Merge branch 'feature/REQ-3282' into 'release-20250218'

Feature/req 3282

See merge request universal/infrastructure/backend/tyr!426

pom.xml

@@ -17,6 +17,7 @@
     <modules>
         <module>tyr-api</module>
         <module>tyr-server</module>
+        <module>tyr-client</module>
     </modules>
 
     <properties>

tyr-api/src/main/java/cn/axzo/tyr/client/model/req/ListSaasRoleGroupParam.java

@@ -2,6 +2,7 @@ package cn.axzo.tyr.client.model.req;
 
 import cn.axzo.foundation.dao.support.wrapper.CriteriaField;
 import cn.axzo.foundation.dao.support.wrapper.Operator;
+import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
@@ -62,4 +63,16 @@ public class ListSaasRoleGroupParam {
 
     @CriteriaField(field = "parentId", operator = Operator.IN)
     private Set<Long> parentIds;
+
+    /**
+     * needRole = true才生效
+     */
+    @CriteriaField(ignore = true)
+    private Set<RoleTypeEnum> roleTypes;
+
+    /**
+     * 查找指定角色分组code层级及以下所有层级角色的用户
+     */
+    @CriteriaField(ignore = true)
+    private String ancestorRoleGroupCode;
 }

tyr-api/src/main/java/cn/axzo/tyr/client/model/req/PagePgroupPermissionRelationReq.java

@@ -63,4 +63,16 @@ public class PagePgroupPermissionRelationReq implements IPageReq {
 
     @CriteriaField(ignore = true)
     private Set<RolePermissionTagEnum> tags;
+
+    /**
+     * 是否需要菜单组件信息
+     */
+    @CriteriaField(ignore = true)
+    private Boolean needFeatureResource;
+
+    /**
+     * 是否需要角色信息
+     */
+    @CriteriaField(ignore = true)
+    private Boolean needRole;
 }

tyr-api/src/main/java/cn/axzo/tyr/client/model/req/PageSaasRoleGroupParam.java

@@ -2,12 +2,16 @@ package cn.axzo.tyr.client.model.req;
 
 import cn.axzo.foundation.dao.support.wrapper.CriteriaField;
 import cn.axzo.foundation.page.IPageReq;
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.client.model.res.SaasRoleGroupDTO;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 import lombok.experimental.SuperBuilder;
 
+import java.util.Collections;
 import java.util.List;
+import java.util.Optional;
 
 
 @SuperBuilder
@@ -28,4 +32,14 @@ public class PageSaasRoleGroupParam extends ListSaasRoleGroupParam implements IP
     @CriteriaField(ignore = true)
     List<String> sort;
 
+    public PageResp<SaasRoleGroupDTO> toEmpty() {
+        return PageResp.<SaasRoleGroupDTO>builder()
+                .current(Optional.ofNullable(this.getPage())
+                        .orElse(DEFAULT_PAGE_NUMBER))
+                .size(Optional.ofNullable(this.getPageSize())
+                        .orElse(DEFAULT_PAGE_SIZE))
+                .total(0)
+                .data(Collections.emptyList())
+                .build();
+    }
 }

tyr-api/src/main/java/cn/axzo/tyr/client/model/req/PermissionQueryReq.java

@@ -1,36 +0,0 @@
-package cn.axzo.tyr.client.model.req;
-
-import cn.axzo.tyr.client.model.base.WorkspaceOUPair;
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-import javax.validation.constraints.NotEmpty;
-import javax.validation.constraints.NotNull;
-import java.util.List;
-
-/**
- * 权限查询请求
- *
- * @version V1.0
- * @author: ZhanSiHu
- * @date: 2024/4/7 16:23
- */
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class PermissionQueryReq {
-
-    @NotNull(message = "人员ID不能为空")
-    private Long personId;
-
-    @NotEmpty(message = "单位标识对不能为空")
-    private List<WorkspaceOUPair> workspaceOUPairs;
-
-    private String terminal;
-
-    private List<String> featureCodes;
-
-}

tyr-api/src/main/java/cn/axzo/tyr/client/model/res/ListPermissionFromRoleGroupResp.java

@@ -92,10 +92,6 @@ public class ListPermissionFromRoleGroupResp {
 
         private Set<RolePermissionTagEnum> tags;
     }
-
-    public String buildOuWorkspaceKey() {
-        return this.getOuId() + "_" + this.getWorkspaceId();
-    }
 }
 
 

tyr-api/src/main/java/cn/axzo/tyr/client/model/res/SaasPermissionRes.java

@@ -21,6 +21,8 @@ public class SaasPermissionRes {
      */
     private String featureCode;
 
+    private String uniCode;
+
     /**
      * 资源所属端
      */

tyr-api/src/main/java/cn/axzo/tyr/client/model/res/SaasRoleGroupDTO.java

@@ -5,6 +5,7 @@ import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.Date;
 import java.util.List;
 
 @Data
@@ -65,6 +66,10 @@ public class SaasRoleGroupDTO {
      */
     private String path;
 
+    private Date createAt;
+
+    private Date updateAt;
+
     /**
      * 角色信息
      */

tyr-api/src/main/java/cn/axzo/tyr/client/model/res/SaasRoleGroupRes.java

@@ -5,6 +5,8 @@ import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.Date;
+
 @Data
 @Builder
 @NoArgsConstructor
@@ -57,4 +59,19 @@ public class SaasRoleGroupRes {
      * 上级分组id
      */
     private Long parentId;
+
+    /**
+     * 层级path
+     */
+    private String path;
+
+    /**
+     * 添加时间
+     */
+    private Date createAt;
+
+    /**
+     * 更新时间
+     */
+    private Date updateAt;
 }

tyr-api/src/main/java/cn/axzo/tyr/client/model/roleuser/dto/SaasRoleUserV2DTO.java

@@ -157,6 +157,25 @@ public class SaasRoleUserV2DTO {
 
         private String roleCode;
 
+        private Date createAt;
+
+        private Date updateAt;
+
+        /**
+         * 创建者
+         */
+        private Long createBy;
+
+        /**
+         * 更新者
+         */
+        private Long updateBy;
+
+        /**
+         * 排序
+         */
+        private Integer sort;
+
         /**
          * 角色权限
          */

tyr-api/src/main/java/cn/axzo/tyr/client/model/roleuser/req/ListRoleUserRelationParam.java

@@ -41,12 +41,18 @@ public class ListRoleUserRelationParam {
     @CriteriaField(field = "resourceType", operator = Operator.EQ)
     private Integer resourceType;
 
+    @CriteriaField(field = "resourceType", operator = Operator.IN)
+    private Set<Integer> resourceTypes;
+
     /**
      * 资源Id
      */
     @CriteriaField(field = "resourceId", operator = Operator.EQ)
     private Long resourceId;
 
+    @CriteriaField(field = "resourceId", operator = Operator.IN)
+    private Set<Long> resourceIds;
+
     /**
      * 是否显示
      */
@@ -141,6 +147,26 @@ public class ListRoleUserRelationParam {
     @CriteriaField(ignore = true)
     private Set<RoleTypeEnum> roleTypes;
 
+    /**
+     * 查找指定角色分组code层级下角色的用户
+     */
+    @CriteriaField(ignore = true)
+    private String roleGroupCode;
+
+    /**
+     * 查找指定角色分组code层级及以下所有层级角色的用户
+     */
+    @CriteriaField(ignore = true)
+    private String ancestorRoleGroupCode;
+
+    /**
+     * 查询用户拥有的权限
+     * 跟needPermission的区别是：needPermission是查询角色关联的菜单组件
+     * needUserPermission是查询这个用户拥有的权限，要根据产品去匹配，
+     */
+    @CriteriaField(ignore = true)
+    private Boolean needUserPermission;
+
     @Data
     @Builder
     @NoArgsConstructor
@@ -175,6 +201,8 @@ public class ListRoleUserRelationParam {
         private Long ouId;
 
         private Long personId;
+
+        private Long resourceId;
     }
 
 }

tyr-api/src/main/java/cn/axzo/tyr/client/model/roleuser/req/PageRoleUserRelationParam.java

@@ -3,6 +3,7 @@ package cn.axzo.tyr.client.model.roleuser.req;
 import cn.axzo.foundation.dao.support.wrapper.CriteriaField;
 import cn.axzo.foundation.page.IPageReq;
 import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
@@ -10,6 +11,7 @@ import lombok.experimental.SuperBuilder;
 
 import java.util.Collections;
 import java.util.List;
+import java.util.Optional;
 
 @SuperBuilder
 @Data
@@ -29,10 +31,12 @@ public class PageRoleUserRelationParam extends ListRoleUserRelationParam impleme
     @CriteriaField(ignore = true)
     List<String> sort;
 
-    public PageResp toEmpty() {
-        return PageResp.builder()
-                .current(this.getPage())
-                .size(this.getPageSize())
+    public PageResp<SaasRoleUserV2DTO> toEmpty() {
+        return PageResp.<SaasRoleUserV2DTO>builder()
+                .current(Optional.ofNullable(this.getPage())
+                        .orElse(DEFAULT_PAGE_NUMBER))
+                .size(Optional.ofNullable(this.getPageSize())
+                        .orElse(DEFAULT_PAGE_SIZE))
                 .total(0)
                 .data(Collections.emptyList())
                 .build();

tyr-client/pom.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <artifactId>tyr</artifactId>
+        <groupId>cn.axzo.tyr</groupId>
+        <version>${revision}</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+
+    <artifactId>tyr-client</artifactId>
+    <packaging>jar</packaging>
+    <name>tyr-client</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>cn.axzo.framework</groupId>
+            <artifactId>axzo-consumer-spring-cloud-starter</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>cn.axzo.foundation</groupId>
+            <artifactId>common-lib</artifactId>
+            <version>2.0.0-SNAPSHOT</version>
+        </dependency>
+    </dependencies>
+</project>

tyr-client/src/main/java/cn/axzo/tyr/feign/api/ProductApi.java

@@ -0,0 +1,17 @@
+package cn.axzo.tyr.feign.api;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.req.PageProductReq;
+import cn.axzo.tyr.feign.resp.ProductResp;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+@FeignClient(name = "tyr", url = "${axzo.service.tyr:http://tyr:8080}")
+public interface ProductApi {
+
+    @PostMapping("/api/product/page")
+    ApiResult<PageResp<ProductResp>> page(@RequestBody @Validated PageProductReq req);
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/api/RoleApi.java

@@ -0,0 +1,22 @@
+package cn.axzo.tyr.feign.api;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.req.PageRoleReq;
+import cn.axzo.tyr.feign.resp.RoleResp;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+@FeignClient(name = "tyr", url = "${axzo.service.tyr:http://tyr:8080}")
+public interface RoleApi {
+
+    /**
+     * 角色分页接口
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/role/page")
+    ApiResult<PageResp<RoleResp>> page(@RequestBody @Validated PageRoleReq req);
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/api/RoleGroupApi.java

@@ -0,0 +1,22 @@
+package cn.axzo.tyr.feign.api;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.req.PageRoleGroupReq;
+import cn.axzo.tyr.feign.resp.RoleGroupResp;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+@FeignClient(name = "tyr", url = "${axzo.service.tyr:http://tyr:8080}")
+public interface RoleGroupApi {
+
+    /**
+     * 角色分组接口
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/role-group/page")
+    ApiResult<PageResp<RoleGroupResp>> page(@RequestBody @Validated PageRoleGroupReq req);
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/api/RoleUserApi.java

@@ -0,0 +1,31 @@
+package cn.axzo.tyr.feign.api;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.req.PageRoleUserReq;
+import cn.axzo.tyr.feign.req.UpsertUserRoleReq;
+import cn.axzo.tyr.feign.resp.RoleUserResp;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+@FeignClient(name = "tyr", url = "${axzo.service.tyr:http://tyr:8080}")
+public interface RoleUserApi {
+
+    /**
+     * 角色用户page接口
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/role-user/page")
+    ApiResult<PageResp<RoleUserResp>> page(@RequestBody @Validated PageRoleUserReq req);
+
+    /**
+     * 更新用户角色
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/user-role/upsert")
+    ApiResult<Void> upsertUserRole(@RequestBody @Validated UpsertUserRoleReq req);
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/api/UserPermissionApi.java

@@ -0,0 +1,34 @@
+package cn.axzo.tyr.feign.api;
+
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.req.ListPermissionUserReq;
+import cn.axzo.tyr.feign.req.ListUserPermissionReq;
+import cn.axzo.tyr.feign.resp.PermissionUserResp;
+import cn.axzo.tyr.feign.resp.UserPermissionResp;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+
+import java.util.List;
+
+@FeignClient(name = "tyr", url = "${axzo.service.tyr:http://tyr:8080}")
+public interface UserPermissionApi {
+
+    /**
+     * 查询用户的权限
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/user-permission/list")
+    ApiResult<List<UserPermissionResp>> listUserPermission(@RequestBody @Validated ListUserPermissionReq req);
+
+    /**
+     * 查询有权限的用户
+     * @param req
+     * @return
+     */
+    @PostMapping("/api/permission-user/list")
+    ApiResult<List<PermissionUserResp>> listPermissionUser(@RequestBody @Validated ListPermissionUserReq req);
+
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/config/TyrFeignAutoConfiguration.java

@@ -0,0 +1,15 @@
+package cn.axzo.tyr.feign.config;
+
+import org.springframework.cloud.openfeign.EnableFeignClients;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * @Author: liyong.tian
+ * @Date: 2022/9/17
+ * @Description:
+ */
+@EnableFeignClients(basePackages = {"cn.axzo.tyr.feign"})
+@Configuration
+public class TyrFeignAutoConfiguration {
+
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/enums/FeatureResourceTypeEnum.java

@@ -0,0 +1,31 @@
+package cn.axzo.tyr.feign.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+/**
+ * 功能资源类型
+ *
+ * @version V1.0
+ * @author: ZhanSiHu
+ * @date: 2024/4/3 11:35
+ */
+@Getter
+@AllArgsConstructor
+public enum FeatureResourceTypeEnum {
+
+    MENU(1, "菜单"),
+    PAGE(2, "页面"),
+    APP_ENTRY(3, "应用入口"),
+    COMPONENT(4, "组件"),
+    ROOT(5, "ROOT"),
+    GROUP(6, "分组"),
+    // 用户pc端菜单直接的分割分组线
+    MENU_PARTITION_GROUP(7, "菜单分割分组"),
+    ;
+
+    private final Integer code;
+
+    private final String desc;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/enums/IdentityTypeEnum.java

@@ -0,0 +1,41 @@
+package cn.axzo.tyr.feign.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * 人员身份类型枚举
+ *
+ * @author xuyaozuo
+ * @since 2022/5/9 21:59
+ */
+@Getter
+@AllArgsConstructor
+public enum IdentityTypeEnum {
+
+    /*人员身份类型*/
+    NOT_SUPPORT(0, "NOT_SUPPORT", "无效类型"),
+    WORKER(1, "WORKER", "工人"),
+    WORKER_LEADER(2, "WORKER_LEADER", "班组长"),
+    PRACTITIONER(3, "PRACTITIONER", "从业人员"),
+    REGULATOR(4, "REGULATOR", "监管人员"),
+    OPERATOR(5, "OPERATOR", "运营人员"),
+    ;
+    private final Integer code;
+    private final String message;
+    private final String desc;
+
+    public static Optional<IdentityTypeEnum> fromCode(Integer code) {
+        if (Objects.isNull(code)) {
+            return Optional.empty();
+        }
+
+        return Arrays.stream(IdentityTypeEnum.values())
+                .filter(e -> Objects.equals(e.getCode(), code))
+                .findFirst();
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/enums/RolePermissionTagEnum.java

@@ -0,0 +1,16 @@
+package cn.axzo.tyr.feign.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+
+@Getter
+@AllArgsConstructor
+public enum RolePermissionTagEnum {
+
+    JOINED("在职"),
+    LEAVE("离场"),
+    ;
+
+    private final String desc;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/enums/RoleTypeEnum.java

@@ -0,0 +1,38 @@
+package cn.axzo.tyr.feign.enums;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.Arrays;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * @author tanjie@axzo.cn
+ * @date 2023/9/13 16:35
+ */
+@Getter
+@AllArgsConstructor
+public enum RoleTypeEnum {
+
+    //角色类型：common 自定义角色 super_admin超级管理员(禁止删除) admin子管理员(禁止删除) init初始化内置角色 auto_own自定义角色(禁止删除)<承载向用户单独分配的自定义权限>
+    COMMON("common", "自定义角色",false),
+    SUPER_ADMIN("super_admin", "超级管理员",true),
+    ADMIN("admin", "子管理员",true),
+    INIT("init", "初始化内置角色-标准角色",false),
+    AUTO_OWN("auto_own", "虚拟角色(自定义权限使用)",false);
+
+    private final String value;
+    private final String desc;
+    private final boolean isAdmin;
+
+    public static Optional<RoleTypeEnum> fromValue(String value) {
+        if (StringUtils.isBlank(value)) {
+            return Optional.empty();
+        }
+        return Arrays.stream(RoleTypeEnum.values())
+                .filter(e -> Objects.equals(e.getValue(), value))
+                .findFirst();
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/ListPermissionUserReq.java

@@ -0,0 +1,59 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotBlank;
+import javax.validation.constraints.NotEmpty;
+import javax.validation.constraints.NotNull;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ListPermissionUserReq {
+
+    @Valid
+    @NotEmpty(message = "permissionUsers不能为空")
+    private Set<PermissionUserReq> permissionUsers;
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class PermissionUserReq {
+        /**
+         * 权限码
+         */
+
+        @NotBlank(message = "featureCode不能为空")
+        private String featureCode;
+
+        /**
+         * 单位id
+         */
+        @NotNull(message = "ouId不能为空")
+        private Long ouId;
+
+        /**
+         * 项目Id
+         */
+        @NotNull(message = "workspaceId不能为空")
+        private Long workspaceId;
+
+        /**
+         * 指定端的权限
+         */
+        private String terminal;
+
+        /**
+         * 指定权限标签
+         */
+        private Set<RolePermissionTagEnum> tags;
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/ListUserPermissionReq.java

@@ -0,0 +1,103 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotEmpty;
+import javax.validation.constraints.NotNull;
+import java.util.List;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ListUserPermissionReq {
+
+    /**
+     * 不能给太多，性能会有问题，一般控制在5个以内合适
+     */
+    @Valid
+    @NotEmpty(message = "userPermissions不能为空")
+    private List<UserPermission> userPermissions;
+
+    /**
+     * 权限code
+     * 没有指定就查询所有的权限，指定了就查询指定code的权限
+     */
+    private Set<String> featureCodes;
+
+    /**
+     * 端信息
+     */
+    private String terminal;
+
+    /**
+     * app类型（APP:原生，H5:h5页面）
+     */
+    private String appType;
+
+    /**
+     * 项目code（H5会拉取项目下所有的元素）
+     * APP上每个应用的code，数据库叫itemCode，保持一致
+     */
+    private String itemCode;
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class UserPermission {
+        /**
+         * 人员id
+         * 根据personId查询权限或者根据identityId、identityType查询权限，不能同时都为空
+         */
+        private Long personId;
+
+        /**
+         * 身份id
+         */
+        private Long identityId;
+
+        /**
+         * 身份类型
+         */
+        private IdentityTypeEnum identityType;
+
+        /**
+         * 租户id
+         */
+        @NotNull(message = "workspaceId不能为空")
+        private Long workspaceId;
+
+        /**
+         * 单位id
+         */
+        @NotNull(message = "ouId不能为空")
+        private Long ouId;
+
+        /**
+         * 人岗架部门id
+         */
+        private Long nodeId;
+
+        /**
+         * 根据权限标签去过滤角色对应的权限
+         * 如果没有指定值，则会根据用户在当前workspaceId和ouId在人岗架的状态来解析
+         */
+        private Set<RolePermissionTagEnum> permissionTags;
+
+        public String buildPersonKey() {
+            return this.getPersonId() + "_" + this.getWorkspaceId() + "_" + this.getOuId();
+        }
+
+        public String buildIdentityKey() {
+            return this.getIdentityId() + "_" + this.getIdentityType().getCode() + "_" + this.getWorkspaceId() + "_" + this.getOuId();
+        }
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/PageProductReq.java

@@ -0,0 +1,50 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.foundation.dao.support.wrapper.CriteriaField;
+import cn.axzo.foundation.dao.support.wrapper.Operator;
+import cn.axzo.foundation.page.IPageReq;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.constraints.Max;
+import java.util.List;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PageProductReq implements IPageReq {
+
+    @CriteriaField(ignore = true)
+    private Integer page;
+
+    /**
+     * 最大值1000
+     */
+    @CriteriaField(ignore = true)
+    @Max(value = 1000, message = "pageSize最大值为1000")
+    private Integer pageSize;
+
+    /**
+     * 排序：使用示例，createTime__DESC
+     */
+    @CriteriaField(ignore = true)
+    private List<String> sort;
+
+    /**
+     * 工作台类型
+     */
+    @CriteriaField(field = "dictWorkspaceTypeId", operator = Operator.IN)
+    private Set<Long> dictWorkspaceTypeIdS;
+
+    /**
+     * 产品默认授权方式
+     * 1:创建工作台
+     * 2:资质认证
+     */
+    @CriteriaField(field = "authType", operator = Operator.IN)
+    private Set<Integer> authTypes;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/PageRoleGroupReq.java

@@ -0,0 +1,53 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.constraints.Max;
+import java.util.List;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PageRoleGroupReq {
+
+    private Integer page;
+
+    /**
+     * 最大值1000
+     */
+    @Max(value = 1000, message = "pageSize最大值为1000")
+    private Integer pageSize;
+
+    /**
+     * 排序：使用示例，createTime__DESC
+     */
+    private List<String> sort;
+
+    /**
+     * 角色分组code
+     */
+    private Set<String> roleGroupCodes;
+
+    /**
+     * 角色类型:RoleTypeEnum
+     * super_admin:超级管理员
+     * admin:管理员
+     * init:初始化内置角色-标准角色
+     * auto_own:虚拟角色(自定义权限使用)
+     * common:自定义角色
+     *
+     * needRole = true时才生效
+     */
+    private Set<RoleTypeEnum> roleTypes;
+
+    /**
+     * 是否需要角色信息
+     */
+    private Boolean needRole;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/PageRoleReq.java

@@ -0,0 +1,158 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.FeatureResourceTypeEnum;
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.constraints.Max;
+import java.util.List;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PageRoleReq {
+
+    private Integer page;
+
+    /**
+     * 最大值1000
+     */
+    @Max(value = 1000, message = "pageSize最大值为1000")
+    private Integer pageSize;
+
+    /**
+     * 排序：使用示例，createTime__DESC
+     */
+    private List<String> sort;
+
+    /**
+     * 角色id
+     */
+    private Set<Long> roleIds;
+
+    /**
+     * 租户类型
+     */
+    private Integer workspaceType;
+
+    /**
+     * 是否显示
+     */
+    private Boolean isDisplay;
+
+    /**
+     * 角色权限码
+     */
+    private String roleCode;
+
+    /**
+     * 租户id
+     */
+    private Set<Long> workspaceIds;
+
+    /**
+     * 单位id
+     */
+    private Set<Long> ouIds;
+
+    /**
+     * 是否启用
+     */
+    private Boolean enabled;
+
+    /**
+     * 角色类型:RoleTypeEnum
+     * super_admin:超级管理员
+     * admin:管理员
+     * init:初始化内置角色-标准角色
+     * auto_own:虚拟角色(自定义权限使用)
+     * common:自定义角色
+     */
+    private Set<RoleTypeEnum> roleTypes;
+
+    /**
+     * workspaceId和ouId配对查询
+     * 例如：((workspaceId = ## and ouId = ##) or (workspaceId = ## and ouId = ##))
+     */
+    private List<WorkspaceOuPair> workspaceOuPairs;
+
+    /**
+     * 角色权限码
+     */
+    private Set<String> roleCodes;
+
+    /**
+     * 角色分组code
+     */
+    private Set<String> roleGroupCodes;
+
+    /**
+     * 协同关系类型
+     * 1:总包 2:建设单位 3:监理单位 4:劳务分包 5:专业分包 6:OMS通用 7:企业通用 8:企业内班组 9:项目内班组
+     * @see cn.axzo.maokai.common.enums.SaasCooperateShipCooperateTypeEnum
+     */
+    private Set<Integer> cooperateShipTypes;
+
+    /**
+     * 是否需要角色关联的菜单组件信息，saas_feature_recource的记录
+     */
+    private Boolean needFeatureResources;
+
+    /**
+     * 根据权限标签去过滤角色对应的权限，
+     * 只有在needFeatureResources = true时才生效
+     */
+    private Set<RolePermissionTagEnum> permissionTags;
+
+    /**
+     * 是否需要角色对应的角色分组信息
+     */
+    private Boolean needRoleGroup;
+
+    /**
+     * 是否需要角色对应的用户信息
+     */
+    private Boolean needRoleUser;
+
+    /**
+     * 是否需要角色跟菜单组件的关联关系，不查询具体的菜单组件信息
+     */
+    private Boolean needFeatureResourceRelation;
+
+    /**
+     * 是否需要预设角色，因为预设角色的workspaceId和ouId为-1
+     */
+    private Boolean needPresetRole;
+
+    /**
+     * 查询菜单树节点类型
+     */
+    private List<FeatureResourceTypeEnum> featureResourceTypes;
+
+    /**
+     * 端，查询权限点时，会根据端过滤，增加效率，目前只有CMS端的新版本才冗余了端
+     */
+    private String terminal;
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class WorkspaceOuPair {
+        /**
+         * 租户id
+         */
+        private Long workspaceId;
+
+        /**
+         * 单位id
+         */
+        private Long ouId;
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/PageRoleUserReq.java

@@ -0,0 +1,206 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.FeatureResourceTypeEnum;
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.constraints.Max;
+import java.util.List;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PageRoleUserReq {
+
+    private Integer page;
+
+    /**
+     * 最大值1000
+     */
+    @Max(value = 1000, message = "pageSize最大值为1000")
+    private Integer pageSize;
+
+    /**
+     * 排序：使用示例，createTime__DESC
+     */
+    private List<String> sort;
+
+    /**
+     * 企业id
+     */
+    private Set<Long> ouIds;
+
+    /**
+     * 项目id
+     */
+    private Set<Long> workspaceIds;
+
+    /**
+     * 角色code
+     * 查询指定角色code对应的用户
+     */
+    private Set<String> roleCodes;
+
+    /**
+     * 角色id
+     * 查询指定角色id对应的用户
+     */
+    private Set<Long> roleIds;
+
+    /**
+     * 角色类型:RoleTypeEnum
+     * super_admin:超级管理员
+     * admin:管理员
+     * init:初始化内置角色-标准角色
+     * auto_own:虚拟角色(自定义权限使用)
+     * common:自定义角色
+     *
+     * 查询指定角色类型的用户
+     */
+    private Set<RoleTypeEnum> roleTypes;
+
+    /**
+     * workspaceId和ouId配对查询
+     * 例如：((workspaceId = ## and ouId = ##) or (workspaceId = ## and ouId = ##))
+     */
+    private List<WorkspaceOuPair> workspaceOuPairs;
+
+    /**
+     * 是否需要角色信息
+     */
+    private Boolean needRole;
+
+    /**
+     * 用户id
+     */
+    private Set<Long> personIds;
+
+    /**
+     * 身份id
+     */
+    private Set<Long> identityIds;
+
+    /**
+     * 身份类型
+     */
+    private IdentityTypeEnum identityType;
+
+    /**
+     * 历史字段，资源类型
+     */
+    private Set<Integer> resourceTypes;
+
+    /**
+     * 历史字段，资源id
+     */
+    private Set<Long> resourceIds;
+
+    /**
+     * 是否显示
+     * needRole = true时才有效，指定isDisplay值去查询对应的角色
+     */
+    private Boolean isDisplay;
+
+    /**
+     * 是否启用
+     * needRole = true时才有效，指定enabled值去查询对应的角色
+     */
+    private Boolean enabled;
+
+    /**
+     * 是否需要用户信息：当前系统没有冗余名字，需要实时查询用户信息，比如名字
+     */
+    private Boolean needUsers;
+
+    /**
+     * 菜单组件id
+     * needRole = true时才有效，根据指定featureResourceIds去查询角色关联的菜单组件等信息
+     */
+    private Set<Long> featureResourceIds;
+
+    /**
+     * 是否需要角色跟菜单组件的关联关系，不查询具体的菜单组件信息
+     * needRole = true时才有效
+     */
+    private Boolean needFeatureResourceRelation;
+
+    /**
+     * 是否需要角色关联的菜单组件信息，saas_feature_recource的记录
+     * needRole = true时才有效
+     */
+    private Boolean needFeatureResources;
+
+    /**
+     * needFeatureResourceRelation 或者 needFeatureResources = true时，根据指定的featureResourceTypes去过滤数据
+     * 需要 needRole = true 且 needFeatureResourceRelation 或者 needFeatureResources = true时，才有效才会生效
+     */
+    private Set<FeatureResourceTypeEnum> featureResourceTypes;
+
+    /**
+     * needFeatureResourceRelation 或者 needFeatureResources = true时，根据指定的featureResourceTypes去过滤数据
+     * 目前只有CMS端的新版本才冗余了端
+     * 需要 needRole = true 且 needFeatureResourceRelation 或者 needFeatureResources = true时，才有效才会生效
+     */
+    private String terminal;
+
+    /**
+     * 批量配对的查询用户
+     */
+    private Set<BatchPerson> batchPersons;
+
+    /**
+     * 查找指定角色分组code层级下角色的用户
+     */
+    private String roleGroupCode;
+
+    /**
+     * 查找指定角色分组code层级及以下所有层级角色的用户
+     */
+    private String ancestorRoleGroupCode;
+
+    /**
+     * 查询用户拥有的权限
+     */
+    private Boolean needUserPermission;
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class WorkspaceOuPair {
+        /**
+         * 租户id
+         */
+        private Long workspaceId;
+
+        /**
+         * 单位id
+         */
+        private Long ouId;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class BatchPerson {
+        private Long identityId;
+
+        /**
+         * 身份类型 1:工人 2:班组长 3:从业人员 4:监管人员 5:运营人员
+         */
+        private Integer identityType;
+
+        private Long workspaceId;
+
+        private Long ouId;
+
+        private Long personId;
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/req/UpsertUserRoleReq.java

@@ -0,0 +1,99 @@
+package cn.axzo.tyr.feign.req;
+
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import javax.validation.Valid;
+import javax.validation.constraints.NotEmpty;
+import javax.validation.constraints.NotNull;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class UpsertUserRoleReq {
+
+    @Valid
+    @NotEmpty(message = "userRoles不能为空")
+    private Set<UserRoleReq> userRoles;
+
+    /**
+     * 操作人personId
+     */
+    @NotNull(message = "operatorId不能为空")
+    private Long operatorId;
+
+    /**
+     * 更新用户角色的场景
+     * 记录日持，方便排查问题
+     */
+    @Builder.Default
+    private String scene = "更新用户角色";
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class UserRoleReq {
+
+        @NotNull(message = "workspaceId不能为空")
+        private Long workspaceId;
+
+        @NotNull(message = "ouId不能为空")
+        private Long ouId;
+
+        @NotNull(message = "identityId不能为空")
+        private Long identityId;
+
+        @NotNull(message = "identityType不能为空")
+        private IdentityTypeEnum identityType;
+
+        @NotNull(message = "personId不能为空")
+        private Long personId;
+
+        /**
+         * 人岗架部门id
+         */
+        private Long nodeId;
+
+        /**
+         * 增量新增的角色id
+         */
+        private Set<Long> insertRoleIds;
+
+        /**
+         * 增量新增的角色code
+         */
+        private Set<String> insertRoleCodes;
+
+        /**
+         * 全量新增的角色id
+         */
+        private Set<Long> fullRoleIds;
+
+        /**
+         * 全量新增的角色code
+         */
+        private Set<String> fullRoleCodes;
+
+        /**
+         * 删除用户的角色id
+         */
+        private Set<Long> removeRoleIds;
+
+        /**
+         * 删除用户的角色code
+         */
+        private Set<String> removeRoleCodes;
+
+        public String buildKey() {
+            return this.getIdentityId() + "_" + this.getIdentityType().getCode() +
+                    "_" + this.getPersonId() + "_" + this.getWorkspaceId() +
+                    "_" + this.getOuId();
+        }
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/FeatureResourceRelationResp.java

@@ -0,0 +1,38 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class FeatureResourceRelationResp {
+
+    /**
+     * 菜单资源树节点id
+     */
+    private Long featureId;
+
+    /**
+     * 新旧菜单资源数标识
+     */
+    private Integer type;
+
+    /**
+     * 菜单资源树节点类型
+     */
+    private Integer featureType;
+
+    /**
+     * 权限点标签：
+     * 在职:JOINED
+     * 离场:LEAVE
+     * @see cn.axzo.tyr.feign.enums.RolePermissionTagEnum
+     */
+    private Set<String> tags;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/PermissionResp.java

@@ -0,0 +1,36 @@
+package cn.axzo.tyr.feign.resp;
+
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PermissionResp {
+
+    /**
+     * 权限点id
+     */
+    private Long featureId;
+
+    /**
+     * 权限code
+     */
+    private String featureCode;
+
+    /**
+     * 权限点的类型
+     */
+    private Integer featureType;
+
+    /**
+     * 端信息
+     */
+    private String terminal;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/PermissionUserResp.java

@@ -0,0 +1,36 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PermissionUserResp {
+
+    private Long ouId;
+
+    private Long workspaceId;
+
+    private Set<User> users;
+
+    @Data
+    @Builder
+    @AllArgsConstructor
+    @NoArgsConstructor
+    public static class User {
+
+        private Long identityId;
+
+        private Integer identityType;
+
+        private Long personId;
+
+        private boolean isSuperAdmin;
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/ProductResp.java

@@ -0,0 +1,174 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Date;
+import java.util.List;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ProductResp {
+
+    private Long id;
+
+    private Date createAt;
+
+    private Date updateAt;
+
+    private Long isDelete;
+
+    /**
+     * 产品 icon
+     */
+    private String icon;
+
+    /**
+     * 产品板块名字
+     */
+    private String productName;
+
+    /**
+     * 产品板块名字
+     */
+    private Integer productType;
+
+    /**
+     * 基础产品与否 0:基础产品 1:普通产品
+     */
+    private Integer commonProduct;
+
+    /**
+     * 产品所属工作台字典 ID
+     */
+    private Long dictWorkspaceTypeId;
+
+    /**
+     * 产品所属工作台字典 Code
+     */
+    private String dictWorkspaceTypeCode;
+
+    /**
+     * 产品状态
+     */
+    private Integer status;
+
+    /**
+     * 产品板块备注
+     */
+    private String remark;
+
+    /**
+     * 产品默认授权方式
+     * 1:创建工作台
+     * 2:资质认证
+     */
+    private Integer authType;
+
+    /**
+     * 资质序列/单位类型(数组多选逗号隔开1,2,3,4,5)
+     * cn.axzo.basics.common.constant.enums.OrganizationalUnitTypeEnum
+     */
+    private String ouType;
+
+    /**
+     * 创建人
+     */
+    private Long createBy;
+
+    /**
+     * 修改人
+     */
+    private Long updateBy;
+
+    /**
+     * 产品类型
+     * PRODUCT_VERSION:产品版本类型、ADD_VALUE_SERVICE:增值服务类型、
+     * GENERAL_SERVICE:通用产品类型、HARD_WARE:硬件产品类型
+     */
+    private String category;
+
+    /**
+     * 版本升级序列(数字越小，版本越低，不能降级，只能升级) <企业、项目产品>
+     */
+    private Integer version;
+
+    /**
+     * 人数上限 <企业、项目产品>
+     */
+    private Integer maxPersonCount;
+
+    /**
+     * 最大项目数  <企业产品>
+     */
+    private Integer maxWorkspaceCount;
+
+    /**
+     * 价格(单位：分)
+     */
+    private Long price;
+
+    /**
+     * 产品详情 jsonList(skuNameSKU名称、model规格型号、count数量、unit单位)
+     */
+    private List<Sku> skus;
+
+    /**
+     * 素材<仅硬件产品支持>json类型
+     * ({"miages":List<String>,"videos":List<String>,"detailImages":List<String>})
+     */
+    private Material material;
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class Sku {
+
+        /**
+         * SKU名称
+         */
+        private String skuName;
+
+        /**
+         * 规格型号
+         */
+        private String model;
+
+        /**
+         * 数量
+         */
+        private Integer count;
+
+        /**
+         * 单位
+         */
+        private String unit;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    public static class Material {
+
+        /**
+         * 图片
+         */
+        private List<String> images;
+
+        /**
+         * 视频
+         */
+        private List<String> videos;
+
+        /**
+         * 详情大图
+         */
+        private List<String> detailImages;
+    }
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/RoleFeatureResourceResp.java

