feat: 实现 RBAC 权限系统和数据权限控制 (004-rbac-data-permission)
主要功能: - 实现完整的 RBAC 权限系统（账号、角色、权限的多对多关联） - 基于 owner_id + shop_id 的自动数据权限过滤 - 使用 PostgreSQL WITH RECURSIVE 查询下级账号 - Redis 缓存优化下级账号查询性能（30分钟过期） - 支持多租户数据隔离和层级权限管理 技术实现: - 新增 Account、Role、Permission 模型及关联关系表 - 实现 GORM Scopes 自动应用数据权限过滤 - 添加数据库迁移脚本（000002_rbac_data_permission、000003_add_owner_id_shop_id） - 完善错误码定义（1010-1027 为 RBAC 相关错误） - 重构 main.go 采用函数拆分提高可读性 测试覆盖: - 添加 Account、Role、Permission 的集成测试 - 添加数据权限过滤的单元测试和集成测试 - 添加下级账号查询和缓存的单元测试 - 添加 API 回归测试确保向后兼容 文档更新: - 更新 README.md 添加 RBAC 功能说明 - 更新 CLAUDE.md 添加技术栈和开发原则 - 添加 docs/004-rbac-data-permission/ 功能总结和使用指南 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
246
internal/service/permission/service.go
Normal file
246
internal/service/permission/service.go
Normal file
@@ -0,0 +1,246 @@
|
||||
package permission
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"regexp"
|
||||
|
||||
"github.com/break/junhong_cmp_fiber/internal/model"
|
||||
"github.com/break/junhong_cmp_fiber/internal/store"
|
||||
"github.com/break/junhong_cmp_fiber/internal/store/postgres"
|
||||
"github.com/break/junhong_cmp_fiber/pkg/constants"
|
||||
"github.com/break/junhong_cmp_fiber/pkg/errors"
|
||||
"github.com/break/junhong_cmp_fiber/pkg/middleware"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// permCodeRegex 权限编码格式验证正则（module:action）
|
||||
var permCodeRegex = regexp.MustCompile(`^[a-z][a-z0-9_]*:[a-z][a-z0-9_]*$`)
|
||||
|
||||
// Service 权限业务服务
|
||||
type Service struct {
|
||||
permissionStore *postgres.PermissionStore
|
||||
}
|
||||
|
||||
// New 创建权限服务
|
||||
func New(permissionStore *postgres.PermissionStore) *Service {
|
||||
return &Service{
|
||||
permissionStore: permissionStore,
|
||||
}
|
||||
}
|
||||
|
||||
// Create 创建权限
|
||||
func (s *Service) Create(ctx context.Context, req *model.CreatePermissionRequest) (*model.Permission, error) {
|
||||
// 获取当前用户 ID
|
||||
currentUserID := middleware.GetUserIDFromContext(ctx)
|
||||
if currentUserID == 0 {
|
||||
return nil, errors.New(errors.CodeUnauthorized, "未授权访问")
|
||||
}
|
||||
|
||||
// 验证权限编码格式
|
||||
if !permCodeRegex.MatchString(req.PermCode) {
|
||||
return nil, errors.New(errors.CodeInvalidPermCode, "权限编码格式不正确（应为 module:action 格式）")
|
||||
}
|
||||
|
||||
// 检查权限编码唯一性
|
||||
existing, err := s.permissionStore.GetByCode(ctx, req.PermCode)
|
||||
if err == nil && existing != nil {
|
||||
return nil, errors.New(errors.CodePermCodeExists, "权限编码已存在")
|
||||
}
|
||||
|
||||
// 验证 parent_id 存在（如果提供）
|
||||
if req.ParentID != nil {
|
||||
parent, err := s.permissionStore.GetByID(ctx, *req.ParentID)
|
||||
if err != nil || parent == nil {
|
||||
return nil, errors.New(errors.CodeNotFound, "上级权限不存在")
|
||||
}
|
||||
}
|
||||
|
||||
// 创建权限
|
||||
permission := &model.Permission{
|
||||
PermName: req.PermName,
|
||||
PermCode: req.PermCode,
