mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-10-07 06:57:54 +00:00
zhangwenjian
c858b322bd
SysApi.Update took a DataPermission and never used it, so with data permission enabled the update reached rows the caller could not read through GetPage, Get or Remove, which all scope the query. It also reported "无权更新该数据" for a row that simply did not exist, a message that only becomes true once the scope is applied. Drops the Debug() left on the query, which logged the statement for every call.
128 lines
3.0 KiB
Go
128 lines
3.0 KiB
Go
package service
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/go-admin-team/go-admin-core/v2/sdk/runtime"
|
|
"github.com/go-admin-team/go-admin-core/v2/sdk/service"
|
|
"go-admin/app/admin/models"
|
|
"go-admin/app/admin/service/dto"
|
|
"go-admin/common/actions"
|
|
cDto "go-admin/common/dto"
|
|
"go-admin/common/global"
|
|
)
|
|
|
|
type SysApi struct {
|
|
service.Service
|
|
}
|
|
|
|
// GetPage 获取SysApi列表
|
|
func (e *SysApi) GetPage(c *dto.SysApiGetPageReq, p *actions.DataPermission, list *[]models.SysApi, count *int64) error {
|
|
var err error
|
|
var data models.SysApi
|
|
|
|
orm := e.Orm.Debug().Model(&data).
|
|
Scopes(
|
|
cDto.MakeCondition(c.GetNeedSearch()),
|
|
cDto.Paginate(c.GetPageSize(), c.GetPageIndex()),
|
|
actions.Permission(data.TableName(), p),
|
|
)
|
|
if c.Type != "" {
|
|
qType := c.Type
|
|
if qType == "暂无" {
|
|
qType = ""
|
|
}
|
|
if global.Driver == "postgres" {
|
|
orm = orm.Where("type = ?", qType)
|
|
} else {
|
|
orm = orm.Where("`type` = ?", qType)
|
|
}
|
|
|
|
}
|
|
err = orm.Find(list).Limit(-1).Offset(-1).
|
|
Count(count).Error
|
|
if err != nil {
|
|
e.Log.Errorf("Service GetSysApiPage error:%s", err)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Get 获取SysApi对象with id
|
|
func (e *SysApi) Get(d *dto.SysApiGetReq, p *actions.DataPermission, model *models.SysApi) *SysApi {
|
|
var data models.SysApi
|
|
err := e.Orm.Model(&data).
|
|
Scopes(
|
|
actions.Permission(data.TableName(), p),
|
|
).
|
|
FirstOrInit(model, d.GetId()).Error
|
|
if err != nil {
|
|
e.Log.Errorf("db error:%s", err)
|
|
_ = e.AddError(err)
|
|
return e
|
|
}
|
|
if model.Id == 0 {
|
|
err = errors.New("查看对象不存在或无权查看")
|
|
e.Log.Errorf("Service GetSysApi error: %s", err)
|
|
_ = e.AddError(err)
|
|
return e
|
|
}
|
|
return e
|
|
}
|
|
|
|
// Update 修改SysApi对象
|
|
func (e *SysApi) Update(c *dto.SysApiUpdateReq, p *actions.DataPermission) error {
|
|
var model = models.SysApi{}
|
|
db := e.Orm.Scopes(
|
|
actions.Permission(model.TableName(), p),
|
|
).First(&model, c.GetId())
|
|
if err := db.Error; err != nil {
|
|
e.Log.Errorf("Service UpdateSysApi error:%s", err)
|
|
return err
|
|
}
|
|
if db.RowsAffected == 0 {
|
|
return errors.New("无权更新该数据")
|
|
}
|
|
c.Generate(&model)
|
|
db = e.Orm.Save(&model)
|
|
if err := db.Error; err != nil {
|
|
e.Log.Errorf("Service UpdateSysApi error:%s", err)
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// Remove 删除SysApi
|
|
func (e *SysApi) Remove(d *dto.SysApiDeleteReq, p *actions.DataPermission) error {
|
|
var data models.SysApi
|
|
|
|
db := e.Orm.Model(&data).
|
|
Scopes(
|
|
actions.Permission(data.TableName(), p),
|
|
).Delete(&data, d.GetId())
|
|
if err := db.Error; err != nil {
|
|
e.Log.Errorf("Service RemoveSysApi error:%s", err)
|
|
return err
|
|
}
|
|
if db.RowsAffected == 0 {
|
|
return errors.New("无权删除该数据")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// CheckStorageSysApi 创建SysApi对象
|
|
func (e *SysApi) CheckStorageSysApi(c *[]runtime.Router) error {
|
|
for _, v := range *c {
|
|
err := e.Orm.Debug().Where(models.SysApi{Path: v.RelativePath, Action: v.HttpMethod}).
|
|
Attrs(models.SysApi{Handle: v.Handler}).
|
|
FirstOrCreate(&models.SysApi{}).Error
|
|
if err != nil {
|
|
err := fmt.Errorf("Service CheckStorageSysApi error: %s \r\n ", err.Error())
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|