458 lines
16 KiB
Go
458 lines
16 KiB
Go
package handler
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"sort"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"gorm.io/gorm"
|
|
"kefu-cloud/server/internal/middleware"
|
|
"kefu-cloud/server/internal/model"
|
|
)
|
|
|
|
type PermissionHandler struct{}
|
|
|
|
func NewPermissionHandler() *PermissionHandler { return &PermissionHandler{} }
|
|
|
|
func ensurePermissionData(tenantID uint) error {
|
|
if err := model.EnsurePermissions(); err != nil {
|
|
return err
|
|
}
|
|
return model.EnsureBuiltinRoles(tenantID)
|
|
}
|
|
|
|
// ListPermissions 获取所有系统权限码（全租户共享，供权限配置页使用）。
|
|
func (h *PermissionHandler) ListPermissions(c *gin.Context) {
|
|
if err := ensurePermissionData(middleware.GetTenantID(c)); err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "初始化权限数据失败"})
|
|
return
|
|
}
|
|
var permissions []model.Permission
|
|
if err := model.DB.Order("sort_order asc").Find(&permissions).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "查询失败"})
|
|
return
|
|
}
|
|
middleware.JSON(c, permissions)
|
|
}
|
|
|
|
// ListRoles 获取当前租户的角色列表（含成员数、权限数）。
|
|
func (h *PermissionHandler) ListRoles(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
if err := ensurePermissionData(tenantID); err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "初始化权限数据失败"})
|
|
return
|
|
}
|
|
var roles []model.Role
|
|
if err := model.DB.Where("tenant_id = ?", tenantID).Order("id asc").Find(&roles).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "查询失败"})
|
|
return
|
|
}
|
|
|
|
type roleWithStats struct {
|
|
model.Role
|
|
MemberCount int64 `json:"member_count"`
|
|
PermCount int64 `json:"perm_count"`
|
|
}
|
|
result := make([]roleWithStats, len(roles))
|
|
for i, role := range roles {
|
|
result[i].Role = role
|
|
if err := model.DB.Model(&model.User{}).Where("tenant_id = ? AND role = ?", tenantID, role.Code).Count(&result[i].MemberCount).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "统计角色成员失败"})
|
|
return
|
|
}
|
|
if err := model.DB.Model(&model.RolePermission{}).Where("role_id = ?", role.ID).Count(&result[i].PermCount).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "统计角色权限失败"})
|
|
return
|
|
}
|
|
}
|
|
middleware.JSON(c, result)
|
|
}
|
|
|
|
type roleAccessSnapshot struct {
|
|
Permissions []string `json:"permissions"`
|
|
DataScopes map[string]string `json:"data_scopes"`
|
|
}
|
|
|
|
func loadRoleAccess(tx *gorm.DB, role model.Role) (roleAccessSnapshot, error) {
|
|
snapshot := roleAccessSnapshot{Permissions: []string{}, DataScopes: model.DefaultRoleDataScopes(role.Code)}
|
|
if err := tx.Table("role_permissions rp").
|
|
Joins("JOIN permissions p ON p.id = rp.permission_id").
|
|
Where("rp.role_id = ?", role.ID).
|
|
Order("p.sort_order asc").
