refactor(权限管理): 接口测试权限 处理冲突

backend/src/main/java/io/metersphere/api/controller/ApiAutomationController.java

@@ -21,7 +21,7 @@ import io.metersphere.log.annotation.MsAuditLog;
 import io.metersphere.track.request.testcase.ApiCaseRelevanceRequest;
 import io.metersphere.track.request.testplan.FileOperationRequest;
 import org.apache.shiro.authz.annotation.Logical;
-import org.apache.shiro.authz.annotation.RequiresRoles;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -33,14 +33,13 @@ import java.util.List;
 
 @RestController
 @RequestMapping(value = "/api/automation")
-@RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
 public class ApiAutomationController {
 
     @Resource
     ApiAutomationService apiAutomationService;
 
     @PostMapping("/list/{goPage}/{pageSize}")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ")
     public Pager<List<ApiScenarioDTO>> list(@PathVariable int goPage, @PathVariable int pageSize, @RequestBody ApiScenarioRequest request) {
         Page<Object> page = PageHelper.startPage(goPage, pageSize, true);
         request.setWorkspaceId(SessionUtils.getCurrentWorkspaceId());
@@ -48,26 +47,26 @@ public class ApiAutomationController {
     }
 
     @PostMapping("/list/all")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ")
     public List<ApiScenarioWithBLOBs> listAll(@RequestBody ApiScenarioBatchRequest request) {
         return apiAutomationService.listAll(request);
     }
 
     @PostMapping("/listWithIds/all")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ")
     public List<ApiScenarioWithBLOBs> listWithIds(@RequestBody ApiScenarioBatchRequest request) {
         return apiAutomationService.listWithIds(request);
     }
 
 
     @PostMapping("/id/all")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ")
     public List<String> idAll(@RequestBody ApiScenarioBatchRequest request) {
         return apiAutomationService.idAll(request);
     }
 
     @GetMapping("/list/{projectId}")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER, RoleConstants.TEST_VIEWER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ")
     public List<ApiScenarioDTO> list(@PathVariable String projectId) {
         ApiScenarioRequest request = new ApiScenarioRequest();
         request.setWorkspaceId(SessionUtils.getCurrentWorkspaceId());
@@ -77,6 +76,7 @@ public class ApiAutomationController {
 
     @PostMapping(value = "/create")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.CREATE, title = "#request.name", content = "#msClass.getLogDetails(#request.id)", msClass = ApiAutomationService.class)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+CREATE")
     public ApiScenario create(@RequestPart("request") SaveApiScenarioRequest request, @RequestPart(value = "bodyFiles") List<MultipartFile> bodyFiles,
                               @RequestPart(value = "scenarioFiles") List<MultipartFile> scenarioFiles) {
         return apiAutomationService.create(request, bodyFiles, scenarioFiles);
@@ -84,6 +84,7 @@ public class ApiAutomationController {
 
     @PostMapping(value = "/update")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.UPDATE, beforeEvent = "#msClass.getLogDetails(#request.id)", title = "#request.name", content = "#msClass.getLogDetails(#request.id)", msClass = ApiAutomationService.class)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+EDIT")
     public void update(@RequestPart("request") SaveApiScenarioRequest request, @RequestPart(value = "bodyFiles") List<MultipartFile> bodyFiles,
                        @RequestPart(value = "scenarioFiles") List<MultipartFile> scenarioFiles) {
         apiAutomationService.update(request, bodyFiles, scenarioFiles);
@@ -91,6 +92,7 @@ public class ApiAutomationController {
 
     @GetMapping("/delete/{id}")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.DELETE, beforeEvent = "#msClass.getLogDetails(#id)", msClass = ApiAutomationService.class)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+delete")
     public void delete(@PathVariable String id) {
         apiAutomationService.delete(id);
     }
@@ -186,14 +188,14 @@ public class ApiAutomationController {
     }
 
     @PostMapping("/batch/edit")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+EDIT")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.BATCH_UPDATE, beforeEvent = "#msClass.getLogDetails(#request.ids)", content = "#msClass.getLogDetails(#request.ids)", msClass = ApiAutomationService.class)
     public void bathEdit(@RequestBody ApiScenarioBatchRequest request) {
         apiAutomationService.bathEdit(request);
     }
 
     @PostMapping("/batch/update/env")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+EDIT")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.BATCH_UPDATE, beforeEvent = "#msClass.getLogDetails(#request.ids)", content = "#msClass.getLogDetails(#request.ids)", msClass = ApiAutomationService.class)
     public void batchUpdateEnv(@RequestBody ApiScenarioBatchRequest request) {
         apiAutomationService.batchUpdateEnv(request);
@@ -246,21 +248,21 @@ public class ApiAutomationController {
     }
 
     @PostMapping(value = "/import", consumes = {"multipart/form-data"})
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+IMPORT_SCENARIO")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.IMPORT, sourceId = "#request.id", title = "#request.name", project = "#request.projectId")
     public ScenarioImport scenarioImport(@RequestPart(value = "file", required = false) MultipartFile file, @RequestPart("request") ApiTestImportRequest request) {
         return apiAutomationService.scenarioImport(file, request);
     }
 
     @PostMapping(value = "/export")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+EXPORT_SCENARIO")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.EXPORT, sourceId = "#request.id", title = "#request.name", project = "#request.projectId")
     public ApiScenrioExportResult export(@RequestBody ApiScenarioBatchRequest request) {
         return apiAutomationService.export(request);
     }
 
