAdminRoles(adminID uint64) ([]adminrole.RoleDTO, error) {
|
||||
var roles []model.Role
|
||||
err := r.db.Table("roles").
|
||||
Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
|
||||
Where("aur.admin_user_id = ?", adminID).
|
||||
Find(&roles).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result := make([]adminrole.RoleDTO, 0, len(roles))
|
||||
for _, role := range roles {
|
||||
result = append(result, adminrole.RoleDTO{
|
||||
ID: role.ID, Code: role.Code, Name: role.Name, Description: role.Description,
|
||||
})
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (r *Repository) isLastSuperAdmin(adminID uint64) (bool, error) {
|
||||
var superRole model.Role
|
||||
if err := r.db.Where("code = ?", "super_admin").First(&superRole).Error; err != nil {
|
||||
return false, nil // 没有 super_admin 角色，不限制
|
||||
}
|
||||
var count int64
|
||||
err := r.db.Model(&model.AdminUserRole{}).
|
||||
Where("role_id = ? AND admin_user_id != ?", superRole.ID, adminID).
|
||||
Count(&count).Error
|
||||
return count == 0, err
|
||||
}
|
||||
|
||||
func (r *Repository) invalidatePermCache(adminID uint64) {
|
||||
if r.redis == nil {
|
||||
return
|
||||
}
|
||||
ctx := context.Background()
|
||||
r.redis.Del(ctx, permCacheKey(adminID))
|
||||
}
|
||||
|
||||
func permCacheKey(adminID uint64) string {
|
||||
return fmt.Sprintf("admin:perms:%d", adminID)
|
||||
}
|
||||
|
||||
var (
|
||||
ErrCannotDeleteSelf = errors.New("cannot delete self")
|
||||
ErrLastSuperAdmin = errors.New("cannot delete the last super admin")
|
||||
ErrWrongPassword = errors.New("wrong password")
|
||||
)
|
||||
|
||||
func IsNotFound(err error) bool {
|
||||
return errors.Is(err, gorm.ErrRecordNotFound)
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package adminmgr
|
||||
|
||||
import "errors"
|
||||
|
||||
var ErrDependencyUnavailable = errors.New("dependency unavailable")
|
||||
|
||||
type Service struct {
|
||||
repo *Repository
|
||||
}
|
||||
|
||||
func NewService(repo *Repository) *Service {
|
||||
return &Service{repo: repo}
|
||||
}
|
||||
|
||||
func (s *Service) List(page, pageSize int) (*PaginatedResult, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
if page < 1 {
|
||||
page = 1
|
||||
}
|
||||
if pageSize < 1 || pageSize > 100 {
|
||||
pageSize = 20
|
||||
}
|
||||
return s.repo.List(page, pageSize)
|
||||
}
|
||||
|
||||
func (s *Service) FindByID(id uint64) (*AdminUserDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.FindByID(id)
|
||||
}
|
||||
|
||||
func (s *Service) Create(req CreateAdminRequest) (*AdminUserDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
if len(req.Password) < 6 {
|
||||
return nil, errors.New("password too short")
|
||||
}
|
||||
return s.repo.Create(req)
|
||||
}
|
||||
|
||||
func (s *Service) Update(id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.Update(id, req)
|
||||
}
|
||||
|
||||
func (s *Service) Delete(id uint64, currentAdminID uint64) error {
|
||||
if s.repo == nil {
|
||||
return ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.Delete(id, currentAdminID)
|
||||
}
|
||||
|
||||
func (s *Service) AssignRoles(adminID uint64, req AssignRolesRequest) error {
|
||||
if s.repo == nil {
|
||||
return ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.AssignRoles(adminID, req.RoleIDs)
|
||||
}
|
||||
|
||||
func (s *Service) ChangePassword(id uint64, req ChangePasswordRequest) error {
|
||||
if s.repo == nil {
|
||||
return ErrDependencyUnavailable
|
||||
}
|
||||
if len(req.NewPassword) < 6 {
|
||||
return errors.New("new password too short")
|
||||
}
|
||||
return s.repo.ChangePassword(id, req.OldPassword, req.NewPassword)
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
package adminrole
|
||||
|
||||
import "time"
|
||||
|
||||
type RoleDTO struct {
|
||||
ID uint64 `json:"id"`
|
||||
Code string `json:"code"`
|
||||
Name string `json:"name"`
|
||||
Description string `json:"description"`
|
||||
PermCount int `json:"perm_count"`
|
||||
Permissions []PermissionDTO `json:"permissions,omitempty"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
UpdatedAt time.Time `json:"updated_at"`
|
||||
}
|
||||
|
||||
type PermissionDTO struct {
|
||||
ID uint64 `json:"id"`
|
||||
Code string `json:"code"`
|
||||
Name string `json:"name"`
|
||||
Resource string `json:"resource"`
|
||||
Action string `json:"action"`
|
||||
}
|
||||
|
||||
type CreateRoleRequest struct {
|
||||
Code string `json:"code" binding:"required"`
|
||||
Name string `json:"name" binding:"required"`
|
||||
Description string `json:"description"`
|
||||
}
|
||||
|
||||
type UpdateRoleRequest struct {
|
||||
Name string `json:"name" binding:"required"`
|
||||
Description string `json:"description"`
|
||||
}
|
||||
|
||||
type AssignPermissionsRequest struct {
|
||||