|
|
Pluck("p.code", &snapshot.Permissions).Error; err != nil {
|
|
return snapshot, err
|
|
}
|
|
var scopes []model.RoleDataScope
|
|
if err := tx.Where("role_id = ?", role.ID).Find(&scopes).Error; err != nil {
|
|
return snapshot, err
|
|
}
|
|
for _, scope := range scopes {
|
|
snapshot.DataScopes[scope.Module] = scope.Scope
|
|
}
|
|
return snapshot, nil
|
|
}
|
|
|
|
// GetRole 获取角色详情（含权限码与数据范围）。
|
|
func (h *PermissionHandler) GetRole(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
var role model.Role
|
|
if err := model.DB.Where("id = ? AND tenant_id = ?", c.Param("id"), tenantID).First(&role).Error; err != nil {
|
|
c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "角色不存在"})
|
|
return
|
|
}
|
|
access, err := loadRoleAccess(model.DB, role)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "查询角色权限失败"})
|
|
return
|
|
}
|
|
var memberCount int64
|
|
if err := model.DB.Model(&model.User{}).Where("tenant_id = ? AND role = ?", tenantID, role.Code).Count(&memberCount).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "统计角色成员失败"})
|
|
return
|
|
}
|
|
middleware.JSON(c, gin.H{
|
|
"role": role, "permissions": access.Permissions,
|
|
"data_scopes": access.DataScopes, "member_count": memberCount,
|
|
})
|
|
}
|
|
|
|
type saveRoleReq struct {
|
|
Name *string `json:"name"`
|
|
Desc *string `json:"desc"`
|
|
Permissions []string `json:"permissions"`
|
|
DataScopes map[string]string `json:"data_scopes"`
|
|
}
|
|
|
|
func validateRoleName(name string) (string, error) {
|
|
name = strings.TrimSpace(name)
|
|
if name == "" || len([]rune(name)) > 50 {
|
|
return "", errors.New("角色名称需 1-50 个字符")
|
|
}
|
|
return name, nil
|
|
}
|
|
|
|
func validateRoleAccess(tx *gorm.DB, permissions []string, dataScopes map[string]string) ([]model.Permission, error) {
|
|
uniqueCodes := make(map[string]struct{}, len(permissions))
|
|
for _, code := range permissions {
|
|
code = strings.TrimSpace(code)
|
|
if code != "" {
|
|
uniqueCodes[code] = struct{}{}
|
|
}
|
|
}
|
|
codes := make([]string, 0, len(uniqueCodes))
|
|
for code := range uniqueCodes {
|
|
codes = append(codes, code)
|
|
}
|
|
sort.Strings(codes)
|
|
var records []model.Permission
|
|
if len(codes) > 0 {
|
|
if err := tx.Where("code IN ?", codes).Order("sort_order asc").Find(&records).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
if len(records) != len(codes) {
|
|
return nil, errors.New("包含无效权限码")
|
|
}
|
|
}
|
|
|
|
selected := make(map[string]bool, len(records))
|
|
moduleViews := make(map[string][]string)
|
|
for _, permission := range records {
|
|
selected[permission.Code] = true
|
|
}
|
|
var allPermissions []model.Permission
|
|
if err := tx.Order("sort_order asc").Find(&allPermissions).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
for _, permission := range allPermissions {
|
|
if permission.Category == "view" {
|
|
moduleViews[permission.Module] = append(moduleViews[permission.Module], permission.Code)
|
|
}
|
|
}
|
|
for _, permission := range records {
|
|
if permission.Category != "operate" || len(moduleViews[permission.Module]) == 0 {
|
|
continue
|
|
}
|
|
hasView := false
|
|
for _, viewCode := range moduleViews[permission.Module] {
|
|
hasView = hasView || selected[viewCode]
|
|
}
|
|
if !hasView {
|
|
return nil, errors.New(permission.Module + "的操作权限必须同时启用查看权限")
|
|
}
|
|
}
|
|
|
|
allowedModules := make(map[string]bool)
|
|
for _, module := range model.DataScopeModules() {
|
|
allowedModules[module] = true
|
|
}
|
|
for module, scope := range dataScopes {
|
|
if !allowedModules[module] || (scope != model.DataScopeAll && scope != model.DataScopeSelf) {
|
|
return nil, errors.New("包含无效数据范围")
|
|
}
|
|
}
|
|
return records, nil
|
|
}
|
|
|
|
func saveRoleAccess(tx *gorm.DB, role model.Role, permissions []string, dataScopes map[string]string) error {
|
|
records, err := validateRoleAccess(tx, permissions, dataScopes)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := tx.Where("role_id = ?", role.ID).Delete(&model.RolePermission{}).Error; err != nil {
|
|
return err
|
|
}
|
|
for _, permission := range records {
|
|
if err := tx.Create(&model.RolePermission{RoleID: role.ID, PermissionID: permission.ID}).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
