563 lines
22 KiB
C#
563 lines
22 KiB
C#
using Microsoft.AspNetCore.Identity;
|
||
using TakeoutSaaS.Application.Identity.Abstractions;
|
||
using TakeoutSaaS.Application.Identity.Contracts;
|
||
using TakeoutSaaS.Domain.Identity.Entities;
|
||
using TakeoutSaaS.Domain.Identity.Enums;
|
||
using TakeoutSaaS.Domain.Identity.Repositories;
|
||
using TakeoutSaaS.Shared.Abstractions.Constants;
|
||
using TakeoutSaaS.Shared.Abstractions.Exceptions;
|
||
using TakeoutSaaS.Shared.Abstractions.Results;
|
||
using TakeoutSaaS.Shared.Abstractions.Tenancy;
|
||
|
||
namespace TakeoutSaaS.Application.Identity.Services;
|
||
|
||
/// <summary>
|
||
/// 管理后台认证服务实现。
|
||
/// </summary>
|
||
public sealed class AdminAuthService(
|
||
IIdentityUserRepository userRepository,
|
||
IUserRoleRepository userRoleRepository,
|
||
IRoleRepository roleRepository,
|
||
IPermissionRepository permissionRepository,
|
||
IRolePermissionRepository rolePermissionRepository,
|
||
IMenuRepository menuRepository,
|
||
IPasswordHasher<IdentityUser> passwordHasher,
|
||
IJwtTokenService jwtTokenService,
|
||
IRefreshTokenStore refreshTokenStore,
|
||
ITenantProvider tenantProvider) : IAdminAuthService
|
||
{
|
||
/// <summary>
|
||
/// 管理后台登录：验证账号密码并生成令牌。
|
||
/// </summary>
|
||
/// <param name="request">登录请求</param>
|
||
/// <param name="cancellationToken">取消令牌</param>
|
||
/// <returns>令牌响应</returns>
|
||
/// <exception cref="BusinessException">账号或密码错误时抛出</exception>
|
||
public async Task<TokenResponse> LoginAsync(AdminLoginRequest request, CancellationToken cancellationToken = default)
|
||
{
|
||
// 1. 根据账号查找用户
|
||
var user = await userRepository.FindByAccountAsync(PortalType.Admin, null, request.Account, cancellationToken)
|
||
?? throw new BusinessException(ErrorCodes.Unauthorized, "账号或密码错误");
|
||
|
||
// 2. 校验账号状态
|
||
var now = DateTime.UtcNow;
|
||
if (user.Status == IdentityUserStatus.Disabled)
|
||
{
|
||
throw new BusinessException(ErrorCodes.Forbidden, "账号已被禁用，请联系管理员");
|
||
}
|
||
if (user.Status == IdentityUserStatus.Locked)
|
||
{
|
||
if (user.LockedUntil.HasValue && user.LockedUntil.Value <= now)
|
||
{
|
||
await ResetLockedUserAsync(user.Id, cancellationToken);
|
||
}
|
||
else
|
||
{
|
||
throw new BusinessException(ErrorCodes.Forbidden, "账号已被锁定，请稍后再试");
|
||
}
|
||
}
|
||
if (user.MustChangePassword)
|
||
{
|
||
throw new BusinessException(ErrorCodes.Forbidden, "账号需要重置密码，请通过重置链接设置新密码");
|
||
}
|
||
|
||
// 3. 验证密码（使用 ASP.NET Core Identity 的密码哈希器）
|
||
var result = passwordHasher.VerifyHashedPassword(user, user.PasswordHash, request.Password);
|
||
if (result == PasswordVerificationResult.Failed)
|
||
{
|
||
await IncreaseFailedLoginAsync(user.Id, now, cancellationToken);
|
||
throw new BusinessException(ErrorCodes.Unauthorized, "账号或密码错误");
|
||
}
|
||
|
||
// 4. 更新登录成功状态
|
||
await UpdateLoginSuccessAsync(user.Id, now, cancellationToken);
|
||
|
||
// 5. 构建用户档案并生成令牌
|
||
var profile = await BuildProfileAsync(user, cancellationToken);
|
||
return await jwtTokenService.CreateTokensAsync(profile, false, cancellationToken);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 简化登录：与标准登录一致（Admin Portal）。
|
||
/// </summary>
|
||
/// <param name="request">登录请求</param>
