From 43d76040d838b790fa4e85369863c10caeef6925 Mon Sep 17 00:00:00 2001 From: Timi Date: Mon, 24 Aug 2026 01:49:44 +0800 Subject: [PATCH] fix store permission --- .../GaoCustomerChartController.java | 7 ++ .../gao/controller/GaoCustomerController.java | 54 ++++++++++----- .../gao/controller/GaoEventController.java | 44 ++++++++----- .../controller/GaoEventRecordController.java | 66 ++++++++++++------- .../controller/GaoPointAccountController.java | 21 ++---- .../controller/GaoPointLedgerController.java | 19 ++---- .../controller/GaoPointRuleController.java | 39 +++-------- .../GaoStoreBusinessDayController.java | 25 ++++++- .../controller/GaoStoreChartController.java | 13 +++- .../gao/controller/GaoStoreController.java | 30 +++++++-- .../gao/controller/GaoUserController.java | 41 ++++++++---- .../gao/service/GaoStoreScopeService.java | 33 ++++++++++ .../GaoStoreScopeServiceImplement.java | 58 ++++++++++++++++ 13 files changed, 311 insertions(+), 139 deletions(-) create mode 100644 src/main/java/com/imyeyu/api/modules/gao/service/GaoStoreScopeService.java create mode 100644 src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoStoreScopeServiceImplement.java diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerChartController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerChartController.java index 3bec34d..e738d60 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerChartController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerChartController.java @@ -3,9 +3,11 @@ package com.imyeyu.api.modules.gao.controller; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; import com.imyeyu.api.modules.gao.service.GaoCustomerChartService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoCustomerChartReq; import com.imyeyu.api.modules.gao.vo.GaoEventRecordCalendarView; import com.imyeyu.api.modules.gao.vo.GaoEventRecordDailyStatView; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; import lombok.RequiredArgsConstructor; @@ -26,6 +28,7 @@ import java.util.List; public class GaoCustomerChartController { private final GaoCustomerChartService service; + private final GaoStoreScopeService storeScopeService; /// 查询客户登记每日统计，可同时支撑登记趋势和登记事件结构图表 @AOPLog @@ -33,6 +36,8 @@ public class GaoCustomerChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/event/record/daily") public List eventRecordDaily(@RequestBody GaoCustomerChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.eventRecordDailyStat(req); } @@ -42,6 +47,8 @@ public class GaoCustomerChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/event/record/calendar") public List eventRecordCalendar(@RequestBody GaoCustomerChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.eventRecordCalendar(req); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java index 26f399a..d78990f 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java @@ -1,21 +1,17 @@ package com.imyeyu.api.modules.gao.controller; import com.fasterxml.jackson.annotation.JsonView; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.common.entity.Attachment; import com.imyeyu.api.modules.common.service.AttachmentService; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoCustomer; import com.imyeyu.api.modules.gao.service.GaoCustomerService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoCustomerDailyStateView; import com.imyeyu.api.modules.gao.vo.GaoCustomerGenderStatView; import com.imyeyu.api.modules.gao.vo.GaoCustomerPage; import com.imyeyu.api.modules.gao.vo.GaoCustomerTrendStateReq; -import com.imyeyu.api.modules.user.service.RoleChecker; -import com.imyeyu.api.modules.user.service.UserLoginService; import com.imyeyu.api.modules.user.service.UserService; import com.imyeyu.java.TimiJava; import com.imyeyu.java.bean.timi.TimiException; @@ -50,11 +46,9 @@ import java.util.Map; public class GaoCustomerController { private final UserService userService; - private final RoleChecker roleChecker; private final AttachmentService attachmentService; private final GaoCustomerService service; - private final GaoStoreService gaoStoreService; - private final UserLoginService userLoginService; + private final GaoStoreScopeService storeScopeService; @AOPLog @RequestRateLimit @@ -62,6 +56,8 @@ public class GaoCustomerController { @PostMapping("/list") @JsonView(ResponseView.Public.class) public PageResult list(@RequestBody GaoCustomerPage page) { + TimiException.required(page, "not found page"); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); PageResult result = service.pageByQuery(page); List idList = result.getList().stream().map(GaoCustomer::getId).distinct().toList(); @@ -79,6 +75,8 @@ public class GaoCustomerController { @JsonView(ResponseView.Public.class) public GaoCustomer detail(@RequestParam String id) { GaoCustomer customer = service.get(id); + TimiException.required(customer, "not found customer"); + storeScopeService.checkStoreId(customer.getStoreId()); if (TimiJava.isNotEmpty(customer.getIntroducerCustomerId())) { GaoCustomer introducerCustomer = service.get(customer.getIntroducerCustomerId()); introducerCustomer.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, introducerCustomer.getId())); @@ -97,9 +95,7 @@ public class GaoCustomerController { @PostMapping("/create") @JsonView(ResponseView.Public.class) public String create(@RequestBody GaoCustomer customer) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - customer.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + customer.setStoreId(storeScopeService.resolveStoreId(customer.getStoreId())); service.create(customer); return customer.getId(); } @@ -109,9 +105,12 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE) @PostMapping("/update") public void update(@RequestBody GaoCustomer customer) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - customer.