后端修改权限和折叠功能

server/dukang-api/src/modules/ops/admin-system-config.controller.ts

@@ -1,22 +1,41 @@
 import { Body, Controller, Get, Post, Put, UseGuards } from '@nestjs/common';
 import type { SystemConfigUpdateRequest } from '@dukang/shared-types';
+import {
+  SYSTEM_CONFIG_GROUP_PERMISSION,
+  SYSTEM_SETTINGS_PERMISSION_KEYS,
+  type HqPermissionKey,
+} from '@dukang/shared-types';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
 import { SuperAdminGuard } from '../../common/guards/super-admin.guard';
+import {
+  HqPermissionGuard,
+  HqPermissionsResolver,
+  RequireAnySystemSettings,
+} from '../../common/guards/hq-permission.guard';
+import { CurrentUser } from '../../common/decorators/current-user.decorator';
+import type { AuthUser } from '../../common/guards/jwt-auth.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { SystemConfigService } from '../../common/system-config/system-config.service';
 
 @Controller('admin/system-config')
-@UseGuards(HqAuthGuard, SuperAdminGuard)
+@UseGuards(HqAuthGuard, HqPermissionGuard)
 export class AdminSystemConfigController {
-  constructor(private readonly systemConfig: SystemConfigService) {}
+  constructor(
+    private readonly systemConfig: SystemConfigService,
+    private readonly permissions: HqPermissionsResolver,
+  ) {}
 
   @Get()
-  getForm() {
-    return this.systemConfig.getForm();
+  @RequireAnySystemSettings()
+  async getForm(@CurrentUser() user: AuthUser) {
+    const keys = await this.permissions.resolveEffectiveKeys(user.actorId);
+    const allowedGroups = allowedConfigGroups(keys);
+    return this.systemConfig.getForm(allowedGroups);
   }
 
   @Put()
+  @RequireAnySystemSettings()
   @HqOperation({
     action: HqOperationAction.SYSTEM_CONFIG_UPDATE,
     refType: 'SYSTEM_CONFIG',
@@ -24,11 +43,14 @@ export class AdminSystemConfigController {
     batch: true,
     includeBody: true,
   })
-  update(@Body() dto: SystemConfigUpdateRequest) {
-    return this.systemConfig.update(dto);
+  async update(@CurrentUser() user: AuthUser, @Body() dto: SystemConfigUpdateRequest) {
+    const keys = await this.permissions.resolveEffectiveKeys(user.actorId);
+    const allowedGroups = allowedConfigGroups(keys);
+    return this.systemConfig.update(dto, allowedGroups);
   }
 
   @Post('sync-env')
+  @UseGuards(SuperAdminGuard)
   @HqOperation({
     action: HqOperationAction.SYSTEM_CONFIG_SYNC_ENV,
     refType: 'SYSTEM_CONFIG',
@@ -39,6 +61,7 @@ export class AdminSystemConfigController {
   }
 
   @Post('import-env')
+  @UseGuards(SuperAdminGuard)
   @HqOperation({
     action: HqOperationAction.SYSTEM_CONFIG_IMPORT_ENV,
     refType: 'SYSTEM_CONFIG',
@@ -48,3 +71,12 @@ export class AdminSystemConfigController {
     return this.systemConfig.importFromProcessEnv();
   }
 }
+
+function allowedConfigGroups(permissionKeys: HqPermissionKey[]): string[] | null {
+  if (SYSTEM_SETTINGS_PERMISSION_KEYS.every((k) => permissionKeys.includes(k))) {
+    return null; // 全部
+  }
+  return Object.entries(SYSTEM_CONFIG_GROUP_PERMISSION)
+    .filter(([, perm]) => permissionKeys.includes(perm))
+    .map(([group]) => group);
+}