dromara/dax-pay
1
0
Fork 0
mirror of https://gitee.com/dromara/dax-pay.git synced 2025-11-30 01:02:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix 角色分配判断是否越权未考虑到子孙角色, 补充一些请求权限注解

Browse Source
This commit is contained in:
DaxPay
2024-10-10 18:36:53 +08:00
parent e72c5ccd32
commit 3e6c4eb92f
7 changed files with 60 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bootx-platform/bootx-platform-common/common-cache/src/main/java/cn/bootx/platform/common/cache/manager/CachingConfiguration.java vendored
View File

@@ -7,7 +7,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.cache.CacheManager;
import org.springframework.cache.annotation.CachingConfigurerSupport;
import org.springframework.cache.annotation.CachingConfigurer;
import org.springframework.cache.annotation.EnableCaching;
import org.springframework.cache.interceptor.KeyGenerator;
import org.springframework.context.annotation.Bean;
@@ -31,7 +31,7 @@ import java.time.Duration;
@EnableConfigurationProperties(CachingProperties.class)
@ConditionalOnClass(CacheManager.class)
@ConditionalOnProperty(prefix = "bootx-platform.cache", value = "enabled", havingValue = "true", matchIfMissing = true)
public class CachingConfiguration extends CachingConfigurerSupport {
public class CachingConfiguration implements CachingConfigurer {
private final CachingProperties cachingProperties;

32
bootx-platform/bootx-platform-service/service-iam/src/main/java/cn/bootx/platform/iam/service/upms/UserRoleService.java
View File

@@ -4,13 +4,14 @@ import cn.bootx.platform.common.mybatisplus.util.MpUtil;
import cn.bootx.platform.core.entity.UserDetail;
import cn.bootx.platform.core.exception.BizException;
import cn.bootx.platform.core.exception.ValidationFailedException;
import cn.bootx.platform.core.util.TreeBuildUtil;
import cn.bootx.platform.iam.dao.role.RoleManager;
import cn.bootx.platform.iam.dao.upms.UserRoleManager;
import cn.bootx.platform.iam.dao.user.UserInfoManager;
import cn.bootx.platform.iam.entity.role.Role;
import cn.bootx.platform.iam.entity.upms.UserRole;
import cn.bootx.platform.iam.entity.user.UserInfo;
import cn.bootx.platform.iam.result.role.RoleResult;
import cn.bootx.platform.iam.service.role.RoleQueryService;
import cn.bootx.platform.starter.auth.util.SecurityUtil;
import cn.hutool.core.collection.CollUtil;
import lombok.RequiredArgsConstructor;
@@ -36,6 +37,8 @@ public class UserRoleService {
private final RoleManager roleManager;
private final RoleQueryService roleQueryService;
private final UserInfoManager userInfoManager;
private final UserRoleManager userRoleManager;
@@ -46,7 +49,12 @@ public class UserRoleService {
@Transactional(rollbackFor = Exception.class)
public void saveAssign(Long userId, List<Long> roleIds) {
// 判断是否越权
List<Long> roleIdsByUser = this.findRoleIdsByUser();
List<RoleResult> roleTree = roleQueryService.tree();
List<Long> roleIdsByUser = TreeBuildUtil.unfold(roleTree, RoleResult::getChildren)
.stream()
.distinct()
.map(RoleResult::getId)
.toList();
if (!CollUtil.containsAll(roleIdsByUser, roleIds)){
throw new ValidationFailedException("角色分配超出了可分配的范围");
}
@@ -63,7 +71,13 @@ public class UserRoleService {
*/
@Transactional(rollbackFor = Exception.class)
public void saveAssignBatch(List<Long> userIds, List<Long> roleIds) {
List<Long> roleIdsByUser = this.findRoleIdsByUser();
// 判断是否越权
List<RoleResult> roleTree = roleQueryService.tree();
List<Long> roleIdsByUser = TreeBuildUtil.unfold(roleTree, RoleResult::getChildren)
.stream()
.distinct()
.map(RoleResult::getId)
.toList();
if (!CollUtil.containsAll(roleIdsByUser, roleIds)){
throw new ValidationFailedException("角色分配超出了可分配的范围");
}
@@ -106,18 +120,6 @@ public class UserRoleService {
.toList();
}
/**
* 查询用户关联的角色, 超级管理员返回全部
*/
private List<Long> findRoleIdsByUser() {
UserDetail user = SecurityUtil.getUser();
if (user.isAdmin()){
return roleManager.findAll().stream().map(Role::getId).toList();
} else {
return findRoleIdsByUser(user.getId());
}
}
/**
* 判断当前登录用户和指定角色是否为符合下列条件
* 1. 为超级管理员