zhengsl/WholeProcessPlatform
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: 优化权限

Browse Source
This commit is contained in:
tangwei 2026-08-28 18:08:30 +08:00
parent 84dfc91ffe
commit 83a18a31a1
9 changed files with 100 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/main/java/com/yfd/platform/system/controller/LoginController.java
View File

@ -24,6 +24,7 @@ import com.yfd.platform.system.service.ISysLogService;
import com.yfd.platform.system.service.IUserService;
import com.yfd.platform.utils.RequestHolder;
import com.yfd.platform.utils.RsaUtils;
import com.yfd.platform.utils.SecurityUtils;
import com.yfd.platform.utils.StringUtils;
import io.swagger.v3.oas.annotations.tags.Tag;
import io.swagger.v3.oas.annotations.Operation;
@ -479,7 +480,8 @@ public class LoginController {
* 判断是否为超级管理员
*/
private boolean checkIsSuperAdmin(String userId) {
String maxLevel = sysUserMapper.getMaxLevel(userId);
String tenantId = SecurityUtils.getTenantId();
String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
return "1".equals(maxLevel);
}

4
backend/src/main/java/com/yfd/platform/system/controller/SmsVerifyCodeController.java
View File

@ -18,6 +18,7 @@ import com.yfd.platform.system.service.ISysLogService;
import com.yfd.platform.system.service.IUserService;
import com.yfd.platform.utils.RequestHolder;
import com.yfd.platform.utils.RsaUtils;
import com.yfd.platform.utils.SecurityUtils;
import com.yfd.platform.utils.StringUtils;
import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
@ -579,7 +580,8 @@ public class SmsVerifyCodeController {
* 判断用户是否为超级管理员（拥有LEVEL=1的角色）
*/
private boolean isSuperAdmin(String userId) {
String maxLevel = sysUserMapper.getMaxLevel(userId);
String tenantId = SecurityUtils.getTenantId();
String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
return "1".equals(maxLevel);
}
}

2
backend/src/main/java/com/yfd/platform/system/mapper/SysUserMapper.java
View File

@ -62,7 +62,7 @@ public interface SysUserMapper extends BaseMapper<SysUser> {
* userid 用户id
* 返回值说明:
************************************/
String getMaxLevel(@Param("userId") String userId);
String getMaxLevel(@Param("userId") String userId,@Param("tenantId") String tenantId);
/***********************************
* 用途说明：根据用户id删除所分配的角色

3
backend/src/main/java/com/yfd/platform/system/service/impl/AdminAuthServiceImpl.java
View File

@ -75,7 +75,8 @@ public class AdminAuthServiceImpl implements IAdminAuthService {
@Override
public boolean isCurrentManagedAdmin() {
// SysUser sysUser = userMapper.selectById(SecurityUtils.getUserId());
String maxLevel = userMapper.getMaxLevel(SecurityUtils.getUserId());
String tenantId = SecurityUtils.getTenantId();
String maxLevel = userMapper.getMaxLevel(SecurityUtils.getUserId(),tenantId);
boolean adminRole = "1".equals(maxLevel);
String currentUsername = SecurityUtils.getCurrentUsername();
return adminRole||isManagedAdminUsername(currentUsername);

4
backend/src/main/java/com/yfd/platform/system/service/impl/UserDetailsServiceImpl.java
View File

@ -11,6 +11,7 @@ import com.yfd.platform.system.mapper.SysUserMapper;
import com.yfd.platform.system.mapper.SysUserTenantMapper;
import com.yfd.platform.system.service.IAdminAuthService;
import com.yfd.platform.system.service.IUserService;
import com.yfd.platform.utils.SecurityUtils;
import jakarta.servlet.http.HttpServletRequest;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
@ -105,7 +106,8 @@ public class UserDetailsServiceImpl implements UserDetailsService {
* 判断用户是否为超级管理员（拥有LEVEL=1的角色）
*/
private boolean isSuperAdmin(String userId) {
String maxLevel = sysUserMapper.getMaxLevel(userId);
String tenantId = SecurityUtils.getTenantId();
String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
return "1".equals(maxLevel);
}
}

6
backend/src/main/java/com/yfd/platform/system/service/impl/UserServiceImpl.java
View File

