BruceSun
/
RuoYi-Vue
mirror of https://gitee.com/y_project/RuoYi-Vue.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

权限

pull/1121/head
梁宇奇 2025-06-23 16:30:12 +08:00
parent a3904cff11
commit faa51942e0
8 changed files with 145 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ruoyi-admin/src/main/java/com/ruoyi/web/controller/xkt/AssetController.java
View File

@ -22,6 +22,7 @@ import com.ruoyi.xkt.service.IAssetService;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;
@ -41,6 +42,7 @@ public class AssetController extends XktBaseController {
@Autowired
private FsNotice fsNotice;
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口资产")
@GetMapping(value = "store/current")
public R<AssetInfoVO> getCurrentStoreAsset() {
@ -48,6 +50,7 @@ public class AssetController extends XktBaseController {
return success(BeanUtil.toBean(dto, AssetInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation(value = "卖家资产")
@GetMapping(value = "user/current")
public R<AssetInfoVO> getCurrentUserAsset() {
@ -55,6 +58,7 @@ public class AssetController extends XktBaseController {
return success(BeanUtil.toBean(dto, AssetInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('store,seller')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "发送短信验证码（资产相关功能）")
@PostMapping("/sendSmsVerificationCode")
public R sendSmsVerificationCode(@Validated @RequestBody PhoneNumberVO vo) {
@ -62,6 +66,7 @@ public class AssetController extends XktBaseController {
return R.ok();
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口绑定支付宝")
@PostMapping(value = "store/alipay/bind")
public R<AssetInfoVO> bindStoreAlipay(@Validated @RequestBody AlipayStoreBindVO vo) {
@ -71,6 +76,7 @@ public class AssetController extends XktBaseController {
return success(BeanUtil.toBean(assetService.bindAlipay(dto), AssetInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation(value = "卖家绑定支付宝")
@PostMapping(value = "user/alipay/bind")
public R<AssetInfoVO> bindUserAlipay(@Validated @RequestBody AlipayUserBindVO vo) {
@ -80,6 +86,7 @@ public class AssetController extends XktBaseController {
return success(BeanUtil.toBean(assetService.bindAlipay(dto), AssetInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口设置交易密码")
@PostMapping(value = "store/transaction-password/set")
public R<AssetInfoVO> setTransactionPassword(@Validated @RequestBody TransactionPasswordSetVO vo) {
@ -88,6 +95,7 @@ public class AssetController extends XktBaseController {
return success(BeanUtil.toBean(assetService.setTransactionPassword(dto), AssetInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口支付宝提现")
@PostMapping(value = "store/alipay/withdraw")
public R withdrawByAlipay(@Validated @RequestBody WithdrawReqVO vo) {
@ -106,6 +114,7 @@ public class AssetController extends XktBaseController {
return success();
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口交易明细")
@PostMapping("store/trans-detail/page")
public R<PageVO<TransDetailStorePageItemVO>> pageStoreTransDetail(@Validated @RequestBody BasePageVO vo) {
@ -115,6 +124,7 @@ public class AssetController extends XktBaseController {
return success(PageVO.of(pageDTO, TransDetailStorePageItemVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation(value = "卖家交易明细")
@PostMapping("user/trans-detail/page")
public R<PageVO<TransDetailUserPageItemVO>> pageUserTransDetail(@Validated @RequestBody BasePageVO vo) {
@ -124,6 +134,7 @@ public class AssetController extends XktBaseController {
return success(PageVO.of(pageDTO, TransDetailUserPageItemVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口充值")
@PostMapping(value = "store/recharge")
public R<StoreRechargeRespVO> rechargeByStore(@Validated @RequestBody StoreRechargeReqVO vo) {
@ -137,6 +148,7 @@ public class AssetController extends XktBaseController {
result.getPayRtnStr()));
}
@PreAuthorize("@ss.hasAnyRoles('store')||@ss.hasSupplierSubRole()")
@ApiOperation(value = "档口充值结果")
@PostMapping(value = "store/recharge/result")
public R<StoreRechargeResultRespVO> getRechargeResult(@Validated @RequestBody StoreRechargeResultReqVO vo) {

58
ruoyi-admin/src/main/java/com/ruoyi/web/controller/xkt/StoreOrderController.java
View File

