From 85bfb9351803d97a33329d507f30a2f78bf1fc75 Mon Sep 17 00:00:00 2001
From: yeg <1347747024@qq.com>
Date: 星期一, 28 九月 2026 10:53:14 +0800
Subject: [PATCH] Merge remote-tracking branch 'origin/main'
---
talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java | 13 ++++++++++++-
1 files changed, 12 insertions(+), 1 deletions(-)
diff --git a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
index e3fe181..7a40ed9 100644
--- a/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
+++ b/talent-card-server/src/main/java/com/talentcard/server/business/admin/auth/AdminAuthService.java
@@ -111,6 +111,16 @@
@Transactional(readOnly = true)
public boolean hasPermission(Long operatorId, String permission) {
+ return hasAnyPermission(operatorId, List.of(permission));
+ }
+
+ /**
+ * 一个接口可能同时服务多个页面（例如家属卡接口既挂在「家属卡申请」也挂在「家属卡管理」下），
+ * 这时只要命中其中任意一个页面权限就放行。
+ */
+ @Transactional(readOnly = true)
+ public boolean hasAnyPermission(Long operatorId, List<String> permissions) {
+ if (permissions.isEmpty()) return true;
List<Map<String, Object>> result = rows("""
select o.role_code, r.permission_codes
from admin_operator o left join admin_role r on r.role_code = o.role_code
@@ -122,7 +132,8 @@
if ("platform_admin".equals(String.valueOf(operator.get("roleCode")))) return true;
String raw = String.valueOf(operator.getOrDefault("permissionCodes", ""));
try {
- return JSON.parseArray(raw, String.class).contains(permission);
+ List<String> granted = JSON.parseArray(raw, String.class);
+ return permissions.stream().anyMatch(granted::contains);
} catch (Exception ignored) {
return false;
}
--
Gitblit v1.7.1