8fdb25e6bd
后端： - 种子数据：超级管理员(admin/admin123)、super_admin 角色、22 条菜单(含按钮权限码)、角色绑定 - admin_menu 扩展 icon/component/hidden 字段(003_schema_ext.sql)，手动补齐 entity/do/table - auth 扩展：/auth/info、/auth/codes（仅登录），路由拆分公开/Profile/受保护三组 - 菜单路由：/menu/routes 返回 vben backend 动态路由树（按角色过滤、排序） - RBAC 管理：/admins、/roles、/menus CRUD（含角色绑定、重置密码、菜单授权） - 日志监控：/log/files、/log/tail（尾部读取+关键词过滤+路径穿越防护） - 安全加固：接口鉴权改为「方法+路径→权限码」自动映射，杜绝任意权限码越权 - 修复：gf v2.10.2 不自动替换→cmd 注入；MySQL driver 需显式引入 contrib - 全链路冒烟测试通过（含越权拒绝 30003）
68 lines
2.1 KiB
Go
68 lines
2.1 KiB
Go
package admin
|
|
|
|
import (
|
|
"context"
|
|
|
|
adminv1 "service.xpcool.com/api/admin/v1"
|
|
"service.xpcool.com/internal/model/dto"
|
|
"service.xpcool.com/internal/service"
|
|
)
|
|
|
|
// ProfileController exposes the logged-in admin's own profile endpoints
|
|
// (login-only, no X-Permission required). Bind behind AdminAuthOnly.
|
|
type ProfileController struct{}
|
|
|
|
// NewProfile creates the profile controller.
|
|
func NewProfile() *ProfileController { return &ProfileController{} }
|
|
|
|
// Info returns the current administrator profile.
|
|
func (c *ProfileController) Info(ctx context.Context, req *adminv1.InfoReq) (res *adminv1.InfoRes, err error) {
|
|
info, err := service.AdminAuth().Info(ctx, adminID(ctx))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &adminv1.InfoRes{AdminID: info.AdminID, Username: info.Username, Nickname: info.Nickname, Roles: info.Roles}, nil
|
|
}
|
|
|
|
// Codes returns the button-level permission codes of the current administrator.
|
|
func (c *ProfileController) Codes(ctx context.Context, req *adminv1.CodesReq) (res *adminv1.CodesRes, err error) {
|
|
codes, err := service.AdminAuth().Codes(ctx, adminID(ctx))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &adminv1.CodesRes{Codes: codes}, nil
|
|
}
|
|
|
|
// Routes returns the current administrator's visible menu tree as vben routes.
|
|
func (c *ProfileController) Routes(ctx context.Context, req *adminv1.MenuRoutesReq) (res *adminv1.MenuRoutesRes, err error) {
|
|
routes, err := service.AdminMenu().Routes(ctx, adminID(ctx))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out := make([]*adminv1.RouteItem, 0, len(routes))
|
|
for _, r := range routes {
|
|
out = append(out, toV1Route(r))
|
|
}
|
|
return &adminv1.MenuRoutesRes{Routes: out}, nil
|
|
}
|
|
|
|
// toV1Route converts a dto route tree into the v1 API shape.
|
|
func toV1Route(r *dto.RouteItem) *adminv1.RouteItem {
|
|
item := &adminv1.RouteItem{
|
|
Name: r.Name,
|
|
Path: r.Path,
|
|
Component: r.Component,
|
|
Meta: adminv1.RouteMeta{
|
|
Title: r.Meta.Title,
|
|
Icon: r.Meta.Icon,
|
|
Order: r.Meta.Order,
|
|
Authority: r.Meta.Authority,
|
|
HideInMenu: r.Meta.HideInMenu,
|
|
},
|
|
}
|
|
for _, c := range r.Children {
|
|
item.Children = append(item.Children, toV1Route(c))
|
|
}
|
|
return item
|
|
}
|