数据权限的修改

2026-01-10 16:39:33 +08:00
parent 29b24e8450
commit 4b427e1b2e
97 changed files with 3056 additions and 466 deletions
@@ -303,8 +303,9 @@ public class MenuApplicationService {
        Long tenantsId = organizationPo1.getTenantsId();
        OrganizationPo organizationPo = iOrganizationSvc.selectOrganizationById(organizationId);
        List<MenuVo> menuVos = new ArrayList<>();
-        //一级组织
-        if(organizationPo.getParentOrganizationId() == 0){
+        //一级组织：organizationState == 1 表示是一级组织，或者 topOrganizationId == null/0
+        if(organizationPo.getOrganizationState() != null && organizationPo.getOrganizationState() == 1 
+           || (organizationPo.getTopOrganizationId() == null || organizationPo.getTopOrganizationId() == 0)){
            menuVos = menuDomainService.selectMenuIdListByTenantsId(organizationPo.getTenantsId(), 1);
        }else {
            menuVos = menuDomainService.selectMenuIdListByOrganizationId(organizationId);
@@ -100,6 +100,9 @@ public class OrganizationApplicationService {
     * @return 组织列表信息
     */
    public List<OrganizationPo> selectOrganizationList(OrganizationPo organizationPo, DataPermission dataPermission) {
+        // 添加组织数据权限过滤
+        applyOrganizationDataPermission(organizationPo);
+        
        if(dataPermission != null){
            if(dataPermission.getOrganizationIdList() != null && dataPermission.getOrganizationIdList().size() > 0){
                organizationPo.setOrganizationIdList(dataPermission.getOrganizationIdList());
@@ -457,7 +460,7 @@ public class OrganizationApplicationService {
        if(parentOrganizationId != null && parentOrganizationId != 0L && CollectionUtil.isNotEmpty(menuIdList)){
            //获取父级组织信息（一级组织拥有自己的菜单，非一级组织只拥有菜单权限）
            OrganizationPo organizationPo = iOrganizationSvc.selectOrganizationById(parentOrganizationId);
-            if(organizationPo.getParentOrganizationId() == 0L){
+            if(organizationPo.getTopOrganizationId() == 0L){
                //获取一级组织对应的所有菜单
                List<Long> allByTenantsId = menuDomainService.getMenuIdByTenantsId(organizationPo.getTenantsId(),null);
                if (CollectionUtil.isNotEmpty(allByTenantsId)){
@@ -634,4 +637,51 @@ public class OrganizationApplicationService {
        }
        return list;
    }
+
+    /**
+     * 应用组织数据权限过滤
+     */
+    private void applyOrganizationDataPermission(OrganizationPo organizationPo) {
+        try {
+            LoginUser loginUser = SecurityUtils.getLoginUser();
+            if (loginUser != null && loginUser.getUserPo() != null) {
+                Long loginUserOrganizationId = loginUser.getUserPo().getOrganizationId();
+                Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
+                
+                // 先保存前端传递的 organizationId（如果存在）
+                Long frontendOrganizationId = organizationPo.getOrganizationId();
+                
+                // 数据权限：根据organizationId来设置查询权限
+                // organizationId等于2827时查询全部，其他仅查询各自组织的信息
+                if (loginUserOrganizationId != null && loginUserOrganizationId.equals(2827L)) {
+                    // 南光组织（organizationId=2827）：可以查询所有组织的数据
+                    // 如果前端传递了 organizationId，使用前端传递的值进行过滤
+                    // 如果前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
+                    if (frontendOrganizationId != null) {
+                        organizationPo.setOrganizationId(frontendOrganizationId);
+                        organizationPo.setTopOrganizationId(null);
+                    } else {
+                        organizationPo.setOrganizationId(null);
+                        organizationPo.setTopOrganizationId(null);
+                    }
+                } else {
+                    // 其他组织：设置organizationId，只查询当前组织的数据
+                    if (frontendOrganizationId != null && !frontendOrganizationId.equals(loginUserOrganizationId)) {
+                        // 前端传递了其他组织的organizationId，强制使用当前登录用户的组织ID，防止越权查询
+                        log.warn("组织列表查询 - 前端传递的组织ID {} 与当前登录用户的组织ID {} 不一致，使用当前登录用户的组织ID进行过滤",
+                            frontendOrganizationId, loginUserOrganizationId);
+                        organizationPo.setOrganizationId(loginUserOrganizationId);
+                    } else if (frontendOrganizationId == null) {
+                        organizationPo.setOrganizationId(loginUserOrganizationId);
+                    }
+                    if (topOrganizationId != null) {
+                        organizationPo.setTopOrganizationId(topOrganizationId);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn("应用组织数据权限过滤失败，将不进行组织过滤: {}", e.getMessage());
+            // 如果获取登录用户信息失败，不添加过滤条件，避免影响正常查询
+        }
+    }
 }
@@ -21,6 +21,8 @@ public class OrganizationPo  extends BaseVOEntity implements Serializable {
    private Long organizationId;
    @ApiModelProperty(name = "上级组织表ID")
    private Long parentOrganizationId;
+    @ApiModelProperty(name = "一级组织表ID")
+    private Long topOrganizationId;
    @ApiModelProperty(name = "组织名称")
    private String organizationName;
    @ApiModelProperty(name = "员工数量")