From b68c048383ae4bde3e1ce794d67c42f8d1fb0d2c Mon Sep 17 00:00:00 2001
From: richjohnrambo <richjohnrambo@gmail.com>
Date: Sun, 20 Sep 2026 21:48:10 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=B9=B3=E5=8F=B0=E8=B6=85=E7=AE=A1?=
 =?UTF-8?q?=E5=8F=AF=E7=AE=A1=E7=90=86=E5=90=8E=E5=8F=B0=E8=A7=92=E8=89=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/internal/logic/admin/member.go |  7 ++++---
 server/internal/logic/admin/role.go   | 27 ++++++++++++++++++++++++---
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/server/internal/logic/admin/member.go b/server/internal/logic/admin/member.go
index b4431b5..d10b442 100644
--- a/server/internal/logic/admin/member.go
+++ b/server/internal/logic/admin/member.go
@@ -959,9 +959,6 @@ func (s *sAdminMember) ClusterSyncSuperAdmin(ctx context.Context, message *gredi
 // 非超管用户只能操作自己的下级角色用户，并且需要满足自身角色的数据权限设置
 func (s *sAdminMember) FilterAuthModel(ctx context.Context, memberId int64) *gdb.Model {
 	m := dao.AdminMember.Ctx(ctx)
-	if s.VerifySuperId(ctx, memberId) {
-		return m
-	}
 
 	var roleId int64
 	if contexts.GetUserId(ctx) == memberId {
@@ -976,6 +973,10 @@ func (s *sAdminMember) FilterAuthModel(ctx context.Context, memberId int64) *gdb
 		roleId = ro.Int64()
 	}
 
+	if isAdminScopeSuper(ctx, memberId, roleId) {
+		return m
+	}
+
 	roleIds, err := service.AdminRole().GetSubRoleIds(ctx, roleId, false)
 	if err != nil {
 		g.Log().Panicf(ctx, "get the subordinate role permission exception, err:%+v", err)
diff --git a/server/internal/logic/admin/role.go b/server/internal/logic/admin/role.go
index 8dd1511..bdc25b6 100644
--- a/server/internal/logic/admin/role.go
+++ b/server/internal/logic/admin/role.go
@@ -37,6 +37,27 @@ func init() {
 	service.RegisterAdminRole(NewAdminRole())
 }
 
+func isAdminScopeSuper(ctx context.Context, memberId, roleId int64) bool {
+	if service.AdminMember().VerifySuperId(ctx, memberId) {
+		return true
+	}
+
+	if memberId == contexts.GetUserId(ctx) && contexts.GetRoleKey(ctx) == consts.ImPlatformRoleKey {
+		return true
+	}
+
+	if roleId <= 0 {
+		return false
+	}
+
+	value, err := dao.AdminRole.Ctx(ctx).Fields(dao.AdminRole.Columns().Key).WherePri(roleId).Value()
+	if err != nil {
+		g.Log().Warningf(ctx, "query admin role key failed, roleId:%d err:%+v", roleId, err)
+		return false
+	}
+	return value.String() == consts.ImPlatformRoleKey
+}
+
 // Verify 验证权限
 func (s *sAdminRole) Verify(ctx context.Context, path, method string) bool {
 	var (
@@ -49,7 +70,7 @@ func (s *sAdminRole) Verify(ctx context.Context, path, method string) bool {
 		return false
 	}
 
-	if service.AdminMember().VerifySuperId(ctx, user.Id) {
+	if isAdminScopeSuper(ctx, user.Id, user.RoleId) {
 		return true
 	}
 
@@ -70,7 +91,7 @@ func (s *sAdminRole) List(ctx context.Context, in *adminin.RoleListInp) (res *ad
 	)
 
 	// 非超管只获取下级角色
-	if !service.AdminMember().VerifySuperId(ctx, contexts.GetUserId(ctx)) {
+	if !isAdminScopeSuper(ctx, contexts.GetUserId(ctx), contexts.GetRoleId(ctx)) {
 		pid = contexts.GetRoleId(ctx)
 		mod = mod.WhereLike(dao.AdminRole.Columns().Tree, "%"+tree.GetIdLabel(pid)+"%")
 	}
@@ -326,7 +347,7 @@ func (s *sAdminRole) VerifyRoleId(ctx context.Context, id int64) (err error) {
 		return
 	}
 
-	ids, err := s.GetSubRoleIds(ctx, mb.RoleId, service.AdminMember().VerifySuperId(ctx, mb.Id))
+	ids, err := s.GetSubRoleIds(ctx, mb.RoleId, isAdminScopeSuper(ctx, mb.Id, mb.RoleId))
 	if err != nil {
 		err = gerror.New("验证角色信息失败！")
 		return