|
||||
PermType: req.PermType,
|
||||
URL: req.URL,
|
||||
ParentID: req.ParentID,
|
||||
Sort: req.Sort,
|
||||
Status: constants.StatusEnabled,
|
||||
Creator: currentUserID,
|
||||
Updater: currentUserID,
|
||||
}
|
||||
|
||||
if err := s.permissionStore.Create(ctx, permission); err != nil {
|
||||
return nil, fmt.Errorf("创建权限失败: %w", err)
|
||||
}
|
||||
|
||||
return permission, nil
|
||||
}
|
||||
|
||||
// Get 获取权限
|
||||
func (s *Service) Get(ctx context.Context, id uint) (*model.Permission, error) {
|
||||
permission, err := s.permissionStore.GetByID(ctx, id)
|
||||
if err != nil {
|
||||
if err == gorm.ErrRecordNotFound {
|
||||
return nil, errors.New(errors.CodePermissionNotFound, "权限不存在")
|
||||
}
|
||||
return nil, fmt.Errorf("获取权限失败: %w", err)
|
||||
}
|
||||
return permission, nil
|
||||
}
|
||||
|
||||
// Update 更新权限
|
||||
func (s *Service) Update(ctx context.Context, id uint, req *model.UpdatePermissionRequest) (*model.Permission, error) {
|
||||
// 获取当前用户 ID
|
||||
currentUserID := middleware.GetUserIDFromContext(ctx)
|
||||
if currentUserID == 0 {
|
||||
return nil, errors.New(errors.CodeUnauthorized, "未授权访问")
|
||||
}
|
||||
|
||||
// 获取现有权限
|
||||
permission, err := s.permissionStore.GetByID(ctx, id)
|
||||
if err != nil {
|
||||
if err == gorm.ErrRecordNotFound {
|
||||
return nil, errors.New(errors.CodePermissionNotFound, "权限不存在")
|
||||
}
|
||||
return nil, fmt.Errorf("获取权限失败: %w", err)
|
||||
}
|
||||
|
||||
// 更新字段
|
||||
if req.PermName != nil {
|
||||
permission.PermName = *req.PermName
|
||||
}
|
||||
if req.PermCode != nil {
|
||||
// 验证权限编码格式
|
||||
if !permCodeRegex.MatchString(*req.PermCode) {
|
||||
return nil, errors.New(errors.CodeInvalidPermCode, "权限编码格式不正确（应为 module:action 格式）")
|
||||
}
|
||||
// 检查新权限编码唯一性
|
||||
existing, err := s.permissionStore.GetByCode(ctx, *req.PermCode)
|
||||
if err == nil && existing != nil && existing.ID != id {
|
||||
return nil, errors.New(errors.CodePermCodeExists, "权限编码已存在")
|
||||
}
|
||||
permission.PermCode = *req.PermCode
|
||||
}
|
||||
if req.URL != nil {
|
||||
permission.URL = *req.URL
|
||||
}
|
||||
if req.ParentID != nil {
|
||||
// 验证 parent_id 存在
|
||||
parent, err := s.permissionStore.GetByID(ctx, *req.ParentID)
|
||||
if err != nil || parent == nil {
|
||||
return nil, errors.New(errors.CodeNotFound, "上级权限不存在")
|
||||
}
|
||||
permission.ParentID = req.ParentID
|
||||
}
|
||||
if req.Sort != nil {
|
||||
permission.Sort = *req.Sort
|
||||
}
|
||||
if req.Status != nil {
|
||||
permission.Status = *req.Status
|
||||
}
|
||||
|
||||
permission.Updater = currentUserID
|
||||
|
||||
if err := s.permissionStore.Update(ctx, permission); err != nil {
|
||||
return nil, fmt.Errorf("更新权限失败: %w", err)
|
||||
}
|
||||
|
||||
return permission, nil
|
||||
}
|
||||
|
||||
// Delete 软删除权限
|
||||
