refactor permission system
This commit is contained in:
Timi
@@ -1,5 +1,7 @@
|
||||
package com.imyeyu.api.util;
|
||||
|
||||
import com.imyeyu.api.bean.CorePermissionCode;
|
||||
import com.imyeyu.api.bean.CoreRoleCode;
|
||||
import com.imyeyu.api.bean.ModuleCode;
|
||||
import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
|
||||
import com.imyeyu.api.modules.common.bean.ImageType;
|
||||
@@ -14,16 +16,18 @@ import com.imyeyu.api.modules.user.bean.BuiltinRoleCode;
|
||||
import com.imyeyu.api.modules.user.entity.Permission;
|
||||
import com.imyeyu.api.modules.user.entity.Role;
|
||||
import com.imyeyu.api.modules.user.entity.RolePermission;
|
||||
import com.imyeyu.api.modules.user.entity.RoleRelation;
|
||||
import com.imyeyu.api.modules.user.entity.RolePermissionDelegation;
|
||||
import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
|
||||
import com.imyeyu.api.modules.user.entity.User;
|
||||
import com.imyeyu.api.modules.user.entity.UserRole;
|
||||
import com.imyeyu.api.modules.user.mapper.PermissionMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.RoleMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.RoleRelationMapper;
|
||||
import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
|
||||
import com.imyeyu.api.modules.user.service.PermissionService;
|
||||
import com.imyeyu.api.modules.user.service.RoleRelationService;
|
||||
import com.imyeyu.api.modules.user.service.RolePermissionInheritService;
|
||||
import com.imyeyu.api.modules.user.service.RoleService;
|
||||
import com.imyeyu.api.modules.user.service.UserRoleService;
|
||||
import com.imyeyu.api.modules.user.service.UserService;
|
||||
@@ -53,13 +57,14 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
private final LoggerService loggerService;
|
||||
private final UserRoleService userRoleService;
|
||||
private final PermissionService permissionService;
|
||||
private final RoleRelationService roleRelationService;
|
||||
private final RolePermissionInheritService rolePermissionInheritService;
|
||||
|
||||
private final RoleMapper roleMapper;
|
||||
private final UserRoleMapper userRoleMapper;
|
||||
private final PermissionMapper permissionMapper;
|
||||
private final RolePermissionMapper rolePermissionMapper;
|
||||
private final RoleRelationMapper roleRelationMapper;
|
||||
private final RolePermissionDelegationMapper rolePermissionDelegationMapper;
|
||||
private final RolePermissionInheritMapper rolePermissionInheritMapper;
|
||||
|
||||
/**
|
||||
* 初始化内建数据
|
||||
@@ -73,8 +78,10 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
// 先同步所有内建权限和角色，再补齐继承与默认授权关系
|
||||
Map<String, Permission> permissionMap = initBuiltinPermissionMap();
|
||||
Map<String, Role> roleMap = initBuiltinRoleMap();
|
||||
bindBuiltinRoleRelation(roleMap);
|
||||
bindBuiltinRolePermissionInherit(roleMap);
|
||||
bindBuiltinRoleParent(roleMap);
|
||||
bindBuiltinPermission(roleMap, permissionMap);
|
||||
bindBuiltinPermissionDelegation(roleMap, permissionMap);
|
||||
|
||||
Role systemRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.SYS_ROLE_MODULE_CODE, BootstrapData.SYS_ROLE_CODE));
|
||||
// 初始化系统用户
|
||||
@@ -94,9 +101,7 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
|
||||
String logContent = "初始化 %s 自举用户成功，请立即修改密码：%s".formatted(BootstrapData.SYS_USER_NAME, password);
|
||||
|
||||
Logger logger = new Logger();
|
||||
logger.setModule(Logger.Module.SYSTEM);
|
||||
logger.setOperation("INITIALIZE_SYSTEM_USER");
|
||||
Logger logger = Logger.info(Logger.Module.SYSTEM, "INITIALIZE_SYSTEM_USER");
|
||||
logger.setUserId(user.getId());
|
||||
logger.setContent(logContent);
|
||||
loggerService.create(logger);
|
||||
@@ -131,8 +136,12 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
permission.setModuleCode(item.getModuleCode());
|
||||
permission.setCode(item.getValue());
|
||||
permission.setName(item.getDefaultName());
|
||||
fillBuiltinPermission(permission, item);
|
||||
permissionService.create(permission);
|
||||
permission = permissionMapper.selectByExample(example);
|
||||
} else {
|
||||
fillBuiltinPermission(permission, item);
|
