timi/TimiServerAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 57 Wiki Activity

refactor permission system

Browse Source
This commit is contained in:
Timi
2026-08-11 23:57:59 +08:00
parent 6e43ff349d
commit 39ac73dc66
60 changed files with 2300 additions and 335 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/imyeyu/api/modules/user/controller/PermissionController.java
+13 -8
View File
@@ -1,12 +1,12 @@
package com.imyeyu.api.modules.user.controller;
import com.imyeyu.api.annotation.RequireCorePermission;
import com.imyeyu.api.annotation.RequireCoreRole;
import com.imyeyu.api.bean.CorePermissionCode;
import com.imyeyu.api.bean.CoreRoleCode;
import com.imyeyu.api.bean.RoleMatchMode;
import com.imyeyu.api.bean.ModuleCode;
import com.imyeyu.api.modules.user.entity.Permission;
import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
import com.imyeyu.api.modules.user.service.PermissionService;
import com.imyeyu.api.modules.user.service.UserLoginService;
import com.imyeyu.api.modules.user.vo.permission.BatchCreateReq;
import com.imyeyu.spring.annotation.AOPLog;
import com.imyeyu.spring.bean.Page;
@@ -19,6 +19,8 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import java.util.List;
/**
* 权限 SDK 控制器
*
@@ -32,16 +34,22 @@ import org.springframework.web.bind.annotation.RestController;
public class PermissionController {
private final PermissionService service;
private final UserLoginService userLoginService;
private final AuthorizationScopeService authorizationScopeService;
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(CorePermissionCode.PERMISSION_READ)
@PostMapping("/list")
public PageResult<Permission> list(@RequestBody Page<Permission> page) {
return service.page(page);
}
@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
@PostMapping("/grantable/list")
public List<Permission> listGrantable(@RequestParam ModuleCode moduleCode) {
return authorizationScopeService.listGrantablePermission(userLoginService.getRequireLoginUserId(), moduleCode);
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.PERMISSION_READ)
@PostMapping("/create")
public void create(@RequestBody Permission permission) {
@@ -49,7 +57,6 @@ public class PermissionController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.PERMISSION_CREATE)
@PostMapping("/create/batch")
public void createBatch(@RequestBody BatchCreateReq req) {
@@ -57,7 +64,6 @@ public class PermissionController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.PERMISSION_UPDATE)
@PostMapping("/update")
public void update(@RequestBody Permission permission) {
@@ -65,7 +71,6 @@ public class PermissionController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.PERMISSION_DELETE)
@PostMapping("/delete")
public void delete(@RequestParam("id") String id) {
src/main/java/com/imyeyu/api/modules/user/controller/RoleController.java
+101 -14
View File
@@ -1,18 +1,19 @@
package com.imyeyu.api.modules.user.controller;
import com.imyeyu.api.annotation.RequireCorePermission;
import com.imyeyu.api.annotation.RequireCoreRole;
import com.imyeyu.api.bean.CorePermissionCode;
import com.imyeyu.api.bean.CoreRoleCode;
import com.imyeyu.api.bean.ModuleCode;
import com.imyeyu.api.bean.RoleMatchMode;
import com.imyeyu.api.modules.user.entity.Permission;
import com.imyeyu.api.modules.user.entity.Role;
import com.imyeyu.api.modules.user.service.PermissionService;
import com.imyeyu.api.modules.user.service.RoleService;
import com.imyeyu.api.modules.user.service.UserLoginService;
import com.imyeyu.api.modules.user.service.UserRoleService;
import com.imyeyu.api.modules.user.vo.role.UserRoleAuthorizeRequest;
import com.imyeyu.java.bean.timi.TimiCode;
import com.imyeyu.java.bean.timi.TimiException;
import com.imyeyu.spring.annotation.AOPLog;
import com.imyeyu.spring.annotation.RequiredToken;
import com.imyeyu.spring.bean.Page;
import com.imyeyu.spring.bean.PageResult;
import lombok.RequiredArgsConstructor;
@@ -23,7 +24,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import java.util.Arrays;
import java.util.List;
import java.util.Set;
