fix: align admin behavior and Kratos integrations

2026-08-14 14:14:51 +08:00
parent 8c4c6ba661
commit e0b0e1d8c8
123 changed files with 4334 additions and 1877 deletions
@@ -45,7 +45,12 @@ func apiFromPO(po apiPO) *biz.API {
 	return &biz.API{ID: po.ID, CreatedAt: po.CreatedAt, UpdatedAt: po.UpdatedAt, Path: po.Path, Description: po.Description, APIGroup: po.APIGroup, Method: po.Method}
 }
 func (r *accessRepo) CreateAPI(ctx context.Context, v *biz.API) error {
-	return r.data.gormDB.WithContext(ctx).Create(&apiPO{Path: v.Path, Description: v.Description, APIGroup: v.APIGroup, Method: strings.ToUpper(v.Method)}).Error
+	po := apiPO{Path: v.Path, Description: v.Description, APIGroup: v.APIGroup, Method: strings.ToUpper(v.Method)}
+	if err := r.data.gormDB.WithContext(ctx).Create(&po).Error; err != nil {
+		return err
+	}
+	v.ID, v.CreatedAt, v.UpdatedAt, v.Method = po.ID, po.CreatedAt, po.UpdatedAt, po.Method
+	return nil
 }
 func (r *accessRepo) UpdateAPI(ctx context.Context, v *biz.API) error {
 	return r.data.gormDB.WithContext(ctx).Model(&apiPO{}).Where("id = ?", v.ID).Updates(map[string]any{"path": v.Path, "description": v.Description, "api_group": v.APIGroup, "method": strings.ToUpper(v.Method)}).Error
@@ -66,17 +71,26 @@ func (r *accessRepo) FindAPI(ctx context.Context, id uint) (*biz.API, error) {
 	return apiFromPO(po), nil
 }
 func (r *accessRepo) ListAPIs(ctx context.Context, page, size int, q *biz.API) ([]*biz.API, int64, error) {
-	if page < 1 {
-		page = 1
-	}
-	if size < 1 {
-		size = 10
-	}
 	db := r.data.gormDB.WithContext(ctx).Model(&apiPO{})
+	if q != nil && q.StrictAll {
+		config := r.data.runtime.Admin()
+		if actor, ok := biz.ActorFromContext(ctx); ok && config != nil && config.System != nil && config.System.UseStrictAuth {
+			var authority authorityPO
+			if err := r.data.gormDB.WithContext(ctx).Where("authority_id = ?", actor.AuthorityID).First(&authority).Error; err != nil {
+				return nil, 0, err
+			}
+			if authority.ParentID != nil && *authority.ParentID != 0 {
+				db = db.Where("id IN (?)", r.data.gormDB.WithContext(ctx).Model(&authorityAPIPO{}).Select("api_id").Where("authority_id = ?", actor.AuthorityID))
+			}
+		}
+	}
 	if q != nil {
 		if q.Path != "" {
 			db = db.Where("path LIKE ?", "%"+q.Path+"%")
 		}
+		if q.Description != "" {
+			db = db.Where("description LIKE ?", "%"+q.Description+"%")
+		}
 		if q.APIGroup != "" {
 			db = db.Where("api_group = ?", q.APIGroup)
 		}
@@ -88,8 +102,23 @@ func (r *accessRepo) ListAPIs(ctx context.Context, page, size int, q *biz.API) (
 	if err := db.Count(&total).Error; err != nil {
 		return nil, 0, err
 	}
+	order := "id desc"
+	if q != nil && q.OrderKey != "" {
+		allowed := map[string]bool{"id": true, "path": true, "api_group": true, "description": true, "method": true}
+		if !allowed[q.OrderKey] {
+			return nil, 0, errors.New("非法的排序字段: " + q.OrderKey)
+		}
+		order = q.OrderKey
+		if q.Desc {
+			order += " desc"
+		}
+	}
 	var pos []apiPO
-	if err := db.Order("api_group,path,method").Offset((page - 1) * size).Limit(size).Find(&pos).Error; err != nil {
+	maxSize := 100
+	if q != nil && q.StrictAll {
+		maxSize = 0
+	}
+	if err := applyPagination(db.Order(order), page, size, maxSize).Find(&pos).Error; err != nil {
 		return nil, 0, err
 	}
 	out := make([]*biz.API, 0, len(pos))
@@ -98,19 +127,26 @@ func (r *accessRepo) ListAPIs(ctx context.Context, page, size int, q *biz.API) (
 	}
 	return out, total, nil
 }
-func (r *accessRepo) APIRoleIDs(ctx context.Context, id uint) ([]uint, error) {
+func (r *accessRepo) APIRoleIDs(ctx context.Context, path, method string) ([]uint, error) {
 	var ids []uint
-	err := r.data.gormDB.WithContext(ctx).Model(&authorityAPIPO{}).Where("api_id = ?", id).Pluck("authority_id", &ids).Error
+	err := r.data.gormDB.WithContext(ctx).Table("sys_authority_apis").
