refactor(permission): 优化文件权限校验及锁定逻辑

- 修改权限校验函数为返回布尔值,简化调用和异常处理逻辑
- 对无权限操作使用统一异常提示,明确提示无权限原因
- 在获取文件详情时添加锁定用户信息及编辑权限标记
- 避免锁定文件时重复提示锁定用户,区分当前用户和锁定用户
- 在文件视图对象中新增可编辑权限字段 canWrite,用于前端权限显示
- 统一权限校验逻辑,支持读写权限细粒度判断,提升代码清晰性和维护性
This commit is contained in:
曹鹏飞 2026-05-29 09:15:50 +08:00
parent 0cecd2e8d8
commit 0582451a99
2 changed files with 24 additions and 15 deletions

View File

@ -120,7 +120,7 @@ public class QmsFileControllerService {
// 校验权限
Long userId = UserUtil.getUserId();
checkFilePermission(request.getId(), userId, true);
VUtil.trueThrowBusinessError(!checkFilePermission(request.getId(), userId)).throwMessage("无权限修改此文件");
String operator = UserUtil.getUserName();
LocalDateTime now = LocalDateTime.now();
@ -154,7 +154,7 @@ public class QmsFileControllerService {
// 校验权限
Long userId = UserUtil.getUserId();
checkFilePermission(id, userId, true);
VUtil.trueThrowBusinessError(!checkFilePermission(id, userId)).throwMessage("无权限");
// 删除文件
fileService.removeById(id);
@ -222,9 +222,15 @@ public class QmsFileControllerService {
// 校验权限
Long userId = UserUtil.getUserId();
checkFilePermission(id, userId, false);
boolean permission = checkFilePermission(id, userId);
QmsFileVO vo = BeanUtil.copyProperties(file, QmsFileVO.class);
String key = StrUtil.format(LOCK_KEY, id);
Long lockedUserId = redisTemplate.opsForValue().get(key);
if (Objects.nonNull(lockedUserId)) {
permission = Objects.equals(lockedUserId, userId);
vo.setCurrentLockUserName(userService.getById(lockedUserId).getUserName());
}
vo.setCanWrite(permission);
// 获取分类名称
QmsFileCategory category = categoryService.getById(file.getCategoryId());
@ -563,9 +569,9 @@ public class QmsFileControllerService {
/**
* 校验文件权限
* @param needWrite 是否需要写权限
* @return 是否有写入权限
*/
private void checkFilePermission(Long fileId, Long userId, boolean needWrite) {
private boolean checkFilePermission(Long fileId, Long userId) {
QmsFile file = fileService.getById(fileId);
if (file == null) {
throw new NflgException(STATE.BusinessError, "文件不存在");
@ -573,7 +579,7 @@ public class QmsFileControllerService {
// 文件创建者有权限
if (Objects.equals(file.getCreateUserId(), userId)) {
return;
return true;
}
// 检查是否是文件组员
@ -585,9 +591,7 @@ public class QmsFileControllerService {
if (member != null) {
// 有权限只读(1) 读写(2)
if (!needWrite || member.getPermissionType() >= 2) {
return;
}
return member.getPermissionType() == 2;
}
// 检查是否是分类组员
@ -598,9 +602,7 @@ public class QmsFileControllerService {
.one();
if (categoryMember != null) {
if (!needWrite || categoryMember.getPermissionType() >= 2) {
return;
}
return categoryMember.getPermissionType() == 2;
}
throw new NflgException(STATE.BusinessError, "无权限操作此文件");
@ -647,8 +649,10 @@ public class QmsFileControllerService {
if (Boolean.FALSE.equals(result)) {
Long lockedUserId = redisTemplate.opsForValue().get(key);
if (lockedUserId != null) {
User lockedUser = userService.getById(lockedUserId);
VUtil.trueThrowBusinessError(true).throwMessage("文件已被用户【" + lockedUser.getUserName() + "】锁定");
if (!Objects.equals(lockedUserId, currentUserId)) {
User lockedUser = userService.getById(lockedUserId);
VUtil.trueThrowBusinessError(true).throwMessage("文件已被用户【" + lockedUser.getUserName() + "】锁定");
}
}
// key 在两次 Redis 操作间隙恰好过期仍属于锁定失败需兜底报错
VUtil.trueThrowBusinessError(true).throwMessage("文件已被锁定");

View File

@ -88,6 +88,11 @@ public class QmsFileVO {
*/
private List<QmsFileMemberVO> members;
/**
* 是否可以编辑
*/
private boolean canWrite;
/**
* 当前锁定用户名称
*/