| | |
|---|
| | | request.setAttribute(OPERATOR_NAME_ATTRIBUTE, service.operatorName(operatorId)); |
|---|
| | | String permission = permission(request.getMethod(), request.getRequestURI()); |
|---|
| | | if (!permission.isBlank() && !service.hasPermission(operatorId, permission)) { |
|---|
| | | if (request.getRequestURI().startsWith("/api/admin/management/merchant-settlement/onboardings")) { |
|---|
| | | throw new com.talentcard.server.common.BusinessException(com.talentcard.server.common.ErrorCode.FORBIDDEN, "当前账号没有该操作权限"); |
|---|
| | | } |
|---|
| | | throw new ResponseStatusException(HttpStatus.FORBIDDEN, "当前账号没有该操作权限"); |
|---|
| | | } |
|---|
| | | return true; |
|---|
| | | } |
|---|
| | | |
|---|
| | | private String permission(String method, String uri) { |
|---|
| | | if (uri.startsWith("/api/admin/management/merchant-settlement/onboardings")) { |
|---|
| | | return "admin.merchant-settlement." + ("GET".equalsIgnoreCase(method) ? "view" : "edit"); |
|---|
| | | } |
|---|
| | | if (uri.startsWith("/api/admin/management/roles")) { |
|---|
| | | return managementPermission(method, uri, "roles"); |
|---|
| | | } |
|---|
