water/server/plugin/saiadmin/app/service/agent/AgentAccessPolicy.php

<?php
declare(strict_types=1);
namespace plugin\saiadmin\app\service\agent;

use plugin\saiadmin\app\model\water\WaterOperatorRole;
final class AgentAccessPolicy
{
    public function grantedUserIds(): array {
        return WaterOperatorRole::query()->alias('ur')
            ->join('sa_system_role as r','r.id','=','ur.role_id')
            ->join('sa_system_role_menu as rm','rm.role_id','=','r.id')
            ->join('sa_system_menu as m','m.id','=','rm.menu_id')
            ->where('r.status',1)->whereNull('r.delete_time')->where('m.status',1)->whereNull('m.delete_time')
            ->where('m.slug','like','water:%')->distinct()->pluck('ur.user_id')->map(fn($id)=>(int)$id)->all();
    }
    public function state(array $row,array $grantedIds): string {
        if ((int)$row['status']!==1 || ($row['user_id'] && ($row['operator_status']===null || (int)$row['operator_status']!==1))) return 'disabled';
        return $row['user_id'] && in_array((int)$row['user_id'],$grantedIds,true) ? 'authorized' : 'pending';
    }
}