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + TimiException.required(customer, "not found customer"); + TimiException.required(customer.getId(), "not found customer.id"); + GaoCustomer dbCustomer = service.get(customer.getId()); + TimiException.required(dbCustomer, "not found customer"); + storeScopeService.checkStoreId(dbCustomer.getStoreId()); + customer.setStoreId(dbCustomer.getStoreId()); service.updateWithAttachment(customer); } @@ -120,6 +119,9 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_DELETE) @PostMapping("/delete") public void delete(@RequestParam String id) { + GaoCustomer customer = service.get(id); + TimiException.required(customer, "not found customer"); + storeScopeService.checkStoreId(customer.getStoreId()); service.delete(id); } @@ -131,6 +133,7 @@ public class GaoCustomerController { public GaoCustomer findById(@RequestParam String id) { GaoCustomer customer = service.get(id); TimiException.required(customer, "not found customer"); + storeScopeService.checkStoreId(customer.getStoreId()); customer.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, customer.getId())); return customer; } @@ -141,7 +144,7 @@ public class GaoCustomerController { @PostMapping("/find/code") @JsonView(ResponseView.Public.class) public GaoCustomer findByCode(@RequestParam String storeId, @RequestParam String code) { - GaoCustomer customer = service.getByCode(storeId, code); + GaoCustomer customer = service.getByCode(storeScopeService.resolveStoreId(storeId), code); if (customer == null) { return null; } @@ -155,7 +158,7 @@ public class GaoCustomerController { @PostMapping("/find/name") @JsonView(ResponseView.Public.class) public GaoCustomer findByName(@RequestParam String storeId, @RequestParam String name) { - GaoCustomer customer = service.getByName(storeId, name); + GaoCustomer customer = service.getByName(storeScopeService.resolveStoreId(storeId), name); if (customer == null) { return null; } @@ -169,6 +172,12 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_EXPORT) @PostMapping("/export") public void export(@RequestBody Page page) throws IOException { + TimiException.required(page, "not found page"); + if (!storeScopeService.hasGlobalScope()) { + GaoCustomer example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoCustomer()); + example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId())); + page.setEqualsExample(example); + } HttpServletResponse resp = TimiSpring.getResponse(); String contentDisposition = Network.getFileDownloadHeader("客户列表-%s.xlsx".formatted(Time.serialize.format(Time.now()))); resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); @@ -182,6 +191,9 @@ public class GaoCustomerController { @PostMapping("/invited/list") @JsonView(ResponseView.Public.class) public List listInvited(@RequestParam String introducerCustomerId) { + GaoCustomer introducerCustomer = service.get(introducerCustomerId); + TimiException.required(introducerCustomer, "not found introducerCustomer"); + storeScopeService.checkStoreId(introducerCustomer.getStoreId()); List result = service.listInvited(introducerCustomerId); List idList = result.stream().map(GaoCustomer::getId).distinct().toList(); Map> attachMap = attachmentService.mapByBizIdList(Attachment.BizType.GAO_CUSTOMER, idList); @@ -196,6 +208,9 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE) @PostMapping("/invite/save") public void saveInvite(@RequestParam String introducerCustomerId, @RequestParam String customerId) { + GaoCustomer customer = service.get(customerId); + TimiException.required(customer, "not found customer"); + storeScopeService.checkStoreId(customer.getStoreId()); service.saveInviteRelation(introducerCustomerId, customerId); } @@ -204,6 +219,9 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_UPDATE) @PostMapping("/invite/delete") public void deleteInvite(@RequestParam String customerId) { + GaoCustomer customer = service.get(customerId); + TimiException.required(customer, "not found customer"); + storeScopeService.checkStoreId(customer.getStoreId()); service.deleteInviteRelation(customerId); } @@ -213,6 +231,8 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_READ) @PostMapping("/state/daily") public List dailyStat(@RequestBody GaoCustomerTrendStateReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.stateDailyTrend(req); } @@ -222,6 +242,6 @@ public class GaoCustomerController { @RequireGaoPermission(GaoPermissionCode.CUSTOMER_READ) @PostMapping("/state/gender") public List genderStat(@RequestParam String storeId) { - return service.stateGender(storeId); + return service.stateGender(storeScopeService.resolveStoreId(storeId)); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java index b825122..33f410a 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java @@ -1,14 +1,12 @@ package com.imyeyu.api.modules.gao.controller; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoEvent; import com.imyeyu.api.modules.gao.service.GaoEventService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; -import com.imyeyu.api.modules.user.service.RoleChecker; -import com.imyeyu.api.modules.user.service.UserLoginService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; +import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; import com.imyeyu.spring.bean.Page; @@ -33,15 +31,19 @@ import java.util.Map; public class GaoEventController { private final GaoEventService service; - private final RoleChecker roleChecker; - private final GaoStoreService gaoStoreService; - private final UserLoginService userLoginService; + private final GaoStoreScopeService storeScopeService; @AOPLog @RequestRateLimit @RequireGaoPermission(GaoPermissionCode.EVENT_READ) @PostMapping("/list") public PageResult list(@RequestBody Page page) { + TimiException.required(page, "not found page"); + if (!storeScopeService.hasGlobalScope()) { + GaoEvent example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoEvent()); + example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId())); + page.setEqualsExample(example); + } PageResult result = service.page(page); Map> roleMap = service.mapRoleCodeListByEventIdList(result.getList().stream().map(GaoEvent::getId).toList()); for (GaoEvent event : result.getList()) { @@ -52,9 +54,10 @@ public class GaoEventController { @AOPLog @RequestRateLimit + @RequireGaoPermission(GaoPermissionCode.EVENT_READ) @PostMapping("/list/valid") public List listValid(@RequestParam String storeId) { - return service.listValid(storeId); + return service.listValid(storeScopeService.resolveStoreId(storeId)); } @AOPLog @@ -63,6 +66,8 @@ public class GaoEventController { @PostMapping("/detail") public GaoEvent detail(@RequestParam String id) { GaoEvent event = service.get(id); + TimiException.required(event, "not found event"); + storeScopeService.checkStoreId(event.getStoreId()); event.setRoleCodeList(service.listRoleCode(event.getId())); return event; } @@ -72,9 +77,7 @@ public class GaoEventController { @RequireGaoPermission(GaoPermissionCode.EVENT_CREATE) @PostMapping("/create") public void create(@RequestBody GaoEvent event) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - event.