add online monitor and fix admin scopes

2026-06-02 20:50:42 +08:00
parent f69fb46c59
commit a01fc93594
17 changed files with 998 additions and 7 deletions
--- a/qiming-backend/app-platform-modules/platform-system/system-application/src/main/resources/permission/permission-1.4.json
+++ b/qiming-backend/app-platform-modules/platform-system/system-application/src/main/resources/permission/permission-1.4.json
@@ -145,13 +145,22 @@
      "sortIndex": 16,
      "status": 1
    },
+    {
+      "code": "online_monitor",
+      "name": "在线监控模块",
+      "description": "在线监控模块",
+      "source": 1,
+      "type": 1,
+      "sortIndex": 17,
+      "status": 1
+    },
    {
      "code": "category_config",
      "name": "分类管理模块",
      "description": "分类管理模块",
      "source": 1,
      "type": 1,
-      "sortIndex": 17,
+      "sortIndex": 18,
      "status": 1
    },
    {
@@ -924,6 +933,16 @@
      "sortIndex": 1,
      "status": 1
    },
+    {
+      "code": "online_monitor_query",
+      "name": "查询",
+      "description": "查询在线监控",
+      "source": 1,
+      "type": 2,
+      "parentCode": "online_monitor",
+      "sortIndex": 1,
+      "status": 1
+    },
    {
      "code": "subscription_points_query",
      "name": "查询",
@@ -2645,6 +2664,18 @@
      "sortIndex": 10,
      "status": 1
    },
+    {
+      "parentCode": "system_manage",
+      "code": "online_monitor",
+      "name": "在线监控",
+      "description": "在线监控",
+      "source": 1,
+      "path": "/system/online-monitor",
+      "openType": 1,
+      "icon": "",
+      "sortIndex": 11,
+      "status": 1
+    },
    {
      "parentCode": "workspace",
      "code": "member_setting",
@@ -2664,7 +2695,7 @@
      "source": 1,
      "openType": 1,
      "icon": "",
-      "sortIndex": 11,
+      "sortIndex": 12,
      "status": 1
    },
    {
@@ -2675,7 +2706,7 @@
      "source": 1,
      "openType": 1,
      "icon": "",
-      "sortIndex": 12,
+      "sortIndex": 13,
      "status": 1
    },
    {
@@ -3203,6 +3234,11 @@
      "resourceCode": "sandbox_config",
      "resourceBindType": 1
    },
+    {
+      "menuCode": "online_monitor",
+      "resourceCode": "online_monitor",
+      "resourceBindType": 1
+    },
    {
      "menuCode": "category_config",
      "resourceCode": "category_config",
@@ -4016,6 +4052,17 @@
        }
      ]
    },
+    {
+      "roleCode": "super_admin",
+      "menuCode": "online_monitor",
+      "menuBindType": 1,
+      "resourceTree": [
+        {
+          "code": "online_monitor",
+          "resourceBindType": 1
+        }
+      ]
+    },
    {
      "roleCode": "super_admin",
      "menuCode": "category_config",
@@ -4354,4 +4401,4 @@
      "pageDailyPromptLimit": -1
    }
  ]
-}
+}
--- a/qiming-backend/app-platform-modules/platform-system/system-spec/src/main/java/com/xspaceagi/system/spec/enums/ResourceEnum.java
+++ b/qiming-backend/app-platform-modules/platform-system/system-spec/src/main/java/com/xspaceagi/system/spec/enums/ResourceEnum.java
@@ -267,6 +267,11 @@ public enum ResourceEnum {
    SANDBOX_CONFIG_DELETE(ResourceTypeEnum.OPERATION, "sandbox_config_delete", "删除", "sandbox_config"),
 //    SANDBOX_CONFIG_ENABLE(ResourceTypeEnum.OPERATION, "sandbox_config_enable", "启用/禁用", "sandbox_config"),

+    // ================== 在线监控模块 ==================
+    ONLINE_MONITOR(ResourceTypeEnum.MODULE, "online_monitor", "在线监控模块", "root"),
+
+    ONLINE_MONITOR_QUERY(ResourceTypeEnum.OPERATION, "online_monitor_query", "查询", "online_monitor"),
+
    // ================== 分类管理模块 ==================
    CATEGORY_CONFIG(ResourceTypeEnum.MODULE, "category_config", "分类管理模块", "root"),

