kang
0527c7c392
- 在 SyncAdminAuthorizationCommand 中新增对代理和抽奖菜单操作的同步功能，确保缺失的菜单操作行能够被创建。 - 更新多个控制器中的权限检查逻辑，使用 hasPermissionCode 替代原有的权限验证方式，提升权限管理的灵活性。 - 引入 ApiMessage 统一错误响应格式，确保在权限不足时返回一致的错误信息。 - 更新 AdminRole 和 AdminUser 模型，增强角色与用户的权限管理功能，支持更细粒度的权限控制。
113 lines
3.5 KiB
PHP
113 lines
3.5 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Agent;
|
|
|
|
use App\Models\AdminRole;
|
|
use App\Models\AdminUser;
|
|
use App\Models\AgentNode;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
final class AgentAdminUserService
|
|
{
|
|
/**
|
|
* @param array{
|
|
* username: string,
|
|
* nickname: string,
|
|
* email?: ?string,
|
|
* password: string,
|
|
* status?: int,
|
|
* role_ids?: list<int>
|
|
* } $payload
|
|
*/
|
|
public function createUnderAgent(AgentNode $agent, array $payload): AdminUser
|
|
{
|
|
$roleIds = array_values(array_unique(array_map('intval', $payload['role_ids'] ?? [])));
|
|
$this->assertRolesAssignable($agent, $roleIds);
|
|
|
|
return DB::transaction(function () use ($agent, $payload, $roleIds): AdminUser {
|
|
$user = AdminUser::query()->create([
|
|
'username' => $payload['username'],
|
|
'name' => $payload['nickname'],
|
|
'email' => isset($payload['email']) ? trim((string) $payload['email']) : null,
|
|
'password' => $payload['password'],
|
|
'status' => (int) ($payload['status'] ?? 0),
|
|
]);
|
|
|
|
DB::table('admin_user_agents')->insert([
|
|
'admin_user_id' => $user->id,
|
|
'agent_node_id' => $agent->id,
|
|
'is_primary' => true,
|
|
'granted_at' => now(),
|
|
]);
|
|
|
|
$user->syncAgentRoleIds($agent->id, $roleIds);
|
|
|
|
return $user->fresh();
|
|
});
|
|
}
|
|
|
|
/**
|
|
* @param list<int> $roleIds
|
|
*/
|
|
public function syncRoles(AgentNode $agent, AdminUser $user, array $roleIds): AdminUser
|
|
{
|
|
if ((int) $user->primaryAgentNodeId() !== (int) $agent->id) {
|
|
throw ValidationException::withMessages(['user' => ['agent_mismatch']]);
|
|
}
|
|
|
|
$roleIds = array_values(array_unique(array_map('intval', $roleIds)));
|
|
$this->assertRolesAssignable($agent, $roleIds);
|
|
$user->syncAgentRoleIds($agent->id, $roleIds);
|
|
|
|
return $user->fresh();
|
|
}
|
|
|
|
/**
|
|
* @param list<int> $roleIds
|
|
*/
|
|
private function assertRolesAssignable(AgentNode $agent, array $roleIds): void
|
|
{
|
|
if ($roleIds === []) {
|
|
return;
|
|
}
|
|
|
|
$validCount = AdminRole::query()
|
|
->where('scope_type', AdminRole::SCOPE_AGENT)
|
|
->where('owner_agent_id', $agent->id)
|
|
->whereIn('id', $roleIds)
|
|
->count();
|
|
|
|
if ($validCount !== count($roleIds)) {
|
|
throw ValidationException::withMessages(['role_ids' => ['invalid_for_agent']]);
|
|
}
|
|
}
|
|
|
|
public function destroyUnderAgent(AgentNode $agent, AdminUser $user): void
|
|
{
|
|
if ((int) $user->primaryAgentNodeId() !== (int) $agent->id) {
|
|
throw ValidationException::withMessages(['user' => ['agent_mismatch']]);
|
|
}
|
|
|
|
DB::transaction(static function () use ($agent, $user): void {
|
|
DB::table('admin_user_agent_roles')
|
|
->where('admin_user_id', $user->id)
|
|
->where('agent_node_id', $agent->id)
|
|
->delete();
|
|
|
|
DB::table('admin_user_agents')
|
|
->where('admin_user_id', $user->id)
|
|
->where('agent_node_id', $agent->id)
|
|
->delete();
|
|
|
|
$siteId = (int) $agent->admin_site_id;
|
|
DB::table('admin_user_site_roles')
|
|
->where('admin_user_id', $user->id)
|
|
->where('site_id', $siteId)
|
|
->delete();
|
|
|
|
$user->delete();
|
|
});
|
|
}
|
|
}
|