PermissionIDs []uint64 `json:"permission_ids"`
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
package adminrole
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"hfb_sys/backend/pkg/response"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type Handler struct {
|
||||
service *Service
|
||||
}
|
||||
|
||||
func NewHandler(service *Service) *Handler {
|
||||
return &Handler{service: service}
|
||||
}
|
||||
|
||||
func (h *Handler) List(c *gin.Context) {
|
||||
items, err := h.service.List()
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, items)
|
||||
}
|
||||
|
||||
func (h *Handler) FindByID(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
item, err := h.service.FindByID(id)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Create(c *gin.Context) {
|
||||
var req CreateRoleRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "角色编码和名称不能为空")
|
||||
return
|
||||
}
|
||||
item, err := h.service.Create(req)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.Created(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Update(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var req UpdateRoleRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "角色名称不能为空")
|
||||
return
|
||||
}
|
||||
item, err := h.service.Update(id, req)
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, item)
|
||||
}
|
||||
|
||||
func (h *Handler) Delete(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
if err := h.service.Delete(id); err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, gin.H{"deleted": true})
|
||||
}
|
||||
|
||||
func (h *Handler) AssignPermissions(c *gin.Context) {
|
||||
id, ok := parseID(c)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
var req AssignPermissionsRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
response.BadRequest(c, "请求格式不正确")
|
||||
return
|
||||
}
|
||||
if err := h.service.AssignPermissions(id, req); err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, gin.H{"updated": true})
|
||||
}
|
||||
|
||||
func (h *Handler) ListPermissions(c *gin.Context) {
|
||||
items, err := h.service.ListPermissions()
|
||||
if err != nil {
|
||||
writeError(c, err)
|
||||
return
|
||||
}
|
||||
response.OK(c, items)
|
||||
}
|
||||
|
||||
func parseID(c *gin.Context) (uint64, bool) {
|
||||
id, err := strconv.ParseUint(c.Param("id"), 10, 64)
|
||||
if err != nil || id == 0 {
|
||||
response.BadRequest(c, "ID 不正确")
|
||||
return 0, false
|
||||
}
|
||||
return id, true
|
||||
}
|
||||
|
||||
func writeError(c *gin.Context, err error) {
|
||||
switch {
|
||||
case errors.Is(err, ErrDependencyUnavailable):
|
||||
response.ServiceUnavailable(c, "数据库未连接")
|
||||
case errors.Is(err, ErrProtectedRole):
|
||||
response.BadRequest(c, "该角色为系统内置角色，不可删除")
|
||||
case IsNotFound(err):
|
||||
response.Error(c, http.StatusNotFound, "not_found", "角色不存在")
|
||||
default:
|
||||
response.Error(c, http.StatusInternalServerError, "internal_error", "角色管理服务暂时不可用")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,170 @@
|
||||
package adminrole
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
"hfb_sys/backend/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
"gorm.io/gorm/clause"
|
||||
)
|
||||
|
||||
type Repository struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
func NewRepository(db *gorm.DB) *Repository {
|
||||
return &Repository{db: db}
|
||||
}
|
||||
|
||||
func (r *Repository) List() ([]RoleDTO, error) {
|
||||
var roles []model.Role
|
||||
if err := r.db.Order("id ASC").Find(&roles).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result := make([]RoleDTO, 0, len(roles))
|
||||
for _, role := range roles {
|
||||
var count int64
|
||||
r.db.Model(&model.RolePermission{}).Where("role_id = ?", role.ID).Count(&count)
|
||||
result = append(result, RoleDTO{
|
||||
ID: role.ID,
|
||||
Code: role.Code,
|
||||
Name: role.Name,
|
||||
Description: role.Description,
|
||||
PermCount: int(count),
|
||||
CreatedAt: role.CreatedAt,
|
||||
UpdatedAt: role.UpdatedAt,
|
||||
})
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (r *Repository) FindByID(id uint64) (*RoleDTO, error) {
|
||||
var role model.Role
|
||||
if err := r.db.First(&role, id).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
perms, err := r.getRolePermissions(id)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
dto := RoleDTO{
|
||||
ID: role.ID,
|
||||
Code: role.Code,
|
||||
Name: role.Name,
|
||||
Description: role.Description,
|
||||
PermCount: len(perms),
|
||||
Permissions: perms,
|
||||
CreatedAt: role.CreatedAt,
|
||||
UpdatedAt: role.UpdatedAt,
|
||||
}
|
||||
return &dto, nil
|
||||
}
|
||||
|
||||
func (r *Repository) Create(req CreateRoleRequest) (*RoleDTO, error) {
|
||||
role := model.Role{
|
||||
Code: req.Code,
|
||||
Name: req.Name,
|
||||
Description: req.Description,
|
||||
}
|
||||