--- a/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/UserManageController.java
+++ b/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/UserManageController.java
@@ -6,6 +6,7 @@ import com.xspaceagi.system.application.dto.UserDto;
 import com.xspaceagi.system.application.dto.UserQueryDto;
 import com.xspaceagi.system.application.service.NotifyMessageApplicationService;
 import com.xspaceagi.system.application.service.SysGroupApplicationService;
+import com.xspaceagi.system.application.service.SysRoleApplicationService;
 import com.xspaceagi.system.application.service.UserApplicationService;
 import com.xspaceagi.system.infra.dao.entity.SysGroup;
 import com.xspaceagi.system.infra.dao.entity.NotifyMessage;
@@ -19,6 +20,7 @@ import com.xspaceagi.system.spec.dto.PageQueryVo;
 import com.xspaceagi.system.spec.dto.ReqResult;
 import com.xspaceagi.system.spec.enums.ErrorCodeEnum;
 import com.xspaceagi.system.spec.enums.GroupEnum;
+import com.xspaceagi.system.spec.enums.RoleEnum;
 import com.xspaceagi.system.spec.exception.BizException;
 import com.xspaceagi.system.spec.exception.BizExceptionCodeEnum;
 import com.xspaceagi.system.web.dto.UserAddDto;
@@ -49,6 +51,9 @@ public class UserManageController {
    @Resource
    private SysGroupApplicationService sysGroupApplicationService;

+    @Resource
+    private SysRoleApplicationService sysRoleApplicationService;
+
    @Resource
    private NotifyMessageApplicationService notifyMessageApplicationService;

@@ -189,12 +194,16 @@ public class UserManageController {
    }

    private void checkCurrentTenantUser(Long userId) {
-        if (userId == null || userService.getById(userId) == null || !visibleUserIds().contains(userId)) {
+        User user = userId == null ? null : userService.getById(userId);
+        if (user == null || !isCurrentTenantUser(user) || (!isPlatformAdmin() && !visibleUserIds().contains(userId))) {
            throw BizException.of(ErrorCodeEnum.PERMISSION_DENIED, BizExceptionCodeEnum.permissionDenied);
        }
    }

    private void applyUserManageScope(PageQueryVo<UserQueryDto> pageQueryVo) {
+        if (isPlatformAdmin()) {
+            return;
+        }
        if (pageQueryVo.getQueryFilter() == null) {
            pageQueryVo.setQueryFilter(new UserQueryDto());
        }
@@ -215,6 +224,18 @@ public class UserManageController {
                .collect(Collectors.toSet());
    }

+    private boolean isPlatformAdmin() {
+        UserDto currentUser = getCurrentUserDto();
+        return currentUser.getRole() == User.Role.Admin
+                && (currentUserGroupIds().isEmpty()
+                || sysRoleApplicationService.getRoleListByUserId(currentUser.getId()).stream()
+                .anyMatch(role -> RoleEnum.SUPER_ADMIN.getCode().equals(role.getCode())));
+    }
+
+    private boolean isCurrentTenantUser(User user) {
+        return user != null && (getCurrentUserDto().getTenantId() == null || getCurrentUserDto().getTenantId().equals(user.getTenantId()));
+    }
+
    private UserDto getCurrentUserDto() {
        UserDto userDto = (UserDto) RequestContext.get().getUser();
        if (userDto == null) {
--- a/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/permission/SysGroupController.java
+++ b/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/permission/SysGroupController.java
@@ -8,6 +8,7 @@ import com.xspaceagi.system.application.converter.SysDataPermissionConverter;
 import com.xspaceagi.system.application.dto.permission.*;
 import com.xspaceagi.system.application.service.SysDataPermissionApplicationService;
 import com.xspaceagi.system.application.service.SysGroupApplicationService;
+import com.xspaceagi.system.application.service.SysRoleApplicationService;
 import com.xspaceagi.system.application.service.SysSubjectPermissionApplicationService;
 import com.xspaceagi.system.application.dto.UserDto;
 import com.xspaceagi.system.domain.model.GroupBindMenuModel;
@@ -52,6 +53,8 @@ public class SysGroupController extends BaseController {
    @Resource
    private SysGroupApplicationService sysGroupApplicationService;
    @Resource
+    private SysRoleApplicationService sysRoleApplicationService;
+    @Resource
    private SysDataPermissionApplicationService sysDataPermissionApplicationService;
    @Resource
    private SysSubjectPermissionApplicationService sysSubjectPermissionApplicationService;
@@ -397,6 +400,9 @@ public class SysGroupController extends BaseController {
        if (CollectionUtils.isEmpty(groupList)) {
            return groupList;
        }
+        if (isPlatformAdmin()) {
+            return groupList;
+        }
        Set<Long> allowedGroupIds = currentUserGroupIds();
        return groupList.stream()
                .filter(group -> group.getId() != null && allowedGroupIds.contains(group.getId()))
@@ -404,6 +410,9 @@ public class SysGroupController extends BaseController {
    }

