package cn.iocoder.yudao.module.system.controller.admin.agent;
|
|
import cn.iocoder.yudao.framework.common.biz.system.permission.PermissionCommonApi;
|
import cn.iocoder.yudao.framework.common.pojo.CommonResult;
|
import cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils;
|
import cn.iocoder.yudao.module.system.framework.agent.AgentBridgeException;
|
import cn.iocoder.yudao.module.system.framework.agent.AgentDelegationToken;
|
import cn.iocoder.yudao.module.system.framework.agent.SystemAgentBridgeGuard;
|
import cn.iocoder.yudao.module.system.framework.agent.SystemAgentDelegationService;
|
import cn.iocoder.yudao.module.system.service.storage.SystemAgentImportBridgeService;
|
import jakarta.annotation.Resource;
|
import jakarta.validation.Valid;
|
import jakarta.validation.constraints.NotBlank;
|
import jakarta.validation.constraints.NotEmpty;
|
import jakarta.validation.constraints.Size;
|
import lombok.Data;
|
import org.springframework.http.HttpStatus;
|
import org.springframework.security.access.prepost.PreAuthorize;
|
import org.springframework.web.bind.annotation.*;
|
|
import java.util.Map;
|
import java.util.LinkedHashSet;
|
import java.util.Set;
|
|
import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
|
|
/** 浏览器以当前登录身份为异步 Worker 签发短期、可撤销、限定范围的委托票据。 */
|
@RestController
|
@RequestMapping("/agent/bridge/delegations")
|
public class SystemAgentDelegationController {
|
|
private static final String IMPORT_PERMISSIONS_EXPR =
|
"@ss.hasAnyPermissions('mdm:item:import','srm:supplier:create','mes:md-item:create',"
|
+ "'mes:qc-template:create','mes:pro-mps:create','mes:pro-route:create')";
|
private static final Set<String> ALLOWED_OPERATIONS = Set.of(
|
"material_import.prepare", "material_import.read", "material_import.review",
|
"material_import.preflight", "material_import.commit", "material_import.read_receipt",
|
"conversation.create", "conversation.read", "conversation.message", "conversation.action",
|
"conversation.report", "attachment.read", "import.modules.read", "import.preflight",
|
"import.commit", "import.receipt.read");
|
private static final Map<String, String> MODULE_PERMISSIONS = Map.of(
|
"mdm.item", SystemAgentBridgeGuard.PERMISSION_ITEM_IMPORT,
|
"srm.supplier", "srm:supplier:create",
|
"mes.bom", "mes:md-item:create",
|
"mes.qc-template", "mes:qc-template:create",
|
"mes.mps", "mes:pro-mps:create",
|
"mes.route", "mes:pro-route:create");
|
|
@Resource
|
private SystemAgentBridgeGuard bridgeGuard;
|
@Resource
|
private SystemAgentDelegationService delegationService;
|
@Resource
|
private SystemAgentImportBridgeService bridgeService;
|
@Resource
|
private PermissionCommonApi permissionApi;
|
|
@PostMapping
|
@PreAuthorize(IMPORT_PERMISSIONS_EXPR)
|
public CommonResult<AgentDelegationToken> issue(
|
@RequestHeader(value = "X-Agent-Service-Token", required = false) String serviceToken,
|
@Valid @RequestBody IssueRequest request) {
|
bridgeGuard.verifyServiceToken(serviceToken);
|
if (!ALLOWED_OPERATIONS.containsAll(request.getOperations())) {
|
throw new AgentBridgeException(HttpStatus.BAD_REQUEST, "DELEGATION_OPERATION_INVALID",
|
"委托包含不支持的操作");
|
}
|
Set<Long> attachmentIds = request.normalizedAttachmentIds();
|
for (Long attachmentId : attachmentIds) {
|
bridgeService.requireOwnedAttachmentRef(attachmentId);
|
}
|
String permission = resolvePermission(request.getModuleId());
|
AgentDelegationToken token = delegationService.issue(request.getTaskId(), request.getModuleId(),
|
attachmentIds, request.getOperations(), permission);
|
return success(token);
|
}
|
|
@DeleteMapping("/{delegationId}")
|
@PreAuthorize(IMPORT_PERMISSIONS_EXPR)
|
public CommonResult<Boolean> revoke(
|
@RequestHeader(value = "X-Agent-Service-Token", required = false) String serviceToken,
|
@PathVariable String delegationId) {
|
bridgeGuard.verifyServiceToken(serviceToken);
|
delegationService.revoke(delegationId, SecurityFrameworkUtils.getLoginUserId());
|
return success(true);
|
}
|
|
private String resolvePermission(String moduleId) {
|
if (moduleId != null && !moduleId.isBlank()) {
|
String permission = MODULE_PERMISSIONS.get(moduleId);
|
if (permission == null) {
|
throw new AgentBridgeException(HttpStatus.BAD_REQUEST, "MODULE_NOT_SUPPORTED", "不支持的导入模块");
|
}
|
return permission;
|
}
|
Long userId = SecurityFrameworkUtils.getLoginUserId();
|
return SystemAgentBridgeGuard.IMPORT_PERMISSIONS.stream()
|
.filter(permission -> permissionApi.hasAnyPermissions(userId, permission))
|
.findFirst()
|
.orElseThrow(() -> new AgentBridgeException(HttpStatus.FORBIDDEN, "FORBIDDEN",
|
"当前用户缺少数据导入权限"));
|
}
|
|
@Data
|
public static class IssueRequest {
|
@NotBlank
|
private String taskId;
|
private String moduleId;
|
private Long attachmentId;
|
@Size(max = 20)
|
private Set<Long> attachmentIds;
|
@NotEmpty
|
private Set<String> operations;
|
|
public Set<Long> normalizedAttachmentIds() {
|
Set<Long> values = new LinkedHashSet<>();
|
if (attachmentIds != null) {
|
values.addAll(attachmentIds);
|
}
|
if (attachmentId != null) {
|
values.add(attachmentId);
|
}
|
if (values.stream().anyMatch(id -> id == null || id <= 0) || values.size() > 20) {
|
throw new AgentBridgeException(HttpStatus.BAD_REQUEST, "DELEGATION_SCOPE_INVALID",
|
"委托附件范围无效");
|
}
|
return values;
|
}
|
}
|
}
|
