优化

internal/data/user.go

@@ -318,6 +318,10 @@ func (r *userRepo) CreateUser(ctx context.Context, user *biz.User) (*biz.User, e
 }
 
 func (r *userRepo) CreateUserWithAuthorities(ctx context.Context, user *biz.User, authorityIDs []uint) (*biz.User, error) {
+	requestedAuthorities := append([]uint{user.AuthorityID}, authorityIDs...)
+	if err := (&authorityAccessRepo{data: r.data}).checkAuthorityIDsAuth(ctx, requestedAuthorities); err != nil {
+		return nil, err
+	}
 	if user.UUID == "" {
 		user.UUID = uuid.NewString()
 	}
@@ -377,9 +381,23 @@ func (r *userRepo) CreateUserWithAuthorities(ctx context.Context, user *biz.User
 }
 
 func (r *userRepo) UpdateUser(ctx context.Context, user *biz.User) error {
+	if err := r.checkUserUpdateAuth(ctx, user); err != nil {
+		return err
+	}
 	return r.updateUser(r.data.gormDB.WithContext(ctx), user)
 }
 
+func (r *userRepo) checkUserUpdateAuth(ctx context.Context, user *biz.User) error {
+	access := &authorityAccessRepo{data: r.data}
+	if err := access.checkUserIDAuth(ctx, user.ID, false); err != nil {
+		return err
+	}
+	if user.AuthorityID != 0 {
+		return access.checkAuthorityIDAuth(ctx, user.AuthorityID)
+	}
+	return nil
+}
+
 func (r *userRepo) UpdateSelfUser(ctx context.Context, user *biz.User) error {
 	updates := make(map[string]any)
 	if user.NickName != "" {
@@ -453,6 +471,13 @@ func (r *userRepo) updateUser(tx *gorm.DB, user *biz.User) error {
 }
 
 func (r *userRepo) UpdateUserWithAuthorities(ctx context.Context, user *biz.User, authorityIDs []uint) error {
+	access := &authorityAccessRepo{data: r.data}
+	if err := r.checkUserUpdateAuth(ctx, user); err != nil {
+		return err
+	}
+	if err := access.checkAuthorityIDsAuth(ctx, authorityIDs); err != nil {
+		return err
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := r.updateUser(tx, user); err != nil {
 			return err
@@ -464,6 +489,9 @@ func (r *userRepo) UpdateUserWithAuthorities(ctx context.Context, user *biz.User
 	})
 }
 func (r *userRepo) DeleteUser(ctx context.Context, id uint) error {
+	if err := (&authorityAccessRepo{data: r.data}).checkUserIDAuth(ctx, id, false); err != nil {
+		return err
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("id = ?", id).Delete(&userPO{}).Error; err != nil {
 			return err
@@ -481,6 +509,9 @@ func (r *userRepo) DeleteUser(ctx context.Context, id uint) error {
 	})
 }
 func (r *userRepo) UpdatePassword(ctx context.Context, id uint, password string, clearMustChange bool) error {
+	if err := (&authorityAccessRepo{data: r.data}).checkUserIDAuth(ctx, id, true); err != nil {
+		return err
+	}
 	now := time.Now()
 	updates := map[string]any{"password": password, "password_updated_at": now}
 	if clearMustChange {
@@ -502,17 +533,18 @@ func (r *userRepo) ListAuthorities(ctx context.Context) ([]*biz.Authority, error
 }
 
 func (r *userRepo) SetUserAuthorities(ctx context.Context, id uint, authorityIDs []uint) error {
+	access := &authorityAccessRepo{data: r.data}
+	if err := access.checkUserIDAuth(ctx, id, false); err != nil {
+		return err
+	}
+	if err := access.checkAuthorityIDsAuth(ctx, authorityIDs); err != nil {
+		return err
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		var user userPO
 		if err := tx.Where("id = ?", id).First(&user).Error; err != nil {
 			return errors.New("查询用户数据失败")
 		}
-		access := &authorityAccessRepo{data: r.data}
-		for _, authorityID := range authorityIDs {
-			if err := access.checkAuthorityIDAuth(ctx, authorityID); err != nil {
-				return err
-			}
-		}
 		return setUserAuthorities(tx, id, authorityIDs)
 	})
 }