feat: support configuring users as system admin on zjrc

packages/base/src/locale/en-US/dmsUserCenter.ts

@@ -28,7 +28,10 @@ export default {
       opPermissions: 'Platform management permissions',
       isDisabled: 'Disabled',
       disabledTips:
-        'When the user is disabled, the user will not be able to log in'
+        'When the user is disabled, the user will not be able to log in',
+      globalManagementLockedTips:
+        'Only the built-in admin can grant or revoke the System Administrator permission',
+      manageTargetForbidden: 'You are not allowed to manage this user'
     },
     createUser: {
       createSuccessTips: 'Add user "{{name}}" successfully'

packages/base/src/locale/zh-CN/dmsUserCenter.ts

@@ -25,7 +25,9 @@ export default {
       userGroups: '所属用户组',
       opPermissions: '平台管理权限',
       isDisabled: '是否禁用',
-      disabledTips: '当用户被禁用，该用户将无法登录'
+      disabledTips: '当用户被禁用，该用户将无法登录',
+      globalManagementLockedTips: '仅内置管理员可授予或收回「系统管理员」权限',
+      manageTargetForbidden: '无权管理该用户'
     },
     createUser: {
       createSuccessTips: '添加用户 "{{name}}" 成功'

packages/base/src/page/Nav/SideMenu/UserMenu/Modal/VersionModal/test/__snapshots__/BasicVersionModal.test.tsx.snap

@@ -110,7 +110,7 @@ exports[`base/Nav/SideMenu/UserMenu/BasicVersionModal render snap when open is t
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div
@@ -345,7 +345,7 @@ exports[`base/Nav/SideMenu/UserMenu/BasicVersionModal render snap when open is t
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div

packages/base/src/page/Nav/SideMenu/UserMenu/Modal/VersionModal/test/__snapshots__/index.ce.test.tsx.snap

@@ -110,7 +110,7 @@ exports[`base/Nav/SideMenu/UserMenu/VersionModal-ce render snap when open is tru
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div
@@ -1312,7 +1312,7 @@ exports[`base/Nav/SideMenu/UserMenu/VersionModal-ce render snap when open is tru
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div

packages/base/src/page/Nav/SideMenu/UserMenu/Modal/VersionModal/test/__snapshots__/index.test.tsx.snap

@@ -110,7 +110,7 @@ exports[`base/Nav/SideMenu/UserMenu/VersionModal-ee render snap when open is tru
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div
@@ -352,7 +352,7 @@ exports[`base/Nav/SideMenu/UserMenu/VersionModal-ee render snap when open is tru
                             class="ant-typography css-dev-only-do-not-override-txh9fw"
                           >
                             UI: 
-                            dev-zjrc-sql-audit-report-summary   f4fab7b02
+                            dev-zjrc-user-system-admin   f4fab7b02
                           </article>
                         </div>
                         <div

packages/base/src/page/UserCenter/Modal/User/AddUser/index.test.tsx

@@ -8,6 +8,7 @@ import { ModalName } from '../../../../../data/ModalName';
 import { selectOptionByIndex } from '@actiontech/shared/lib/testUtil/customQuery';
 import EmitterKey from '../../../../../data/EmitterKey';
 import { queryBySelector } from '@actiontech/shared/lib/testUtil/customQuery';
+import { mockUseCurrentUser } from '@actiontech/shared/lib/testUtil/mockHook/mockUseCurrentUser';
 
 jest.mock('react-redux', () => {
   return {
@@ -23,6 +24,7 @@ describe('base/UserCenter/Modal/AddUser', () => {
   let addUserSpy: jest.SpyInstance;
   beforeEach(() => {
     jest.useFakeTimers();
+    mockUseCurrentUser({ username: 'admin', uid: '700200' });
     addUserSpy = userCenter.addUser();
 
     opPermissionListSpy = userCenter.getOpPermissionsList();

packages/base/src/page/UserCenter/Modal/User/AddUser/index.tsx

@@ -1,18 +1,20 @@
-import { useCallback } from 'react';
+import { useCallback, useMemo } from 'react';
 import { useBoolean } from 'ahooks';
 import { Form, message, Space } from 'antd';
 import { useTranslation } from 'react-i18next';
 import { useDispatch, useSelector } from 'react-redux';
 import { ModalName } from '../../../../../data/ModalName';
 import { IReduxState } from '../../../../../store';
 import { updateUserManageModalStatus } from '../../../../../store/userCenter';
-import { ResponseCode } from '@actiontech/shared/lib/enum';
+import { OpPermissionTypeUid, ResponseCode } from '@actiontech/shared/lib/enum';
 import EmitterKey from '../../../../../data/EmitterKey';
 import UserForm from '../UserForm';
 import { IUserFormFields } from '../UserForm/index.type';
 import EventEmitter from '../../../../../utils/EventEmitter';
 import { BasicDrawer, BasicButton } from '@actiontech/shared';
 import User from '@actiontech/shared/lib/api/base/service/User';
+import { useCurrentUser } from '@actiontech/shared/lib/global';
+import { canEditGlobalManagement } from '../../../utils/systemAdminBoundary';
 
 const AddUser = () => {
   const [form] = Form.useForm<IUserFormFields>();
@@ -27,6 +29,12 @@
     (state) => !!state.userCenter.modalStatus[ModalName.DMS_Add_User]
   );
 