@@ -0,0 +1,36 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class RoleFeatureResourceResp {
+
+    /**
+     * 菜单组件id
+     */
+    private Long id;
+
+    /**
+     * 菜单组件编码(全局唯一)
+     */
+    private String uniCode;
+
+    /**
+     * 菜单组件所属端
+     */
+    private String terminal;
+
+    /**
+     * 菜单组件的权限标签
+     * @see cn.axzo.tyr.feign.enums.RolePermissionTagEnum
+     */
+    private Set<String> tags;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/RoleGroupResp.java

@@ -0,0 +1,87 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Date;
+import java.util.List;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class RoleGroupResp {
+
+    private Long id;
+
+    /**
+     * 租户类型：
+     * @see cn.axzo.apollo.workspace.common.enums.WorkspaceTypeEnum
+     */
+    private Integer workspaceType;
+
+    /**
+     * 协同关系类型
+     * 1:总包 2:建设单位 3:监理单位 4:劳务分包 5:专业分包 6:OMS通用 7:企业通用 8:企业内班组 9:项目内班组
+     * 政务的就是-1
+     * @see cn.axzo.maokai.common.enums.SaasCooperateShipCooperateTypeEnum
+     */
+    private Integer cooperateShipType;
+
+    /**
+     * 名称
+     */
+    private String name;
+
+    /**
+     * 所属工作台id
+     */
+    private Long workspaceId;
+
+    /**
+     * 所属单位id
+     */
+    private Long ouId;
+
+    /**
+     * 上级分组id
+     */
+    private Long parentId;
+
+    /**
+     * 层级path
+     */
+    private String path;
+
+    /**
+     * 排序
+     */
+    private Integer sort;
+
+    /**
+     * 分组CODE
+     */
+    private String code;
+
+    /**
+     * 分类CODE, 用于代班长，小组长的权限分类。
+     */
+    private String categoryCode;
+
+    /**
+     * 添加时间
+     */
+    private Date createAt;
+
+    /**
+     * 更新时间
+     */
+    private Date updateAt;
+
+    /**
+     * 角色信息
+     */
+    private List<RoleResp> roles;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/RoleResp.java

@@ -0,0 +1,114 @@
+package cn.axzo.tyr.feign.resp;
+
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Date;
+import java.util.List;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class RoleResp {
+
+    /**
+     * 角色id
+     */
+    private Long roleId;
+
+    /**
+     * 角色编码
+     */
+    private String roleCode;
+
+    /**
+     * 角色名称
+     */
+    private String name;
+
+    /**
+     * 角色描述
+     */
+    private String description;
+
+    /**
+     * 角色类型：common 普通角色 super_admin超级管理员(禁止删除) admin子管理员(禁止删除) init初始化内置角色
+     * @see cn.axzo.tyr.feign.enums.RoleTypeEnum
+     */
+    private String roleType;
+
+    /**
+     * 角色所属租户id，预设角色的workspaceId <= 0
+     */
+    private Long workspaceId;
+
+    /**
+     * 角色所属单位id，预设角色的ouId <= 0
+     */
+    private Long ouId;
+
+    /**
+     * 协同关系类型
+     * 1:总包 2:建设单位 3:监理单位 4:劳务分包 5:专业分包 6:OMS通用 7:企业通用 8:企业内班组 9:项目内班组
+     * @see cn.axzo.maokai.common.enums.SaasCooperateShipCooperateTypeEnum
+     */
+    private Integer cooperateShipType;
+
+    /**
+     * 创建者
+     */
+    private Long createBy;
+
+    /**
+     * 更新者
+     */
+    private Long updateBy;
+
+    /**
+     * 是否显示
+     */
+    private Boolean isDisplay;
+    /**
+     * 是否启用
+     */
+    private Boolean enabled;
+
+    /**
+     * 排序
+     */
+    private Integer sort;
+
+    /**
+     * 添加时间
+     */
+    private Date createAt;
+
+    /**
+     * 更新时间
+     */
+    private Date updateAt;
+
+    /**
+     * 角色所属分组
+     */
+    private RoleGroupResp roleGroup;
+
+    /**
+     * 角色关联的菜单组件信息
+     */
+    private List<RoleFeatureResourceResp> roleFeatureResources;
+
+    /**
+     * 角色对应的人员信息
+     */
+    private List<RoleUserResp> roleUsers;
+
+    /**
+     * 角色关联的菜单组件信息：只有相关的关联信息，比roleFeatureResources少很多信息
+     */
+    private List<FeatureResourceRelationResp> featureResourceRelations;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/RoleUserResp.java

@@ -0,0 +1,90 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Date;
+import java.util.Set;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class RoleUserResp {
+
+    /**
+     * 主键ID
+     */
+    private Long id;
+
+    /**
+     * 角色Id
+     */
+    private Long roleId;
+
+    /**
+     * 身份Id
+     */
+    private Long identityId;
+
+    /**
+     * 身份类型 1:工人 2:从业人员 3:班组长 4:运营人员 5:政务人员
+     */
+    private Integer identityType;
+
+    /**
+     * 用户personId
+     */
+    private Long personId;
+
+    /**
+     * 用户名字
+     */
+    private String realName;
+
+    /**
+     * 所属单位Id 用户在当前工作台的所属单位
+     */
+    private Long ouId;
+
+    /**
+     * 工作台Id
+     */
+    private Long workspaceId;
+
+    /**
+     * 创建者
+     */
+    private Long createBy;
+
+    /**
+     * 更新者
+     */
+    private Long updateBy;
+
+    protected Date createAt;
+
+    protected Date updateAt;
+
+    /**
+     * 资源类型
+     */
+    private Integer resourceType;
+
+    /**
+     * 资源Id
+     */
+    private Long resourceId;
+
+    /**
+     * 角色信息
+     */
+    private RoleResp role;
+
+    /**
+     * 用户当前角色拥有的权限
+     */
+    private Set<PermissionResp> permissions;
+}

tyr-client/src/main/java/cn/axzo/tyr/feign/resp/UserPermissionResp.java

@@ -0,0 +1,52 @@
+package cn.axzo.tyr.feign.resp;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.List;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class UserPermissionResp {
+
+    /**
+     * 人员id
+     */
+    private Long personId;
+
+    /**
+     * 身份id
+     */
+    private Long identityId;
+
+    /**
+     * 身份类型
+     */
+    private String identityType;
+
+    /**
+     * 项目id
+     */
+    private Long workspaceId;
+
+    /**
+     * 单位id
+     */
+    private Long ouId;
+
+    /**
+     * 部门id
+     */
+    private Long nodeId;
+
+    /**
+     * 是否是超管
+     */
+    private Boolean isSuperAdmin;
+
+    private List<PermissionResp> permissions;
+}

tyr-client/src/main/resources/META-INF/spring.factories

@@ -0,0 +1,2 @@
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+cn.axzo.tyr.feign.config.TyrFeignAutoConfiguration

tyr-server/pom.xml

@@ -156,12 +156,23 @@
             <artifactId>braum-api</artifactId>
             <version>1.0.0-SNAPSHOT</version>
         </dependency>
+        <dependency>
+            <groupId>cn.axzo.tyr</groupId>
+            <artifactId>tyr-client</artifactId>
+            <version>2.0.0-SNAPSHOT</version>
+        </dependency>
 
         <dependency>
             <groupId>cn.axzo.nanopart</groupId>
             <artifactId>config-api</artifactId>
             <version>2.0.0-SNAPSHOT</version>
         </dependency>
+
+        <dependency>
+            <groupId>cn.axzo.platform</groupId>
+            <artifactId>axzo-log-api</artifactId>
+            <version>1.0.0-SNAPSHOT</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>

tyr-server/src/main/java/cn/axzo/tyr/server/common/constants/PermissionConstant.java

@@ -18,4 +18,9 @@ public class PermissionConstant {
     public static final String FEATURE_TOP_PATH = "/0/";
     /** 权限点business_no前缀 **/
     public static final String FEATURE_BIZ_NO_PREFIX = "feature";
+
+    /**
+     * 分页查询最大PAGE_SIZE
+     */
+    public static final Integer MAX_PAGE_SIZE = 1000;
 }

tyr-server/src/main/java/cn/axzo/tyr/server/config/exception/BizResultCode.java

@@ -26,12 +26,14 @@ public enum BizResultCode implements IResultCode {
     PAGE_ELEMENT_CATEGORY_NOT_FOUND("100016", "资源分组数据不存在"),
     PAGE_ELEMENT_ERROR("100017", "资源分组错误:{}"),
     PAGE_CODE_DUPLICATE("100018", "资源元素code重复,重复的code:{}"),
-    PARAM_ERROR("100019", "参数错误"),
+    PARAM_ERROR("100019", "参数错误:{}"),
     FEATURE_NAME_EXIST("100020", "菜单组件名字已经存在:{}"),
     TERMINAL_CODE_EXIST("100021", "端code已经存在，请修改"),
     TERMINAL_NOT_FOUND("100022", "原端不存在:{}"),
     FEATURE_CODE_OVER_LENGTH("100023", "组件code不能超过100个字符:{}"),
-    TERMINAL_NAME_EXIST("100024", "端名字已经存在，请修改");
+    TERMINAL_NAME_EXIST("100024", "端名字已经存在，请修改"),
+    ROLE_ID_NOF_FOUND("100025", "角色ID不存在:{}"),
+    ROLE_CODE_NOF_FOUND("100026", "角色CODE不存在:{}");
 
 
     private String errorCode;

tyr-server/src/main/java/cn/axzo/tyr/server/controller/PrivateController.java

@@ -18,8 +18,6 @@ import cn.axzo.tyr.client.model.req.ListRoleReq;
 import cn.axzo.tyr.client.model.req.ListSaasRoleGroupParam;
 import cn.axzo.tyr.client.model.req.PagePgroupPermissionRelationReq;
 import cn.axzo.tyr.client.model.req.PageProductFeatureRelationReq;
-import cn.axzo.tyr.client.model.req.PageRoleReq;
-import cn.axzo.tyr.client.model.req.PermissionCheckReq;
 import cn.axzo.tyr.client.model.req.QuerySaasRoleGroupReq;
 import cn.axzo.tyr.client.model.res.CommonDictResp;
 import cn.axzo.tyr.client.model.res.FeatureResourceDTO;
@@ -69,7 +67,6 @@ import cn.axzo.tyr.server.service.SaasFeatureResourceService;
 import cn.axzo.tyr.server.service.SaasPgroupPermissionRelationService;
 import cn.axzo.tyr.server.service.SaasRoleGroupService;
 import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
-import cn.axzo.tyr.server.service.TyrSaasAuthService;
 import cn.axzo.tyr.server.service.WorkspaceProductService;
 import cn.axzo.tyr.server.service.impl.SaasFeatureResourceCacheService;
 import cn.axzo.tyr.server.util.FeatureCodeUtil;
@@ -86,7 +83,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.BooleanUtils;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -115,72 +111,38 @@ import static cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation.
 @RequiredArgsConstructor
 public class PrivateController {
 
-    @Autowired
-    private SaasCommonDictService saasCommonDictService;
-    @Autowired
-    private SaasRoleGroupService saasRoleGroupService;
-    @Autowired
-    private SaasRoleGroupRelationDao saasRoleGroupRelationDao;
-    @Autowired
-    private RoleService roleService;
-    @Autowired
-    private SaasFeatureResourceDao saasFeatureResourceDao;
-    @Autowired
-    private SaasFeatureResourceCacheService saasFeatureResourceCacheService;
-    @Autowired
-    private ProductPermissionCacheService productPermissionCacheService;
-    @Autowired
-    private TyrSaasAuthService tyrSaasAuthService;
-    @Autowired
-    private SaasFeatureDao saasFeatureDao;
-    @Autowired
-    private SaasPgroupPermissionRelationService saasPgroupPermissionRelationService;
-    @Autowired
-    private SaasRoleDao saasRoleDao;
-    @Autowired
-    private SaasPgroupRoleRelationDao saasPgroupRoleRelationDao;
-    @Autowired
-    private SaasPgroupPermissionRelationDao saasPgroupPermissionRelationDao;
-    @Autowired
-    private ProductFeatureRelationService productFeatureRelationService;
-    @Autowired
-    private FeatureCodeUtil featureCodeUtil;
-    @Autowired
-    private WorkspaceProductService workspaceProductService;
-    @Autowired
-    private CacheWorkspaceProductHandler cacheWorkspaceProductHandler;
-    @Autowired
-    private SaasRoleGroupDao saasRoleGroupDao;
-    @Autowired
-    private CacheProductPermissionJob cacheProductPermissionJob;
-    @Autowired
-    private CacheRolePermissionJob cacheRolePermissionJob;
-    @Autowired
-    private CacheSaasFeatureJob cacheSaasFeatureJob;
-    @Autowired
-    private CacheProductFeatureResourceJob cacheProductFeatureResourceJob;
-    @Autowired
-    private CacheRoleFeatureResourceJob cacheRoleFeatureResourceJob;
-    @Autowired
-    private SaasFeatureResourceService saasFeatureResourceService;
-    @Autowired
-    private RolePermissionCacheService rolePermissionCacheService;
-    @Autowired
-    private SaasPageElementDao saasPageElementDao;
-    @Autowired
-    private SaasPageElementFeatureResourceRelationDao saasPageElementFeatureResourceRelationDao;
-    @Autowired
-    private SaasRoleUserRelationService saasRoleUserRelationService;
-    @Autowired
-    private ProductModuleDao productModuleDao;
-    @Autowired
-    private CacheWorkspaceProductJob cacheWorkspaceProductJob;
-    @Autowired
-    private RoleSaasFeatureResourceCacheService roleSaasFeatureResourceCacheService;
-    @Autowired
-    private SendDingTalkHandler sendDingTalkHandler;
-    @Autowired
-    private ProductSaasFeatureResourceCacheService productSaasFeatureResourceCacheService;
+    private final SaasCommonDictService saasCommonDictService;
+    private final SaasRoleGroupService saasRoleGroupService;
+    private final SaasRoleGroupRelationDao saasRoleGroupRelationDao;
+    private final RoleService roleService;
+    private final SaasFeatureResourceDao saasFeatureResourceDao;
+    private final SaasFeatureResourceCacheService saasFeatureResourceCacheService;
+    private final ProductPermissionCacheService productPermissionCacheService;
+    private final SaasFeatureDao saasFeatureDao;
+    private final SaasPgroupPermissionRelationService saasPgroupPermissionRelationService;
+    private final SaasRoleDao saasRoleDao;
+    private final SaasPgroupRoleRelationDao saasPgroupRoleRelationDao;
+    private final SaasPgroupPermissionRelationDao saasPgroupPermissionRelationDao;
+    private final ProductFeatureRelationService productFeatureRelationService;
+    private final FeatureCodeUtil featureCodeUtil;
+    private final WorkspaceProductService workspaceProductService;
+    private final CacheWorkspaceProductHandler cacheWorkspaceProductHandler;
+    private final SaasRoleGroupDao saasRoleGroupDao;
+    private final CacheProductPermissionJob cacheProductPermissionJob;
+    private final CacheRolePermissionJob cacheRolePermissionJob;
+    private final CacheSaasFeatureJob cacheSaasFeatureJob;
+    private final CacheProductFeatureResourceJob cacheProductFeatureResourceJob;
+    private final CacheRoleFeatureResourceJob cacheRoleFeatureResourceJob;
+    private final SaasFeatureResourceService saasFeatureResourceService;
+    private final RolePermissionCacheService rolePermissionCacheService;
+    private final SaasPageElementDao saasPageElementDao;
+    private final SaasPageElementFeatureResourceRelationDao saasPageElementFeatureResourceRelationDao;
+    private final SaasRoleUserRelationService saasRoleUserRelationService;
+    private final ProductModuleDao productModuleDao;
+    private final CacheWorkspaceProductJob cacheWorkspaceProductJob;
+    private final RoleSaasFeatureResourceCacheService roleSaasFeatureResourceCacheService;
+    private final SendDingTalkHandler sendDingTalkHandler;
+    private final ProductSaasFeatureResourceCacheService productSaasFeatureResourceCacheService;
 
     /**
      * 统一层级的roleGroup按照id升序，sort从1递增
@@ -437,7 +399,7 @@ public class PrivateController {
                     .pageSize(DEFAULT_PAGE_SIZE)
                     .build();
 
-            PageResp<SaasPgroupPermissionRelation> page = saasPgroupPermissionRelationService.page(req);
+            PageResp<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> page = saasPgroupPermissionRelationService.page(req);
             if (CollectionUtils.isNotEmpty(page.getData())) {
                 updateOldRoleFeature(page.getData());
 
@@ -451,8 +413,8 @@ public class PrivateController {
         return "ok";
     }
 
-    private void updateNewRoleFeature(List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations) {
-        List<SaasPgroupPermissionRelation> newFeatureRelations = saasPgroupPermissionRelations.stream()
+    private void updateNewRoleFeature(List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> saasPgroupPermissionRelations) {
+        List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> newFeatureRelations = saasPgroupPermissionRelations.stream()
                 .filter(e -> Objects.equals(e.getType(), NEW_FEATURE))
                 .collect(Collectors.toList());
 
@@ -460,7 +422,7 @@ public class PrivateController {
             return;
         }
 
-        Map<Long, SaasFeatureResource> saasFeatureResourceMap = saasFeatureResourceDao.listByIds(Lists.transform(newFeatureRelations, SaasPgroupPermissionRelation::getFeatureId))
+        Map<Long, SaasFeatureResource> saasFeatureResourceMap = saasFeatureResourceDao.listByIds(Lists.transform(newFeatureRelations, SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getFeatureId))
                 .stream()
                 .collect(Collectors.toMap(SaasFeatureResource::getId, Function.identity()));
 
@@ -485,8 +447,8 @@ public class PrivateController {
         saasPgroupPermissionRelationService.updateBatchById(update);
     }
 
-    private void updateOldRoleFeature(List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations) {
-        List<SaasPgroupPermissionRelation> oldFeatureRelations = saasPgroupPermissionRelations.stream()
+    private void updateOldRoleFeature(List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> saasPgroupPermissionRelations) {
+        List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> oldFeatureRelations = saasPgroupPermissionRelations.stream()
                 .filter(e -> Objects.equals(e.getType(), OLD_FEATURE))
                 .collect(Collectors.toList());
 
@@ -494,7 +456,7 @@ public class PrivateController {
             return;
         }
 
-        Map<Long, SaasFeature> saasFeatureMap = saasFeatureDao.listByIds(Lists.transform(oldFeatureRelations, SaasPgroupPermissionRelation::getFeatureId))
+        Map<Long, SaasFeature> saasFeatureMap = saasFeatureDao.listByIds(Lists.transform(oldFeatureRelations, SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getFeatureId))
                 .stream()
                 .collect(Collectors.toMap(SaasFeature::getId, Function.identity()));
 
@@ -649,11 +611,6 @@ public class PrivateController {
         return "ok";
     }
 
-    @PostMapping("/api/private/workspaceProduct/list")
-    public Object listWorkspaceProduct(@RequestBody WorkspaceProductService.WorkspaceProductParam request) {
-        return workspaceProductService.listWorkspaceProductCached(request);
-    }
-
     @PostMapping("/api/private/cacheWorkspaceProductHandler/process")
     public Object processCacheWorkspaceProductHandler(@RequestBody ServicePkgProductCreatedPayload request) {
         Event event = Event.builder()
@@ -712,8 +669,8 @@ public class PrivateController {
     }
 
     @PostMapping("/api/private/workspaceProductCached/list")
-    public Object workspaceProductCached(@RequestBody WorkspaceProductService.ListWorkspaceProductPermissionCacheParam request) {
-        return workspaceProductService.listWorkspaceProductPermissionCached(request);
+    public Object workspaceProductCached(@RequestBody WorkspaceProductService.ListWorkspacePermissionCacheParam request) {
+        return workspaceProductService.listWorkspacePermissionCached(request);
     }
 
     /**
@@ -1331,11 +1288,13 @@ public class PrivateController {
     }
 
     private List<WorkspaceProductService.ProductPermission> listWorkspaceProductPermission(CheckPermissionParam request) {
-        WorkspaceProductService.ListWorkspaceProductPermissionCacheParam listWorkspaceProductPermissionCacheParam = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam
+        WorkspaceProductService.ListWorkspacePermissionCacheParam listWorkspaceProductPermissionCacheParam = WorkspaceProductService.ListWorkspacePermissionCacheParam
                 .builder()
-                .workspaceIds(Sets.newHashSet(request.getWorkspaceId()))
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(request.getWorkspaceId())
+                        .build()))
                 .build();
-        return workspaceProductService.listWorkspaceProductPermissionCached(listWorkspaceProductPermissionCacheParam).stream()
+        return workspaceProductService.listWorkspacePermissionCached(listWorkspaceProductPermissionCacheParam).stream()
                 .map(WorkspaceProductService.WorkspaceProductPermission::getProductPermissions)
                 .flatMap(Collection::stream)
                 .collect(Collectors.toList());

tyr-server/src/main/java/cn/axzo/tyr/server/controller/v2/ProductV2Controller.java

@@ -0,0 +1,24 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.feign.api.ProductApi;
+import cn.axzo.tyr.feign.req.PageProductReq;
+import cn.axzo.tyr.feign.resp.ProductResp;
+import cn.axzo.tyr.server.service.ProductService;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RestController;
+
+@Slf4j
+@RestController
+public class ProductV2Controller implements ProductApi {
+
+    @Autowired
+    private ProductService productService;
+
+    @Override
+    public ApiResult<PageResp<ProductResp>> page(PageProductReq req) {
+        return ApiResult.success(productService.pageV2(req));
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/controller/v2/RoleController.java

@@ -0,0 +1,147 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.client.model.res.SaasRoleRes;
+import cn.axzo.tyr.feign.api.RoleApi;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.PageRoleReq;
+import cn.axzo.tyr.feign.resp.FeatureResourceRelationResp;
+import cn.axzo.tyr.feign.resp.RoleFeatureResourceResp;
+import cn.axzo.tyr.feign.resp.RoleGroupResp;
+import cn.axzo.tyr.feign.resp.RoleResp;
+import cn.axzo.tyr.feign.resp.RoleUserResp;
+import cn.axzo.tyr.server.service.RoleService;
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONArray;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+@Slf4j
+@RestController
+public class RoleController implements RoleApi {
+
+    @Autowired
+    private RoleService roleService;
+
+    @Override
+    public ApiResult<PageResp<RoleResp>> page(PageRoleReq req) {
+        PageResp<SaasRoleRes> page = roleService.page(from(req));
+
+        return ApiResult.success(PageResp.<RoleResp>builder()
+                .total(page.getTotal())
+                .size(page.getSize())
+                .current(page.getCurrent())
+                .data(page.getData().stream()
+                        .map(this::from)
+                        .collect(Collectors.toList()))
+                .build());
+    }
+
+    private cn.axzo.tyr.client.model.req.PageRoleReq from(PageRoleReq req) {
+
+        cn.axzo.tyr.client.model.req.PageRoleReq result = JSON.parseObject(JSON.toJSONString(req),
+                cn.axzo.tyr.client.model.req.PageRoleReq.class);
+
+        result.setRoleTypes(Optional.ofNullable(req.getRoleTypes())
+                .map(e -> e.stream()
+                        .map(RoleTypeEnum::getValue)
+                        .collect(Collectors.toList()))
+                .orElse(null));
+
+        result.setProductUnitTypes(req.getCooperateShipTypes());
+
+        result.setNeedPermission(req.getNeedFeatureResources());
+
+        result.setNeedPermissionRelation(req.getNeedFeatureResourceRelation());
+        return result;
+    }
+
+    private void assembleRoleFeatureResource(SaasRoleRes saasRoleRes, RoleResp roleResp) {
+        if (CollectionUtils.isEmpty(saasRoleRes.getSaasPermissions())) {
+            return;
+        }
+
+        List<RoleFeatureResourceResp> roleFeatureResources = JSONArray.parseArray(JSON.toJSONString(saasRoleRes.getSaasPermissions()),
+                RoleFeatureResourceResp.class);
+        roleResp.setRoleFeatureResources(roleFeatureResources);
+    }
+
+    private void assembleRoleGroup(SaasRoleRes saasRoleRes, RoleResp roleResp) {
+        if (CollectionUtils.isEmpty(saasRoleRes.getSaasRoleGroups())) {
+            return;
+        }
+        roleResp.setRoleGroup(saasRoleRes.getSaasRoleGroups().stream()
+                .map(roleGroup -> {
+                    RoleGroupResp roleGroupResp = RoleGroupResp.builder().build();
+                    BeanUtils.copyProperties(roleGroup, roleGroupResp);
+
+                    if (StringUtils.isNotBlank(roleGroup.getWorkspaceTypeCode())) {
+                        roleGroupResp.setWorkspaceType(Integer.valueOf(roleGroup.getWorkspaceTypeCode()));
+                    }
+
+                    // 因为角色分组页面可以选择多个，会逗号隔开，但是是不允许这样的数据出现的，为了兼容不报错，如果有逗号就取第一个返回
+                    if (StringUtils.isNotBlank(roleGroup.getOuTypeCode())) {
+                        if (roleGroup.getOuTypeCode().contains(",")) {
+                            roleGroupResp.setCooperateShipType(Integer.valueOf(roleGroup.getOuTypeCode().split(",")[0]));
+                        } else {
+                            roleGroupResp.setCooperateShipType(Integer.valueOf(roleGroup.getOuTypeCode()));
+                        }
+                    }
+                    return roleGroupResp;
+                })
+                .findFirst()
+                .orElse(null));
+    }
+
+    private void assembleRoleUser(SaasRoleRes saasRoleRes, RoleResp roleResp) {
+
+        if (CollectionUtils.isEmpty(saasRoleRes.getSaasRoleUsers())) {
+            return;
+        }
+
+        roleResp.setRoleUsers(saasRoleRes.getSaasRoleUsers().stream()
+                .map(saasRoleUser -> {
+                    RoleUserResp roleUserResp = RoleUserResp.builder().build();
+                    BeanUtils.copyProperties(saasRoleUser, roleUserResp);
+                    return roleUserResp;
+                })
+                .collect(Collectors.toList()));
+    }
+
+    private void assembleFeatureResourceRelation(SaasRoleRes saasRoleRes, RoleResp roleResp) {
+
+        if (CollectionUtils.isEmpty(saasRoleRes.getPermissionRelations())) {
+            return;
+        }
+
+        List<FeatureResourceRelationResp> resourceRelationResps = JSONArray.parseArray(JSON.toJSONString(saasRoleRes.getPermissionRelations()),
+                FeatureResourceRelationResp.class);
+        roleResp.setFeatureResourceRelations(resourceRelationResps);
+    }
+
+    private RoleResp from(SaasRoleRes saasRoleRes) {
+        RoleResp result = RoleResp.builder().build();
+        BeanUtils.copyProperties(saasRoleRes, result);
+        result.setRoleId(saasRoleRes.getId());
+        result.setCooperateShipType(saasRoleRes.getProductUnitType());
+        result.setOuId(saasRoleRes.getOwnerOuId());
+
+        assembleRoleFeatureResource(saasRoleRes, result);
+
+        assembleRoleGroup(saasRoleRes, result);
+
+        assembleRoleUser(saasRoleRes, result);
+
+        assembleFeatureResourceRelation(saasRoleRes, result);
+        return result;
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/controller/v2/RoleGroupController.java

@@ -0,0 +1,80 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.client.model.req.PageSaasRoleGroupParam;
+import cn.axzo.tyr.client.model.res.SaasRoleGroupDTO;
+import cn.axzo.tyr.feign.api.RoleGroupApi;
+import cn.axzo.tyr.feign.req.PageRoleGroupReq;
+import cn.axzo.tyr.feign.resp.RoleGroupResp;
+import cn.axzo.tyr.feign.resp.RoleResp;
+import cn.axzo.tyr.server.service.SaasRoleGroupService;
+import com.alibaba.fastjson.JSON;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.stream.Collectors;
+
+@Slf4j
+@RestController
+public class RoleGroupController implements RoleGroupApi {
+
+    @Autowired
+    private SaasRoleGroupService saasRoleGroupService;
+
+    @Override
+    public ApiResult<PageResp<RoleGroupResp>> page(PageRoleGroupReq req) {
+
+        PageResp<SaasRoleGroupDTO> page = saasRoleGroupService.page(from(req));
+
+        return ApiResult.success(PageResp.<RoleGroupResp>builder()
+                .total(page.getTotal())
+                .size(page.getSize())
+                .current(page.getCurrent())
+                .data(page.getData().stream()
+                        .map(this::from)
+                        .collect(Collectors.toList()))
+                .build());
+    }
+
+    private PageSaasRoleGroupParam from(PageRoleGroupReq req) {
+        return JSON.parseObject(JSON.toJSONString(req), PageSaasRoleGroupParam.class);
+    }
+
+    private RoleGroupResp from(SaasRoleGroupDTO saasRoleGroupDTO) {
+        RoleGroupResp result = RoleGroupResp.builder().build();
+
+        BeanUtils.copyProperties(saasRoleGroupDTO, result);
+
+        result.setWorkspaceType(Integer.valueOf(saasRoleGroupDTO.getWorkspaceTypeCode()));
+        // 这里需要catch，因为oms端设置的时候是可以设置多个，用逗号隔开的，但是这样设置后会导致系统出问题，是不允许这样的
+        try {
+            result.setCooperateShipType(Integer.valueOf(saasRoleGroupDTO.getOuTypeCode()));
+        } catch (Exception exception) {
+            log.warn("roleGroup ouTypeCode to cooperateShipType ERROR,", exception);
+        }
+        assembleRole(saasRoleGroupDTO, result);
+        return result;
+    }
+
+    private void assembleRole(SaasRoleGroupDTO saasRoleGroupDTO, RoleGroupResp roleGroupResp) {
+        if (CollectionUtils.isEmpty(saasRoleGroupDTO.getSaasRoles())) {
+            return;
+        }
+
+        roleGroupResp.setRoles(saasRoleGroupDTO.getSaasRoles().stream()
+                .map(saasRole -> {
+                    RoleResp roleResp = RoleResp.builder().build();
+                    BeanUtils.copyProperties(saasRole, roleResp);
+
+                    roleResp.setRoleId(saasRole.getId());
+                    roleResp.setCooperateShipType(saasRole.getProductUnitType());
+                    roleResp.setOuId(saasRole.getOwnerOuId());
+                    return roleResp;
+                })
+                .collect(Collectors.toList()));
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/controller/v2/RoleUserV2Controller.java

@@ -0,0 +1,121 @@
+package cn.axzo.tyr.server.controller.v2;
+
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
+import cn.axzo.tyr.client.model.roleuser.req.PageRoleUserRelationParam;
+import cn.axzo.tyr.feign.api.RoleUserApi;
+import cn.axzo.tyr.feign.req.PageRoleUserReq;
+import cn.axzo.tyr.feign.req.UpsertUserRoleReq;
+import cn.axzo.tyr.feign.resp.FeatureResourceRelationResp;
+import cn.axzo.tyr.feign.resp.RoleFeatureResourceResp;
+import cn.axzo.tyr.feign.resp.RoleResp;
+import cn.axzo.tyr.feign.resp.RoleUserResp;
+import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONArray;
+import com.google.common.collect.Lists;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+import static cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation.NEW_FEATURE;
+
+@Slf4j
+@RestController
+public class RoleUserV2Controller implements RoleUserApi {
+
+    @Autowired
+    private SaasRoleUserRelationService saasRoleUserRelationService;
+
+    @Override
+    public ApiResult<PageResp<RoleUserResp>> page(PageRoleUserReq req) {
+
+        PageResp<SaasRoleUserV2DTO> page = saasRoleUserRelationService.page(from(req));
+
+        return ApiResult.success(PageResp.<RoleUserResp>builder()
+                .total(page.getTotal())
+                .size(page.getSize())
+                .current(page.getCurrent())
+                .data(page.getData().stream()
+                        .map(this::from)
+                        .collect(Collectors.toList()))
+                .build());
+    }
+
+    @Override
+    public ApiResult<Void> upsertUserRole(UpsertUserRoleReq req) {
+        saasRoleUserRelationService.upsert(req);
+        return ApiResult.success();
+    }
+
+    private PageRoleUserRelationParam from(PageRoleUserReq req) {
+        PageRoleUserRelationParam result = JSON.parseObject(JSON.toJSONString(req),
+                PageRoleUserRelationParam.class);
+
+        result.setFeatureIds(Optional.ofNullable(req.getFeatureResourceIds())
+                .map(Lists::newArrayList)
+                .orElse(null));
+
+        result.setNeedPermission(req.getNeedFeatureResources());
+
+        result.setNeedPermissionRelation(req.getNeedFeatureResourceRelation());
+
+        // 因为关联关系存在关联featureResource和feature两个表，且有冲突，用type区分的，只有type = NEW_FEATURE的数据补了端
+        // 这个type对外不可知，也是临时的，后续只能关联featureResource，所以这里如果有terminal，则自动补上type = NEW_FEATURE
+        if (StringUtils.isNotBlank(req.getTerminal())) {
+            result.setType(NEW_FEATURE);
+        }
+        return result;
+    }
+
+    private RoleUserResp from(SaasRoleUserV2DTO saasRoleUserV2DTO) {
+        RoleUserResp result = RoleUserResp.builder().build();
+
+        BeanUtils.copyProperties(saasRoleUserV2DTO, result);
+
+        result.setPersonId(saasRoleUserV2DTO.getSaasRoleUser().getPersonId());
+        result.setRealName(saasRoleUserV2DTO.getSaasRoleUser().getRealName());
+
+        result.setRole(Optional.ofNullable(saasRoleUserV2DTO.getSaasRole())
+                .map(e -> {
+                    RoleResp role = RoleResp.builder().build();
+                    BeanUtils.copyProperties(e, role);
+                    role.setRoleId(e.getId());
+                    role.setCooperateShipType(e.getProductUnitType());
+                    role.setOuId(e.getOwnerOuId());
+
+                    assembleRoleFeatureResource(e, role);
+
+                    assembleFeatureResourceRelation(e, role);
+                    return role;
+                })
+                .orElse(null));
+        return result;
+    }
+
+    private void assembleRoleFeatureResource(SaasRoleUserV2DTO.SaasRole fromSaasRole, RoleResp roleResp) {
+        if (CollectionUtils.isEmpty(fromSaasRole.getSaasPermissions())) {
+            return;
+        }
+        roleResp.setRoleFeatureResources(JSONArray.parseArray(JSON.toJSONString(fromSaasRole.getSaasPermissions()),
+                RoleFeatureResourceResp.class));
+    }
+
+    private void assembleFeatureResourceRelation(SaasRoleUserV2DTO.SaasRole saasRoleRes, RoleResp roleResp) {
+
+        if (CollectionUtils.isEmpty(saasRoleRes.getPermissionRelations())) {
+            return;
+        }
+
+        roleResp.setFeatureResourceRelations(JSONArray.parseArray(JSON.toJSONString(saasRoleRes.getPermissionRelations()),
+                FeatureResourceRelationResp.class));
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/controller/v2/UserPermissionController.java