if err := r.db.Create(&role).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return r.FindByID(role.ID)
|
||||
}
|
||||
|
||||
func (r *Repository) Update(id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
|
||||
var role model.Role
|
||||
if err := r.db.First(&role, id).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
role.Name = req.Name
|
||||
role.Description = req.Description
|
||||
if err := r.db.Save(&role).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return r.FindByID(id)
|
||||
}
|
||||
|
||||
func (r *Repository) Delete(id uint64) error {
|
||||
var role model.Role
|
||||
if err := r.db.First(&role, id).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if role.Code == "super_admin" {
|
||||
return ErrProtectedRole
|
||||
}
|
||||
return r.db.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Where("role_id = ?", id).Delete(&model.RolePermission{}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tx.Where("role_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
return tx.Delete(&model.Role{}, id).Error
|
||||
})
|
||||
}
|
||||
|
||||
func (r *Repository) AssignPermissions(roleID uint64, permIDs []uint64) error {
|
||||
var role model.Role
|
||||
if err := r.db.First(&role, roleID).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
return r.db.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Where("role_id = ?", roleID).Delete(&model.RolePermission{}).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
for _, pid := range permIDs {
|
||||
rp := model.RolePermission{RoleID: roleID, PermissionID: pid}
|
||||
if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&rp).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
func (r *Repository) ListPermissions() ([]PermissionDTO, error) {
|
||||
var perms []model.Permission
|
||||
if err := r.db.Order("resource ASC, action ASC").Find(&perms).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result := make([]PermissionDTO, 0, len(perms))
|
||||
for _, p := range perms {
|
||||
result = append(result, PermissionDTO{
|
||||
ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
|
||||
})
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func (r *Repository) getRolePermissions(roleID uint64) ([]PermissionDTO, error) {
|
||||
var rps []model.RolePermission
|
||||
if err := r.db.Where("role_id = ?", roleID).Find(&rps).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(rps) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
ids := make([]uint64, 0, len(rps))
|
||||
for _, rp := range rps {
|
||||
ids = append(ids, rp.PermissionID)
|
||||
}
|
||||
var perms []model.Permission
|
||||
if err := r.db.Where("id IN ?", ids).Find(&perms).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
result := make([]PermissionDTO, 0, len(perms))
|
||||
for _, p := range perms {
|
||||
result = append(result, PermissionDTO{
|
||||
ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
|
||||
})
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
var ErrProtectedRole = errors.New("protected role")
|
||||
|
||||
func IsNotFound(err error) bool {
|
||||
return errors.Is(err, gorm.ErrRecordNotFound)
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
package adminrole
|
||||
|
||||
import "errors"
|
||||
|
||||
var ErrDependencyUnavailable = errors.New("dependency unavailable")
|
||||
|
||||
type Service struct {
|
||||
repo *Repository
|
||||
}
|
||||
|
||||
func NewService(repo *Repository) *Service {
|
||||
return &Service{repo: repo}
|
||||
}
|
||||
|
||||
func (s *Service) List() ([]RoleDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.List()
|
||||
}
|
||||
|
||||
func (s *Service) FindByID(id uint64) (*RoleDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.FindByID(id)
|
||||
}
|
||||
|
||||
func (s *Service) Create(req CreateRoleRequest) (*RoleDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
if req.Code == "" || req.Name == "" {
|
||||
return nil, errors.New("code and name are required")
|
||||
}
|
||||
return s.repo.Create(req)
|
||||
}
|
||||
|
||||
func (s *Service) Update(id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.Update(id, req)
|
||||
}
|
||||
|
||||
func (s *Service) Delete(id uint64) error {
|
||||
if s.repo == nil {
|
||||
return ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.Delete(id)
|
||||
}
|
||||
|
||||
func (s *Service) AssignPermissions(roleID uint64, req AssignPermissionsRequest) error {
|
||||
if s.repo == nil {
|
||||
return ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.AssignPermissions(roleID, req.PermissionIDs)
|
||||
}
|
||||
|
||||
func (s *Service) ListPermissions() ([]PermissionDTO, error) {
|
||||
if s.repo == nil {
|
||||
return nil, ErrDependencyUnavailable
|
||||
}
|
||||
return s.repo.ListPermissions()
|
||||
}
|
||||
Reference in New Issue
Block a user