for module, scope := range dataScopes {
|
|
item := model.RoleDataScope{RoleID: role.ID, Module: module}
|
|
if err := tx.Where(item).Assign(model.RoleDataScope{Scope: scope}).FirstOrCreate(&item).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
// UpdatedAt 同时作为前端权限缓存版本，关联表变更时也必须推进。
|
|
return tx.Model(&role).UpdateColumn("updated_at", time.Now()).Error
|
|
}
|
|
|
|
func newCustomRoleCode() (string, error) {
|
|
random := make([]byte, 8)
|
|
if _, err := rand.Read(random); err != nil {
|
|
return "", err
|
|
}
|
|
return "custom_" + hex.EncodeToString(random), nil
|
|
}
|
|
|
|
// CreateRole 创建自定义角色。
|
|
func (h *PermissionHandler) CreateRole(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
var req saveRoleReq
|
|
if err := c.ShouldBindJSON(&req); err != nil || req.Name == nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
|
|
return
|
|
}
|
|
name, err := validateRoleName(*req.Name)
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
|
|
return
|
|
}
|
|
var duplicate int64
|
|
if err := model.DB.Model(&model.Role{}).Where("tenant_id = ? AND name = ?", tenantID, name).Count(&duplicate).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "检查角色名称失败"})
|
|
return
|
|
}
|
|
if duplicate > 0 {
|
|
c.JSON(http.StatusConflict, gin.H{"code": 409, "message": "角色名称已被占用"})
|
|
return
|
|
}
|
|
code, err := newCustomRoleCode()
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "生成角色标识失败"})
|
|
return
|
|
}
|
|
desc := ""
|
|
if req.Desc != nil {
|
|
desc = strings.TrimSpace(*req.Desc)
|
|
}
|
|
role := model.Role{TenantID: tenantID, Name: name, Code: code, Type: "custom", Desc: desc}
|
|
dataScopes := req.DataScopes
|
|
if dataScopes == nil {
|
|
dataScopes = model.DefaultRoleDataScopes(role.Code)
|
|
}
|
|
if err := model.DB.Transaction(func(tx *gorm.DB) error {
|
|
if err := tx.Create(&role).Error; err != nil {
|
|
return err
|
|
}
|
|
return saveRoleAccess(tx, role, req.Permissions, dataScopes)
|
|
}); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
|
|
return
|
|
}
|
|
middleware.InvalidatePermissionCache(tenantID, role.Code)
|
|
logPermissionChange(c, "create_role", role, roleAccessSnapshot{}, roleAccessSnapshot{Permissions: req.Permissions, DataScopes: dataScopes})
|
|
middleware.JSON(c, role)
|
|
}
|
|
|
|
// UpdateRole 更新自定义角色信息、权限与数据范围，角色标识保持不变。
|
|
func (h *PermissionHandler) UpdateRole(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
var role model.Role
|
|
if err := model.DB.Where("id = ? AND tenant_id = ?", c.Param("id"), tenantID).First(&role).Error; err != nil {
|
|
c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "角色不存在"})
|
|
return
|
|
}
|
|
if role.Type == "builtin" {
|
|
c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "内置角色请使用专用配置接口"})
|
|
return
|
|
}
|
|
var req saveRoleReq
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "参数错误"})
|
|
return
|
|
}
|
|
before, err := loadRoleAccess(model.DB, role)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "读取原权限失败"})
|
|
return
|
|
}
|
|
if req.Permissions == nil {
|
|
req.Permissions = before.Permissions
|
|
}
|
|
if req.DataScopes == nil {
|
|
req.DataScopes = before.DataScopes
|
|
}
|
|
updates := map[string]interface{}{}
|
|
if req.Name != nil {
|
|
name, err := validateRoleName(*req.Name)
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
|
|
return
|
|
}
|
|
var duplicate int64
|
|
model.DB.Model(&model.Role{}).Where("tenant_id = ? AND name = ? AND id <> ?", tenantID, name, role.ID).Count(&duplicate)
|
|
if duplicate > 0 {
|
|
c.JSON(http.StatusConflict, gin.H{"code": 409, "message": "角色名称已被占用"})
|
|
return
|
|
}
|
|
updates["name"] = name
|
|
}
|
|
if req.Desc != nil {
|
|
updates["desc"] = strings.TrimSpace(*req.Desc)
|
|
}
|
|
if err := model.DB.Transaction(func(tx *gorm.DB) error {
|
|
if len(updates) > 0 {
|
|
if err := tx.Model(&role).Updates(updates).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return saveRoleAccess(tx, role, req.Permissions, req.DataScopes)
|
|
}); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
|
|
return
|
|
}
|
|
model.DB.First(&role, role.ID)
|
|
after, _ := loadRoleAccess(model.DB, role)
|
|
middleware.InvalidatePermissionCache(tenantID, role.Code)