@@ -0,0 +1,217 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.foundation.exception.Axssert;
+import cn.axzo.foundation.result.ApiResult;
+import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
+import cn.axzo.tyr.client.model.roleuser.req.ListRoleUserRelationParam;
+import cn.axzo.tyr.feign.api.UserPermissionApi;
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.ListPermissionUserReq;
+import cn.axzo.tyr.feign.req.ListUserPermissionReq;
+import cn.axzo.tyr.feign.resp.PermissionUserResp;
+import cn.axzo.tyr.feign.resp.UserPermissionResp;
+import cn.axzo.tyr.server.service.PermissionService;
+import cn.axzo.tyr.server.service.PermissionTagService;
+import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.compress.utils.Lists;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.CollectionUtils;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import static cn.axzo.tyr.server.config.exception.BizResultCode.PARAM_ERROR;
+
+@Slf4j
+@RestController
+public class UserPermissionController implements UserPermissionApi {
+
+    @Autowired
+    private PermissionService permissionService;
+    @Autowired
+    private SaasRoleUserRelationService saasRoleUserRelationService;
+    @Autowired
+    private PermissionTagService permissionTagService;
+
+    @Override
+    public ApiResult<List<UserPermissionResp>> listUserPermission(ListUserPermissionReq req) {
+
+        check(req);
+
+        List<SaasRoleUserV2DTO> saasRoleUsers = listRoleUserRelation(req);
+
+        if (CollectionUtils.isEmpty(saasRoleUsers)) {
+            return ApiResult.success();
+        }
+
+        assembleTag(req);
+
+        // 按照最细的维度进行用户的权限解析，这样才能组装成其他维度的数据
+        List<PermissionService.UserParam> userParams = resolveUserParam(saasRoleUsers, req);
+
+        List<UserPermissionResp> userPermissionResps = permissionService.listUserPermission(PermissionService.ListUserPermissionParam.builder()
+                .featureCodes(req.getFeatureCodes())
+                .terminal(req.getTerminal())
+                .appType(req.getAppType())
+                .itemCode(req.getItemCode())
+                .users(userParams)
+                .build());
+
+        return ApiResult.success(userPermissionResps);
+    }
+
+    @Override
+    public ApiResult<List<PermissionUserResp>> listPermissionUser(ListPermissionUserReq req) {
+        return ApiResult.success(permissionService.listPermissionUser(req));
+    }
+
+    private void check(ListUserPermissionReq req) {
+
+        req.getUserPermissions().forEach(user -> {
+            if (Objects.nonNull(user.getPersonId()) && (Objects.nonNull(user.getIdentityId()) || Objects.nonNull(user.getIdentityType()))) {
+                throw PARAM_ERROR.toException(PARAM_ERROR.getErrorMessage(), "personId 和 identityId只能二选一");
+            }
+
+            Axssert.check(Objects.nonNull(user.getPersonId()) || Objects.nonNull(user.getIdentityId()),
+                    PARAM_ERROR, PARAM_ERROR.getErrorMessage(), "personId 和 identityId不能同时为空");
+
+            if (Objects.nonNull(user.getIdentityId())) {
+                Axssert.check(Objects.nonNull(user.getIdentityType()),
+                        PARAM_ERROR, PARAM_ERROR.getErrorMessage(), "identityType不能为空");
+            }
+        });
+    }
+
+    private List<SaasRoleUserV2DTO> listRoleUserRelation(ListUserPermissionReq req) {
+
+        List<ListRoleUserRelationParam.BatchPerson> batchPersons = req.getUserPermissions().stream()
+                .map(user -> ListRoleUserRelationParam.BatchPerson.builder()
+                        .personId(user.getPersonId())
+                        .identityId(user.getIdentityId())
+                        .identityType(Optional.ofNullable(user.getIdentityType())
+                                .map(IdentityTypeEnum::getCode)
+                                .orElse(null))
+                        .workspaceId(user.getWorkspaceId())
+                        .ouId(user.getOuId())
+                        .resourceId(user.getNodeId())
+                        .build())
+                .collect(Collectors.toList());
+
+        ListRoleUserRelationParam listRoleUserRelationParam = ListRoleUserRelationParam.builder()
+                .batchPersons(batchPersons)
+                .needRole(true)
+                .build();
+
+        return saasRoleUserRelationService.listV2(listRoleUserRelationParam).stream()
+                .filter(e -> e.getSaasRole() != null)
+                .collect(Collectors.toList());
+    }
+
+    private Set<PermissionService.RoleParam> resolveRoles(Map<String, List<SaasRoleUserV2DTO>> personIdRoleUserMap,
+                                                          Map<String, List<SaasRoleUserV2DTO>> identityIdRoleUserMap,
+                                                          ListUserPermissionReq.UserPermission userPermission) {
+        List<SaasRoleUserV2DTO> roleUsers = Lists.newArrayList();
+        if (Objects.nonNull(userPermission.getPersonId())) {
+            roleUsers = personIdRoleUserMap.get(userPermission.buildPersonKey());
+        }
+
+        if (Objects.nonNull(userPermission.getIdentityId()) && Objects.nonNull(userPermission.getIdentityType())) {
+            roleUsers = identityIdRoleUserMap.get(userPermission.buildIdentityKey());
+        }
+
+        if (CollectionUtils.isEmpty(roleUsers)) {
+            return Collections.emptySet();
+        }
+
+        return roleUsers.stream()
+                .filter(e -> {
+                    if (Objects.isNull(userPermission.getNodeId())) {
+                        return true;
+                    }
+                    return Objects.equals(userPermission.getNodeId(), e.getResourceId());
+                })
+                .map(e ->
+                        PermissionService.RoleParam.builder()
+                                .roleId(e.getRoleId())
+                                .roleType(RoleTypeEnum.fromValue(e.getSaasRole().getRoleType()).orElse(null))
+                                .cooperateShipTypes(e.getSaasRole().getProductUnitType())
+                                .build())
+                .collect(Collectors.toSet());
+    }
+
+    private List<PermissionService.UserParam> resolveUserParam(List<SaasRoleUserV2DTO> saasRoleUsers,
+                                                               ListUserPermissionReq req) {
+
+        // 因为入参可能是根据personId来查询也可能根据identityId和identityType来查询，这里就需要组装多个map方便解析用户的role信息
+        Map<String, List<SaasRoleUserV2DTO>> personIdRoleUserMap = saasRoleUsers.stream()
+                .collect(Collectors.groupingBy(e -> e.getSaasRoleUser().getPersonId() + "_" + e.getWorkspaceId() + "_" + e.getOuId()));
+
+        Map<String, List<SaasRoleUserV2DTO>> identityIdRoleUserMap = saasRoleUsers.stream()
+                .collect(Collectors.groupingBy(e -> e.getIdentityId() + "_" + e.getIdentityType() + "_" + e.getWorkspaceId() + "_" + e.getOuId()));
+
+        return req.getUserPermissions().stream()
+                .map(user ->
+                        PermissionService.UserParam.builder()
+                                .identityId(user.getIdentityId())
+                                .identityType(Optional.ofNullable(user.getIdentityType())
+                                        .map(IdentityTypeEnum::getCode)
+                                        .orElse(null))
+                                .personId(user.getPersonId())
+                                .workspaceId(user.getWorkspaceId())
+                                .ouId(user.getOuId())
+                                .nodeId(user.getNodeId())
+                                .roles(resolveRoles(personIdRoleUserMap, identityIdRoleUserMap, user))
+                                .tags(user.getPermissionTags())
+                                .build())
+                .collect(Collectors.toList());
+
+    }
+
+    private void assembleTag(ListUserPermissionReq req) {
+
+        List<ListUserPermissionReq.UserPermission> needResolveTags = req.getUserPermissions().stream()
+                .filter(e -> CollectionUtils.isEmpty(e.getPermissionTags()))
+                .collect(Collectors.toList());
+
+        if (CollectionUtils.isEmpty(needResolveTags)) {
+            return;
+        }
+
+        PermissionTagService.ResolvePermissionTagParam resolvePermissionTagParam = PermissionTagService.ResolvePermissionTagParam.builder()
+                .personPermissions(needResolveTags.stream()
+                        .map(e -> PermissionTagService.PersonPermission.builder()
+                                .workspaceId(e.getWorkspaceId())
+                                .ouId(e.getOuId())
+                                .personId(e.getPersonId())
+                                .build())
+                        .collect(Collectors.toList()))
+                .build();
+        Map<String, PermissionTagService.ResolvePermissionDTO> resolvePermissions = permissionTagService.resolvePermissionTag(resolvePermissionTagParam).stream()
+                .collect(Collectors.toMap(e -> e.getPersonId() + "_" + e.getOuId() + "_" + e.getWorkspaceId(), Function.identity()));
+
+        req.getUserPermissions().forEach(e -> {
+            if (!CollectionUtils.isEmpty(e.getPermissionTags())) {
+                return;
+            }
+
+            PermissionTagService.ResolvePermissionDTO resolvePermissionDTO = resolvePermissions.get(e.getPersonId() + "_" + e.getOuId() + "_" + e.getWorkspaceId());
+            if (Objects.isNull(resolvePermissionDTO)) {
+                return;
+            }
+
+            e.setPermissionTags(resolvePermissionDTO.getTags().stream()
+                    .map(tag -> RolePermissionTagEnum.valueOf(tag.name()))
+                    .collect(Collectors.toSet()));
+        });
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/SaasFeatureDao.java

@@ -18,7 +18,6 @@ public interface SaasFeatureDao extends IService<SaasFeature> {
 
     void updateChildrenPath(Long updater, String pathPrefix, String newPathPrefix);
 
-    List<SaasFeature> listByParentId(Long parentId);
 
     void updateSort(Long permissionId, int switchIndex);
 
@@ -31,7 +30,5 @@ public interface SaasFeatureDao extends IService<SaasFeature> {
 
     List<SaasFeature> getChildByParentId(Long parentId);
 
-    List<SaasFeature> listAllFeature();
-
     List<SaasFeature> listAllFeatureByTerminal(String terminal);
 }

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/SaasPageElementFeatureResourceRelationDao.java

@@ -58,13 +58,4 @@ public class SaasPageElementFeatureResourceRelationDao extends ServiceImpl<SaasP
                 .set(Objects.nonNull(operatorId), SaasPageElementFeatureResourceRelation::getUpdateBy, operatorId)
                 .update();
     }
-
-    public void updateGroupCode(String oldGroupCode, String newGroupCode, String terminal) {
-        lambdaUpdate()
-                .eq(SaasPageElementFeatureResourceRelation::getIsDelete, DeleteEnum.NORMAL.getValue())
-                .eq(SaasPageElementFeatureResourceRelation::getTerminal, terminal)
-                .eq(SaasPageElementFeatureResourceRelation::getPageElementCode, oldGroupCode)
-                .set(SaasPageElementFeatureResourceRelation::getPageElementCode, newGroupCode)
-                .update();
-    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/SaasRoleDao.java

@@ -60,27 +60,6 @@ public class SaasRoleDao extends ServiceImpl<SaasRoleMapper, SaasRole> {
 		return this.getBaseMapper().listRoleUserByPermissionGroup(permissionGroupIdList, workspaceIds);
 	}
 
-	public SaasRole findRoleByTypeAndWorkspaceIdAndOuId(String roleType, Long workspaceId,
-														Long ouId) {
-		return this.lambdaQuery()
-				.eq(SaasRole::getRoleType, roleType)
-				.eq(SaasRole::getWorkspaceId, workspaceId)
-				.eq(SaasRole::getOwnerOuId, ouId)
-				.eq(SaasRole::getIsDelete, TableIsDeleteEnum.NORMAL.value)
-				.last(" limit 1").one();
-	}
-
-	public List<SaasRole> listCommonRoleByNameAndWorkspaceIdAndOuId(String name, Long workspaceId,
-																	Long ouId) {
-		return lambdaQuery().eq(SaasRole::getName, name)
-				.eq(SaasRole::getWorkspaceId, workspaceId)
-				.eq(SaasRole::getOwnerOuId, ouId)
-				.eq(SaasRole::getRoleType, RoleTypeEnum.COMMON.getValue())
-				.eq(SaasRole::getIsDelete, TableIsDeleteEnum.NORMAL.value)
-				.select(SaasRole::getId)
-				.list();
-	}
-
 	public List<SaasRole> findRoleByName(Long ouId, Long workspaceId,List<Long> roleIds,
 										 List<String> roleNames) {
 		return this.lambdaQuery().select(SaasRole::getId, SaasRole::getName, SaasRole::getRoleType)
@@ -109,7 +88,7 @@ public class SaasRoleDao extends ServiceImpl<SaasRoleMapper, SaasRole> {
 			return new ArrayList<>();
 		}
 		return lambdaQuery().in(BaseEntity::getId, roleIds)
-				.eq(BaseEntity::getIsDelete, TableIsDeleteEnum.NORMAL)
+				.eq(BaseEntity::getIsDelete, TableIsDeleteEnum.NORMAL.value)
 				.eq(SaasRole::getRoleType, RoleTypeEnum.INIT.getValue())
 				.list();
 	}

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/SaasRoleGroupDao.java

@@ -54,13 +54,6 @@ public class SaasRoleGroupDao extends ServiceImpl<SaasRoleGroupMapper, SaasRoleG
             .update();
     }
 
-    /** 弃用category_code 通过角色组层级实现 **/
-    @Deprecated
-    public List<SaasRoleGroup> listByCategoryCode(List<String> categoryCode) {
-        return lambdaQuery().eq(BaseEntity::getIsDelete, 0L)
-                .in(SaasRoleGroup::getCategoryCode, categoryCode).list();
-    }
-
     public List<SaasRoleGroup> listByCodes(List<String> codes) {
         return lambdaQuery().eq(BaseEntity::getIsDelete, 0L)
                 .in(SaasRoleGroup::getCode, codes).list();

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/SaasRoleUserRelationDao.java

@@ -2,7 +2,6 @@ package cn.axzo.tyr.server.repository.dao;
 
 import cn.axzo.basics.common.constant.enums.TableIsDeleteEnum;
 import cn.axzo.karma.client.model.dto.ProjectWorkBaseDTO;
-import cn.axzo.pokonyan.config.mybatisplus.BaseEntity;
 import cn.axzo.tyr.client.model.BaseWorkspaceModel;
 import cn.axzo.tyr.client.model.enums.IdentityType;
 import cn.axzo.tyr.client.model.enums.SaasJobTypeEnum;
@@ -32,33 +31,6 @@ public class SaasRoleUserRelationDao extends ServiceImpl<SaasRoleUserRelationMap
 	@Autowired
 	private SaasRoleUserRelationMapper saasRoleUserRelationMapper;
 
-	public List<SaasRoleUserRelation> query(Long identityId, Integer identityType, Long workspaceId, Long ouId) {
-		return this.lambdaQuery()
-				.eq(SaasRoleUserRelation::getIdentityId, identityId)
-				.eq(SaasRoleUserRelation::getIdentityType, identityType)
-				.eq(null != workspaceId, SaasRoleUserRelation::getWorkspaceId, workspaceId)
-				.eq(null != ouId, SaasRoleUserRelation::getOuId, ouId)
-				.eq(BaseEntity::getIsDelete, TableIsDeleteEnum.NORMAL.value)
-				.list();
-	}
-
-	public List<SaasRoleUserRelation> queryByPersonId(Long personId,  Long workspaceId, Long ouId) {
-		return this.lambdaQuery()
-				.eq(SaasRoleUserRelation::getNaturalPersonId, personId)
-				.eq(null != workspaceId, SaasRoleUserRelation::getWorkspaceId, workspaceId)
-				.eq(null != ouId, SaasRoleUserRelation::getOuId, ouId)
-				.eq(BaseEntity::getIsDelete, TableIsDeleteEnum.NORMAL.value)
-				.list();
-	}
-
-
-	public void deleteByRoleId(List<Long> roleId) {
-		lambdaUpdate()
-			.in(SaasRoleUserRelation::getRoleId,roleId)
-			.set(BaseEntity::getIsDelete,TableIsDeleteEnum.DELETE.value)
-			.update();
-	}
-
 	public void deleteById(List<Long> ids) {
 		if (CollUtil.isEmpty(ids)) {
 			return;
@@ -171,11 +143,6 @@ public class SaasRoleUserRelationDao extends ServiceImpl<SaasRoleUserRelationMap
 
 	public void delByIdentityAndWorkspaceIdAndOuId(Long identityId, cn.axzo.basics.profiles.common.enums.IdentityType identityType, Long workspaceId, Long ouId) {
 		getBaseMapper().deleteButNotAdminAndNotLeader(workspaceId, ouId, identityId, identityType, null);
-//		lambdaUpdate().eq(SaasRoleUserRelation::getWorkspaceId, workspaceId)
-//				.eq(SaasRoleUserRelation::getIdentityId, identityId)
-//				.eq(SaasRoleUserRelation::getIdentityType, identityType)
-//				.eq(SaasRoleUserRelation::getOuId, ouId)
-//				.set(SaasRoleUserRelation::getIsDelete, TableIsDeleteEnum.DELETE.value).update();
 	}
 
 	public List<SaasRoleUserRelation> findBathSuperAdmin(List<ProjectWorkBaseDTO> req) {

tyr-server/src/main/java/cn/axzo/tyr/server/repository/dao/impl/SaasFeatureDaoImpl.java

@@ -28,11 +28,6 @@ public class SaasFeatureDaoImpl extends ServiceImpl<SaasFeatureMapper, SaasFeatu
         this.baseMapper.updateChildrenPath(updater, pathPrefix, newPathPrefix);
     }
 
-    @Override
-    public List<SaasFeature> listByParentId(Long parentId) {
-        return this.baseMapper.selectList(new LambdaQueryWrapper<SaasFeature>().eq(SaasFeature::getParentId, parentId));
-    }
-
     @Override
     public void updateSort(Long permissionId, int sort) {
         this.update(new LambdaUpdateWrapper<SaasFeature>().set(SaasFeature::getSort, sort).eq(SaasFeature::getId, permissionId));
@@ -61,11 +56,6 @@ public class SaasFeatureDaoImpl extends ServiceImpl<SaasFeatureMapper, SaasFeatu
                 .eq(BaseEntity::getIsDelete,TableIsDeleteEnum.NORMAL).list();
     }
 
-    @Override
-    public List<SaasFeature> listAllFeature() {
-        return lambdaQuery().eq(BaseEntity::getIsDelete, 0).list();
-    }
-
     @Override
     public List<SaasFeature> listAllFeatureByTerminal(String terminal) {
         return lambdaQuery()

tyr-server/src/main/java/cn/axzo/tyr/server/repository/mapper/SaasFeatureResourceMapper.java

@@ -2,8 +2,6 @@ package cn.axzo.tyr.server.repository.mapper;
 
 import cn.axzo.tyr.server.repository.entity.SaasFeatureResource;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
-import org.apache.ibatis.annotations.Param;
-import org.apache.ibatis.annotations.Update;
 
 /**
  * <p>
@@ -15,8 +13,4 @@ import org.apache.ibatis.annotations.Update;
  */
 public interface SaasFeatureResourceMapper extends BaseMapper<SaasFeatureResource> {
 
-    @Update("UPDATE saas_feature_resource" +
-            " SET path = REPLACE(path, #{oldPath}, #{newPath})" +
-            " WHERE is_delete = 0 AND path LIKE CONCAT(#{oldPath}, '%')")
-    void replacePath(@Param("oldPath") String oldPath, @Param("newPath") String newPath);
 }

tyr-server/src/main/java/cn/axzo/tyr/server/repository/mapper/SaasRoleMapper.java

@@ -25,8 +25,6 @@ public interface SaasRoleMapper extends BaseMapper<SaasRole> {
     Page<SaasRole> pageQueryForOUWorkspace(IPage<SaasRole> page, Long ouId, Long workspaceId, Integer workspaceJoinType,
                                            Integer superAdminWorkspaceType);
 
-    List<SaasRole> listForOUWorkspace(Long ouId, Long workspaceId, Integer workspaceJoinType);
-
     List<RoleFeatureRelation> listFeatureByIds(@Param("roleIds") Set<Long> roleIds, @Param("featureIds") Set<Long> featureIds);
 }
 

tyr-server/src/main/java/cn/axzo/tyr/server/service/OperateLogService.java

@@ -0,0 +1,8 @@
+package cn.axzo.tyr.server.service;
+
+import cn.axzo.log.platform.client.model.req.LogAddReq;
+
+public interface OperateLogService {
+
+    void save(LogAddReq param);
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/PermissionPointService.java

@@ -51,14 +51,6 @@ public interface PermissionPointService {
 
     List<PermissionPointTreeNode> queryList(PermissionPointListQueryRequest request);
 
-    /**
-     * 指定条件查询出子级的所以父级
-     * 并将父级平铺返回
-     * @param request
-     * @return
-     */
-    List<PermissionPointTreeNode> listTreeNodesFlatChild(PermissionPointTreeQueryReq request);
-
     /** 根据code查询权限点, terminal可为空 **/
     List<SaasFeature> listNodeWithChildrenByCode(String featureCode, String terminal);
 

tyr-server/src/main/java/cn/axzo/tyr/server/service/PermissionService.java

@@ -0,0 +1,101 @@
+package cn.axzo.tyr.server.service;
+
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.ListPermissionUserReq;
+import cn.axzo.tyr.feign.resp.PermissionUserResp;
+import cn.axzo.tyr.feign.resp.UserPermissionResp;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+public interface PermissionService {
+
+    /**
+     * 查询用户的权限
+     * @param param
+     * @return
+     */
+    List<UserPermissionResp> listUserPermission(ListUserPermissionParam param);
+
+    /**
+     * 查询有权限的用户
+     * @param param
+     * @return
+     */
+    List<PermissionUserResp> listPermissionUser(ListPermissionUserReq param);
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class ListUserPermissionParam {
+        private List<UserParam> users;
+
+        /**
+         * 权限code
+         * 没有指定就查询所有的权限，指定了就查询指定code的权限
+         */
+        private Set<String> featureCodes;
+
+        /**
+         * 端信息
+         */
+        private String terminal;
+
+        /**
+         * app类型（APP:原生，H5:h5页面）
+         */
+        private String appType;
+
+        /**
+         * 项目code（H5会拉取项目下所有的元素）
+         * APP上每个应用的code，数据库叫itemCode，保持一致
+         */
+        private String itemCode;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class UserParam {
+
+        private Long identityId;
+
+        private Integer identityType;
+
+        private Long personId;
+
+        private Set<RolePermissionTagEnum> tags;
+
+        private Set<RoleParam> roles;
+
+        private Long workspaceId;
+
+        private Long ouId;
+
+        private Long nodeId;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class RoleParam {
+        private Long roleId;
+
+        private RoleTypeEnum roleType;
+
+        /**
+         * 产品单位类型
+         * 1:总包 2:建设单位 3:监理单位 4:劳务分包 5:专业分包 6:OMS通用 7:企业通用 8:企业内班组 9:项目内班组
+         */
+        private Integer cooperateShipTypes;
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/ProductPermissionCacheService.java

@@ -62,6 +62,22 @@ public interface ProductPermissionCacheService {
         private Set<Long> productIds;
 
         private Set<String> featureCodes;
+
+        /**
+         * 端信息
+         */
+        private String terminal;
+
+        /**
+         * app类型（APP:原生，H5:h5页面）
+         */
+        private String appType;
+
+        /**
+         * 项目code（H5会拉取项目下所有的元素）
+         * APP上每个应用的code，数据库叫itemCode，保持一致
+         */
+        private String itemCode;
     }
 
     @Data
@@ -93,10 +109,5 @@ public interface ProductPermissionCacheService {
          * 项目code（H5会拉取项目下所有的元素）
          */
         private String itemCode;
-
-        /**
-         * 客户端版本号
-         */
-        private Integer version;
     }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/ProductService.java

@@ -1,6 +1,7 @@
 package cn.axzo.tyr.server.service;
 
 import cn.axzo.basics.common.page.PageResult;
+import cn.axzo.foundation.page.PageResp;
 import cn.axzo.framework.domain.web.result.ApiPageResult;
 import cn.axzo.framework.domain.web.result.ApiResult;
 import cn.axzo.tyr.client.model.product.ProductAddReq;
@@ -15,7 +16,10 @@ import cn.axzo.tyr.client.model.req.UpdateProductStatusReq;
 import cn.axzo.tyr.client.model.res.GovernmentTerminalResp;
 import cn.axzo.tyr.client.model.res.SaasProductResp;
 import cn.axzo.tyr.client.model.res.WorkspaceProductResp;
+import cn.axzo.tyr.feign.req.PageProductReq;
+import cn.axzo.tyr.feign.resp.ProductResp;
 import cn.axzo.tyr.server.repository.entity.ProductModule;
+import com.baomidou.mybatisplus.extension.service.IService;
 
 import java.util.List;
 
@@ -25,7 +29,7 @@ import java.util.List;
  * @author wangli
  * @since 2023/9/7 14:21
  */
-public interface ProductService {
+public interface ProductService extends IService<ProductModule> {
     ApiResult<List<ProductVO>> list(ProductSearchListReq req);
 
 
@@ -61,4 +65,6 @@ public interface ProductService {
      * @param req
      */
     Long productModuleCreate(SaasProductSaveOrUpdateReq req);
+
+    PageResp<ProductResp> pageV2(PageProductReq req);
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasPgroupPermissionRelationService.java

@@ -1,7 +1,9 @@
 package cn.axzo.tyr.server.service;
 
 import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
 import cn.axzo.tyr.client.model.req.PagePgroupPermissionRelationReq;
+import cn.axzo.tyr.client.model.res.SaasFeatureResourceResp;
 import cn.axzo.tyr.client.model.vo.SaveOrUpdateRoleVO;
 import cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation;
 import com.baomidou.mybatisplus.extension.service.IService;
@@ -10,14 +12,16 @@ import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.Date;
 import java.util.List;
+import java.util.Set;
 
 public interface SaasPgroupPermissionRelationService extends IService<SaasPgroupPermissionRelation> {
     void saveOrUpdate(UpsertPermissionRelationParam param);
 
-    PageResp<SaasPgroupPermissionRelation> page(PagePgroupPermissionRelationReq param);
+    PageResp<SaasPgroupPermissionRelationDTO> page(PagePgroupPermissionRelationReq param);
 
-    List<SaasPgroupPermissionRelation> list(PagePgroupPermissionRelationReq param);
+    List<SaasPgroupPermissionRelationDTO> list(PagePgroupPermissionRelationReq param);
 
     void delete(DeleteParam param);
 
@@ -61,4 +65,64 @@ public interface SaasPgroupPermissionRelationService extends IService<SaasPgroup
     class DeleteParam {
         private List<Long> ids;
     }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class SaasPgroupPermissionRelationDTO {
+
+        private Long id;
+
+        private Date createAt;
+
+        private Date updateAt;
+
+        /**
+         * 权限集id
+         */
+        private Long groupId;
+        /**
+         * 功能id
+         */
+        private Long featureId;
+
+        /**
+         * 创建者
+         */
+        private Long createBy;
+
+        /**
+         * 更新者
+         */
+        private Long updateBy;
+
+        /**
+         * 关联类型（0：saas_feature,1:saas_feature_resource）
+         * 暂时的，因为cms端会有灰度，数据从saas_feature和saas_feature_resource出
+         */
+        private Integer type;
+
+        /**
+         * 菜单资源类型1-菜单 2-页面 3-应用入口  4-组件
+         * 冗余菜单资源类型，是在cms端查询菜单和页面时，方便快速查询
+         * type = 0时，featureType是saas_feature表的featureType
+         * type = 1时，featureType是saas_feature_resource表的featureType
+         * 后面会全部切换到saas_feature_resource
+         * FeatureResourceType
+         */
+        private Integer featureType;
+
+        /**
+         * featureId所在端
+         */
+        private String terminal;
+
+        /**
+         * 标签
+         */
+        private Set<RolePermissionTagEnum> tags;
+
+        private SaasFeatureResourceResp saasFeatureResource;
+    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasPgroupRoleRelationService.java

@@ -0,0 +1,141 @@
+package cn.axzo.tyr.server.service;
+
+import cn.axzo.foundation.dao.support.wrapper.CriteriaField;
+import cn.axzo.foundation.dao.support.wrapper.Operator;
+import cn.axzo.foundation.page.IPageReq;
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.client.common.enums.FeatureResourceType;
+import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.client.model.res.SaasRoleRes;
+import cn.axzo.tyr.server.repository.entity.SaasPgroupRoleRelation;
+import com.baomidou.mybatisplus.extension.service.IService;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import lombok.experimental.SuperBuilder;
+
+import java.util.Date;
+import java.util.List;
+import java.util.Set;
+
+public interface SaasPgroupRoleRelationService extends IService<SaasPgroupRoleRelation> {
+
+    List<SaasPgroupRoleRelationDTO> list(ListSaasPgroupRoleRelationParam param);
+
+    PageResp<SaasPgroupRoleRelationDTO> page(PageSaasPgroupRoleRelationParam param);
+
+    @Data
+    @SuperBuilder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class ListSaasPgroupRoleRelationParam {
+
+        @CriteriaField(field = "roleId", operator = Operator.IN)
+        private Set<Long> roleIds;
+
+        @CriteriaField(field = "groupId", operator = Operator.IN)
+        private Set<Long> groupIds;
+
+        @CriteriaField(ignore = true)
+        private Boolean needRole;
+
+        /**
+         * 查询featureResource，需要
+         * 组装在pgroupPermissionRelations.SaasFeatureResourceResp
+         */
+        @CriteriaField(ignore = true)
+        private Boolean needFeatureResource;
+
+        /**
+         * 只查询featureId跟pgroupId的关联关系记录
+         * 组装在pgroupPermissionRelations
+         */
+        @CriteriaField(ignore = true)
+        private Boolean needFeatureResourceRelation;
+
+        /**
+         * 根据权限标签去过滤角色对应的权限，
+         * 只有在needPermission = true时才生效
+         */
+        @CriteriaField(ignore = true)
+        private Set<RolePermissionTagEnum> permissionTags;
+
+        /**
+         * 端，查询权限点时，会根据端过滤，增加效率，目前只有CMS端的新版本才冗余了端
+         */
+        @CriteriaField(ignore = true)
+        private String terminal;
+
+        @CriteriaField(ignore = true)
+        private List<Long> featureIds;
+
+        /**
+         * 查询菜单树节点类型
+         */
+        @CriteriaField(ignore = true)
+        private List<FeatureResourceType> featureResourceTypes;
+
+        /**
+         * 新旧feature
+         */
+        @CriteriaField(ignore = true)
+        private Integer type;
+    }
+
+    @SuperBuilder
+    @Data
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class PageSaasPgroupRoleRelationParam extends ListSaasPgroupRoleRelationParam implements IPageReq {
+
+        @CriteriaField(ignore = true)
+        Integer page;
+
+        @CriteriaField(ignore = true)
+        Integer pageSize;
+
+        /**
+         * 排序：使用示例，createTime__DESC
+         */
+        @CriteriaField(ignore = true)
+        List<String> sort;
+    }
+
+    @Builder
+    @Data
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class SaasPgroupRoleRelationDTO {
+
+        private Long id;
+
+        private Date createAt;
+
+        private Date updateAt;
+
+        /**
+         * 角色id
+         */
+        private Long roleId;
+
+        /**
+         * 权限集id
+         */
+        private Long groupId;
+
+        /**
+         * 创建者
+         */
+        private Long createBy;
+
+        /**
+         * 更新者
+         */
+        private Long updateBy;
+
+        private SaasRoleRes saasRoleRes;
+
+        private List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> pgroupPermissionRelations;
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleGroupService.java

@@ -19,6 +19,7 @@ import java.util.List;
  */
 public interface SaasRoleGroupService extends IService<SaasRoleGroup> {
 
+	@Deprecated
     List<SaasRoleGroupVO> getList(QuerySaasRoleGroupReq req);
 
 	/**
@@ -26,6 +27,7 @@ public interface SaasRoleGroupService extends IService<SaasRoleGroup> {
 	 * @param req 角色分组参数
 	 * @return 角色分组列表
 	 */
+	@Deprecated
 	List<SaasRoleGroupVO> getRoleGroupList(QuerySaasRoleGroupReq req);
 
 
@@ -40,6 +42,7 @@ public interface SaasRoleGroupService extends IService<SaasRoleGroup> {
 	 * @param categoryCode
 	 * @return
 	 */
+	@Deprecated
 	List<SaasRoleGroupVO> listByCategoryCode(List<String> categoryCode);
 
 	/**
@@ -47,6 +50,7 @@ public interface SaasRoleGroupService extends IService<SaasRoleGroup> {
 	 * @param codes 角色组编码
 	 * @param type 1-仅查当前code 2-对应code角色组及子级角色组 3-仅对应code角色组的子级
 	 *  **/
+	@Deprecated
     List<SaasRoleGroup> listByCodes(List<String> codes, int type);
 
 	List<SaasRoleGroupDTO> list(ListSaasRoleGroupParam param);

tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleUserRelationService.java

@@ -1,7 +1,6 @@
 package cn.axzo.tyr.server.service;
 
 import cn.axzo.basics.profiles.common.enums.IdentityType;
-import cn.axzo.framework.domain.page.PageResp;
 import cn.axzo.tyr.client.model.permission.IdentityAndAccountDTO;
 import cn.axzo.tyr.client.model.permission.IdentityKey;
 import cn.axzo.tyr.client.model.permission.QueryIdentityByPermissionDTO;
@@ -10,11 +9,10 @@ import cn.axzo.tyr.client.model.req.QuerySuperAdminReq;
 import cn.axzo.tyr.client.model.req.UpdateUserJobReq;
 import cn.axzo.tyr.client.model.req.WorkspaceUpdateUserRoleDTO;
 import cn.axzo.tyr.client.model.res.SuperAminInfoResp;
-import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserDTO;
 import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
 import cn.axzo.tyr.client.model.roleuser.req.ListRoleUserRelationParam;
 import cn.axzo.tyr.client.model.roleuser.req.PageRoleUserRelationParam;
-import cn.axzo.tyr.client.model.roleuser.req.RoleUserParam;
+import cn.axzo.tyr.feign.req.UpsertUserRoleReq;
 import cn.axzo.tyr.server.repository.entity.SaasRoleUserRelation;
 import com.baomidou.mybatisplus.extension.service.IService;
 import lombok.AllArgsConstructor;
@@ -35,21 +33,10 @@ public interface SaasRoleUserRelationService extends IService<SaasRoleUserRelati
 
     cn.axzo.foundation.page.PageResp<SaasRoleUserV2DTO> page(PageRoleUserRelationParam param);
 
-    void upsert(UpsertParam param);
+    void upsert(UpsertUserRoleReq param);
 
     void batchRemove(BatchRemoveParam param);
 
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    class UpsertParam {
-
-        private List<SaasRoleUserRelation> saasRoleUserRelations;
-
-        private Long operator;
-    }
-
     @Data
     @Builder
     @NoArgsConstructor

tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleUserService.java

@@ -42,8 +42,6 @@ public interface SaasRoleUserService {
      */
     List<SuperAminInfoResp> batchSuperAdminList(List<SuperAdminParam> param);
 
