package jnpf.dmsService;
|
|
import jnpf.base.UserInfo;
|
import jnpf.dmsEntity.permission.form.UserFolderPermissionTreeForm;
|
import jnpf.dmsEntity.permission.model.DmsSubjectSet;
|
import jnpf.dmsEntity.permission.model.DmsUserFolderPermissionTreeRow;
|
import jnpf.dmsEntity.permission.vo.DmsCursorPageVO;
|
import jnpf.dmsEntity.permission.vo.DmsUserFolderPermissionTreeNodeVO;
|
import jnpf.dmsEntity.permission.vo.DmsUserFolderPermissionVO;
|
import jnpf.dmsMapper.DmsUserFolderPermissionTreeMapper;
|
import jnpf.dmsPermission.DmsCurrentIdentity;
|
import jnpf.dmsPermission.DmsFileCenterCursorCodec;
|
import jnpf.dmsPermission.DmsPermissionError;
|
import jnpf.dmsPermission.DmsPermissionException;
|
import jnpf.dmsPermission.DmsPermissionGroupMembershipResolver;
|
import jnpf.dmsPermission.DmsPermissionProperties;
|
import jnpf.dmsPermission.DmsUserFolderPermissionPrincipal;
|
import jnpf.dmsPermission.DmsUserFolderPermissionTreeQuery;
|
import jnpf.dmsPermission.DmsUserSubjectBatchResolver;
|
import lombok.RequiredArgsConstructor;
|
import org.springframework.stereotype.Service;
|
import org.springframework.transaction.annotation.Transactional;
|
|
import java.util.ArrayList;
|
import java.util.Collections;
|
import java.util.LinkedHashMap;
|
import java.util.LinkedHashSet;
|
import java.util.List;
|
import java.util.Map;
|
import java.util.Set;
|
import java.util.UUID;
|
|
@Service
|
@RequiredArgsConstructor
|
public class DmsUserFolderPermissionTreeService {
|
private static final String CURSOR_KIND = "USER_FOLDER_PERMISSION_TREE";
|
|
private final DmsCurrentIdentity currentIdentity;
|
private final DmsPermissionProperties properties;
|
private final DmsFileCenterCursorCodec cursorCodec;
|
private final DmsUserSubjectBatchResolver subjectResolver;
|
private final DmsPermissionGroupMembershipResolver groupMembershipResolver;
|
private final DmsUserFolderPermissionTreeMapper mapper;
|
|
@Transactional(readOnly = true)
|
public DmsCursorPageVO<DmsUserFolderPermissionTreeNodeVO> tree(UserFolderPermissionTreeForm form) {
|
currentIdentity.requirePermissionAdministrator();
|
UserInfo actor = currentIdentity.requireUser();
|
String tenantId = currentIdentity.tenantId(actor);
|
List<String> userIds = normalizeUserIds(form == null ? null : form.getUserIds());
|
int pageSize = pageSize(form == null ? null : form.getPageSize());
|
UUID parentId = form == null ? null : form.getParentId();
|
String fingerprint = cursorCodec.fingerprint(String.join("\n", userIds));
|
DmsFileCenterCursorCodec.Cursor cursor = cursorCodec.decode(
|
form == null ? null : form.getCursor(), CURSOR_KIND, tenantId,
|
actor.getUserId().trim(), parentId, fingerprint);
|
|
List<DmsSubjectSet> subjects = subjectResolver.resolve(tenantId, userIds);
|
groupMembershipResolver.resolveAll(subjects, properties.getMaxPermissionGroupScan());
|
|
DmsUserFolderPermissionTreeQuery query = new DmsUserFolderPermissionTreeQuery();
|
query.setTenantId(tenantId);
|
query.setParentId(parentId);
|
query.setCursorSortCode(cursor.getSortCode());
|
query.setCursorId(cursor.getId());
|
query.setLimit(pageSize + 1);
|
query.setPrincipals(principals(subjects));
|
|
List<DmsUserFolderPermissionTreeRow> rows = mapper.selectTree(query);
|