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + event.setStoreId(storeScopeService.resolveStoreId(event.getStoreId())); service.create(event); } @@ -83,9 +86,12 @@ public class GaoEventController { @RequireGaoPermission(GaoPermissionCode.EVENT_UPDATE) @PostMapping("/update") public void update(@RequestBody GaoEvent event) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - event.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + TimiException.required(event, "not found event"); + TimiException.required(event.getId(), "not found event.id"); + GaoEvent dbEvent = service.get(event.getId()); + TimiException.required(dbEvent, "not found event"); + storeScopeService.checkStoreId(dbEvent.getStoreId()); + event.setStoreId(dbEvent.getStoreId()); service.update(event); } @@ -94,6 +100,11 @@ public class GaoEventController { @RequireGaoPermission(GaoPermissionCode.EVENT_UPDATE) @PostMapping("/sort") public void sort(@RequestBody List idList) { + for (String id : TimiJava.safeIterable(idList)) { + GaoEvent event = service.get(id); + TimiException.required(event, "not found event"); + storeScopeService.checkStoreId(event.getStoreId()); + } service.sort(idList); } @@ -102,6 +113,9 @@ public class GaoEventController { @RequireGaoPermission(GaoPermissionCode.EVENT_DELETE) @PostMapping("/delete") public void delete(@RequestParam String id) { + GaoEvent event = service.get(id); + TimiException.required(event, "not found event"); + storeScopeService.checkStoreId(event.getStoreId()); service.delete(id); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java index fbcb2e3..44a6a25 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java @@ -1,27 +1,24 @@ package com.imyeyu.api.modules.gao.controller; import com.fasterxml.jackson.annotation.JsonView; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.common.entity.Attachment; import com.imyeyu.api.modules.common.service.AttachmentService; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoCustomer; import com.imyeyu.api.modules.gao.entity.GaoEvent; import com.imyeyu.api.modules.gao.entity.GaoEventRecord; import com.imyeyu.api.modules.gao.service.GaoCustomerService; import com.imyeyu.api.modules.gao.service.GaoEventRecordService; import com.imyeyu.api.modules.gao.service.GaoEventService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoCustomerEventRankView; import com.imyeyu.api.modules.gao.vo.GaoEventRecordPage; import com.imyeyu.api.modules.gao.vo.GaoEventRecordPageResult; import com.imyeyu.api.modules.gao.vo.GaoEventRecordRankPage; -import com.imyeyu.api.modules.user.service.RoleChecker; -import com.imyeyu.api.modules.user.service.UserLoginService; import com.imyeyu.api.modules.user.service.UserService; import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.network.Network; import com.imyeyu.spring.TimiSpring; import com.imyeyu.spring.annotation.AOPLog; @@ -52,13 +49,11 @@ import java.util.Map; public class GaoEventRecordController { private final UserService userService; - private final RoleChecker roleChecker; private final GaoEventService eventService; private final AttachmentService attachmentService; private final GaoCustomerService customerService; - private final GaoStoreService gaoStoreService; + private final GaoStoreScopeService storeScopeService; private final GaoEventRecordService service; - private final UserLoginService userLoginService; @AOPLog @RequestRateLimit @@ -66,6 +61,8 @@ public class GaoEventRecordController { @PostMapping("/list") @JsonView(ResponseView.Public.class) public GaoEventRecordPageResult list(@RequestBody GaoEventRecordPage page) { + TimiException.required(page, "not found page"); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); PageResult pageResult = service.pageByRange(page); GaoEventRecordPageResult result = new GaoEventRecordPageResult(); result.setTotal(pageResult.getTotal()); @@ -108,6 +105,8 @@ public class GaoEventRecordController { @JsonView(ResponseView.Public.class) public GaoEventRecord detail(@RequestParam String id) { GaoEventRecord record = service.get(id); + TimiException.required(record, "not found event record"); + storeScopeService.checkStoreId(record.getStoreId()); record.setCustomer(customerService.get(record.getCustomerId())); record.getCustomer().setAttachmentList(attachmentService.listByBizId(Attachment.BizType.GAO_CUSTOMER, record.getCustomerId())); record.setEvent(eventService.get(record.getEventId())); @@ -121,9 +120,7 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE) @PostMapping("/create") public void create(@RequestBody GaoEventRecord record) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - record.