-    List<SaasRoleUserRelation> listByRoleIds(List<Long> roleIds, Long ouId, Long workspaceId);
-
     /**
      * 删除单位参与的工作台的所有的人员与角色。 目前主要是用于移除参与单位的地方
      */

tyr-server/src/main/java/cn/axzo/tyr/server/service/WorkspaceProductService.java

@@ -14,16 +14,6 @@ import java.util.Set;
 
 public interface WorkspaceProductService {
 
-
-    List<WorkspaceProduct> listWorkspaceProduct(WorkspaceProductParam param);
-
-    /**
-     * 从缓存中查询项目的产品
-     * @param param
-     * @return
-     */
-    List<WorkspaceProduct> listWorkspaceProductCached(WorkspaceProductParam param);
-
     /**
      * 缓存项目的产品
      * @param param
@@ -32,11 +22,20 @@ public interface WorkspaceProductService {
 
     /**
      * 从缓存中查询项目的产品及产品的权限
+     * 没有切到：listWorkspacePermissionCached，后续有测试机会的时候切到listWorkspacePermissionCached
      * @param param
      * @return
      */
+    @Deprecated
     List<WorkspaceProductPermission> listWorkspaceProductPermissionCached(ListWorkspaceProductPermissionCacheParam param);
 
+    /**
+     * 从缓存中查询项目的权限
+     * @param param
+     * @return
+     */
+    List<WorkspaceProductPermission> listWorkspacePermissionCached(ListWorkspacePermissionCacheParam param);
+
     /**
      * 从缓存中查询项目的产品及产品的菜单信息
      * @param param
@@ -70,6 +69,63 @@ public interface WorkspaceProductService {
         private Set<Long> workspaceIds;
 
         private Set<String> featureCodes;
+
+        /**
+         * 端信息
+         */
+        private String terminal;
+
+        /**
+         * app类型（APP:原生，H5:h5页面）
+         */
+        private String appType;
+
+        /**
+         * 项目code（H5会拉取项目下所有的元素）
+         * APP上每个应用的code，数据库叫itemCode，保持一致
+         */
+        private String itemCode;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class ListWorkspacePermissionCacheParam {
+        private List<WorkspacePermission> workspacePermissions;
+    }
+
+    @Data
+    @Builder
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class WorkspacePermission {
+
+        /**
+         * 项目id
+         */
+        private Long workspaceId;
+
+        /**
+         * 权限code
+         */
+        private Set<String> featureCodes;
+
+        /**
+         * 端信息
+         */
+        private String terminal;
+
+        /**
+         * app类型（APP:原生，H5:h5页面）
+         */
+        private String appType;
+
+        /**
+         * 项目code（H5会拉取项目下所有的元素）
+         * APP上每个应用的code，数据库叫itemCode，保持一致
+         */
+        private String itemCode;
     }
 
     @Data

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/OperateLogServiceImpl.java

@@ -0,0 +1,36 @@
+package cn.axzo.tyr.server.service.impl;
+
+import cn.axzo.framework.jackson.utility.JSON;
+import cn.axzo.log.platform.client.feign.LogApi;
+import cn.axzo.log.platform.client.model.req.LogAddReq;
+import cn.axzo.tyr.server.service.OperateLogService;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
+
+import java.util.concurrent.ExecutorService;
+
+@Slf4j
+@Service
+public class OperateLogServiceImpl implements OperateLogService {
+
+    @Autowired
+    private LogApi logApi;
+    @Qualifier("asyncExecutor")
+    @Autowired
+    private ExecutorService asyncExecutor;
+
+    @Override
+    public void save(LogAddReq param) {
+
+        try {
+            // 目前操作日志的记录，不是核心流程，这个方法，不抛出异常，以免影响正常业务流程。
+            // 异步处理
+            asyncExecutor.submit(() -> logApi.addLog(param));
+        } catch (Throwable e) {
+            log.warn("OperateLogServiceImpl save caught exception, msg = {}, param = {}",
+                    e.getMessage(), JSON.toJSONString(param), e);
+        }
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/PermissionPointServiceImpl.java

@@ -659,18 +659,6 @@ public class PermissionPointServiceImpl implements PermissionPointService {
         return node;
     }
 
-
-    @Override
-    public List<PermissionPointTreeNode> listTreeNodesFlatChild(PermissionPointTreeQueryReq request) {
-        List<PermissionPointTreeNode> permissionPointTreeNodes = listTreeNodes(request);
-        //将树型结构打平
-        return permissionPointTreeNodes.stream().map(e -> {
-            e.flatChildren();
-            return e.getChildren();
-        }).flatMap(List::stream).collect(Collectors.toList());
-
-    }
-
     @Override
     public List<SaasFeature> listNodeWithChildrenByCode(String featureCode, String terminal) {
         return listNodeWithChildrenByCodes(Collections.singletonList(featureCode), terminal);

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/PermissionServiceImpl.java

@@ -0,0 +1,415 @@
+package cn.axzo.tyr.server.service.impl;
+
+import cn.axzo.tyr.client.model.req.ListIdentityFromPermissionReq;
+import cn.axzo.tyr.client.model.res.ListIdentityFromPermissionResp;
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.ListPermissionUserReq;
+import cn.axzo.tyr.feign.resp.PermissionResp;
+import cn.axzo.tyr.feign.resp.PermissionUserResp;
+import cn.axzo.tyr.feign.resp.UserPermissionResp;
+import cn.axzo.tyr.server.service.PermissionService;
+import cn.axzo.tyr.server.service.ProductPermissionCacheService;
+import cn.axzo.tyr.server.service.RolePermissionCacheService;
+import cn.axzo.tyr.server.service.SaasFeatureResourceService;
+import cn.axzo.tyr.server.service.TyrSaasAuthService;
+import cn.axzo.tyr.server.service.WorkspaceProductService;
+import cn.axzo.tyr.server.util.FeatureCodeUtil;
+import cn.hutool.core.collection.CollectionUtil;
+import com.alibaba.fastjson.JSONObject;
+import com.google.common.collect.Sets;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.compress.utils.Lists;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.util.CollectionUtils;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+@Slf4j
+@Service
+public class PermissionServiceImpl implements PermissionService {
+
+    @Autowired
+    private RolePermissionCacheService rolePermissionCacheService;
+    @Autowired
+    private WorkspaceProductService workspaceProductService;
+    @Autowired
+    private SaasFeatureResourceService saasFeatureResourceService;
+    @Autowired
+    private FeatureCodeUtil featureCodeUtil;
+    @Autowired
+    private TyrSaasAuthService tyrSaasAuthService;
+
+    /**
+     * 1、查询用户的角色
+     * 2、查询角色的权限
+     * 3、查询项目的权限
+     * 4、查找项目权限的端的所有菜单、可能菜单已经被删除，需要需要校验有权限id是否存在
+     * 5、解析超管、管理员角色的权限
+     * 6、解析普通角色的权限
+     * 7、解析免授权的权限
+     * 8、合并5、6、7的权限并返回
+     * 因为角色的单位类型要跟产品的单位类型去匹配、超管|管理员角色的权限是对应的产品的权限、普通角色的权限需要跟产品匹配
+     * 权限点指定是全部角色，则只需要产品勾选了权限即有权限
+     *
+     */
+    @Override
+    public List<UserPermissionResp> listUserPermission(ListUserPermissionParam param) {
+        if (CollectionUtils.isEmpty(param.getUsers())) {
+            return Collections.emptyList();
+        }
+
+        // 为了兼容新旧featureCode，这里根据featureCode去查询新旧featureCode的映射把新旧featureCode都组装起
+        Set<String> newFeatureCodes = featureCodeUtil.resolveFeatureCode(param.getFeatureCodes());
+        param.setFeatureCodes(newFeatureCodes);
+
+        // 查询项目的权限
+        Map<Long, List<ProductPermissionCacheService.PermissionDTO>> workspacePermissionMap = listWorkspacePermission(param);
+        if (Objects.isNull(workspacePermissionMap) || workspacePermissionMap.isEmpty()) {
+            return Collections.emptyList();
+        }
+
+        // 查询产品的端的所有菜单信息
+        List<SaasFeatureResourceService.SaasFeatureResourceCache> allFeatureResources = listAllSaasFeature(workspacePermissionMap);
+        if (CollectionUtils.isEmpty(allFeatureResources)) {
+            return Collections.emptyList();
+        }
+
+        Set<Long> effectFeatureIds = allFeatureResources.stream()
+                .map(SaasFeatureResourceService.SaasFeatureResourceCache::getFeatureId)
+                .collect(Collectors.toSet());
+        // 查询角色的权限
+        Map<Long, List<RolePermissionCacheService.PermissionDTO>> rolePermissions = listRolePermission(param);
+
+        // 按照人去解析每个人的权限，因为每个人的tag可能不一样
+        return param.getUsers().stream()
+                .map(user -> {
+                    if (CollectionUtils.isEmpty(user.getRoles())) {
+                        return null;
+                    }
+
+                    List<ProductPermissionCacheService.PermissionDTO> workspacePermissions = workspacePermissionMap.get(user.getWorkspaceId());
+                    if (CollectionUtils.isEmpty(workspacePermissions)) {
+                        return null;
+                    }
+
+                    // 匹配用户在场时的管理员角色的权限，管理员角色的权限是对应的项目的权限
+                    Set<PermissionResp> adminRolePermissions = resolveAdminRolePermission(workspacePermissions, user);
+
+                    // 匹配普通角色的权限，需要根据角色配置的权限和项目的权限去匹配(单位类型、tag等信息)
+                    Set<PermissionResp> normalRolePermissionPoints = resolveNormalRolePermission(workspacePermissions, user, rolePermissions);
+
+                    Set<PermissionResp> notAuthPermissionPoints = resolveNotAuthPermission(workspacePermissions, allFeatureResources);
+
+                    //组装返回值
+                    //是否超管
+
+                    boolean isSuperAdmin = user.getRoles().stream()
+                            .anyMatch(f -> Objects.equals(RoleTypeEnum.SUPER_ADMIN, f.getRoleType()));
+                    UserPermissionResp result = UserPermissionResp.builder()
+                            .identityId(user.getIdentityId())
+                            .identityType(IdentityTypeEnum.fromCode(user.getIdentityType())
+                                    .map(IdentityTypeEnum::name)
+                                    .orElse(null))
+                            .personId(user.getPersonId())
+                            .ouId(user.getOuId())
+                            .workspaceId(user.getWorkspaceId())
+                            .nodeId(user.getNodeId())
+                            .isSuperAdmin(isSuperAdmin)
+                            .build();
+
+                    Set<PermissionResp> allPermissionPoints = Sets.newHashSet();
+                    allPermissionPoints.addAll(adminRolePermissions);
+                    allPermissionPoints.addAll(normalRolePermissionPoints);
+                    allPermissionPoints.addAll(notAuthPermissionPoints);
+
+
+                    result.setPermissions(allPermissionPoints.stream()
+                            .filter(e -> effectFeatureIds.contains(e.getFeatureId()))
+                            .collect(Collectors.toList()));
+                    return result;
+                })
+                .filter(Objects::nonNull)
+                .collect(Collectors.toList());
+    }
+
+    /**
+     * 1、根据权限code及相关条件查询项目的权限
+     * 2、根据项目查询所有role
+     * 3、根据权限code查询有权限的角色信息
+     * 4、根据项目的权限和role查询角色的权限信息
+     * 5、解析有权限的admin role
+     * 6、解析有权限的非admin role
+     * 7、解析有离场权限的admin role
+     * 8、聚合6，7，8的角色，根据角色查询用户
+     * 9、根据用户查询用户的tags
+     * 10、
+     * @param param
+     * @return
+     */
+    @Override
+    public List<PermissionUserResp> listPermissionUser(ListPermissionUserReq param) {
+        // 使用原来接口，因为目前没有做用户维度的权限缓存，对源代码优化成本高,效果不显著，没有多大意义，
+        List<ListIdentityFromPermissionReq> list = param.getPermissionUsers().stream()
+                .map(e -> JSONObject.parseObject(JSONObject.toJSONString(e), ListIdentityFromPermissionReq.class))
+                .collect(Collectors.toList());
+        List<ListIdentityFromPermissionResp> listIdentityFromPermissions = tyrSaasAuthService.batchListIdentityFromPermission(list);
+
+        return listIdentityFromPermissions.stream()
+                .map(e -> PermissionUserResp.builder()
+                        .workspaceId(e.getWorkspaceId())
+                        .ouId(e.getOuId())
+                        .users(Optional.ofNullable(e.getUsers())
+                                .map(users -> users.stream()
+                                        .map(user -> PermissionUserResp.User.builder()
+                                                .identityId(user.getIdentityId())
+                                                .identityType(user.getIdentityType())
+                                                .personId(user.getPersonalId())
+                                                .isSuperAdmin(user.isSuperAdmin())
+                                                .build())
+                                        .collect(Collectors.toSet()))
+                                .orElseGet(Sets::newHashSet))
+                        .build())
+                .collect(Collectors.toList());
+    }
+
+    /**
+     * 只有查询在职权限时才能直接根据管理员角色和产品去匹配
+     * 因为离场权限，管理员角色会配置管理员角色对应的离场权限
+     * @param workspacePermissions
+     * @param userParam
+     * @return
+     */
+    private Set<PermissionResp> resolveAdminRolePermission(List<ProductPermissionCacheService.PermissionDTO> workspacePermissions,
+                                                           UserParam userParam) {
+
+        if (!CollectionUtils.isEmpty(userParam.getTags()) && !userParam.getTags().contains(RolePermissionTagEnum.JOINED)) {
+            log.info("admin role permission:tags not null and no joined tag");
+            return Collections.emptySet();
+        }
+
+        //超管和管理员角色
+        List<RoleParam> adminRoles = userParam.getRoles().stream()
+                .filter(role -> Objects.nonNull(role.getRoleType()) && role.getRoleType().isAdmin())
+                .collect(Collectors.toList());
+        if (CollectionUtil.isEmpty(adminRoles)) {
+            log.info("no admin roles");
+            return Collections.emptySet();
+        }
+
+        Set<String> cooperateShipTypes = adminRoles.stream()
+                .map(RoleParam::getCooperateShipTypes)
+                .map(String::valueOf)
+                .collect(Collectors.toSet());
+
+        return workspacePermissions.stream()
+                .filter(e -> cooperateShipTypes.contains(e.getCooperateType()))
+                .map(e -> PermissionResp.builder()
+                        .featureCode(e.getFeatureCode())
+                        .featureId(e.getFeatureId())
+                        .terminal(e.getTerminal())
+                        .featureType(e.getFeatureType())
+                        .build())
+                .collect(Collectors.toSet());
+    }
+
+
+    private Set<PermissionResp> resolveNotAuthPermission(List<ProductPermissionCacheService.PermissionDTO> productPermissions,
+                                                         List<SaasFeatureResourceService.SaasFeatureResourceCache> allFeatures) {
+
+        // 因为有权授权权限的权限点，就需要有所有上层权限点的权限
+        List<SaasFeatureResourceService.SaasFeatureResourceCache> notAuthFeatures = allFeatures.stream()
+                .filter(SaasFeatureResourceService.SaasFeatureResourceCache::isNotAuth)
+                .collect(Collectors.toList());
+
+        Set<Long> notAuthFeatureIds = notAuthFeatures.stream()
+                .map(SaasFeatureResourceService.SaasFeatureResourceCache::getFeatureId)
+                .collect(Collectors.toSet());
+
+        Set<Long> notAuthParentFeatureIds = notAuthFeatures.stream()
+                .map(SaasFeatureResourceService.SaasFeatureResourceCache::getParentIds)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        notAuthFeatureIds.addAll(notAuthParentFeatureIds);
+        if (CollectionUtils.isEmpty(notAuthFeatureIds)) {
+            return Collections.emptySet();
+        }
+
+        return productPermissions.stream()
+                .filter(productPermission -> notAuthFeatureIds.contains(productPermission.getFeatureId()))
+                .map(e -> PermissionResp.builder()
+                        .featureCode(e.getFeatureCode())
+                        .featureId(e.getFeatureId())
+                        .terminal(e.getTerminal())
+                        .featureType(e.getFeatureType())
+                        .build())
+                .collect(Collectors.toSet());
+    }
+
+    /**
+     * 根据角色的协同关系类型去匹配权限
+     * @param workspacePermissions
+     * @param userParam
+     * @param rolePermissionMap
+     * @return
+     */
+    private Set<PermissionResp> resolveNormalRolePermission(List<ProductPermissionCacheService.PermissionDTO> workspacePermissions,
+                                                            UserParam userParam,
+                                                            Map<Long, List<RolePermissionCacheService.PermissionDTO>> rolePermissionMap) {
+
+        Map<String, List<PermissionResp>> workspacePermissionMap = workspacePermissions.stream()
+                .collect(Collectors.groupingBy(ProductPermissionCacheService.PermissionDTO::getCooperateType,
+                        Collectors.mapping(e -> PermissionResp.builder()
+                                .featureCode(e.getFeatureCode())
+                                .featureId(e.getFeatureId())
+                                .terminal(e.getTerminal())
+                                .featureType(e.getFeatureType())
+                                .build(), Collectors.toList())));
+
+        return userParam.getRoles().stream()
+                .map(role -> {
+                    List<RolePermissionCacheService.PermissionDTO> rolePermissions = rolePermissionMap.get(role.getRoleId());
+                    if (CollectionUtils.isEmpty(rolePermissions)) {
+                        return null;
+                    }
+
+                    List<PermissionResp> workspacePermissionsMatched = workspacePermissionMap.get(role.getCooperateShipTypes().toString());
+                    if (CollectionUtils.isEmpty(workspacePermissionsMatched)) {
+                        return null;
+                    }
+
+                    Set<String> rolePermissionFeatureCodes = rolePermissions.stream()
+                                    .filter(Objects::nonNull)
+                                    .filter(rolePermission -> {
+                                        if (CollectionUtils.isEmpty(userParam.getTags()) || CollectionUtils.isEmpty(rolePermission.getTags())) {
+                                            return true;
+                                        }
+                                        Set<String> paramTags = userParam.getTags().stream()
+                                                .map(RolePermissionTagEnum::name)
+                                                .collect(Collectors.toSet());
+
+                                        Set<String> cacheTags = rolePermission.getTags().stream()
+                                                .map(cn.axzo.tyr.client.model.enums.RolePermissionTagEnum::name)
+                                                .collect(Collectors.toSet());
+                                        return !Sets.intersection(paramTags, cacheTags).isEmpty();
+                                    })
+                                    .map(RolePermissionCacheService.PermissionDTO::getFeatureCode)
+                                    .collect(Collectors.toSet());
+
+                    if (CollectionUtils.isEmpty(rolePermissionFeatureCodes)) {
+                        return null;
+                    }
+
+                    return workspacePermissionsMatched.stream()
+                            .filter(productPermission -> rolePermissionFeatureCodes.contains(productPermission.getFeatureCode()))
+                            .collect(Collectors.toSet());
+
+                })
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+    }
+
+    private Map<Long, List<RolePermissionCacheService.PermissionDTO>> listRolePermission(ListUserPermissionParam param) {
+        Set<Long> roleIds = param.getUsers().stream()
+                .map(UserParam::getRoles)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .map(RoleParam::getRoleId)
+                .collect(Collectors.toSet());
+        if (CollectionUtils.isEmpty(roleIds)) {
+            return Collections.emptyMap();
+        }
+
+        RolePermissionCacheService.ListRolePermissionParam listRolePermissionParam = RolePermissionCacheService.ListRolePermissionParam.builder()
+                .roleIds(roleIds)
+                .featureCodes(param.getFeatureCodes())
+                .build();
+        return rolePermissionCacheService.list(listRolePermissionParam);
+    }
+
+    private Map<Long, List<ProductPermissionCacheService.PermissionDTO>> listWorkspacePermission(ListUserPermissionParam param) {
+
+        Set<Long> workspaceIds = param.getUsers().stream()
+                .map(UserParam::getWorkspaceId)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+        if (CollectionUtils.isEmpty(workspaceIds)) {
+            return Collections.emptyMap();
+        }
+
+        WorkspaceProductService.ListWorkspacePermissionCacheParam listWorkspacePermissionCacheParam = WorkspaceProductService.ListWorkspacePermissionCacheParam
+                .builder()
+                .workspacePermissions(workspaceIds.stream()
+                        .map(workspaceId -> WorkspaceProductService.WorkspacePermission.builder()
+                                .workspaceId(workspaceId)
+                                .featureCodes(param.getFeatureCodes())
+                                .appType(param.getAppType())
+                                .itemCode(param.getItemCode())
+                                .terminal(param.getTerminal())
+                                .build())
+                        .collect(Collectors.toList()))
+                .build();
+        return workspaceProductService.listWorkspacePermissionCached(listWorkspacePermissionCacheParam)
+                .stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId,
+                        e -> Optional.ofNullable(e.getProductPermissions())
+                                .map(productPermissions -> productPermissions.stream()
+                                        .map(WorkspaceProductService.ProductPermission::getPermissions)
+                                        .filter(Objects::nonNull)
+                                        .flatMap(Collection::stream)
+                                        .collect(Collectors.toList()))
+                                .orElseGet(Lists::newArrayList)));
+    }
+
+//    private Map<Long, List<ProductPermissionCacheService.PermissionDTO>> listWorkspacePermission(ListPermissionUserReq param) {
+//
+//        WorkspaceProductService.ListWorkspacePermissionCacheParam listWorkspacePermissionCacheParam = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+//                .workspacePermissions(param.getPermissionUsers().stream()
+//                        .map(e -> WorkspaceProductService.WorkspacePermission.builder()
+//                                .workspaceId(e.getWorkspaceId())
+//                                .featureCodes(Sets.newHashSet(e.getFeatureCode()))
+//                                .terminal(e.getTerminal())
+//                                .build())
+//                        .collect(Collectors.toList()))
+//                .build();
+//        return workspaceProductService.listWorkspacePermissionCached(listWorkspacePermissionCacheParam)
+//                .stream()
+//                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId,
+//                        e -> Optional.ofNullable(e.getProductPermissions())
+//                                .map(productPermissions -> productPermissions.stream()
+//                                        .map(WorkspaceProductService.ProductPermission::getPermissions)
+//                                        .filter(Objects::nonNull)
+//                                        .flatMap(Collection::stream)
+//                                        .collect(Collectors.toList()))
+//                                .orElseGet(Lists::newArrayList)));
+//    }
+
+    private List<SaasFeatureResourceService.SaasFeatureResourceCache> listAllSaasFeature(Map<Long, List<ProductPermissionCacheService.PermissionDTO>> workspacePermissions) {
+
+        Set<String> terminals = workspacePermissions.values().stream()
+                .flatMap(Collection::stream)
+                .map(ProductPermissionCacheService.PermissionDTO::getTerminal)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+
+        SaasFeatureResourceService.ListSaasFeatureResourceCache listSaasFeatureResourceCache = SaasFeatureResourceService.ListSaasFeatureResourceCache.builder()
+                .terminals(terminals)
+                .build();
+        return saasFeatureResourceService.listCache(listSaasFeatureResourceCache)
+                .values()
+                .stream()
+                .flatMap(Collection::stream)
+                .collect(Collectors.toList());
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/ProductPermissionCacheServiceImpl.java

@@ -18,6 +18,7 @@ import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cloud.context.config.annotation.RefreshScope;
 import org.springframework.stereotype.Service;
@@ -85,18 +86,20 @@ public class ProductPermissionCacheServiceImpl implements ProductPermissionCache
                     .collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue().orElseGet(Lists::newArrayList)));
         } catch (ExecutionException ex) {
             log.error("list product cache permission error:{} error", param.getProductIds(), ex);
-            // 外面有做降级
             throw new ServiceException("查询产品权限缓存异常");
         }
 
-        if (CollectionUtils.isEmpty(param.getFeatureCodes())) {
-            return productPermissions;
-        }
-
         return productPermissions.entrySet()
                 .stream()
                 .map(e -> Pair.of(e.getKey(), e.getValue().stream()
-                        .filter(permission -> param.getFeatureCodes().contains(permission.getFeatureCode()))
+                        .filter(permission -> CollectionUtils.isEmpty(param.getFeatureCodes())
+                                || param.getFeatureCodes().contains(permission.getFeatureCode()))
+                        .filter(permission -> StringUtils.isBlank(param.getTerminal())
+                                || Objects.equals(permission.getTerminal(), param.getTerminal()))
+                        .filter(permission -> StringUtils.isBlank(param.getAppType())
+                                || Objects.equals(permission.getAppType(), param.getAppType()))
+                        .filter(permission -> StringUtils.isBlank(param.getItemCode())
+                                || Objects.equals(permission.getItemCode(), param.getItemCode()))
                         .collect(Collectors.toList()))
                 )
                 .filter(e -> !CollectionUtils.isEmpty(e.getValue()))

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/ProductServiceImpl.java

@@ -5,9 +5,12 @@ import cn.axzo.basics.common.page.PageResult;
 import cn.axzo.basics.common.util.AssertUtil;
 import cn.axzo.basics.profiles.api.UserProfileServiceApi;
 import cn.axzo.basics.profiles.dto.basic.PersonProfileDto;
+import cn.axzo.foundation.dao.support.converter.PageConverter;
+import cn.axzo.foundation.dao.support.mysql.QueryWrapperHelper;
 import cn.axzo.framework.domain.page.PageResp;
 import cn.axzo.framework.domain.web.result.ApiPageResult;
 import cn.axzo.framework.domain.web.result.ApiResult;
+import cn.axzo.framework.jackson.utility.JSON;
 import cn.axzo.pokonyan.config.mybatisplus.BaseEntity;
 import cn.axzo.pudge.core.service.ServiceException;
 import cn.axzo.tyr.client.common.enums.PermissionRelationOperateLogSceneEnum;
@@ -32,6 +35,8 @@ import cn.axzo.tyr.client.model.req.UpdateProductStatusReq;
 import cn.axzo.tyr.client.model.res.GovernmentTerminalResp;
 import cn.axzo.tyr.client.model.res.SaasProductResp;
 import cn.axzo.tyr.client.model.res.WorkspaceProductResp;
+import cn.axzo.tyr.feign.req.PageProductReq;
+import cn.axzo.tyr.feign.resp.ProductResp;
 import cn.axzo.tyr.server.model.RelationOperateLogProductBindResourceDO;
 import cn.axzo.tyr.server.repository.dao.ProductModuleDao;
 import cn.axzo.tyr.server.repository.dao.SaasFeatureResourceDao;
@@ -39,6 +44,7 @@ import cn.axzo.tyr.server.repository.entity.ProductModule;
 import cn.axzo.tyr.server.repository.entity.SaasFeatureResource;
 import cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelationOperateLog;
 import cn.axzo.tyr.server.repository.entity.SaasProductModuleFeatureRelation;
+import cn.axzo.tyr.server.repository.mapper.ProductModuleMapper;
 import cn.axzo.tyr.server.service.ProductFeatureRelationService;
 import cn.axzo.tyr.server.service.ProductService;
 import cn.axzo.tyr.server.service.SaasBasicDictService;
@@ -50,8 +56,10 @@ import cn.azxo.framework.common.constatns.Constants;
 import cn.hutool.core.collection.CollectionUtil;
 import com.alibaba.fastjson.JSONObject;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.conditions.query.LambdaQueryChainWrapper;
+import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
 import lombok.RequiredArgsConstructor;
@@ -82,7 +90,7 @@ import java.util.stream.Collectors;
 @Slf4j
 @RequiredArgsConstructor
 @Service
-public class ProductServiceImpl implements ProductService {
+public class ProductServiceImpl extends ServiceImpl<ProductModuleMapper, ProductModule> implements ProductService {
 
     /** 政务端前缀 **/
     private static final String PREFIX_TERMINAL_GA = "NT_PC_GA_";
@@ -643,4 +651,18 @@ public class ProductServiceImpl implements ProductService {
         productModuleDao.save(product);
         return product;
     }
+
+    @Override
+    public cn.axzo.foundation.page.PageResp<ProductResp> pageV2(PageProductReq req) {
+        QueryWrapper<ProductModule> wrapper = QueryWrapperHelper.fromBean(req, ProductModule.class);
+        wrapper.eq("is_delete", 0);
+
+        IPage<ProductModule> page = this.page(PageConverter.toMybatis(req, ProductModule.class), wrapper);
+
+        return PageConverter.toResp(page, this::from);
+    }
+
+    private ProductResp from(ProductModule productModule) {
+        return JSON.parseObject(JSON.toJSONString(productModule), ProductResp.class);
+    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/RoleServiceImpl.java

@@ -87,12 +87,14 @@ import cn.axzo.tyr.server.service.RoleService;
 import cn.axzo.tyr.server.service.SaasFeatureResourceService;
 import cn.axzo.tyr.server.service.SaasPgroupPermissionRelationOperateLogService;
 import cn.axzo.tyr.server.service.SaasPgroupPermissionRelationService;
+import cn.axzo.tyr.server.service.SaasPgroupRoleRelationService;
 import cn.axzo.tyr.server.service.SaasRoleGroupRelationService;
 import cn.axzo.tyr.server.service.SaasRoleGroupService;
 import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
 import cn.axzo.tyr.server.util.RpcInternalUtil;
 import cn.axzo.tyr.server.utils.RpcExternalUtil;
 import cn.azxo.framework.common.constatns.Constants;
+import cn.azxo.framework.common.utils.LogUtil;
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.collection.CollectionUtil;
@@ -100,6 +102,7 @@ import cn.hutool.core.collection.ListUtil;
 import cn.hutool.core.lang.Assert;
 import cn.hutool.core.lang.Pair;
 import cn.hutool.core.util.StrUtil;
+import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
@@ -212,6 +215,8 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
     private MqProducer mqProducer;
     @Autowired
     private WorkspaceApi workspaceApi;
+    @Autowired
+    private SaasPgroupRoleRelationService saasPgroupRoleRelationService;
 
     private static final String TARGET_TYPE = "saasFeatureResourceId";
 
@@ -1391,13 +1396,18 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
 
     @Override
     public List<SaasRoleRes> list(ListRoleReq param) {
-        return PageConverter.drainAll(pageNumber -> {
         PageRoleReq pageParam = PageRoleReq.builder().build();
         BeanUtils.copyProperties(param, pageParam);
-            pageParam.setPage(pageNumber);
-            pageParam.setPageSize(10000);
-            return page(pageParam);
-        });
+        pageParam.setPage(1);
+        pageParam.setPageSize(5000);
+        List<SaasRoleRes> data = page(pageParam).getData();
+
+        // XXX：list接口返回数据太大，为了不影响业务，先返回。同时输出error日志以便告警，研发排查请求来源和业务是否正确
+        if (data.size() > 5000) {
+            LogUtil.error(LogUtil.ErrorLevel.P1, LogUtil.ErrorType.ERROR_BUSINESS,
+                    "单次请求role的条数过多，只返回5000条信息，请确认场景， param = {}", JSON.toJSONString(param));
+        }
+        return data;
     }
 
     @Override
@@ -1583,58 +1593,30 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
             return Collections.emptyMap();
         }
 
-        List<SaasPgroupRoleRelation> saasPgroupRoleRelations = saasPgroupRoleRelationDao.findByRoleIds(Lists.transform(saasRoles, SaasRole::getId));
-
-        if (CollectionUtils.isEmpty(saasPgroupRoleRelations)) {
-            return Collections.emptyMap();
-        }
-
-        List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations = saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
-                .groupIds(Lists.transform(saasPgroupRoleRelations, SaasPgroupRoleRelation::getGroupId))
+        return saasPgroupRoleRelationService.list(SaasPgroupRoleRelationService.ListSaasPgroupRoleRelationParam.builder()
+                        .roleIds(saasRoles.stream()
+                                .map(SaasRole::getId)
+                                .collect(Collectors.toSet()))
+                        .needFeatureResource(true)
+                        .permissionTags(param.getPermissionTags())
                         .featureIds(param.getFeatureIds())
-                .type(NEW_FEATURE)
-                .tags(param.getPermissionTags())
                         .terminal(param.getTerminal())
-                .build());
-        if (CollectionUtils.isEmpty(saasPgroupPermissionRelations)) {
-            return Collections.emptyMap();
-        }
-
-        Map<Long, ResourcePermission> resourcePermissions = saasFeatureResourceService.permissionQuery(ResourcePermissionQueryDTO.builder()
-                .ids(Lists.transform(saasPgroupPermissionRelations, SaasPgroupPermissionRelation::getFeatureId))
+                        .type(NEW_FEATURE)
+                        .featureResourceTypes(param.getFeatureResourceTypes())
                         .build())
                 .stream()
-                .collect(Collectors.toMap(ResourcePermission::getId, Function.identity()));
-
-        Map<Long, List<SaasPgroupPermissionRelation>> pgroupPermissions = saasPgroupPermissionRelations.stream()
-                .collect(Collectors.groupingBy(SaasPgroupPermissionRelation::getGroupId));
-
-        return saasPgroupRoleRelations.stream()
-                .map(e -> {
-                    List<SaasPgroupPermissionRelation> permissions = pgroupPermissions.get(e.getGroupId());
-                    if (CollectionUtils.isEmpty(permissions)) {
-                        return null;
-                    }
-
-                    return permissions.stream()
-                            .map(permission -> {
-                                ResourcePermission saasPermissionRes = resourcePermissions.get(permission.getFeatureId());
-                                return SaasPermissionWrapper.from(e, saasPermissionRes, permission);
-                            })
-                            .filter(Objects::nonNull)
-                            .collect(Collectors.toList());
-                })
-                .filter(Objects::nonNull)
-                .flatMap(Collection::stream)
-                .collect(Collectors.groupingBy(SaasPermissionWrapper::getRoleId,
-                        Collectors.mapping(e -> SaasPermissionRes.builder()
-                                        .id(e.getId())
-                                        .featureCode(e.getFeatureCode())
-                                        .tags(e.getTags())
-                                        .terminal(e.getTerminal())
-                                        .build(),
-                                Collectors.toList())));
-
+                .filter(e -> CollectionUtils.isNotEmpty(e.getPgroupPermissionRelations()))
+                .collect(Collectors.toMap(SaasPgroupRoleRelationService.SaasPgroupRoleRelationDTO::getRoleId,
+                        e -> e.getPgroupPermissionRelations().stream()
+                                .filter(relation -> Objects.nonNull(relation.getSaasFeatureResource()))
+                                .map(relation -> SaasPermissionRes.builder()
+                                    .id(relation.getSaasFeatureResource().getId())
+                                    .featureCode(relation.getSaasFeatureResource().getUniCode())
+                                    .uniCode(relation.getSaasFeatureResource().getUniCode())
+                                    .tags(relation.getTags())
+                                    .terminal(relation.getSaasFeatureResource().getTerminal())
+                                    .build())
+                            .collect(Collectors.toList())));
     }
 
     @Data
@@ -1650,6 +1632,8 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
          */
         private String featureCode;
 
+        private String uniCode;
+
         private Long roleId;
 
         private Set<RolePermissionTagEnum> tags;
@@ -1661,7 +1645,7 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
 
         public static SaasPermissionWrapper from(SaasPgroupRoleRelation saasPgroupRoleRelation,
                                                  ResourcePermission saasPermissionRes,
-                                                 SaasPgroupPermissionRelation saasPgroupPermissionRelation) {
+                                                 SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO saasPgroupPermissionRelation) {
             if (saasPermissionRes == null) {
                 return null;
             }
@@ -1671,6 +1655,7 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
                     .roleId(saasPgroupRoleRelation.getRoleId())
                     .tags(saasPgroupPermissionRelation.getTags())
                     .terminal(saasPermissionRes.getTerminal())
+                    .uniCode(saasPermissionRes.getFeatureCode())
                     .build();
         }
     }
@@ -1681,31 +1666,31 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
             return Collections.emptyMap();
         }
 
