Merge branch 'developer' of http://115.159.76.241/base_platform_enterprise/gic-store into developer

gic-store-api/src/main/java/com/gic/store/service/StoreOpenApiService.java

@@ -29,12 +29,13 @@ public interface StoreOpenApiService {
      * @Title: getStoreDetail

      * @Description:
     
* @author guojuxing
+     * @param appId
      * @param enterpriseId 商户ID
      * @param storeCode 门店代码
      * @param regionId
门店域ID
      * @return  com.gic.api.base.commons.ServiceResponse<java.lang.String>

     
*/
-    ServiceResponse<String> getStoreDetail(Integer enterpriseId, String storeCode, Integer regionId);
+    ServiceResponse<String> getStoreDetail(String appId, Integer enterpriseId, String storeCode, Integer regionId);
 
     /**
      * 门店新增接口
@@ -79,17 +80,18 @@ public interface StoreOpenApiService {
      * @Title: getClerkDetail

      * @Description:
     
* @author guojuxing
+     * @param appId
      * @param enterpriseId 商户ID
      * @param storeCode 门店code
      * @param clerkCode 导购code
      * @param regionId
门店域ID
      * @return  com.gic.api.base.commons.ServiceResponse<java.lang.String>

     
*/
-    ServiceResponse<String> getClerkDetail(Integer enterpriseId, String storeCode, String clerkCode, Integer regionId);
+    ServiceResponse<String> getClerkDetail(String appId, Integer enterpriseId, String storeCode, String clerkCode, Integer regionId);
 
-    ServiceResponse<Void> addClerk(Integer enterpriseId, ClerkDTO clerkInfo);
+    ServiceResponse<Void> addClerk(String appId, Integer enterpriseId, ClerkDTO clerkInfo);
 
-    ServiceResponse<Void> editClerk(Integer enterpriseId, ClerkDTO clerkInfo);
+    ServiceResponse<Void> editClerk(String appId, Integer enterpriseId, ClerkDTO clerkInfo);
 
     /**
      * 分页查询导购列表
@@ -104,5 +106,5 @@ public interface StoreOpenApiService {
      * @param pageSize
每页多少条
      * @return  com.gic.api.base.commons.ServiceResponse<java.lang.String>

     
*/
-    ServiceResponse<String> pageClerk(Long appId, Integer enterpriseId, String storeCode, Integer regionId, Integer pageNum, Integer pageSize);
+    ServiceResponse<String> pageClerk(String appId, Integer enterpriseId, String storeCode, Integer regionId, Integer pageNum, Integer pageSize);
 }

gic-store-service/src/main/java/com/gic/store/service/outer/impl/StoreOpenApiServiceImpl.java

@@ -36,10 +36,7 @@ import org.apache.logging.log4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 import java.util.stream.Collectors;
 
 @Service("storeOpenApiService")
@@ -70,6 +67,8 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
     private StoreDictApiService storeDictApiService;
     @Autowired
     private AuthorizeService authorizeService;
+    @Autowired
+    private StoreWidgetApiService storeWidgetApiService;
 
     @Override
     public ServiceResponse<String> getApiFieldJson(Integer enterpriseId, Integer regionId) {
@@ -96,8 +95,8 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
     }
 
     @Override
-    @GatewayParams(query = {"enterpriseId", "storeCode", "regionId"})
-    public ServiceResponse<String> getStoreDetail(Integer enterpriseId, String storeCode, Integer regionId) {
+    @GatewayParams(query = {"appId", "enterpriseId", "storeCode", "regionId"})
+    public ServiceResponse<String> getStoreDetail(String appId, Integer enterpriseId, String storeCode, Integer regionId) {
         //参数校验
         ServiceResponse<EnterpriseDTO> enterpriseResult = enterpriseApiService.getEnterpriseById(enterpriseId);
         if (!enterpriseResult.isSuccess()) {
@@ -109,6 +108,9 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         if (regionId == null) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "门店域不能为空");
         }
+        if (!hasAuth(appId, enterpriseId, storeCode, regionId)) {
+            return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "没有门店权限");
+        }
         StoreDTO store = storeService.getStoreByRegionIdAndStoreCode(enterpriseId, regionId, storeCode);
         if (store == null) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "门店code或者域数据错误，无此门店");
@@ -363,8 +365,8 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
     }
 
     @Override
-    @GatewayParams(query = {"enterpriseId", "storeCode", "clerkCode", "regionId"})
-    public ServiceResponse<String> getClerkDetail(Integer enterpriseId, String storeCode, String clerkCode, Integer regionId) {
+    @GatewayParams(query = {"appId", "enterpriseId", "storeCode", "clerkCode", "regionId"})
+    public ServiceResponse<String> getClerkDetail(String appId, Integer enterpriseId, String storeCode, String clerkCode, Integer regionId) {
         //参数校验
         ServiceResponse<EnterpriseDTO> enterpriseResult = enterpriseApiService.getEnterpriseById(enterpriseId);
         if (!enterpriseResult.isSuccess()) {
@@ -380,6 +382,9 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         if (store == null) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "门店code或者域数据错误，无此门店");
         }
+        if (!hasAuth(appId, enterpriseId, storeCode, regionId)) {
+            return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "没有门店权限");
+        }
         if (StringUtils.isBlank(clerkCode)) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "导购code不能为空");
         }
@@ -394,8 +399,8 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
     }
 