+  const { username, uid } = useCurrentUser();
+  const allowEditGlobalManagement = useMemo(
+    () => canEditGlobalManagement({ name: username, uid }),
+    [username, uid]
+  );
+
   const [messageApi, contextHolder] = message.useMessage();
 
   const onClose = useCallback(() => {
@@ -41,6 +49,16 @@
 
   const addUser = useCallback(async () => {
     const values = await form.validateFields();
+    const opPermissionUids = values.opPermissionUids ?? [];
+    if (
+      !allowEditGlobalManagement &&
+      opPermissionUids.includes(OpPermissionTypeUid.global_management)
+    ) {
+      messageApi.error(
+        t('dmsUserCenter.user.userForm.globalManagementLockedTips')
+      );
+      return;
+    }
     setTrue();
     User.AddUser({
       user: {
@@ -49,7 +67,7 @@
         email: values.email ?? '',
         phone: values.phone ?? '',
         wxid: values.wxid ?? '',
-        op_permission_uids: values.opPermissionUids ?? []
+        op_permission_uids: opPermissionUids
       }
     })
       .then((res) => {
@@ -66,7 +84,15 @@
       .finally(() => {
         setFalse();
       });
-  }, [onClose, form, setFalse, setTrue, t, messageApi]);
+  }, [
+    allowEditGlobalManagement,
+    onClose,
+    form,
+    setFalse,
+    setTrue,
+    t,
+    messageApi
+  ]);
 
   return (
     <BasicDrawer
@@ -86,7 +112,11 @@
       }
     >
       {contextHolder}
-      <UserForm form={form} visible={visible} />
+      <UserForm
+        form={form}
+        visible={visible}
+        canEditGlobalManagement={allowEditGlobalManagement}
+      />
     </BasicDrawer>
   );
 };

packages/base/src/page/UserCenter/Modal/User/UpdateUser/index.test.tsx

@@ -8,6 +8,7 @@ import { useDispatch, useSelector } from 'react-redux';
 import { ModalName } from '../../../../../data/ModalName';
 import EmitterKey from '../../../../../data/EmitterKey';
 import { queryBySelector } from '@actiontech/shared/lib/testUtil/customQuery';
+import { mockUseCurrentUser } from '@actiontech/shared/lib/testUtil/mockHook/mockUseCurrentUser';
 
 jest.mock('react-redux', () => ({
   ...jest.requireActual('react-redux'),
@@ -22,6 +23,8 @@ describe('base/UserCenter/Modal/UpdateUser', () => {
   const mockUserData = userList[0];
   beforeEach(() => {
     jest.useFakeTimers();
+    // UpdateUser 经 useCurrentUser 读当前操作者；需内置 admin 才能编辑系统管理员边界
+    mockUseCurrentUser({ username: 'admin', uid: '700200' });
     updateUserSpy = userCenter.updateUser();
     opPermissionListSpy = userCenter.getOpPermissionsList();
 

packages/base/src/page/UserCenter/Modal/User/UpdateUser/index.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useCallback } from 'react';
+import { useEffect, useCallback, useMemo } from 'react';
 import { Form, message, Space } from 'antd';
 import { useTranslation } from 'react-i18next';
 import { useDispatch, useSelector } from 'react-redux';
@@ -9,7 +9,7 @@
 import { IUserFormFields } from '../UserForm/index.type';
 import { ModalName } from '../../../../../data/ModalName';
 import { updateUserManageModalStatus } from '../../../../../store/userCenter';
-import { ResponseCode } from '@actiontech/shared/lib/enum';
+import { OpPermissionTypeUid, ResponseCode } from '@actiontech/shared/lib/enum';
 import EventEmitter from '../../../../../utils/EventEmitter';
 import {
   IListUser,
@@ -19,6 +19,11 @@
 import { ListUserStatEnum } from '@actiontech/shared/lib/api/base/service/common.enum';
 import { BasicDrawer, BasicButton } from '@actiontech/shared';
 import { SystemRole } from '@actiontech/shared/lib/enum';
+import { useCurrentUser } from '@actiontech/shared/lib/global';
+import {
+  canEditGlobalManagement,
+  canManageTarget
+} from '../../../utils/systemAdminBoundary';
 
 const UpdateUser = () => {
   const [form] = Form.useForm<IUserFormFields>();
@@ -37,6 +42,16 @@
     (state) => state.userCenter.selectUser
   );
 
