fix(mis-web): 修复租户财务人员获取租户下的所有账号信息无权限，平台财务人员访问平台下的所有租户信息无权限问题 (#576)

目前管理系统，租户财务人员进入租户管理种财务管理的充值记录页面时，需要调用获取该租户下所有账户信息的接口，现状下该接口只允许租户管理员调用。平台财务人员进入平台财务管理的租户充值页面时需要获取所有租户，调用所有租户接口无权限原因也是该接口只允许平台管理员调用。此处fix后，对应接口可分别给两种财务人员调用
PKUHPC · Apr 24, 2023 · 230a8f0 · 230a8f0
1 parent e02d98c
commit 230a8f0
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/.changeset/popular-ligers-refuse.md b/.changeset/popular-ligers-refuse.md
@@ -0,0 +1,5 @@
+---
+"@scow/mis-web": patch
+---
+
+修复租户财务人员获取租户下的所有账号信息无权限，平台财务人员访问平台下的所有租户信息无权限问题
diff --git a/apps/mis-web/src/pages/api/tenant/getAccounts.ts b/apps/mis-web/src/pages/api/tenant/getAccounts.ts
@@ -48,7 +48,8 @@ export async function getAccounts(req: GetAccountsRequest) {
   return results.map((x) => ensureNotUndefined(x, ["balance"]));
 }
 
-const auth = authenticate((info) => info.tenantRoles.includes(TenantRole.TENANT_ADMIN));
+const auth = authenticate((info) => info.tenantRoles.includes(TenantRole.TENANT_ADMIN)
+  || info.tenantRoles.includes(TenantRole.TENANT_FINANCE));
 
 export default route<GetAccountsSchema>("GetAccountsSchema",
   async (req, res) => {

diff --git a/apps/mis-web/src/pages/api/tenant/getTenants.ts b/apps/mis-web/src/pages/api/tenant/getTenants.ts
@@ -27,7 +27,8 @@ export interface GetTenantsSchema {
   }
 }
 
-const auth = authenticate((info) => info.platformRoles.includes(PlatformRole.PLATFORM_ADMIN));
+const auth = authenticate((info) => info.platformRoles.includes(PlatformRole.PLATFORM_ADMIN)
+  || info.platformRoles.includes(PlatformRole.PLATFORM_FINANCE));
 
 export default route<GetTenantsSchema>("GetTenantsSchema",
   async (req, res) => {