fix: 优化权限

backend/src/main/java/com/yfd/platform/system/controller/LoginController.java

@@ -24,6 +24,7 @@ import com.yfd.platform.system.service.ISysLogService;
 import com.yfd.platform.system.service.IUserService;
 import com.yfd.platform.utils.RequestHolder;
 import com.yfd.platform.utils.RsaUtils;
+import com.yfd.platform.utils.SecurityUtils;
 import com.yfd.platform.utils.StringUtils;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import io.swagger.v3.oas.annotations.Operation;
@@ -479,7 +480,8 @@ public class LoginController {
      * 判断是否为超级管理员
      */
     private boolean checkIsSuperAdmin(String userId) {
-        String maxLevel = sysUserMapper.getMaxLevel(userId);
+        String tenantId = SecurityUtils.getTenantId();
+        String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
         return "1".equals(maxLevel);
     }
 

backend/src/main/java/com/yfd/platform/system/controller/SmsVerifyCodeController.java

@@ -18,6 +18,7 @@ import com.yfd.platform.system.service.ISysLogService;
 import com.yfd.platform.system.service.IUserService;
 import com.yfd.platform.utils.RequestHolder;
 import com.yfd.platform.utils.RsaUtils;
+import com.yfd.platform.utils.SecurityUtils;
 import com.yfd.platform.utils.StringUtils;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -579,7 +580,8 @@ public class SmsVerifyCodeController {
      * 判断用户是否为超级管理员（拥有LEVEL=1的角色）
      */
     private boolean isSuperAdmin(String userId) {
-        String maxLevel = sysUserMapper.getMaxLevel(userId);
+        String tenantId = SecurityUtils.getTenantId();
+        String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
         return "1".equals(maxLevel);
     }
 }

backend/src/main/java/com/yfd/platform/system/mapper/SysUserMapper.java

@@ -62,7 +62,7 @@ public interface SysUserMapper extends BaseMapper<SysUser> {
      * userid     用户id
      * 返回值说明:
      ************************************/
-    String getMaxLevel(@Param("userId") String userId);
+    String getMaxLevel(@Param("userId") String userId,@Param("tenantId") String tenantId);
 
     /***********************************
      * 用途说明：根据用户id删除所分配的角色

backend/src/main/java/com/yfd/platform/system/service/impl/AdminAuthServiceImpl.java

@@ -75,7 +75,8 @@ public class AdminAuthServiceImpl implements IAdminAuthService {
     @Override
     public boolean isCurrentManagedAdmin() {
 //        SysUser sysUser = userMapper.selectById(SecurityUtils.getUserId());
-        String maxLevel = userMapper.getMaxLevel(SecurityUtils.getUserId());
+        String tenantId = SecurityUtils.getTenantId();
+        String maxLevel = userMapper.getMaxLevel(SecurityUtils.getUserId(),tenantId);
         boolean adminRole = "1".equals(maxLevel);
         String currentUsername = SecurityUtils.getCurrentUsername();
         return adminRole||isManagedAdminUsername(currentUsername);

backend/src/main/java/com/yfd/platform/system/service/impl/UserDetailsServiceImpl.java

@@ -11,6 +11,7 @@ import com.yfd.platform.system.mapper.SysUserMapper;
 import com.yfd.platform.system.mapper.SysUserTenantMapper;
 import com.yfd.platform.system.service.IAdminAuthService;
 import com.yfd.platform.system.service.IUserService;
+import com.yfd.platform.utils.SecurityUtils;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
@@ -105,7 +106,8 @@ public class UserDetailsServiceImpl implements UserDetailsService {
      * 判断用户是否为超级管理员（拥有LEVEL=1的角色）
      */
     private boolean isSuperAdmin(String userId) {
-        String maxLevel = sysUserMapper.getMaxLevel(userId);
+        String tenantId = SecurityUtils.getTenantId();
+        String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
         return "1".equals(maxLevel);
     }
 }

backend/src/main/java/com/yfd/platform/system/service/impl/UserServiceImpl.java

@@ -543,7 +543,8 @@ public class UserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impleme
             return true;
         }
         String currentUserId = SecurityUtils.getUserId();
-        String level = sysUserMapper.getMaxLevel(currentUserId);
+        String tenantId = SecurityUtils.getTenantId();
+        String level = sysUserMapper.getMaxLevel(currentUserId, tenantId);
         Integer roleLevel = parseRoleLevel(level);
         return roleLevel != null && roleLevel <= 2;
     }
@@ -1030,7 +1031,8 @@ public class UserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impleme
 
 
     public boolean isSuperAdmin(String userId) {
-        String maxLevel = sysUserMapper.getMaxLevel(userId);
+        String tenantId = SecurityUtils.getTenantId();
+        String maxLevel = sysUserMapper.getMaxLevel(userId,tenantId);
         SysUser sysUser = sysUserMapper.selectById(userId);
         return (sysUser!=null && sysUser.getUsertype()==0) || "1".equals(maxLevel);
     }