@ -39,6 +39,7 @@ import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;
import java.util.ArrayList;
import java.util.List;
import java.util.Objects;
import java.util.Set;
import java.util.concurrent.TimeUnit;
import java.util.stream.Collectors;
@ -86,8 +87,9 @@ public class StoreOrderController extends XktBaseController {
public R<Long> edit(@Valid @RequestBody StoreOrderUpdateReqVO vo) {
StoreOrderUpdateDTO dto = BeanUtil.toBean(vo, StoreOrderUpdateDTO.class);
dto.setOrderUserId(SecurityUtils.getUserId());
//仅本人可修改
storeOrderService.checkOrderUser(dto.getId(), dto.getOrderUserId());
StoreOrderExt result = storeOrderService.modifyOrder(dto);
//TODO 非下单人，不允许修改
return success(result.getOrder().getId());
}
@ -96,6 +98,8 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("支付订单")
@PostMapping("pay")
public R<StoreOrderPayRespVO> pay(@Valid @RequestBody StoreOrderPayReqVO vo) {
//仅本人可支付
storeOrderService.checkOrderUser(vo.getStoreOrderId(), SecurityUtils.getUserId());
EPayChannel payChannel = EPayChannel.of(vo.getPayChannel());
PaymentManager paymentManager = getPaymentManager(payChannel);
//订单支付状态->支付中
@ -115,8 +119,9 @@ public class StoreOrderController extends XktBaseController {
.storeOrderId(vo.getStoreOrderId())
.operatorId(SecurityUtils.getUserId())
.build();
//仅本人可取消
storeOrderService.checkOrderUser(dto.getStoreOrderId(), dto.getOperatorId());
storeOrderService.cancelOrder(dto);
//TODO 非下单人，不允许取消
return success();
}
@ -124,8 +129,13 @@ public class StoreOrderController extends XktBaseController {
@GetMapping(value = "/{id}")
public R<StoreOrderInfoVO> getInfo(@PathVariable("id") Long id) {
StoreOrderInfoDTO infoDTO = storeOrderService.getInfo(id);
//TODO 非下单人，非所属档口不允许查询
return success(BeanUtil.toBean(infoDTO, StoreOrderInfoVO.class));
if (SecurityUtils.isAdmin()
|| Objects.equals(infoDTO.getOrderUserId(), SecurityUtils.getUserId())
|| Objects.equals(infoDTO.getStoreId(), SecurityUtils.getStoreId())) {
return success(BeanUtil.toBean(infoDTO, StoreOrderInfoVO.class));
}
//没有订单权限
return success();
}
@ -138,7 +148,12 @@ public class StoreOrderController extends XktBaseController {
if (1 == vo.getSrcPage()) {
queryDTO.setOrderUserId(SecurityUtils.getUserId());
} else {
queryDTO.setStoreId(SecurityUtils.getStoreId());
Long storeId = SecurityUtils.getStoreId();
if (storeId == null && !SecurityUtils.isAdmin()) {
//没有权限
return success();
}
queryDTO.setStoreId(storeId);
}
Page<StoreOrderPageItemDTO> pageDTO = storeOrderService.page(queryDTO);
return success(PageVO.of(pageDTO, StoreOrderPageItemVO.class));
@ -149,7 +164,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("发货-平台物流")
@PostMapping("ship/platform")
public R<List<StoreOrderShipRespVO>> shipByPlatform(@Valid @RequestBody StoreOrderShipByPlatformReqVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderId(), SecurityUtils.getStoreId());
}
StoreOrderExt orderExt = storeOrderService.shipOrderByPlatform(vo.getStoreOrderId(),
vo.getStoreOrderDetailIds(), vo.getExpressId(), SecurityUtils.getUserId());
List<StoreOrderShipRespVO> respList = new ArrayList<>(vo.getStoreOrderDetailIds().size());
@ -166,7 +184,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("发货-档口物流")
@PostMapping("ship/store")
public R<List<StoreOrderShipRespVO>> shipByStore(@Valid @RequestBody StoreOrderShipByStoreReqVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderId(), SecurityUtils.getStoreId());
}
StoreOrderExt orderExt = storeOrderService.shipOrderByStore(vo.getStoreOrderId(),
vo.getStoreOrderDetailIds(), vo.getExpressId(), vo.getExpressWaybillNo(), SecurityUtils.getUserId());
List<StoreOrderShipRespVO> respList = new ArrayList<>(vo.getStoreOrderDetailIds().size());
@ -183,7 +204,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("打印面单")
@PostMapping("ship/print")
public R<List<StoreOrderPrintRespVO>> print(@Valid @RequestBody StoreOrderPrintReqVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderDetailIds(), SecurityUtils.getStoreId());
}
List<ExpressPrintDTO> dtoList = storeOrderService.printOrder(vo.getStoreOrderDetailIds());
List<StoreOrderPrintRespVO> rtnList = dtoList.stream().map(o -> {
StoreOrderPrintRespVO rtn = new StoreOrderPrintRespVO();
@ -199,7 +223,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("确认收货")
@PostMapping("receipt")
public R receipt(@Valid @RequestBody StoreOrderReceiptReqVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderId(), SecurityUtils.getStoreId());
}
storeOrderService.receiptOrder(vo.getStoreOrderId(), SecurityUtils.getUserId());
return success();
}
@ -209,7 +236,8 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("申请售后（创建售后订单）")
@PostMapping("refund/apply")
public R<Long> applyRefund(@Valid @RequestBody StoreOrderAfterSaleReqVO vo) {
//TODO 权限
//仅本人可操作
storeOrderService.checkOrderUser(vo.getStoreOrderId(), SecurityUtils.getUserId());
StoreOrderAfterSaleDTO dto = BeanUtil.toBean(vo, StoreOrderAfterSaleDTO.class);
dto.setOperatorId(SecurityUtils.getUserId());
//创建售后订单
@ -245,7 +273,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("确认退款")
@PostMapping("refund/confirm")
public R confirmRefund(@Valid @RequestBody StoreOrderRefundConfirmVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderId(), SecurityUtils.getStoreId());
}
StoreOrderRefundConfirmDTO dto = BeanUtil.toBean(vo, StoreOrderRefundConfirmDTO.class);
dto.setOperatorId(SecurityUtils.getUserId());
//支付宝接口要求：同一笔交易的退款至少间隔3s后发起
@ -277,7 +308,10 @@ public class StoreOrderController extends XktBaseController {
@ApiOperation("拒绝退款")
@PostMapping("refund/reject")
public R rejectRefund(@Valid @RequestBody StoreOrderRefundRejectVO vo) {
//TODO 权限
if (!SecurityUtils.isAdmin()) {
//仅档口可操作
storeOrderService.checkOrderStore(vo.getStoreOrderId(), SecurityUtils.getStoreId());
}
StoreOrderRefundRejectDTO dto = BeanUtil.toBean(vo, StoreOrderRefundRejectDTO.class);
dto.setOperatorId(SecurityUtils.getUserId());
storeOrderService.rejectRefundOrder(dto);