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + resolveCreateRecordStore(record); service.create(record); } @@ -132,11 +129,8 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE) @PostMapping("/create/batch") public void createBatch(@RequestBody List recordList) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - String storeId = gaoStoreService.getBelongIdByRequiredLoginUserId(); - for (GaoEventRecord record : recordList) { - record.setStoreId(storeId); - } + for (GaoEventRecord record : TimiJava.safeIterable(recordList)) { + resolveCreateRecordStore(record); } service.createBatch(recordList); } @@ -146,11 +140,17 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_CREATE) @PostMapping("/create/customer") public void createWithCustomer(@RequestBody GaoCustomer customer) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - String storeId = gaoStoreService.getBelongIdByRequiredLoginUserId(); - for (GaoEventRecord record : TimiJava.safeIterable(customer.getEventRecordList())) { - record.setStoreId(storeId); - } + TimiException.required(customer, "not found customer"); + if (TimiJava.isNotEmpty(customer.getId())) { + GaoCustomer dbCustomer = customerService.get(customer.getId()); + TimiException.required(dbCustomer, "not found customer"); + storeScopeService.checkStoreId(dbCustomer.getStoreId()); + customer.setStoreId(dbCustomer.getStoreId()); + } else { + customer.setStoreId(storeScopeService.resolveStoreId(customer.getStoreId())); + } + for (GaoEventRecord record : TimiJava.safeIterable(customer.getEventRecordList())) { + resolveCreateRecordStore(record); } service.createWithCustomer(customer); } @@ -160,9 +160,12 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_UPDATE) @PostMapping("/update") public void update(@RequestBody GaoEventRecord record) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - record.setStoreId(gaoStoreService.getBelongIdByRequiredLoginUserId()); - } + TimiException.required(record, "not found event record"); + TimiException.required(record.getId(), "not found event record.id"); + GaoEventRecord dbRecord = service.get(record.getId()); + TimiException.required(dbRecord, "not found event record"); + storeScopeService.checkStoreId(dbRecord.getStoreId()); + record.setStoreId(dbRecord.getStoreId()); service.update(record); } @@ -171,6 +174,9 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_DELETE) @PostMapping("/delete") public void delete(@RequestParam String id) { + GaoEventRecord record = service.get(id); + TimiException.required(record, "not found event record"); + storeScopeService.checkStoreId(record.getStoreId()); service.delete(id); } @@ -180,6 +186,8 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.EVENT_RECORD_EXPORT) @PostMapping("/export") public void export(@RequestBody GaoEventRecordPage page) throws IOException { + TimiException.required(page, "not found page"); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); HttpServletResponse resp = TimiSpring.getResponse(); String contentDisposition = Network.getFileDownloadHeader("登记事件记录-%s.xlsx".formatted(Time.serialize.format(Time.now()))); resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); @@ -193,6 +201,8 @@ public class GaoEventRecordController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/rank") public PageResult eventRank(@RequestBody GaoEventRecordRankPage page) { + TimiException.required(page, "not found page"); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); PageResult result = service.pageRankByRange(page); List customerIdList = result.getList().stream().map(GaoCustomerEventRankView::getCustomerId).distinct().toList(); if (customerIdList.isEmpty()) { @@ -209,4 +219,12 @@ public class GaoEventRecordController { } return result; } + + private void resolveCreateRecordStore(GaoEventRecord record) { + TimiException.required(record, "not found event record"); + GaoEvent event = eventService.get(record.getEventId()); + TimiException.required(event, "not found event"); + storeScopeService.checkStoreId(event.getStoreId()); + record.setStoreId(event.getStoreId()); + } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointAccountController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointAccountController.java index ef977ac..5e43000 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointAccountController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointAccountController.java @@ -1,14 +1,11 @@ package com.imyeyu.api.modules.gao.controller; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoPointAccount; import com.imyeyu.api.modules.gao.service.GaoPointAccountService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoPointAccountPage; -import com.imyeyu.api.modules.user.service.RoleChecker; import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; @@ -29,8 +26,7 @@ import org.springframework.web.bind.annotation.RestController; @RequestMapping("/gao/customer/point") public class GaoPointAccountController { - private final RoleChecker roleChecker; - private final GaoStoreService storeService; + private final GaoStoreScopeService storeScopeService; private final GaoPointAccountService accountService; @AOPLog @@ -39,7 +35,7 @@ public class GaoPointAccountController { @PostMapping("/account/list") public PageResult list(@RequestBody GaoPointAccountPage page) { TimiException.required(page, "not found page"); - page.setStoreId(resolveStoreId(page.getStoreId())); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); return accountService.pageByQuery(page); } @@ -48,7 +44,7 @@ public class GaoPointAccountController { @RequireGaoPermission(GaoPermissionCode.POINT_ACCOUNT_READ) @PostMapping("/account/detail/customer") public GaoPointAccount detail(@RequestParam String customerId, @RequestParam(required = false) String storeId) { - storeId = resolveStoreId(storeId); + storeId = storeScopeService.resolveStoreId(storeId); return accountService.getByCustomerId(storeId, customerId); } @@ -57,13 +53,6 @@ public class GaoPointAccountController { @RequireGaoPermission(GaoPermissionCode.POINT_ACCOUNT_READ) @PostMapping("/account/detail") public GaoPointAccount detailById(@RequestParam String id, @RequestParam(required = false) String storeId) { - return accountService.getByIdAndStoreId(resolveStoreId(storeId), id); - } - - private String resolveStoreId(String requestedStoreId) { - if (roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - return requestedStoreId; - } - return storeService.getBelongIdByRequiredLoginUserId(); + return accountService.getByIdAndStoreId(storeScopeService.resolveStoreId(storeId), id); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointLedgerController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointLedgerController.java index 412c761..eaee296 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointLedgerController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointLedgerController.java @@ -1,16 +1,13 @@ package com.imyeyu.api.modules.gao.controller; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoPointLedger; import com.imyeyu.api.modules.gao.service.GaoPointLedgerService; import com.imyeyu.api.modules.gao.service.GaoPointTriggerService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoPointAdjustRequest; import com.imyeyu.api.modules.gao.vo.GaoPointLedgerPage; -import com.imyeyu.api.modules.user.service.RoleChecker; import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; @@ -30,8 +27,7 @@ import org.springframework.web.bind.annotation.RestController; @RequestMapping("/gao/customer/point") public class GaoPointLedgerController { - private final RoleChecker roleChecker; - private final GaoStoreService storeService; + private final GaoStoreScopeService storeScopeService; private final GaoPointLedgerService ledgerService; private final GaoPointTriggerService triggerService; @@ -41,7 +37,7 @@ public class GaoPointLedgerController { @PostMapping("/ledger/list") public PageResult list(@RequestBody GaoPointLedgerPage page) { TimiException.required(page, "not found page"); - page.setStoreId(resolveStoreId(page.getStoreId())); + page.setStoreId(storeScopeService.resolveStoreId(page.getStoreId())); return ledgerService.pageByQuery(page); } @@ -50,14 +46,7 @@ public class GaoPointLedgerController { @RequireGaoPermission(GaoPermissionCode.POINT_ADJUST) @PostMapping("/adjust") public void adjust(@RequestBody GaoPointAdjustRequest request) { - request.setStoreId(resolveStoreId(request.getStoreId())); + request.setStoreId(storeScopeService.resolveStoreId(request.getStoreId())); triggerService.adjust(request); } - - private String resolveStoreId(String requestedStoreId) { - if (roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - return requestedStoreId; - } - return storeService.getBelongIdByRequiredLoginUserId(); - } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointRuleController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointRuleController.java index e786ca1..38118a1 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointRuleController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoPointRuleController.java @@ -1,13 +1,10 @@ package com.imyeyu.api.modules.gao.controller; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoPointRule; import com.imyeyu.api.modules.gao.service.GaoPointRuleService; -import com.imyeyu.api.modules.gao.service.GaoStoreService; -import com.imyeyu.api.modules.user.service.RoleChecker; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.java.TimiJava; import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; @@ -32,8 +29,7 @@ import java.util.List; @RequestMapping("/gao/customer/point") public class GaoPointRuleController { - private final RoleChecker roleChecker; - private final GaoStoreService storeService; + private final GaoStoreScopeService storeScopeService; private final GaoPointRuleService ruleService; @AOPLog @@ -42,9 +38,9 @@ public class GaoPointRuleController { @PostMapping("/rule/list") public PageResult list(@RequestBody Page page) { TimiException.required(page, "not found page"); - if (!isGlobalManager()) { + if (!storeScopeService.hasGlobalScope()) { GaoPointRule example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoPointRule()); - example.setStoreId(resolveStoreId(null)); + example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId())); page.setEqualsExample(example); } return ruleService.page(page); @@ -57,7 +53,7 @@ public class GaoPointRuleController { public GaoPointRule detail(@RequestParam String id) { GaoPointRule rule = ruleService.get(id); TimiException.required(rule, "not found point rule"); - checkStore(rule.getStoreId()); + storeScopeService.checkStoreId(rule.getStoreId()); return rule; } @@ -66,7 +62,7 @@ public class GaoPointRuleController { @RequireGaoPermission(GaoPermissionCode.POINT_RULE_CREATE) @PostMapping("/rule/create") public String create(@RequestBody GaoPointRule rule) { - rule.setStoreId(resolveStoreId(rule.getStoreId())); + rule.setStoreId(storeScopeService.resolveStoreId(rule.getStoreId())); ruleService.create(rule); return rule.getId(); } @@ -76,7 +72,7 @@ public class GaoPointRuleController { @RequireGaoPermission(GaoPermissionCode.POINT_RULE_UPDATE) @PostMapping("/rule/update") public void update(@RequestBody GaoPointRule rule) { - rule.setStoreId(resolveStoreId(rule.getStoreId())); + rule.setStoreId(storeScopeService.resolveStoreId(rule.getStoreId())); ruleService.update(rule); } @@ -87,7 +83,7 @@ public class GaoPointRuleController { public void sort(@RequestBody List idList) { if (idList != null) { for (GaoPointRule rule : ruleService.listByIdList(idList)) { - checkStore(rule.getStoreId()); + storeScopeService.checkStoreId(rule.getStoreId()); } } ruleService.sort(idList); @@ -100,24 +96,7 @@ public class GaoPointRuleController { public void delete(@RequestParam String id) { GaoPointRule rule = ruleService.get(id); TimiException.required(rule, "not found point rule"); - checkStore(rule.getStoreId()); + storeScopeService.checkStoreId(rule.getStoreId()); ruleService.delete(id); } - - private String resolveStoreId(String requestedStoreId) { - if (isGlobalManager()) { - return requestedStoreId; - } - return storeService.getBelongIdByRequiredLoginUserId(); - } - - private void checkStore(String storeId) { - if (!isGlobalManager()) { - TimiException.requiredTrue(resolveStoreId(null).equals(storeId), "无权操作其他门店数据"); - } - } - - private boolean isGlobalManager() { - return roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name()); - } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreBusinessDayController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreBusinessDayController.java index 68d29cf..a18477b 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreBusinessDayController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreBusinessDayController.java @@ -4,6 +4,9 @@ import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; import com.imyeyu.api.modules.gao.entity.GaoStoreBusinessDay; import