|
|
logPermissionChange(c, "update_role", role, before, after)
|
|
middleware.JSON(c, role)
|
|
}
|
|
|
|
// UpdateBuiltinRole 更新内置角色权限与数据范围，不允许清空权限或修改标识。
|
|
func (h *PermissionHandler) UpdateBuiltinRole(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
var role model.Role
|
|
if err := model.DB.Where("id = ? AND tenant_id = ?", c.Param("id"), tenantID).First(&role).Error; err != nil {
|
|
c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "角色不存在"})
|
|
return
|
|
}
|
|
if role.Type != "builtin" {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "仅内置角色可使用此接口"})
|
|
return
|
|
}
|
|
var req saveRoleReq
|
|
if err := c.ShouldBindJSON(&req); err != nil || len(req.Permissions) == 0 {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "内置角色至少需要一项权限"})
|
|
return
|
|
}
|
|
before, err := loadRoleAccess(model.DB, role)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "读取原权限失败"})
|
|
return
|
|
}
|
|
if req.DataScopes == nil {
|
|
req.DataScopes = before.DataScopes
|
|
}
|
|
if role.Code == "admin" {
|
|
required := map[string]bool{
|
|
"permission.view": false, "permission.create_role": false,
|
|
"permission.delete_role": false, "permission.assign_role": false,
|
|
}
|
|
for _, code := range req.Permissions {
|
|
if _, exists := required[code]; exists {
|
|
required[code] = true
|
|
}
|
|
}
|
|
for _, enabled := range required {
|
|
if !enabled {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "管理员必须保留全部权限控制权限"})
|
|
return
|
|
}
|
|
}
|
|
for _, module := range model.DataScopeModules() {
|
|
req.DataScopes[module] = model.DataScopeAll
|
|
}
|
|
}
|
|
if err := model.DB.Transaction(func(tx *gorm.DB) error {
|
|
if req.Desc != nil {
|
|
if err := tx.Model(&role).Update("desc", strings.TrimSpace(*req.Desc)).Error; err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return saveRoleAccess(tx, role, req.Permissions, req.DataScopes)
|
|
}); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
|
|
return
|
|
}
|
|
model.DB.First(&role, role.ID)
|
|
after, _ := loadRoleAccess(model.DB, role)
|
|
middleware.InvalidatePermissionCache(tenantID, role.Code)
|
|
logPermissionChange(c, "update_builtin_role", role, before, after)
|
|
middleware.JSON(c, role)
|
|
}
|
|
|
|
// DeleteRole 删除无成员绑定的自定义角色。
|
|
func (h *PermissionHandler) DeleteRole(c *gin.Context) {
|
|
tenantID := middleware.GetTenantID(c)
|
|
var role model.Role
|
|
if err := model.DB.Where("id = ? AND tenant_id = ?", c.Param("id"), tenantID).First(&role).Error; err != nil {
|
|
c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "角色不存在"})
|
|
return
|
|
}
|
|
if role.Type == "builtin" {
|
|
c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "内置角色不可删除"})
|
|
return
|
|
}
|
|
var memberCount int64
|
|
if err := model.DB.Model(&model.User{}).Where("tenant_id = ? AND role = ?", tenantID, role.Code).Count(&memberCount).Error; err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "检查角色成员失败"})
|
|
return
|
|
}
|
|
if memberCount > 0 {
|
|
c.JSON(http.StatusConflict, gin.H{"code": 409, "message": "请先为该角色下的成员更换角色", "member_count": memberCount})
|
|
return
|
|
}
|
|
before, _ := loadRoleAccess(model.DB, role)
|
|
if err := model.DB.Transaction(func(tx *gorm.DB) error {
|
|
if err := tx.Where("role_id = ?", role.ID).Delete(&model.RolePermission{}).Error; err != nil {
|
|
return err
|
|
}
|
|
if err := tx.Where("role_id = ?", role.ID).Delete(&model.RoleDataScope{}).Error; err != nil {
|
|
return err
|
|
}
|
|
return tx.Delete(&role).Error
|
|
}); err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "删除失败"})
|
|
return
|
|
}
|
|
middleware.InvalidatePermissionCache(tenantID, role.Code)
|
|
logPermissionChange(c, "delete_role", role, before, roleAccessSnapshot{})
|
|
middleware.JSON(c, gin.H{"message": "已删除"})
|
|
}
|
|
|
|
func logPermissionChange(c *gin.Context, action string, role model.Role, before, after roleAccessSnapshot) {
|
|
detail, _ := json.Marshal(gin.H{
|
|
"role": role.Name, "code": role.Code, "before": before, "after": after,
|
|
})
|
|
model.DB.Create(&model.OperationLog{
|
|
OperatorID: middleware.GetUserID(c), Action: action, Detail: string(detail),
|
|
TargetType: "role", TargetID: &role.ID, IP: c.ClientIP(),
|
|
})
|
|
}
|