8fdb25e6bd
后端： - 种子数据：超级管理员(admin/admin123)、super_admin 角色、22 条菜单(含按钮权限码)、角色绑定 - admin_menu 扩展 icon/component/hidden 字段(003_schema_ext.sql)，手动补齐 entity/do/table - auth 扩展：/auth/info、/auth/codes（仅登录），路由拆分公开/Profile/受保护三组 - 菜单路由：/menu/routes 返回 vben backend 动态路由树（按角色过滤、排序） - RBAC 管理：/admins、/roles、/menus CRUD（含角色绑定、重置密码、菜单授权） - 日志监控：/log/files、/log/tail（尾部读取+关键词过滤+路径穿越防护） - 安全加固：接口鉴权改为「方法+路径→权限码」自动映射，杜绝任意权限码越权 - 修复：gf v2.10.2 不自动替换→cmd 注入；MySQL driver 需显式引入 contrib - 全链路冒烟测试通过（含越权拒绝 30003）
91 lines
2.5 KiB
Go
91 lines
2.5 KiB
Go
package service
|
||
|
||
import (
|
||
"context"
|
||
"sort"
|
||
"strings"
|
||
|
||
"github.com/gogf/gf/v2/errors/gerror"
|
||
"github.com/gogf/gf/v2/text/gstr"
|
||
|
||
"service.xpcool.com/internal/dao"
|
||
"service.xpcool.com/internal/model/dto"
|
||
"service.xpcool.com/internal/model/entity"
|
||
)
|
||
|
||
type IAdminMenu interface {
|
||
// Routes returns the visible menu tree of an admin as vben route items.
|
||
Routes(context.Context, uint64) ([]*dto.RouteItem, error)
|
||
}
|
||
|
||
type adminMenu struct{}
|
||
|
||
func NewAdminMenu() IAdminMenu { return &adminMenu{} }
|
||
|
||
var localAdminMenu IAdminMenu
|
||
|
||
func AdminMenu() IAdminMenu {
|
||
if localAdminMenu == nil {
|
||
panic("AdminMenu implementation not registered")
|
||
}
|
||
return localAdminMenu
|
||
}
|
||
func RegisterAdminMenu(i IAdminMenu) { localAdminMenu = i }
|
||
|
||
// routeName converts a permission code like "system:admin" to a unique
|
||
// vben route name, e.g. "SystemAdmin".
|
||
func routeName(permission string) string {
|
||
if permission == "" {
|
||
return ""
|
||
}
|
||
return gstr.CaseCamel(strings.ReplaceAll(permission, ":", "_"))
|
||
}
|
||
|
||
func (s *adminMenu) Routes(ctx context.Context, adminID uint64) ([]*dto.RouteItem, error) {
|
||
// 当前管理员所有启用角色可见的菜单（type=1），含按钮行但不作为路由节点。
|
||
var list []entity.AdminMenu
|
||
if err := dao.AdminUserRole.Ctx(ctx).As("ur").
|
||
LeftJoin("admin_role_menu rm", "ur.role_id=rm.role_id").
|
||
LeftJoin("admin_menu m", "rm.menu_id=m.id").
|
||
Where("ur.admin_user_id", adminID).
|
||
Where("m.type", 1).
|
||
Where("m.status", 1).
|
||
Where("m.deleted_at IS NULL").
|
||
Fields("m.*").
|
||
Scan(&list); err != nil {
|
||
return nil, gerror.Wrap(err, "query admin menu routes")
|
||
}
|
||
byID := make(map[uint64]*dto.RouteItem, len(list))
|
||
for i := range list {
|
||
m := &list[i]
|
||
byID[m.Id] = &dto.RouteItem{
|
||
Name: routeName(m.Permission),
|
||
Path: m.Path,
|
||
Component: m.Component,
|
||
Meta: dto.RouteMeta{Title: m.Name, Icon: m.Icon, Order: m.Sort, HideInMenu: m.Hidden},
|
||
}
|
||
}
|
||
var roots []*dto.RouteItem
|
||
for i := range list {
|
||
m := &list[i]
|
||
item := byID[m.Id]
|
||
if m.ParentId == 0 {
|
||
roots = append(roots, item)
|
||
} else if p, ok := byID[m.ParentId]; ok {
|
||
p.Children = append(p.Children, item)
|
||
}
|
||
}
|
||
sort.Slice(roots, func(i, j int) bool { return roots[i].Meta.Order < roots[j].Meta.Order })
|
||
for _, r := range roots {
|
||
sortRouteChildren(r)
|
||
}
|
||
return roots, nil
|
||
}
|
||
|
||
func sortRouteChildren(r *dto.RouteItem) {
|
||
sort.Slice(r.Children, func(i, j int) bool { return r.Children[i].Meta.Order < r.Children[j].Meta.Order })
|
||
for _, c := range r.Children {
|
||
sortRouteChildren(c)
|
||
}
|
||
}
|