From d2c0afa20eef4e652c30ea8d4f5b4ae7a9d15734 Mon Sep 17 00:00:00 2001 From: Odboy Date: Sat, 29 Aug 2026 21:11:20 +0800 Subject: [PATCH] =?UTF-8?q?refactor:=20=E7=A7=BB=E9=99=A4=E6=9C=AA?= =?UTF-8?q?=E4=BD=BF=E7=94=A8=E7=9A=84=20user=5Fpermission=20=E8=A1=A8?= =?UTF-8?q?=E5=8F=8A=E6=9D=83=E9=99=90=E5=8A=A0=E8=BD=BD=E9=80=BB=E8=BE=91?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 删除 UserPermission 模型与 xorm Sync2 注册 - 移除登录/鉴权时从 user_permission 加载授权的逻辑 - 应用列表查询去掉 user_permission 子查询，仅保留负责人和业务组条件 - SQL 导出文件删除建表语句，新增 drop_user_permission.sql 升级脚本 --- server/internal/dao/engine.go | 1 - server/internal/handler/app.go | 12 ++++++------ server/internal/model/user.go | 12 ------------ server/internal/service/auth.go | 28 ---------------------------- sql/drop_user_permission.sql | 5 +++++ sql/kenaito_conf.sql | 9 --------- 6 files changed, 11 insertions(+), 56 deletions(-) create mode 100644 sql/drop_user_permission.sql diff --git a/server/internal/dao/engine.go b/server/internal/dao/engine.go index a032aa1..6c1660d 100644 --- a/server/internal/dao/engine.go +++ b/server/internal/dao/engine.go @@ -37,7 +37,6 @@ func Init() error { new(model.AppConfig), new(model.AppConfigHistory), new(model.User), - new(model.UserPermission), new(model.ClientInstance), ); err != nil { return err diff --git a/server/internal/handler/app.go b/server/internal/handler/app.go index e7c08e4..9850172 100644 --- a/server/internal/handler/app.go +++ b/server/internal/handler/app.go @@ -45,10 +45,10 @@ func (h *AppHandler) List(c *gin.Context) { if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { // 组管理员：本组应用 + 自己是负责人的应用 - query = query.And("(group_id = ? OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = ?))", *userInfo.GroupId, userId) + query = query.And("(group_id = ? OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)", *userInfo.GroupId) } else { - // 普通用户：自己是负责人的应用 + 被授权的应用 - query = query.And("(FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = ?))", userId) + // 普通用户：自己是负责人的应用 + query = query.And("FIND_IN_SET('" + userIdStr + "', owner_ids) > 0") } } @@ -60,10 +60,10 @@ func (h *AppHandler) List(c *gin.Context) { if userInfo.IsGroupAdmin() && userInfo.GroupId != nil { // 组管理员：本组应用 + 自己是负责人的应用 - whereClause += " AND (group_id = " + strconv.Itoa(*userInfo.GroupId) + " OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = " + strconv.Itoa(userId) + "))" + whereClause += " AND (group_id = " + strconv.Itoa(*userInfo.GroupId) + " OR FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)" } else { - // 普通用户：自己是负责人的应用 + 被授权的应用 - whereClause += " AND (FIND_IN_SET('" + userIdStr + "', owner_ids) > 0 OR id IN (SELECT app_id FROM user_permission WHERE user_id = " + strconv.Itoa(userId) + "))" + // 普通用户：自己是负责人的应用 + whereClause += " AND (FIND_IN_SET('" + userIdStr + "', owner_ids) > 0)" } } if req.AppType != "" { diff --git a/server/internal/model/user.go b/server/internal/model/user.go index 8386b2e..0dbb9c1 100644 --- a/server/internal/model/user.go +++ b/server/internal/model/user.go @@ -22,18 +22,6 @@ func (User) TableName() string { return "user" } -type UserPermission struct { - Id int `xorm:"int autoincr pk" json:"id"` - UserId int `xorm:"int" json:"userId"` - Env string `xorm:"varchar(16)" json:"env"` - AppId int `xorm:"int" json:"appId"` - Operate string `xorm:"varchar(8) default 'RW'" json:"operate"` // RO, RW -} - -func (UserPermission) TableName() string { - return "user_permission" -} - type LoginUserInfo struct { Id string `json:"id"` Name string `json:"name"` diff --git a/server/internal/service/auth.go b/server/internal/service/auth.go index 009b8c5..3d9973d 100644 --- a/server/internal/service/auth.go +++ b/server/internal/service/auth.go @@ -148,34 +148,6 @@ func (s *AuthService) loadPermissions(userInfo *model.LoginUserInfo, userId int) userInfo.GrantAppIds = append(userInfo.GrantAppIds, app.Id) userInfo.GrantPermissons = append(userInfo.GrantPermissons, buildPermissionCode(app.Id, "RW")) } - - // load granted permissions - var perms []model.UserPermission - dao.Engine.Where("user_id = ?", userId).Find(&perms) - for _, p := range perms { - permCode := buildPermissionCode(p.AppId, p.Operate) - // avoid duplicate - found := false - for _, existing := range userInfo.GrantPermissons { - if existing == permCode { - found = true - break - } - } - if !found { - userInfo.GrantPermissons = append(userInfo.GrantPermissons, permCode) - } - appIdFound := false - for _, id := range userInfo.GrantAppIds { - if id == p.AppId { - appIdFound = true - break - } - } - if !appIdFound { - userInfo.GrantAppIds = append(userInfo.GrantAppIds, p.AppId) - } - } } func buildPermissionCode(appId int, operate string) string { diff --git a/sql/drop_user_permission.sql b/sql/drop_user_permission.sql new file mode 100644 index 0000000..5780135 --- /dev/null +++ b/sql/drop_user_permission.sql @@ -0,0 +1,5 @@ +-- 删除已废弃的用户应用授权表。 +-- 权限现由 application.owner_ids（应用负责人）和业务组角色管理。 +-- 已有环境升级时手动执行：mysql -u -p < sql/drop_user_permission.sql + +DROP TABLE IF EXISTS `user_permission`; diff --git a/sql/kenaito_conf.sql b/sql/kenaito_conf.sql index a9016de..28dcb98 100644 --- a/sql/kenaito_conf.sql +++ b/sql/kenaito_conf.sql @@ -4,15 +4,6 @@ SET FOREIGN_KEY_CHECKS = 0; -CREATE TABLE `user_permission` ( - `id` int NOT NULL AUTO_INCREMENT, - `user_id` int DEFAULT NULL, - `env` varchar(16) DEFAULT NULL, - `app_id` int DEFAULT NULL, - `operate` varchar(8) DEFAULT 'RW', - PRIMARY KEY (`id`) -) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3; - CREATE TABLE `profile_extr_attr` ( `profile` varchar(32) NOT NULL, `attr_name` varchar(50) NOT NULL,