@ -543,7 +543,8 @@ public class UserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impleme
return true;
}
String currentUserId = SecurityUtils.getUserId();
String level = sysUserMapper.getMaxLevel(currentUserId);
String tenantId = SecurityUtils.getTenantId();
String level = sysUserMapper.getMaxLevel(currentUserId, tenantId);
Integer roleLevel = parseRoleLevel(level);
return roleLevel != null && roleLevel <= 2;
}
@ -1030,7 +1031,8 @@ public class UserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impleme
public boolean isSuperAdmin(String userId) {
String maxLevel = sysUserMapper.getMaxLevel(userId);
String tenantId = SecurityUtils.getTenantId();
String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
SysUser sysUser = sysUserMapper.selectById(userId);
return (sysUser!=null && sysUser.getUsertype()==0) || "1".equals(maxLevel);
}

64
backend/src/main/java/com/yfd/platform/utils/JasyptUtil.java Normal file
View File

@ -0,0 +1,64 @@
package com.yfd.platform.utils;
import org.jasypt.encryption.pbe.StandardPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig;
/**
* Jasypt 加密解密工具
* 配置：算法 PBEWithMD5AndTripleDES，密钥 dec，迭代次数 1000（默认）
*/
public class JasyptUtil {
private static final String PASSWORD = "dec";
// 建议使用标准名称（Java 内部识别），原写法也兼容但推荐此写法
private static final String ALGORITHM = "PBEWithMD5AndTripleDES";
private static final int ITERATIONS = 1000;
private static StandardPBEStringEncryptor getEncryptor() {
StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
EnvironmentStringPBEConfig config = new EnvironmentStringPBEConfig();
config.setPassword(PASSWORD);
config.setAlgorithm(ALGORITHM);
config.setKeyObtentionIterations(ITERATIONS);
encryptor.setConfig(config);
return encryptor;
}
/**
* 加密明文
* @param plainText 明文
* @return 密文（Base64 字符串）
*/
public static String encrypt(String plainText) {
StandardPBEStringEncryptor encryptor = getEncryptor();
return encryptor.encrypt(plainText);
}
/**
* 解密密文
* @param cipherText 密文（Base64 字符串）
* @return 明文
* @throws org.jasypt.exceptions.EncryptionOperationNotPossibleException 如果解密失败（密钥/算法不匹配）
*/
public static String decrypt(String cipherText) {
StandardPBEStringEncryptor encryptor = getEncryptor();
return encryptor.decrypt(cipherText);
}
// 测试入口
public static void main(String[] args) {
// 1. 加密测试
String plain = "Lcj@5678.";
String encrypted = encrypt(plain);
System.out.println("加密后的密文：" + encrypted);
// 2. 解密测试（用你自己的密文）
String yourCipher = "w8ffsaU1GBbVeJ5wnBeCwoUDcadbD2oL";
try {
String decrypted = decrypt(yourCipher);
System.out.println("解密结果：" + decrypted);
} catch (Exception e) {
System.err.println("解密失败，请检查密钥或算法是否正确：" + e.getMessage());
}
}
}

20
backend/src/main/java/com/yfd/platform/utils/SecurityUtils.java
View File

@ -15,11 +15,13 @@
*/
package com.yfd.platform.utils;
import cn.hutool.core.util.StrUtil;
import cn.hutool.json.JSONArray;
import cn.hutool.json.JSONObject;
import cn.hutool.json.JSONUtil;
import com.yfd.platform.exception.BadRequestException;
import com.yfd.platform.system.domain.LoginUser;
import jakarta.servlet.http.HttpServletRequest;
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
@ -27,6 +29,8 @@ import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import java.util.Collection;
import java.util.List;
@ -38,7 +42,7 @@ import java.util.List;
*/
@Slf4j
public class SecurityUtils {
private static final String TENANT_HEADER = "Tenant_Id";
/**
* 获取当前登录的用户
* @return UserDetails
@ -142,4 +146,18 @@ public class SecurityUtils {
LoginUser loginUser = (LoginUser) authentication.getPrincipal();
return loginUser.getAccessibleTenantIds();
}
/**
* 从当前请求头中获取租户ID
* @return 租户ID，未获取到返回 null
*/
public static String getTenantId() {
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
if (attributes == null) {
return null;
}
HttpServletRequest request = attributes.getRequest();
String tenantId = request.getHeader(TENANT_HEADER);
return StrUtil.isNotBlank(tenantId) ? tenantId : null;
}
}

2
backend/src/main/resources/mapper/system/SysUserMapper.xml
View File

@ -53,7 +53,7 @@
FROM (
SELECT r."LEVEL" AS level_col
FROM sys_role r
WHERE r.id IN (SELECT roleid FROM sys_role_users WHERE userid = #{userId})
WHERE TENANT_ID = #{tenantId} AND r.id IN (SELECT roleid FROM sys_role_users WHERE userid = #{userId})
) t
</select>
<select id="queryUsers" resultType="com.yfd.platform.system.domain.SysUser">