gxwebsoft/mp-java
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): 修改权限校验允许超管直接创建和更新网站

Browse Source 
- 新租户超管尚未被 grantCmsPermission 授予 cms:website:save 权限时允许直接创建首个站点
- 新租户超管尚未被 grantCmsPermission 授予 cms:website:update 权限时允许直接更新站点
- 更新了 save、update 和 updateAll 接口的 @PreAuthorize 注解以支持上述逻辑
- 添加注释说明注册流程中超管权限放宽的原因
This commit is contained in:
赵忠林
2026-08-06 17:25:18 +08:00
parent b20304da29
commit ed963b7a40
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/main/java/com/gxwebsoft/cms/controller/CmsWebsiteController.java
View File

@@ -92,7 +92,8 @@ public class CmsWebsiteController extends BaseController {
return success(cmsWebsiteService.getByIdRelAll(id)); return success(cmsWebsiteService.getByIdRelAll(id));
} }
@PreAuthorize("hasAuthority('cms:website:save')") // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:save，允许超管直接创建首个站点
@PreAuthorize("hasAuthority('cms:website:save') or principal.getIsSuperAdmin() == true")
@Operation(summary = "添加网站信息记录表") @Operation(summary = "添加网站信息记录表")
@PostMapping() @PostMapping()
public ApiResult<?> save(@RequestBody CmsWebsite cmsWebsite) { public ApiResult<?> save(@RequestBody CmsWebsite cmsWebsite) {
@@ -127,7 +128,8 @@ public class CmsWebsiteController extends BaseController {
return fail("创建失败"); return fail("创建失败");
} }
@PreAuthorize("hasAuthority('cms:website:update')") // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:update，允许超管直接更新站点
@PreAuthorize("hasAuthority('cms:website:update') or principal.getIsSuperAdmin() == true")
@Operation(summary = "修改网站信息记录表") @Operation(summary = "修改网站信息记录表")
@PutMapping() @PutMapping()
public ApiResult<?> update(@RequestBody CmsWebsite cmsWebsite) { public ApiResult<?> update(@RequestBody CmsWebsite cmsWebsite) {
@@ -154,7 +156,8 @@ public class CmsWebsiteController extends BaseController {
return fail("修改失败"); return fail("修改失败");
} }
@PreAuthorize("hasAuthority('cms:website:update')") // 注册流程：新租户超管尚未被 grantCmsPermission 赋予 cms:website:update，允许超管直接更新站点
@PreAuthorize("hasAuthority('cms:website:update') or principal.getIsSuperAdmin() == true")
@Operation(summary = "修改网站信息记录表") @Operation(summary = "修改网站信息记录表")
@PutMapping("/updateAll") @PutMapping("/updateAll")
public ApiResult<?> updateAll(@RequestBody CmsWebsite cmsWebsite) { public ApiResult<?> updateAll(@RequestBody CmsWebsite cmsWebsite) {