-        List<SaasRoleGroupRelation> roleGroupRelations = saasRoleGroupRelationDao.lambdaQuery()
-                .in(SaasRoleGroupRelation::getRoleId, Lists.transform(saasRoles, SaasRole::getId))
-                .eq(SaasRoleGroupRelation::getIsDelete, TableIsDeleteEnum.NORMAL.value)
-                .list();
+        List<SaasRoleGroupRelation> roleGroupRelations = saasRoleGroupRelationService.list(SaasRoleGroupRelationService.ListSaasRoleGroupRelationParam.builder()
+                .roleIds(Lists.transform(saasRoles, SaasRole::getId))
+                .build());
 
         if (CollectionUtils.isEmpty(roleGroupRelations)) {
             return Collections.emptyMap();
         }
-
-        Map<Long, SaasRoleGroup> saasRoleGroups = saasRoleGroupDao.query(QuerySaasRoleGroupReq.builder()
-                .ids(Lists.transform(roleGroupRelations, SaasRoleGroupRelation::getSaasRoleGroupId))
+        Map<Long, SaasRoleGroupDTO> saasRoleGroups = saasRoleGroupService.list(ListSaasRoleGroupParam.builder()
+                        .ids(roleGroupRelations.stream()
+                                .map(SaasRoleGroupRelation::getSaasRoleGroupId)
+                                .collect(Collectors.toSet()))
                         .build())
                 .stream()
-                .collect(Collectors.toMap(SaasRoleGroup::getId, Function.identity()));
+                .collect(Collectors.toMap(SaasRoleGroupDTO::getId, Function.identity()));
 
         return roleGroupRelations.stream()
                 .filter(e -> saasRoleGroups.get(e.getSaasRoleGroupId()) != null)
                 .collect(Collectors.groupingBy(SaasRoleGroupRelation::getRoleId,
                         Collectors.mapping(e -> {
-                            SaasRoleGroup saasRoleGroup = saasRoleGroups.get(e.getSaasRoleGroupId());
+                            SaasRoleGroupDTO saasRoleGroup = saasRoleGroups.get(e.getSaasRoleGroupId());
                             return toRoleGroupRes(saasRoleGroup);
                         }, Collectors.toList())));
     }
 
-    private SaasRoleGroupRes toRoleGroupRes(SaasRoleGroup saasRoleGroup) {
+    private SaasRoleGroupRes toRoleGroupRes(SaasRoleGroupDTO saasRoleGroup) {
         if (saasRoleGroup == null) {
             return null;
         }
@@ -1732,9 +1717,10 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
                 .collect(Collectors.toList());
         PagePgroupPermissionRelationReq pagePgroupPermissionRelationReq = PagePgroupPermissionRelationReq.builder()
                 .featureIds(featureIds)
+                .needRole(true)
                 .build();
         List<Long> groupIds = saasPgroupPermissionRelationService.list(pagePgroupPermissionRelationReq).stream()
-                .map(SaasPgroupPermissionRelation::getGroupId)
+                .map(SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getGroupId)
                 .collect(Collectors.toList());
 
         if (CollectionUtils.isEmpty(groupIds)) {
@@ -1971,7 +1957,7 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
             return Collections.emptyMap();
         }
 
-        List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations = saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
+        List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> saasPgroupPermissionRelations = saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
                 .groupIds(Lists.transform(saasPgroupRoleRelations, SaasPgroupRoleRelation::getGroupId))
                 .featureIds(param.getFeatureIds())
                 .type(OLD_FEATURE)
@@ -1981,17 +1967,17 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
             return Collections.emptyMap();
         }
 
-        List<Long> featureIds = Lists.transform(saasPgroupPermissionRelations, SaasPgroupPermissionRelation::getFeatureId);
+        List<Long> featureIds = Lists.transform(saasPgroupPermissionRelations, SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getFeatureId);
 
         Map<Long, SaasFeature> resourcePermissions = saasFeatureDao.listByIds(featureIds).stream()
                 .collect(Collectors.toMap(SaasFeature::getId, Function.identity()));
 
-        Map<Long, List<SaasPgroupPermissionRelation>> pgroupPermissions = saasPgroupPermissionRelations.stream()
-                .collect(Collectors.groupingBy(SaasPgroupPermissionRelation::getGroupId));
+        Map<Long, List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO>> pgroupPermissions = saasPgroupPermissionRelations.stream()
+                .collect(Collectors.groupingBy(SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getGroupId));
 
         return saasPgroupRoleRelations.stream()
                 .map(e -> {
-                    List<SaasPgroupPermissionRelation> permissions = pgroupPermissions.get(e.getGroupId());
+                    List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> permissions = pgroupPermissions.get(e.getGroupId());
                     if (CollectionUtils.isEmpty(permissions)) {
                         return null;
                     }
@@ -2027,46 +2013,27 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
             return Collections.emptyMap();
         }
 
-        List<SaasPgroupRoleRelation> saasPgroupRoleRelations = saasPgroupRoleRelationDao.findByRoleIds(Lists.transform(saasRoles, SaasRole::getId));
-
-        if (CollectionUtils.isEmpty(saasPgroupRoleRelations)) {
-            return Collections.emptyMap();
-        }
-
-        PagePgroupPermissionRelationReq pagePgroupPermissionRelationReq = PagePgroupPermissionRelationReq.builder()
-                .groupIds(Lists.transform(saasPgroupRoleRelations, SaasPgroupRoleRelation::getGroupId))
+        return saasPgroupRoleRelationService.list(SaasPgroupRoleRelationService.ListSaasPgroupRoleRelationParam.builder()
+                        .roleIds(saasRoles.stream()
+                                .map(SaasRole::getId)
+                                .collect(Collectors.toSet()))
+                        .needFeatureResourceRelation(true)
                         .featureIds(param.getFeatureIds())
                         .featureResourceTypes(param.getFeatureResourceTypes())
                         .type(param.getType())
                         .terminal(param.getTerminal())
-                .build();
-        List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations = saasPgroupPermissionRelationService.list(pagePgroupPermissionRelationReq);
-
-        Map<Long, List<SaasPgroupPermissionRelation>> pgroupPermissions = saasPgroupPermissionRelations.stream()
-                .collect(Collectors.groupingBy(SaasPgroupPermissionRelation::getGroupId));
-
-        return saasPgroupRoleRelations.stream()
-                .map(e -> {
-                    List<SaasPgroupPermissionRelation> permissionRelations = pgroupPermissions.get(e.getGroupId());
-                    if (CollectionUtils.isEmpty(permissionRelations)) {
-                        return null;
-                    }
-
-                    return permissionRelations.stream()
-                            .map(permissionRelation -> SaasPermissionRelationWrapper.from(e, permissionRelation))
-                            .filter(Objects::nonNull)
-                            .collect(Collectors.toList());
-                })
-                .filter(Objects::nonNull)
-                .flatMap(Collection::stream)
-                .collect(Collectors.groupingBy(SaasPermissionRelationWrapper::getRoleId,
-                        Collectors.mapping(e -> SaasPermissionRelationRes.builder()
-                                        .featureId(e.getFeatureId())
-                                        .type(e.getType())
-                                        .featureType(e.getFeatureType())
-                                        .tags(e.getTags())
-                                        .build(),
-                                Collectors.toList())));
+                        .build())
+                .stream()
+                .filter(e -> CollectionUtils.isNotEmpty(e.getPgroupPermissionRelations()))
+                .collect(Collectors.toMap(SaasPgroupRoleRelationService.SaasPgroupRoleRelationDTO::getRoleId,
+                        e -> e.getPgroupPermissionRelations().stream()
+                                .map(relation -> SaasPermissionRelationRes.builder()
+                                        .featureId(relation.getFeatureId())
+                                        .type(relation.getType())
+                                        .featureType(relation.getFeatureType())
+                                        .tags(relation.getTags())
+                                        .build())
+                                .collect(Collectors.toList())));
     }
 
     private void saveOperateLog(Long featureId, Long operatorId, List<FeatureRoleRelationReq.RelationRoleSettings> req) {
@@ -2154,52 +2121,4 @@ public class RoleServiceImpl extends ServiceImpl<SaasRoleMapper, SaasRole>
 
         saasPgroupPermissionRelationOperateLogService.batchSave(Lists.newArrayList(operateLog));
     }
-
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    static class SaasPermissionRelationWrapper {
-
-        /**
-         * 角色id
-         */
-        private Long roleId;
-
-        /**
-         * 菜单资源树节点id
-         */
-        private Long featureId;
-
-        /**
-         * 新旧菜单资源数标识
-         */
-        private Integer type;
-
-        /**
-         * 菜单资源树节点类型
-         */
-        private Integer featureType;
-
-        /**
-         * 权限点标签：
-         * 在职:JOINED
-         * 离场:LEAVE
-         */
-        private Set<RolePermissionTagEnum> tags;
-
-        public static SaasPermissionRelationWrapper from(SaasPgroupRoleRelation saasPgroupRoleRelation,
-                                                         SaasPgroupPermissionRelation permissionRelation) {
-            if (permissionRelation == null) {
-                return null;
-            }
-            return SaasPermissionRelationWrapper.builder()
-                    .roleId(saasPgroupRoleRelation.getRoleId())
-                    .featureId(permissionRelation.getFeatureId())
-                    .type(permissionRelation.getType())
-                    .featureType(permissionRelation.getFeatureType())
-                    .tags(permissionRelation.getTags())
-                    .build();
-        }
-    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/RoleUserService.java

@@ -367,29 +367,6 @@ public class RoleUserService implements SaasRoleUserService {
                 .eq(SaasRoleUserRelation::getOuId, ouId));
     }
 
-    private SaasRole findSuperAdmin(Long workspaceId, Long ouId, Integer workspaceType) {
-        //优先取租户超管 没有再取标准角色超管
-        //租户超管
-        return saasRoleDao
-                .findRoleByTypeAndWorkspaceIdAndOuId(RoleTypeEnum.SUPER_ADMIN.getValue(),
-                        workspaceId, ouId);
-//        if (superAdmin != null) {
-//            return superAdmin;
-//        }
-        //标准角超管
-//         String superAdminCode = superAdminCodes.get(workspaceType);
-//        if (StrUtil.isBlank(superAdminCode)) {
-//            throw new ServiceException("租户类型[" + workspaceType + "]未配置超管编码");
-//        }
-//        return saasRoleDao.lambdaQuery().eq(SaasRole::getRoleCode, superAdminCode).one();
-    }
-
-    private void checkRoleName(String name, Long workspaceId, Long ouId) {
-        List<SaasRole> saasRoles = saasRoleDao.listCommonRoleByNameAndWorkspaceIdAndOuId(name,
-                workspaceId, ouId);
-        AssertUtil.isEmpty(saasRoles, "已存在相同的角色名称，请更换角色名称");
-    }
-
     @Override
     public List<SuperAminInfoResp> batchSuperAdminList(List<SuperAdminParam> param) {
         // 兼容上线历史数据还没清洗的间隙，查询超管角色需要根据workspaceId和预设的超管一起
@@ -467,17 +444,6 @@ public class RoleUserService implements SaasRoleUserService {
         }).collect(Collectors.toList());
     }
 
-    @Override
-    public List<SaasRoleUserRelation> listByRoleIds(List<Long> roleIds, Long ouId, Long workspaceId) {
-        if (CollectionUtil.isEmpty(roleIds)) {
-            return new ArrayList<>();
-        }
-        return roleUserRelationDao.list(new LambdaQueryWrapper<SaasRoleUserRelation>()
-                .eq(Objects.nonNull(ouId), SaasRoleUserRelation::getOuId, ouId)
-                .eq(Objects.nonNull(workspaceId), SaasRoleUserRelation::getWorkspaceId, workspaceId)
-                .in(SaasRoleUserRelation::getRoleId, roleIds));
-    }
-
     @Override
     @Transactional(rollbackFor = Exception.class)
     public void removeWorkspaceOuAllUserRole(Long workspaceId, Long ouId) {

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasFeatureResourceServiceImpl.java

@@ -305,7 +305,7 @@ public class SaasFeatureResourceServiceImpl extends ServiceImpl<SaasFeatureResou
             return Collections.emptyMap();
         }
 
-        List<SaasPgroupPermissionRelation> relations = saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
+        List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> relations = saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
                 .featureIds(Lists.transform(descendants, SaasFeatureResource::getId))
                 .tags(detailFeatureResourceReq.getTags())
                 .build());
@@ -313,7 +313,7 @@ public class SaasFeatureResourceServiceImpl extends ServiceImpl<SaasFeatureResou
             return Collections.emptyMap();
         }
 
-        List<Long> groupIds = Lists.transform(relations, SaasPgroupPermissionRelation::getGroupId);
+        List<Long> groupIds = Lists.transform(relations, SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getGroupId);
         List<SaasPgroupRoleRelation> saasPgroupRoleRelations = saasPgroupRoleRelationDao.listByGroupIds(groupIds);
 
         if (CollectionUtils.isEmpty(saasPgroupRoleRelations)) {
@@ -1001,13 +1001,13 @@ public class SaasFeatureResourceServiceImpl extends ServiceImpl<SaasFeatureResou
                 .featureIds(Lists.transform(deleteFeatureResource, SaasFeatureResourceResp::getId))
                 .type(NEW_FEATURE)
                 .build();
-        List<SaasPgroupPermissionRelation> permissionRelations = saasPgroupPermissionRelationService.list(pagePgroupPermissionRelationReq);
+        List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO> permissionRelations = saasPgroupPermissionRelationService.list(pagePgroupPermissionRelationReq);
 
         if (CollectionUtils.isEmpty(permissionRelations)) {
             return;
         }
         SaasPgroupPermissionRelationService.DeleteParam deleteParam = SaasPgroupPermissionRelationService.DeleteParam.builder()
-                .ids(Lists.transform(permissionRelations, SaasPgroupPermissionRelation::getId))
+                .ids(Lists.transform(permissionRelations, SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getId))
                 .build();
         saasPgroupPermissionRelationService.delete(deleteParam);
     }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasPgroupPermissionRelationOperateLogServiceImpl.java

@@ -18,12 +18,12 @@ import cn.axzo.tyr.server.util.RpcInternalUtil;
 import cn.azxo.framework.common.constatns.Constants;
 import com.alibaba.fastjson.JSONObject;
 import com.google.common.collect.Lists;
-import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections4.CollectionUtils;
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.MDC;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
 import java.util.Collections;
@@ -39,7 +39,6 @@ import java.util.stream.Collectors;
  */
 @Slf4j
 @Service
-@AllArgsConstructor
 public class SaasPgroupPermissionRelationOperateLogServiceImpl implements SaasPgroupPermissionRelationOperateLogService {
 
     public static final String TABLE_NAME_FEATURE_RESOURCE = "saas_feature_resource";
@@ -50,10 +49,14 @@ public class SaasPgroupPermissionRelationOperateLogServiceImpl implements SaasPg
     public static final String TABLE_NAME_SAAS_ROLE_GROUP = "saas_role_group";
     public static final String TABLE_NAME_SAAS_FEATURE = "saas_feature";
 
-    private final SaasPgroupPermissionRelationOperateLogDao saasPgroupPermissionRelationOperateLogDao;
-    private final SaasRoleDao saasRoleDao;
-    private final UserProfileServiceApi userProfileServiceApi;
-    private final SaasRoleUserRelationService saasRoleUserRelationService;
+    @Autowired
+    private SaasPgroupPermissionRelationOperateLogDao saasPgroupPermissionRelationOperateLogDao;
+    @Autowired
+    private SaasRoleDao saasRoleDao;
+    @Autowired
+    private UserProfileServiceApi userProfileServiceApi;
+    @Autowired
+    private SaasRoleUserRelationService saasRoleUserRelationService;
 
     @Override
     public void batchSave(List<SaasPgroupPermissionRelationOperateLog> logs) {

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasPgroupPermissionRelationServiceImpl.java

@@ -7,9 +7,12 @@ import cn.axzo.foundation.page.PageResp;
 import cn.axzo.tyr.client.common.enums.FeatureResourceType;
 import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
 import cn.axzo.tyr.client.model.req.PagePgroupPermissionRelationReq;
+import cn.axzo.tyr.client.model.req.PageSaasFeatureResourceReq;
+import cn.axzo.tyr.client.model.res.SaasFeatureResourceResp;
 import cn.axzo.tyr.server.repository.dao.SaasPgroupPermissionRelationDao;
 import cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation;
 import cn.axzo.tyr.server.repository.mapper.SaasPgroupPermissionRelationMapper;
+import cn.axzo.tyr.server.service.SaasFeatureResourceService;
 import cn.axzo.tyr.server.service.SaasPgroupPermissionRelationService;
 import cn.hutool.core.collection.CollectionUtil;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
@@ -19,16 +22,18 @@ import com.google.common.collect.Lists;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.BooleanUtils;
+import org.springframework.beans.BeanUtils;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.StringUtils;
 
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
@@ -42,6 +47,8 @@ public class SaasPgroupPermissionRelationServiceImpl
 		implements SaasPgroupPermissionRelationService {
 	private final SaasPgroupPermissionRelationDao saasPgroupPermissionRelationDao;
 
+	private final SaasFeatureResourceService saasFeatureResourceService;
+
 	@Override
 	@Transactional(rollbackFor = Exception.class)
 	public void saveOrUpdate(UpsertPermissionRelationParam param) {
@@ -94,7 +101,7 @@ public class SaasPgroupPermissionRelationServiceImpl
 	}
 
 	@Override
-	public PageResp<SaasPgroupPermissionRelation> page(PagePgroupPermissionRelationReq param) {
+	public PageResp<SaasPgroupPermissionRelationDTO> page(PagePgroupPermissionRelationReq param) {
 		QueryWrapper<SaasPgroupPermissionRelation> wrapper = QueryWrapperHelper.fromBean(param, SaasPgroupPermissionRelation.class);
 		wrapper.eq("is_delete", 0);
 
@@ -117,11 +124,13 @@ public class SaasPgroupPermissionRelationServiceImpl
 
 		IPage<SaasPgroupPermissionRelation> page = this.page(PageConverter.toMybatis(param, SaasPgroupPermissionRelation.class), wrapper);
 
-		return PageConverter.toResp(page, Function.identity());
+		Map<Long, SaasFeatureResourceResp> saasFeatureResources = listSaasFeatureResource(page.getRecords(), param);
+
+		return PageConverter.toResp(page, (record) -> from(record, saasFeatureResources));
 	}
 
 	@Override
-	public List<SaasPgroupPermissionRelation> list(PagePgroupPermissionRelationReq param) {
+	public List<SaasPgroupPermissionRelationDTO> list(PagePgroupPermissionRelationReq param) {
 		return PageConverter.drainAll(pageNumber -> {
 			param.setPage(pageNumber);
 			// 减少io，后续优化
@@ -138,4 +147,29 @@ public class SaasPgroupPermissionRelationServiceImpl
 		}
 		this.removeByIds(param.getIds());
 	}
+
+	private SaasPgroupPermissionRelationDTO from(SaasPgroupPermissionRelation saasPgroupPermissionRelation,
+												 Map<Long, SaasFeatureResourceResp> saasFeatureResources) {
+		SaasPgroupPermissionRelationDTO result = SaasPgroupPermissionRelationDTO.builder().build();
+		BeanUtils.copyProperties(saasPgroupPermissionRelation, result);
+
+		result.setSaasFeatureResource(saasFeatureResources.get(result.getFeatureId()));
+		return result;
+	}
+
+	private Map<Long, SaasFeatureResourceResp> listSaasFeatureResource(List<SaasPgroupPermissionRelation> saasPgroupPermissionRelations,
+																	   PagePgroupPermissionRelationReq param) {
+		if (CollectionUtils.isEmpty(saasPgroupPermissionRelations) || BooleanUtils.isNotTrue(param.getNeedFeatureResource())) {
+			return Collections.emptyMap();
+		}
+
+		return saasFeatureResourceService.list(PageSaasFeatureResourceReq.builder()
+				.ids(saasPgroupPermissionRelations.stream()
+						.map(SaasPgroupPermissionRelation::getFeatureId)
+						.distinct()
+						.collect(Collectors.toList()))
+				.build())
+				.stream()
+				.collect(Collectors.toMap(SaasFeatureResourceResp::getId, Function.identity()));
+	}
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasPgroupRoleRelationServiceImpl.java

@@ -0,0 +1,116 @@
+package cn.axzo.tyr.server.service.impl;
+
+import cn.axzo.foundation.dao.support.converter.PageConverter;
+import cn.axzo.foundation.dao.support.mysql.QueryWrapperHelper;
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.client.model.req.ListRoleReq;
+import cn.axzo.tyr.client.model.req.PagePgroupPermissionRelationReq;
+import cn.axzo.tyr.client.model.res.SaasRoleRes;
+import cn.axzo.tyr.server.repository.entity.SaasPgroupRoleRelation;
+import cn.axzo.tyr.server.repository.mapper.SaasPgroupRoleRelationMapper;
+import cn.axzo.tyr.server.service.RoleService;
+import cn.axzo.tyr.server.service.SaasPgroupPermissionRelationService;
+import cn.axzo.tyr.server.service.SaasPgroupRoleRelationService;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
+import com.google.common.collect.Lists;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.BooleanUtils;
+import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.util.CollectionUtils;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import static cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation.NEW_FEATURE;
+
+@Slf4j
+@Service
+public class SaasPgroupRoleRelationServiceImpl extends ServiceImpl<SaasPgroupRoleRelationMapper, SaasPgroupRoleRelation>
+        implements SaasPgroupRoleRelationService {
+
+    @Autowired
+    private RoleService roleService;
+    @Autowired
+    private SaasPgroupPermissionRelationService saasPgroupPermissionRelationService;
+
+    @Override
+    public List<SaasPgroupRoleRelationDTO> list(ListSaasPgroupRoleRelationParam param) {
+        PageSaasPgroupRoleRelationParam pageParam = PageSaasPgroupRoleRelationParam.builder().build();
+        BeanUtils.copyProperties(param, pageParam);
+        return PageConverter.drainAll(pageNumber -> {
+            pageParam.setPage(pageNumber);
+            pageParam.setPageSize(1000);
+            return page(pageParam);
+        });
+    }
+
+    @Override
+    public PageResp<SaasPgroupRoleRelationDTO> page(PageSaasPgroupRoleRelationParam param) {
+        QueryWrapper<SaasPgroupRoleRelation> wrapper = QueryWrapperHelper.fromBean(param, SaasPgroupRoleRelation.class);
+        wrapper.eq("is_delete", 0);
+
+        IPage<SaasPgroupRoleRelation> page = this.page(PageConverter.toMybatis(param, SaasPgroupRoleRelation.class), wrapper);
+
+        Map<Long, SaasRoleRes> saasRoleRes = listRole(page.getRecords(), param);
+
+        Map<Long, List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO>> pgrouupPermissionRelations = listFeatureResource(page.getRecords(), param);
+
+        return PageConverter.toResp(page, (record) -> from(record, saasRoleRes, pgrouupPermissionRelations));
+    }
+
+    private SaasPgroupRoleRelationDTO from(SaasPgroupRoleRelation saasPgroupRoleRelation,
+                                           Map<Long, SaasRoleRes> saasRoleRes,
+                                           Map<Long, List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO>> pgrouupPermissionRelations) {
+        SaasPgroupRoleRelationDTO result = SaasPgroupRoleRelationDTO.builder().build();
+        BeanUtils.copyProperties(saasPgroupRoleRelation, result);
+
+        result.setSaasRoleRes(saasRoleRes.get(result.getRoleId()));
+
+        result.setPgroupPermissionRelations(pgrouupPermissionRelations.get(result.getGroupId()));
+        return result;
+    }
+
+    private Map<Long, SaasRoleRes> listRole(List<SaasPgroupRoleRelation> saasPgroupRoleRelations,
+                                            PageSaasPgroupRoleRelationParam param) {
+
+        if (CollectionUtils.isEmpty(saasPgroupRoleRelations) || BooleanUtils.isNotTrue(param.getNeedRole())) {
+            return Collections.emptyMap();
+        }
+
+        return roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.transform(saasPgroupRoleRelations, SaasPgroupRoleRelation::getRoleId))
+                .build())
+                .stream()
+                .collect(Collectors.toMap(SaasRoleRes::getId, Function.identity()));
+    }
+
+    private Map<Long, List<SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO>> listFeatureResource(List<SaasPgroupRoleRelation> saasPgroupRoleRelations,
+                                                                                                                     PageSaasPgroupRoleRelationParam param) {
+        if (CollectionUtils.isEmpty(saasPgroupRoleRelations) ||
+                (BooleanUtils.isNotTrue(param.getNeedFeatureResource()) && BooleanUtils.isNotTrue(param.getNeedFeatureResourceRelation()))) {
+            return Collections.emptyMap();
+        }
+
+        return saasPgroupPermissionRelationService.list(PagePgroupPermissionRelationReq.builder()
+                        .groupIds(saasPgroupRoleRelations.stream()
+                                .map(SaasPgroupRoleRelation::getGroupId)
+                                .distinct()
+                                .collect(Collectors.toList()))
+                        .needFeatureResource(param.getNeedFeatureResource())
+                        .featureIds(param.getFeatureIds())
+                        .tags(param.getPermissionTags())
+                        .type(param.getType())
+                        .terminal(param.getTerminal())
+                        .featureResourceTypes(param.getFeatureResourceTypes())
+                        .build())
+                .stream()
+                .collect(Collectors.groupingBy(SaasPgroupPermissionRelationService.SaasPgroupPermissionRelationDTO::getGroupId));
+    }
+}

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupRelationServiceImpl.java

@@ -15,6 +15,7 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
 import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -25,10 +26,10 @@ import java.util.stream.Collectors;
 
 @Slf4j
 @Service
-@RequiredArgsConstructor
 public class SaasRoleGroupRelationServiceImpl extends ServiceImpl<SaasRoleGroupRelationMapper, SaasRoleGroupRelation>
 		implements SaasRoleGroupRelationService {
-	private final SaasRoleGroupRelationDao saasRoleGroupRelationDao;
+	@Autowired
+	private SaasRoleGroupRelationDao saasRoleGroupRelationDao;
 
 	@Override
 	@Transactional(rollbackFor = Exception.class)

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupServiceImpl.java

@@ -8,6 +8,7 @@ import cn.axzo.foundation.exception.Axssert;
 import cn.axzo.foundation.page.PageResp;
 import cn.axzo.pokonyan.config.mybatisplus.BaseEntity;
 import cn.axzo.tyr.client.common.enums.PermissionRelationOperateLogSceneEnum;
+import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
 import cn.axzo.tyr.client.model.req.ListRoleReq;
 import cn.axzo.tyr.client.model.req.ListSaasRoleGroupParam;
 import cn.axzo.tyr.client.model.req.PageSaasRoleGroupParam;
@@ -45,6 +46,7 @@ import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.MDC;
 import org.springframework.beans.BeanUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -58,23 +60,29 @@ import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 
 import static cn.axzo.tyr.server.config.exception.BizResultCode.CANT_DELETE_ROLE_GROUP;
 
 @Slf4j
-@RequiredArgsConstructor
 @Service
 public class SaasRoleGroupServiceImpl extends ServiceImpl<SaasRoleGroupMapper, SaasRoleGroup>
         implements SaasRoleGroupService {
 
-    private final SaasRoleGroupMapper saasRoleGroupMapper;
-    private final SaasRoleGroupDao saasRoleGroupDao;
-    private final SaasRoleGroupRelationDao saasRoleGroupRelationDao;
-    private final SaasRoleGroupRelationService saasRoleGroupRelationService;
-    private final RoleService roleService;
-    private final SaasPgroupPermissionRelationOperateLogService saasPgroupPermissionRelationOperateLogService;
+    @Autowired
+    private SaasRoleGroupMapper saasRoleGroupMapper;
+    @Autowired
+    private SaasRoleGroupDao saasRoleGroupDao;
+    @Autowired
+    private SaasRoleGroupRelationDao saasRoleGroupRelationDao;
+    @Autowired
+    private SaasRoleGroupRelationService saasRoleGroupRelationService;
+    @Autowired
+    private RoleService roleService;
+    @Autowired
+    private SaasPgroupPermissionRelationOperateLogService saasPgroupPermissionRelationOperateLogService;
 
     @Override
     public List<SaasRoleGroupVO> getList(QuerySaasRoleGroupReq req) {
@@ -402,6 +410,11 @@ public class SaasRoleGroupServiceImpl extends ServiceImpl<SaasRoleGroupMapper, S
             });
         }
 
+        Set<Long> idByAncestorRoleGroupCode = resolveIdByAncestorRoleGroupCode(param);
+        if (Objects.nonNull(param.getAncestorRoleGroupCode()) && CollectionUtils.isEmpty(idByAncestorRoleGroupCode)) {
+            return param.toEmpty();
+        }
+
         IPage<SaasRoleGroup> page = this.page(PageConverter.toMybatis(param, SaasRoleGroup.class), wrapper);
 
         Map<Long, List<SaasRoleRes>> roles = listRoles(param, page.getRecords());
@@ -411,6 +424,28 @@ public class SaasRoleGroupServiceImpl extends ServiceImpl<SaasRoleGroupMapper, S
         return PageConverter.toResp(page, (record) -> from(record, roles, roleGroupRelations));
     }
 
+    private Set<Long> resolveIdByAncestorRoleGroupCode(PageSaasRoleGroupParam param) {
+        if (Objects.isNull(param.getAncestorRoleGroupCode())) {
+            return Collections.emptySet();
+        }
+        List<SaasRoleGroup> saasRoleGroups = this.lambdaQuery()
+                .eq(SaasRoleGroup::getCode, param.getAncestorRoleGroupCode())
+                .list();
+        if (CollectionUtils.isEmpty(saasRoleGroups)) {
+            return Collections.emptySet();
+        }
+
+        return this.list(ListSaasRoleGroupParam.builder()
+                .paths(saasRoleGroups.stream()
+                        .map(SaasRoleGroup::getPath)
+                        .collect(Collectors.toSet()))
+                .build())
+                .stream()
+                .map(SaasRoleGroupDTO::getId)
+                .collect(Collectors.toSet());
+
+    }
+
     private SaasRoleGroupDTO from(SaasRoleGroup saasRoleGroup,
                                   Map<Long, List<SaasRoleRes>> roles,
                                   Map<Long, List<RoleGroupRelationRes>> roleGroupRelations) {
@@ -438,12 +473,19 @@ public class SaasRoleGroupServiceImpl extends ServiceImpl<SaasRoleGroupMapper, S
         if (CollectionUtils.isEmpty(roleIds)) {
             return Collections.emptyMap();
         }
-        ListRoleReq listSaasRoleParam = ListRoleReq.builder().build();
-        listSaasRoleParam.setRoleIds(roleIds);
+        ListRoleReq listSaasRoleParam = ListRoleReq.builder()
+                .roleIds(roleIds)
+                .roleTypes(Optional.ofNullable(param.getRoleTypes())
+                        .map(e -> e.stream()
+                                .map(RoleTypeEnum::getValue)
+                                .collect(Collectors.toList()))
+                        .orElse(null))
+                .build();
         Map<Long, SaasRoleRes> roles = roleService.list(listSaasRoleParam).stream()
                 .collect(Collectors.toMap(SaasRoleRes::getId, Function.identity()));
 
         return saasRoleGroupRelations.stream()
+                .filter(e -> Objects.nonNull(roles.get(e.getRoleId())))
                 .collect(Collectors.groupingBy(SaasRoleGroupRelation::getSaasRoleGroupId,
                         LinkedHashMap::new,
                         Collectors.mapping(e -> roles.get(e.getRoleId()), Collectors.toList())));

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleUserRelationServiceImpl.java

@@ -15,10 +15,12 @@ import cn.axzo.framework.auth.domain.ContextInfo;
 import cn.axzo.framework.auth.domain.ContextInfoHolder;
 import cn.axzo.framework.rocketmq.Event;
 import cn.axzo.karma.client.model.dto.ProjectWorkBaseDTO;
+import cn.axzo.log.platform.client.model.req.LogAddReq;
 import cn.axzo.maokai.api.client.OrganizationalUnitApi;
 import cn.axzo.maokai.api.vo.response.OrganizationalUnitVO;
 import cn.axzo.pokonyan.config.mybatisplus.BaseEntity;
 import cn.axzo.pudge.core.service.ServiceException;
+import cn.axzo.tyr.client.common.enums.RoleResourceTypeEnum;
 import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
 import cn.axzo.tyr.client.model.enums.SaasJobTypeEnum;
 import cn.axzo.tyr.client.model.permission.IdentityAndAccountDTO;
@@ -26,27 +28,35 @@ import cn.axzo.tyr.client.model.permission.IdentityKey;
 import cn.axzo.tyr.client.model.permission.QueryIdentityByPermissionDTO;
 import cn.axzo.tyr.client.model.permission.SaasUserRoleExBO;
 import cn.axzo.tyr.client.model.req.ListRoleReq;
+import cn.axzo.tyr.client.model.req.ListSaasRoleGroupParam;
 import cn.axzo.tyr.client.model.req.QuerySuperAdminReq;
 import cn.axzo.tyr.client.model.req.UpdateUserJobReq;
 import cn.axzo.tyr.client.model.req.WorkspaceUpdateUserRoleDTO;
+import cn.axzo.tyr.client.model.res.RoleGroupRelationRes;
+import cn.axzo.tyr.client.model.res.SaasRoleGroupDTO;
 import cn.axzo.tyr.client.model.res.SaasRoleRes;
 import cn.axzo.tyr.client.model.res.SuperAminInfoResp;
 import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
 import cn.axzo.tyr.client.model.roleuser.req.ListRoleUserRelationParam;
 import cn.axzo.tyr.client.model.roleuser.req.PageRoleUserRelationParam;
+import cn.axzo.tyr.feign.req.UpsertUserRoleReq;
 import cn.axzo.tyr.server.common.util.NumUtil;
 import cn.axzo.tyr.server.config.MqProducer;
 import cn.axzo.tyr.server.event.payload.SaasRoleUserRelationRemovePayload;
+import cn.axzo.tyr.server.event.payload.SaasRoleUserRelationUpsertPayload;
 import cn.axzo.tyr.server.model.QueryUserRoleReq;
 import cn.axzo.tyr.server.repository.dao.SaasRoleDao;
 import cn.axzo.tyr.server.repository.dao.SaasRoleUserRelationDao;
 import cn.axzo.tyr.server.repository.entity.SaasRole;
 import cn.axzo.tyr.server.repository.entity.SaasRoleUserRelation;
 import cn.axzo.tyr.server.repository.mapper.SaasRoleUserRelationMapper;
+import cn.axzo.tyr.server.service.OperateLogService;
 import cn.axzo.tyr.server.service.RoleService;
+import cn.axzo.tyr.server.service.SaasRoleGroupService;
 import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
 import cn.axzo.tyr.server.util.RpcInternalUtil;
 import cn.hutool.core.collection.CollectionUtil;
+import com.alibaba.fastjson.JSONObject;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
@@ -72,9 +82,13 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static cn.axzo.tyr.server.config.exception.BizResultCode.REMOVE_USER_ROLE_ERROR;
+import static cn.axzo.tyr.server.config.exception.BizResultCode.ROLE_CODE_NOF_FOUND;
+import static cn.axzo.tyr.server.config.exception.BizResultCode.ROLE_ID_NOF_FOUND;
 import static cn.axzo.tyr.server.event.inner.EventTypeEnum.SAAS_ROLE_USER_RELATION_REMOVED;
+import static cn.axzo.tyr.server.event.inner.EventTypeEnum.SAAS_ROLE_USER_RELATION_UPSERT;
 