     @PostMapping(value = "/export/jmx")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_SCENARIO:READ+EXPORT_SCENARIO")
     @MsAuditLog(module = "api_automation", type = OperLogConstants.EXPORT, sourceId = "#request.id", title = "#request.name", project = "#request.projectId")
     public List<ApiScenrioExportJmx> exportJmx(@RequestBody ApiScenarioBatchRequest request) {
         return apiAutomationService.exportJmx(request);

backend/src/main/java/io/metersphere/api/controller/ApiDefinitionController.java

@@ -20,7 +20,6 @@ import io.metersphere.base.domain.ApiDefinitionWithBLOBs;
 import io.metersphere.base.domain.ApiTestEnvironmentWithBLOBs;
 import io.metersphere.base.domain.Schedule;
 import io.metersphere.commons.constants.OperLogConstants;
-import io.metersphere.commons.constants.RoleConstants;
 import io.metersphere.commons.json.JSONSchemaGenerator;
 import io.metersphere.commons.utils.CronUtils;
 import io.metersphere.commons.utils.PageUtils;
@@ -32,9 +31,7 @@ import io.metersphere.service.CheckPermissionService;
 import io.metersphere.service.ScheduleService;
 import io.metersphere.track.request.testcase.ApiCaseRelevanceRequest;
 import org.apache.commons.lang3.StringUtils;
-import org.apache.shiro.authz.annotation.Logical;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
-import org.apache.shiro.authz.annotation.RequiresRoles;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -97,7 +94,7 @@ public class ApiDefinitionController {
 
 
     @PostMapping(value = "/create", consumes = {"multipart/form-data"})
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+CREATE_API")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.CREATE, title = "#request.name", content = "#msClass.getLogDetails(#request.id)", msClass = ApiDefinitionService.class)
     public void create(@RequestPart("request") SaveApiDefinitionRequest request, @RequestPart(value = "files") List<MultipartFile> bodyFiles) {
         checkPermissionService.checkProjectOwner(request.getProjectId());
@@ -105,7 +102,7 @@ public class ApiDefinitionController {
     }
 
     @PostMapping(value = "/update", consumes = {"multipart/form-data"})
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+EDIT_API")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.UPDATE, beforeEvent = "#msClass.getLogDetails(#request.id)", title = "#request.name", content = "#msClass.getLogDetails(#request.id)", msClass = ApiDefinitionService.class)
     public ApiDefinitionWithBLOBs update(@RequestPart("request") SaveApiDefinitionRequest request, @RequestPart(value = "files") List<MultipartFile> bodyFiles) {
         checkPermissionService.checkProjectOwner(request.getProjectId());
@@ -113,14 +110,14 @@ public class ApiDefinitionController {
     }
 
     @GetMapping("/delete/{id}")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+DELETE")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.DELETE, beforeEvent = "#msClass.getLogDetails(#id)", msClass = ApiDefinitionService.class)
     public void delete(@PathVariable String id) {
         apiDefinitionService.delete(id);
     }
 
     @PostMapping("/deleteBatch")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+DELETE")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.BATCH_DEL, beforeEvent = "#msClass.getLogDetails(#request.ids)", msClass = ApiDefinitionService.class)
     public void deleteBatch(@RequestBody List<String> ids) {
         apiDefinitionService.deleteBatch(ids);
@@ -142,14 +139,14 @@ public class ApiDefinitionController {
     }
 
     @PostMapping("/removeToGc")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+DELETE")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.GC, beforeEvent = "#msClass.getLogDetails(#ids)", msClass = ApiDefinitionService.class)
     public void removeToGc(@RequestBody List<String> ids) {
         apiDefinitionService.removeToGc(ids);
     }
 
     @PostMapping("/removeToGcByParams")
-    @RequiresRoles(value = {RoleConstants.TEST_MANAGER, RoleConstants.TEST_USER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+DELETE")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.BATCH_GC, beforeEvent = "#msClass.getLogDetails(#request.ids)", msClass = ApiDefinitionService.class)
     public void removeToGcByParams(@RequestBody ApiBatchRequest request) {
         apiDefinitionService.removeToGcByParams(request);
@@ -195,14 +192,14 @@ public class ApiDefinitionController {
     }
 
     @PostMapping(value = "/import", consumes = {"multipart/form-data"})
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+IMPORT_API")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.IMPORT, sourceId = "#request.id", title = "#request.name", project = "#request.projectId")
     public ApiDefinitionImport testCaseImport(@RequestPart(value = "file", required = false) MultipartFile file, @RequestPart("request") ApiTestImportRequest request) {
         return apiDefinitionService.apiTestImport(file, request);
     }
 
     @PostMapping(value = "/export/{type}")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+EXPORT_API")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.EXPORT, sourceId = "#request.id", title = "#request.name", project = "#request.projectId")
     public ApiExportResult export(@RequestBody ApiBatchRequest request, @PathVariable String type) {
         return apiDefinitionService.export(request, type);
@@ -262,13 +259,13 @@ public class ApiDefinitionController {
     }
 
     @PostMapping("/batch/edit")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+EDIT_API")
     public void editApiBath(@RequestBody ApiBatchRequest request) {
         apiDefinitionService.editApiBath(request);
     }
 