func (s *Service) Delete(ctx context.Context, id uint) error {
|
||||
// 检查权限存在
|
||||
_, err := s.permissionStore.GetByID(ctx, id)
|
||||
if err != nil {
|
||||
if err == gorm.ErrRecordNotFound {
|
||||
return errors.New(errors.CodePermissionNotFound, "权限不存在")
|
||||
}
|
||||
return fmt.Errorf("获取权限失败: %w", err)
|
||||
}
|
||||
|
||||
if err := s.permissionStore.Delete(ctx, id); err != nil {
|
||||
return fmt.Errorf("删除权限失败: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// List 查询权限列表
|
||||
func (s *Service) List(ctx context.Context, req *model.PermissionListRequest) ([]*model.Permission, int64, error) {
|
||||
opts := &store.QueryOptions{
|
||||
Page: req.Page,
|
||||
PageSize: req.PageSize,
|
||||
OrderBy: "sort ASC, id ASC",
|
||||
}
|
||||
if opts.Page == 0 {
|
||||
opts.Page = 1
|
||||
}
|
||||
if opts.PageSize == 0 {
|
||||
opts.PageSize = constants.DefaultPageSize
|
||||
}
|
||||
|
||||
filters := make(map[string]interface{})
|
||||
if req.PermName != "" {
|
||||
filters["perm_name"] = req.PermName
|
||||
}
|
||||
if req.PermCode != "" {
|
||||
filters["perm_code"] = req.PermCode
|
||||
}
|
||||
if req.PermType != nil {
|
||||
filters["perm_type"] = *req.PermType
|
||||
}
|
||||
if req.ParentID != nil {
|
||||
filters["parent_id"] = *req.ParentID
|
||||
}
|
||||
if req.Status != nil {
|
||||
filters["status"] = *req.Status
|
||||
}
|
||||
|
||||
return s.permissionStore.List(ctx, opts, filters)
|
||||
}
|
||||
|
||||
// GetTree 获取权限树
|
||||
func (s *Service) GetTree(ctx context.Context) ([]*model.PermissionTreeNode, error) {
|
||||
// 获取所有权限
|
||||
permissions, err := s.permissionStore.GetAll(ctx)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("获取权限列表失败: %w", err)
|
||||
}
|
||||
|
||||
// 构建树结构
|
||||
return buildPermissionTree(permissions), nil
|
||||
}
|
||||
|
||||
// buildPermissionTree 构建权限树
|
||||
func buildPermissionTree(permissions []*model.Permission) []*model.PermissionTreeNode {
|
||||
// 转换为节点映射
|
||||
nodeMap := make(map[uint]*model.PermissionTreeNode)
|
||||
for _, p := range permissions {
|
||||
nodeMap[p.ID] = &model.PermissionTreeNode{
|
||||
ID: p.ID,
|
||||
PermName: p.PermName,
|
||||
PermCode: p.PermCode,
|
||||
PermType: p.PermType,
|
||||
URL: p.URL,
|
||||
Sort: p.Sort,
|
||||
Children: make([]*model.PermissionTreeNode, 0),
|
||||
}
|
||||
}
|
||||
|
||||
// 构建树
|
||||
var roots []*model.PermissionTreeNode
|
||||
for _, p := range permissions {
|
||||
node := nodeMap[p.ID]
|
||||
if p.ParentID == nil || *p.ParentID == 0 {
|
||||
roots = append(roots, node)
|
||||
} else if parent, ok := nodeMap[*p.ParentID]; ok {
|
||||
parent.Children = append(parent.Children, node)
|
||||
} else {
|
||||
// 如果找不到父节点，作为根节点处理
|
||||
roots = append(roots, node)
|
||||
}
|
||||
}
|
||||
|
||||
return roots
|
||||
}
|
||||
Reference in New Issue
Block a user