 /**
  * @author haiyangjin
@@ -88,7 +102,6 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
     private SaasRoleUserRelationDao saasRoleUserRelationDao;
     @Autowired
     private SaasRoleDao saasRoleDao;
-
     @Autowired
     private UserProfileServiceApi userProfileServiceApi;
     @Autowired
@@ -99,6 +112,11 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
     private IdentityProfileApi identityProfileApi;
     @Autowired
     private OrganizationalUnitApi organizationalUnitApi;
+    @Autowired
+    private SaasRoleGroupService saasRoleGroupService;
+    @Autowired
+    private OperateLogService operateLogService;
+
     private static final String TARGET_TYPE = "saasRoleUserRelationId";
 
     @Override
@@ -128,12 +146,33 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
             });
         }
 
-        Set<Long> roleIds = resolveRoleIds(param);
-        if ((!CollectionUtils.isEmpty(param.getRoleCodes()) || !CollectionUtils.isEmpty(param.getRoleTypes()))
-                && CollectionUtils.isEmpty(roleIds)) {
+        Set<Long> roleIdsByRoleCodes = resolveRoleIdsByRoleCodes(param);
+        if (!CollectionUtils.isEmpty(param.getRoleCodes()) && CollectionUtils.isEmpty(roleIdsByRoleCodes)) {
             return param.toEmpty();
         }
-        wrapper.in(!CollectionUtils.isEmpty(roleIds), "role_id", roleIds);
+
+        Set<Long> roleIdsByRoleTypes = resolveRoleIdsByRoleTypes(param);
+        if (!CollectionUtils.isEmpty(param.getRoleTypes()) && CollectionUtils.isEmpty(roleIdsByRoleTypes)) {
+            return param.toEmpty();
+        }
+
+        Set<Long> roleIdsByRoleGroupCode = resolveRoleIdsByRoleGroupCode(param);
+        if (Objects.nonNull(param.getRoleGroupCode()) && CollectionUtils.isEmpty(roleIdsByRoleGroupCode)) {
+            return param.toEmpty();
+        }
+
+        Set<Long> roleIdsByAncestorRoleGroupCode = resolveRoleIdsByAncestorRoleGroupCode(param);
+        if (Objects.nonNull(param.getAncestorRoleGroupCode()) && CollectionUtils.isEmpty(roleIdsByAncestorRoleGroupCode)) {
+            return param.toEmpty();
+        }
+
+        wrapper.in(!CollectionUtils.isEmpty(roleIdsByRoleCodes), "role_id", roleIdsByRoleCodes);
+
+        wrapper.in(!CollectionUtils.isEmpty(roleIdsByRoleTypes), "role_id", roleIdsByRoleTypes);
+
+        wrapper.in(!CollectionUtils.isEmpty(roleIdsByRoleGroupCode), "role_id", roleIdsByRoleGroupCode);
+
+        wrapper.in(!CollectionUtils.isEmpty(roleIdsByAncestorRoleGroupCode), "role_id", roleIdsByAncestorRoleGroupCode);
 
         assembleBatchPersonWrapper(param, wrapper);
 
@@ -161,6 +200,7 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
                     k.eq(Objects.nonNull(batchPerson.getIdentityType()), "identity_type", batchPerson.getIdentityType());
                     k.eq(Objects.nonNull(batchPerson.getWorkspaceId()), "workspace_id", batchPerson.getWorkspaceId());
                     k.eq(Objects.nonNull(batchPerson.getOuId()), "ou_id", batchPerson.getOuId());
+                    k.eq(Objects.nonNull(batchPerson.getResourceId()), "resource_id", batchPerson.getResourceId());
                 });
             }
         });
@@ -168,8 +208,75 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
 
     @Override
     @Transactional
-    public void upsert(UpsertParam param) {
+    public void upsert(UpsertUserRoleReq param) {
 
+        // check数据完整性
+
+        // check roleId
+        checkRoleId(param);
+        // check roleCode
+        Map<String, SaasRoleRes> roles = checkRoleCode(param);
+
+        // 查询用户的历史记录
+        List<SaasRoleUserV2DTO> oldRoleUsers = listRoleUserRelation(param);
+        Map<String, List<SaasRoleUserV2DTO>> roleUserMap = oldRoleUsers.stream()
+                .collect(Collectors.groupingBy(e -> e.getIdentityId() + "_" + e.getIdentityType() +
+                        "_" + e.getSaasRoleUser().getPersonId() + "_" + e.getWorkspaceId() + "_" + e.getOuId()));
+        // 根据入参解析insert、delete的记录
+        List<SaasRoleUserRelation> upsert = Lists.newArrayList();
+        assembleInsertData(roleUserMap, param, roles, upsert);
+
+        assembleDeleteData(roleUserMap, param, roles, upsert);
+
+        // 批量insert、delete
+        if (CollectionUtils.isEmpty(upsert)) {
+            return;
+        }
+        this.saveOrUpdateBatch(upsert);
+
+        // 发送mq
+        List<SaasRoleUserRelation> inserts = upsert.stream()
+                .filter(saasRoleUserRelation -> Objects.isNull(saasRoleUserRelation.getIsDelete()) || Objects.equals(TableIsDeleteEnum.NORMAL.value, saasRoleUserRelation.getIsDelete()))
+                .collect(Collectors.toList());
+        if (!CollectionUtils.isEmpty(inserts)) {
+            Event event = Event.builder()
+                    .targetType(TARGET_TYPE)
+                    .eventCode(SAAS_ROLE_USER_RELATION_UPSERT.getEventCode())
+                    .data(SaasRoleUserRelationUpsertPayload.builder()
+                            .newValues(inserts)
+                            .build())
+                    .build();
+            mqProducer.send(event);
+        }
+
+        List<SaasRoleUserRelation> deletes = upsert.stream()
+                .filter(saasRoleUserRelation -> Objects.nonNull(saasRoleUserRelation.getIsDelete()) && !Objects.equals(TableIsDeleteEnum.NORMAL.value, saasRoleUserRelation.getIsDelete()))
+                .collect(Collectors.toList());
+        if (!CollectionUtils.isEmpty(deletes)) {
+            Event event = Event.builder()
+                    .targetType(TARGET_TYPE)
+                    .eventCode(SAAS_ROLE_USER_RELATION_REMOVED.getEventCode())
+                    .data(SaasRoleUserRelationRemovePayload.builder()
+                            .values(deletes)
+                            .build())
+                    .build();
+            mqProducer.send(event);
+        }
+
+
+        operateLogService.save(LogAddReq.builder()
+                .scene("UPSERT_USER_ROLE")
+                .level("INFO")
+                .tags(param.getUserRoles().stream()
+                        .map(UpsertUserRoleReq.UserRoleReq::getPersonId)
+                        .map(String::valueOf)
+                        .collect(Collectors.toList()))
+                .message(new JSONObject()
+                        .fluentPut("param", param)
+                        .fluentPut("oldValues", oldRoleUsers)
+                        .fluentPut("newValues", upsert)
+                        .toJSONString())
+                .build());
     }
 
     @Override
@@ -202,29 +309,16 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
         mqProducer.send(event);
     }
 
-    private Set<Long> resolveRoleIds(PageRoleUserRelationParam param) {
-        if (CollectionUtils.isEmpty(param.getRoleCodes()) && CollectionUtils.isEmpty(param.getRoleTypes())) {
-            return Optional.ofNullable(param.getRoleIds())
-                    .map(Sets::newHashSet)
-                    .orElseGet(Sets::newHashSet);
+    private Set<Long> resolveRoleIdsByRoleCodes(PageRoleUserRelationParam param) {
+        if (CollectionUtils.isEmpty(param.getRoleCodes())) {
+            return Collections.emptySet();
         }
         ListRoleReq listSaasRoleParam = ListRoleReq.builder()
                 .roleCodes(param.getRoleCodes())
-                .roleTypes(Optional.ofNullable(param.getRoleTypes())
-                        .map(e -> e.stream().map(RoleTypeEnum::getValue).collect(Collectors.toList()))
-                        .orElse(null))
                 .build();
-        Set<Long> roleIds = roleService.list(listSaasRoleParam).stream()
+        return roleService.list(listSaasRoleParam).stream()
                 .map(SaasRoleRes::getId)
                 .collect(Collectors.toSet());
-
-        if (CollectionUtils.isEmpty(param.getRoleIds())) {
-            return roleIds;
-        }
-
-        return param.getRoleIds().stream()
-                .filter(roleIds::contains)
-                .collect(Collectors.toSet());
     }
 
     private Map<Long, SaasRoleUserV2DTO.SaasRoleUser> listSaasRoleUser(PageRoleUserRelationParam param,
@@ -611,4 +705,293 @@ public class SaasRoleUserRelationServiceImpl extends ServiceImpl<SaasRoleUserRel
         doUpdateWorkspaceUserRoles(g.getIdentityId(), g.getIdentityType(), g.getUpdateRoleIds(), g.getWorkspaceId(), g.getOuId(), g.getJobType());
         return Boolean.TRUE;
     }
+
+    private Set<Long> resolveRoleIdsByRoleTypes(PageRoleUserRelationParam param) {
+        if (CollectionUtils.isEmpty(param.getRoleTypes())) {
+            return Collections.emptySet();
+        }
+
+        ListRoleReq listSaasRoleParam = ListRoleReq.builder()
+                .roleTypes(param.getRoleTypes().stream()
+                        .map(RoleTypeEnum::getValue)
+                        .collect(Collectors.toList()))
+                .build();
+        return roleService.list(listSaasRoleParam).stream()
+                .map(SaasRoleRes::getId)
+                .collect(Collectors.toSet());
+    }
+
+    private Set<Long> resolveRoleIdsByRoleGroupCode(PageRoleUserRelationParam param) {
+        if (Objects.isNull(param.getRoleGroupCode())) {
+            return Collections.emptySet();
+        }
+
+        return saasRoleGroupService.list(ListSaasRoleGroupParam.builder()
+                .roleGroupCodes(Sets.newHashSet(param.getRoleGroupCode()))
+                .needRoleGroupRelation(true)
+                .build())
+                .stream()
+                .map(SaasRoleGroupDTO::getRoleGroupRelations)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .map(RoleGroupRelationRes::getRoleId)
+                .collect(Collectors.toSet());
+    }
+
+    private Set<Long> resolveRoleIdsByAncestorRoleGroupCode(PageRoleUserRelationParam param) {
+        if (Objects.isNull(param.getAncestorRoleGroupCode())) {
+            return Collections.emptySet();
+        }
+
+        return saasRoleGroupService.list(ListSaasRoleGroupParam.builder()
+                        .ancestorRoleGroupCode(param.getAncestorRoleGroupCode())
+                        .needRoleGroupRelation(true)
+                        .build())
+                .stream()
+                .map(SaasRoleGroupDTO::getRoleGroupRelations)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .map(RoleGroupRelationRes::getRoleId)
+                .collect(Collectors.toSet());
+    }
+
+    private Map<Long, SaasRoleUserV2DTO.SaasRole> listUserPermission(PageRoleUserRelationParam param,
+                                                                     List<SaasRoleUserRelation> saasRoleUserRelations) {
+        if (CollectionUtils.isEmpty(saasRoleUserRelations) || BooleanUtils.isNotTrue(param.getNeedUserPermission())) {
+            return Collections.emptyMap();
+        }
+
+        return Collections.emptyMap();
+    }
+
+    private void checkRoleId(UpsertUserRoleReq param) {
+        Set<Long> allRoleIds = Sets.newHashSet();
+        Set<Long> insertRoleIds = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getInsertRoleIds)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        Set<Long> fullRoleIds = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getFullRoleIds)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        Set<Long> removeRoleIds = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getRemoveRoleIds)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+        allRoleIds.addAll(insertRoleIds);
+        allRoleIds.addAll(fullRoleIds);
+        allRoleIds.addAll(removeRoleIds);
+        if (CollectionUtils.isEmpty(allRoleIds)) {
+            return;
+        }
+
+        List<SaasRoleRes> dbRoles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(allRoleIds))
+                .build());
+
+        if (!Objects.equals(allRoleIds.size(), dbRoles.size())) {
+            Sets.SetView<Long> difference = Sets.difference(allRoleIds, dbRoles.stream().map(SaasRoleRes::getId).collect(Collectors.toSet()));
+            throw ROLE_ID_NOF_FOUND.toException(ROLE_ID_NOF_FOUND.getErrorMessage(), difference.stream().sorted().collect(Collectors.toList()));
+        }
+    }
+
+    private Map<String, SaasRoleRes> checkRoleCode(UpsertUserRoleReq param) {
+        Set<String> allRoleCodes = Sets.newHashSet();
+        Set<String> insertRoleCodes = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getInsertRoleCodes)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        Set<String> fullRoleCodes = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getFullRoleCodes)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        Set<String> removeRoleCodes = param.getUserRoles().stream()
+                .map(UpsertUserRoleReq.UserRoleReq::getRemoveRoleCodes)
+                .filter(Objects::nonNull)
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+        allRoleCodes.addAll(insertRoleCodes);
+        allRoleCodes.addAll(fullRoleCodes);
+        allRoleCodes.addAll(removeRoleCodes);
+        if (CollectionUtils.isEmpty(allRoleCodes)) {
+            return Collections.emptyMap();
+        }
+
+        List<SaasRoleRes> dbRoles = roleService.list(ListRoleReq.builder()
+                .roleCodes(allRoleCodes)
+                .build());
+
+        if (!Objects.equals(allRoleCodes.size(), dbRoles.size())) {
+            Sets.SetView<String> difference = Sets.difference(allRoleCodes, dbRoles.stream().map(SaasRoleRes::getRoleCode).collect(Collectors.toSet()));
+            throw ROLE_CODE_NOF_FOUND.toException(ROLE_CODE_NOF_FOUND.getErrorMessage(), difference.stream().sorted().collect(Collectors.toList()));
+        }
+
+        return dbRoles.stream()
+                .collect(Collectors.toMap(SaasRoleRes::getRoleCode, Function.identity(), (f, s) -> f));
+    }
+
+    private List<SaasRoleUserV2DTO> listRoleUserRelation(UpsertUserRoleReq param) {
+        return this.listV2(ListRoleUserRelationParam.builder()
+                .batchPersons(param.getUserRoles().stream()
+                        .map(e -> ListRoleUserRelationParam.BatchPerson.builder()
+                                .identityId(e.getIdentityId())
+                                .identityType(e.getIdentityType().getCode())
+                                .personId(e.getPersonId())
+                                .workspaceId(e.getWorkspaceId())
+                                .ouId(e.getOuId())
+                                .resourceId(e.getNodeId())
+                                .build())
+                        .collect(Collectors.toList()))
+                .build());
+    }
+
+    private SaasRoleUserRelation from(UpsertUserRoleReq.UserRoleReq userRoleReq,
+                                      UpsertUserRoleReq param) {
+        SaasRoleUserRelation saasRoleUserRelation = new SaasRoleUserRelation();
+        saasRoleUserRelation.setNaturalPersonId(userRoleReq.getPersonId());
+        saasRoleUserRelation.setIdentityId(userRoleReq.getIdentityId());
+        saasRoleUserRelation.setIdentityType(userRoleReq.getIdentityType().getCode());
+        saasRoleUserRelation.setWorkspaceId(userRoleReq.getWorkspaceId());
+        saasRoleUserRelation.setOuId(userRoleReq.getOuId());
+        saasRoleUserRelation.setCreateBy(param.getOperatorId());
+        saasRoleUserRelation.setResourceId(userRoleReq.getNodeId());
+        // 目前都是node，所以没有让接口传入，后续如果放开了，可以增加默认值
+        saasRoleUserRelation.setResourceType(RoleResourceTypeEnum.NODE.code);
+        return saasRoleUserRelation;
+    }
+
+    private void assembleInsertData(Map<String, List<SaasRoleUserV2DTO>> roleUserMap,
+                                    UpsertUserRoleReq param,
+                                    Map<String, SaasRoleRes> roles,
+                                    List<SaasRoleUserRelation> upsert) {
+        List<SaasRoleUserRelation> resultByInsertRoleIds = param.getUserRoles().stream()
+                .flatMap(e -> {
+                    Set<Long> allInsertRoleIds = Optional.ofNullable(e.getInsertRoleIds())
+                            .orElseGet(Sets::newHashSet);
+
+                    allInsertRoleIds.addAll(Optional.ofNullable(e.getInsertRoleCodes())
+                            .map(roleCodes -> roleCodes.stream()
+                                    .map(roleCode -> roles.get(roleCode).getId())
+                                    .collect(Collectors.toSet()))
+                            .orElseGet(Sets::newHashSet));
+
+                    return allInsertRoleIds.stream()
+                            .map(roleId -> {
+                                SaasRoleUserRelation saasRoleUserRelation = from(e, param);
+                                saasRoleUserRelation.setRoleId(roleId);
+                                return saasRoleUserRelation;
+                            });
+                })
+                .collect(Collectors.toList());
+        upsert.addAll(resultByInsertRoleIds);
+
+
+        List<SaasRoleUserRelation> resultByFullRoleIds = param.getUserRoles().stream()
+                .flatMap(e -> {
+                    Set<Long> allFullRoleIds = Optional.ofNullable(e.getFullRoleIds())
+                            .orElseGet(Sets::newHashSet);
+
+                    allFullRoleIds.addAll(Optional.ofNullable(e.getFullRoleCodes())
+                            .map(roleCodes -> roleCodes.stream()
+                                    .map(roleCode -> roles.get(roleCode).getId())
+                                    .collect(Collectors.toSet()))
+                            .orElseGet(Sets::newHashSet));
+
+                    Set<Long> roleIds = Optional.ofNullable(roleUserMap.get(e.buildKey()))
+                            .map(roleUsers -> roleUsers.stream()
+                                    .filter(roleUser -> Objects.isNull(e.getNodeId()) || Objects.equals(e.getNodeId(), roleUser.getResourceId()))
+                                    .map(SaasRoleUserV2DTO::getRoleId)
+                                    .collect(Collectors.toSet()))
+                            .orElseGet(Sets::newHashSet);
+
+                    return allFullRoleIds.stream()
+                            .filter(roleId -> !roleIds.contains(roleId))
+                            .map(roleId -> {
+                                SaasRoleUserRelation saasRoleUserRelation = from(e, param);
+                                saasRoleUserRelation.setRoleId(roleId);
+                                return saasRoleUserRelation;
+                            });
+                })
+                .collect(Collectors.toList());
+        upsert.addAll(resultByFullRoleIds);
+    }
+
+    /**
+     * 组装delete的数据是需要完整的信息，执行sql的时候，不会全部字段去更新，
+     * 是为了发送mq，方便消费mq的业务进行操作，因为软删除的是查询不到的不应该拿去做业务
+     * @param roleUserMap
+     * @param param
+     * @param roles
+     * @param upsert
+     */
+    private void assembleDeleteData(Map<String, List<SaasRoleUserV2DTO>> roleUserMap,
+                                    UpsertUserRoleReq param,
+                                    Map<String, SaasRoleRes> roles,
+                                    List<SaasRoleUserRelation> upsert) {
+        List<SaasRoleUserRelation> resultByRemoveRoles = param.getUserRoles().stream()
+                .flatMap(e -> {
+                    Set<Long> allRemoveRoleIds = Optional.ofNullable(e.getRemoveRoleIds())
+                            .orElseGet(Sets::newHashSet);
+                    allRemoveRoleIds.addAll(Optional.ofNullable(e.getRemoveRoleCodes())
+                            .map(roleCodes -> roleCodes.stream()
+                                    .map(roleCode -> roles.get(roleCode).getId())
+                                    .collect(Collectors.toSet()))
+                            .orElseGet(Sets::newHashSet));
+                    List<SaasRoleUserV2DTO> saasRoleUsers = Optional.ofNullable(roleUserMap.get(e.buildKey()))
+                            .orElseGet(Lists::newArrayList);
+
+                    return saasRoleUsers.stream()
+                            .filter(roleUser -> Objects.isNull(e.getNodeId()) || Objects.equals(e.getNodeId(), roleUser.getResourceId()))
+                            .filter(roleUser -> allRemoveRoleIds.contains(roleUser.getRoleId()))
+                            .map(roleUser -> {
+                                SaasRoleUserRelation saasRoleUserRelation = new SaasRoleUserRelation();
+                                BeanUtils.copyProperties(roleUser, saasRoleUserRelation);
+                                saasRoleUserRelation.setIsDelete(roleUser.getId());
+                                saasRoleUserRelation.setUpdateBy(param.getOperatorId());
+                                return saasRoleUserRelation;
+                            });
+                })
+                .collect(Collectors.toList());
+        upsert.addAll(resultByRemoveRoles);
+
+        List<SaasRoleUserRelation> resultByFullRoles = param.getUserRoles().stream()
+                .flatMap(e -> {
+                    Set<Long> allFullRoleIds = Optional.ofNullable(e.getFullRoleIds())
+                            .orElseGet(Sets::newHashSet);
+
+                    allFullRoleIds.addAll(Optional.ofNullable(e.getFullRoleCodes())
+                            .map(roleCodes -> roleCodes.stream()
+                                    .map(roleCode -> roles.get(roleCode).getId())
+                                    .collect(Collectors.toSet()))
+                            .orElseGet(Sets::newHashSet));
+                    if (CollectionUtils.isEmpty(allFullRoleIds)) {
+                        return Stream.empty();
+                    }
+
+                    List<SaasRoleUserV2DTO> saasRoleUsers = Optional.ofNullable(roleUserMap.get(e.buildKey()))
+                            .orElseGet(Lists::newArrayList);
+
+                    return saasRoleUsers.stream()
+                            .filter(roleUser -> Objects.isNull(e.getNodeId()) || Objects.equals(e.getNodeId(), roleUser.getResourceId()))
+                            .filter(roleUser -> !allFullRoleIds.contains(roleUser.getRoleId()))
+                            .map(roleUser -> {
+                                SaasRoleUserRelation saasRoleUserRelation = new SaasRoleUserRelation();
+                                BeanUtils.copyProperties(roleUser, saasRoleUserRelation);
+                                saasRoleUserRelation.setIsDelete(roleUser.getId());
+                                saasRoleUserRelation.setUpdateBy(param.getOperatorId());
+                                return saasRoleUserRelation;
+                            });
+                })
+                .collect(Collectors.toList());
+        upsert.addAll(resultByFullRoles);
+    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/TyrSaasAuthServiceImpl.java

@@ -7,7 +7,6 @@ import cn.axzo.thrones.client.saas.ServicePkgClient;
 import cn.axzo.thrones.client.saas.entity.serivicepgkproduct.ServicePkgProduct;
 import cn.axzo.thrones.client.saas.entity.servicepkg.ServicePkgDetailRes;
 import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
-import cn.axzo.tyr.client.common.enums.WorkspaceJoinType;
 import cn.axzo.tyr.client.model.enums.DelegatedType;
 import cn.axzo.tyr.client.model.enums.IdentityType;
 import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
@@ -926,24 +925,24 @@ public class TyrSaasAuthServiceImpl implements TyrSaasAuthService {
                 .build()).collect(Collectors.toList()));
 
         return permissionInfo.stream()
-                .filter(e -> {
+                .peek(e -> {
                     PermissionTagService.ResolvePermissionDTO resolvePermission = personPermissionTags.get(e.getPersonId() + "_" + e.getOuId() + "_" + e.getWorkspaceId());
+
+                    Set<ListPermissionFromRoleGroupResp.FeatureInfo> featureInfos = Optional.ofNullable(authMap.get(NumberUtil.parseLong(e.getRoleId())))
+                            .orElseGet(Sets::newHashSet)
+                            .stream()
+                            .filter(feature -> {
                                 if (Objects.isNull(resolvePermission)) {
                                     // 未解析到标签兼容历史情况
                                     return true;
                                 }
-
-                    Set<ListPermissionFromRoleGroupResp.FeatureInfo> featureInfos = authMap.get(NumberUtil.parseLong(e.getRoleId()));
-
-                    return featureInfos.stream()
-                            .anyMatch(permission -> permission.getTags()
-                                    .stream()
-                                    .anyMatch(tag -> !Sets.intersection(permission.getTags(), resolvePermission.getTags()).isEmpty()));
+                                return !Sets.intersection(feature.getTags(), resolvePermission.getTags()).isEmpty();
                             })
-                .peek(e -> {
-                    e.setFeatureInfos(authMap.get(NumberUtil.parseLong(e.getRoleId())));
-                    e.setSimpleFeatureInfos(org.apache.commons.collections4.CollectionUtils.emptyIfNull(authMap.get(NumberUtil.parseLong(e.getRoleId())))
-                            .stream().map(ListPermissionFromRoleGroupResp.FeatureInfo::getFeatureId).collect(Collectors.toSet()));
+                            .collect(Collectors.toSet());
+                        e.setFeatureInfos(featureInfos);
+                        e.setSimpleFeatureInfos(featureInfos.stream()
+                                .map(ListPermissionFromRoleGroupResp.FeatureInfo::getFeatureId)
+                                .collect(Collectors.toSet()));
                 })
                 .collect(Collectors.toList());
     }
@@ -998,6 +997,7 @@ public class TyrSaasAuthServiceImpl implements TyrSaasAuthService {
         WorkspaceProductService.ListWorkspaceProductPermissionCacheParam listWorkspaceProductPermission = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
                 .workspaceIds(workspaceId)
                 .build();
+
         Map<Long, List<WorkspaceProductService.ProductPermission>> workspaceProductPermissions = workspaceProductService.listWorkspaceProductPermissionCached(listWorkspaceProductPermission)
                 .stream()
                 .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId,
@@ -1011,15 +1011,23 @@ public class TyrSaasAuthServiceImpl implements TyrSaasAuthService {
                 LogUtil.error(" find role info error,role id:{}", roleId);
                 return Collections.emptySet();
             }
+            List<RolePermissionCacheService.PermissionDTO> permissionDTOS = rolePermissions.get(roleId);
+            if (CollectionUtils.isEmpty(permissionDTOS)) {
+                return Collections.emptySet();
+            }
 
-            Set<Long> productPermissionIds = workspaceProductPermissions.get(e.getWorkspaceId()).stream()
+            List<WorkspaceProductService.ProductPermission> productPermissions = workspaceProductPermissions.get(e.getWorkspaceId());
+            if (CollectionUtils.isEmpty(productPermissions)) {
+                return Collections.emptySet();
+            }
+            Set<Long> productPermissionIds = productPermissions.stream()
                     .map(WorkspaceProductService.ProductPermission::getPermissions)
                     .flatMap(Collection::stream)
                     .filter(productPermission -> Objects.equals(productPermission.getCooperateType(), String.valueOf(saasRole.getProductUnitType())))
                     .map(ProductPermissionCacheService.PermissionDTO::getFeatureId)
                     .collect(Collectors.toSet());
 
-            return rolePermissions.get(roleId).stream()
+            return permissionDTOS.stream()
                     .filter(rolePermission -> productPermissionIds.contains(rolePermission.getFeatureId()))
                     .collect(Collectors.toSet());
         }, (oldFeatureLists, newFeatureLists) -> {
@@ -1043,20 +1051,6 @@ public class TyrSaasAuthServiceImpl implements TyrSaasAuthService {
         return featureMap;
     }
 
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    public static class OUWRoleInfo {
-
-        Long workspaceId;
-        Integer workspaceType;
-        Long ouId;
-        WorkspaceJoinType workspaceJoinType;
-        Set<SaasRoleRes> roles = new HashSet<>();
-
-    }
-
     @Override
     public List<ListIdentityFromPermissionResp> listWorkspacePermissionIdentity(WorkspacePermissionIdentityReq req) {
 
@@ -1531,17 +1525,4 @@ public class TyrSaasAuthServiceImpl implements TyrSaasAuthService {
                 .build();
         return rolePermissionCacheService.list(listRolePermissionParam);
     }
-
-    @Data
-    @Builder
-    @NoArgsConstructor
-    @AllArgsConstructor
-    static class FeatureWrapper {
-        private Long featureId;
-
-        /**
-         * 关联类型（0：saas_feature,1:saas_feature_resource）
-         */
-        private Integer type;
-    }
 }

tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/WorkspaceProductServiceImpl.java

@@ -7,9 +7,6 @@ import cn.axzo.thrones.client.saas.ServicePkgClient;
 import cn.axzo.thrones.client.saas.entity.serivicepgkproduct.ServicePkgProduct;
 import cn.axzo.thrones.client.saas.entity.servicepkg.ServicePkgDetailRes;
 import cn.axzo.tyr.server.repository.dao.ProductModuleDao;
-import cn.axzo.tyr.server.repository.entity.ProductFeatureQuery;
-import cn.axzo.tyr.server.repository.entity.SaasProductModuleFeatureRelation;
-import cn.axzo.tyr.server.service.ProductFeatureRelationService;
 import cn.axzo.tyr.server.service.ProductPermissionCacheService;
 import cn.axzo.tyr.server.service.ProductSaasFeatureResourceCacheService;
 import cn.axzo.tyr.server.service.WorkspaceProductService;
@@ -22,6 +19,7 @@ import com.google.common.collect.Sets;
 import com.google.common.collect.Streams;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.cloud.context.config.annotation.RefreshScope;
@@ -36,6 +34,7 @@ import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 import static cn.axzo.tyr.server.config.exception.BizResultCode.REDIS_PRODUCT_NOT_NULL;
@@ -51,8 +50,6 @@ public class WorkspaceProductServiceImpl implements WorkspaceProductService {
     @Autowired
     private ProductModuleDao productModuleDao;
     @Autowired
-    private ProductFeatureRelationService productFeatureRelationService;
-    @Autowired
     private StringRedisTemplate redisTemplate;
     @Autowired
     private ProductPermissionCacheService productPermissionCacheService;
@@ -66,116 +63,6 @@ public class WorkspaceProductServiceImpl implements WorkspaceProductService {
 
     private static final String WORKSPACE_PRODUCT_KEY = "workspace:product";
 
-    @Override
-    public List<WorkspaceProduct> listWorkspaceProduct(WorkspaceProductParam param) {
-
-        if (CollectionUtils.isEmpty(param.getWorkspaceIds())) {
-            return Collections.emptyList();
-        }
-
-        List<ServicePkgDetailRes> servicePkgDetailRes = RpcInternalUtil.rpcListProcessor(() -> servicePkgClient.getServicePkgDetailBySpaceId(param.getWorkspaceIds()),
-                "查询项目的产品", param.getWorkspaceIds()).getData();
-        if (CollectionUtil.isEmpty(servicePkgDetailRes)) {
-            return Collections.emptyList();
-        }
-
-        Set<Long> productIds = servicePkgDetailRes.stream()
-                .map(ServicePkgDetailRes::getProducts)
-                .filter(CollectionUtil::isNotEmpty)
-                .flatMap(List::stream)
-                .map(ServicePkgProduct::getProductId)
-                .collect(Collectors.toSet());
-        if (CollectionUtil.isEmpty(productIds)) {
-            log.warn("no product found for workspace :{}", param.getWorkspaceIds());
-            return Collections.emptyList();
-        }
-
-        // 已被删除产品过滤一层
-        productIds = productModuleDao.listByIds(productIds)
-                .stream()
-                .filter(productModule -> Objects.equals(productModule.getIsDelete(),0L))
-                .map(BaseEntity::getId)
-                .collect(Collectors.toSet());
-        if (CollectionUtil.isEmpty(productIds)) {
-            log.warn("all product is deleted for workspace :{}", param.getWorkspaceIds());
-            return Collections.emptyList();
-        }
-
-        ProductFeatureQuery productFeatureQuery = ProductFeatureQuery.builder()
-                .productIds(productIds)
-                .featureResourceTypes(param.getFeatureResourceTypes())
-                .terminal(param.getTerminal())
-                .type(param.getType())
-                .featureIdPairs(param.getFeatureIdPairs())
-                .build();
-        Map<Long, List<SaasProductModuleFeatureRelation>> saasProductModuleFeatureRelations = productFeatureRelationService.queryOnCondition(productFeatureQuery).stream()
-                .collect(Collectors.groupingBy(SaasProductModuleFeatureRelation::getProductModuleId));
-
-        return servicePkgDetailRes.stream()
-                .filter(e -> CollectionUtils.isNotEmpty(e.getProducts()))
-                .map(e -> {
-                    List<SaasProductModuleFeatureRelation> features = e.getProducts().stream()
-                            .map(product -> saasProductModuleFeatureRelations.get(product.getProductId()))
-                            .filter(Objects::nonNull)
-                            .flatMap(Collection::stream)
-                            .collect(Collectors.toList());
-                    return Pair.of(e.getSpaceId(), features);
-                })
-                // 考虑一个项目有多个服务包的情况
-                .collect(Collectors.toMap(Pair::getKey, Pair::getValue, (f, s) -> {
-                    f.addAll(s);
-                    return f;
-                }))
-                .entrySet()
-                .stream()
-                .map(e -> WorkspaceProduct.builder()
-                        .workspaceId(e.getKey())
-                        .saasProductModuleFeatureRelations(e.getValue())
-                        .build())
-                .collect(Collectors.toList());
-    }
-
-    @Override
-    public List<WorkspaceProduct> listWorkspaceProductCached(WorkspaceProductParam param) {
-        if (CollectionUtils.isEmpty(param.getWorkspaceIds())) {
-            return Collections.emptyList();
-        }
-
-        Map<Long, Set<Long>> workspaceProducts = listWorkspaceProduct(param.getWorkspaceIds());
-
-        Set<Long> productIds = workspaceProducts.values().stream()
-                .flatMap(Collection::stream)
-                .collect(Collectors.toSet());
-
-        if (CollectionUtils.isEmpty(productIds)) {
-            return Collections.emptyList();
-        }
-
-        ProductFeatureQuery productFeatureQuery = ProductFeatureQuery.builder()
-                .productIds(productIds)
-                .featureResourceTypes(param.getFeatureResourceTypes())
-                .terminal(param.getTerminal())
-                .type(param.getType())
-                .featureIdPairs(param.getFeatureIdPairs())
-                .build();
-        Map<Long, List<SaasProductModuleFeatureRelation>> saasProductModuleFeatureRelations = productFeatureRelationService.queryOnCondition(productFeatureQuery).stream()
-                .collect(Collectors.groupingBy(SaasProductModuleFeatureRelation::getProductModuleId));
-
-        return workspaceProducts.entrySet().stream()
-                .filter(e -> CollectionUtils.isNotEmpty(e.getValue()))
-                .map(e -> {
-                    List<SaasProductModuleFeatureRelation> features = e.getValue().stream()
-                            .map(saasProductModuleFeatureRelations::get)
-                            .filter(Objects::nonNull)
-                            .flatMap(Collection::stream)
-                            .collect(Collectors.toList());
-                    return WorkspaceProduct.builder()
-                            .workspaceId(e.getKey())
-                            .saasProductModuleFeatureRelations(features)
-                            .build();
-                })
-                .collect(Collectors.toList());
-    }
 
     @Override
     public void storeWorkspaceProduct(StoreWorkspaceProductParam param) {
@@ -287,6 +174,9 @@ public class WorkspaceProductServiceImpl implements WorkspaceProductService {
         ProductPermissionCacheService.ListProductPermissionParam listProductPermissionParam = ProductPermissionCacheService.ListProductPermissionParam.builder()
                 .productIds(productIds)
                 .featureCodes(param.getFeatureCodes())
+                .appType(param.getAppType())
+                .itemCode(param.getItemCode())
+                .terminal(param.getTerminal())
                 .build();
         Map<Long, List<ProductPermissionCacheService.PermissionDTO>> productPermissionMap = productPermissionCacheService.list(listProductPermissionParam);
 
@@ -314,6 +204,70 @@ public class WorkspaceProductServiceImpl implements WorkspaceProductService {
                 .collect(Collectors.toList());
     }
 