     @PostMapping("/batch/editByParams")
-    @RequiresRoles(value = {RoleConstants.TEST_USER, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+EDIT_API")
     @MsAuditLog(module = "api_definition", type = OperLogConstants.BATCH_UPDATE, beforeEvent = "#msClass.getLogDetails(#request)", content = "#msClass.getLogDetails(#request)", msClass = ApiDefinitionService.class)
     public void editByParams(@RequestBody ApiBatchRequest request) {
         apiDefinitionService.editApiByParam(request);
@@ -291,7 +288,7 @@ public class ApiDefinitionController {
     }
 
     @GetMapping("/export/esbExcelTemplate")
-    @RequiresRoles(value = {RoleConstants.ADMIN, RoleConstants.ORG_ADMIN, RoleConstants.TEST_MANAGER}, logical = Logical.OR)
+    @RequiresPermissions("PROJECT_API_DEFINITION:READ+EXPORT_API")
     public void testCaseTemplateExport(HttpServletResponse response) {
         esbImportService.templateExport(response);
     }

frontend/src/business/components/api/automation/ApiAutomation.vue

@@ -41,7 +41,8 @@
           :name="item.name"
           closable>
           <div class="ms-api-scenario-div">
-            <ms-edit-api-scenario @refresh="refresh" @openScenario="editScenario" @closePage="closePage" :currentScenario="item.currentScenario"
+            <ms-edit-api-scenario @refresh="refresh" @openScenario="editScenario" @closePage="closePage"
+                                  :currentScenario="item.currentScenario"
                                   :custom-num="customNum" :moduleOptions="moduleOptions" ref="autoScenarioConfig"/>
           </div>
         </el-tab-pane>
@@ -51,7 +52,10 @@
             <el-dropdown @command="handleCommand" v-tester>
               <el-button type="primary" plain icon="el-icon-plus" size="mini" v-tester/>
               <el-dropdown-menu slot="dropdown">
-                <el-dropdown-item command="ADD">{{ $t('api_test.automation.add_scenario') }}</el-dropdown-item>
+                <el-dropdown-item command="ADD"
+                                  v-permission="['PROJECT_API_SCENARIO:READ+CREATE']">
+                  {{ $t('api_test.automation.add_scenario') }}
+                </el-dropdown-item>
                 <el-dropdown-item command="CLOSE_ALL">{{ $t('api_test.definition.request.close_all_label') }}
                 </el-dropdown-item>
               </el-dropdown-menu>
@@ -69,7 +73,7 @@
 import MsAsideContainer from "@/business/components/common/components/MsAsideContainer";
 import MsMainContainer from "@/business/components/common/components/MsMainContainer";
 import MsApiScenarioList from "@/business/components/api/automation/scenario/ApiScenarioList";
-  import {getUUID, downloadFile, checkoutTestManagerOrTestUser, getCurrentUser} from "@/common/js/utils";
+import {checkoutTestManagerOrTestUser, getCurrentUser, getUUID} from "@/common/js/utils";
 import MsApiScenarioModule from "@/business/components/api/automation/scenario/ApiScenarioModule";
 import MsEditApiScenario from "./scenario/EditApiScenario";
 
@@ -281,7 +285,7 @@
         this.activeName = this.tabs[this.tabs.length - 1].name;
         this.addListener(); //  自动切换当前标签时，也添加监听
       } else {
-          this.activeName = "default"
+        this.activeName = "default";
       }
     },
     removeTab(targetName) {
@@ -290,7 +294,7 @@
         this.activeName = this.tabs[this.tabs.length - 1].name;
         this.addListener(); //  自动切换当前标签时，也添加监听
       } else {
-          this.activeName = "default"
+        this.activeName = "default";
       }
     },
     setTabLabel(data) {
@@ -351,10 +355,10 @@
         if (data) {
           this.customNum = data.scenarioCustomNum;
         }
-        })
+      });
-      }
     }
   }
+};
 </script>
 
 <style scoped>

frontend/src/business/components/api/automation/report/ApiReportList.vue

@@ -61,6 +61,7 @@
               <ms-table-operator-button :tip="$t('api_report.detail')" icon="el-icon-s-data"
                                         @exec="handleView(scope.row)" type="primary"/>
               <ms-table-operator-button :is-tester-permission="true" :tip="$t('api_report.delete')"
+                                        v-permission="['PROJECT_API_REPORT:READ+DELETE']"
                                         icon="el-icon-delete" @exec="handleDelete(scope.row)" type="danger"/>
             </template>
           </el-table-column>