com.imyeyu.api.modules.gao.service.GaoStoreBusinessDayService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; +import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; import com.imyeyu.spring.bean.Page; @@ -27,12 +30,17 @@ import java.util.List; public class GaoStoreBusinessDayController { private final GaoStoreBusinessDayService service; + private final GaoStoreScopeService storeScopeService; @AOPLog @RequestRateLimit @RequireGaoPermission(GaoPermissionCode.STORE_READ) @PostMapping("/list") public PageResult list(@RequestBody Page page) { + TimiException.required(page, "not found page"); + GaoStoreBusinessDay example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStoreBusinessDay()); + example.setStoreId(storeScopeService.resolveStoreId(example.getStoreId())); + page.setEqualsExample(example); return service.page(page); } @@ -41,7 +49,7 @@ public class GaoStoreBusinessDayController { @RequireGaoPermission(GaoPermissionCode.STORE_READ) @PostMapping("/calendar") public List calendar(@RequestParam String storeId, @RequestParam Integer beginDateValue, @RequestParam Integer endDateValue) { - return service.listByDateRange(storeId, beginDateValue, endDateValue); + return service.listByDateRange(storeScopeService.resolveStoreId(storeId), beginDateValue, endDateValue); } @AOPLog @@ -49,7 +57,10 @@ public class GaoStoreBusinessDayController { @RequireGaoPermission(GaoPermissionCode.STORE_READ) @PostMapping("/detail") public GaoStoreBusinessDay detail(@RequestParam String id) { - return service.get(id); + GaoStoreBusinessDay businessDay = service.get(id); + TimiException.required(businessDay, "not found businessDay"); + storeScopeService.checkStoreId(businessDay.getStoreId()); + return businessDay; } @AOPLog @@ -57,6 +68,7 @@ public class GaoStoreBusinessDayController { @RequireGaoPermission(GaoPermissionCode.STORE_UPDATE) @PostMapping("/create") public String create(@RequestBody GaoStoreBusinessDay businessDay) { + businessDay.setStoreId(storeScopeService.resolveStoreId(businessDay.getStoreId())); service.create(businessDay); return businessDay.getId(); } @@ -66,6 +78,12 @@ public class GaoStoreBusinessDayController { @RequireGaoPermission(GaoPermissionCode.STORE_UPDATE) @PostMapping("/update") public void update(@RequestBody GaoStoreBusinessDay businessDay) { + TimiException.required(businessDay, "not found businessDay"); + TimiException.required(businessDay.getId(), "not found businessDay.id"); + GaoStoreBusinessDay dbBusinessDay = service.get(businessDay.getId()); + TimiException.required(dbBusinessDay, "not found businessDay"); + storeScopeService.checkStoreId(dbBusinessDay.getStoreId()); + businessDay.setStoreId(dbBusinessDay.getStoreId()); service.update(businessDay); } @@ -74,6 +92,9 @@ public class GaoStoreBusinessDayController { @RequireGaoPermission(GaoPermissionCode.STORE_DELETE) @PostMapping("/delete") public void delete(@RequestParam String id) { + GaoStoreBusinessDay businessDay = service.get(id); + TimiException.required(businessDay, "not found businessDay"); + storeScopeService.checkStoreId(businessDay.getStoreId()); service.delete(id); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreChartController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreChartController.java index b68c4b0..ab17bd6 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreChartController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreChartController.java @@ -3,12 +3,14 @@ package com.imyeyu.api.modules.gao.controller; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; import com.imyeyu.api.modules.gao.service.GaoStoreChartService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.vo.GaoCustomerDailyStateView; import com.imyeyu.api.modules.gao.vo.GaoCustomerGenderStatView; import com.imyeyu.api.modules.gao.vo.GaoEventRecordCalendarView; import com.imyeyu.api.modules.gao.vo.GaoEventRecordDailyStatView; import com.imyeyu.api.modules.gao.vo.GaoEventRecordNumberValueDailyStatView; import com.imyeyu.api.modules.gao.vo.GaoStoreChartReq; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; import lombok.RequiredArgsConstructor; @@ -30,6 +32,7 @@ import java.util.List; public class GaoStoreChartController { private final GaoStoreChartService service; + private final GaoStoreScopeService storeScopeService; /// 查询客户增长趋势 @AOPLog @@ -37,6 +40,8 @@ public class GaoStoreChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/customer/daily") public List customerDaily(@RequestBody GaoStoreChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.customerDailyTrend(req); } @@ -46,7 +51,7 @@ public class GaoStoreChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/customer/gender") public List customerGender(@RequestParam String storeId) { - return service.customerGender(storeId); + return service.customerGender(storeScopeService.resolveStoreId(storeId)); } /// 查询登记事件每日统计，可同时支撑登记趋势和事件结构图表 @@ -55,6 +60,8 @@ public class GaoStoreChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/event/record/daily") public List eventRecordDaily(@RequestBody GaoStoreChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.eventRecordDailyStat(req); } @@ -64,6 +71,8 @@ public class GaoStoreChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/event/record/number-value/daily") public List eventRecordNumberValueDaily(@RequestBody GaoStoreChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.eventRecordNumberValueDailyStat(req); } @@ -73,6 +82,8 @@ public class GaoStoreChartController { @RequireGaoPermission(GaoPermissionCode.STAT_READ) @PostMapping("/event/record/calendar") public List eventRecordCalendar(@RequestBody GaoStoreChartReq req) { + TimiException.required(req, "not found req"); + req.setStoreId(storeScopeService.resolveStoreId(req.getStoreId())); return service.eventRecordCalendar(req); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java index c544d4e..85616cc 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java @@ -1,13 +1,13 @@ package com.imyeyu.api.modules.gao.controller; -import com.imyeyu.api.bean.ModuleCode; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; import