return page(rows, userIds, pageSize, tenantId, actor.getUserId().trim(), parentId, fingerprint);
|
}
|
|
/** Internal business entry: only the authenticated user's full PRINT folder scope. */
|
@Transactional(readOnly = true)
|
public List<UUID> currentUserPrintFolderIds() {
|
UserInfo actor = currentIdentity.requireUser();
|
String tenantId = currentIdentity.tenantId(actor);
|
String userId = actor.getUserId().trim();
|
List<DmsSubjectSet> subjects = subjectResolver.resolve(tenantId, Collections.singletonList(userId));
|
for (DmsSubjectSet subject : subjects) {
|
if (!userId.equals(subject.getUserId())) {
|
throw invalid("用户授权主体不匹配");
|
}
|
}
|
groupMembershipResolver.resolveAll(subjects, properties.getMaxPermissionGroupScan());
|
DmsUserFolderPermissionTreeQuery query = new DmsUserFolderPermissionTreeQuery();
|
query.setTenantId(tenantId);
|
query.setPrincipals(principals(subjects));
|
List<UUID> ids = new ArrayList<>();
|
for (DmsUserFolderPermissionTreeRow row : mapper.selectPrintFolders(query)) {
|
ids.add(row.getId());
|
}
|
return ids;
|
}
|
|
/** Personal workflow grants are version-scoped and never expanded into folder permissions. */
|
@Transactional(readOnly = true)
|
public List<UUID> currentUserWorkflowPrintVersionIds() {
|
UserInfo actor = currentIdentity.requireUser();
|
List<UUID> ids = new ArrayList<>();
|
for (DmsUserFolderPermissionTreeRow row : mapper.selectWorkflowPrintVersions(
|
currentIdentity.tenantId(actor), actor.getUserId().trim())) {
|
ids.add(row.getId());
|
}
|
return ids;
|
}
|
|
private List<String> normalizeUserIds(List<String> values) {
|
if (values == null || values.isEmpty()) {
|
throw invalid("userIds 不能为空");
|
}
|
LinkedHashSet<String> normalized = new LinkedHashSet<>();
|
for (String value : values) {
|
if (value == null || value.trim().isEmpty()) {
|
throw invalid("userIds 不能包含空值");
|
}
|
normalized.add(value.trim());
|
}
|
if (normalized.size() > properties.getMaxUserFolderTreeUsers()) {
|
throw invalid("userIds 数量不能超过 " + properties.getMaxUserFolderTreeUsers());
|
}
|
return new ArrayList<>(normalized);
|
}
|
|
private int pageSize(Integer requested) {
|
int value = requested == null ? properties.getDefaultPageSize() : requested;
|
if (value < 1 || value > properties.getMaxPageSize()) {
|
throw invalid("pageSize 必须在 1 到 " + properties.getMaxPageSize() + " 之间");
|
}
|
return value;
|
}
|
|
private List<DmsUserFolderPermissionPrincipal> principals(List<DmsSubjectSet> subjects) {
|
LinkedHashMap<String, DmsUserFolderPermissionPrincipal> values = new LinkedHashMap<>();
|
for (DmsSubjectSet subject : subjects) {
|
addPrincipal(values, subject.getUserId(), "USER", subject.getUserId());
|
addPrincipals(values, subject.getUserId(), "ORG_DIRECT", subject.getDirectOrgIds());
|
addPrincipals(values, subject.getUserId(), "ORG_ANCESTOR", subject.getAncestorOrgIds());
|
addPrincipals(values, subject.getUserId(), "POSITION", subject.getPositionIds());
|
addPrincipals(values, subject.getUserId(), "ROLE", subject.getRoleIds());
|
addPrincipals(values, subject.getUserId(), "GROUP", subject.getPermissionGroupIds());
|
}
|
return new ArrayList<>(values.values());
|
}
|
|
private void addPrincipals(Map<String, DmsUserFolderPermissionPrincipal> values,
|
String userId, String kind, Set<String> ids) {
|
if (ids == null) {
|
return;
|
}
|
for (String id : ids) {