frontend/src/business/components/api/automation/scenario/ApiScenarioList.vue

@@ -25,7 +25,8 @@
 
         <el-table-column v-if="!referenced" width="30" min-width="30" :resizable="false" align="center">
           <template v-slot:default="scope">
-            <show-more-btn :is-show="scope.row.showMore" :buttons="trashEnable ? trashButtons: buttons" :size="selectDataCounts" v-tester/>
+            <show-more-btn :is-show="scope.row.showMore" :buttons="trashEnable ? trashButtons: buttons"
+                           :size="selectDataCounts" v-tester/>
           </template>
         </el-table-column>
         <template v-for="(item, index) in tableLabel">
@@ -142,14 +143,18 @@
             </div>
             <div v-else>
               <ms-table-operator-button :tip="$t('api_test.automation.edit')" icon="el-icon-edit" @exec="edit(row)"
-                                        v-tester/>
+                                        v-permission="['PROJECT_API_SCENARIO:READ+EDIT']"/>
-              <ms-table-operator-button class="run-button" :is-tester-permission="true"
+              <ms-table-operator-button class="run-button"
                                         :tip="$t('api_test.automation.execute')"
                                         icon="el-icon-video-play"
-                                        @exec="execute(row)" v-tester/>
+                                        v-permission="['PROJECT_API_SCENARIO:READ+RUN']"
+                                        @exec="execute(row)"/>
               <ms-table-operator-button :tip="$t('api_test.automation.copy')" icon="el-icon-document-copy" type=""
+                                        v-permission="['PROJECT_API_SCENARIO:READ+COPY']"
                                         @exec="copy(row)"/>
-              <ms-table-operator-button :tip="$t('api_test.automation.remove')" icon="el-icon-delete" @exec="remove(row)" type="danger" v-tester/>
+              <ms-table-operator-button :tip="$t('api_test.automation.remove')"
+                                        v-permission="['PROJECT_API_SCENARIO:READ+DELETE']"
+                                        icon="el-icon-delete" @exec="remove(row)" type="danger"/>
               <ms-scenario-extend-buttons style="display: contents" @openScenario="openScenario" :row="row"/>
             </div>
           </template>
@@ -173,7 +178,8 @@
       </div>
     </el-card>
 
-    <batch-edit ref="batchEdit" @batchEdit="batchEdit" :typeArr="typeArr" :value-arr="valueArr" :dialog-title="$t('test_track.case.batch_edit_case')"/>
+    <batch-edit ref="batchEdit" @batchEdit="batchEdit" :typeArr="typeArr" :value-arr="valueArr"
+                :dialog-title="$t('test_track.case.batch_edit_case')"/>
     <batch-move @refresh="search" @moveSave="moveSave" ref="testBatchMove"/>
     <ms-run-mode @handleRunBatch="handleRunBatch" ref="runMode"/>
   </div>
@@ -253,13 +259,13 @@
     moduleTree: {
       type: Array,
       default() {
-          return []
+        return [];
       },
     },
     moduleOptions: {
       type: Array,
       default() {
-          return []
+        return [];
       },
     },
     //用于判断是否是只读用户
@@ -303,22 +309,38 @@
       userFilters: [],
       buttons: [
         {
-            name: this.$t('api_test.automation.batch_add_plan'), handleClick: this.handleBatchAddCase
+          name: this.$t('api_test.automation.batch_add_plan'),
+          handleClick: this.handleBatchAddCase,
+          permissions: ['PROJECT_API_SCENARIO:READ+MOVE_BATCH']
         },
         {
-            name: this.$t('api_test.automation.batch_execute'), handleClick: this.handleBatchExecute
+          name: this.$t('api_test.automation.batch_execute'),
+          handleClick: this.handleBatchExecute,
+          permissions: ['PROJECT_API_SCENARIO:READ+RUN']
         },
         {
-            name: this.$t('test_track.case.batch_edit_case'), handleClick: this.handleBatchEdit
+          name: this.$t('test_track.case.batch_edit_case'),
+          handleClick: this.handleBatchEdit,
+          permissions: ['PROJECT_API_SCENARIO:READ+EDIT']
         },
         {
-            name: this.$t('test_track.case.batch_move_case'), handleClick: this.handleBatchMove
+          name: this.$t('test_track.case.batch_move_case'),
+          handleClick: this.handleBatchMove,
+          permissions: ['PROJECT_API_SCENARIO:READ+MOVE_BATCH']
+        },
+        {
+          name: this.$t('api_test.definition.request.batch_delete'),
+          handleClick: this.handleDeleteBatch,
+          permissions: ['PROJECT_API_SCENARIO:READ+DELETE']
         },
-          {name: this.$t('api_test.definition.request.batch_delete'), handleClick: this.handleDeleteBatch},
 