|
||
/// <param name="cancellationToken">取消令牌</param>
|
||
/// <returns>令牌响应</returns>
|
||
public async Task<TokenResponse> LoginSimpleAsync(AdminLoginRequest request, CancellationToken cancellationToken = default)
|
||
{
|
||
// 1. 参数校验
|
||
if (string.IsNullOrWhiteSpace(request.Account))
|
||
{
|
||
throw new BusinessException(ErrorCodes.BadRequest, "账号不能为空");
|
||
}
|
||
|
||
// 2. (空行后) 标准化账号
|
||
request.Account = request.Account.Trim();
|
||
|
||
// 3. (空行后) 走标准登录逻辑（Admin Portal）
|
||
return await LoginAsync(request, cancellationToken);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 刷新访问令牌：使用刷新令牌获取新的访问令牌和刷新令牌。
|
||
/// </summary>
|
||
/// <param name="request">刷新令牌请求</param>
|
||
/// <param name="cancellationToken">取消令牌</param>
|
||
/// <returns>新的令牌响应</returns>
|
||
/// <exception cref="BusinessException">刷新令牌无效、已过期或用户不存在时抛出</exception>
|
||
public async Task<TokenResponse> RefreshTokenAsync(RefreshTokenRequest request, CancellationToken cancellationToken = default)
|
||
{
|
||
// 1. 验证刷新令牌（检查是否存在、是否过期、是否已撤销）
|
||
var descriptor = await refreshTokenStore.GetAsync(request.RefreshToken, cancellationToken);
|
||
if (descriptor == null || descriptor.ExpiresAt <= DateTime.UtcNow || descriptor.Revoked)
|
||
{
|
||
throw new BusinessException(ErrorCodes.Unauthorized, "RefreshToken 无效或已过期");
|
||
}
|
||
|
||
// 2. 根据用户 ID 查找用户
|
||
var user = await userRepository.FindByIdAsync(descriptor.UserId, cancellationToken)
|
||
?? throw new BusinessException(ErrorCodes.Unauthorized, "用户不存在");
|
||
|
||
// 3. 撤销旧刷新令牌（防止重复使用）
|
||
await refreshTokenStore.RevokeAsync(descriptor.Token, cancellationToken);
|
||
|
||
// 4. 生成新的令牌对
|
||
var profile = await BuildProfileAsync(user, cancellationToken);
|
||
return await jwtTokenService.CreateTokensAsync(profile, false, cancellationToken);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 获取用户档案。
|
||
/// </summary>
|
||
/// <param name="userId">用户 ID</param>
|
||
/// <param name="cancellationToken">取消令牌</param>
|
||
/// <returns>用户档案</returns>
|
||
/// <exception cref="BusinessException">用户不存在时抛出</exception>
|
||
public async Task<CurrentUserProfile> GetProfileAsync(long userId, CancellationToken cancellationToken = default)
|
||
{
|
||
var user = await userRepository.FindByIdAsync(userId, cancellationToken)
|
||
?? throw new BusinessException(ErrorCodes.NotFound, "用户不存在");
|
||
// 1. 返回档案
|
||
return await BuildProfileAsync(user, cancellationToken);
|
||
}
|
||
|
||
/// <summary>
|
||
/// 获取当前用户可见菜单树。
|
||
/// </summary>
|
||
/// <param name="userId">用户 ID。</param>
|
||
/// <param name="cancellationToken">取消令牌。</param>
|
||
/// <returns>菜单树。</returns>
|
||
public async Task<IReadOnlyList<MenuNodeDto>> GetMenuTreeAsync(long userId, CancellationToken cancellationToken = default)
|
||
{
|
||
// 1. 读取档案以获取权限
|
||
var profile = await GetProfileAsync(userId, cancellationToken);
|
||
// 2. 读取菜单定义
|
||
var definitions = await menuRepository.GetByPortalAsync(profile.Portal, cancellationToken);
|
||
|
||
// 3. 生成菜单树
|
||
var menu = BuildMenuTree(definitions, profile.Permissions);
|
||
return menu;
|
||
}
|
||
|
||
/// <summary>
|
||
/// 获取指定用户的权限概览（校验当前租户）。
|
||
/// </summary>
|
||
