From ed963b7a40fb2f8d1b0d8791df6356e49e998050 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=B5=B5=E5=BF=A0=E6=9E=97?= <170083662@qq.com> Date: Thu, 6 Aug 2026 17:25:18 +0800 Subject: [PATCH] =?UTF-8?q?fix(auth):=20=E4=BF=AE=E6=94=B9=E6=9D=83?= =?UTF-8?q?=E9=99=90=E6=A0=A1=E9=AA=8C=E5=85=81=E8=AE=B8=E8=B6=85=E7=AE=A1?= =?UTF-8?q?=E7=9B=B4=E6=8E=A5=E5=88=9B=E5=BB=BA=E5=92=8C=E6=9B=B4=E6=96=B0?= =?UTF-8?q?=E7=BD=91=E7=AB=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 新租户超管尚未被 grantCmsPermission 授予 cms:website:save 权限时允许直接创建首个站点 - 新租户超管尚未被 grantCmsPermission 授予 cms:website:update 权限时允许直接更新站点 - 更新了 save、update 和 updateAll 接口的 @PreAuthorize 注解以支持上述逻辑 - 添加注释说明注册流程中超管权限放宽的原因 --- .../gxwebsoft/cms/controller/CmsWebsiteController.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java index 9aefeab..b2dd43e 100644 --- a/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java +++ b/src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java @@ -92,7 +92,8 @@ public class CmsWebsiteController extends BaseController { return success(cmsWebsiteService.getByIdRelAll(id)); } - @PreAuthorize("hasAuthority('cms:website:save')") + // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:save，允许超管直接创建首个站点 + @PreAuthorize("hasAuthority('cms:website:save') or principal.getIsSuperAdmin() == true") @Operation(summary = "添加网站信息记录表") @PostMapping() public ApiResult save(@RequestBody CmsWebsite cmsWebsite) { @@ -127,7 +128,8 @@ public class CmsWebsiteController extends BaseController { return fail("创建失败"); } - @PreAuthorize("hasAuthority('cms:website:update')") + // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:update，允许超管直接更新站点 + @PreAuthorize("hasAuthority('cms:website:update') or principal.getIsSuperAdmin() == true") @Operation(summary = "修改网站信息记录表") @PutMapping() public ApiResult update(@RequestBody CmsWebsite cmsWebsite) { @@ -154,7 +156,8 @@ public class CmsWebsiteController extends BaseController { return fail("修改失败"); } - @PreAuthorize("hasAuthority('cms:website:update')") + // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:update，允许超管直接更新站点 + @PreAuthorize("hasAuthority('cms:website:update') or principal.getIsSuperAdmin() == true") @Operation(summary = "修改网站信息记录表") @PutMapping("/updateAll") public ApiResult updateAll(@RequestBody CmsWebsite cmsWebsite) {