    private void checkGroupManageScope(Long groupId) {
+        if (isPlatformAdmin()) {
+            return;
+        }
        if (groupId == null || !currentUserGroupIds().contains(groupId)) {
            throw BizException.of(ErrorCodeEnum.PERMISSION_DENIED, BizExceptionCodeEnum.permissionDenied);
        }
@@ -416,6 +425,14 @@ public class SysGroupController extends BaseController {
                .collect(Collectors.toSet());
    }

+    private boolean isPlatformAdmin() {
+        UserDto currentUser = getCurrentUserDto();
+        return currentUser.getRole() == User.Role.Admin
+                && (currentUserGroupIds().isEmpty()
+                || sysRoleApplicationService.getRoleListByUserId(currentUser.getId()).stream()
+                .anyMatch(role -> RoleEnum.SUPER_ADMIN.getCode().equals(role.getCode())));
+    }
+
    private UserDto getCurrentUserDto() {
        UserDto userDto = (UserDto) RequestContext.get().getUser();
        if (userDto == null) {
--- a/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/permission/SysUserController.java
+++ b/qiming-backend/app-platform-modules/platform-system/system-web/src/main/java/com/xspaceagi/system/web/controller/permission/SysUserController.java
@@ -17,6 +17,7 @@ import com.xspaceagi.system.spec.common.RequestContext;
 import com.xspaceagi.system.spec.dto.ReqResult;
 import com.xspaceagi.system.spec.enums.ErrorCodeEnum;
 import com.xspaceagi.system.spec.enums.GroupEnum;
+import com.xspaceagi.system.spec.enums.RoleEnum;
 import com.xspaceagi.system.spec.exception.BizException;
 import com.xspaceagi.system.spec.exception.BizExceptionCodeEnum;
 import com.xspaceagi.system.spec.utils.I18nUtil;
@@ -157,6 +158,9 @@ public class SysUserController extends BaseController {
        if (targetUser == null || !Objects.equals(targetUser.getTenantId(), RequestContext.get().getTenantId())) {
            throw BizException.of(ErrorCodeEnum.PERMISSION_DENIED, BizExceptionCodeEnum.permissionDenied);
        }
+        if (isPlatformAdmin()) {
+            return;
+        }

        Set<Long> allowedGroupIds = currentUserGroupIds();
        boolean inScope = sysGroupApplicationService.getGroupListByUserId(userId).stream()
@@ -171,6 +175,9 @@ public class SysUserController extends BaseController {
        if (CollectionUtils.isEmpty(groupIds)) {
            return;
        }
+        if (isPlatformAdmin()) {
+            return;
+        }
        Set<Long> allowedGroupIds = currentUserGroupIds();
        boolean allInScope = groupIds.stream().allMatch(allowedGroupIds::contains);
        if (!allInScope) {
@@ -182,6 +189,9 @@ public class SysUserController extends BaseController {
        if (CollectionUtils.isEmpty(roleIds)) {
            return;
        }
+        if (isPlatformAdmin()) {
+            return;
+        }
        Set<Long> allowedRoleIds = sysRoleApplicationService.getRoleListByUserId(getCurrentUserDto().getId()).stream()
                .map(SysRole::getId)
                .collect(Collectors.toSet());
@@ -205,6 +215,14 @@ public class SysUserController extends BaseController {
                .collect(Collectors.toSet());
    }

+    private boolean isPlatformAdmin() {
+        UserDto currentUser = getCurrentUserDto();
+        return currentUser.getRole() == User.Role.Admin
+                && (currentUserGroupIds().isEmpty()
+                || sysRoleApplicationService.getRoleListByUserId(currentUser.getId()).stream()
+                .anyMatch(role -> RoleEnum.SUPER_ADMIN.getCode().equals(role.getCode())));
+    }
+
    private UserDto getCurrentUserDto() {
        UserDto userDto = (UserDto) RequestContext.get().getUser();
        if (userDto == null) {