public async Task<UserPermissionDto?> GetUserPermissionsAsync(long userId, CancellationToken cancellationToken = default)
|
||
{
|
||
var tenantId = tenantProvider.GetCurrentTenantId();
|
||
var user = await userRepository.FindByIdAsync(userId, cancellationToken);
|
||
if (user == null || user.TenantId != tenantId)
|
||
{
|
||
return null;
|
||
}
|
||
|
||
// 1. 解析角色集合
|
||
var roleCodes = await ResolveUserRolesAsync(user.Portal, user.TenantId, user.Id, cancellationToken);
|
||
// 2. (空行后) 解析权限集合
|
||
var permissionCodes = await ResolveUserPermissionsAsync(user.Portal, user.TenantId, user.Id, cancellationToken);
|
||
|
||
// 3. (空行后) 返回概览
|
||
return new UserPermissionDto
|
||
{
|
||
UserId = user.Id,
|
||
TenantId = user.TenantId,
|
||
MerchantId = user.MerchantId,
|
||
Account = user.Account,
|
||
DisplayName = user.DisplayName,
|
||
Roles = roleCodes,
|
||
Permissions = permissionCodes,
|
||
CreatedAt = user.CreatedAt
|
||
};
|
||
}
|
||
|
||
/// <summary>
|
||
/// 按租户分页查询用户权限概览。
|
||
/// </summary>
|
||
public async Task<PagedResult<UserPermissionDto>> SearchUserPermissionsAsync(
|
||
string? keyword,
|
||
int page,
|
||
int pageSize,
|
||
string? sortBy,
|
||
bool sortDescending,
|
||
CancellationToken cancellationToken = default)
|
||
{
|
||
// 1. 获取当前租户
|
||
var tenantId = tenantProvider.GetCurrentTenantId();
|
||
// 2. (空行后) 查询用户列表
|
||
var users = await userRepository.SearchAsync(tenantId, keyword, cancellationToken);
|
||
|
||
// 3. (空行后) 排序
|
||
var sorted = sortBy?.ToLowerInvariant() switch
|
||
{
|
||
"account" => sortDescending
|
||
? users.OrderByDescending(x => x.Account)
|
||
: users.OrderBy(x => x.Account),
|
||
"displayname" => sortDescending
|
||
? users.OrderByDescending(x => x.DisplayName)
|
||
: users.OrderBy(x => x.DisplayName),
|
||
_ => sortDescending
|
||
? users.OrderByDescending(x => x.CreatedAt)
|
||
: users.OrderBy(x => x.CreatedAt)
|
||
};
|
||
|
||
// 4. (空行后) 分页
|
||
var paged = sorted
|
||
.Skip((page - 1) * pageSize)
|
||
.Take(pageSize)
|
||
.ToList();
|
||
|
||
// 5. (空行后) 解析角色与权限
|
||
var resolved = await ResolveRolesAndPermissionsAsync(PortalType.Tenant, tenantId, paged, cancellationToken);
|
||
// 6. (空行后) 映射为 DTO
|
||
var items = paged.Select(user => new UserPermissionDto
|
||
{
|
||
UserId = user.Id,
|
||
TenantId = user.TenantId,
|
||
MerchantId = user.MerchantId,
|
||
Account = user.Account,
|
||
DisplayName = user.DisplayName,
|
||
Roles = resolved[user.Id].roles,
|
||
Permissions = resolved[user.Id].permissions,
|
||
CreatedAt = user.CreatedAt
|
||
}).ToList();
|
||
|
||
// 7. (空行后) 返回分页结果
|
||
return new PagedResult<UserPermissionDto>(items, page, pageSize, users.Count);
|
||
}
|
||
|
||
private async Task<CurrentUserProfile> BuildProfileAsync(IdentityUser user, CancellationToken cancellationToken)
|
||
{
|
||
// 1. 解析角色集合
|
||
var roles = await ResolveUserRolesAsync(user.Portal, user.TenantId, user.Id, cancellationToken);
|
||
// 2. (空行后) 解析权限集合
|
||
var permissions = await ResolveUserPermissionsAsync(user.Portal, user.TenantId, user.Id, cancellationToken);
|
||
|
||
// 3. (空行后) 组装档案
|
||
return new CurrentUserProfile
|
||
{
|
||
Portal = user.Portal,
|
||
UserId = user.Id,
|
||
Account = user.Account,
|
||
