97 lines
3.4 KiB
PHP
97 lines
3.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use app\adminapi\logic\auth\AuthLogic;
|
|
use app\adminapi\logic\auth\MenuLogic;
|
|
use app\common\service\qywx\QywxPromotionOperatorAccess;
|
|
use think\facade\Db;
|
|
|
|
require dirname(__DIR__) . '/vendor/autoload.php';
|
|
|
|
$app = new think\App();
|
|
$app->initialize();
|
|
|
|
$pool = Db::name('qywx_promotion_pool')->whereNull('delete_time')->order('id', 'asc')->find();
|
|
$grantorId = (int) (Db::name('admin')->where('root', 1)->whereNull('delete_time')->value('id') ?? 0);
|
|
if (!$pool || $grantorId <= 0) {
|
|
throw new RuntimeException('缺少分流方案或 root 管理员，无法验证动态共享权限');
|
|
}
|
|
|
|
$candidate = null;
|
|
foreach (Db::name('admin')
|
|
->where('root', 0)
|
|
->where('disable', 0)
|
|
->whereNull('delete_time')
|
|
->order('id', 'asc')
|
|
->select()
|
|
->toArray() as $admin) {
|
|
$adminId = (int) ($admin['id'] ?? 0);
|
|
if ($adminId > 0
|
|
&& !QywxPromotionOperatorAccess::hasBasePagePermission($adminId, $admin)
|
|
&& !QywxPromotionOperatorAccess::hasSharedPagePermission($adminId)) {
|
|
$candidate = $admin;
|
|
break;
|
|
}
|
|
}
|
|
if ($candidate === null) {
|
|
throw new RuntimeException('未找到无基础页面权限且无现有共享的启用账号');
|
|
}
|
|
|
|
$candidateId = (int) $candidate['id'];
|
|
$poolId = (int) $pool['id'];
|
|
$now = time();
|
|
Db::startTrans();
|
|
try {
|
|
$relation = Db::name('qywx_promotion_pool_operator')
|
|
->where('pool_id', $poolId)
|
|
->where('admin_id', $candidateId)
|
|
->find();
|
|
if ($relation) {
|
|
Db::name('qywx_promotion_pool_operator')->where('id', (int) $relation['id'])->update([
|
|
'granted_by_admin_id' => $grantorId,
|
|
'delete_time' => null,
|
|
'update_time' => $now,
|
|
]);
|
|
} else {
|
|
Db::name('qywx_promotion_pool_operator')->insert([
|
|
'pool_id' => $poolId,
|
|
'admin_id' => $candidateId,
|
|
'granted_by_admin_id' => $grantorId,
|
|
'create_time' => $now,
|
|
'update_time' => $now,
|
|
'delete_time' => null,
|
|
]);
|
|
}
|
|
|
|
if (!QywxPromotionOperatorAccess::hasSharedPagePermission($candidateId)
|
|
|| !QywxPromotionOperatorAccess::hasPagePermission($candidateId, $candidate)) {
|
|
throw new RuntimeException('共享关系未生成动态页面权限');
|
|
}
|
|
if (QywxPromotionOperatorAccess::visibleAdminIds($candidateId, $candidate) !== []) {
|
|
throw new RuntimeException('纯共享账号错误继承了普通角色数据范围');
|
|
}
|
|
if (!in_array($poolId, QywxPromotionOperatorAccess::activePoolIds($candidateId), true)) {
|
|
throw new RuntimeException('共享方案未进入操作人专用数据范围');
|
|
}
|
|
if (!in_array(QywxPromotionOperatorAccess::PAGE_PERMISSION, AuthLogic::getAuthByAdminId($candidateId), true)) {
|
|
throw new RuntimeException('共享账号的接口权限列表缺少获客助手页面权限');
|
|
}
|
|
$menuJson = json_encode(MenuLogic::getMenuByAdminId($candidateId), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
|
if (!is_string($menuJson) || !str_contains($menuJson, QywxPromotionOperatorAccess::PAGE_PERMISSION)) {
|
|
throw new RuntimeException('共享账号的导航菜单缺少获客助手页面');
|
|
}
|
|
} finally {
|
|
Db::rollback();
|
|
}
|
|
|
|
if (QywxPromotionOperatorAccess::hasSharedPagePermission($candidateId)) {
|
|
throw new RuntimeException('测试事务回滚后仍残留共享权限');
|
|
}
|
|
|
|
echo sprintf(
|
|
"WECOM_PROMOTION_OPERATOR_DYNAMIC_ACCESS_OK admin=%d pool=%d\n",
|
|
$candidateId,
|
|
$poolId
|
|
);
|