4
ruoyi-admin/src/main/java/com/ruoyi/web/controller/xkt/UserAccountController.java
View File

@ -21,8 +21,8 @@ import java.util.List;
* @author ruoyi
* @date 2025-03-26
*/
@RestController
@RequestMapping("/rest/v1/user-accs")
//@RestController
//@RequestMapping("/rest/v1/user-accs")
public class UserAccountController extends XktBaseController {
@Autowired
private IUserAccountService userAccountService;

13
ruoyi-admin/src/main/java/com/ruoyi/web/controller/xkt/UserAddressController.java
View File

@ -13,6 +13,7 @@ import com.ruoyi.xkt.service.IUserAddressService;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;
@ -31,6 +32,7 @@ public class UserAddressController extends XktBaseController {
@Autowired
private IUserAddressService userAddressService;
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation("创建用户收货地址")
@PostMapping("create")
public R<UserAddressInfoVO> create(@Valid @RequestBody UserAddressCreateVO vo) {
@ -39,37 +41,44 @@ public class UserAddressController extends XktBaseController {
return success(BeanUtil.toBean(userAddressService.createUserAddress(dto), UserAddressInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation("修改用户收货地址")
@PostMapping("edit")
public R<UserAddressInfoVO> edit(@Valid @RequestBody UserAddressModifyVO vo) {
UserAddressInfoDTO dto = BeanUtil.toBean(vo, UserAddressInfoDTO.class);
dto.setUserId(SecurityUtils.getUserId());
//TODO 非本人不允许修改
userAddressService.checkOwner(dto.getId(), dto.getUserId());
return success(BeanUtil.toBean(userAddressService.modifyUserAddress(dto), UserAddressInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation("复制用户收货地址")
@PostMapping("copy")
public R<UserAddressInfoVO> copy(@Valid @RequestBody IdVO vo) {
userAddressService.checkOwner(vo.getId(), SecurityUtils.getUserId());
UserAddressInfoDTO dto = userAddressService.copyUserAddress(vo.getId());
return success(BeanUtil.toBean(dto, UserAddressInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation("删除用户收货地址")
@PostMapping("delete")
public R delete(@Valid @RequestBody IdVO vo) {
userAddressService.checkOwner(vo.getId(), SecurityUtils.getUserId());
userAddressService.deleteUserAddress(vo.getId());
return success();
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation(value = "用户收货地址详情")
@GetMapping("/{id}")
public R<UserAddressInfoVO> getInfo(@PathVariable("id") Long id) {
userAddressService.checkOwner(id, SecurityUtils.getUserId());
UserAddressInfoDTO infoDTO = userAddressService.getUserAddress(id);
//TODO 非本人不允许查询
return success(BeanUtil.toBean(infoDTO, UserAddressInfoVO.class));
}
@PreAuthorize("@ss.hasAnyRoles('seller')")
@ApiOperation(value = "用户收货地址列表")
@PostMapping("/list")
public R<List<UserAddressInfoVO>> list() {