+    @Override
+    public List<WorkspaceProductPermission> listWorkspacePermissionCached(ListWorkspacePermissionCacheParam param) {
+        if (CollectionUtils.isEmpty(param.getWorkspacePermissions())) {
+            return Collections.emptyList();
+        }
+
+        Map<Long, Set<Long>> workspaceProducts = listWorkspaceProduct(param.getWorkspacePermissions().stream()
+                .map(WorkspacePermission::getWorkspaceId)
+                .collect(Collectors.toSet()));
+
+        Set<Long> productIds = workspaceProducts.values().stream()
+                .flatMap(Collection::stream)
+                .collect(Collectors.toSet());
+
+        if (CollectionUtils.isEmpty(productIds)) {
+            return Collections.emptyList();
+        }
+
+        ProductPermissionCacheService.ListProductPermissionParam listProductPermissionParam = ProductPermissionCacheService.ListProductPermissionParam.builder()
+                .productIds(productIds)
+                .build();
+        Map<Long, List<ProductPermissionCacheService.PermissionDTO>> productPermissionMap = productPermissionCacheService.list(listProductPermissionParam);
+
+        Map<Long, WorkspacePermission> workspacePermissionMap = param.getWorkspacePermissions().stream()
+                .collect(Collectors.toMap(WorkspacePermission::getWorkspaceId, Function.identity(), (f, s) -> f));
+
+        return workspaceProducts.entrySet().stream()
+                .filter(e -> CollectionUtils.isNotEmpty(e.getValue()))
+                .map(e -> {
+
+                    WorkspacePermission workspacePermissionParam = workspacePermissionMap.get(e.getKey());
+
+                    List<ProductPermission> productPermissions = e.getValue().stream()
+                            .map(productId -> {
+                                List<ProductPermissionCacheService.PermissionDTO> permissions = Optional.ofNullable(productPermissionMap.get(productId))
+                                        .orElseGet(Lists::newArrayList)
+                                        .stream()
+                                        .filter(permission -> CollectionUtils.isEmpty(workspacePermissionParam.getFeatureCodes())
+                                                || workspacePermissionParam.getFeatureCodes().contains(permission.getFeatureCode()))
+                                        .filter(permission -> StringUtils.isBlank(workspacePermissionParam.getTerminal())
+                                                || Objects.equals(workspacePermissionParam.getTerminal(), permission.getTerminal()))
+                                        .filter(permission -> StringUtils.isBlank(workspacePermissionParam.getAppType())
+                                                || Objects.equals(workspacePermissionParam.getAppType(), permission.getAppType()))
+                                        .filter(permission -> StringUtils.isBlank(workspacePermissionParam.getItemCode())
+                                                || Objects.equals(workspacePermissionParam.getItemCode(), permission.getItemCode()))
+                                        .collect(Collectors.toList());
+                                if (CollectionUtils.isEmpty(permissions)) {
+                                    return null;
+                                }
+                                return ProductPermission.builder()
+                                        .productId(productId)
+                                        .permissions(permissions)
+                                        .build();
+                            })
+                            .filter(Objects::nonNull)
+                            .collect(Collectors.toList());
+                    return WorkspaceProductPermission.builder()
+                            .workspaceId(e.getKey())
+                            .productPermissions(productPermissions)
+                            .build();
+                })
+                .collect(Collectors.toList());
+    }
+
     private Map<Long, Set<Long>> listWorkspaceProduct(Set<Long> workspaceIds) {
         if (CollectionUtils.isEmpty(workspaceIds)) {
             return Collections.emptyMap();

tyr-server/src/main/java/cn/axzo/tyr/server/util/IdPathUtil.java

@@ -1,33 +0,0 @@
-package cn.axzo.tyr.server.util;
-
-import lombok.AccessLevel;
-import lombok.NoArgsConstructor;
-import org.springframework.util.CollectionUtils;
-import org.springframework.util.StringUtils;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-@NoArgsConstructor(access = AccessLevel.PRIVATE)
-public class IdPathUtil {
-
-    private static final String PATH_SPLIT = "/";
-
-    public static Set<Long> featurePathsToIds(Set<String> paths) {
-        if (CollectionUtils.isEmpty(paths)) {
-            return Collections.emptySet();
-        }
-        return paths.stream().map(e -> {
-            String[] split = e.split(PATH_SPLIT);
-            return Arrays.stream(split).filter(StringUtils::hasText).map(Long::parseLong)
-                    .collect(Collectors.toSet());
-        }).reduce(new HashSet<>(), (a, b) -> {
-            a.addAll(b);
-            return a;
-        });
-    }
-
-}

tyr-server/src/main/java/cn/axzo/tyr/server/utils/mapper/DataObjectMapper.java

@@ -5,7 +5,6 @@ import cn.axzo.tyr.client.model.data.object.AttributePermissionBO;
 import cn.axzo.tyr.client.model.data.object.DataObjectRuleBO;
 import cn.axzo.tyr.client.model.data.object.DefaultDataObjectRuleBO;
 import cn.axzo.tyr.client.model.req.CreateDataObjectReq;
-import cn.axzo.tyr.client.model.req.EditDataObjectReq;
 import cn.axzo.tyr.client.model.res.DataObjectRes;
 import cn.axzo.tyr.server.repository.entity.DataObject;
 import cn.axzo.tyr.server.repository.entity.DataObjectAttr;
@@ -20,7 +19,6 @@ import org.mapstruct.Named;
 import org.mapstruct.factory.Mappers;
 
 import java.util.List;
-import java.util.Objects;
 import java.util.stream.Collectors;
 
 @Mapper
@@ -30,8 +28,6 @@ public interface DataObjectMapper {
     DataObject createReq2DataObject(CreateDataObjectReq req);
 
 
-    DataObject editReq2DataObject(EditDataObjectReq req);
-
     DataObjectRes dataObject2DataObjectRes(DataObject req);
 
     DataObjectAttr attributeBO2DataObjectAttr(AttributeBO bo);
@@ -67,12 +63,8 @@ public interface DataObjectMapper {
 
     List<DataObjectRule> defaultRuleBOs2Rules(List<DefaultDataObjectRuleBO> bo);
 
-    List<DefaultDataObjectRuleBO> rules2defaultRuleBOs(List<DataObjectRule> bo);
-
     List<DataObjectRule> ruleBOs2Rules(List<DataObjectRuleBO> bo);
 
-    List<DataObjectRuleBO> rules2RuleBOs(List<DataObjectRule> bo);
-
     List<AttributePermissionBO> ruleAttrs2AttrPermissionBOs(List<DataObjectRuleAttr> bo);
 
     @Named("mapRelationId2RuleScope")

tyr-server/src/test/java/cn/axzo/tyr/base/TestConfig.java

@@ -2,9 +2,18 @@ package cn.axzo.tyr.base;
 
 import cn.axzo.apollo.workspace.api.workspace.WorkspaceApi;
 import cn.axzo.basics.profiles.api.UserProfileServiceApi;
+import cn.axzo.client.feign.FeatureCodeCachedApi;
+import cn.axzo.framework.jackson.utility.JSON;
 import cn.axzo.framework.rocketmq.Event;
 import cn.axzo.framework.rocketmq.EventProducer;
+import cn.axzo.log.platform.client.feign.LogApi;
+import cn.axzo.log.platform.client.model.req.LogAddReq;
+import cn.axzo.log.platform.client.model.req.LogBatchAddReq;
+import cn.axzo.log.platform.client.model.req.LogFindReq;
+import cn.axzo.log.platform.client.model.resp.LogResp;
+import cn.axzo.maokai.api.client.OrgUserApi;
 import cn.axzo.thrones.client.saas.ServicePkgClient;
+import cn.azxo.framework.common.model.CommonResponse;
 import com.alibaba.fastjson.JSONObject;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.boot.test.context.TestConfiguration;
@@ -15,7 +24,10 @@ import redis.embedded.RedisServer;
 
 import javax.annotation.PostConstruct;
 import javax.annotation.PreDestroy;
+import javax.validation.Valid;
+import javax.validation.constraints.NotBlank;
 import java.io.IOException;
+import java.util.List;
 import java.util.Map;
 
 @Slf4j
@@ -49,6 +61,12 @@ public class TestConfig {
     private WorkspaceApi workspaceApi;
     @MockBean
     private UserProfileServiceApi userProfileServiceApi;
+    @MockBean
+    private OrgUserApi orgUserApi;
+    @MockBean
+    private FeatureCodeCachedApi featureCodeCachedApi;
+    @MockBean
+    private LogApi logApi;
 
     @Bean
     @Primary

tyr-server/src/test/java/cn/axzo/tyr/server/controller/v2/RoleControllerTest.java

@@ -0,0 +1,294 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.basics.profiles.api.UserProfileServiceApi;
+import cn.axzo.basics.profiles.dto.basic.PersonProfileDto;
+import cn.axzo.tyr.base.BaseTest;
+import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.feign.enums.FeatureResourceTypeEnum;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.PageRoleReq;
+import cn.axzo.tyr.feign.resp.RoleResp;
+import cn.azxo.framework.common.model.CommonResponse;
+import com.google.common.collect.Sets;
+import org.assertj.core.util.Lists;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.util.List;
+
+class RoleControllerTest extends BaseTest {
+
+    @Autowired
+    private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private RoleController roleController;
+    @Autowired
+    private UserProfileServiceApi userProfileServiceApi;
+
+    @BeforeEach
+    @Override
+    public void setup() {
+        super.setup();
+        mysqlDataLoader.loadFromClassName(getClass().getSimpleName());
+        MockitoAnnotations.initMocks(this);
+    }
+
+    @Test
+    void page() {
+        List<RoleResp> roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .pageSize(1000)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+
+        Assertions.assertEquals(roleResps.get(0).getRoleId(), 24425L);
+        Assertions.assertEquals(roleResps.get(0).getRoleCode(), "oms:project_manager");
+        Assertions.assertEquals(roleResps.get(0).getName(), "项目经理");
+        Assertions.assertEquals(roleResps.get(0).getDescription(), "描述");
+        Assertions.assertEquals(roleResps.get(0).getRoleType(), "init");
+        Assertions.assertEquals(roleResps.get(0).getWorkspaceId(), -1L);
+        Assertions.assertEquals(roleResps.get(0).getOuId(), -1L);
+        Assertions.assertEquals(roleResps.get(0).getCooperateShipType(), 6);
+        Assertions.assertEquals(roleResps.get(0).getCreateBy(), 2003043L);
+        Assertions.assertEquals(roleResps.get(0).getUpdateBy(), 2003028L);
+        Assertions.assertTrue(roleResps.get(0).getIsDisplay());
+        Assertions.assertTrue(roleResps.get(0).getEnabled());
+        Assertions.assertEquals(roleResps.get(0).getSort(), 2);
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 9, 19, 15, 22, 55));
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 25));
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .workspaceType(6)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 2);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .isDisplay(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 9);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleCode("oms:project_manager")
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .workspaceIds(Sets.newHashSet(3L, 0L))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 5);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .ouIds(Sets.newHashSet(4L, 0L))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 5);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .enabled(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 9);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleTypes(Sets.newHashSet(RoleTypeEnum.SUPER_ADMIN))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 4);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .workspaceOuPairs(Lists.newArrayList(PageRoleReq.WorkspaceOuPair.builder()
+                                .workspaceId(3L)
+                                .ouId(4L)
+                                .build()))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleCodes(Sets.newHashSet("ou_superadmin"))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleGroupCodes(Sets.newHashSet("omsSuperAdminGroup"))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .cooperateShipTypes(Sets.newHashSet(1))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 2);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .needFeatureResources(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().size(), 5);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(0).getId(), 153L);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(0).getUniCode(), "oms:menu_page");
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getRoleFeatureResources().get(0).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(0).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(1).getId(), 466L);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(1).getUniCode(), "oms:imConfig_page");
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(1).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getRoleFeatureResources().get(1).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(1).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(2).getId(), 467L);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(2).getUniCode(), "oms:im_robot_page");
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(2).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getRoleFeatureResources().get(2).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(2).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(3).getId(), 469L);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(3).getUniCode(), "oms:msgPush_page");
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(3).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getRoleFeatureResources().get(3).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(3).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(4).getId(), 693L);
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(4).getUniCode(), "oms:detail_backPay_btn");
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(4).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getRoleFeatureResources().get(4).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+        Assertions.assertEquals(roleResps.get(0).getRoleFeatureResources().get(4).getTerminal(), "NT_OMS_WEB");
+
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .needRoleGroup(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertNotNull(roleResps.get(0).getRoleGroup());
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getId(), 6);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getWorkspaceType(), 6);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCooperateShipType(), 6);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getName(), "研发中心");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getWorkspaceId(), -1);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getOuId(), -1);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getParentId(), 0);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getPath(), "6,");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getSort(), 3);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCode(), "A1");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCategoryCode(), "FF");
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getRoleGroup().getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 9, 19, 14, 31, 19));
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getRoleGroup().getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 5, 29, 9, 33, 24));
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(25324L))
+                        .needRoleGroup(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertNotNull(roleResps.get(0).getRoleGroup());
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getId(), 13);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getWorkspaceType(), 2);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCooperateShipType(), 5);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getName(), "专业分包");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getWorkspaceId(), -1);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getOuId(), -1);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getParentId(), 0);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getPath(), "13,");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getSort(), 1);
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCode(), "A2");
+        Assertions.assertEquals(roleResps.get(0).getRoleGroup().getCategoryCode(), "");
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getRoleGroup().getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 49, 59));
+        Assertions.assertEquals(LocalDateTime.ofInstant(roleResps.get(0).getRoleGroup().getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 15, 18, 39, 13));
+
+        List<PersonProfileDto> personProfileDtos = Lists.newArrayList();
+        PersonProfileDto personProfileDto = new PersonProfileDto();
+        personProfileDto.setId(24511L);
+        personProfileDto.setRealName("测试名字");
+        personProfileDtos.add(personProfileDto);
+        Mockito.when(userProfileServiceApi.postPersonProfiles(Mockito.any()))
+                .thenReturn(CommonResponse.success(personProfileDtos));
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .needRoleUser(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().size(), 1);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getPersonId(), 24511L);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getIdentityId(), 28802L);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getIdentityType(), 3);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getOuId(), 4L);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getWorkspaceId(), 3L);
+        Assertions.assertEquals(roleResps.get(0).getRoleUsers().get(0).getRealName(), "测试名字");
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .needFeatureResourceRelation(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().size(), 10);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().get(0).getFeatureId(), 153L);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().get(0).getType(), 1);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().get(0).getFeatureType(), 2);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roleResps.get(0).getFeatureResourceRelations().get(0).getTags().contains(RolePermissionTagEnum.JOINED.name()));
+
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .roleIds(Sets.newHashSet(24425L))
+                        .needFeatureResourceRelation(true)
+                        .featureResourceTypes(Lists.newArrayList(FeatureResourceTypeEnum.PAGE))
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 1);
+        Assertions.assertEquals(roleResps.get(0).getFeatureResourceRelations().size(), 7);
+
+        roleResps = roleController.page(PageRoleReq.builder()
+                        .needPresetRole(true)
+                        .build())
+                .getData()
+                .getData();
+        Assertions.assertEquals(roleResps.size(), 4);
+
+    }
+}

tyr-server/src/test/java/cn/axzo/tyr/server/controller/v2/RoleGroupControllerTest.java

@@ -0,0 +1,229 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.tyr.base.BaseTest;
+import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.feign.enums.RoleTypeEnum;
+import cn.axzo.tyr.feign.req.PageRoleGroupReq;
+import cn.axzo.tyr.feign.resp.RoleGroupResp;
+import com.google.common.collect.Sets;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockitoAnnotations;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+import java.util.List;
+
+class RoleGroupControllerTest extends BaseTest {
+
+    @Autowired
+    private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private RoleGroupController roleGroupController;
+
+    @BeforeEach
+    @Override
+    public void setup() {
+        super.setup();
+        mysqlDataLoader.loadFromClassName(getClass().getSimpleName());
+        MockitoAnnotations.initMocks(this);
+    }
+
+    @Test
+    void page() {
+
+        List<RoleGroupResp> page = roleGroupController.page(PageRoleGroupReq.builder()
+                .build())
+                .getData()
+                .getData();
+
+        Assertions.assertEquals(page.size(), 5);
+
+        page = roleGroupController.page(PageRoleGroupReq.builder()
+                        .roleGroupCodes(Sets.newHashSet("A1", "A2"))
+                        .build())
+                .getData()
+                .getData();
+
+        Assertions.assertEquals(page.size(), 2);
+
+        page = roleGroupController.page(PageRoleGroupReq.builder()
+                        .roleGroupCodes(Sets.newHashSet("A1", "A2"))
+                        .needRole(true)
+                        .build())
+                .getData()
+                .getData();
+
+        Assertions.assertEquals(page.size(), 2);
+        Assertions.assertEquals(page.get(0).getRoles().size(), 1);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleId(), 24425L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleCode(), "oms:project_manager");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getName(), "项目经理");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getDescription(), "描述");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleType(), "init");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getOuId(), -1L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getCooperateShipType(), 6);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getCreateBy(), 2003043L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getUpdateBy(), 2003028L);
+        Assertions.assertTrue(page.get(0).getRoles().get(0).getIsDisplay());
+        Assertions.assertTrue(page.get(0).getRoles().get(0).getEnabled());
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getSort(), 2);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(0).getRoles().get(0).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 9, 19, 15, 22, 55));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(0).getRoles().get(0).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 25));
+
+        Assertions.assertEquals(page.get(1).getRoles().size(), 3);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleId(), 25324L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleCode(), "cms:mafb_project_commissioner");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getName(), "项目负责人");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getUpdateBy(), 9000399985L);
+        Assertions.assertTrue(page.get(1).getRoles().get(0).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(0).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getSort(), 1);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(0).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 49, 59));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(0).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 40));
+
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleId(), 25326L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleCode(), "cms:mafb_business_vice_officer");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getName(), "商务副经理");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getUpdateBy(), 2006333L);
+        Assertions.assertTrue(page.get(1).getRoles().get(1).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(1).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getSort(), 2);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(1).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 50, 0));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(1).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 41));
+
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleId(), 25327L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleCode(), "cms:mafb_productivity_vice_officer");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getName(), "生产副经理");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getUpdateBy(), 2006333L);
+        Assertions.assertTrue(page.get(1).getRoles().get(2).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(2).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getSort(), 3);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(2).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 50, 0));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(2).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 41));
+
+        page = roleGroupController.page(PageRoleGroupReq.builder()
+                        .roleGroupCodes(Sets.newHashSet("A1", "A2"))
+                        .needRole(true)
+                        .roleTypes(Sets.newHashSet(RoleTypeEnum.SUPER_ADMIN))
+                        .build())
+                .getData()
+                .getData();
+
+        Assertions.assertEquals(page.size(), 2);
+        Assertions.assertNull(page.get(0).getRoles());
+        Assertions.assertNull(page.get(1).getRoles());
+
+        page = roleGroupController.page(PageRoleGroupReq.builder()
+                        .roleGroupCodes(Sets.newHashSet("A1", "A2"))
+                        .needRole(true)
+                        .roleTypes(Sets.newHashSet(RoleTypeEnum.INIT))
+                        .build())
+                .getData()
+                .getData();
+
+        Assertions.assertEquals(page.size(), 2);
+        Assertions.assertEquals(page.get(0).getRoles().size(), 1);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleId(), 24425L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleCode(), "oms:project_manager");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getName(), "项目经理");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getDescription(), "描述");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getRoleType(), "init");
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getOuId(), -1L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getCooperateShipType(), 6);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getCreateBy(), 2003043L);
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getUpdateBy(), 2003028L);
+        Assertions.assertTrue(page.get(0).getRoles().get(0).getIsDisplay());
+        Assertions.assertTrue(page.get(0).getRoles().get(0).getEnabled());
+        Assertions.assertEquals(page.get(0).getRoles().get(0).getSort(), 2);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(0).getRoles().get(0).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 9, 19, 15, 22, 55));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(0).getRoles().get(0).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 25));
+
+        Assertions.assertEquals(page.get(1).getRoles().size(), 3);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleId(), 25324L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleCode(), "cms:mafb_project_commissioner");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getName(), "项目负责人");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getUpdateBy(), 9000399985L);
+        Assertions.assertTrue(page.get(1).getRoles().get(0).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(0).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(0).getSort(), 1);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(0).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 49, 59));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(0).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 40));
+
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleId(), 25326L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleCode(), "cms:mafb_business_vice_officer");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getName(), "商务副经理");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getUpdateBy(), 2006333L);
+        Assertions.assertTrue(page.get(1).getRoles().get(1).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(1).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(1).getSort(), 2);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(1).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 50, 0));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(1).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 41));
+
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleId(), 25327L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleCode(), "cms:mafb_productivity_vice_officer");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getName(), "生产副经理");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getDescription(), "");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getRoleType(), "init");
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getWorkspaceId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getOuId(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getCooperateShipType(), 5);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getCreateBy(), -1L);
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getUpdateBy(), 2006333L);
+        Assertions.assertTrue(page.get(1).getRoles().get(2).getIsDisplay());
+        Assertions.assertTrue(page.get(1).getRoles().get(2).getEnabled());
+        Assertions.assertEquals(page.get(1).getRoles().get(2).getSort(), 3);
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(2).getCreateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2023, 10, 23, 17, 50, 0));
+        Assertions.assertEquals(LocalDateTime.ofInstant(page.get(1).getRoles().get(2).getUpdateAt().toInstant(), ZoneId.systemDefault()),
+                LocalDateTime.of(2024, 8, 13, 10, 25, 41));
+    }
+}

tyr-server/src/test/java/cn/axzo/tyr/server/controller/v2/UserPermissionControllerTest.java

@@ -0,0 +1,838 @@
+package cn.axzo.tyr.server.controller.v2;
+
+import cn.axzo.client.feign.FeatureCodeCachedApi;
+import cn.axzo.foundation.exception.BusinessException;
+import cn.axzo.framework.domain.web.result.ApiListResult;
+import cn.axzo.framework.domain.web.result.ApiResult;
+import cn.axzo.maokai.api.client.OrgUserApi;
+import cn.axzo.maokai.api.vo.response.OrgUserRes;
+import cn.axzo.maokai.common.enums.OrgUserStatusEnum;
+import cn.axzo.thrones.client.saas.ServicePkgClient;
+import cn.axzo.thrones.client.saas.entity.serivicepgkproduct.ServicePkgProduct;
+import cn.axzo.thrones.client.saas.entity.servicepkg.ServicePkgDetailRes;
+import cn.axzo.tyr.base.BaseTest;
+import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.client.model.enums.IdentityType;
+import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
+import cn.axzo.tyr.client.model.req.IdentityAuthReq;
+import cn.axzo.tyr.client.model.req.PermissionCheckReq;
+import cn.axzo.tyr.client.model.res.IdentityAuthRes;
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.req.ListUserPermissionReq;
+import cn.axzo.tyr.feign.resp.UserPermissionResp;
+import cn.axzo.tyr.server.service.PermissionQueryService;
+import cn.axzo.tyr.server.service.TyrSaasAuthService;
+import cn.azxo.framework.common.model.CommonResponse;
+import com.google.common.collect.Maps;
+import com.google.common.collect.Sets;
+import org.apache.commons.collections.CollectionUtils;
+import org.assertj.core.util.Lists;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static cn.axzo.tyr.server.config.exception.BizResultCode.PARAM_ERROR;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class UserPermissionControllerTest extends BaseTest {
+
+    @Autowired
+    private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private UserPermissionController userPermissionController;
+    @Autowired
+    private PermissionQueryService permissionQueryService;
+    @Autowired
+    private OrgUserApi orgUserApi;
+    @Autowired
+    private FeatureCodeCachedApi featureCodeCachedApi;
+    @Autowired
+    private ServicePkgClient servicePkgClient;
+    @Autowired
+    private TyrSaasAuthService tyrSaasAuthService;
+
+    @BeforeEach
+    @Override
+    public void setup() {
+        super.setup();
+        mysqlDataLoader.loadFromClassName(getClass().getSimpleName());
+        MockitoAnnotations.initMocks(this);
+        Mockito.when(orgUserApi.listOrgUser(Mockito.any()))
+                .thenReturn(ApiListResult.ok(com.google.common.collect.Lists.newArrayList(OrgUserRes.builder()
+                                .workspaceId(3L)
+                                .ouId(4L)
+                                .personId(1827L)
+                                .status(OrgUserStatusEnum.JOINED)
+                                .build(),
+                        OrgUserRes.builder()
+                                .workspaceId(3L)
+                                .ouId(4L)
+                                .personId(3470L)
+                                .status(OrgUserStatusEnum.LEAVE)
+                                .build())));
+
+        Map<String, Set<String>> featureCodeMap = Maps.newHashMap();
+        featureCodeMap.put("h5:cmp_user_manage_worker_page", Sets.newHashSet("h5:cmp_user_manage_worker_page"));
+        Mockito.when(featureCodeCachedApi.list(Mockito.eq(FeatureCodeCachedApi.ListFeatureCodeParam.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page"))
+                        .build())))
+                .thenReturn(ApiResult.ok(featureCodeMap));
+
+        featureCodeMap = Maps.newHashMap();
+        featureCodeMap.put("h5:cmp_user_manage_worker_page", Sets.newHashSet("h5:cmp_user_manage_worker_page"));
+        featureCodeMap.put("h5:cmp_user_manage_worker_jump_to_team_btn", Sets.newHashSet("h5:cmp_user_manage_worker_jump_to_team_btn"));
+        Mockito.when(featureCodeCachedApi.list(Mockito.eq(FeatureCodeCachedApi.ListFeatureCodeParam.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .build())))
+                .thenReturn(ApiResult.ok(featureCodeMap));
+
+        ServicePkgDetailRes servicePkgDetail = new ServicePkgDetailRes();
+        servicePkgDetail.setSpaceId(3L);
+        ServicePkgProduct servicePkgProduct = new ServicePkgProduct();
+        servicePkgProduct.setProductId(2L);
+        servicePkgDetail.setProducts(com.google.common.collect.Lists.newArrayList(servicePkgProduct));
+        Mockito.when(servicePkgClient.getServicePkgDetailBySpaceId(Mockito.any()))
+                .thenReturn(CommonResponse.success(com.google.common.collect.Lists.newArrayList(servicePkgDetail)));
+    }
+
+    @Test
+    void listUserPermissionReplaceHasPermission() {
+
+        Map<String, Set<String>> featureCodeMap = Maps.newHashMap();
+        featureCodeMap.put("h5:cmp_user_manage_worker_page", Sets.newHashSet("h5:cmp_user_manage_worker_page"));
+        featureCodeMap.put("h5:cmp_user_manage_worker_page_2", Sets.newHashSet("h5:cmp_user_manage_worker_page_2"));
+        featureCodeMap.put("h5:cmp_user_manage_worker_on_site_audit_btn", Sets.newHashSet("h5:cmp_user_manage_worker_on_site_audit_btn"));
+        featureCodeMap.put("h5:cmp_user_manage_worker_jump_to_team_btn", Sets.newHashSet("h5:cmp_user_manage_worker_jump_to_team_btn"));
+        Mockito.when(featureCodeCachedApi.list(Mockito.any()))
+                .thenReturn(ApiResult.ok(featureCodeMap));
+
+        // old cn.axzo.tyr.client.feign.PermissionQueryApi#hasPermission
+        PermissionCheckReq permissionCheckReq = PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .build();
+        boolean hasPermission = permissionQueryService.hasPermission(permissionCheckReq);
+        Assertions.assertTrue(hasPermission);
+
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page"))
+                .ouId(4L)
+                .workspaceId(4L)
+                .build());
+        Assertions.assertFalse(hasPermission);
+
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .build());
+        Assertions.assertTrue(hasPermission);
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .terminal("NT_CMP_APP_GENERAL")
+                .build());
+        Assertions.assertTrue(hasPermission);
+
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .terminal("NT_CMS_WEB_GENERAL")
+                .build());
+        Assertions.assertFalse(hasPermission);
+
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .tags(Sets.newHashSet(RolePermissionTagEnum.LEAVE))
+                .build());
+        Assertions.assertFalse(hasPermission);
+
+        hasPermission = permissionQueryService.hasPermission(PermissionCheckReq.builder()
+                .personId(1827L)
+                .featureCodes(Lists.newArrayList("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .ouId(4L)
+                .workspaceId(3L)
+                .tags(Sets.newHashSet(RolePermissionTagEnum.JOINED))
+                .build());
+        Assertions.assertTrue(hasPermission);
+        // old cn.axzo.tyr.client.feign.PermissionQueryApi#hasPermission
+
+        List<UserPermissionResp> userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page"))
+                .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                        .personId(1827L)
+                        .ouId(4L)
+                        .workspaceId(3L)
+                        .build()))
+                .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 2);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(4L)
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isEmpty(userPermissionResps));
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page_2"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isEmpty(userPermissionResps));
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_on_site_audit_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 0);
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .terminal("NT_CMS_WEB_GENERAL")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isEmpty(userPermissionResps));
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .terminal("NT_CMP_APP_GENERAL")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .permissionTags(Sets.newHashSet(cn.axzo.tyr.feign.enums.RolePermissionTagEnum.LEAVE))
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 0);
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .permissionTags(Sets.newHashSet(cn.axzo.tyr.feign.enums.RolePermissionTagEnum.JOINED,
+                                        cn.axzo.tyr.feign.enums.RolePermissionTagEnum.LEAVE))
+                                .build()))
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+    }
+
+    @Test
+    void listUserPermissionReplaceFindIdentityAuth() {
+
+        // old
+        IdentityAuthReq identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page"))
+                .build();
+        IdentityAuthRes identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 2);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(4L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page"))
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 4L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 0);
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 3);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .terminal(Lists.newArrayList("NT_CMS_WEB_GENERAL"))
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 0);
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .terminal(Lists.newArrayList("NT_CMP_APP_GENERAL"))
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 3);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .appType("H5")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 3);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .appType("APP")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 0);
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .itemCode("h5:user_manage_D9B0187")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 0);
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .itemCode("h5:user_manage_D9B0186")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 3);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .personId(1827L)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .featureId(Sets.newHashSet(101745L))
+                .itemCode("h5:user_manage_D9B0186")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getPersonId(), 1827L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        identityAuthReq = IdentityAuthReq.builder()
+                .identityId(6L)
+                .identityType(IdentityType.PRACTITIONER)
+                .workspaceOusPairs(Lists.newArrayList(IdentityAuthReq.WorkspaceOuPair.builder()
+                        .workspaceId(3L)
+                        .ouId(4L)
+                        .build()))
+                .featureCode(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                .featureId(Sets.newHashSet(101745L))
+                .itemCode("h5:user_manage_D9B0186")
+                .build();
+        identityAuthMix = tyrSaasAuthService.findIdentityAuthMix(identityAuthReq);
+        Assertions.assertEquals(identityAuthMix.getIdentity(), 6L);
+        Assertions.assertEquals(identityAuthMix.getIdentityType(), IdentityType.PRACTITIONER);
+        Assertions.assertNull(identityAuthMix.getPersonId());
+        Assertions.assertEquals(identityAuthMix.getPermissions().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getOuId(), 4L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(identityAuthMix.getPermissions().get(0).isSuperAdmin());
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().size(), 1);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureId(), 101745L);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(identityAuthMix.getPermissions().get(0).getPermissionPoint().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        // old
+
+        List<UserPermissionResp> userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .itemCode("h5:user_manage_D9B0186")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .appType("APP")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isEmpty(userPermissionResps));
+
+        userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                .personId(1827L)
+                                .ouId(4L)
+                                .workspaceId(3L)
+                                .build()))
+                        .appType("H5")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+    }
+
+    @Test
+    void listUserPermission() {
+        BusinessException businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .personId(1827L)
+                                    .identityId(11L)
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:personId 和 identityId只能二选一");
+
+        businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .personId(1827L)
+                                    .identityType(IdentityTypeEnum.OPERATOR)
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:personId 和 identityId只能二选一");
+
+        businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .personId(1827L)
+                                    .identityId(2424L)
+                                    .identityType(IdentityTypeEnum.OPERATOR)
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:personId 和 identityId只能二选一");
+
+        businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:personId 和 identityId不能同时为空");
+
+        businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .identityId(123L)
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:identityType不能为空");
+
+        businessException = assertThrows(BusinessException.class, () -> {
+            userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                            .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                            .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                    .identityType(IdentityTypeEnum.OPERATOR)
+                                    .ouId(4L)
+                                    .workspaceId(3L)
+                                    .build()))
+                            .appType("H5")
+                            .build())
+                    .getData();
+        });
+        Assertions.assertEquals(businessException.getErrorCode(), PARAM_ERROR.getErrorCode());
+        Assertions.assertEquals(businessException.getErrorMsg(), "参数错误:personId 和 identityId不能同时为空");
+
+        List<UserPermissionResp> userPermissionResps = userPermissionController.listUserPermission(ListUserPermissionReq.builder()
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_page", "h5:cmp_user_manage_worker_jump_to_team_btn"))
+                        .userPermissions(Lists.newArrayList(ListUserPermissionReq.UserPermission.builder()
+                                        .personId(1827L)
+                                        .ouId(4L)
+                                        .workspaceId(3L)
+                                        .build(),
+                                ListUserPermissionReq.UserPermission.builder()
+                                        .identityId(8L)
+                                        .identityType(IdentityTypeEnum.PRACTITIONER)
+                                        .ouId(4L)
+                                        .workspaceId(3L)
+                                        .build()))
+                        .appType("H5")
+                        .build())
+                .getData();
+        Assertions.assertTrue(CollectionUtils.isNotEmpty(userPermissionResps));
+        Assertions.assertEquals(userPermissionResps.get(0).getPersonId(), 1827L);
+        Assertions.assertEquals(userPermissionResps.get(0).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(0).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(0).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+
+        Assertions.assertEquals(userPermissionResps.get(1).getIdentityId(), 8L);
+        Assertions.assertEquals(userPermissionResps.get(1).getIdentityType(), IdentityTypeEnum.PRACTITIONER.name());
+        Assertions.assertEquals(userPermissionResps.get(1).getOuId(), 4L);
+        Assertions.assertEquals(userPermissionResps.get(1).getWorkspaceId(), 3L);
+        Assertions.assertFalse(userPermissionResps.get(0).getIsSuperAdmin());
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().size(), 3);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(0).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_jump_to_team_btn");
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(1).getFeatureId(), 101744L);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(1).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(1).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(1).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(2).getFeatureId(), 101745L);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(2).getFeatureCode(), "h5:cmp_user_manage_worker_page");
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(2).getFeatureType(), 4);
+        Assertions.assertEquals(userPermissionResps.get(1).getPermissions().get(2).getTerminal(), "NT_CMP_APP_GENERAL");
+    }
+}

tyr-server/src/test/java/cn/axzo/tyr/server/permission/JobTest.java

@@ -1,28 +0,0 @@
-package cn.axzo.tyr.server.permission;
-
-import cn.axzo.tyr.server.job.ProductFeatureRefreshJobHandler;
-import cn.axzo.tyr.server.model.ProductFeatureRefreshParam;
-import com.alibaba.fastjson.JSON;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-
-/**
- * @version V1.0
- * @author: ZhanSiHu
- * @date: 2023/10/23 11:30
- */
-@SpringBootTest
-public class JobTest {
-    @Autowired
-    private ProductFeatureRefreshJobHandler productFeatureRefreshJobHandler;
-
-    @Test
-    public void testProductFeatureRefresh() throws Exception {
-        ProductFeatureRefreshParam param = new ProductFeatureRefreshParam();
-        param.setWorkspaceType(2);
-        param.setProductId(1007L);
-        productFeatureRefreshJobHandler.execute(JSON.toJSONString(param));
-    }
-
-}

