refactor(permission): 将按钮权限检查器和相关服务迁移至公共模块

- 移除 tenant-admin 模块中的 FormButtonPermissionCheckerImpl 实现类
- 新增 common-online 模块中的 FormButtonPermissionCheckerImpl 实现类
- 将 IRoleFormButtonService 接口从 tenant 模块迁移至 common-online 模块
- 将 RoleFormButton 实体模型从 tenant 模块迁移至 common-online 模块
- 将 RoleFormButtonController 控制器从 tenant 模块迁移至 common-online 模块
- 将 RoleFormButtonDto 数据传输对象从 tenant 模块迁移至 common-online 模块
- 迁移 RoleFormButtonMapper 数据访问层及相关 XML 映射文件
- 更新权限检查逻辑以使用 TokenData 中的角色ID信息

application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/upms/controller/SysRoleController.java

@@ -9,8 +9,8 @@ import apelet.common.core.util.MyPageUtil;
 import apelet.common.core.validator.UpdateGroup;
 import apelet.common.log.annotation.OperationLog;
 import apelet.common.log.model.constant.SysOperationLogType;
-import apelet.tenantadmin.tenant.dto.RoleFormButtonDto;
-import apelet.tenantadmin.tenant.service.IRoleFormButtonService;
+import apelet.common.online.dto.RoleFormButtonDto;
+import apelet.common.online.service.IRoleFormButtonService;
 import apelet.tenantadmin.upms.dto.SysRoleDto;
 import apelet.tenantadmin.upms.dto.SysUserDto;
 import apelet.tenantadmin.upms.model.SysRole;
@@ -21,7 +21,6 @@ import apelet.tenantadmin.upms.service.SysUserService;
 import apelet.tenantadmin.upms.vo.SysDeptVo;
 import apelet.tenantadmin.upms.vo.SysRoleVo;
 import apelet.tenantadmin.upms.vo.SysUserVo;
-import com.alibaba.fastjson.JSONObject;
 import com.alibaba.fastjson.TypeReference;
 import com.github.pagehelper.Page;
 import com.github.pagehelper.page.PageMethod;

application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/upms/service/impl/SysRoleServiceImpl.java

@@ -13,6 +13,7 @@ import apelet.common.core.util.MyPageUtil;
 import apelet.common.ext.base.BizWidgetDatasource;
 import apelet.common.ext.constant.BizWidgetDatasourceType;
 import apelet.common.ext.util.BizWidgetDatasourceExtHelper;
+import apelet.common.online.service.IRoleFormButtonService;
 import apelet.common.sequence.wrapper.IdGeneratorWrapper;
 import apelet.tenantadmin.config.DataSourceType;
 import apelet.tenantadmin.upms.dao.SysDeptMapper;
@@ -71,7 +72,7 @@ public class SysRoleServiceImpl extends BaseService<SysRole, Long> implements Sy
     @Autowired
     private BizWidgetDatasourceExtHelper bizWidgetDatasourceExtHelper;
     @Autowired
-    private apelet.tenantadmin.tenant.service.IRoleFormButtonService roleFormButtonService;
+    private IRoleFormButtonService roleFormButtonService;
 
     @PostConstruct
     private void registerBizWidgetDatasource() {

common/common-online/src/main/java/apelet/common/online/controller/RoleFormButtonController.java

@@ -1,4 +1,4 @@
-package apelet.tenantadmin.tenant.controller;
+package apelet.common.online.controller;
 
 import apelet.common.core.annotation.MyRequestBody;
 import apelet.common.core.constant.ErrorCodeEnum;
@@ -7,9 +7,9 @@ import apelet.common.core.util.MyCommonUtil;
 import apelet.common.core.util.MyPageUtil;
 import apelet.common.log.annotation.OperationLog;
 import apelet.common.log.model.constant.SysOperationLogType;
-import apelet.tenantadmin.tenant.dto.RoleFormButtonDto;
-import apelet.tenantadmin.tenant.model.RoleFormButton;
-import apelet.tenantadmin.tenant.service.IRoleFormButtonService;
+import apelet.common.online.dto.RoleFormButtonDto;
+import apelet.common.online.model.RoleFormButton;
+import apelet.common.online.service.IRoleFormButtonService;
 import com.github.pagehelper.page.PageMethod;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
@@ -25,7 +25,7 @@ import java.util.Set;
  * @date 2026-07-17
  */
 @RestController
-@RequestMapping("/tenantadmin/tenant/roleFormButton")
+@RequestMapping("${common-online.urlPrefix}/roleFormButton")
 public class RoleFormButtonController {
 