       ],
       trashButtons: [
-          {name: this.$t('api_test.definition.request.batch_delete'), handleClick: this.handleDeleteBatch},
+        {
+          name: this.$t('api_test.definition.request.batch_delete'),
+          handleClick: this.handleDeleteBatch,
+          permissions: ['PROJECT_API_SCENARIO:READ+DELETE']
+        },
         {
           name: "批量恢复", handleClick: this.handleBatchRestore
         },
@@ -329,7 +351,11 @@
       typeArr: [
         {id: 'level', name: this.$t('test_track.case.priority')},
         {id: 'status', name: this.$t('test_track.plan.plan_status')},
-          {id: 'principal', name: this.$t('api_test.definition.request.responsible'), optionMethod: this.getPrincipalOptions},
+        {
+          id: 'principal',
+          name: this.$t('api_test.definition.request.responsible'),
+          optionMethod: this.getPrincipalOptions
+        },
         // {id: 'environmentId', name: this.$t('api_test.definition.request.run_env'), optionMethod: this.getEnvsOptions},
         {id: 'projectEnv', name: this.$t('api_test.definition.request.run_env')},
       ],
@@ -365,7 +391,7 @@
         environmentId: [],
         projectEnv: [],
       },
-      }
+    };
   },
   created() {
     this.condition.filters = {status: ["Prepare", "Underway", "Completed"]};
@@ -402,12 +428,12 @@
       return "Running" !== this.report.status;
     },
     projectId() {
-        return this.$store.state.projectId
+      return this.$store.state.projectId;
     },
   },
   methods: {
     customHeader() {
-        this.$refs.headerCustom.open(this.tableLabel)
+      this.$refs.headerCustom.open(this.tableLabel);
     },
     selectByParam() {
       this.changeSelectDataRangeAll();
@@ -476,7 +502,7 @@
               setTimeout(this.$refs.scenarioTable.doLayout, 200);
             }
             this.checkTableRowIsSelect();
-            })
+          });
         });
       }
       getLabel(this, API_SCENARIO_LIST);
@@ -501,7 +527,7 @@
               this.selectRows.delete(row);
             }
           }
-          })
+        });
       }
     },
     handleCommand(cmd) {
@@ -513,7 +539,7 @@
           break;
         case "all":
           this.condition.selectAll = true;
-            break
+          break;
       }
     },
     handleBatchAddCase() {
@@ -558,7 +584,7 @@
         this.$post('/api/automation/batch/update/env', param, () => {
           this.$success(this.$t('commons.save_success'));
           this.search();
-          })
+        });
       } else {
         // 批量修改其它
         let param = {};
@@ -577,7 +603,7 @@
       this.$post('/user/ws/member/tester/list', {workspaceId: workspaceId}, response => {
         option.push(...response.data);
         this.userFilters = response.data.map(u => {
-            return {text: u.name, value: u.id}
+          return {text: u.name, value: u.id};
         });
       });
     },
@@ -690,14 +716,14 @@
       this.$post("/api/automation/reduction", [row.id], response => {
         this.$success(this.$t('commons.save_success'));
         this.search();
-        })
+      });
     },
     handleBatchRestore() {
       let ids = Array.from(this.selectRows).map(row => row.id);
       this.$post("/api/automation/reduction", ids, response => {
         this.$success(this.$t('commons.save_success'));
         this.search();
-        })
+      });
     },
     handleDeleteBatch(row) {
       if (this.trashEnable) {
@@ -807,7 +833,7 @@
       column.realWidth = finalWidth;
     },
     openScenario(item) {
-        this.$emit('openScenario', item)
+      this.$emit('openScenario', item);
     },
     exportApi() {
       let param = {};
@@ -838,7 +864,7 @@
         if (obj && obj.length > 0) {
           obj.forEach(item => {
             downloadFile(item.name + ".jmx", item.jmx);
-            })
+          });
         }
       });
     },
@@ -855,7 +881,7 @@
       return this.condition;
     }
   }
-  }
+};
 </script>
 
 <style scoped>

frontend/src/business/components/api/automation/scenario/ApiScenarioModule.vue

@@ -89,14 +89,17 @@
         operators: [
           {
             label: this.$t('api_test.automation.add_scenario'),
-            callback: this.addScenario
+            callback: this.addScenario,
+            permissions: ['PROJECT_API_SCENARIO:READ+CREATE']
           },
           {
             label: this.$t('api_test.api_import.label'),
-            callback: this.handleImport
+            callback: this.handleImport,
+            permissions: ['PROJECT_API_SCENARIO:READ+IMPORT_SCENARIO']
           },
           {
             label: this.$t('report.export'),
+            permissions: ['PROJECT_API_SCENARIO:READ+EXPORT_SCENARIO'],
             children: [
               {
                 label: this.$t('report.export_to_ms_format'),

frontend/src/business/components/api/automation/scenario/ScenarioExtendBtns.vue

@@ -6,8 +6,11 @@
       </el-link>
       <el-dropdown-menu slot="dropdown">
         <el-dropdown-item command="ref">{{ $t('api_test.automation.view_ref') }}</el-dropdown-item>
-        <el-dropdown-item command="schedule" v-tester>{{ $t('api_test.automation.schedule') }}</el-dropdown-item>
+        <el-dropdown-item command="schedule" v-permission="['PROJECT_API_SCENARIO:READ+SCHEDULE']">
-        <el-dropdown-item command="create_performance" v-tester v-modules="['performance']">
+          {{ $t('api_test.automation.schedule') }}
+        </el-dropdown-item>
+        <el-dropdown-item command="create_performance" v-permission="['PROJECT_API_SCENARIO:READ+CREATE_PERFORMANCE']"
+                          v-modules="['performance']">
           {{ $t('api_test.create_performance_test') }}
         </el-dropdown-item>
       </el-dropdown-menu>
@@ -20,7 +23,7 @@
 
 <script>
 import MsReferenceView from "@/business/components/api/automation/scenario/ReferenceView";
-  import MsScheduleMaintain from "@/business/components/api/automation/schedule/ScheduleMaintain"
+import MsScheduleMaintain from "@/business/components/api/automation/schedule/ScheduleMaintain";
 import {getCurrentProjectID, getUUID} from "@/common/js/utils";
 
 export default {
@@ -63,20 +66,20 @@
         this.$store.commit('setTest', {
           name: row.name,
           jmx: jmxObj
-          })
+        });
         this.$router.push({
           path: "/performance/test/create"
-          })
+        });
       });
     },
     openScenario(item) {
-        this.$emit('openScenario', item)
+      this.$emit('openScenario', item);
     },
     refreshTable() {
 
