优化结构

2026-08-29 02:58:00 +08:00
parent 3d108ebdfe
commit b6d25c1a0f
24 changed files with 1657 additions and 224 deletions
@@ -0,0 +1,200 @@
+package system
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	platformmodule "kra/pkg/module"
+
+	"gorm.io/gorm"
+)
+
+// EnsureAdminSurface upgrades an already initialized installation with a
+// module's current menus, API metadata, root menu links, and root policies.
+// It intentionally does nothing before first-install seed data exists.
+func EnsureAdminSurface(db *gorm.DB, surface platformmodule.Surface, rootAuthorityID uint) error {
+	if db == nil || !db.Migrator().HasTable(&menuPO{}) || !db.Migrator().HasTable(&apiPO{}) {
+		return nil
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		parentIDs := map[string]uint{}
+		for _, item := range surface.Menus {
+			if item.ParentName == "" {
+				continue
+			}
+			if _, ok := parentIDs[item.ParentName]; ok {
+				continue
+			}
+			var parent menuPO
+			if err := tx.Where("name = ?", item.ParentName).First(&parent).Error; err != nil {
+				if errors.Is(err, gorm.ErrRecordNotFound) {
+					return nil
+				}
+				return err
+			}
+			parentIDs[item.ParentName] = parent.ID
+		}
+
+		menus := make([]menuPO, 0, len(surface.Menus))
+		for _, item := range surface.Menus {
+			menu := menuPO{
+				MenuLevel: 1, ParentID: parentIDs[item.ParentName], Path: item.Path, Name: item.Name,
+				Component: item.Component, Title: item.Title, Icon: item.Icon, Sort: item.Sort,
+			}
+			if item.ParentName == "" {
+				menu.MenuLevel = 0
+			}
+			var current menuPO
+			err := tx.Where("name = ?", item.Name).First(&current).Error
+			switch {
+			case errors.Is(err, gorm.ErrRecordNotFound):
+				if err = tx.Create(&menu).Error; err != nil {
+					return err
+				}
+			case err != nil:
+				return err
+			default:
+				if err = tx.Model(&current).Updates(map[string]any{
+					"menu_level": menu.MenuLevel, "parent_id": menu.ParentID, "path": menu.Path,
+					"component": menu.Component, "title": menu.Title, "icon": menu.Icon, "sort": menu.Sort,
+				}).Error; err != nil {
+					return err
+				}
+				menu.ID = current.ID
+			}
+			menus = append(menus, menu)
+		}
+
+		apis := make([]apiPO, 0, len(surface.APIs))
+		for _, item := range surface.APIs {
+			api := apiPO{Path: item.Path, Method: strings.ToUpper(item.Method), APIGroup: item.Group, Description: item.Description}
+			var current apiPO
+			err := tx.Where("path = ? AND method = ?", api.Path, api.Method).First(&current).Error
+			switch {
+			case errors.Is(err, gorm.ErrRecordNotFound):
+				if err = tx.Create(&api).Error; err != nil {
+					return err
+				}
+			case err != nil:
+				return err
+			default:
+				if err = tx.Model(&current).Updates(map[string]any{"api_group": api.APIGroup, "description": api.Description}).Error; err != nil {
+					return err
+				}
+				api.ID = current.ID
+			}
+			apis = append(apis, api)
+		}
+
+		if rootAuthorityID == 0 || !tx.Migrator().HasTable(&authorityPO{}) || !tx.Migrator().HasTable(&authorityMenuPO{}) || !tx.Migrator().HasTable(&casbinRulePO{}) {
+			return nil
+		}
+		var root authorityPO
+		if err := tx.Where("authority_id = ?", rootAuthorityID).First(&root).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return err
+		}
+		for _, menu := range menus {
+			link := authorityMenuPO{SysAuthorityAuthorityID: rootAuthorityID, SysBaseMenuID: menu.ID}
+			var count int64
+			if err := tx.Model(&authorityMenuPO{}).
+				Where("sys_authority_authority_id = ? AND sys_base_menu_id = ?", rootAuthorityID, menu.ID).
+				Count(&count).Error; err != nil {
+				return err
+			}
+			if count == 0 {
+				if err := tx.Create(&link).Error; err != nil {
+					return err
+				}
+			}
+		}
+		for _, api := range apis {
+			exists, err := policyExists(tx, rootAuthorityID, api.Path, api.Method)
+			if err != nil {
+				return err
+			}
+			if !exists {
+				rule := newPolicyRule(rootAuthorityID, api.Path, api.Method)
+				if err := tx.Create(&rule).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
+// InheritAPIPolicy grants a new route only to authorities that already own
+// the supplied predecessor route. This preserves existing read-access intent
+// without broadening unrelated write permissions.
+func InheritAPIPolicy(db *gorm.DB, sourcePath, sourceMethod, targetPath, targetMethod string) error {
+	if db == nil || !db.Migrator().HasTable(&casbinRulePO{}) {
+		return nil
+	}
+	sourceMethod = strings.ToUpper(sourceMethod)
+	targetMethod = strings.ToUpper(targetMethod)
+	return db.Transaction(func(tx *gorm.DB) error {
+		var rows []casbinRulePO
+		if err := policyScope(tx).Where("v1 = ? AND v2 = ?", sourcePath, sourceMethod).Find(&rows).Error; err != nil {
+			return err
+		}
+		for _, row := range rows {
+			parsed, err := strconv.ParseUint(row.V0, 10, 64)
+			if err != nil {
+				continue
+			}
+			authorityID := uint(parsed)
+			exists, err := policyExists(tx, authorityID, targetPath, targetMethod)
+			if err != nil {
+				return err
+			}
+			if !exists {
+				rule := newPolicyRule(authorityID, targetPath, targetMethod)
+				if err := tx.Create(&rule).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
+// GrantMenuAPIs makes a visible administration menu usable by granting only
+// its explicitly supplied API set to authorities that already own the menu.
+func GrantMenuAPIs(db *gorm.DB, menuName string, apis []platformmodule.API) error {
+	if db == nil || !db.Migrator().HasTable(&menuPO{}) || !db.Migrator().HasTable(&authorityMenuPO{}) || !db.Migrator().HasTable(&casbinRulePO{}) {
+		return nil
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		var menu menuPO
+		if err := tx.Where("name = ?", menuName).First(&menu).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return err
+		}
+		var links []authorityMenuPO
+		if err := tx.Where("sys_base_menu_id = ?", menu.ID).Find(&links).Error; err != nil {
+			return err
+		}
+		for _, link := range links {
+			for _, api := range apis {
+				method := strings.ToUpper(api.Method)
+				exists, err := policyExists(tx, link.SysAuthorityAuthorityID, api.Path, method)
+				if err != nil {
+					return err
+				}
+				if !exists {
+					rule := newPolicyRule(link.SysAuthorityAuthorityID, api.Path, method)
+					if err := tx.Create(&rule).Error; err != nil {
+						return err
+					}
+				}
+			}
+		}
+		return nil
+	})
+}