增加权限系统

2026-05-27 05:41:59 +08:00
parent a04327fd05
commit 1458fc279c
29 changed files with 2276 additions and 46 deletions
@@ -0,0 +1,37 @@
+package adminrole
+
+import "time"
+
+type RoleDTO struct {
+	ID          uint64         `json:"id"`
+	Code        string         `json:"code"`
+	Name        string         `json:"name"`
+	Description string         `json:"description"`
+	PermCount   int            `json:"perm_count"`
+	Permissions []PermissionDTO `json:"permissions,omitempty"`
+	CreatedAt   time.Time      `json:"created_at"`
+	UpdatedAt   time.Time      `json:"updated_at"`
+}
+
+type PermissionDTO struct {
+	ID       uint64 `json:"id"`
+	Code     string `json:"code"`
+	Name     string `json:"name"`
+	Resource string `json:"resource"`
+	Action   string `json:"action"`
+}
+
+type CreateRoleRequest struct {
+	Code        string `json:"code" binding:"required"`
+	Name        string `json:"name" binding:"required"`
+	Description string `json:"description"`
+}
+
+type UpdateRoleRequest struct {
+	Name        string `json:"name" binding:"required"`
+	Description string `json:"description"`
+}
+
+type AssignPermissionsRequest struct {
+	PermissionIDs []uint64 `json:"permission_ids"`
+}
@@ -0,0 +1,133 @@
+package adminrole
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) List(c *gin.Context) {
+	items, err := h.service.List()
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, items)
+}
+
+func (h *Handler) FindByID(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	item, err := h.service.FindByID(id)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Create(c *gin.Context) {
+	var req CreateRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "角色编码和名称不能为空")
+		return
+	}
+	item, err := h.service.Create(req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.Created(c, item)
+}
+
+func (h *Handler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req UpdateRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "角色名称不能为空")
+		return
+	}
+	item, err := h.service.Update(id, req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.service.Delete(id); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": true})
+}
+
+func (h *Handler) AssignPermissions(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req AssignPermissionsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	if err := h.service.AssignPermissions(id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ListPermissions(c *gin.Context) {
+	items, err := h.service.ListPermissions()
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, items)
+}
+
+func parseID(c *gin.Context) (uint64, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		response.BadRequest(c, "ID 不正确")
+		return 0, false
+	}
+	return id, true
+}
+
+func writeError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库未连接")
+	case errors.Is(err, ErrProtectedRole):
+		response.BadRequest(c, "该角色为系统内置角色，不可删除")
+	case IsNotFound(err):
+		response.Error(c, http.StatusNotFound, "not_found", "角色不存在")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "角色管理服务暂时不可用")
+	}
+}
@@ -0,0 +1,170 @@
+package adminrole
+
+import (
+	"errors"
+
+	"hfb_sys/backend/internal/model"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+func NewRepository(db *gorm.DB) *Repository {
+	return &Repository{db: db}
+}
+
+func (r *Repository) List() ([]RoleDTO, error) {
+	var roles []model.Role
+	if err := r.db.Order("id ASC").Find(&roles).Error; err != nil {
+		return nil, err
+	}
+	result := make([]RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		var count int64
+		r.db.Model(&model.RolePermission{}).Where("role_id = ?", role.ID).Count(&count)
+		result = append(result, RoleDTO{
+			ID:          role.ID,
+			Code:        role.Code,
+			Name:        role.Name,
+			Description: role.Description,
+			PermCount:   int(count),
+			CreatedAt:   role.CreatedAt,
+			UpdatedAt:   role.UpdatedAt,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) FindByID(id uint64) (*RoleDTO, error) {
+	var role model.Role
+	if err := r.db.First(&role, id).Error; err != nil {
+		return nil, err
+	}
+	perms, err := r.getRolePermissions(id)
+	if err != nil {
+		return nil, err
+	}
+	dto := RoleDTO{
+		ID:          role.ID,
