feat: 权限添加

f0aad61d · Sxy · 29115a66 · f0aad61d · f0aad61d · f0aad61d
Commit f0aad61d authored Sep 10, 2020 by Sxy
5 changed files
--- a/center-manage/app/base/controller/ctl.base.js
+++ b/center-manage/app/base/controller/ctl.base.js
@@ -8,40 +8,43 @@ class CtlBase {
    this.cacheManager = system.getObject("db.common.cacheManager");
    this.logClient = system.getObject("util.logClient");
  }
-  getUUID () {
+  getUUID() {
    var uuid = uuidv4();
    var u = uuid.replace(/\-/g, "");
    return u;
  }
-  static getServiceName (ClassObj) {
+  static getServiceName(ClassObj) {
    return ClassObj["name"].substring(0, ClassObj["name"].lastIndexOf("Ctl")).toLowerCase() + "Sve";
  }
-  async update (pobj, qobj, req) {
+  async update(pobj, qobj, req) {
    const up = await this.service.update(pobj);
    return system.getResult(up);
  }
-  async create (pobj, qobj, req) {
+  async create(pobj, qobj, req) {
    const up = await this.service.create(pobj);
    return system.getResult(up);
  }
-  async delete (pobj, qobj, req) {
+  async delete(pobj, qobj, req) {
    const up = await this.service.delete(pobj);
    return system.getResult(up);
  }
-  async findAndCountAll (pobj, qobj, req) {
+  async findAndCountAll(pobj, qobj, req) {
    //设置查询条件
    console.log(pobj)
    const rs = await this.service.findAndCountAll(pobj);
    return system.getResult(rs);
  }
-  async refQuery (pobj, qobj, req) {
+  async findOne(obj) {
+    return this.service.findOne(obj);
+  }
+  async refQuery(pobj, qobj, req) {
    //pobj.refwhere.app_id=pobj.app_id;//角色过滤按照公司过滤
    pobj.refwhere.company_id = pobj.company_id;
    let rtn = await this.service.refQuery(pobj);
    return rtn
  }
-  async setContextParams (pobj, qobj, req) {
+  async setContextParams(pobj, qobj, req) {
    let custtags = req.headers["x-consumetag"] ? req.headers["x-consumetag"].split("|") : null;
    let lastindex = custtags ? custtags.length - 1 : 0;
    //当自由用户注册时，需要根据前端传来的companykey,查询出公司，给companyid赋值
@@ -97,7 +100,7 @@ class CtlBase {
    pobj.bizpath = req.xctx.bizpath;
  }
-  async doexec (methodname, pobj, query, req) {
+  async doexec(methodname, pobj, query, req) {
    try {
      let xarg = await this.setContextParams(pobj, query, req);
      if (xarg && xarg[0] < 0) {

