批量优化

go/controllers/backend_menu.go

@@ -2,11 +2,13 @@ package controllers
 
 import (
 	"encoding/json"
+	"strconv"
+	"strings"
+
 	"server/models"
 	"server/pkg/jwtutil"
 	"server/services"
-	"strconv"
-	"strings"
+	authsvc "server/services/auth"
 
 	beego "github.com/beego/beego/v2/server/web"
 )
@@ -98,22 +100,31 @@ func (c *BackendMenuController) GetBackendMenu() {
 	idStr := c.Ctx.Input.Param(":id")
 	uid, _ := strconv.ParseUint(idStr, 10, 64)
 	tid := uint64(0)
+	groupID := uint64(0)
 	if uid > 0 {
-		var tu models.SystemTenantUser
-		if e := models.Orm.QueryTable(new(models.SystemTenantUser)).
-			Filter("id", uid).
-			Filter("delete_time__isnull", true).
-			One(&tu); e == nil {
+		// URL 参数是认证中心 identity_id，不能直接当 yz_system_tenant_user 主键查：
+		// 主键恰好与 identity_id 相同时会套用**别人**的角色权限——
+		// 如 identity_id=1（李增炎）命中主键 1（李志强 tid=1、group_id=0），
+		// 反而免过滤拿到全量菜单（越权）；identity_id=2 则命中李增炎的受限角色，
+		// 菜单被错误过滤（基础设置 404）。
+		// 解析顺序：认证绑定表（identity_id+tid → group_id，与 /auth/userinfo 同源）
+		// → 业务表身份解析链（identity_id 换算 → 主键 → 老 uid）。
+		jwtTid := backendJWTTenantID(c.Ctx.Request.Header.Get("Authorization"))
+		if bind, e := authsvc.GetTenantUser(uid, jwtTid); e == nil {
+			tid = bind.Tid
+			groupID = bind.GroupID
+		} else if tu, e := findBackendTenantUser(uid, jwtTid, false); e == nil {
 			tid = tu.Tid
-			if tu.GroupID > 0 {
-				var role models.AdminRole
-				if re := models.Orm.QueryTable(new(models.AdminRole)).
-					Filter("id", tu.GroupID).
-					Filter("cid", 2).
-					One(&role); re == nil {
-					backendMenus = filterMenusByRights(backendMenus, role.Rights)
-				}
-			}
+			groupID = tu.GroupID
+		}
+	}
+	if groupID > 0 {
+		var role models.AdminRole
+		if re := models.Orm.QueryTable(new(models.AdminRole)).
+			Filter("id", groupID).
+			Filter("cid", 2).
+			One(&role); re == nil {
+			backendMenus = filterMenusByRights(backendMenus, role.Rights)
 		}
 	}