com.imyeyu.api.modules.gao.entity.GaoStore; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.service.GaoStoreService; -import com.imyeyu.api.modules.user.service.PermissionChecker; import com.imyeyu.api.modules.user.service.UserLoginService; import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.network.Network; import com.imyeyu.spring.TimiSpring; import com.imyeyu.spring.annotation.AOPLog; @@ -37,14 +37,20 @@ import java.util.List; public class GaoStoreController { private final GaoStoreService service; + private final GaoStoreScopeService storeScopeService; private final UserLoginService userLoginService; - private final PermissionChecker permissionChecker; @AOPLog @RequestRateLimit @RequireGaoPermission(GaoPermissionCode.STORE_READ) @PostMapping("/list") public PageResult list(@RequestBody Page page) { + TimiException.required(page, "not found page"); + if (!storeScopeService.hasGlobalScope()) { + GaoStore example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStore()); + example.setId(storeScopeService.resolveStoreId(example.getId())); + page.setEqualsExample(example); + } return service.page(page); } @@ -53,7 +59,9 @@ public class GaoStoreController { @RequireGaoPermission(GaoPermissionCode.STORE_READ) @PostMapping("/detail") public GaoStore detail(@RequestParam String id) { - return service.get(id); + GaoStore store = service.get(id); + storeScopeService.checkStore(store); + return store; } @AOPLog @@ -70,12 +78,13 @@ public class GaoStoreController { @RequireGaoPermission(GaoPermissionCode.STORE_UPDATE) @PostMapping("/update") public void update(@RequestBody GaoStore store) { - if (permissionChecker.hasAny(ModuleCode.GAO, GaoPermissionCode.STORE_CREATE.getValue())) { + if (storeScopeService.hasGlobalScope()) { // 门店管理 service.update(store); } else { // 店长 GaoStore dbStore = service.get(store.getId()); + storeScopeService.checkStore(dbStore); dbStore.setName(store.getName()); dbStore.setTelephone(store.getTelephone()); dbStore.setAddress(store.getAddress()); @@ -98,6 +107,11 @@ public class GaoStoreController { @RequireGaoPermission(GaoPermissionCode.STORE_UPDATE) @PostMapping("/sort") public void sort(@RequestBody List idList) { + if (!storeScopeService.hasGlobalScope()) { + for (String id : TimiJava.safeIterable(idList)) { + storeScopeService.checkStore(service.get(id)); + } + } service.sort(idList); } @@ -107,6 +121,12 @@ public class GaoStoreController { @RequireGaoPermission(GaoPermissionCode.STORE_EXPORT) @PostMapping("/export") public void export(@RequestBody Page page) throws IOException { + TimiException.required(page, "not found page"); + if (!storeScopeService.hasGlobalScope()) { + GaoStore example = TimiJava.defaultIfNull(page.getEqualsExample(), new GaoStore()); + example.setId(storeScopeService.resolveStoreId(example.getId())); + page.setEqualsExample(example); + } HttpServletResponse resp = TimiSpring.getResponse(); String contentDisposition = Network.getFileDownloadHeader("门店列表-%s.xlsx".formatted(Time.serialize.format(Time.now()))); resp.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"); diff --git a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java index 8d44978..df788b4 100644 --- a/src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java +++ b/src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java @@ -6,9 +6,8 @@ import com.imyeyu.api.modules.common.entity.Attachment; import com.imyeyu.api.modules.common.service.AttachmentService; import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission; import com.imyeyu.api.modules.gao.bean.GaoPermissionCode; -import com.imyeyu.api.modules.gao.bean.GaoRoleCode; import com.imyeyu.api.modules.gao.entity.GaoUser; -import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; import com.imyeyu.api.modules.gao.service.GaoUserInviteService; import com.imyeyu.api.modules.gao.service.GaoUserService; import com.imyeyu.api.modules.gao.vo.GaoUserInviteCreateRequest; @@ -19,13 +18,13 @@ import com.imyeyu.api.modules.gao.vo.GaoUserInviteValidateRequest; import com.imyeyu.api.modules.gao.vo.GaoUserInviteValidateResponse; import com.imyeyu.api.modules.user.entity.Role; import com.imyeyu.api.modules.user.entity.User; -import com.imyeyu.api.modules.user.service.RoleChecker; -import com.imyeyu.api.modules.user.service.RoleService; +import com.imyeyu.api.modules.user.service.AuthorizationScopeService; import com.imyeyu.api.modules.user.service.UserLoginService; import com.imyeyu.api.modules.user.service.UserRoleService; import com.imyeyu.api.modules.user.service.UserService; import com.imyeyu.api.modules.user.vo.LoginResponse; import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; import com.imyeyu.spring.annotation.AOPLog; import com.imyeyu.spring.annotation.RequestRateLimit; import com.imyeyu.spring.bean.Page; @@ -53,12 +52,11 @@ import java.util.UUID; public class GaoUserController { private final UserService userService; - private final RoleService roleService; - private final RoleChecker roleChecker; + private final AuthorizationScopeService authorizationScopeService; private final GaoUserService service; private final GaoUserInviteService inviteService; private final UserRoleService userRoleService; - private final GaoStoreService gaoStoreService; + private final GaoStoreScopeService storeScopeService; private final UserLoginService userLoginService; private final AttachmentService attachmentService; @@ -93,10 +91,11 @@ public class GaoUserController { @PostMapping("/list") @JsonView(ResponseView.Public.class) public PageResult list(@RequestBody Page page) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { + TimiException.required(page, "not found page"); + if (!storeScopeService.hasGlobalScope()) { // 非全局管理只能看所在店用户 page.setEqualsExample(TimiJava.defaultIfNull(page.getEqualsExample(), new GaoUser())); - page.getEqualsExample().setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); + page.getEqualsExample().setStoreId(storeScopeService.resolveStoreId(page.getEqualsExample().getStoreId())); } PageResult result = service.page(page); { @@ -118,6 +117,8 @@ public