--- a/center-manage/app/base/controller/impl/auth/userCtl.js
+++ b/center-manage/app/base/controller/impl/auth/userCtl.js
@@ -8,23 +8,23 @@ class UserCtl extends CtlBase {
    super("auth", CtlBase.getServiceName(UserCtl));
    this.captchaSve = system.getObject("service.auth.captchaSve");
  }
-  async logout (pobj, qobj, req) {
+  async logout(pobj, qobj, req) {
    let rtn = await this.service.logout(pobj)
    return system.getResult(rtn)
  }
-  async pmgetUserByCode (pobj, qobj, req) {
+  async pmgetUserByCode(pobj, qobj, req) {
    let code = pobj.code
    let rtn = await this.service.pmgetUserByCode(code)
    return system.getResult(rtn)
  }
-  async loginApp (pobj, qobj, req) {
+  async loginApp(pobj, qobj, req) {
    let appkey = pobj.fromAppKey
    let uname = pobj.username
    let rtn = await this.service.loginApp(appkey, uname)
    return system.getResult(rtn);
  }
-  async resetPassword (pobj, qobj, req) {
+  async resetPassword(pobj, qobj, req) {
    try {
      await this.service.resetPassword(req.xctx.username, pobj.onepassword)
      return system.getResult({});
@@ -32,18 +32,22 @@ class UserCtl extends CtlBase {
      return system.getResult(null, err.message)
    }
  }
-  async allowOrNot (pobj, qobj, req) {
+  async allowOrNot(pobj, qobj, req) {
    await this.service.updateByWhere({ isEnabled: !pobj.isEnabled }, { company_id: pobj.company_id })
    return system.getResult({});
  }
-  async allowOrNotToOne (pobj, qobj, req) {
+  async allowOrNotToOne(pobj, qobj, req) {
    if (!pobj.isEnabled) {
      await this.service.cacheManager["LoginTimesCache"].invalidate(pobj.userName)
    }
+    const userData = await this.service.findOne({ id: pobj.curid, company_id: pobj.company_id });
+    if (!userData) {
+      throw new Error("没有权限")
+    }
    await this.service.updateByWhere({ isEnabled: !pobj.isEnabled }, { id: pobj.curid })
    return system.getResult({});
  }
-  async initNewInstance (queryobj, req) {
+  async initNewInstance(queryobj, req) {
    var rtn = {};
    rtn.roles = [];
    return system.getResultSuccess(rtn);
@@ -54,11 +58,11 @@ class UserCtl extends CtlBase {
  //   let v = await this.smsS.sendVCode(mobile);
  //   return system.getResult({ vcodestr: v });
  // }
-  async exit (pobj, qobj, req) {
+  async exit(pobj, qobj, req) {
  }
  //应用的自由用户注册,无需验证，需要前端头设置公司KEY
-  async pmregisterByFreeUser (p, q, req) {
+  async pmregisterByFreeUser(p, q, req) {
    //检查是否有用户名和密码
    if (!pobj.userName || !pobj.password) {
      return system.getResult(null, "请检查用户名和密码是否存在")
@@ -72,7 +76,7 @@ class UserCtl extends CtlBase {
    return rtn;
  }
-  async create (p, q, req) {
+  async create(p, q, req) {
    //检查是否有用户名和密码
    if (!p.userName) {
      return system.getResult(null, "请检查用户名和密码是否存在")
@@ -85,7 +89,7 @@ class UserCtl extends CtlBase {
  //和租户绑定同一家公司
  //按照用户名和密码进行注册
  //控制器端检查用户名和密码非空
-  async registerByTantent (p, q, req) {
+  async registerByTantent(p, q, req) {
    //检查是否有用户名和密码
    if (!pobj.userName) {
      return system.getResult(null, "请检查用户名和密码是否存在")
@@ -94,7 +98,7 @@ class UserCtl extends CtlBase {
    return rtn;
  }
  //租户用户名和密码的租户注册
-  async pmregister (pobj, qobj, req) {
+  async pmregister(pobj, qobj, req) {
    //平台注册设置平台的应用ID
    pobj.app_id = settings.pmappid;
    //检查是否有用户名和密码
@@ -104,9 +108,9 @@ class UserCtl extends CtlBase {
    var rtn = await this.service.pmregister(pobj);
    return system.getResult(rtn);
  }
-  async pmlogin (pobj, qobj, req) {
+  async pmlogin(pobj, qobj, req) {
    //平台注册设置平台的应用ID
-    let verifyres = await this.captchaSve.apiValidator({key:pobj.key,code:pobj.code});
+    let verifyres = await this.captchaSve.apiValidator({ key: pobj.key, code: pobj.code });
    if (verifyres.status !== 0)
      return verifyres;
    let rtn = await this.service.pmlogin(pobj, qobj, req);
@@ -128,22 +132,26 @@ class UserCtl extends CtlBase {
   * @param {*} qobj 
   * @param {*} req 
   */
-  async unlockUser (pobj, qobj, req) {
+  async unlockUser(pobj, qobj, req) {
    try {
+      const userData = await this.service.findOne({ userName: pobj.userName, company_id: pobj.company_id });
+      if (!userData) {
+        throw new Error("没有权限")
+      }
      await this.service.unlockUser(pobj.userName)
      return system.getResult({});
    } catch (err) {
      return system.getResult(null, err.message)
    }
  }
-  async getUserInfo (pobj, qobj, req) {
+  async getUserInfo(pobj, qobj, req) {
    let uname = req.xctx.username;
    let rtn = await this.service.getUserInfo(uname);
    return system.getResult(rtn);
  }
  //按照电话创建自由用户
-  async pmloginByVCodeForFreeUser (p, q, req) {
+  async pmloginByVCodeForFreeUser(p, q, req) {
    if (!pobj.mobile || !pobj.vcode) {
      return system.getResult(null, "请检查手机号和验证码是否存在")
    }
@@ -154,11 +162,11 @@ class UserCtl extends CtlBase {
    let rtn = await this.service.pmloginByVCodeForFreeUser(p, q);
    return rtn;
  }
-  async pmloginByVCode (pobj, qobj, req) {
+  async pmloginByVCode(pobj, qobj, req) {
    let rtn = await this.service.pmloginByVCode(pobj, qobj);
    return system.getResult(rtn);
  }
-  async pmSendVCode (pobj, qobj, req) {
+  async pmSendVCode(pobj, qobj, req) {
    let rtn = await this.service.sendVCode(pobj, qobj);
    return system.getResult(rtn);
  }

--- a/center-manage/app/base/controller/impl/common/companyCtl.js
+++ b/center-manage/app/base/controller/impl/common/companyCtl.js
@@ -11,6 +11,11 @@ class CompanyCtl extends CtlBase {
    }
    async update(p, q, req) {
+        if (p.company_id != 1) {
+            if (p.company_id != p.id) {
+                throw new Error("没有权限");
+            }
+        }
        let u = await super.update(p, q, req)
        //缓存失效
        await this.cacheManager["CompanyCache"].invalidate(p.companykey)

--- a/center-manage/app/base/service/impl/auth/roleSve.js
+++ b/center-manage/app/base/service/impl/auth/roleSve.js
@@ -17,7 +17,7 @@ class RoleService extends ServiceBase {
      }
    })
    if (!data) {
-      throw new Error("无权限修改")
+      throw new Error("无权限")
    }
    return await this.dao.update(qobj);
  }
@@ -30,7 +30,7 @@ class RoleService extends ServiceBase {
      }
    })
    if (!data) {
-      throw new Error("无权限修改")
+      throw new Error("无权限")
    }
    return await this.dao.delete(qobj);
  }

--- a/center-manage/app/base/service/impl/auth/userSve.js
+++ b/center-manage/app/base/service/impl/auth/userSve.js
@@ -384,6 +384,13 @@ class UserService extends ServiceBase {
  //修改
  async update(qobj, tm = null) {
    var self = this;
+    const userData = await self.dao.findOne({
+      id: qobj.id,
+      company_id: qobj.company_id
+    });
+    if (!userData) {
+      throw new Error("没有权限");
+    }
    return this.db.transaction(async function (t) {
      delete qobj['company_id']
      let up = await self.dao.update(qobj, t);