water/server/plugin/saiadmin/app/service/WaterAccess.php

<?php

declare(strict_types=1);

namespace plugin\saiadmin\app\service;

use plugin\saiadmin\app\model\water\{WaterAgent, WaterOperator, WaterOperatorRole};
use plugin\saiadmin\exception\ApiException;

/** Current database permissions, never stored on a reusable controller or in a user cache. */
final class WaterAccess
{
    public const MODULES = ['overview', 'alerts', 'dispatch', 'inventory', 'devices', 'enterprises', 'packages', 'agents', 'finance', 'content'];

    public function authorize(int $actor, string $module, string $action): void
    {
        if (!in_array($module, self::MODULES, true)) throw new ApiException('业务模块不存在');
        $user = WaterOperator::query()->where('id', $actor)->whereNull('delete_time')->first();
        if (!$user || (int) $user->status !== 1) throw new ApiException('账号已停用', 401);
        if ($actor === 1) return;
        if (WaterAgent::query()->where('user_id', $actor)->where('status', '<>', 1)->exists()) {
            throw new ApiException('代理已停用，无法访问供水业务', 403);
        }
        $allowed = WaterOperatorRole::query()->alias('ur')
            ->join('sa_system_role as r', 'r.id', '=', 'ur.role_id')->join('sa_system_role_menu as rm', 'rm.role_id', '=', 'r.id')
            ->join('sa_system_menu as m', 'm.id', '=', 'rm.menu_id')->where('ur.user_id', $actor)
            ->where('r.status', 1)->whereNull('r.delete_time')->where('m.status', 1)->whereNull('m.delete_time')
            ->where('m.slug', 'water:' . $module . ':' . $action)->exists();
        if (!$allowed) throw new ApiException('没有该供水业务的操作权限', 403);
    }

    public function allows(int $actor, string $module, string $action): bool
    {
        try { $this->authorize($actor, $module, $action); return true; }
        catch (ApiException) { return false; }
    }
}