From 44af16f451361084e8af46517141a36311fb991e Mon Sep 17 00:00:00 2001 From: Timi Date: Tue, 11 Aug 2026 22:06:53 +0800 Subject: [PATCH] fix new permission D authorize fail --- ...AuthorizationBoundaryServiceImplement.java | 2 -- .../implement/RoleServiceImplement.java | 28 +++++++++++-------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java b/src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java index e0c947c..30baa9c 100644 --- a/src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java +++ b/src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java @@ -173,7 +173,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound } List permissionList = permissionMapper.selectByIdList(permissionIdList.stream().toList()); checkPermissionIdListComplete(permissionIdList, permissionList); - Set allPermissionIdSet = listRoleAllPermissionId(operatorUserId, roleId); boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId()); Set parentDelegationPermissionIdSet = listParentDelegationPermissionId(roleId); if (!isCoreDelegationRoot(role)) { @@ -182,7 +181,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound Set operatorGrantablePermissionIdSet = listGrantablePermissionId(operatorUserId, permissionList); for (Permission permission : permissionList) { TimiException.requiredTrue(role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission), "不能配置其他模块转授权限"); - TimiException.requiredTrue(isCoreDelegationRoot(role) || allPermissionIdSet.contains(permission.getId()), "转授权限必须先属于目标角色有效权限：%s".formatted(permission.getCode())); if (hasParentRole) { TimiException.requiredTrue(parentDelegationPermissionIdSet.contains(permission.getId()), "转授权限超过上级边界：%s".formatted(permission.getCode())); } diff --git a/src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java b/src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java index 94a25ac..99a5850 100644 --- a/src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java +++ b/src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java @@ -151,7 +151,6 @@ public class RoleServiceImplement extends AbstractEntityService im if (TimiJava.isNotEmpty(deleteIdList)) { rolePermissionMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList)); - rolePermissionDelegationMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList)); } if (TimiJava.isNotEmpty(addIdList)) { List rolePermissionList = new ArrayList<>(); @@ -284,19 +283,20 @@ public class RoleServiceImplement extends AbstractEntityService im String loginUserId = userLoginService.getRequireLoginUserId(); Role role = mapper.selectById(roleId); TimiException.required(role, "not found role"); - List allPermissionList = isCoreDelegationRoot(role) - ? Arrays.stream(ModuleCode.values()).flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream()).toList() - : listPermissionByRoleId(roleId); - Set allPermissionIdSet = allPermissionList.stream().map(Permission::getId).collect(Collectors.toSet()); - Set operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, allPermissionList); boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId()); - Set parentDelegationIdSet = listDelegationParentPermissionId(roleId); boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId); - return allPermissionList.stream() - .filter(permission -> allPermissionIdSet.contains(permission.getId())) - .filter(permission -> parentDelegationIdSet.contains(permission.getId()) || isCoreDelegationRoot(role) && systemAdmin && !hasParentRole) - .filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin) - .toList(); + Set candidateIdSet = isCoreDelegationRoot(role) && systemAdmin && !hasParentRole + ? Arrays.stream(ModuleCode.values()) + .flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream()) + .map(Permission::getId) + .collect(Collectors.toSet()) + : listDelegationParentPermissionId(roleId); + List candidateList = listPermissionById(candidateIdSet); + Set operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, candidateList); + return candidateList.stream() + .filter(permission -> role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission)) + .filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin) + .toList(); } @Transactional(TimiServerDBConfig.ROLLBACKER) @@ -411,6 +411,10 @@ public class RoleServiceImplement extends AbstractEntityService im && (com.imyeyu.api.bean.CoreRoleCode.SYSTEM.name().equals(role.getCode()) || com.imyeyu.api.bean.CoreRoleCode.ADMIN.name().equals(role.getCode())); } + private boolean isCoreAuthorizationPermission(Permission permission) { + return permission != null && ModuleCode.CORE == permission.getModuleCode(); + } + private Set listOperatorGrantablePermissionId(String loginUserId, List permissionList) { if (TimiJava.isEmpty(permissionList)) { return Set.of();