+		Code:        role.Code,
+		Name:        role.Name,
+		Description: role.Description,
+		PermCount:   len(perms),
+		Permissions: perms,
+		CreatedAt:   role.CreatedAt,
+		UpdatedAt:   role.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(req CreateRoleRequest) (*RoleDTO, error) {
+	role := model.Role{
+		Code:        req.Code,
+		Name:        req.Name,
+		Description: req.Description,
+	}
+	if err := r.db.Create(&role).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(role.ID)
+}
+
+func (r *Repository) Update(id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
+	var role model.Role
+	if err := r.db.First(&role, id).Error; err != nil {
+		return nil, err
+	}
+	role.Name = req.Name
+	role.Description = req.Description
+	if err := r.db.Save(&role).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(id)
+}
+
+func (r *Repository) Delete(id uint64) error {
+	var role model.Role
+	if err := r.db.First(&role, id).Error; err != nil {
+		return err
+	}
+	if role.Code == "super_admin" {
+		return ErrProtectedRole
+	}
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("role_id = ?", id).Delete(&model.RolePermission{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("role_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		return tx.Delete(&model.Role{}, id).Error
+	})
+}
+
+func (r *Repository) AssignPermissions(roleID uint64, permIDs []uint64) error {
+	var role model.Role
+	if err := r.db.First(&role, roleID).Error; err != nil {
+		return err
+	}
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("role_id = ?", roleID).Delete(&model.RolePermission{}).Error; err != nil {
+			return err
+		}
+		for _, pid := range permIDs {
+			rp := model.RolePermission{RoleID: roleID, PermissionID: pid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&rp).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+func (r *Repository) ListPermissions() ([]PermissionDTO, error) {
+	var perms []model.Permission
+	if err := r.db.Order("resource ASC, action ASC").Find(&perms).Error; err != nil {
+		return nil, err
+	}
+	result := make([]PermissionDTO, 0, len(perms))
+	for _, p := range perms {
+		result = append(result, PermissionDTO{
+			ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) getRolePermissions(roleID uint64) ([]PermissionDTO, error) {
+	var rps []model.RolePermission
+	if err := r.db.Where("role_id = ?", roleID).Find(&rps).Error; err != nil {
+		return nil, err
+	}
+	if len(rps) == 0 {
+		return nil, nil
+	}
+	ids := make([]uint64, 0, len(rps))
+	for _, rp := range rps {
+		ids = append(ids, rp.PermissionID)
+	}
+	var perms []model.Permission
+	if err := r.db.Where("id IN ?", ids).Find(&perms).Error; err != nil {
+		return nil, err
+	}
+	result := make([]PermissionDTO, 0, len(perms))
+	for _, p := range perms {
+		result = append(result, PermissionDTO{
+			ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
+		})
+	}
+	return result, nil
+}
+
+var ErrProtectedRole = errors.New("protected role")
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}
@@ -0,0 +1,65 @@
+package adminrole
+
+import "errors"
+
+var ErrDependencyUnavailable = errors.New("dependency unavailable")
+
+type Service struct {
+	repo *Repository
+}
+
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+func (s *Service) List() ([]RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.List()
+}
+
+func (s *Service) FindByID(id uint64) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.FindByID(id)
+}
+
+func (s *Service) Create(req CreateRoleRequest) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if req.Code == "" || req.Name == "" {
+		return nil, errors.New("code and name are required")
+	}
+	return s.repo.Create(req)
+}
+
+func (s *Service) Update(id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.Update(id, req)
+}
+
+func (s *Service) Delete(id uint64) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.Delete(id)
+}
+
+func (s *Service) AssignPermissions(roleID uint64, req AssignPermissionsRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.AssignPermissions(roleID, req.PermissionIDs)
+}
+
+func (s *Service) ListPermissions() ([]PermissionDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.ListPermissions()
+}