数据权限：完善 code review 提到的问题

puhui999
1 parent 69503689
Showing 7 changed files with 23 additions and 36 deletions
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/framework/permission/core/aop/CrmPermissionAspect.java
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/framework/permission/core/util/CrmPermissionUtils.java
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/service/customer/CrmCustomerServiceImpl.java
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/service/permission/CrmPermissionServiceImpl.java
yudao-module-crm/yudao-module-crm-biz/src/main/java/cn/iocoder/yudao/module/crm/util/CrmQueryWrapperUtils.java
yudao-module-mall/yudao-module-promotion-biz/src/main/java/cn/iocoder/yudao/module/promotion/controller/app/activity/AppActivityController.java
yudao-module-mall/yudao-module-promotion-biz/src/main/java/cn/iocoder/yudao/module/promotion/controller/app/activity/vo/AppActivityRespVO.java
@@ -50,7 +50,7 @@ public class CrmPermissionAspect {
         Integer permissionLevel = crmPermission.level().getLevel(); // 需要的权限级别
         // 1.1 如果是超级管理员则直接通过
-        if (CrmPermissionUtils.validateAdminUser()) {
+        if (CrmPermissionUtils.isCrmAdmin()) {
             return;
         }
         // 1.2 获取数据权限
 package cn.iocoder.yudao.module.crm.framework.permission.core.util;
 import cn.hutool.extra.spring.SpringUtil;
-import cn.iocoder.yudao.framework.web.core.util.WebFrameworkUtils;
 import cn.iocoder.yudao.module.crm.enums.permission.CrmPermissionRoleCodeEnum;
 import cn.iocoder.yudao.module.system.api.permission.PermissionApi;
+import static cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
+
 /**
  * 数据权限工具类
  *
@@ -12,24 +13,14 @@ import cn.iocoder.yudao.module.system.api.permission.PermissionApi;
  */
 public class CrmPermissionUtils {
-    // TODO @puhui999：isCrmAdmin。换成这个名字；因为 validate 一般是参数校验，不符合抛出异常；一般是 isXXXValid 才会返回 true false
+
     /**
      * 校验用户是否是 CRM 管理员
      *
      * @return 是/否
      */
-    public static boolean validateAdminUser() {
-        return SingletonManager.getPermissionApi().hasAnyRoles(getUserId(), CrmPermissionRoleCodeEnum.CRM_ADMIN.getCode());
-    }
-
-    // TODO @puhui999：这个不需要哈，直接用原本的 SecuriyUtils 去拿更方便一些；
-    /**
-     * 获得用户编号
-     *
-     * @return 用户编号
-     */
-    private static Long getUserId() {
-        return WebFrameworkUtils.getLoginUserId();
+    public static boolean isCrmAdmin() {
+        return SingletonManager.getPermissionApi().hasAnyRoles(getLoginUserId(), CrmPermissionRoleCodeEnum.CRM_ADMIN.getCode());
     }
     /**
@@ -67,7 +67,6 @@ public class CrmCustomerServiceImpl implements CrmCustomerService {
         return customer.getId();
     }
-    // TODO @puhui999：测试下，能不能打出用户数据的变更。啊哈，可以打完微信发我下；
     @Override
     @Transactional(rollbackFor = Exception.class)
     @LogRecord(type = CRM_CUSTOMER, subType = "更新客户", bizNo = "{{#updateReqVO.id}}", success = "更新了客户{_DIFF{#updateReqVO}}", extra = "{{#extra}}")
@@ -90,8 +90,7 @@ public class CrmPermissionServiceImpl implements CrmPermissionService {
         CrmPermissionDO oldPermission = crmPermissionMapper.selectByBizTypeAndBizIdByUserId(
                 transferReqBO.getBizType(), transferReqBO.getBizId(), transferReqBO.getUserId());
         String bizTypeName = CrmBizTypeEnum.getNameByType(transferReqBO.getBizType());
-        // TODO @puhui999：是不是并且？ 不是拥有者，并且不是超管
-        if (oldPermission == null || !isOwner(oldPermission.getLevel()) || !CrmPermissionUtils.validateAdminUser()) {
+        if (oldPermission == null || (!isOwner(oldPermission.getLevel()) && !CrmPermissionUtils.isCrmAdmin())) {  // 不是拥有者，并且不是超管
             throw exception(CRM_PERMISSION_DENIED, bizTypeName);
         }
         // 1.1 校验转移对象是否已经是该负责人
@@ -40,7 +40,7 @@ public class CrmQueryWrapperUtils {
                                                                                     Long userId, Integer sceneType, Boolean pool) {
         final String ownerUserIdField = SingletonManager.getMybatisPlusJoinProperties().getTableAlias() + ".owner_user_id";
         // 1. 构建数据权限连表条件
-        if (ObjUtil.notEqual(CrmPermissionUtils.validateAdminUser(), Boolean.TRUE) && ObjUtil.notEqual(pool, Boolean.TRUE)) { // 管理员，公海不需要数据权限
+        if (ObjUtil.notEqual(CrmPermissionUtils.isCrmAdmin(), Boolean.TRUE) && ObjUtil.notEqual(pool, Boolean.TRUE)) { // 管理员，公海不需要数据权限
             query.innerJoin(CrmPermissionDO.class, on -> on.eq(CrmPermissionDO::getBizType, bizType)
                     .eq(CrmPermissionDO::getBizId, bizId) // 只能使用 SFunction 如果传 id 解析出来的 sql 不对
                     .eq(CrmPermissionDO::getUserId, userId));
