timi/TimiServerAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

v1.0.9 #16

Merged
timi merged 12 commits from dev into master 2026-08-11 16:01:10 +00:00
Conversation 0 Commits 12 Files Changed 179
+16 -14
2 changed files with 16 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 44af16f451 - Show all commits
src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java
-2
View File
@@ -173,7 +173,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound
}
List<Permission> permissionList = permissionMapper.selectByIdList(permissionIdList.stream().toList());
checkPermissionIdListComplete(permissionIdList, permissionList);
Set<String> allPermissionIdSet = listRoleAllPermissionId(operatorUserId, roleId);
boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
Set<String> parentDelegationPermissionIdSet = listParentDelegationPermissionId(roleId);
if (!isCoreDelegationRoot(role)) {
@@ -182,7 +181,6 @@ public class AuthorizationBoundaryServiceImplement implements AuthorizationBound
Set<String> operatorGrantablePermissionIdSet = listGrantablePermissionId(operatorUserId, permissionList);
for (Permission permission : permissionList) {
TimiException.requiredTrue(role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission), "不能配置其他模块转授权限");
TimiException.requiredTrue(isCoreDelegationRoot(role) || allPermissionIdSet.contains(permission.getId()), "转授权限必须先属于目标角色有效权限：%s".formatted(permission.getCode()));
if (hasParentRole) {
TimiException.requiredTrue(parentDelegationPermissionIdSet.contains(permission.getId()), "转授权限超过上级边界：%s".formatted(permission.getCode()));
}
src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java
+16 -12
View File
@@ -151,7 +151,6 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
if (TimiJava.isNotEmpty(deleteIdList)) {
rolePermissionMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
rolePermissionDelegationMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
}
if (TimiJava.isNotEmpty(addIdList)) {
List<RolePermission> rolePermissionList = new ArrayList<>();
@@ -284,19 +283,20 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
String loginUserId = userLoginService.getRequireLoginUserId();
Role role = mapper.selectById(roleId);
TimiException.required(role, "not found role");
List<Permission> allPermissionList = isCoreDelegationRoot(role)
? Arrays.stream(ModuleCode.values()).flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream()).toList()
: listPermissionByRoleId(roleId);
Set<String> allPermissionIdSet = allPermissionList.stream().map(Permission::getId).collect(Collectors.toSet());
Set<String> operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, allPermissionList);
boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
Set<String> parentDelegationIdSet = listDelegationParentPermissionId(roleId);
boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId);
return allPermissionList.stream()
.filter(permission -> allPermissionIdSet.contains(permission.getId()))
.filter(permission -> parentDelegationIdSet.contains(permission.getId()) || isCoreDelegationRoot(role) && systemAdmin && !hasParentRole)
.filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin)
.toList();
Set<String> candidateIdSet = isCoreDelegationRoot(role) && systemAdmin && !hasParentRole
? Arrays.stream(ModuleCode.values())
.flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream())
.map(Permission::getId)
.collect(Collectors.toSet())
: listDelegationParentPermissionId(roleId);
List<Permission> candidateList = listPermissionById(candidateIdSet);
Set<String> operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, candidateList);
return candidateList.stream()
.filter(permission -> role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission))
.filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin)
.toList();
}
@Transactional(TimiServerDBConfig.ROLLBACKER)
@@ -411,6 +411,10 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
&& (com.imyeyu.api.bean.CoreRoleCode.SYSTEM.name().equals(role.getCode()) || com.imyeyu.api.bean.CoreRoleCode.ADMIN.name().equals(role.getCode()));
}
private boolean isCoreAuthorizationPermission(Permission permission) {
return permission != null && ModuleCode.CORE == permission.getModuleCode();
}
private Set<String> listOperatorGrantablePermissionId(String loginUserId, List<Permission> permissionList) {
if (TimiJava.isEmpty(permissionList)) {
return Set.of();