     @Autowired

common/common-online/src/main/java/apelet/common/online/dao/RoleFormButtonMapper.java

@@ -1,7 +1,7 @@
-package apelet.tenantadmin.tenant.dao;
+package apelet.common.online.dao;
 
 import apelet.common.core.base.dao.BaseDaoMapper;
-import apelet.tenantadmin.tenant.model.RoleFormButton;
+import apelet.common.online.model.RoleFormButton;
 import org.apache.ibatis.annotations.Param;
 
 import java.util.List;

common/common-online/src/main/java/apelet/common/online/dao/mapper/RoleFormButtonMapper.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
-<mapper namespace="apelet.tenantadmin.tenant.dao.RoleFormButtonMapper">
+<mapper namespace="apelet.common.online.dao.RoleFormButtonMapper">
 
     <select id="getListByFilter"
-            resultType="apelet.tenantadmin.tenant.model.RoleFormButton">
+            resultType="apelet.common.online.model.RoleFormButton">
         SELECT * FROM xy_sys_role_form_button
         WHERE 1=1
         <if test="filter.roleId != null">

common/common-online/src/main/java/apelet/common/online/dto/RoleFormButtonDto.java

@@ -1,4 +1,4 @@
-package apelet.tenantadmin.tenant.dto;
+package apelet.common.online.dto;
 
 import lombok.Data;
 

common/common-online/src/main/java/apelet/common/online/model/RoleFormButton.java

@@ -1,9 +1,9 @@
-package apelet.tenantadmin.tenant.model;
+package apelet.common.online.model;
 
 import apelet.common.core.base.mapper.BaseModelMapper;
 import apelet.common.core.base.model.BaseModel;
 import apelet.common.core.validator.UpdateGroup;
-import apelet.tenantadmin.tenant.vo.RoleFormButtonVo;
+import apelet.common.online.vo.RoleFormButtonVo;
 import com.baomidou.mybatisplus.annotation.TableField;
 import com.baomidou.mybatisplus.annotation.TableId;
 import com.baomidou.mybatisplus.annotation.TableName;

common/common-online/src/main/java/apelet/common/online/service/IRoleFormButtonService.java

@@ -1,12 +1,12 @@
-package apelet.tenantadmin.tenant.service;
+package apelet.common.online.service;
 
 import apelet.common.core.base.service.IBaseService;
 import apelet.common.core.object.CallResult;
 import apelet.common.core.object.MyOrderParam;
 import apelet.common.core.object.MyPageData;
 import apelet.common.core.object.MyPageParam;
-import apelet.tenantadmin.tenant.dto.RoleFormButtonDto;
-import apelet.tenantadmin.tenant.model.RoleFormButton;
+import apelet.common.online.dto.RoleFormButtonDto;
+import apelet.common.online.model.RoleFormButton;
 
 import java.util.List;
 import java.util.Map;

common/common-online/src/main/java/apelet/common/online/service/impl/FormButtonPermissionCheckerImpl.java

@@ -1,14 +1,12 @@
-package apelet.tenantadmin.tenant.service.impl;
+package apelet.common.online.service.impl;
 
 import apelet.common.core.object.TokenData;
+import apelet.common.online.model.RoleFormButton;
 import apelet.common.online.service.FormButtonPermissionChecker;
-import apelet.tenantadmin.tenant.model.RoleFormButton;
-import apelet.tenantadmin.tenant.service.IRoleFormButtonService;
-import apelet.tenantadmin.tenant.util.WidgetJsonButtonParser;
-import apelet.tenantadmin.upms.dao.SysUserRoleMapper;
-import apelet.tenantadmin.upms.model.SysUserRole;
+import apelet.common.online.service.IRoleFormButtonService;
+import apelet.common.online.util.WidgetJsonButtonParser;
+import cn.hutool.core.util.StrUtil;
 import com.alibaba.fastjson.JSON;
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
@@ -29,15 +27,12 @@ import java.util.stream.Collectors;
 public class FormButtonPermissionCheckerImpl implements FormButtonPermissionChecker {
 
     @Autowired
-    private SysUserRoleMapper sysUserRoleMapper;
-
-    @Autowired
     private IRoleFormButtonService roleFormButtonService;
 
