权限管理

app-hd/controllers/ShopAdminController.php

@@ -196,48 +196,49 @@ class ShopAdminController extends BaseController
     {
         $post = Yii::$app->request->post();
         $id = $post['id'] ?? 0;
-
-        $shopAdmin = $this->shopAdmin->attributes;
-        if ($shopAdmin['super'] != 1) {
-            util::fail('超管才能操作');
+        $shopAdmin = $this->shopAdmin;
+        $adminId = $this->adminId;
+        if (isset($shopAdmin->super) == false || $shopAdmin->super != 1) {
+            util::fail('没有权限');
         }
-
         if (empty($id)) {
             util::fail('请选择员工');
         }
+        $finance = $post['finance'] ?? 0;
+        $switchShop = $post['switchShop'] ?? 0;
+        $super = $post['super'] ?? 0;
         $relation = ShopAdminClass::getById($id, true);
         if (empty($relation)) {
             util::fail('没有找到员工');
         }
         ShopAdminClass::valid($relation, $this->mainId);
-        unset($post['id']);
+        $founder = $relation->founder ?? 1;
+        $shop = $this->shop;
+        $ptSuperAdminId = AdminClass::getPtSuperAdminId();
+        if ($shop->adminId != $adminId && $adminId != $ptSuperAdminId) {
+            if ($finance == 1) {
+                util::fail('超管才能修改财务权限');
+            }
+            if ($switchShop == 1) {
+                util::fail('超管才能修改管理分店权限');
+            }
+        }
+        if ($founder == 2) {
+            if ($super == 0) {
+                util::fail('超管不能关闭改库存改价权限');
+            }
+        }
         $roleId = $post['roleId'] ?? 0;
         $remind = $post['remind'] ?? 0;
         $status = $post['status'] ?? 1;
         $super = $post['super'] ?? 0;
-        $name = $post['name'] ?? '';
-        $founder = $relation->founder ?? 1;
-        if ($founder == 2 && $super == 0) {
-            util::fail('不能关闭超管权限');
-        }
-        if(!empty($name)){
-            $relation->name = $name;
-        }
         $relation->roleId = $roleId;
         $relation->remind = $remind;
         $relation->status = $status;
         $relation->super = $super;
-        if (isset($post['name']) && !empty($post['name'])) {
-            $relation->name = $post['name'];
-        }
+        $relation->finance = $finance;
+        $relation->switchShop = $switchShop;
         $relation->save();
-        //若有传密码，则修改密码
-        $password = $post['password'] ?? '';
-        if (!empty($password)) {
-            $adminId = $relation->adminId;
-            $password = password_hash($password, PASSWORD_BCRYPT);
-            AdminClass::updateById($adminId, ['password' => $password]);
-        }
         util::complete('修改成功');
     }