tyr-server/src/test/java/cn/axzo/tyr/server/permission/PermissionPointTest.java

@@ -1,145 +0,0 @@
-package cn.axzo.tyr.server.permission;
-
-import cn.axzo.framework.domain.web.result.ApiResult;
-import cn.axzo.tyr.client.model.enums.FeatureType;
-import cn.axzo.tyr.client.model.permission.PermissionPointDTO;
-import cn.axzo.tyr.client.model.permission.PermissionPointListQueryRequest;
-import cn.axzo.tyr.client.model.permission.PermissionPointMoveRequest;
-import cn.axzo.tyr.client.model.permission.PermissionPointTreeNode;
-import cn.axzo.tyr.client.model.permission.PermissionPointTreeQueryReq;
-import cn.axzo.tyr.client.model.permission.PermissionPointVO;
-import cn.axzo.tyr.server.controller.permission.PermissionPointController;
-import cn.axzo.tyr.server.repository.entity.SaasFeature;
-import cn.axzo.tyr.server.repository.dao.SaasFeatureDao;
-import cn.axzo.tyr.server.service.PermissionPointService;
-import com.alibaba.fastjson.JSON;
-import com.alibaba.fastjson.serializer.SerializerFeature;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-
-import java.util.Arrays;
-import java.util.List;
-
-/**
- * 权限点测试
- *
- * @version V1.0
- * @author: ZhanSiHu
- * @date: 2023/9/6 14:59
- */
-@SpringBootTest
-public class PermissionPointTest {
-    @Autowired
-    private PermissionPointController controller;
-    @Autowired
-    private SaasFeatureDao saasFeatureDao;
-    @Autowired
-    private PermissionPointService permissionPointService;
-
-    @Test
-    public void testList() {
-        List<SaasFeature> saasFeatures = saasFeatureDao.listByIds(Arrays.asList(206L, 207L, 208L));
-        System.out.println(JSON.toJSONString(saasFeatures));
-    }
-
-    @Test
-    public void testListTreeNode() {
-        PermissionPointTreeQueryReq request = new PermissionPointTreeQueryReq();
-        //request.setParentId(354L);
-        //request.setKeyword("预警");
-        //request.setWorkspaceType(Arrays.asList("ent"));
-        //request.setTerminalList(Arrays.asList("NT_CMS_WEB_ENT_ZB"));
-        request.setDelegateType(0);
-        request.setMaxLevel(3);
-        request.setMaxFeatureType(2);
-        ApiResult<List<PermissionPointTreeNode>> result = controller.listTreeNodes(request);
-        System.out.println("---------------");
-        System.out.println(JSON.toJSONString(result, SerializerFeature.DisableCircularReferenceDetect));
-    }
-
-    @Test
-    public void testGetDetail() {
-        Long permissionId = 360L;
-        ApiResult<PermissionPointVO> result = controller.getDetail(permissionId);
-        System.out.println(JSON.toJSONString(result));
-    }
-
-    @Test
-    public void testListByIds() {
-        List<Long> ids = Arrays.asList(354L, 360L);
-        ApiResult<List<PermissionPointTreeNode>> result = controller.listTreeNodesByIds(ids);
-        System.out.println(JSON.toJSONString(result));
-    }
-
-    @Test
-    public void testInsert() {
-        PermissionPointDTO permissionPoint = new PermissionPointDTO();
-        permissionPoint.setFeatureName("测试合同权限点");
-        permissionPoint.setFeatureCode("CMS_WEB_PROJ_0158");
-        //permissionPoint.setParentId(360L);
-        //permissionPoint.setPath("/0/354/360/");
-        //permissionPoint.setSort(3);
-        //permissionPoint.setTerminal("NT_CMS_WEB_PROJ");
-        permissionPoint.setTerminal("NT_CMS_WEB_ENT_ZB");
-        permissionPoint.setFeatureType(1);
-        //permissionPoint.setAppName("tyr");
-        //permissionPoint.setFeatureUrl("/tyr/test/permission");
-        //permissionPoint.setNeedAuth(true);
-        //permissionPoint.setNeedAuth(true);
-        System.out.println(JSON.toJSONString(permissionPoint));
-        controller.savePermissionPoint(permissionPoint);
-    }
-
-    @Test
-    public void testUpdate() {
-        PermissionPointDTO permissionPoint = new PermissionPointDTO();
-        permissionPoint.setId(3479L);
-        permissionPoint.setFeatureName("测试合同权限点");
-        permissionPoint.setFeatureCode("CMS_WEB_PROJ_0159"); //不生效
-        permissionPoint.setParentId(361L);//不生效
-        permissionPoint.setPath("/0/354/361/");//不生效
-        permissionPoint.setSort(9);//不生效
-        permissionPoint.setTerminal("NT_CMS_WEB_PROJ-xx");//不生效
-        permissionPoint.setFeatureType(3);
-        permissionPoint.setAppName("tyr");
-        permissionPoint.setFeatureUrl("/tyr/test/permission");
-        permissionPoint.setNeedAuth(true);
-        permissionPoint.setNeedAuth(true);
-        controller.savePermissionPoint(permissionPoint);
-    }
-
-
-    @Test
-    public void testMove() {
-        PermissionPointMoveRequest request = new PermissionPointMoveRequest();
-        request.setPermissionId(3483L);
-        request.setParentId(360L);
-        request.setSort(1);
-        ApiResult<Void> result = controller.move(request);
-        System.out.println(JSON.toJSONString(result));
-    }
-
-
-    @Test
-    public void testDelete() {
-        Long permissionId = 360L;
-        controller.deletePermissionPoint(permissionId);
-    }
-
-    @Test
-    public void testQueryList() {
-        PermissionPointListQueryRequest request = new PermissionPointListQueryRequest();
-        request.setFeatureType(FeatureType.BUTTON.getCode());
-        request.setIds(Arrays.asList(255L, 266L));
-        ApiResult<List<PermissionPointTreeNode>> result = controller.queryList(request);
-        System.out.println(JSON.toJSONString(result));
-    }
-
-    @Test
-    public void test() {
-        List<SaasFeature> saasFeatures = permissionPointService.listNodeWithChildrenByCode("CMS_WEB_PROJ_0546", "NT_CMS_WEB_PROJ");
-        System.out.println(JSON.toJSONString(saasFeatures));
-    }
-
-}

tyr-server/src/test/java/cn/axzo/tyr/server/permission/RoleUserTest.java

@@ -1,78 +0,0 @@
-package cn.axzo.tyr.server.permission;
-
-import cn.axzo.framework.domain.web.result.ApiPageResult;
-import cn.axzo.framework.domain.web.result.ApiResult;
-import cn.axzo.tyr.client.feign.TyrSaasRoleApi;
-import cn.axzo.tyr.client.model.BaseWorkspaceModel;
-import cn.axzo.tyr.client.model.enums.FeatureType;
-import cn.axzo.tyr.client.model.enums.IdentityType;
-import cn.axzo.tyr.client.model.req.RoleWithUserQueryReq;
-import cn.axzo.tyr.client.model.res.RoleWithUserRes;
-import cn.axzo.tyr.server.controller.role.SaasRoleController;
-import cn.axzo.tyr.server.repository.dao.SaasFeatureDao;
-import cn.axzo.tyr.server.repository.dao.SaasRoleDao;
-import cn.axzo.tyr.server.repository.dao.SaasRoleUserRelationDao;
-import cn.axzo.tyr.server.repository.entity.SaasRole;
-import cn.axzo.tyr.server.service.RoleService;
-import com.alibaba.fastjson.JSON;
-import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-
-import java.util.Arrays;
-import java.util.List;
-
-/**
- * 权限点测试
- *
- * @version V1.0
- * @author: ZhanSiHu
- * @date: 2023/9/6 14:59
- */
-@SpringBootTest
-public class RoleUserTest {
-    @Autowired
-    private SaasRoleUserRelationDao saasRoleUserRelationDao;
-    @Autowired
-    private SaasFeatureDao saasFeatureDao;
-
-    @Autowired
-    private SaasRoleController controller;
-
-    @Autowired
-    private SaasRoleDao saasRoleDao;
-
-    @Autowired
-    private RoleService roleService;
-
-    @Test
-    public void testList() {
-        saasRoleUserRelationDao.deleteByUser(BaseWorkspaceModel.builder()
-                        .workspaceId(
-                                999L
-                        )
-                        .ouId(123L)
-                        .identityId(32L)
-                        .identityType(IdentityType.PRACTITIONER)
-                .build(), Arrays.asList(4L));
-    }
-
-    @Test
-    public void testQuery() {
-        RoleWithUserQueryReq request = new RoleWithUserQueryReq();
-        request.setOuId(5195L);
-        request.setWorkspaceId(232L);
-        request.setPage(1L);
-        request.setPageSize(5L);
-        ApiPageResult<RoleWithUserRes> result = controller.queryRoleWithUser(request);
-        System.out.println(JSON.toJSONString(result));
-    }
-
-    @Test
-    public void testListAdmin() {
-        roleService.listAdmins(111L, 22L);
-    }
-
-
-}

tyr-server/src/test/java/cn/axzo/tyr/server/permission/SimpleTest.java

@@ -1,25 +0,0 @@
-package cn.axzo.tyr.server.permission;
-
-import cn.axzo.tyr.client.model.permission.PermissionPointVO;
-import cn.hutool.core.date.StopWatch;
-import org.junit.Test;
-
-import java.util.concurrent.TimeUnit;
-
-/**
- * @version V1.0
- * @author: ZhanSiHu
- * @date: 2023/9/13 18:43
- */
-public class SimpleTest {
-
-    @Test
-    public void testSplitBit() {
-
-        PermissionPointVO vo = new PermissionPointVO();
-        vo.applyFitOuTypeBit(65535L);
-        System.out.println(vo.getFitOuTypeList());
-        vo.applyFitOuTypeBit(65535L);
-        System.out.println(vo.getFitOuTypeList());
-    }
-}

tyr-server/src/test/java/cn/axzo/tyr/server/service/RoleServiceTest.java

@@ -7,7 +7,9 @@ import cn.axzo.apollo.workspace.api.workspace.res.SimpleWorkspaceRes;
 import cn.axzo.basics.profiles.api.UserProfileServiceApi;
 import cn.axzo.tyr.base.BaseTest;
 import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.client.common.enums.FeatureResourceType;
 import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
+import cn.axzo.tyr.client.model.enums.RolePermissionTagEnum;
 import cn.axzo.tyr.client.model.req.ListRoleReq;
 import cn.axzo.tyr.client.model.req.QueryByIdentityIdTypeReq;
 import cn.axzo.tyr.client.model.req.QuerySaasRoleReq;
@@ -30,6 +32,9 @@ import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
 
+import static cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation.NEW_FEATURE;
+import static cn.axzo.tyr.server.repository.entity.SaasPgroupPermissionRelation.OLD_FEATURE;
+
 class RoleServiceTest extends BaseTest {
 
     @Autowired
@@ -88,6 +93,201 @@ class RoleServiceTest extends BaseTest {
                 .roleIds(Lists.newArrayList(24425L, 25324L))
                 .build());
         Assertions.assertEquals(roles.size(), 2);
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermission(true)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().size(), 5);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getId(), 153L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getFeatureCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getUniCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(1).getId(), 466L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(1).getFeatureCode(), "oms:imConfig_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(1).getUniCode(), "oms:imConfig_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(1).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(1).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(1).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(2).getId(), 467L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(2).getFeatureCode(), "oms:im_robot_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(2).getUniCode(), "oms:im_robot_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(2).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(2).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(2).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(3).getId(), 469L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(3).getFeatureCode(), "oms:msgPush_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(3).getUniCode(), "oms:msgPush_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(3).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(3).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(3).getTerminal(), "NT_OMS_WEB");
+
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(4).getId(), 693L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(4).getFeatureCode(), "oms:detail_backPay_btn");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(4).getUniCode(), "oms:detail_backPay_btn");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(4).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(4).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(4).getTerminal(), "NT_OMS_WEB");
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .featureIds(Lists.newArrayList(153L))
+                .needPermission(true)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().size(), 1);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getId(), 153L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getFeatureCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getUniCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTerminal(), "NT_OMS_WEB");
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .terminal("NT_OMS_WEB")
+                .needPermission(true)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().size(), 1);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getId(), 153L);
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getFeatureCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getUniCode(), "oms:menu_page");
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getSaasPermissions().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+        Assertions.assertEquals(roles.get(0).getSaasPermissions().get(0).getTerminal(), "NT_OMS_WEB");
+
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().size(), 10);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureId(), 153L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(1).getFeatureId(), 466L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(1).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(1).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(1).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(1).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(2).getFeatureId(), 467L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(2).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(2).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(2).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(2).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(3).getFeatureId(), 469L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(3).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(3).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(3).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(3).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(4).getFeatureId(), 693L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(4).getFeatureType(), 4);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(4).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(4).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(4).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(5).getFeatureId(), 694L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(5).getFeatureType(), 0);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(5).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(5).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(5).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(6).getFeatureId(), 695L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(6).getFeatureType(), 0);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(6).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(6).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(6).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(7).getFeatureId(), 101996L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(7).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(7).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(7).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(7).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(8).getFeatureId(), 102055L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(8).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(8).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(8).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(8).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(9).getFeatureId(), 102056L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(9).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(9).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(9).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(9).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .featureIds(Lists.newArrayList(153L))
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureId(), 153L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .type(OLD_FEATURE)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertNull(roles.get(0).getPermissionRelations());
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .type(NEW_FEATURE)
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().size(), 10);
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .type(NEW_FEATURE)
+                .featureResourceTypes(Lists.newArrayList(FeatureResourceType.COMPONENT))
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().size(), 1);
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureId(), 693L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
+
+        roles = roleService.list(ListRoleReq.builder()
+                .roleIds(Lists.newArrayList(24425L))
+                .needPermissionRelation(true)
+                .type(NEW_FEATURE)
+                .terminal("NT_OMS_WEB")
+                .build());
+        Assertions.assertEquals(roles.size(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().size(), 4);
+
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureId(), 153L);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getFeatureType(), 2);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getType(), 1);
+        Assertions.assertEquals(roles.get(0).getPermissionRelations().get(0).getTags().size(), 1);
+        Assertions.assertTrue(roles.get(0).getPermissionRelations().get(0).getTags().contains(RolePermissionTagEnum.JOINED));
     }
 
     @Test

tyr-server/src/test/java/cn/axzo/tyr/server/service/impl/ProductServiceImplTest.java

@@ -0,0 +1,51 @@
+package cn.axzo.tyr.server.service.impl;
+
+import cn.axzo.foundation.page.PageResp;
+import cn.axzo.tyr.base.BaseTest;
+import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.feign.req.PageProductReq;
+import cn.axzo.tyr.feign.resp.ProductResp;
+import cn.axzo.tyr.server.service.ProductService;
+import cn.hutool.db.Page;
+import org.apache.commons.compress.utils.Sets;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockitoAnnotations;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class ProductServiceImplTest extends BaseTest {
+
+    @Autowired
+    private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private ProductService productService;
+
+    @BeforeEach
+    @Override
+    public void setup() {
+        super.setup();
+        mysqlDataLoader.loadFromClassName(getClass().getSimpleName());
+    }
+
+    @Test
+    void pageV2() {
+        PageResp<ProductResp> resp = productService.pageV2(PageProductReq.builder()
+                .build());
+
+        Assertions.assertEquals(resp.getData().size(), 2);
+
+        resp = productService.pageV2(PageProductReq.builder()
+                        .dictWorkspaceTypeIdS(Sets.newHashSet(1L))
+                .build());
+        Assertions.assertEquals(resp.getData().size(), 1);
+
+        resp = productService.pageV2(PageProductReq.builder()
+                .authTypes(Sets.newHashSet(1))
+                .build());
+        Assertions.assertEquals(resp.getData().size(), 2);
+
+    }
+}

tyr-server/src/test/java/cn/axzo/tyr/server/service/impl/SaasRoleUserRelationServiceImplTest.java

@@ -4,11 +4,16 @@ import cn.axzo.foundation.exception.BusinessException;
 import cn.axzo.foundation.page.PageResp;
 import cn.axzo.tyr.base.BaseTest;
 import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.client.common.enums.RoleResourceTypeEnum;
 import cn.axzo.tyr.client.common.enums.RoleTypeEnum;
+import cn.axzo.tyr.client.model.req.ChangeGroupLeaderRoleReq;
 import cn.axzo.tyr.client.model.roleuser.dto.SaasRoleUserV2DTO;
 import cn.axzo.tyr.client.model.roleuser.req.ListRoleUserRelationParam;
 import cn.axzo.tyr.client.model.roleuser.req.PageRoleUserRelationParam;
+import cn.axzo.tyr.feign.enums.IdentityTypeEnum;
+import cn.axzo.tyr.feign.req.UpsertUserRoleReq;
 import cn.axzo.tyr.server.repository.entity.SaasRoleUserRelation;
+import cn.axzo.tyr.server.service.RoleService;
 import cn.axzo.tyr.server.service.SaasRoleUserRelationService;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
@@ -28,6 +33,8 @@ class SaasRoleUserRelationServiceImplTest extends BaseTest {
     private SaasRoleUserRelationService saasRoleUserRelationService;
     @Autowired
     private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private RoleService roleService;
 
     @BeforeEach
     @Override
@@ -40,12 +47,12 @@ class SaasRoleUserRelationServiceImplTest extends BaseTest {
     void batchRemove() {
 
         List<SaasRoleUserV2DTO> saasRoleUsers = saasRoleUserRelationService.listV2(ListRoleUserRelationParam.builder().build());
-        Assertions.assertEquals(saasRoleUsers.size(), 4);
+        Assertions.assertEquals(saasRoleUsers.size(), 9);
 
         SaasRoleUserRelationService.BatchRemoveParam batchRemoveParam =
                 SaasRoleUserRelationService.BatchRemoveParam.builder().build();
         saasRoleUserRelationService.batchRemove(batchRemoveParam);
-        Assertions.assertEquals(saasRoleUserRelationService.listV2(ListRoleUserRelationParam.builder().build()).size(), 4);
+        Assertions.assertEquals(saasRoleUserRelationService.listV2(ListRoleUserRelationParam.builder().build()).size(), 9);
 
         BusinessException businessException = assertThrows(BusinessException.class, ()->{
             saasRoleUserRelationService.batchRemove(SaasRoleUserRelationService.BatchRemoveParam.builder()
@@ -57,7 +64,7 @@ class SaasRoleUserRelationServiceImplTest extends BaseTest {
         saasRoleUserRelationService.batchRemove(SaasRoleUserRelationService.BatchRemoveParam.builder()
                 .ids(Sets.newHashSet(16399L, 16400L))
                 .build());
-        Assertions.assertEquals(saasRoleUserRelationService.listV2(ListRoleUserRelationParam.builder().build()).size(), 2);
+        Assertions.assertEquals(saasRoleUserRelationService.listV2(ListRoleUserRelationParam.builder().build()).size(), 7);
     }
 
     @Test
@@ -118,4 +125,220 @@ class SaasRoleUserRelationServiceImplTest extends BaseTest {
         result = saasRoleUserRelationService.listV2(list);
         Assertions.assertEquals(result.size(), 1);
     }
+
+    @Test
+    void upsertUserRole() {
+        ListRoleUserRelationParam listRoleUserRelationParam = ListRoleUserRelationParam.builder()
+                .personId(1776L)
+                .resourceType(RoleResourceTypeEnum.NODE.code)
+                .resourceId(17990L)
+                .build();
+        List<SaasRoleUserV2DTO> saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+
+        Assertions.assertEquals(saasRoleUsers.size(), 1);
+        // 清空role
+        saasRoleUserRelationService.upsert(UpsertUserRoleReq.builder()
+                .userRoles(Sets.newHashSet(
+                        UpsertUserRoleReq.UserRoleReq.builder()
+                                .identityId(10256L)
+                                .identityType(IdentityTypeEnum.WORKER)
+                                .personId(1776L)
+                                .workspaceId(195L)
+                                .ouId(7784L)
+                                .nodeId(17990L)
+                                .removeRoleIds(Sets.newHashSet(100008L))
+                                .build()
+                ))
+                .operatorId(11L)
+                .build());
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+
+        Assertions.assertEquals(saasRoleUsers.size(), 0);
+        // 清空role
+
+        // 更换role
+        saasRoleUserRelationService.upsert(UpsertUserRoleReq.builder()
+                .userRoles(Sets.newHashSet(
+                        UpsertUserRoleReq.UserRoleReq.builder()
+                                .identityId(10256L)
+                                .identityType(IdentityTypeEnum.WORKER)
+                                .personId(1776L)
+                                .workspaceId(195L)
+                                .ouId(7784L)
+                                .nodeId(17990L)
+                                .fullRoleIds(Sets.newHashSet(100009L))
+                                .build()
+                ))
+                .operatorId(11L)
+                .build());
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+        Assertions.assertEquals(saasRoleUsers.size(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getRoleId(), 100009L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceType(), RoleResourceTypeEnum.NODE.code);
+        // 更换role
+
+        // 增加和删除role
+        saasRoleUserRelationService.upsert(UpsertUserRoleReq.builder()
+                .userRoles(Sets.newHashSet(
+                        UpsertUserRoleReq.UserRoleReq.builder()
+                                .identityId(10256L)
+                                .identityType(IdentityTypeEnum.WORKER)
+                                .personId(1776L)
+                                .workspaceId(195L)
+                                .ouId(7784L)
+                                .nodeId(17990L)
+                                .insertRoleIds(Sets.newHashSet(100010L))
+                                .build()
+                ))
+                .operatorId(11L)
+                .build());
+        saasRoleUserRelationService.upsert(UpsertUserRoleReq.builder()
+                .userRoles(Sets.newHashSet(
+                        UpsertUserRoleReq.UserRoleReq.builder()
+                                .identityId(10256L)
+                                .identityType(IdentityTypeEnum.WORKER)
+                                .personId(1776L)
+                                .workspaceId(195L)
+                                .ouId(7784L)
+                                .nodeId(17990L)
+                                .removeRoleIds(Sets.newHashSet(100009L))
+                                .insertRoleIds(Sets.newHashSet(100147L))
+                                .build()
+                ))
+                .operatorId(11L)
+                .build());
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+        Assertions.assertEquals(saasRoleUsers.size(), 2);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getRoleId(), 100010L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceType(), RoleResourceTypeEnum.NODE.code);
+
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(1).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getRoleId(), 100147L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceType(), RoleResourceTypeEnum.NODE.code);
+        // 增加role
+    }
+
+    @Test
+    void upsertUserRoleReplaceChangeGroupLeaderRole() {
+        // old
+        // 清空role
+        ListRoleUserRelationParam listRoleUserRelationParam = ListRoleUserRelationParam.builder()
+                .personId(1776L)
+                .resourceType(RoleResourceTypeEnum.NODE.code)
+                .resourceId(17990L)
+                .build();
+        List<SaasRoleUserV2DTO> saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+
+        Assertions.assertEquals(saasRoleUsers.size(), 1);
+        roleService.changeGroupLeaderRole(Lists.newArrayList(
+                ChangeGroupLeaderRoleReq.builder().groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupLeaderPersonId(listRoleUserRelationParam.getPersonId()).build()
+        ));
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+
+        Assertions.assertEquals(saasRoleUsers.size(), 0);
+        // 清空role
+
+        // 更换role
+        roleService.changeGroupLeaderRole(Lists.newArrayList(
+                ChangeGroupLeaderRoleReq.builder().groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupLeaderPersonId(listRoleUserRelationParam.getPersonId())
+                        .workspaceId(195L)
+                        .ouId(7784L)
+                        .groupLeaderIdentityId(10256L)
+                        .roleIdList(Lists.newArrayList(100009L)).build()
+        ));
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+        Assertions.assertEquals(saasRoleUsers.size(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getRoleId(), 100009L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceType(), RoleResourceTypeEnum.NODE.code);
+        // 更换role
+
+        // 增加role
+        roleService.changeGroupLeaderRole(Lists.newArrayList(
+                ChangeGroupLeaderRoleReq.builder().groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupLeaderPersonId(listRoleUserRelationParam.getPersonId())
+                        .workspaceId(195L)
+                        .ouId(7784L)
+                        .groupLeaderIdentityId(10256L)
+                        .roleIdList(Lists.newArrayList(100009L, 100010L)).build()
+        ));
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+        Assertions.assertEquals(saasRoleUsers.size(), 2);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getRoleId(), 100009L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceType(), RoleResourceTypeEnum.NODE.code);
+
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(1).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getRoleId(), 100010L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceType(), RoleResourceTypeEnum.NODE.code);
+        // 增加role
+
+        // 增加和删除role
+        roleService.changeGroupLeaderRole(Lists.newArrayList(
+                ChangeGroupLeaderRoleReq.builder().groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupNodeId(listRoleUserRelationParam.getResourceId())
+                        .groupLeaderPersonId(listRoleUserRelationParam.getPersonId())
+                        .workspaceId(195L)
+                        .ouId(7784L)
+                        .groupLeaderIdentityId(10256L)
+                        .roleIdList(Lists.newArrayList(100147L, 100010L)).build()
+        ));
+        saasRoleUsers = saasRoleUserRelationService.listV2(listRoleUserRelationParam);
+        Assertions.assertEquals(saasRoleUsers.size(), 2);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(0).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getRoleId(), 100010L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(0).getResourceType(), RoleResourceTypeEnum.NODE.code);
+
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityId(), 10256L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getIdentityType(), 1);
+        Assertions.assertEquals(saasRoleUsers.get(1).getSaasRoleUser().getPersonId(), 1776L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getRoleId(), 100147L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getWorkspaceId(), 195L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getOuId(), 7784L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceId(), 17990L);
+        Assertions.assertEquals(saasRoleUsers.get(1).getResourceType(), RoleResourceTypeEnum.NODE.code);
+        // 增加role
+        // old
+    }
 }

tyr-server/src/test/java/cn/axzo/tyr/server/service/impl/WorkspaceProductServiceImplTest.java

@@ -0,0 +1,334 @@
+package cn.axzo.tyr.server.service.impl;
+
+import cn.axzo.thrones.client.saas.ServicePkgClient;
+import cn.axzo.thrones.client.saas.entity.serivicepgkproduct.ServicePkgProduct;
+import cn.axzo.thrones.client.saas.entity.servicepkg.ServicePkgDetailRes;
+import cn.axzo.tyr.base.BaseTest;
+import cn.axzo.tyr.base.MysqlDataLoader;
+import cn.axzo.tyr.server.service.WorkspaceProductService;
+import cn.azxo.framework.common.model.CommonResponse;
+import com.google.common.collect.Lists;
+import com.google.common.collect.Sets;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.CollectionUtils;
+
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class WorkspaceProductServiceImplTest extends BaseTest {
+
+    @Autowired
+    private MysqlDataLoader mysqlDataLoader;
+    @Autowired
+    private WorkspaceProductService workspaceProductService;
+    @Autowired
+    private ServicePkgClient servicePkgClient;
+
+    @BeforeEach
+    @Override
+    public void setup() {
+        super.setup();
+        mysqlDataLoader.loadFromClassName(getClass().getSimpleName());
+        ServicePkgDetailRes servicePkgDetail = new ServicePkgDetailRes();
+        servicePkgDetail.setSpaceId(3L);
+        ServicePkgProduct servicePkgProduct = new ServicePkgProduct();
+        servicePkgProduct.setProductId(2L);
+        servicePkgDetail.setProducts(Lists.newArrayList(servicePkgProduct));
+        Mockito.when(servicePkgClient.getServicePkgDetailBySpaceId(Mockito.eq(Sets.newHashSet(3L))))
+                .thenReturn(CommonResponse.success(Lists.newArrayList(servicePkgDetail)));
+
+        ServicePkgDetailRes servicePkgDetail2 = new ServicePkgDetailRes();
+        servicePkgDetail2.setSpaceId(4L);
+        ServicePkgProduct servicePkgProduct2 = new ServicePkgProduct();
+        servicePkgProduct2.setProductId(3L);
+        servicePkgDetail2.setProducts(Lists.newArrayList(servicePkgProduct2));
+        Mockito.when(servicePkgClient.getServicePkgDetailBySpaceId(Mockito.eq(Sets.newHashSet(3L, 4L))))
+                .thenReturn(CommonResponse.success(Lists.newArrayList(servicePkgDetail2, servicePkgDetail)));
+
+        Mockito.when(servicePkgClient.getServicePkgDetailBySpaceId(Mockito.eq(Sets.newHashSet(11L))))
+                .thenReturn(CommonResponse.success(Lists.newArrayList()));
+    }
+
+    @Test
+    void listWorkspaceProductPermissionCached() {
+
+        // workspace 没有product
+        WorkspaceProductService.ListWorkspaceProductPermissionCacheParam param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(11L))
+                .build();
+        List<WorkspaceProductService.WorkspaceProductPermission> workspaceProductPermissions = workspaceProductService.listWorkspaceProductPermissionCached(param);
+
+        Assertions.assertTrue(CollectionUtils.isEmpty(workspaceProductPermissions));
+        // workspace 没有product
+
+        // workspace 有product，featureCode
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L, 4L))
+                .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn", "h5:cmp_allotted_time_page"))
+                .build();
+        Map<Long, List<WorkspaceProductService.ProductPermission>> workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getCooperateType(), "1");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureId(), 101745L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_labor_audit_btn");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getAppType(), "H5");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getItemCode(), "h5:user_manage_D9B0186");
+        // workspace 有product，featureCode
+
+        // workspace 有product，terminal
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .terminal("NT_CMP_APP_GENERAL")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .terminal("NT_CMP_APP_GENERAL_sdf")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，terminal
+
+        // workspace 有product，appType
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .appType("H5")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .appType("APP")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，appType
+
+        // workspace 有product，itemCode
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .itemCode("h5:user_manage_D9B0186")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .itemCode("h5:user_manage_D9B0186_sdf")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，itemCode
+
+        // workspace 有product，featureCode、terminal、appType、itemCode
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn"))
+                .terminal("NT_CMP_APP_GENERAL")
+                .appType("H5")
+                .itemCode("h5:user_manage_D9B0186")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 1);
+
+        param = WorkspaceProductService.ListWorkspaceProductPermissionCacheParam.builder()
+                .workspaceIds(Sets.newHashSet(3L))
+                .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn"))
+                .terminal("NT_CMP_APP_GENERAL")
+                .appType("APP")
+                .itemCode("h5:user_manage_D9B0186_sdf")
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspaceProductPermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，featureCode、terminal、appType、itemCode
+    }
+
+    @Test
+    void listWorkspacePermissionCached() {
+
+
+        // workspace 没有product
+        WorkspaceProductService.ListWorkspacePermissionCacheParam param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(11L)
+                        .build()))
+                .build();
+        List<WorkspaceProductService.WorkspaceProductPermission> workspaceProductPermissions = workspaceProductService.listWorkspacePermissionCached(param);
+
+        Assertions.assertTrue(CollectionUtils.isEmpty(workspaceProductPermissions));
+        // workspace 没有product
+
+        // workspace 有product，featureCode
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                                .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn", "h5:cmp_allotted_time_page"))
+                        .build(),
+                        WorkspaceProductService.WorkspacePermission.builder()
+                                .workspaceId(4L)
+                                .featureCodes(Sets.newHashSet("h5:cmp_allotted_time_page"))
+                                .build()))
+                .build();
+
+        Map<Long, List<WorkspaceProductService.ProductPermission>> workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getCooperateType(), "1");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureId(), 101745L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_user_manage_worker_labor_audit_btn");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getAppType(), "H5");
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().get(0).getItemCode(), "h5:user_manage_D9B0186");
+
+        Assertions.assertEquals(workspacePermissions.get(4L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getProductId(), 3L);
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getCooperateType(), "9");
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getFeatureId(), 101936L);
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getFeatureCode(), "h5:cmp_allotted_time_page");
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getFeatureType(), 4);
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getTerminal(), "NT_CMP_APP_GENERAL");
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getAppType(), "H5");
+        Assertions.assertEquals(workspacePermissions.get(4L).get(0).getPermissions().get(0).getItemCode(), "h5:allotted-time_26081705");
+        // workspace 有product，featureCode
+
+        // workspace 有product，terminal
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                                .workspaceId(3L)
+                                .terminal("NT_CMP_APP_GENERAL")
+                                .build()))
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .terminal("NT_CMP_APP_GENERAL_sdf")
+                        .build()))
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，terminal
+
+        // workspace 有product，appType
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .appType("H5")
+                        .build()))
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .appType("APP")
+                        .build()))
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，appType
+
+        // workspace 有product，itemCode
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .itemCode("h5:user_manage_D9B0186")
+                        .build()))
+                .build();
+
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 7);
+
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .itemCode("h5:user_manage_D9B0186_sdf")
+                        .build()))
+                .build();
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，itemCode
+
+        // workspace 有product，featureCode、terminal、appType、itemCode
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn"))
+                        .terminal("NT_CMP_APP_GENERAL")
+                        .appType("H5")
+                        .itemCode("h5:user_manage_D9B0186")
+                        .build()))
+                .build();
+
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 1);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getProductId(), 2L);
+        Assertions.assertEquals(workspacePermissions.get(3L).get(0).getPermissions().size(), 1);
+
+        param = WorkspaceProductService.ListWorkspacePermissionCacheParam.builder()
+                .workspacePermissions(Lists.newArrayList(WorkspaceProductService.WorkspacePermission.builder()
+                        .workspaceId(3L)
+                        .featureCodes(Sets.newHashSet("h5:cmp_user_manage_worker_labor_audit_btn"))
+                        .terminal("NT_CMP_APP_GENERAL")
+                        .appType("APP")
+                        .itemCode("h5:user_manage_D9B0186_sdf")
+                        .build()))
+                .build();
+
+        workspacePermissions = workspaceProductService.listWorkspacePermissionCached(param).stream()
+                .collect(Collectors.toMap(WorkspaceProductService.WorkspaceProductPermission::getWorkspaceId, WorkspaceProductService.WorkspaceProductPermission::getProductPermissions));
+        Assertions.assertEquals(workspacePermissions.get(3L).size(), 0);
+        // workspace 有product，featureCode、terminal、appType、itemCode
+    }
+}

tyr-server/src/test/resources/mysql/ProductServiceImplTest.sql

@@ -0,0 +1,10 @@
+#-->DEFAULT
+
+
+INSERT INTO product_module (id, icon, product_type, product_name, dict_workspace_type_id, dict_workspace_type_code, status, common_product, remark, auth_type, ou_type, is_delete, create_by, create_at, update_at, update_by, category, version, max_person_count, max_workspace_count, price, skus, material)
+VALUES (1, 'https://axzo-public.oss-cn-chengdu.aliyuncs.com/oms/test/1695189976949-Snipaste_09-15 16-36.png', 1, '企业基础-自动授权', 1, '1', 1, 1, '', 1, null, 0, 0, '2022-08-17 19:46:11', '2025-01-13 14:19:46', 9000399458, 'GENERAL_SERVICE', 0, 0, 0, 0, null, null);
+
+INSERT INTO product_module (id, icon, product_type, product_name, dict_workspace_type_id, dict_workspace_type_code, status, common_product, remark, auth_type, ou_type, is_delete, create_by, create_at, update_at, update_by, category, version, max_person_count, max_workspace_count, price, skus, material)
+VALUES (2, 'https://axzo-public.oss-cn-chengdu.aliyuncs.com/oms/test/1695286111017-Snipaste_09-13 16-24.png', 2, '项目基础', 2, '2', 1, 1, '', 1, null, 0, 0, '2022-08-17 19:46:11', '2024-12-25 13:39:12', 9000400021, 'GENERAL_SERVICE', 0, 0, 0, 0, null, null);
+
+#-->ProductServiceImplTest.sql