     @Override
     public boolean hasPermission(Long formId, String buttonName) {
         try {
-            // 1. 获取当前登录用户ID
+            // 1. 获取当前登录用户信息
             TokenData tokenData = TokenData.takeFromRequest();
             if (tokenData == null) {
                 log.warn("TokenData 为空，无法校验按钮权限");
@@ -48,29 +43,19 @@ public class FormButtonPermissionCheckerImpl implements FormButtonPermissionChec
                 return false;
             }
 
-            // 2. 获取用户的所有角色
-            List<SysUserRole> userRoles = sysUserRoleMapper.selectList(
-                    new LambdaQueryWrapper<SysUserRole>()
-                            .eq(SysUserRole::getUserId, userId));
-            if (userRoles.isEmpty()) {
+            // 2. 从 TokenData 获取用户的所有角色ID
+            if (StrUtil.isBlank(tokenData.getRoleIds())) {
                 return false;
             }
-
-            List<Long> roleIds = userRoles.stream()
-                    .map(SysUserRole::getRoleId)
-                    .collect(Collectors.toList());
+            List<Long> roleIds = StrUtil.split(tokenData.getRoleIds(), ',').stream().map(Long::valueOf).collect(Collectors.toList());
 
             // 3. 遍历角色，检查是否有任一角色授权了该表单的该按钮
             for (Long roleId : roleIds) {
-                RoleFormButton config =
-                        roleFormButtonService.getByRoleIdAndFormId(roleId, formId);
+                RoleFormButton config = roleFormButtonService.getByRoleIdAndFormId(roleId, formId);
                 if (config != null && config.getButtonConfig() != null) {
-                    List<WidgetJsonButtonParser.ButtonInfo> buttons =
-                            JSON.parseArray(config.getButtonConfig(),
-                                    WidgetJsonButtonParser.ButtonInfo.class);
+                    List<WidgetJsonButtonParser.ButtonInfo> buttons = JSON.parseArray(config.getButtonConfig(), WidgetJsonButtonParser.ButtonInfo.class);
                     for (WidgetJsonButtonParser.ButtonInfo btn : buttons) {
-                        if (buttonName.equals(btn.getName())
-                                && Boolean.TRUE.equals(btn.getEnabled())) {
+                        if (buttonName.equals(btn.getName()) && Boolean.TRUE.equals(btn.getEnabled())) {
                             return true;
                         }
                     }

common/common-online/src/main/java/apelet/common/online/service/impl/RoleFormButtonServiceImpl.java

@@ -1,18 +1,18 @@
-package apelet.tenantadmin.tenant.service.impl;
+package apelet.common.online.service.impl;
 
 import apelet.common.core.base.dao.BaseDaoMapper;
 import apelet.common.core.base.service.BaseService;
 import apelet.common.core.object.*;
+import apelet.common.online.dao.RoleFormButtonMapper;
+import apelet.common.online.dto.RoleFormButtonDto;
 import apelet.common.online.model.OnlineForm;
 import apelet.common.online.model.OnlinePage;
+import apelet.common.online.model.RoleFormButton;
+import apelet.common.online.service.IRoleFormButtonService;
 import apelet.common.online.service.OnlineFormService;
 import apelet.common.online.service.OnlinePageService;
+import apelet.common.online.util.WidgetJsonButtonParser;
 import apelet.common.sequence.wrapper.IdGeneratorWrapper;
-import apelet.tenantadmin.tenant.dao.RoleFormButtonMapper;
-import apelet.tenantadmin.tenant.dto.RoleFormButtonDto;
-import apelet.tenantadmin.tenant.model.RoleFormButton;
-import apelet.tenantadmin.tenant.service.IRoleFormButtonService;
-import apelet.tenantadmin.tenant.util.WidgetJsonButtonParser;
 import cn.hutool.core.collection.CollectionUtil;
 import cn.hutool.core.util.StrUtil;
 import com.alibaba.fastjson.JSON;

common/common-online/src/main/java/apelet/common/online/util/WidgetJsonButtonParser.java

@@ -1,4 +1,4 @@
-package apelet.tenantadmin.tenant.util;
+package apelet.common.online.util;
 
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONArray;

common/common-online/src/main/java/apelet/common/online/vo/RoleFormButtonVo.java

@@ -1,6 +1,6 @@
-package apelet.tenantadmin.tenant.vo;
+package apelet.common.online.vo;
 
-import apelet.tenantadmin.tenant.model.RoleFormButton;
+import apelet.common.online.model.RoleFormButton;
 import lombok.Data;
 import lombok.EqualsAndHashCode;