     @Override
-    @GatewayParams(query = {"enterpriseId"}, body = {"clerkInfo"})
-    public ServiceResponse<Void> addClerk(Integer enterpriseId, ClerkDTO clerkInfo) {
+    @GatewayParams(query = { "appId", "enterpriseId"}, body = {"clerkInfo"})
+    public ServiceResponse<Void> addClerk(String appId, Integer enterpriseId, ClerkDTO clerkInfo) {
         LOGGER.info("对外API新增导购参数:{}", JSON.toJSONString(clerkInfo));
         //参数校验
         ServiceResponse<EnterpriseDTO> enterpriseResult = enterpriseApiService.getEnterpriseById(enterpriseId);
@@ -414,6 +419,9 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         }
         Integer storeInfoId = store.getStoreInfoId();
 
+        if (!hasAuth(appId, enterpriseId, clerkInfo.getStoreCode(), clerkInfo.getRegionId())) {
+            return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "没有门店权限");
+        }
         if (StringUtils.isBlank(clerkInfo.getClerkCode())) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "导购code不能为空");
         }
@@ -442,8 +450,8 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
     }
 
     @Override
-    @GatewayParams(query = {"enterpriseId"}, body = {"clerkInfo"})
-    public ServiceResponse<Void> editClerk(Integer enterpriseId, ClerkDTO clerkInfo) {
+    @GatewayParams(query = { "appId", "enterpriseId"}, body = {"clerkInfo"})
+    public ServiceResponse<Void> editClerk(String appId, Integer enterpriseId, ClerkDTO clerkInfo) {
         //参数校验
         ServiceResponse<EnterpriseDTO> enterpriseResult = enterpriseApiService.getEnterpriseById(enterpriseId);
         if (!enterpriseResult.isSuccess()) {
@@ -461,6 +469,9 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         }
         Integer storeInfoId = store.getStoreInfoId();
 
+        if (!hasAuth(appId, enterpriseId, clerkInfo.getStoreCode(), clerkInfo.getRegionId())) {
+            return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "没有门店权限");
+        }
         if (StringUtils.isBlank(clerkInfo.getClerkCode())) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "导购code不能为空");
         }
@@ -496,16 +507,12 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
 
     @Override
     @GatewayParams(query = {"appId", "enterpriseId", "storeCode", "regionId", "pageNum", "pageSize"})
-    public ServiceResponse<String> pageClerk(Long appId, Integer enterpriseId, String storeCode, Integer regionId, Integer pageNum, Integer pageSize) {
+    public ServiceResponse<String> pageClerk(String appId, Integer enterpriseId, String storeCode, Integer regionId, Integer pageNum, Integer pageSize) {
         //参数校验
         ServiceResponse<EnterpriseDTO> enterpriseResult = enterpriseApiService.getEnterpriseById(enterpriseId);
         if (!enterpriseResult.isSuccess()) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "商户ID错误，无此商户");
         }
-        ServiceResponse<ApplicationResourceDTO> res = authorizeService.findResourceByEnterpriseIdAndApplicationId(Long.valueOf(enterpriseId), appId);
-        if (res.isSuccess()) {
-            return ServiceResponse.failure(res.getCode(), res.getMessage());
-        }
         if (pageNum == null) {
             pageNum = 1;
         }
@@ -515,6 +522,9 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         if (regionId == null) {
             return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "门店域不能为空");
         }
+        if (!hasAuth(appId, enterpriseId, storeCode, regionId)) {
+            return ServiceResponse.failure(ErrorCode.PARAMETER_ERROR.getCode(), "没有门店权限");
+        }
         StringBuilder storeIds = new StringBuilder();
         if (StringUtils.isBlank(storeCode)) {
             //查询域下所有的门店:q
@@ -551,4 +561,53 @@ public class StoreOpenApiServiceImpl implements StoreOpenApiService {
         }
         return ServiceResponse.failure(clerkResult.getCode(), clerkResult.getMessage());
     }
+
+    /**
+     * 验证权限门店相关权限
+     * @param appId
+     * @param enterpriseId
+     * @param storeCode 门店code
+     * @param regionId 门店域ID
+     * @return
+     */
+    private boolean hasAuth(String appId, Integer enterpriseId, String storeCode, Integer regionId) {
+        Map<String, Object> storeMap = new HashMap<>(16);
+        Map<String, Object> regionMap = new HashMap<>(16);
+        ServiceResponse<ApplicationResourceDTO> res = authorizeService
+                .findResourceByEnterpriseIdAndAppId(Long.valueOf(enterpriseId), appId);
+        if (res.isSuccess()) {
+            ApplicationResourceDTO resourceDTO = res.getResult();
+            if (resourceDTO != null) {
+                Long storeResourceId = resourceDTO.getStoreResource();
+                //查询门店资源组所有的门店权限
+                ServiceResponse<Page<StoreDTO>> storeResult = storeWidgetApiService
+                        .listStoreByStoreWidgetId(enterpriseId, storeResourceId.intValue(), 0, Integer.MAX_VALUE);
+                if (storeResult.isSuccess()) {
+                    Page<StoreDTO> page = storeResult.getResult();
+                    List<StoreDTO> list = page.getResult();
+                    if (CollectionUtils.isNotEmpty(list)) {
+                        for (StoreDTO storeDTO : list) {
+                            storeMap.put(storeDTO.getStoreCode(), 1);
+                            regionMap.put(storeDTO.getRegionId().toString(), 1);
+                        }
+                    }
+                } else {
+                    LOGGER.info("对外API权限校验结果-门店资源获取:{}", JSON.toJSONString(storeResult));
+                }
+            }
+        } else {
+            LOGGER.info("对外API权限校验结果:{}", JSON.toJSONString(res));
+        }
+        if (StringUtils.isNotBlank(storeCode)) {
+            if (storeMap.containsKey(storeCode)) {
+                return true;
+            }
+        }
+        if (regionId != null) {
+            if (regionMap.containsKey(storeCode)) {
+                return true;
+            }
+        }
+        return false;
+    }
 }