fix: 平台超管可管理后台角色

server/internal/logic/admin/member.go

@@ -959,9 +959,6 @@ func (s *sAdminMember) ClusterSyncSuperAdmin(ctx context.Context, message *gredi
 // 非超管用户只能操作自己的下级角色用户，并且需要满足自身角色的数据权限设置
 func (s *sAdminMember) FilterAuthModel(ctx context.Context, memberId int64) *gdb.Model {
 	m := dao.AdminMember.Ctx(ctx)
-	if s.VerifySuperId(ctx, memberId) {
-		return m
-	}
 
 	var roleId int64
 	if contexts.GetUserId(ctx) == memberId {
@@ -976,6 +973,10 @@ func (s *sAdminMember) FilterAuthModel(ctx context.Context, memberId int64) *gdb
 		roleId = ro.Int64()
 	}
 
+	if isAdminScopeSuper(ctx, memberId, roleId) {
+		return m
+	}
+
 	roleIds, err := service.AdminRole().GetSubRoleIds(ctx, roleId, false)
 	if err != nil {
 		g.Log().Panicf(ctx, "get the subordinate role permission exception, err:%+v", err)

server/internal/logic/admin/role.go

@@ -37,6 +37,27 @@ func init() {
 	service.RegisterAdminRole(NewAdminRole())
 }
 
+func isAdminScopeSuper(ctx context.Context, memberId, roleId int64) bool {
+	if service.AdminMember().VerifySuperId(ctx, memberId) {
+		return true
+	}
+
+	if memberId == contexts.GetUserId(ctx) && contexts.GetRoleKey(ctx) == consts.ImPlatformRoleKey {
+		return true
+	}
+
+	if roleId <= 0 {
+		return false
+	}
+
+	value, err := dao.AdminRole.Ctx(ctx).Fields(dao.AdminRole.Columns().Key).WherePri(roleId).Value()
+	if err != nil {
+		g.Log().Warningf(ctx, "query admin role key failed, roleId:%d err:%+v", roleId, err)
+		return false
+	}
+	return value.String() == consts.ImPlatformRoleKey
+}
+
 // Verify 验证权限
 func (s *sAdminRole) Verify(ctx context.Context, path, method string) bool {
 	var (
@@ -49,7 +70,7 @@ func (s *sAdminRole) Verify(ctx context.Context, path, method string) bool {
 		return false
 	}
 
-	if service.AdminMember().VerifySuperId(ctx, user.Id) {
+	if isAdminScopeSuper(ctx, user.Id, user.RoleId) {
 		return true
 	}
 
@@ -70,7 +91,7 @@ func (s *sAdminRole) List(ctx context.Context, in *adminin.RoleListInp) (res *ad
 	)
 
 	// 非超管只获取下级角色
-	if !service.AdminMember().VerifySuperId(ctx, contexts.GetUserId(ctx)) {
+	if !isAdminScopeSuper(ctx, contexts.GetUserId(ctx), contexts.GetRoleId(ctx)) {
 		pid = contexts.GetRoleId(ctx)
 		mod = mod.WhereLike(dao.AdminRole.Columns().Tree, "%"+tree.GetIdLabel(pid)+"%")
 	}
@@ -326,7 +347,7 @@ func (s *sAdminRole) VerifyRoleId(ctx context.Context, id int64) (err error) {
 		return
 	}
 
-	ids, err := s.GetSubRoleIds(ctx, mb.RoleId, service.AdminMember().VerifySuperId(ctx, mb.Id))
+	ids, err := s.GetSubRoleIds(ctx, mb.RoleId, isAdminScopeSuper(ctx, mb.Id, mb.RoleId))
 	if err != nil {
 		err = gerror.New("验证角色信息失败！")
 		return