+		Joins("JOIN sys_apis ON sys_apis.id = sys_authority_apis.api_id").
+		Where("sys_apis.path = ? AND sys_apis.method = ? AND sys_apis.deleted_at IS NULL", path, strings.ToUpper(method)).
+		Pluck("sys_authority_apis.authority_id", &ids).Error
 	return ids, err
 }
-func (r *accessRepo) SetAPIRoles(ctx context.Context, id uint, ids []uint) error {
+func (r *accessRepo) SetAPIRoles(ctx context.Context, path, method string, ids []uint) error {
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
-		if err := tx.Where("api_id = ?", id).Delete(&authorityAPIPO{}).Error; err != nil {
+		var api apiPO
+		if err := tx.Where("path = ? AND method = ?", path, strings.ToUpper(method)).First(&api).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("api_id = ?", api.ID).Delete(&authorityAPIPO{}).Error; err != nil {
 			return err
 		}
 		links := make([]authorityAPIPO, 0, len(ids))
 		for _, aid := range ids {
-			links = append(links, authorityAPIPO{AuthorityID: aid, APIID: id})
+			links = append(links, authorityAPIPO{AuthorityID: aid, APIID: api.ID})
 		}
 		if len(links) > 0 {
 			return tx.Create(&links).Error
@@ -159,6 +195,31 @@ func (r *accessRepo) PolicyPaths(ctx context.Context, aid uint) ([]*biz.API, err
 	return out, nil
 }
 func (r *accessRepo) SetPolicyPaths(ctx context.Context, aid uint, paths []*biz.API) error {
+	if err := r.checkAuthorityIDAuth(ctx, aid); err != nil {
+		return err
+	}
+	config := r.data.runtime.Admin()
+	if actor, ok := biz.ActorFromContext(ctx); ok && config != nil && config.System != nil && config.System.UseStrictAuth {
+		var authority authorityPO
+		if err := r.data.gormDB.WithContext(ctx).Where("authority_id = ?", actor.AuthorityID).First(&authority).Error; err != nil {
+			return err
+		}
+		if authority.ParentID != nil && *authority.ParentID != 0 {
+			allowed, err := r.PolicyPaths(ctx, actor.AuthorityID)
+			if err != nil {
+				return err
+			}
+			allowedSet := make(map[string]bool, len(allowed))
+			for _, item := range allowed {
+				allowedSet[item.Path+"\x00"+strings.ToUpper(item.Method)] = true
+			}
+			for _, item := range paths {
+				if !allowedSet[item.Path+"\x00"+strings.ToUpper(item.Method)] {
+					return errors.New("存在api不在权限列表中")
+				}
+			}
+		}
+	}
 	return r.data.gormDB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("authority_id = ?", aid).Delete(&authorityAPIPO{}).Error; err != nil {
 			return err