优化

internal/data/permission.go

@@ -46,6 +46,12 @@ func (r *permissionRepo) Buttons(ctx context.Context, menuID uint) ([]*biz.MenuB
 	return out, nil
 }
 func (r *permissionRepo) SetAuthorityButtons(ctx context.Context, aid uint, buttons map[uint][]uint) error {
+	if err := (&authorityAccessRepo{data: r.data}).checkAuthorityIDAuth(ctx, aid); err != nil {
+		return err
+	}
+	if err := r.checkButtonAssignmentAuth(ctx, buttons); err != nil {
+		return err
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("authority_id = ?", aid).Delete(&authorityButtonPO{}).Error; err != nil {
 			return err
@@ -74,6 +80,12 @@ func (r *permissionRepo) SelectedButtons(ctx context.Context, aid, menuID uint)
 	return ids, nil
 }
 func (r *permissionRepo) SetSelectedButtons(ctx context.Context, aid, menuID uint, ids []uint) error {
+	if err := (&authorityAccessRepo{data: r.data}).checkAuthorityIDAuth(ctx, aid); err != nil {
+		return err
+	}
+	if err := r.checkButtonAssignmentAuth(ctx, map[uint][]uint{menuID: ids}); err != nil {
+		return err
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("authority_id = ? AND sys_menu_id = ?", aid, menuID).Delete(&authorityButtonPO{}).Error; err != nil {
 			return err
@@ -104,3 +116,53 @@ func (r *permissionRepo) AuthorityButtonIDs(ctx context.Context, aid uint) ([]ui
 	err := r.data.gormDB.WithContext(ctx).Model(&authorityButtonPO{}).Where("authority_id = ?", aid).Pluck("sys_base_menu_btn_id", &ids).Error
 	return ids, err
 }
+
+func (r *permissionRepo) checkButtonAssignmentAuth(ctx context.Context, buttons map[uint][]uint) error {
+	actor, allowedAuthorities, strict, err := (&authorityAccessRepo{data: r.data}).strictAuthorityAccess(ctx)
+	if err != nil || !strict {
+		return err
+	}
+	return checkButtonAssignment(r.data.gormDB.WithContext(ctx), actor.AuthorityID, allowedAuthorities[actor.AuthorityID], buttons)
+}
+
+func checkButtonAssignment(db *gorm.DB, actorID uint, root bool, buttons map[uint][]uint) error {
+	requested := make(map[[2]uint]struct{})
+	buttonIDs := make([]uint, 0)
+	for menuID, ids := range buttons {
+		for _, buttonID := range ids {
+			key := [2]uint{menuID, buttonID}
+			if _, exists := requested[key]; exists {
+				continue
+			}
+			requested[key] = struct{}{}
+			buttonIDs = append(buttonIDs, buttonID)
+		}
+	}
+	if len(requested) == 0 {
+		return nil
+	}
+	allowed := make(map[[2]uint]bool, len(requested))
+	if root {
+		var rows []menuButtonPO
+		if err := db.Where("id IN ?", buttonIDs).Find(&rows).Error; err != nil {
+			return err
+		}
+		for _, row := range rows {
+			allowed[[2]uint{row.MenuID, row.ID}] = true
+		}
+	} else {
+		var rows []authorityButtonPO
+		if err := db.Where("authority_id = ?", actorID).Find(&rows).Error; err != nil {
+			return err
+		}
+		for _, row := range rows {
+			allowed[[2]uint{row.MenuID, row.ButtonID}] = true
+		}
+	}
+	for key := range requested {
+		if !allowed[key] {
+			return errors.New("添加失败,请勿跨级操作")
+		}
+	}
+	return nil
+}