DisplayName = user.DisplayName,
|
||
TenantId = user.TenantId,
|
||
MerchantId = user.MerchantId,
|
||
Roles = roles,
|
||
Permissions = permissions,
|
||
Avatar = user.Avatar
|
||
};
|
||
}
|
||
|
||
private async Task ResetLockedUserAsync(long userId, CancellationToken cancellationToken)
|
||
{
|
||
// 1. 获取可更新实体
|
||
var tracked = await userRepository.GetForUpdateAsync(userId, cancellationToken);
|
||
if (tracked == null)
|
||
{
|
||
return;
|
||
}
|
||
|
||
// 2. 解除锁定并清空失败次数
|
||
tracked.Status = IdentityUserStatus.Active;
|
||
tracked.LockedUntil = null;
|
||
tracked.FailedLoginCount = 0;
|
||
|
||
// 3. 保存变更
|
||
await userRepository.SaveChangesAsync(cancellationToken);
|
||
}
|
||
|
||
private async Task IncreaseFailedLoginAsync(long userId, DateTime now, CancellationToken cancellationToken)
|
||
{
|
||
// 1. 获取可更新实体
|
||
var tracked = await userRepository.GetForUpdateAsync(userId, cancellationToken);
|
||
if (tracked == null)
|
||
{
|
||
return;
|
||
}
|
||
|
||
// 2. 累计失败次数并判断是否需要锁定
|
||
tracked.FailedLoginCount += 1;
|
||
if (tracked.FailedLoginCount >= 5)
|
||
{
|
||
tracked.Status = IdentityUserStatus.Locked;
|
||
tracked.LockedUntil = now.AddMinutes(15);
|
||
}
|
||
|
||
// 3. 保存变更
|
||
await userRepository.SaveChangesAsync(cancellationToken);
|
||
}
|
||
|
||
private async Task UpdateLoginSuccessAsync(long userId, DateTime now, CancellationToken cancellationToken)
|
||
{
|
||
// 1. 获取可更新实体
|
||
var tracked = await userRepository.GetForUpdateAsync(userId, cancellationToken);
|
||
if (tracked == null)
|
||
{
|
||
return;
|
||
}
|
||
|
||
// 2. 重置失败次数并刷新登录时间
|
||
tracked.FailedLoginCount = 0;
|
||
tracked.LockedUntil = null;
|
||
tracked.LastLoginAt = now;
|
||
if (tracked.Status == IdentityUserStatus.Locked)
|
||
{
|
||
tracked.Status = IdentityUserStatus.Active;
|
||
}
|
||
|
||
// 3. 保存变更
|
||
await userRepository.SaveChangesAsync(cancellationToken);
|
||
}
|
||
|
||
private static bool IsLikelyPhone(string value)
|
||
{
|
||
// 1. 空值快速返回
|
||
if (string.IsNullOrWhiteSpace(value))
|
||
{
|
||
return false;
|
||
}
|
||
|
||
// 2. 标准化前缀
|
||
var span = value.AsSpan();
|
||
if (span[0] == '+')
|
||
{
|
||
span = span[1..];
|
||
}
|
||
|
||
// 3. 长度校验
|
||
if (span.Length < 6 || span.Length > 32)
|
||
{
|
||
return false;
|
||
}
|
||
|
||
// 4. 逐字符校验
|
||
foreach (var ch in span)
|
||
{
|
||
if (!char.IsDigit(ch))
|
||
{
|
||
return false;
|
||
}
|
||
}
|
||
|
||
// 5. 返回校验结果
|
||
return true;
|
||
}
|
||
|
||
private static IReadOnlyList<MenuNodeDto> BuildMenuTree(
|
||
IReadOnlyList<Domain.Identity.Entities.MenuDefinition> definitions,
|
||
IReadOnlyList<string> permissions)
|
||
{
|
||
// 1. 权限集合
|
||
var permissionSet = new HashSet<string>(permissions, StringComparer.OrdinalIgnoreCase);
|
||
|
||
// 2. 父子分组
|
||
var parentLookup = definitions
|
||
.GroupBy(x => x.ParentId)
|
||
.ToDictionary(g => g.Key, g => g.OrderBy(d => d.SortOrder).ToList());
|
||
|
||
// 3. 递归构造并过滤
|
||
IReadOnlyList<MenuNodeDto> BuildChildren(long parentId)
|
||
{
|
||
if (!parentLookup.TryGetValue(parentId, out var children))
|
||
{
|
||
return [];
|
||
}
|
||
|
||
// 1. 收集可见节点
|
||
var result = new List<MenuNodeDto>();
|
||
foreach (var def in children)
