diff --git a/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java b/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java index 18f3529c..d9f552a7 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java @@ -10,34 +10,38 @@ import java.util.List; import java.util.Map; /** -* @author ThinkBook -* @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service -* @createDate 2023-09-07 11:20:30 -*/ + * @author ThinkBook + * @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service + * @createDate 2023-09-07 11:20:30 + */ public interface EnterpriseStandardAuthUserService extends IService { void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission); /** * 不校验当前登陆人账号是否有权限 + * * @param lawsStandardTempPermission */ void saveTempPermissionTwo(LawsStandardTempPermission lawsStandardTempPermission); /** * 查看详情权限设置 + * * @param records */ void detailFlagSet(List> records); /** * 编辑权限设置 + * * @param records */ void editFlagSet(List> records); /** * 删除权限设置 + * * @param records */ void delFlagSet(List> records); @@ -48,13 +52,15 @@ public interface EnterpriseStandardAuthUserService extends IService standardIds); + + /** + * 指定用户Id是否有指定企标的删除权限 + * @param standardId 企标Id + * @param userId 用户Id + */ + boolean hasDelAuth(String standardId, String userId); + + /** + * 指定用户Id是否有指定企标的删除权限 + * @param standardId 企标Id + * @param userId 用户Id + */ + boolean hasEditAuth(String standardId, String userId); + + /** + * 编辑水平越权校验 + * @param standardId 企标Id + */ + void isEditHorizontalOverstep(String standardId); + + /** + * 删除水平越权校验 + * @param standardId 企标Id + */ + void isDeleteHorizontalOverstep(String standardId); } diff --git a/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java index 1dd1a9df..69ab74bb 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java @@ -82,6 +82,9 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl adminRoleCodeList; + @Resource + private ILawsEnterpriseStandardService esService; + @Override public void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission) { @@ -396,7 +399,7 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl roleList = sysUserRoleService.getRole(currentUser.getUsername()); + List roleList = sysUserRoleService.getRole(username); if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) { records.forEach(kv -> kv.put(FieldCommon.EDIT_FLAG, true)); return; @@ -411,6 +414,79 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl roleList = sysUserRoleService.getRole(currentUser.getUsername()); + // 管理员能够删除所有试用期的企标 + if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) { + String tryFlag = es.getTryFlag(); + if (tryFlag.equals(YesOrNoEnum.NO.getValue())) { + return false; + } + + Date releaseDate = es.getReleaseDate(); + int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数 + Calendar calendar = Calendar.getInstance(); + calendar.setTime(releaseDate); + calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上 + Date trialEndDate = calendar.getTime(); // 获取试用期结束日期 + + // 在适用周期之内的可以删除 + return tryFlag.equals(YesOrNoEnum.YES.getValue()) && currentDate.compareTo(trialEndDate) <= 0; + } + + // 创建人只能删除自己的试用期的企标 + String createBy = es.getCreateBy(); + String tryFlag = es.getTryFlag(); + if (tryFlag.equals(YesOrNoEnum.NO.getValue())) { + return false; + } + Date releaseDate = es.getReleaseDate(); + int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数 + Calendar calendar = Calendar.getInstance(); + calendar.setTime(releaseDate); + calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上 + Date trialEndDate = calendar.getTime(); // 获取试用期结束日期 + return username.equals(createBy) && tryFlag.equals(YesOrNoEnum.YES.getValue()) + && currentDate.compareTo(trialEndDate) <= 0; + } + + @Override + public boolean hasEditAuth(String standardId, String userId) { + SysUser user = sysUserService.getById(userId); + String username = user.getUsername(); + // 获取当前用户的角色roleCode + List roleList = sysUserRoleService.getRole(username); + if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) { + return true; + } + LawsEnterpriseStandard es = esService.getById(standardId); + String createBy = es.getCreateBy(); + return username.equals(createBy); + } + + @Override + public void isEditHorizontalOverstep(String standardId) { + if (hasEditAuth(standardId, UserUtils.getUserId())) { + return; + } + throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId)); + } + + @Override + public void isDeleteHorizontalOverstep(String standardId) { + if (hasDelAuth(standardId, UserUtils.getUserId())) { + return; + } + throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId)); + } + @Override public void delFlagSet(List> records) { String userId = UserUtils.getUserId(); diff --git a/laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java b/laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java index c694cefe..a8400891 100644 --- a/laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java +++ b/laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java @@ -123,6 +123,8 @@ public class LawsEnterpriseController { @ApiOperationSupport(order = 4) @RequiresPermissions("enterpriseStandard:edit") public Result commonEdit(@RequestBody @ApiParam("标签管理") Map parameterMap) { + // 水平越权校验 + esAuthUserService.isEditHorizontalOverstep((String) parameterMap.get("id")); parameterMap.put(FieldCommon.MODULE, MODULE_VALUE); return Result.OK(lawsCommonService.commonEdit(parameterMap)); } @@ -192,6 +194,8 @@ public class LawsEnterpriseController { @ApiOperationSupport(order = 9) @RequiresPermissions("enterpriseStandard:delete") public Result singleDelete(@RequestBody @ApiParam(name = "ids", value = "主键（多个用逗号分隔）") Map parameterMap) { + // 水平越权校验 + esAuthUserService.isDeleteHorizontalOverstep((String) parameterMap.get("id")); // 删除标准时同步删除这个标准的收藏数据 lawsStandardCollectionService.deleteByStandardId((String) parameterMap.get("ids")); lawsStandardSharingService.deleteByStandardId((String) parameterMap.get("ids"));