||||
permissionMapper.updateSelective(permission);
|
||||
}
|
||||
permissionMap.put(BuiltinAuthRegistry.toPermissionKey(item.getModuleCode(), item.getValue()), permission);
|
||||
}
|
||||
@@ -155,8 +164,12 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
role.setModuleCode(item.getModuleCode());
|
||||
role.setCode(code);
|
||||
role.setName(item.getDefaultName());
|
||||
fillBuiltinRole(role, item);
|
||||
roleService.create(role);
|
||||
role = roleMapper.selectByExample(example);
|
||||
} else {
|
||||
fillBuiltinRole(role, item);
|
||||
roleMapper.updateSelective(role);
|
||||
}
|
||||
roleMap.put(BuiltinAuthRegistry.toRoleKey(item.getModuleCode(), code), role);
|
||||
}
|
||||
@@ -166,7 +179,7 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
/// 按角色定义补齐父子角色关系
|
||||
///
|
||||
/// @param roleMap 已同步的角色映射
|
||||
private void bindBuiltinRoleRelation(Map<String, Role> roleMap) {
|
||||
private void bindBuiltinRolePermissionInherit(Map<String, Role> roleMap) {
|
||||
for (BuiltinRoleCode item : BuiltinAuthRegistry.ROLE_CODE_LIST) {
|
||||
if (TimiJava.isEmpty(item.getParentCode())) {
|
||||
continue;
|
||||
@@ -176,15 +189,26 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
if (parentRole == null || childRole == null) {
|
||||
continue;
|
||||
}
|
||||
RoleRelation relation = new RoleRelation();
|
||||
RolePermissionInherit relation = new RolePermissionInherit();
|
||||
relation.setParentRoleId(parentRole.getId());
|
||||
relation.setChildRoleId(childRole.getId());
|
||||
if (roleRelationMapper.selectByExample(relation) == null) {
|
||||
roleRelationService.create(relation);
|
||||
relation.setOwnerType(item.getOwnerType());
|
||||
relation.setOwnerId(item.getOwnerId());
|
||||
if (rolePermissionInheritMapper.selectByExample(relation) == null) {
|
||||
rolePermissionInheritService.create(relation);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// 补齐内置角色管理父级
|
||||
///
|
||||
/// @param roleMap 已同步的角色映射
|
||||
private void bindBuiltinRoleParent(Map<String, Role> roleMap) {
|
||||
setRoleParent(roleMap, ModuleCode.CORE, CoreRoleCode.ADMIN.name(), ModuleCode.CORE, CoreRoleCode.SYSTEM.name());
|
||||
setRoleParent(roleMap, ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name(), ModuleCode.CORE, CoreRoleCode.ADMIN.name());
|
||||
setRoleParent(roleMap, ModuleCode.GAO, GaoRoleCode.STORE_MANAGER.name(), ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name());
|
||||
}
|
||||
|
||||
/// 按权限定义补齐 SYSTEM 和 ADMIN 的默认权限
|
||||
///
|
||||
/// @param roleMap 已同步的角色映射
|
||||
@@ -205,6 +229,12 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
if (item.isGrantToAdmin() && adminRole != null) {
|
||||
createRolePermissionIfAbsent(adminRole.getId(), permission.getId());
|
||||
}
|
||||
if (item instanceof CorePermissionCode corePermission && isGrantToModuleRoleManager(corePermission) && gaoGlobalManagerRole != null) {
|
||||
createRolePermissionIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
|
||||
}
|
||||
if (item instanceof CorePermissionCode corePermission && isGrantToModuleRoleManager(corePermission) && gaoStoreManagerRole != null) {
|
||||
createRolePermissionIfAbsent(gaoStoreManagerRole.getId(), permission.getId());
|
||||
}
|
||||
if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToGlobalManager() && gaoGlobalManagerRole != null) {
|
||||
createRolePermissionIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
|
||||
}
|
||||
@@ -214,6 +244,35 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
}
|
||||
}
|
||||
|
||||
/// 按内置策略补齐角色转授权限
|
||||
///
|
||||
/// @param roleMap 已同步的角色映射
|
||||
/// @param permissionMap 已同步的权限映射
|
||||
private void bindBuiltinPermissionDelegation(Map<String, Role> roleMap, Map<String, Permission> permissionMap) {
|
||||
Role systemRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.SYS_ROLE_MODULE_CODE, BootstrapData.SYS_ROLE_CODE));
|
||||
Role adminRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.ADMIN_ROLE_MODULE_CODE, BootstrapData.ADMIN_ROLE_CODE));
|
||||
Role gaoGlobalManagerRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name()));
|
||||