class GaoUserController { @JsonView(ResponseView.Public.class) public GaoUser detail(@RequestParam String id) { GaoUser result = service.get(id); + TimiException.required(result, "not found gao user"); + storeScopeService.checkStoreId(result.getStoreId()); { User user = userService.get(result.getUserId()); user.setAttachmentList(attachmentService.listByBizId(Attachment.BizType.USER, user.getId())); @@ -135,9 +136,7 @@ public class GaoUserController { @PostMapping("/create") @JsonView(ResponseView.Public.class) public GaoUser create(@RequestBody GaoUser gaoUser) { - if (!roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name())) { - gaoUser.setStoreId(gaoStoreService.getByUserId(userLoginService.getRequireLoginUserId()).getId()); - } + gaoUser.setStoreId(storeScopeService.resolveStoreId(gaoUser.getStoreId())); service.create(gaoUser); return service.get(gaoUser.getId()); } @@ -148,6 +147,12 @@ public class GaoUserController { @PostMapping("/update") @JsonView(ResponseView.Public.class) public GaoUser update(@RequestBody GaoUser gaoUser) { + TimiException.required(gaoUser, "not found gao user"); + TimiException.required(gaoUser.getId(), "not found gao user.id"); + GaoUser dbGaoUser = service.get(gaoUser.getId()); + TimiException.required(dbGaoUser, "not found gao user"); + storeScopeService.checkStoreId(dbGaoUser.getStoreId()); + gaoUser.setStoreId(dbGaoUser.getStoreId()); service.update(gaoUser); return service.get(gaoUser.getId()); } @@ -158,6 +163,12 @@ public class GaoUserController { @PostMapping("/transfer/store") @JsonView(ResponseView.Public.class) public GaoUser transferStore(@RequestBody GaoUser gaoUser) { + TimiException.required(gaoUser, "not found gao user"); + TimiException.required(gaoUser.getId(), "not found gao user.id"); + GaoUser dbGaoUser = service.get(gaoUser.getId()); + TimiException.required(dbGaoUser, "not found gao user"); + storeScopeService.checkStoreId(dbGaoUser.getStoreId()); + gaoUser.setStoreId(storeScopeService.resolveStoreId(gaoUser.getStoreId())); service.transferStore(gaoUser); return service.get(gaoUser.getId()); } @@ -167,6 +178,9 @@ public class GaoUserController { @RequireGaoPermission(GaoPermissionCode.USER_DELETE) @PostMapping("/delete") public void delete(@RequestParam String id) { + GaoUser gaoUser = service.get(id); + TimiException.required(gaoUser, "not found gao user"); + storeScopeService.checkStoreId(gaoUser.getStoreId()); service.delete(id); } @@ -175,7 +189,6 @@ public class GaoUserController { @RequireGaoPermission(GaoPermissionCode.USER_READ) @PostMapping("/role/list") public List roleList() { - // TODO 此接口获取本模块所有角色，需要限制角色 - return roleService.listByModuleCode(ModuleCode.GAO); + return authorizationScopeService.listGrantableRole(userLoginService.getRequireLoginUserId(), ModuleCode.GAO); } } diff --git a/src/main/java/com/imyeyu/api/modules/gao/service/GaoStoreScopeService.java b/src/main/java/com/imyeyu/api/modules/gao/service/GaoStoreScopeService.java new file mode 100644 index 0000000..d2e1818 --- /dev/null +++ b/src/main/java/com/imyeyu/api/modules/gao/service/GaoStoreScopeService.java @@ -0,0 +1,33 @@ +package com.imyeyu.api.modules.gao.service; + +import com.imyeyu.api.modules.gao.entity.GaoStore; + +/// GAO 门店资源范围服务 +/// +/// 同时拥有门店管理和店长角色时，按门店管理角色使用全局范围 +/// +/// @author Codex +/// @since 2026-08-23 +public interface GaoStoreScopeService { + + /// 判断当前用户是否拥有 GAO 全局范围 + /// + /// @return `true` 为允许访问全部门店 + boolean hasGlobalScope(); + + /// 将请求门店 ID 解析为当前可用门店 ID + /// + /// @param requestedStoreId 请求中的门店 ID，可为空 + /// @return 门店 ID，全局范围可为空 + String resolveStoreId(String requestedStoreId); + + /// 检查门店是否在当前用户可管理范围内 + /// + /// @param storeId 门店 ID + void checkStoreId(String storeId); + + /// 检查门店实体是否在当前用户可管理范围内 + /// + /// @param store 门店 + void checkStore(GaoStore store); +} diff --git a/src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoStoreScopeServiceImplement.java b/src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoStoreScopeServiceImplement.java new file mode 100644 index 0000000..ae37427 --- /dev/null +++ b/src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoStoreScopeServiceImplement.java @@ -0,0 +1,58 @@ +package com.imyeyu.api.modules.gao.service.implement; + +import com.imyeyu.api.bean.CoreRoleCode; +import com.imyeyu.api.bean.ModuleCode; +import com.imyeyu.api.modules.gao.bean.GaoRoleCode; +import com.imyeyu.api.modules.gao.entity.GaoStore; +import com.imyeyu.api.modules.gao.service.GaoStoreScopeService; +import com.imyeyu.api.modules.gao.service.GaoStoreService; +import com.imyeyu.api.modules.user.service.RoleChecker; +import com.imyeyu.java.TimiJava; +import com.imyeyu.java.bean.timi.TimiException; +import lombok.RequiredArgsConstructor; +import org.springframework.stereotype.Service; + +/// GAO 门店资源范围服务实现 +/// +/// @author Codex +/// @since 2026-08-23 +@Service +@RequiredArgsConstructor +public class GaoStoreScopeServiceImplement implements GaoStoreScopeService { + + private final RoleChecker roleChecker; + private final GaoStoreService gaoStoreService; + + @Override + public boolean hasGlobalScope() { + return roleChecker.hasAny(ModuleCode.CORE, CoreRoleCode.SYSTEM.name(), CoreRoleCode.ADMIN.name()) + || roleChecker.hasAny(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name()); + } + + @Override + public String resolveStoreId(String requestedStoreId) { + if (hasGlobalScope()) { + return requestedStoreId; + } + String currentStoreId = gaoStoreService.getBelongIdByRequiredLoginUserId(); + if (TimiJava.isNotEmpty(requestedStoreId)) { + TimiException.requiredTrue(currentStoreId.equals(requestedStoreId), "无权操作其他门店"); + } + return currentStoreId; + } + + @Override + public void checkStoreId(String storeId) { + TimiException.required(storeId, "not found storeId"); + if (!hasGlobalScope()) { + String currentStoreId = gaoStoreService.getBelongIdByRequiredLoginUserId(); + TimiException.requiredTrue(currentStoreId.equals(storeId), "无权操作其他门店"); + } + } + + @Override + public void checkStore(GaoStore store) { + TimiException.required(store, "not found store"); + checkStoreId(store.getId()); + } +}