+  const { username, uid } = useCurrentUser();
+  const currentOperator = useMemo(
+    () => ({ name: username, uid }),
+    [username, uid]
+  );
+  const allowEditGlobalManagement = useMemo(
+    () => canEditGlobalManagement(currentOperator),
+    [currentOperator]
+  );
+
   const [messageApi, contextHolder] = message.useMessage();
 
   const onClose = useCallback(() => {
@@ -52,12 +67,32 @@
   const updateUser = async () => {
     const values = await form.validateFields();
 
+    if (!canManageTarget(currentOperator, currentUser)) {
+      messageApi.error(t('dmsUserCenter.user.userForm.manageTargetForbidden'));
+      return;
+    }
+
+    const nextOpUids = values.opPermissionUids ?? [];
+    const prevHadGlobal =
+      currentUser?.op_permissions?.some(
+        (p) => p.uid === OpPermissionTypeUid.global_management
+      ) ?? false;
+    const nextHasGlobal = nextOpUids.includes(
+      OpPermissionTypeUid.global_management
+    );
+    if (!allowEditGlobalManagement && prevHadGlobal !== nextHasGlobal) {
+      messageApi.error(
+        t('dmsUserCenter.user.userForm.globalManagementLockedTips')
+      );
+      return;
+    }
+
     const userParams: IUpdateUser = {
       password: values.passwordConfirm,
       email: values.email ?? '',
       phone: values.phone ?? '',
       wxid: values.wxid ?? '',
-      op_permission_uids: values.opPermissionUids ?? [],
+      op_permission_uids: nextOpUids,
       is_disabled: values.username !== 'admin' ? !!values.isDisabled : false
     };
     setTrue();
@@ -124,6 +159,7 @@
         visible={visible}
         isUpdate={true}
         isAdmin={currentUser?.name === SystemRole.admin}
+        canEditGlobalManagement={allowEditGlobalManagement}
       />
     </BasicDrawer>
   );

packages/base/src/page/UserCenter/Modal/User/UserForm/index.tsx

@@ -1,24 +1,38 @@
 import { IUserFormProps } from './index.type';
 import { Form, Switch } from 'antd';
 import { BasicInput, BasicSelect } from '@actiontech/shared';
-import React, { useEffect } from 'react';
+import React, { useEffect, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Rule } from 'antd/es/form';
 import { nameRule, phoneRule } from '@actiontech/shared/lib/utils/FormRule';
 import EmptyBox from '@actiontech/shared/lib/components/EmptyBox';
 import { BasicToolTips } from '@actiontech/shared';
 import useOpPermission from '../../../../../hooks/useOpPermission';
 import { ListOpPermissionsFilterByTargetEnum } from '@actiontech/shared/lib/api/base/service/OpPermission/index.enum';
+import { OpPermissionTypeUid } from '@actiontech/shared/lib/enum';
 
 const UserForm: React.FC<IUserFormProps> = (props) => {
   const { t } = useTranslation();
+  const canEditGlobalManagement = props.canEditGlobalManagement !== false;
 
   const {
     loading: getOpPermissionListLoading,
     opPermissionOptions,
     updateOpPermissionList
   } = useOpPermission();
 
+  const permissionOptions = useMemo(() => {
+    if (canEditGlobalManagement) {
+      return opPermissionOptions;
+    }
+    return opPermissionOptions.map((opt) => {
+      if (opt.value === OpPermissionTypeUid.global_management) {
+        return { ...opt, disabled: true };
+      }
+      return opt;
+    });
+  }, [canEditGlobalManagement, opPermissionOptions]);
+
   const userNameRules = (): Rule[] => {
     const baseRules = [
       {
@@ -164,7 +178,21 @@
       </Form.Item>
       <Form.Item
         name="opPermissionUids"
-        label={t('dmsUserCenter.user.userForm.opPermissions')}
+        label={
+          canEditGlobalManagement ? (
+            t('dmsUserCenter.user.userForm.opPermissions')
+          ) : (
+            <BasicToolTips
+              suffixIcon
+              titleWidth={320}
+              title={t(
+                'dmsUserCenter.user.userForm.globalManagementLockedTips'
+              )}
+            >
+              {t('dmsUserCenter.user.userForm.opPermissions')}
+            </BasicToolTips>
+          )
+        }
       >
         <BasicSelect
           mode="multiple"
@@ -173,7 +201,7 @@
           placeholder={t('common.form.placeholder.select', {
             name: t('dmsUserCenter.user.userForm.opPermissions')
           })}
-          options={opPermissionOptions}
+          options={permissionOptions}
           optionFilterProp="label"
         />
       </Form.Item>

packages/base/src/page/UserCenter/Modal/User/UserForm/index.type.ts

@@ -16,5 +16,8 @@ export interface IUserFormProps {
   form: FormInstance<IUserFormFields>;
   visible: boolean;
   isUpdate?: boolean;
+  /** 目标用户是否为 admin（控制禁用开关展示；勿与「当前操作者是否内置」混淆） */
   isAdmin?: boolean;
+  /** 当前操作者是否可授予/收回「系统管理员」；false 时锁定 700017 选项 */
+  canEditGlobalManagement?: boolean;
 }