import java.util.stream.Collectors;
/**
* 角色 SDK 控制器
@@ -39,30 +43,52 @@ public class RoleController {
private final RoleService service;
private final UserRoleService userRoleService;
private final UserLoginService userLoginService;
private final PermissionService permissionService;
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(CorePermissionCode.ROLE_READ)
@PostMapping("/list")
public PageResult<Role> list(@RequestBody Page<Role> page) {
Set<String> manageableRoleIdSet = listManageableRoleId();
PageResult<Role> result = service.page(page);
if (result.getList() != null) {
result.setList(result.getList().stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList());
result.getList().forEach(this::fillRoleDetail);
}
return result;
}
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(CorePermissionCode.ROLE_READ)
@PostMapping("/manageable/list")
public List<Role> listManageableRole(@RequestParam ModuleCode moduleCode) {
return service.listManageableRole(moduleCode);
}
@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
@PostMapping("/grantable/list")
public List<Role> listGrantableRole(@RequestParam ModuleCode moduleCode) {
return service.listGrantableRole(moduleCode);
}
@RequiredToken
@PostMapping("/current/detail/list")
public List<Role> listCurrentRoleDetail(@RequestParam(required = false) ModuleCode moduleCode) {
String loginUserId = userLoginService.getRequireLoginUserId();
List<Role> roleList = moduleCode == null ? userRoleService.listRoleByUserId(loginUserId) : userRoleService.listRoleByUserId(moduleCode, loginUserId);
roleList.forEach(this::fillRoleDetail);
return roleList;
}
@RequireCorePermission(CorePermissionCode.ROLE_READ)
@PostMapping("/detail")
public Role detail(@RequestParam String id) {
Role role = service.get(id);
requireManageableRole(role.getId());
fillRoleDetail(role);
return role;
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.ROLE_CREATE)
@PostMapping("/create")
public void create(@RequestBody Role role) {
@@ -70,49 +96,110 @@ public class RoleController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.ROLE_UPDATE)
@PostMapping("/update")
public void update(@RequestBody Role role) {
service.update(role);
}
@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
@PostMapping("/permission/grantable/list")
public List<Permission> listGrantableRolePermission(@RequestParam String roleId) {
requireManageableRole(roleId);
return service.listGrantableRolePermission(roleId);
}
@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
@PostMapping("/delegation/list")
public List<Permission> listDelegationPermission(@RequestParam String roleId) {
requireManageableRole(roleId);
return service.listDelegationPermissionByRoleId(roleId);
}
@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
@PostMapping("/delegation/grantable/list")
public List<Permission> listGrantableDelegationPermission(@RequestParam String roleId) {
requireManageableRole(roleId);
return service.listGrantableDelegationPermission(roleId);
}
@AOPLog
@RequireCorePermission(value = {CorePermissionCode.ROLE_PERMISSION_CREATE, CorePermissionCode.ROLE_PERMISSION_DELETE})
@PostMapping("/delegation/update")
public void updateRoleDelegation(@RequestBody Role role) {
service.updateRoleDelegation(role);
}
@RequireCorePermission(CorePermissionCode.ROLE_READ)
@PostMapping("/parent/grantable/list")
public List<Role> listGrantableParentRole(@RequestParam String roleId) {
requireManageableRole(roleId);
return service.listGrantableParentRole(roleId);
}
@AOPLog
@RequireCorePermission(CorePermissionCode.ROLE_UPDATE)
@PostMapping("/parent/update")
public void updateRoleParent(@RequestBody Role role) {
service.updateRoleParent(role);
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequireCorePermission(CorePermissionCode.ROLE_DELETE)
@PostMapping("/delete")
public void delete(@RequestParam String id) {
service.delete(id);
}
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
@PostMapping("/authorized/list")
public List<Role> listUserRole(@RequestParam(required = false) ModuleCode moduleCode, @RequestParam String userId) {
