zlwu
0bddf38e52
Separate cross-team selection from attribution maintenance and apply the same scope to options, history filters and writes. Add an opt-in tenant permission without granting existing roles. Protect authorization mutation paths against self-grants, validate tenant targets and links, and include menu ancestors atomically. Cover role union, revocation, mobile writes and administration boundaries with regression tests.
12 lines
901 B
SQL
12 lines
901 B
SQL
-- Issue #13：在 project_top_menu 之后执行，可重复执行。
|
|
-- 独立功能权限，挂在“项目”一级节点下，授权时无需同时授予项目资料管理权限。
|
|
-- 不从归属维护或管理员角色继承授权，不写 sys_role_menu；由角色管理显式勾选。
|
|
INSERT INTO sys_menu (id, menu_name, parent_id, menu_type, path, component, perms,
|
|
is_frame, visible, status, tenant_no, order_num, create_dept_id, create_time, update_time, del_flag)
|
|
SELECT MD5(CONCAT(parent.tenant_no, ':project:project:all')), '全部项目', parent.id,
|
|
'F', '', '', 'project:project:all', 1, '0', '1', parent.tenant_no, 20, '', NOW(), NOW(), 0
|
|
FROM sys_menu parent
|
|
WHERE parent.perms='menu:project' AND parent.del_flag=0 AND parent.status='1'
|
|
AND NOT EXISTS (SELECT 1 FROM sys_menu existing
|
|
WHERE existing.tenant_no=parent.tenant_no AND existing.perms='project:project:all');
|