backend/src/main/java/com/yfd/platform/utils/JasyptUtil.java

@@ -0,0 +1,64 @@
+package com.yfd.platform.utils;
+
+import org.jasypt.encryption.pbe.StandardPBEStringEncryptor;
+import org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig;
+
+/**
+ * Jasypt 加密解密工具
+ * 配置：算法 PBEWithMD5AndTripleDES，密钥 dec，迭代次数 1000（默认）
+ */
+public class JasyptUtil {
+
+    private static final String PASSWORD = "dec";
+    // 建议使用标准名称（Java 内部识别），原写法也兼容但推荐此写法
+    private static final String ALGORITHM = "PBEWithMD5AndTripleDES";
+    private static final int ITERATIONS = 1000;
+
+    private static StandardPBEStringEncryptor getEncryptor() {
+        StandardPBEStringEncryptor encryptor = new StandardPBEStringEncryptor();
+        EnvironmentStringPBEConfig config = new EnvironmentStringPBEConfig();
+        config.setPassword(PASSWORD);
+        config.setAlgorithm(ALGORITHM);
+        config.setKeyObtentionIterations(ITERATIONS);
+        encryptor.setConfig(config);
+        return encryptor;
+    }
+
+    /**
+     * 加密明文
+     * @param plainText 明文
+     * @return 密文（Base64 字符串）
+     */
+    public static String encrypt(String plainText) {
+        StandardPBEStringEncryptor encryptor = getEncryptor();
+        return encryptor.encrypt(plainText);
+    }
+
+    /**
+     * 解密密文
+     * @param cipherText 密文（Base64 字符串）
+     * @return 明文
+     * @throws org.jasypt.exceptions.EncryptionOperationNotPossibleException 如果解密失败（密钥/算法不匹配）
+     */
+    public static String decrypt(String cipherText) {
+        StandardPBEStringEncryptor encryptor = getEncryptor();
+        return encryptor.decrypt(cipherText);
+    }
+
+    // 测试入口
+    public static void main(String[] args) {
+        // 1. 加密测试
+        String plain = "Lcj@5678.";
+        String encrypted = encrypt(plain);
+        System.out.println("加密后的密文：" + encrypted);
+
+        // 2. 解密测试（用你自己的密文）
+        String yourCipher = "w8ffsaU1GBbVeJ5wnBeCwoUDcadbD2oL";
+        try {
+            String decrypted = decrypt(yourCipher);
+            System.out.println("解密结果：" + decrypted);
+        } catch (Exception e) {
+            System.err.println("解密失败，请检查密钥或算法是否正确：" + e.getMessage());
+        }
+    }
+}

backend/src/main/java/com/yfd/platform/utils/SecurityUtils.java

@@ -15,11 +15,13 @@
  */
 package com.yfd.platform.utils;
 
+import cn.hutool.core.util.StrUtil;
 import cn.hutool.json.JSONArray;
 import cn.hutool.json.JSONObject;
 import cn.hutool.json.JSONUtil;
 import com.yfd.platform.exception.BadRequestException;
 import com.yfd.platform.system.domain.LoginUser;
+import jakarta.servlet.http.HttpServletRequest;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.Authentication;
@@ -27,6 +29,8 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
 
 import java.util.Collection;
 import java.util.List;
@@ -38,7 +42,7 @@ import java.util.List;
  */
 @Slf4j
 public class SecurityUtils {
-
+    private static final String TENANT_HEADER = "Tenant_Id";
     /**
      * 获取当前登录的用户
      * @return UserDetails
@@ -142,4 +146,18 @@ public class SecurityUtils {
         LoginUser loginUser = (LoginUser) authentication.getPrincipal();
         return loginUser.getAccessibleTenantIds();
     }
+
+    /**
+     * 从当前请求头中获取租户ID
+     * @return 租户ID，未获取到返回 null
+     */
+    public static String getTenantId() {
+        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (attributes == null) {
+            return null;
+        }
+        HttpServletRequest request = attributes.getRequest();
+        String tenantId = request.getHeader(TENANT_HEADER);
+        return StrUtil.isNotBlank(tenantId) ? tenantId : null;
+    }
 }

backend/src/main/resources/mapper/system/SysUserMapper.xml

@@ -53,7 +53,7 @@
         FROM (
                  SELECT r."LEVEL" AS level_col
                  FROM sys_role r
-                 WHERE r.id IN (SELECT roleid FROM sys_role_users WHERE userid = #{userId})
+                 WHERE TENANT_ID = #{tenantId} AND r.id IN (SELECT roleid FROM sys_role_users WHERE userid = #{userId})
              ) t
     </select>
     <select id="queryUsers" resultType="com.yfd.platform.system.domain.SysUser">