优化平台端租户端

go/controllers/backend_menu.go

@@ -77,6 +77,9 @@ func (c *BackendMenuController) GetMenu() {
 }
 
 func (c *BackendMenuController) GetBackendMenu() {
+	// 确保租户用户 group_id 列存在（老库兼容）
+	models.EnsureTenantUserGroupColumn()
+
 	var menus []models.SystemMenu
 	_, err := models.Orm.QueryTable(new(models.SystemMenu)).Filter("status", 1).All(&menus)
 	if err != nil {
@@ -84,10 +87,105 @@ func (c *BackendMenuController) GetBackendMenu() {
 		_ = c.ServeJSON()
 		return
 	}
-	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": buildMenuTree(filterMenusByView(menus, 2), 0)}
+	backendMenus := filterMenusByView(menus, 2)
+
+	// 按当前登录用户角色过滤可见功能菜单：
+	// 角色 rights 为空（或未分配角色）→ 全权限，返回全部后端菜单；
+	// 否则仅返回角色允许访问的菜单（含其祖先节点，保证树结构完整）。
+	idStr := c.Ctx.Input.Param(":id")
+	uid, _ := strconv.ParseUint(idStr, 10, 64)
+	if uid > 0 {
+		var tu models.SystemTenantUser
+		if e := models.Orm.QueryTable(new(models.SystemTenantUser)).
+			Filter("id", uid).
+			Filter("delete_time__isnull", true).
+			One(&tu); e == nil && tu.GroupID > 0 {
+			var role models.AdminRole
+			if re := models.Orm.QueryTable(new(models.AdminRole)).
+				Filter("id", tu.GroupID).
+				Filter("cid", 2).
+				One(&role); re == nil {
+				backendMenus = filterMenusByRights(backendMenus, role.Rights)
+			}
+		}
+	}
+
+	c.Data["json"] = map[string]interface{}{"code": 200, "msg": "success", "data": buildMenuTree(backendMenus, 0)}
 	_ = c.ServeJSON()
 }
 
+// parseRightsToSet 将角色 rights 解析为菜单 ID 集合（兼容 JSON 数组 / 逗号分隔）
+func parseRightsToSet(raw string) map[uint64]bool {
+	set := map[uint64]bool{}
+	var arr []string
+	if err := json.Unmarshal([]byte(raw), &arr); err == nil {
+		for _, s := range arr {
+			s = strings.TrimSpace(s)
+			if s == "" {
+				continue
+			}
+			if n, e := strconv.ParseUint(s, 10, 64); e == nil {
+				set[n] = true
+			}
+		}
+		return set
+	}
+	for _, s := range strings.Split(raw, ",") {
+		s = strings.TrimSpace(s)
+		if s == "" {
+			continue
+		}
+		if n, e := strconv.ParseUint(s, 10, 64); e == nil {
+			set[n] = true
+		}
+	}
+	return set
+}
+
+// filterMenusByRights 按角色 rights（菜单 ID 集合）过滤菜单，并补全祖先节点，保证树结构完整。
+// rights 为空（nil / 空串）→ 原样返回（全权限）。
+func filterMenusByRights(menus []models.SystemMenu, rights *string) []models.SystemMenu {
+	if rights == nil || strings.TrimSpace(*rights) == "" {
+		return menus
+	}
+	allowed := parseRightsToSet(*rights)
+	if len(allowed) == 0 {
+		return menus
+	}
+
+	pidOf := make(map[uint64]int64, len(menus))
+	byID := make(map[uint64]models.SystemMenu, len(menus))
+	for _, m := range menus {
+		pidOf[m.ID] = m.Pid
+		byID[m.ID] = m
+	}
+
+	final := make(map[uint64]bool, len(allowed))
+	for id := range allowed {
+		cur := id
+		for {
+			if _, ok := byID[cur]; !ok {
+				break
+			}
+			if final[cur] {
+				break
+			}
+			final[cur] = true
+			p := pidOf[cur]
+			if p == 0 {
+				break
+			}
+			cur = uint64(p)
+		}
+	}
+
+	out := make([]models.SystemMenu, 0, len(final))
+	for id := range final {
+		out = append(out, byID[id])
+	}
+	return out
+}
+
 func (c *BackendMenuController) GetTenantList() {
 	var tid uint64
 	if jwtTid := c.Ctx.Input.GetData("tid"); jwtTid != nil {