|
addPrincipal(values, userId, kind, id);
|
}
|
}
|
|
private void addPrincipal(Map<String, DmsUserFolderPermissionPrincipal> values,
|
String userId, String kind, String id) {
|
if (id == null || id.trim().isEmpty()) {
|
return;
|
}
|
String normalizedId = id.trim();
|
String key = userId + "\n" + kind + "\n" + normalizedId;
|
values.computeIfAbsent(key,
|
ignored -> new DmsUserFolderPermissionPrincipal(userId, kind, normalizedId));
|
}
|
|
private DmsCursorPageVO<DmsUserFolderPermissionTreeNodeVO> page(
|
List<DmsUserFolderPermissionTreeRow> sourceRows, List<String> userIds, int pageSize,
|
String tenantId, String actorId, UUID parentId, String fingerprint) {
|
List<DmsUserFolderPermissionTreeRow> rows = sourceRows == null
|
? Collections.<DmsUserFolderPermissionTreeRow>emptyList() : sourceRows;
|
LinkedHashMap<UUID, DmsUserFolderPermissionTreeNodeVO> nodes = new LinkedHashMap<>();
|
Map<UUID, Map<String, Set<String>>> actionsByFolder = new LinkedHashMap<>();
|
for (DmsUserFolderPermissionTreeRow row : rows) {
|
DmsUserFolderPermissionTreeNodeVO node = nodes.computeIfAbsent(row.getId(), ignored -> node(row));
|
if (row.getUserId() != null && row.getActionCode() != null) {
|
actionsByFolder.computeIfAbsent(node.getId(), ignored -> new LinkedHashMap<>())
|
.computeIfAbsent(row.getUserId(), ignored -> new LinkedHashSet<>())
|
.add(row.getActionCode());
|
}
|
}
|
|
boolean hasMore = nodes.size() > pageSize;
|
List<DmsUserFolderPermissionTreeNodeVO> list = new ArrayList<>(nodes.values());
|
if (hasMore) {
|
list = new ArrayList<>(list.subList(0, pageSize));
|
}
|
for (DmsUserFolderPermissionTreeNodeVO node : list) {
|
Map<String, Set<String>> byUser = actionsByFolder.getOrDefault(
|
node.getId(), Collections.<String, Set<String>>emptyMap());
|
for (String userId : userIds) {
|
Set<String> actions = byUser.get(userId);
|
if (actions == null || actions.isEmpty()) {
|
continue;
|
}
|
DmsUserFolderPermissionVO permission = new DmsUserFolderPermissionVO();
|
permission.setUserId(userId);
|
List<String> ordered = new ArrayList<>();
|
if (actions.contains("READ")) {
|
ordered.add("READ");
|
}
|
if (actions.contains("PRINT")) {
|
ordered.add("PRINT");
|
}
|
permission.setActions(ordered);
|
node.getUserPermissions().add(permission);
|
}
|
}
|
|
DmsCursorPageVO<DmsUserFolderPermissionTreeNodeVO> result = new DmsCursorPageVO<>();
|
result.setList(list);
|
result.setHasMore(hasMore);
|
if (hasMore && !list.isEmpty()) {
|
DmsUserFolderPermissionTreeNodeVO last = list.get(list.size() - 1);
|
result.setNextCursor(cursorCodec.encode(CURSOR_KIND, tenantId, actorId, parentId, fingerprint,
|
new DmsFileCenterCursorCodec.Cursor(
|
last.getName(), null, null, last.getSortCode(), last.getId())));
|
}
|
return result;
|
}
|
|
private DmsUserFolderPermissionTreeNodeVO node(DmsUserFolderPermissionTreeRow row) {
|
DmsUserFolderPermissionTreeNodeVO node = new DmsUserFolderPermissionTreeNodeVO();
|
node.setId(row.getId());
|
node.setParentId(row.getParentId());
|
node.setName(row.getName());
|
node.setSortCode(row.getSortCode());
|
node.setHasChildren(row.isHasChildren());
|
return node;
|
}
|
|
private DmsPermissionException invalid(String message) {
|
return DmsPermissionException.of(DmsPermissionError.INVALID_REQUEST, message);
|
}
|
}
|
