权限相关调整

2026-09-10 16:43:11 +08:00
parent 1fd557a19e
commit f858b04701
19 changed files with 393 additions and 53 deletions
@@ -0,0 +1,50 @@
+namespace SimpleAdmin.Application;
+
+/// <summary>
+/// 入职业务数据操作权限校验。
+/// 普通人事可查看全部业务数据，但只能操作本人创建的数据；拥有模块“管理全部”按钮权限的人员可操作全部数据。
+/// </summary>
+public class OnboardingDataPermissionService : IOnboardingDataPermissionService
+{
+    private readonly ISysUserService _sysUserService;
+
+    public OnboardingDataPermissionService(ISysUserService sysUserService)
+    {
+        _sysUserService = sysUserService;
+    }
+
+    public async Task<bool> CanManage(long? createUserId, string manageAllPermissionCode)
+    {
+        if (UserManager.SuperAdmin)
+            return true;
+
+        if (createUserId.HasValue && createUserId.Value == UserManager.UserId)
+            return true;
+
+        var buttonCodes = await _sysUserService.GetButtonCodeList(UserManager.UserId);
+        return buttonCodes.Contains(manageAllPermissionCode);
+    }
+
+    public async Task EnsureCanManage(long? createUserId, string manageAllPermissionCode, string dataName)
+    {
+        if (!await CanManage(createUserId, manageAllPermissionCode))
+            throw Oops.Bah($"只能操作本人创建的{dataName}");
+    }
+
+    public async Task EnsureCanManage(
+        IEnumerable<long?> createUserIds,
+        string manageAllPermissionCode,
+        string dataName)
+    {
+        var owners = createUserIds.Distinct().ToList();
+        if (owners.Count == 0)
+            return;
+
+        if (UserManager.SuperAdmin || owners.All(id => id.HasValue && id.Value == UserManager.UserId))
+            return;
+
+        var buttonCodes = await _sysUserService.GetButtonCodeList(UserManager.UserId);
+        if (!buttonCodes.Contains(manageAllPermissionCode))
+            throw Oops.Bah($"所选数据中包含他人创建的{dataName}，不能操作");
+    }
+}