@@ -81,7 +81,7 @@ public class CrmQueryWrapperUtils {
      * @param userId  用户编号
      */
     public static <T extends MPJLambdaWrapper<?>> void appendPermissionCondition(T query, Integer bizType, Collection<Long> bizIds, Long userId) {
-        if (ObjUtil.equal(CrmPermissionUtils.validateAdminUser(), Boolean.TRUE)) {// 管理员不需要数据权限
+        if (ObjUtil.equal(CrmPermissionUtils.isCrmAdmin(), Boolean.TRUE)) {// 管理员不需要数据权限
             return;
         }
@@ -98,11 +98,9 @@ public class AppActivityController {
             return;
         }
-        // TODO @puhui999：AppActivityRespVO 搞个构造方法，写起来更方便一些；这样后续万一加个属性，也可以处理下哈；
         combinationActivities.forEach(item -> {
-            activityList.add(new AppActivityRespVO().setId(item.getId())
-                    .setType(PromotionTypeEnum.COMBINATION_ACTIVITY.getType()).setName(item.getName())
-                    .setSpuId(item.getSpuId()).setStartTime(item.getStartTime()).setEndTime(item.getEndTime()));
+            activityList.add(new AppActivityRespVO(item.getId(), PromotionTypeEnum.COMBINATION_ACTIVITY.getType(),
+                    item.getName(), item.getSpuId(), item.getStartTime(), item.getEndTime()));
         });
     }
@@ -114,9 +112,8 @@ public class AppActivityController {
         }
         seckillActivities.forEach(item -> {
-            activityList.add(new AppActivityRespVO().setId(item.getId())
-                    .setType(PromotionTypeEnum.SECKILL_ACTIVITY.getType()).setName(item.getName())
-                    .setSpuId(item.getSpuId()).setStartTime(item.getStartTime()).setEndTime(item.getEndTime()));
+            activityList.add(new AppActivityRespVO(item.getId(), PromotionTypeEnum.SECKILL_ACTIVITY.getType(),
+                    item.getName(), item.getSpuId(), item.getStartTime(), item.getEndTime()));
         });
     }
@@ -128,9 +125,8 @@ public class AppActivityController {
         }
         bargainActivities.forEach(item -> {
-            activityList.add(new AppActivityRespVO().setId(item.getId())
-                    .setType(PromotionTypeEnum.BARGAIN_ACTIVITY.getType()).setName(item.getName())
-                    .setSpuId(item.getSpuId()).setStartTime(item.getStartTime()).setEndTime(item.getEndTime()));
+            activityList.add(new AppActivityRespVO(item.getId(), PromotionTypeEnum.BARGAIN_ACTIVITY.getType(),
+                    item.getName(), item.getSpuId(), item.getStartTime(), item.getEndTime()));
         });
     }
@@ -144,9 +140,8 @@ public class AppActivityController {
         List<DiscountProductDO> products = discountActivityService.getDiscountProductsByActivityId(
                 convertSet(discountActivities, DiscountActivityDO::getId));
         Map<Long, Long> productMap = convertMap(products, DiscountProductDO::getActivityId, DiscountProductDO::getSpuId);
-        discountActivities.forEach(item -> activityList.add(new AppActivityRespVO().setId(item.getId())
-                .setType(PromotionTypeEnum.DISCOUNT_ACTIVITY.getType()).setName(item.getName())
-                .setSpuId(productMap.get(item.getId())).setStartTime(item.getStartTime()).setEndTime(item.getEndTime())));
+        discountActivities.forEach(item -> activityList.add(new AppActivityRespVO(item.getId(), PromotionTypeEnum.DISCOUNT_ACTIVITY.getType(),
+                item.getName(), productMap.get(item.getId()), item.getStartTime(), item.getEndTime())));
     }
     private void getRewardActivities(Collection<Long> spuIds, LocalDateTime now, List<AppActivityRespVO> activityList) {
@@ -168,9 +163,8 @@ public class AppActivityController {
             }
             RewardActivityDO rewardActivityDO = spuIdAndActivityMap.get(supId).get();
-            activityList.add(new AppActivityRespVO().setId(rewardActivityDO.getId())
-                    .setType(PromotionTypeEnum.REWARD_ACTIVITY.getType()).setName(rewardActivityDO.getName())
-                    .setSpuId(supId).setStartTime(rewardActivityDO.getStartTime()).setEndTime(rewardActivityDO.getEndTime()));
+            activityList.add(new AppActivityRespVO(rewardActivityDO.getId(), PromotionTypeEnum.REWARD_ACTIVITY.getType(),
+                    rewardActivityDO.getName(), supId, rewardActivityDO.getStartTime(), rewardActivityDO.getEndTime()));
         }
     }
 package cn.iocoder.yudao.module.promotion.controller.app.activity.vo;
 import io.swagger.v3.oas.annotations.media.Schema;
+import lombok.AllArgsConstructor;
 import lombok.Data;
+import lombok.NoArgsConstructor;
 import java.time.LocalDateTime;
 @Schema(description = "用户 App - 营销活动 Response VO")
+@AllArgsConstructor
+@NoArgsConstructor
 @Data
 public class AppActivityRespVO {