From 32a8a52d251106f486bd7576cb662df1264da09a Mon Sep 17 00:00:00 2001
From: shinnosuke <tantao@1hoper.com>
Date: 星期四, 06 八月 2026 22:52:18 +0800
Subject: [PATCH] fix(admin): 按角色权限展示后台菜单 (bug #24030)
---
talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java | 26 +++++++++++++++++++-------
1 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
index 7fb972a..71a3848 100644
--- a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
+++ b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
@@ -10,6 +10,8 @@
import java.util.List;
import java.util.Map;
+import com.alibaba.fastjson.JSON;
+
import com.talentcard.server.business.DatabaseRows;
import com.talentcard.server.business.merchant.auth.MerchantPasswordHasher;
import com.talentcard.server.common.BusinessException;
@@ -34,10 +36,11 @@
public Map<String, Object> login(AdminLoginRequest request, String requestId) {
String account = request.account().trim();
List<Map<String, Object>> rows = rows("""
- select id operator_id, password_hash, display_name, role_code, status,
+ select o.id operator_id, o.password_hash, o.display_name, o.role_code, o.status,
+ r.permission_codes,
login_failed_count, locked_until
- from admin_operator
- where account = ? and deleted = 0
+ from admin_operator o left join admin_role r on r.role_code = o.role_code
+ where o.account = ? and o.deleted = 0
limit 1
""", account);
if (rows.isEmpty()) {
@@ -114,13 +117,22 @@
Map<String, Object> result = new LinkedHashMap<>();
result.put("accessToken", accessToken);
result.put("expiresIn", ACCESS_TOKEN_SECONDS);
- result.put("operator", Map.of(
- "id", number(operator.get("operatorId")),
- "name", String.valueOf(operator.get("displayName")),
- "roleCode", String.valueOf(operator.get("roleCode"))));
+ Map<String, Object> principal = new LinkedHashMap<>();
+ principal.put("id", number(operator.get("operatorId")));
+ principal.put("name", String.valueOf(operator.get("displayName")));
+ principal.put("roleCode", String.valueOf(operator.get("roleCode")));
+ principal.put("permissionCodes", permissions(operator));
+ result.put("operator", principal);
return result;
}
+ private List<String> permissions(Map<String, Object> operator) {
+ if ("platform_admin".equals(String.valueOf(operator.get("roleCode")))) return List.of("*");
+ String raw = String.valueOf(operator.getOrDefault("permissionCodes", ""));
+ try { return JSON.parseArray(raw, String.class); }
+ catch (Exception ignored) { return List.of(); }
+ }
+
private void audit(Long operatorId, String account, boolean success, String reason, String requestId) {
jdbc.update("insert into admin_login_audit(operator_id, account, success, failure_reason, request_id) values (?, ?, ?, ?, ?)",
operatorId, account, success ? 1 : 0, reason, requestId);
--
Gitblit v1.7.1