|
||
{
|
||
// 1.1 构造节点
|
||
var node = MapMenuNode(def);
|
||
|
||
// 1.2 递归子节点
|
||
var sub = BuildChildren(def.Id);
|
||
|
||
// 1.3 可见性（严格使用 RequiredPermissions，不做兜底）
|
||
var requiredPermissions = node.RequiredPermissions;
|
||
// 1.4 (空行后) 判断可见性
|
||
var isVisible = requiredPermissions.Length == 0 || requiredPermissions.Any(permissionSet.Contains);
|
||
|
||
// 1.5 (空行后) 收集
|
||
if (isVisible || sub.Count > 0)
|
||
{
|
||
result.Add(node with { Children = sub });
|
||
}
|
||
}
|
||
|
||
// 2. 返回本层节点
|
||
return result;
|
||
}
|
||
|
||
// 4. 返回根节点
|
||
return BuildChildren(0);
|
||
}
|
||
|
||
private static MenuNodeDto MapMenuNode(Domain.Identity.Entities.MenuDefinition definition)
|
||
{
|
||
// 1. 解析权限
|
||
var requiredPermissions = SplitCodes(definition.RequiredPermissions);
|
||
var metaPermissions = SplitCodes(definition.MetaPermissions);
|
||
var metaRoles = SplitCodes(definition.MetaRoles);
|
||
|
||
// 2. 解析按钮权限
|
||
var authList = string.IsNullOrWhiteSpace(definition.AuthListJson)
|
||
? []
|
||
: System.Text.Json.JsonSerializer.Deserialize<List<MenuAuthItemDto>>(definition.AuthListJson) ?? [];
|
||
|
||
// 3. 构造节点
|
||
return new MenuNodeDto
|
||
{
|
||
Name = definition.Name,
|
||
Path = definition.Path,
|
||
Component = definition.Component,
|
||
Meta = new MenuMetaDto
|
||
{
|
||
Title = definition.Title,
|
||
Icon = definition.Icon,
|
||
KeepAlive = definition.KeepAlive,
|
||
IsIframe = definition.IsIframe,
|
||
Link = definition.Link,
|
||
Roles = metaRoles,
|
||
Permissions = metaPermissions,
|
||
AuthList = authList
|
||
},
|
||
Children = [],
|
||
RequiredPermissions = requiredPermissions
|
||
};
|
||
}
|
||
|
||
private static string[] SplitCodes(string? value)
|
||
{
|
||
if (string.IsNullOrWhiteSpace(value))
|
||
{
|
||
return Array.Empty<string>();
|
||
}
|
||
|
||
// 1. 拆分去重
|
||
return value
|
||
.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
|
||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||
.ToArray();
|
||
}
|
||
|
||
private async Task<string[]> ResolveUserRolesAsync(PortalType portal, long? tenantId, long userId, CancellationToken cancellationToken)
|
||
{
|
||
var relations = await userRoleRepository.GetByUserIdAsync(portal, tenantId, userId, cancellationToken);
|
||
var roleIds = relations.Select(x => x.RoleId).Distinct().ToArray();
|
||
if (roleIds.Length == 0)
|
||
{
|
||
return Array.Empty<string>();
|
||
}
|
||
|
||
// 2. (空行后) 查询角色定义并返回角色码
|
||
var roles = await roleRepository.GetByIdsAsync(portal, tenantId, roleIds, cancellationToken);
|
||
return roles.Select(x => x.Code).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
|
||
}
|
||
|
||
private async Task<string[]> ResolveUserPermissionsAsync(PortalType portal, long? tenantId, long userId, CancellationToken cancellationToken)
|
||
{
|
||
var relations = await userRoleRepository.GetByUserIdAsync(portal, tenantId, userId, cancellationToken);
|
||
var roleIds = relations.Select(x => x.RoleId).Distinct().ToArray();
|
||
if (roleIds.Length == 0)
|
||
{
|
||
return Array.Empty<string>();
|
||
}
|
||
|
||
// 2. (空行后) 查询角色权限关联
|
||
var rolePermissions = await rolePermissionRepository.GetByRoleIdsAsync(portal, tenantId, roleIds, cancellationToken);