     }
   }
-  }
+};
 </script>
 
 <style scoped>

frontend/src/business/components/api/definition/ApiDefinition.vue

@@ -84,13 +84,17 @@
             </div>
             <!-- 快捷调试 -->
             <div v-else-if="item.type=== 'debug'" class="ms-api-div">
-              <ms-debug-http-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi" @refreshModule="refreshModule"
+              <ms-debug-http-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi"
+                                  @refreshModule="refreshModule"
                                   v-if="currentProtocol==='HTTP'"/>
-              <ms-debug-jdbc-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi" @refreshModule="refreshModule"
+              <ms-debug-jdbc-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi"
+                                  @refreshModule="refreshModule"
                                   v-if="currentProtocol==='SQL'"/>
-              <ms-debug-tcp-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi" @refreshModule="refreshModule"
+              <ms-debug-tcp-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi"
+                                 @refreshModule="refreshModule"
                                  v-if="currentProtocol==='TCP'"/>
-              <ms-debug-dubbo-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi" @refreshModule="refreshModule"
+              <ms-debug-dubbo-page :currentProtocol="currentProtocol" :testCase="item.api" @saveAs="editApi"
+                                   @refreshModule="refreshModule"
                                    v-if="currentProtocol==='DUBBO'"/>
             </div>
 
@@ -119,8 +123,12 @@
               <el-dropdown @command="handleCommand" v-tester>
                 <el-button type="primary" plain icon="el-icon-plus" size="mini" v-tester/>
                 <el-dropdown-menu slot="dropdown">
-                  <el-dropdown-item command="debug">{{ $t('api_test.definition.request.fast_debug') }}</el-dropdown-item>
+                  <el-dropdown-item command="debug" v-permission="['PROJECT_API_DEFINITION:READ+DEBUG']">
-                  <el-dropdown-item command="ADD">{{ $t('api_test.definition.request.title') }}</el-dropdown-item>
+                    {{ $t('api_test.definition.request.fast_debug') }}
+                  </el-dropdown-item>
+                  <el-dropdown-item command="ADD" v-permission="['PROJECT_API_DEFINITION:READ+CREATE_API']">
+                    {{ $t('api_test.definition.request.title') }}
+                  </el-dropdown-item>
                   <el-dropdown-item command="CLOSE_ALL">{{ $t('api_test.definition.request.close_all_label') }}
                   </el-dropdown-item>
                 </el-dropdown-menu>
@@ -175,7 +183,7 @@
       return !checkoutTestManagerOrTestUser();
     },
     projectId() {
-        return this.$store.state.projectId
+      return this.$store.state.projectId;
     },
   },
   components: {
@@ -231,7 +239,7 @@
       syncTabs: [],
       nodeTree: [],
       currentModulePath: "",
-      }
+    };
   },
   created() {
     let dataRange = this.$route.params.dataSelectRange;
@@ -326,8 +334,14 @@
         return;
       }
       let api = {
-          status: "Underway", method: "GET", userId: getCurrentUser().id,
+        status: "Underway",
-          url: "", protocol: this.currentProtocol, environmentId: "", moduleId: 'default-module', modulePath: "/" + this.$t("commons.module_title")
+        method: "GET",
+        userId: getCurrentUser().id,
+        url: "",
+        protocol: this.currentProtocol,
+        environmentId: "",
+        moduleId: 'default-module',
+        modulePath: "/" + this.$t("commons.module_title")
       };
       this.currentModulePath = "";
       if (this.nodeTree && this.nodeTree.length > 0) {
@@ -485,7 +499,7 @@
       this.trashEnable = data;
     }
   }
-  }
+};
 </script>
 
