1b5781bf42
Adds @RequirePermission to 19 TS GraphQL resolvers across 5 subgraphs (iam, config-service, core-edu, content, msg) per audit report §6.1. Maps: iam user/role -> IAM_USER_READ; config-service 5 queries -> CONFIG_USER; core-edu classInfo -> CLASS_READ, exam -> EXAM_READ, grade -> GRADE_READ, homework -> HOMEWORK_READ, datascope visibleGrades/visibleExams -> GRADE_READ/EXAM_READ; content chapter/knowledgePoint/question/ textbook -> CONTENT_*_READ; msg notifications -> MSG_NOTIFICATION_READ, template -> MSG_NOTIFICATION_MANAGE. Federation resolveReference left unguarded. Python subgraphs (data-ana, ai) deferred to follow-up infrastructure work.
60 lines
1.3 KiB
TypeScript
60 lines
1.3 KiB
TypeScript
/**
|
||
* iam Role Resolver（v2.1 M1）
|
||
*
|
||
* Apollo Federation 子图：Role Entity
|
||
* - @key(fields: "roleId") 支持跨子图引用
|
||
* - @ResolveReference 使用 DataLoader 批量加载（ADR-035）
|
||
*/
|
||
import {
|
||
Resolver,
|
||
Query,
|
||
Args,
|
||
ID,
|
||
ResolveReference,
|
||
ObjectType,
|
||
Field,
|
||
Directive,
|
||
} from "@nestjs/graphql";
|
||
import { DataLoaderService, type RoleEntity } from "../dataloader.service.js";
|
||
import {
|
||
Permissions,
|
||
RequirePermission,
|
||
} from "../../middleware/permission.guard.js";
|
||
|
||
@ObjectType()
|
||
@Directive(`@key(fields: "roleId")`)
|
||
export class Role {
|
||
@Field(() => ID)
|
||
roleId!: string;
|
||
|
||
@Field()
|
||
name!: string;
|
||
|
||
@Field(() => String, { nullable: true })
|
||
description: string | null = null;
|
||
|
||
@Field()
|
||
roleType!: string;
|
||
|
||
@Field()
|
||
level!: number;
|
||
}
|
||
|
||
@Resolver(() => Role)
|
||
export class RoleResolver {
|
||
constructor(private readonly loader: DataLoaderService) {}
|
||
|
||
@ResolveReference()
|
||
async resolveReference(ref: { roleId: string }): Promise<RoleEntity | null> {
|
||
return this.loader.roleLoader.load(ref.roleId);
|
||
}
|
||
|
||
@Query(() => Role, { nullable: true })
|
||
@RequirePermission(Permissions.IAM_USER_READ)
|
||
async role(
|
||
@Args("roleId", { type: () => ID }) roleId: string,
|
||
): Promise<RoleEntity | null> {
|
||
return this.loader.roleLoader.load(roleId);
|
||
}
|
||
}
|