Role gaoStoreManagerRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(ModuleCode.GAO, GaoRoleCode.STORE_MANAGER.name()));
|
||||
for (BuiltinPermissionCode item : BuiltinAuthRegistry.PERMISSION_CODE_LIST) {
|
||||
Permission permission = permissionMap.get(BuiltinAuthRegistry.toPermissionKey(item.getModuleCode(), item.getValue()));
|
||||
if (permission == null) {
|
||||
continue;
|
||||
}
|
||||
if (systemRole != null) {
|
||||
createRolePermissionDelegationIfAbsent(systemRole.getId(), permission.getId());
|
||||
}
|
||||
if (adminRole != null) {
|
||||
createRolePermissionDelegationIfAbsent(adminRole.getId(), permission.getId());
|
||||
}
|
||||
if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToStoreManager() && gaoGlobalManagerRole != null) {
|
||||
createRolePermissionDelegationIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
|
||||
}
|
||||
if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToStoreManager() && gaoStoreManagerRole != null) {
|
||||
createRolePermissionDelegationIfAbsent(gaoStoreManagerRole.getId(), permission.getId());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// 角色权限关系不存在时才创建
|
||||
///
|
||||
/// @param roleId 角色 ID
|
||||
@@ -230,4 +289,70 @@ public class InitBuiltinUser implements ApplicationRunner {
|
||||
rolePermission.setPermissionId(permissionId);
|
||||
rolePermissionMapper.insert(rolePermission);
|
||||
}
|
||||
|
||||
/// 角色转授权限关系不存在时才创建
|
||||
///
|
||||
/// @param roleId 角色 ID
|
||||
/// @param permissionId 权限 ID
|
||||
private void createRolePermissionDelegationIfAbsent(String roleId, String permissionId) {
|
||||
RolePermissionDelegation example = new RolePermissionDelegation();
|
||||
example.setRoleId(roleId);
|
||||
example.setPermissionId(permissionId);
|
||||
if (rolePermissionDelegationMapper.selectByExample(example) != null) {
|
||||
return;
|
||||
}
|
||||
RolePermissionDelegation rolePermissionDelegation = new RolePermissionDelegation();
|
||||
rolePermissionDelegation.setRoleId(roleId);
|
||||
rolePermissionDelegation.setPermissionId(permissionId);
|
||||
rolePermissionDelegationMapper.insert(rolePermissionDelegation);
|
||||
}
|
||||
|
||||
/// 填充内置权限元数据
|
||||
///
|
||||
/// @param permission 权限
|
||||
/// @param item 内置权限定义
|
||||
private void fillBuiltinPermission(Permission permission, BuiltinPermissionCode item) {
|
||||
permission.setBuiltin(true);
|
||||
permission.setProtectedPermission(item.isProtected());
|
||||
permission.setOwnerType(item.getOwnerType());
|
||||
permission.setOwnerId(item.getOwnerId());
|
||||
}
|
||||
|
||||
/// 填充内置角色元数据
|
||||
///
|
||||
/// @param role 角色
|
||||
/// @param item 内置角色定义
|
||||
private void fillBuiltinRole(Role role, BuiltinRoleCode item) {
|
||||
role.setBuiltin(true);
|
||||
role.setProtectedRole(item.isProtected());
|
||||
role.setOwnerType(item.getOwnerType());
|
||||
role.setOwnerId(item.getOwnerId());
|
||||
}
|
||||
|
||||
/// 设置角色管理父级
|
||||
///
|
||||
/// @param roleMap 已同步的角色映射
|
||||
/// @param moduleCode 角色模块
|
||||
/// @param roleCode 角色代码
|
||||
/// @param parentModuleCode 父角色模块
|
||||
/// @param parentRoleCode 父角色代码
|
||||
private void setRoleParent(Map<String, Role> roleMap, ModuleCode moduleCode, String roleCode, ModuleCode parentModuleCode, String parentRoleCode) {
|
||||
Role role = roleMap.get(BuiltinAuthRegistry.toRoleKey(moduleCode, roleCode));
|
||||
Role parentRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(parentModuleCode, parentRoleCode));
|
||||
if (role == null || parentRole == null || parentRole.getId().equals(role.getParentRoleId())) {
|
||||
return;
|
||||
}
|
||||
role.setParentRoleId(parentRole.getId());
|
||||
roleMapper.updateSelective(role);
|
||||
}
|
||||
|
||||
/// 判断权限是否默认授予模块角色管理员
|
||||
///
|
||||
/// @param permissionCode 核心权限
|
||||
/// @return true 为授予
|
||||
private boolean isGrantToModuleRoleManager(CorePermissionCode permissionCode) {
|
||||
return permissionCode.name().startsWith("ROLE_")
|
||||
|| permissionCode.name().startsWith("USER_ROLE_")
|
||||
|| CorePermissionCode.PERMISSION_READ == permissionCode;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user