From 2b20145159c4c4eefc73fd449093e639812a64df Mon Sep 17 00:00:00 2001
From: shinnosuke <tantao@1hoper.com>
Date: 星期三, 19 八月 2026 14:35:36 +0800
Subject: [PATCH] 又又更新
---
talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthInterceptor.java | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 57 insertions(+), 0 deletions(-)
diff --git a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthInterceptor.java b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthInterceptor.java
index edf6827..4a712c7 100644
--- a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthInterceptor.java
+++ b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthInterceptor.java
@@ -5,6 +5,8 @@
import org.springframework.http.HttpHeaders;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
@Component
public class AdminAuthInterceptor implements HandlerInterceptor {
@@ -22,6 +24,61 @@
Long operatorId = service.authenticate(request.getHeader(HttpHeaders.AUTHORIZATION));
request.setAttribute(OPERATOR_ID_ATTRIBUTE, operatorId);
request.setAttribute(OPERATOR_NAME_ATTRIBUTE, service.operatorName(operatorId));
+ String permission = permission(request.getMethod(), request.getRequestURI());
+ if (!permission.isBlank() && !service.hasPermission(operatorId, permission)) {
+ throw new ResponseStatusException(HttpStatus.FORBIDDEN, "当前账号没有该操作权限");
+ }
return true;
}
+
+ private String permission(String method, String uri) {
+ if (uri.startsWith("/api/admin/management/roles")) {
+ return managementPermission(method, uri, "roles");
+ }
+ if (uri.startsWith("/api/admin/management/staff")) {
+ return managementPermission(method, uri, "staff");
+ }
+ String page = page(uri);
+ if (page.isBlank()) return "";
+ String action = "GET".equalsIgnoreCase(method) ? "view" : "edit";
+ if ("POST".equalsIgnoreCase(method)) action = "create";
+ if ("DELETE".equalsIgnoreCase(method)) action = "delete";
+ if ("PATCH".equalsIgnoreCase(method)) {
+ action = uri.endsWith("/audit") || uri.endsWith("/status") ? (uri.endsWith("/audit") ? "audit" : "disable") : "edit";
+ }
+ return "admin." + page + "." + action;
+ }
+
+ private String page(String uri) {
+ if (uri.startsWith("/api/admin/business/merchants")) return "merchants";
+ if (uri.startsWith("/api/admin/business/products")) return "products";
+ if (uri.startsWith("/api/admin/business/news")) return "news";
+ if (uri.startsWith("/api/admin/business/policies")) return "policies";
+ if (uri.startsWith("/api/admin/business/coupons")) return "benefit-coupons";
+ if (uri.startsWith("/api/admin/dependent-card-applies")) return "family-card-applications";
+ if (uri.startsWith("/api/admin/cards/child-applications")) return "child-cards";
+ if (uri.startsWith("/api/admin/service-appointment-applications")) return "appointment-management";
+ if (uri.startsWith("/api/admin/medical-reservations")) return "medical-reservations";
+ if (uri.startsWith("/api/admin/parking-plate-submissions")) return "parking-plates";
+ if (uri.startsWith("/api/admin/car-wash-benefits") || uri.startsWith("/api/admin/car-wash-merchant-jump-configs")) return "car-wash-benefits";
+ if (uri.startsWith("/api/admin/fuel-services")) return "fuel-services";
+ if (uri.startsWith("/api/admin/spouse-employment")) return "spouse-employment";
+ if (uri.startsWith("/api/admin/hotel-reservations")) return "hotel-reservations";
+ if (uri.startsWith("/api/admin/merchant-settlement")) return "merchant-settlement";
+ if (uri.startsWith("/api/admin/ticket-packages")) return "movie-tickets";
+ if (uri.startsWith("/api/admin/display-services")) return "display-services";
+ if (uri.startsWith("/api/admin/equity-images")) return "equity-images";
+ return "";
+ }
+
+ private String managementPermission(String method, String uri, String page) {
+ String action;
+ if ("GET".equalsIgnoreCase(method)) action = "view";
+ else if ("POST".equalsIgnoreCase(method)) action = "create";
+ else if ("DELETE".equalsIgnoreCase(method)) action = "delete";
+ else if ("PUT".equalsIgnoreCase(method)) action = "edit";
+ else if ("PATCH".equalsIgnoreCase(method)) action = uri.endsWith("/status") ? "disable" : "reset";
+ else return "";
+ return "admin." + page + "." + action;
+ }
}
--
Gitblit v1.7.1