|
||
var permissionIds = rolePermissions.Select(x => x.PermissionId).Distinct().ToArray();
|
||
if (permissionIds.Length == 0)
|
||
{
|
||
return Array.Empty<string>();
|
||
}
|
||
|
||
// 3. (空行后) 查询权限定义并返回权限码
|
||
var permissions = await permissionRepository.GetByIdsAsync(permissionIds, cancellationToken);
|
||
return permissions.Select(x => x.Code).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
|
||
}
|
||
|
||
private async Task<Dictionary<long, (string[] roles, string[] permissions)>> ResolveRolesAndPermissionsAsync(
|
||
PortalType portal,
|
||
long? tenantId,
|
||
IReadOnlyCollection<IdentityUser> users,
|
||
CancellationToken cancellationToken)
|
||
{
|
||
// 1. 读取用户-角色关系
|
||
var userIds = users.Select(x => x.Id).ToArray();
|
||
var userRoleRelations = await userRoleRepository.GetByUserIdsAsync(portal, tenantId, userIds, cancellationToken);
|
||
var roleIds = userRoleRelations.Select(x => x.RoleId).Distinct().ToArray();
|
||
|
||
// 2. (空行后) 读取角色定义
|
||
var roles = roleIds.Length == 0
|
||
? Array.Empty<Role>()
|
||
: await roleRepository.GetByIdsAsync(portal, tenantId, roleIds, cancellationToken);
|
||
var roleCodeMap = roles.ToDictionary(r => r.Id, r => r.Code, comparer: EqualityComparer<long>.Default);
|
||
|
||
// 3. (空行后) 读取角色-权限关系
|
||
var rolePermissions = roleIds.Length == 0
|
||
? Array.Empty<RolePermission>()
|
||
: await rolePermissionRepository.GetByRoleIdsAsync(portal, tenantId, roleIds, cancellationToken);
|
||
|
||
// 4. (空行后) 读取权限定义
|
||
var permissionIds = rolePermissions.Select(x => x.PermissionId).Distinct().ToArray();
|
||
var permissions = permissionIds.Length == 0
|
||
? Array.Empty<Permission>()
|
||
: await permissionRepository.GetByIdsAsync(permissionIds, cancellationToken);
|
||
var permissionCodeMap = permissions.ToDictionary(p => p.Id, p => p.Code, comparer: EqualityComparer<long>.Default);
|
||
|
||
// 5. (空行后) 构建 Role -> PermissionId[] 映射
|
||
var rolePermissionsLookup = rolePermissions
|
||
.GroupBy(rp => rp.RoleId)
|
||
.ToDictionary(g => g.Key, g => g.Select(rp => rp.PermissionId).ToArray(), comparer: EqualityComparer<long>.Default);
|
||
|
||
// 6. (空行后) 按用户聚合角色码与权限码
|
||
var result = new Dictionary<long, (string[] roles, string[] permissions)>();
|
||
foreach (var userId in userIds)
|
||
{
|
||
// 6.1 解析用户角色码
|
||
var rolesForUser = userRoleRelations.Where(ur => ur.UserId == userId).Select(ur => ur.RoleId).Distinct().ToArray();
|
||
var roleCodes = rolesForUser
|
||
.Select(rid => roleCodeMap.GetValueOrDefault(rid))
|
||
.Where(c => !string.IsNullOrWhiteSpace(c))
|
||
.Select(c => c!)
|
||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||
.ToArray();
|
||
|
||
// 6.2 (空行后) 解析用户权限码
|
||
var permissionCodes = rolesForUser
|
||
.SelectMany(rid => rolePermissionsLookup.GetValueOrDefault(rid) ?? Array.Empty<long>())
|
||
.Select(pid => permissionCodeMap.GetValueOrDefault(pid))
|
||
.Where(code => !string.IsNullOrWhiteSpace(code))
|
||
.Select(code => code!)
|
||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||
.ToArray();
|
||
|
||
// 6.3 (空行后) 写入结果
|
||
result[userId] = (roleCodes, permissionCodes);
|
||
}
|
||
|
||
// 7. (空行后) 返回聚合结果
|
||
return result;
|
||
}
|
||
}
|