Bläddra i källkod

fix(auth): UATAdminA 补绑 UAT_FUNCTION_USER 修复登录后菜单为空

UATAdminA 为 AccountType=777 普通账号,菜单只能来自 SysRoleMenu 角色授权。
其原绑的 SMART_OPS_DEPT_HEAD / SMART_OPS_MODULE_OWNER / SMART_OPS_OPS_OWNER
三个角色均为 0 条菜单授权,导致菜单接口返回空数组,前端 backEnd.ts 判定
isNoPower=true,弹出「抱歉,您没有登录权限」并清除刚下发的 token。

同租户 UATTEST_CHL 其余 5 个账号均绑定 UAT_FUNCTION_USER(308 菜单,
DataScope=1),本脚本使 UATAdminA 与既有范式对齐,不改 AccountType、
不动权限模型。脚本幂等,账号或角色不存在的库上为空操作。

chore: bump version server 1.0.384
YY968XX 13 timmar sedan
förälder
incheckning
385c07d4b9

+ 9 - 3
server/Admin.NET.Web.Entry/Admin.NET.Web.Entry.csproj

@@ -11,9 +11,9 @@
     <GenerateSatelliteAssembliesForCore>true</GenerateSatelliteAssembliesForCore>
     <Copyright>Admin.NET</Copyright>
     <Description>Admin.NET 通用权限开发平台</Description>
-    <AssemblyVersion>1.0.383</AssemblyVersion>
-    <FileVersion>1.0.383</FileVersion>
-    <Version>1.0.383</Version>
+    <AssemblyVersion>1.0.384</AssemblyVersion>
+    <FileVersion>1.0.384</FileVersion>
+    <Version>1.0.384</Version>
   </PropertyGroup>
 
   <ItemGroup>
@@ -484,6 +484,12 @@
     <None Update="UpdateScripts\1.0.382.sql">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>
+    <None Update="UpdateScripts\1.0.384.sql">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
+    <None Update="UpdateScripts\1.0.384.verify.sql">
+      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+    </None>
     <None Update="UpdateScripts\1.0.364.verify.sql">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>

+ 44 - 0
server/Admin.NET.Web.Entry/UpdateScripts/1.0.384.sql

@@ -0,0 +1,44 @@
+-- 1.0.384: UATAdminA 补绑 UAT_FUNCTION_USER 角色,修复登录后「抱歉,您没有登录权限」。
+--
+-- 背景:
+--   UATAdminA 为 AccountType=777 普通账号,SysMenuService.GetLoginMenuList 中
+--   !(SuperAdmin || SysAdmin) 分支成立,菜单只能来自 SysRoleMenu 的角色授权。
+--   该账号原绑的 SMART_OPS_DEPT_HEAD / SMART_OPS_MODULE_OWNER / SMART_OPS_OPS_OWNER
+--   三个角色在 SysRoleMenu 中均为 0 条菜单授权(纯业务身份标签角色),
+--   导致菜单接口返回空数组,前端 router/backEnd.ts 判定 isNoPower=true,
+--   弹出「抱歉,您没有登录权限」并 clearTokens() 退回登录页。
+--
+--   同租户(UATTEST_CHL / 838257186181189)其余 5 个账号
+--   UATPlanA / UATPurchaseA / UATWarehouseA / UATQualityA / UATExceptionA
+--   均绑定了 UAT_FUNCTION_USER(308 个菜单,DataScope=1 全部数据)而工作正常。
+--   本脚本使 UATAdminA 与同租户既有范式对齐,不改 AccountType、不改权限模型。
+--
+-- 幂等:已绑定则不重复插入;账号或角色不存在的库上为空操作。
+
+DROP TEMPORARY TABLE IF EXISTS tmp_uat_admin_a_ur;
+CREATE TEMPORARY TABLE tmp_uat_admin_a_ur (
+  seq INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  user_id BIGINT NOT NULL,
+  role_id BIGINT NOT NULL
+);
+
+INSERT INTO tmp_uat_admin_a_ur (user_id, role_id)
+SELECT u.Id, r.Id
+FROM SysUser u
+JOIN SysRole r
+  ON r.TenantId = u.TenantId
+ AND r.Code = 'UAT_FUNCTION_USER'
+ AND r.Status = 1
+WHERE u.Account = 'UATAdminA'
+  AND u.Status = 1
+  AND NOT EXISTS (
+    SELECT 1 FROM SysUserRole x WHERE x.UserId = u.Id AND x.RoleId = r.Id
+  );
+
+SET @uat_admin_a_ur_base := (SELECT IFNULL(MAX(Id), 0) FROM SysUserRole);
+
+INSERT INTO SysUserRole (Id, UserId, RoleId)
+SELECT @uat_admin_a_ur_base + s.seq, s.user_id, s.role_id
+FROM tmp_uat_admin_a_ur s;
+
+DROP TEMPORARY TABLE IF EXISTS tmp_uat_admin_a_ur;

+ 33 - 0
server/Admin.NET.Web.Entry/UpdateScripts/1.0.384.verify.sql

@@ -0,0 +1,33 @@
+-- 1.0.384 verify: UATAdminA 应绑定 UAT_FUNCTION_USER 并能解析出菜单。
+
+-- 1) 目标账号角色与可解析菜单数
+--    期望:roles = 4(原 3 个 SMART_OPS_* + 新增 UAT_FUNCTION_USER),role_menus > 0
+SELECT u.Account,
+       u.AccountType,
+       u.TenantId,
+       COUNT(DISTINCT ur.RoleId) AS roles,
+       COUNT(DISTINCT rm.MenuId) AS role_menus
+FROM SysUser u
+LEFT JOIN SysUserRole ur ON ur.UserId = u.Id
+LEFT JOIN SysRoleMenu rm ON rm.RoleId = ur.RoleId
+WHERE u.Account = 'UATAdminA'
+GROUP BY u.Id, u.Account, u.AccountType, u.TenantId;
+
+-- 2) 与同租户对照账号横向比对
+--    期望:UATAdminA 的 role_menus 与其余 5 个账号一致(308)
+SELECT u.Account,
+       COUNT(DISTINCT rm.MenuId) AS role_menus
+FROM SysUser u
+LEFT JOIN SysUserRole ur ON ur.UserId = u.Id
+LEFT JOIN SysRoleMenu rm ON rm.RoleId = ur.RoleId
+WHERE u.TenantId = (SELECT TenantId FROM SysUser WHERE Account = 'UATAdminA')
+GROUP BY u.Id, u.Account
+ORDER BY u.Account;
+
+-- 3) 幂等性:重复执行不应产生重复绑定
+--    期望:0 行
+SELECT UserId, RoleId, COUNT(*) AS dup
+FROM SysUserRole
+WHERE UserId = (SELECT Id FROM SysUser WHERE Account = 'UATAdminA')
+GROUP BY UserId, RoleId
+HAVING COUNT(*) > 1;