Set<String> manageableRoleIdSet = listManageableRoleId();
if (moduleCode != null) {
return userRoleService.listRoleByUserId(moduleCode, userId);
return userRoleService.listRoleByUserId(moduleCode, userId).stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList();
}
return userRoleService.listRoleByUserId(userId);
return userRoleService.listRoleByUserId(userId).stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList();
}
@AOPLog
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(value = {CorePermissionCode.USER_ROLE_CREATE, CorePermissionCode.USER_ROLE_DELETE})
@PostMapping("/authorized/create")
public void authorizeUserRole(@RequestBody UserRoleAuthorizeRequest req) {
userRoleService.authorizeUserRole(req);
}
@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
@PostMapping("/authorized/permission")
public List<Permission> listAuthorizedPermission(@RequestParam String userId) {
return userRoleService.listAllPermissionByUserId(userId);
Set<String> manageableRoleIdSet = listManageableRoleId();
List<String> roleIdList = userRoleService.listRoleByUserId(userId)
.stream()
.filter(role -> manageableRoleIdSet.contains(role.getId()))
.map(Role::getId)
.toList();
return roleIdList.isEmpty() ? List.of() : permissionService.listByRoleId(service.listAllRoleIdIncludingChildren(roleIdList));
}
private void fillRoleDetail(Role role) {
role.setPermissionList(permissionService.listByRoleId(role.getId()));
role.setAllPermissionList(service.listPermissionByRoleId(role.getId()));
role.setChildRoleList(service.listChildByParentRoleId(role.getId()));
if (role.getParentRoleId() != null) {
role.setParentRole(service.get(role.getParentRoleId()));
}
role.setDelegationPermissionList(service.listDelegationPermissionByRoleId(role.getId()));
}
private Set<String> listManageableRoleId() {
return Arrays.stream(ModuleCode.values())
.flatMap(moduleCode -> service.listManageableRole(moduleCode).stream())
.map(Role::getId)
.collect(Collectors.toSet());
}
private void requireManageableRole(String roleId) {
if (!listManageableRoleId().contains(roleId)) {
throw new TimiException(TimiCode.PERMISSION_ERROR);
}
}
}
src/main/java/com/imyeyu/api/modules/user/controller/UserController.java
+1 -7
View File
@@ -2,9 +2,7 @@ package com.imyeyu.api.modules.user.controller;
import com.fasterxml.jackson.annotation.JsonView;
import com.imyeyu.api.annotation.RequireCorePermission;
import com.imyeyu.api.annotation.RequireCoreRole;
import com.imyeyu.api.bean.CorePermissionCode;
import com.imyeyu.api.bean.CoreRoleCode;
import com.imyeyu.api.modules.common.entity.Attachment;
import com.imyeyu.api.modules.common.service.AttachmentService;
import com.imyeyu.api.modules.user.entity.User;
@@ -56,7 +54,6 @@ public class UserController {
private final UserLoginService userLoginService;
private final AttachmentService attachmentService;
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequestRateLimit
@RequireCorePermission(CorePermissionCode.USER_READ)
@PostMapping("/list")
@@ -65,7 +62,6 @@ public class UserController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequestRateLimit
@RequireCorePermission(CorePermissionCode.USER_READ)
@RequestMapping("/detail")
@@ -74,7 +70,6 @@ public class UserController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequestRateLimit
@RequireCorePermission(CorePermissionCode.USER_CREATE)
@PostMapping("/create")
@@ -83,7 +78,6 @@ public class UserController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequestRateLimit
@RequireCorePermission(CorePermissionCode.USER_UPDATE)
@PostMapping("/update")
@@ -92,7 +86,6 @@ public class UserController {
}
@AOPLog
@RequireCoreRole(CoreRoleCode.ADMIN)
@RequestRateLimit
@RequestMapping("/delete")
public void delete(@RequestParam String id) {
@@ -125,6 +118,7 @@ public class UserController {
@AOPLog
@JsonView(ResponseView.Public.class)
@RequestRateLimit
@CaptchaValid
@PostMapping("/login")
public LoginResponse login(@RequestBody @Valid CaptchaData<LoginRequest> req) {
return userLoginService.login(req.getData());