 <style scoped>

frontend/src/business/components/api/definition/components/list/ApiList.vue

@@ -194,18 +194,7 @@ import MsTableAdvSearchBar from "@/business/components/common/components/search/
 import {API_DEFINITION_CONFIGS} from "@/business/components/common/components/search/search-components";
 import MsTipButton from "@/business/components/common/components/MsTipButton";
 import CaseBatchMove from "@/business/components/api/definition/components/basis/BatchMove";
-import {
+import {_filter, _sort, buildBatchParam, getLabel, initCondition} from "@/common/js/tableUtils";
-  _filter,
-  _handleSelect,
-  _handleSelectAll,
-  _sort,
-  buildBatchParam, deepClone,
-  getLabel,
-  getSelectDataCounts,
-  initCondition,
-  setUnSelectIds,
-  toggleAllSelection
-} from "@/common/js/tableUtils";
 import {Api_List} from "@/business/components/common/model/JsonData";
 import HeaderCustom from "@/business/components/common/head/HeaderCustom";
 import HeaderLabelOperate from "@/business/components/common/head/HeaderLabelOperate";
@@ -251,31 +240,90 @@ export default {
       selectDataRange: "all",
       deletePath: "/test/case/delete",
       buttons: [
-        {name: this.$t('api_test.definition.request.batch_delete'), handleClick: this.handleDeleteBatch},
-        {name: this.$t('api_test.definition.request.batch_edit'), handleClick: this.handleEditBatch},
         {
-          name: this.$t('api_test.definition.request.batch_move'), handleClick: this.handleBatchMove
+          name: this.$t('api_test.definition.request.batch_delete'),
+          handleClick: this.handleDeleteBatch,
+          permissions: ['PROJECT_API_DEFINITION:READ+DELETE_API']
+        },
+        {
+          name: this.$t('api_test.definition.request.batch_edit'),
+          handleClick: this.handleEditBatch,
+          permissions: ['PROJECT_API_DEFINITION:READ+EDIT_API']
+        },
+        {
+          name: this.$t('api_test.definition.request.batch_move'),
+          handleClick: this.handleBatchMove,
+          permissions: ['PROJECT_API_DEFINITION:READ+BATCH_MOVE']
         }
       ],
       trashButtons: [
-        {name: this.$t('api_test.definition.request.batch_delete'), handleClick: this.handleDeleteBatch},
+        {
+          name: this.$t('api_test.definition.request.batch_delete'),
+          handleClick: this.handleDeleteBatch,
+          permissions: ['PROJECT_API_DEFINITION:READ+DELETE_API']
+        },
         {
           name: "批量恢复", handleClick: this.handleBatchRestore
         },
       ],
       tableOperatorButtons: [],
       tableUsualOperatorButtons: [
-        {tip: this.$t('api_test.automation.execute'), icon: "el-icon-video-play", exec: this.runApi},
+        {
-        {tip: this.$t('commons.edit'), icon: "el-icon-edit", exec: this.editApi},
+          tip: this.$t('api_test.automation.execute'),
-        {tip: "CASE", exec: this.handleTestCase, isDivButton: true, type: "primary"},
+          icon: "el-icon-video-play",
-        {tip: this.$t('commons.delete'), exec: this.handleDelete, icon: "el-icon-delete", type: "danger"},
+          exec: this.runApi,
-        {tip: this.$t('commons.copy'), exec: this.handleCopy, icon: "el-icon-document-copy", type: "primary"},
+          permissions: ['PROJECT_API_DEFINITION:READ+RUN']
+        },
+        {
+          tip: this.$t('commons.edit'),
+          icon: "el-icon-edit",
+          exec: this.editApi,
+          permissions: ['PROJECT_API_DEFINITION:READ+EDIT_API']
+        },
+        {
+          tip: "CASE",
+          exec: this.handleTestCase,
+          isDivButton: true,
+          type: "primary",
+          permissions: ['PROJECT_API_DEFINITION:READ+CREATE_CASE']
+        },
+        {
+          tip: this.$t('commons.delete'),
+          exec: this.handleDelete,
+          icon: "el-icon-delete",
+          type: "danger",
+          permissions: ['PROJECT_API_DEFINITION:READ+DELETE_API']
+        },
+        {
+          tip: this.$t('commons.copy'),
+          exec: this.handleCopy,
+          icon: "el-icon-document-copy",
+          type: "primary",
+          permissions: ['PROJECT_API_DEFINITION:READ+COPY']
+        },
       ],
       tableTrashOperatorButtons: [
-        {tip: this.$t('api_test.automation.execute'), icon: "el-icon-video-play", exec: this.runApi},
+        {
+          tip: this.$t('api_test.automation.execute'),
+          icon: "el-icon-video-play",
+          exec: this.runApi,
+          permissions: ['PROJECT_API_DEFINITION:READ+RUN']
+        },
         {tip: this.$t('commons.reduction'), icon: "el-icon-refresh-left", exec: this.reductionApi},
-        {tip: "CASE", exec: this.handleTestCase, isDivButton: true, type: "primary"},
+        {
-        {tip: this.$t('commons.delete'), exec: this.handleDelete, icon: "el-icon-delete", type: "danger"},
+          tip: "CASE",
+          exec: this.handleTestCase,
+          isDivButton: true,
+          type: "primary",
+          permissions: ['PROJECT_API_DEFINITION:READ+CREATE_CASE']
+        },
+        {
+          tip: this.$t('commons.delete'),
+          exec: this.handleDelete,
+          icon: "el-icon-delete",
+          type: "danger",
+          permissions: ['PROJECT_API_DEFINITION:READ+DELETE_API']
+        },
       ],
       typeArr: [
         {id: 'status', name: this.$t('api_test.definition.api_status')},
@@ -321,7 +369,7 @@ export default {
       screenHeight: document.documentElement.clientHeight - 310,//屏幕高度,
       environmentId: undefined,
       selectDataCounts: 0,
-    }
+    };
   },
   props: {
     currentProtocol: String,
@@ -347,13 +395,13 @@ export default {
     moduleTree: {
       type: Array,
       default() {
-        return []
+        return [];
       },
     },
     moduleOptions: {
       type: Array,
       default() {
-        return []
+        return [];
       },
     }
   },
@@ -453,7 +501,7 @@ export default {
             if (item.tags && item.tags.length > 0) {
               item.tags = JSON.parse(item.tags);
             }
-          })
+          });
 
