任务三

internal/data/system/jwt_blacklist.go

@@ -0,0 +1,37 @@
+package system
+
+import (
+	"context"
+
+	"kra/internal/biz/system"
+	"kra/internal/data/model"
+	"kra/internal/data/query"
+
+	"gorm.io/gorm"
+)
+
+type jwtBlacklistRepo struct {
+	db *gorm.DB
+}
+
+// NewJwtBlacklistRepo 创建JWT黑名单仓储
+func NewJwtBlacklistRepo(db *gorm.DB) system.JwtBlacklistRepo {
+	query.SetDefault(db)
+	return &jwtBlacklistRepo{db: db}
+}
+
+func (r *jwtBlacklistRepo) Create(ctx context.Context, jwt string) error {
+	m := &model.JwtBlacklist{Jwt: jwt}
+	return query.JwtBlacklist.WithContext(ctx).Create(m)
+}
+
+func (r *jwtBlacklistRepo) IsInBlacklist(ctx context.Context, jwt string) bool {
+	count, _ := query.JwtBlacklist.WithContext(ctx).Where(query.JwtBlacklist.Jwt.Eq(jwt)).Count()
+	return count > 0
+}
+
+func (r *jwtBlacklistRepo) LoadAll(ctx context.Context) ([]string, error) {
+	var jwts []string
+	err := r.db.WithContext(ctx).Model(&model.JwtBlacklist{}).Pluck("jwt", &jwts).Error
+	return jwts, err
+}

internal/data/system/user.go

@@ -220,17 +220,53 @@ func (r *userRepo) SetUserAuthorities(ctx context.Context, adminAuthorityID, use
 }
 
 func checkAuthorityIDAuth(tx *gorm.DB, adminAuthorityID, targetAuthorityID uint) error {
+	// 超级管理员(888)直接通过
 	if adminAuthorityID == 888 {
 		return nil
 	}
-	var authority model.SysAuthority
-	if err := tx.Where("authority_id = ? AND parent_id = ?", targetAuthorityID, adminAuthorityID).First(&authority).Error; err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return errors.New("您没有权限分配该角色")
-		}
+
+	// 获取管理员角色的所有子角色ID（递归）
+	authIDs, err := getStructAuthorityList(tx, adminAuthorityID)
+	if err != nil {
 		return err
 	}
-	return nil
+
+	// 检查目标角色是否在权限列表中
+	for _, id := range authIDs {
+		if id == targetAuthorityID {
+			return nil
+		}
+	}
+	return errors.New("您没有权限分配该角色")
+}
+
+// getStructAuthorityList 递归获取角色ID列表（包含子角色）
+func getStructAuthorityList(tx *gorm.DB, authorityID uint) ([]uint, error) {
+	var auth model.SysAuthority
+	if err := tx.First(&auth, "authority_id = ?", authorityID).Error; err != nil {
+		return nil, err
+	}
+
+	var list []uint
+	var children []model.SysAuthority
+	if err := tx.Where("parent_id = ?", authorityID).Find(&children).Error; err != nil {
+		return nil, err
+	}
+
+	for _, child := range children {
+		list = append(list, uint(child.AuthorityID))
+		childList, err := getStructAuthorityList(tx, uint(child.AuthorityID))
+		if err == nil {
+			list = append(list, childList...)
+		}
+	}
+
+	// 如果是顶级角色，包含自己
+	if auth.ParentID == 0 {
+		list = append(list, authorityID)
+	}
+
+	return list, nil
 }
 
 func (r *userRepo) CheckUserHasAuthority(ctx context.Context, userId, authorityId uint) (bool, error) {