25
xkt/src/main/java/com/ruoyi/xkt/service/IStoreOrderService.java
View File

@ -8,6 +8,7 @@ import com.ruoyi.xkt.enums.EPayChannel;
import com.ruoyi.xkt.enums.EPayPage;
import java.math.BigDecimal;
import java.util.Collection;
import java.util.Date;
import java.util.List;
@ -193,4 +194,28 @@ public interface IStoreOrderService {
* @return
*/
List<StoreOrderRefund> listNeedContinueRefundOrder(Integer count);
/**
* 订单是否属于用户
*
* @param storeOrderId
* @param userId
*/
void checkOrderUser(Long storeOrderId, Long userId);
/**
* 订单是否属于档口
*
* @param storeOrderId
* @param storeId
*/
void checkOrderStore(Long storeOrderId, Long storeId);
/**
* 订单明细是否属于档口
*
* @param storeOrderDetailIds
* @param storeId
*/
void checkOrderStore(Collection<Long> storeOrderDetailIds, Long storeId);
}

8
xkt/src/main/java/com/ruoyi/xkt/service/IUserAddressService.java
View File

@ -57,4 +57,12 @@ public interface IUserAddressService {
* @param id
*/
void deleteUserAddress(Long id);
/**
* 校验地址归属
*
* @param id
* @param userId
*/
void checkOwner(Long id, Long userId);
}

28
xkt/src/main/java/com/ruoyi/xkt/service/impl/StoreOrderServiceImpl.java
View File

@ -1323,6 +1323,34 @@ public class StoreOrderServiceImpl implements IStoreOrderService {
return storeOrderRefunds;
}
@Override
public void checkOrderUser(Long storeOrderId, Long userId) {
StoreOrder order = storeOrderMapper.selectById(storeOrderId);
Assert.notNull(order, "订单不存在");
if (!Objects.equals(userId, order.getOrderUserId())) {
throw new ServiceException(CharSequenceUtil.format("无订单[{}]权限", order.getId()));
}
}
@Override
public void checkOrderStore(Long storeOrderId, Long storeId) {
StoreOrder order = storeOrderMapper.selectById(storeOrderId);
Assert.notNull(order, "订单不存在");
if (!Objects.equals(storeId, order.getStoreId())) {
throw new ServiceException(CharSequenceUtil.format("无订单[{}]权限", order.getId()));
}
}
@Override
public void checkOrderStore(Collection<Long> storeOrderDetailIds, Long storeId) {
Assert.notEmpty(storeOrderDetailIds);
Set<Long> storeOrderIds = storeOrderDetailMapper.selectByIds(storeOrderDetailIds)
.stream()
.map(StoreOrderDetail::getStoreOrderId)
.collect(Collectors.toSet());
storeOrderIds.forEach(id -> checkOrderStore(id, storeId));
}
/**
* 添加操作记录
*

13
xkt/src/main/java/com/ruoyi/xkt/service/impl/UserAddressServiceImpl.java
View File

@ -7,6 +7,7 @@ import cn.hutool.core.lang.Assert;
import com.baomidou.mybatisplus.core.toolkit.Wrappers;
import com.ruoyi.common.constant.Constants;
import com.ruoyi.common.core.domain.XktBaseEntity;
import com.ruoyi.common.exception.ServiceException;
import com.ruoyi.xkt.domain.UserAddress;
import com.ruoyi.xkt.dto.express.ExpressStructAddressDTO;
import com.ruoyi.xkt.dto.express.UserAddressInfoDTO;
@ -19,6 +20,7 @@ import org.springframework.transaction.annotation.Transactional;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.stream.Collectors;
/**
@ -147,4 +149,15 @@ public class UserAddressServiceImpl implements IUserAddressService {
userAddress.setDelFlag(Constants.DELETED);
userAddressMapper.updateById(userAddress);
}
@Override
public void checkOwner(Long id, Long userId) {
UserAddress ua = userAddressMapper.selectById(id);
if (ua == null) {
return;
}
if (!Objects.equals(ua.getUserId(), userId)) {
throw new ServiceException("无权操作");
}
}
}