优化

internal/data/api.go

@@ -11,6 +11,7 @@ import (
 	"github.com/casbin/casbin/v3"
 	casbinmodel "github.com/casbin/casbin/v3/model"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type apiRepo struct{ data *Data }
@@ -167,11 +168,11 @@ func (r *apiRepo) ListAPIs(ctx context.Context, page, size int, q *biz.API) ([]*
 		}
 	}
 	var pos []apiPO
-	maxSize := 100
-	if q != nil && q.StrictAll {
-		maxSize = 0
+	query := db.Order(order)
+	if q == nil || !q.StrictAll {
+		query = applyRequiredPagination(query, page, size, 100)
 	}
-	if err := applyPagination(db.Order(order), page, size, maxSize).Find(&pos).Error; err != nil {
+	if err := query.Find(&pos).Error; err != nil {
 		return nil, 0, err
 	}
 	out := make([]*biz.API, 0, len(pos))
@@ -248,7 +249,10 @@ func (r *apiRepo) PolicyPaths(ctx context.Context, aid uint) ([]*biz.API, error)
 	if err != nil {
 		return nil, err
 	}
-	out := make([]*biz.API, 0, len(rows))
+	var out []*biz.API
+	if len(rows) > 0 {
+		out = make([]*biz.API, 0, len(rows))
+	}
 	for _, row := range rows {
 		out = append(out, &biz.API{Path: row.V1, Method: row.V2})
 	}
@@ -264,46 +268,64 @@ func (r *apiRepo) SetPolicyPaths(ctx context.Context, aid uint, paths []*biz.API
 		if err := r.data.gormDB.WithContext(ctx).Where("authority_id = ?", actor.AuthorityID).First(&authority).Error; err != nil {
 			return err
 		}
-		if authority.ParentID != nil && *authority.ParentID != 0 {
-			allowed, err := r.PolicyPaths(ctx, actor.AuthorityID)
+		var registered []apiPO
+		if err := r.data.gormDB.WithContext(ctx).Find(&registered).Error; err != nil {
+			return err
+		}
+		allowedSet := make(map[string]bool, len(registered))
+		if authority.ParentID == nil || *authority.ParentID == 0 {
+			for _, item := range registered {
+				allowedSet[item.Path+"\x00"+item.Method] = true
+			}
+		} else {
+			policies, err := policyRowsForAuthority(r.data.gormDB.WithContext(ctx), actor.AuthorityID)
 			if err != nil {
 				return err
 			}
-			allowedSet := make(map[string]bool, len(allowed))
-			for _, item := range allowed {
-				allowedSet[item.Path+"\x00"+item.Method] = true
+			policySet := make(map[string]bool, len(policies))
+			for _, item := range policies {
+				policySet[item.V1+"\x00"+item.V2] = true
 			}
-			for _, item := range paths {
-				if !allowedSet[item.Path+"\x00"+item.Method] {
-					return errors.New("存在api不在权限列表中")
+			for _, item := range registered {
+				key := item.Path + "\x00" + item.Method
+				if policySet[key] {
+					allowedSet[key] = true
 				}
 			}
 		}
-	}
-	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
-		if err := deletePoliciesForAuthority(tx, aid); err != nil {
-			return err
-		}
-		// Keep the legacy relation table clean for upgraded installations. It
-		// is not consulted for authorization anymore.
-		if err := tx.Where("authority_id = ?", aid).Delete(&authorityAPIPO{}).Error; err != nil {
-			return err
-		}
-		rules := make([]casbinRulePO, 0, len(paths))
-		seen := make(map[string]struct{}, len(paths))
-		for _, path := range paths {
-			key := path.Path + "\x00" + path.Method
-			if _, ok := seen[key]; ok {
-				continue
+		for _, item := range paths {
+			if !allowedSet[item.Path+"\x00"+item.Method] {
+				return errors.New("存在api不在权限列表中")
 			}
-			seen[key] = struct{}{}
-			rules = append(rules, newPolicyRule(aid, path.Path, path.Method))
 		}
-		if len(rules) > 0 {
-			return tx.Create(&rules).Error
+	}
+	db := r.data.gormDB.WithContext(ctx)
+	// The reference enforcer removes the old authority policies before it
+	// attempts to add the replacement set. Keep that ordering visible even
+	// though Kra reads policies directly from the database rather than through
+	// an in-memory enforcer.
+	if err := deletePoliciesForAuthority(db, aid); err != nil {
+		return err
+	}
+	// Keep the legacy relation table clean for upgraded installations. It is
+	// not consulted for authorization anymore.
+	if err := db.Where("authority_id = ?", aid).Delete(&authorityAPIPO{}).Error; err != nil {
+		return err
+	}
+	rules := make([]casbinRulePO, 0, len(paths))
+	seen := make(map[string]struct{})
+	for _, path := range paths {
+		key := strconv.FormatUint(uint64(aid), 10) + path.Path + path.Method
+		if _, ok := seen[key]; ok {
+			continue
 		}
-		return nil
-	})
+		seen[key] = struct{}{}
+		rules = append(rules, newPolicyRule(aid, path.Path, path.Method))
+	}
+	if len(rules) > 0 {
+		return db.Clauses(clause.OnConflict{DoNothing: true}).Create(&rules).Error
+	}
+	return nil
 }
 
 func (r *apiRepo) IgnoredAPIs(ctx context.Context) ([]*biz.API, error) {