           // nexttick:表格加载完成之后触发。判断是否需要勾选行
           this.$nextTick(function () {
@@ -461,7 +509,7 @@ export default {
               this.$refs.apiDefinitionTable.checkTableRowIsSelect();
               this.$refs.apiDefinitionTable.doLayout();
             }
-          })
+          });
         });
       }
       getLabel(this, API_LIST);
@@ -513,7 +561,7 @@ export default {
       this.$post('/user/ws/member/tester/list', {workspaceId: workspaceId}, response => {
         this.valueArr.userId = response.data;
         this.userFilters = response.data.map(u => {
-          return {text: u.name, value: u.id}
+          return {text: u.name, value: u.id};
         });
       });
     },
@@ -562,8 +610,8 @@ export default {
         }
         response.body = body;
       }
-      row.request = request
+      row.request = request;
-      row.response = response
+      row.response = response;
       this.$emit('runTest', row);
     },
     reductionApi(row) {
@@ -706,7 +754,7 @@ export default {
       this.$emit("changeSelectDataRangeAll", "api");
     },
     getIds(rowSets) {
-      let rowArray = Array.from(rowSets)
+      let rowArray = Array.from(rowSets);
       let ids = rowArray.map(s => s.id);
       return ids;
     },
@@ -739,7 +787,7 @@ export default {
             if (api.moduleId === item.id) {
               api.modulePath = item.path;
             }
-          })
+          });
         });
       } catch (e) {
         console.log(e);
@@ -773,7 +821,7 @@ export default {
       return row[property] === value;
     }
   },
-}
+};
 </script>
 
 <style scoped>

frontend/src/business/components/api/definition/components/module/ApiModuleHeader.vue

@@ -27,7 +27,8 @@
       @saveAsEdit="saveAsEdit"
       @refresh="refresh"
       ref="basisApi"/>
-    <api-import :propotal="condition.protocol" ref="apiImport" :moduleOptions="moduleOptions" @refresh="$emit('refresh')"/>
+    <api-import :propotal="condition.protocol" ref="apiImport" :moduleOptions="moduleOptions"
+                @refresh="$emit('refresh')"/>
   </div>
 </template>
 
@@ -36,9 +37,9 @@
 import MsAddBasisApi from "../basis/AddBasisApi";
 import ApiImport from "../import/ApiImport";
 import ModuleTrashButton from "./ModuleTrashButton";
-  import {buildNodePath} from "@/business/components/api/definition/model/NodeTree";
 import TemplateComponent from "../../../../track/plan/view/comonents/report/TemplateComponent/TemplateComponent";
 import MsSearchBar from "@/business/components/common/components/search/MsSearchBar";
+
 export default {
   name: "ApiModuleHeader",
   components: {MsSearchBar, TemplateComponent, ModuleTrashButton, ApiImport, MsAddBasisApi},
@@ -48,18 +49,24 @@
       operators: [
         {
           label: this.$t('api_test.definition.request.title'),
-            callback: this.addApi
+          callback: this.addApi,
+          permissions: ['PROJECT_API_DEFINITION:READ+CREATE_API']
         },
         {
           label: this.$t('api_test.definition.request.fast_debug'),
-            callback: () => {this.$emit('debug')}
+          callback: () => {
+            this.$emit('debug');
+          },
+          permissions: ['PROJECT_API_DEFINITION:READ+DEBUG']
         },
         {
           label: this.$t('api_test.api_import.label'),
-            callback: this.handleImport
+          callback: this.handleImport,
+          permissions: ['PROJECT_API_DEFINITION:READ+IMPORT_API']
         },
         {
           label: this.$t('report.export'),
+          permissions: ['PROJECT_API_DEFINITION:READ+EXPORT_API'],
           children: [
             {
               label: this.$t('report.export_to_ms_format'),
@@ -84,13 +91,13 @@
           ]
         }
       ]
-      }
+    };
   },
   props: {
     condition: {
       type: Object,
       default() {
-          return {}
+        return {};
       }
     },
     showOperator: Boolean,
@@ -98,19 +105,19 @@
     currentModule: {
       type: Object,
       default() {
-          return {}
+        return {};
       }
     },
     isReadOnly: {
       type: Boolean,
       default() {
-          return false
+        return false;
       }
     },
   },
   computed: {
     projectId() {
-        return this.$store.state.projectId
+      return this.$store.state.projectId;
     },
   },
   methods: {
@@ -139,7 +146,7 @@
       this.condition.trashEnable = true;
     }
   }
-  }
+};
 </script>
 
 <style scoped>
@@ -147,12 +154,15 @@
   width: 92px;
   height: 30px;
 }
+
 .protocol-col {
   min-width: 93px;
 }
+
 .read-only {
   width: 150px !important;
 }
+
 .filter-input {
   width: 174px;
   padding-left: 3px;

frontend/src/business/components/common/components/search/MsSearchBar.vue

@@ -7,7 +7,9 @@
             <i class="el-icon-arrow-down el-icon--right"/>
           </el-button>
           <el-dropdown-menu slot="dropdown">
-            <el-dropdown-item v-for="(item, index) in commands" :key="index" @click.native.stop="click(item)">
+            <el-dropdown-item v-for="(item, index) in commands" :key="index" @click.native.stop="click(item)"
+                              v-permission="item.permissions"
+            >
              <span class="tip-font" v-if="!item.children">
                {{ item.label }}
              </span>

frontend/src/common/js/utils.js

@@ -96,7 +96,7 @@ export function hasPermission(permission) {
   }
 
   let systemPermissions = user.userGroups.filter(gp => gp.group.type === 'SYSTEM')
-    .filter(ug => ug.sourceId === 'system')[0]?.userGroupPermissions
+    .filter(ug => ug.sourceId === 'system' || ug.sourceId === 'adminSourceId')[0]?.userGroupPermissions
     .map(g => g.permissionId) || [];
 
   for (const p of systemPermissions) {