refactor: reorganize modules and add Linux build tooling

module/base/mgt/internal/logic/department/create.go

@@ -0,0 +1,103 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	coreTypes "git.apinb.com/bsm-sdk/core/types"
+	"git.apinb.com/bsm-sdk/core/utils"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func Create(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+		data    = models.MgtDepartment{}
+	)
+
+	// 解析JSON请求
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+
+	// 参数验证
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	// 创建时必填：应用维度（应用->部门）
+	if request.Workspace == "" {
+		printer.Error("新增部门参数异常: workspace 不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.Name == "" {
+		printer.Error("新增部门参数异常: 部门名称不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: workspace=%s, err=%v", request.Workspace, err)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	// 同一应用下部门名称唯一
+	if err = models.DBService.Model(&models.MgtDepartment{}).
+		Where("app_id = ? and name = ?", appId, request.Name).First(&data).Error; err != nil {
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+	} else {
+		printer.Info("该应用下部门已存在: workspace=%s, name=%s", request.Workspace, request.Name)
+		infra.Response.Error(c, errcode.ErrAlreadyExists)
+		return
+	}
+
+	// 若有父部门，校验父部门属于同一应用
+	if request.ParentID > 0 {
+		var parent models.MgtDepartment
+		if err = models.DBService.Select("id", "app_id").Where("id = ?", request.ParentID).First(&parent).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				infra.Response.Error(c, errcode.ErrRecordNotFound)
+				return
+			}
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		if parent.AppID != appId {
+			printer.Error("父部门不属于当前应用")
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+	}
+
+	// 新增部门（归属当前应用）
+	var dataModel = models.MgtDepartment{
+		Std_IICUDS: coreTypes.Std_IICUDS{Identity: utils.ULID(), Status: 1},
+		AppID:      appId,
+		ParentID:   request.ParentID,
+		LeaderID:   request.LeaderID,
+		Name:       request.Name,
+	}
+	if err = models.DBService.Create(&dataModel).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("部门创建成功: ID=%d, name=%s", dataModel.ID, dataModel.Name)
+	infra.Response.Success(c, types.IdResp{Id: dataModel.ID, Identity: dataModel.Identity})
+}

module/base/mgt/internal/logic/department/del.go

@@ -0,0 +1,96 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func getDepartmentIdsRecursive(db *gorm.DB, appId uint, rootDeptId uint) ([]uint, error) {
+	var allDepts []models.MgtDepartment
+	if err := db.Select("id", "parent_id").Where("app_id = ?", appId).Find(&allDepts).Error; err != nil {
+		return nil, err
+	}
+	childrenMap := make(map[uint][]uint, len(allDepts))
+	for _, dept := range allDepts {
+		if dept.ParentID > 0 {
+			childrenMap[dept.ParentID] = append(childrenMap[dept.ParentID], dept.ID)
+		}
+	}
+	result := make([]uint, 0, len(allDepts))
+	var collectChildren func(uint)
+	collectChildren = func(deptId uint) {
+		result = append(result, deptId)
+		for _, childId := range childrenMap[deptId] {
+			collectChildren(childId)
+		}
+	}
+	collectChildren(rootDeptId)
+	return result, nil
+}
+
+func Del(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+	)
+
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	if request.ID == 0 {
+
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	var dept models.MgtDepartment
+	if err := models.DBService.Select("id", "app_id").Where("id = ?", request.ID).First(&dept).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	allDeptIds, err := getDepartmentIdsRecursive(models.DBService, dept.AppID, request.ID)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	if err := models.DBService.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("dpt_id in ?", allDeptIds).Delete(&models.MgtLinkUserDpt{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("dpt_id in ?", allDeptIds).Delete(&models.MgtLinkDptRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("dpt_id in ?", allDeptIds).Delete(&models.MgtLinkDptPmn{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("id in ?", allDeptIds).Delete(&models.MgtDepartment{}).Error; err != nil {
+			return err
+		}
+		return nil
+	}); err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	infra.Response.Success(c, types.IdResp{Id: request.ID})
+}

module/base/mgt/internal/logic/department/detail.go

@@ -0,0 +1,54 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func Detail(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+		data    = models.MgtDepartment{}
+	)
+
+	// 解析JSON请求
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+
+	// 参数验证
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	if request.ID == 0 {
+		printer.Error("部门ID不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	if err = models.DBService.Model(&models.MgtDepartment{}).
+		Select("id", "identity", "name", "app_id", "parent_id", "leader_id").Preload("Leader", func(db *gorm.DB) *gorm.DB {
+		return db.Select("id", "identity", "name")
+	}).Where("id = ?", request.ID).First(&data).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	infra.Response.Success(c, data)
+}

module/base/mgt/internal/logic/department/fetch.go

@@ -0,0 +1,68 @@
+package department
+
+import (
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/logic/tool"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+)
+
+func Fetch(c *gin.Context) {
+	var (
+		request       = types.DptReq{}
+		count   int64 = 0
+		data          = make([]models.MgtDepartment, 0)
+		db            = models.DBService.Model(&models.MgtDepartment{}).Select("id", "identity", "name", "app_id", "parent_id")
+	)
+
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	// 应用->部门：列表必传 workspace，只查询应用下部门
+	if request.Workspace == "" {
+		printer.Error("获取部门列表参数异常: workspace 不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: workspace=%s", request.Workspace)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+	db = db.Where("app_id = ?", appId)
+
+	if request.Keyword != "" {
+		db = db.Where("name like ?", "%"+request.Keyword+"%")
+	}
+	if request.Status != 0 {
+		db = db.Where("status =  ? ", request.Status)
+	}
+	if request.ID != 0 {
+		db = db.Where("id = ?", request.ID)
+	}
+	if request.ParentID != 0 {
+		db = db.Where("parent_id = ?", request.ParentID)
+	}
+
+	page, size := tool.GetSizeAndPage(request.Page, request.Size)
+	if err := db.Count(&count).Limit(size).Offset((page - 1) * size).Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	infra.Response.Success(c, types.FetchResp{Data: data, Page: page, Size: size, Total: count})
+}

module/base/mgt/internal/logic/department/fetch_pmn.go

@@ -0,0 +1,105 @@
+package department
+
+import (
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func PermissionsFetch(c *gin.Context) {
+	var (
+		request = types.FetchBase{}
+		data    = make([]models.MgtDepartment, 0)
+		db      = models.DBService.Model(&models.MgtDepartment{})
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.ID != 0 {
+		db = db.Where("id = ?", request.ID)
+	}
+	var appId uint
+	if request.Workspace != "" {
+		appModel := models.MgtApplication{Workspace: request.Workspace}
+		var err error
+		appId, err = appModel.WorkspaceToId()
+		if err != nil {
+			printer.Error("workspace not found: workspace=%s", request.Workspace)
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		db = db.Where("app_id = ?", appId)
+	}
+
+	if request.Workspace != "" {
+		if err := db.Select("id", "identity", "name").Find(&data).Error; err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		if len(data) == 0 {
+			infra.Response.Success(c, data)
+			return
+		}
+		deptIds := make([]uint, 0, len(data))
+		for _, d := range data {
+			deptIds = append(deptIds, d.ID)
+		}
+		var links []models.MgtLinkDptPmn
+		if err := models.DBService.Where("app_id = ? and dpt_id in ?", appId, deptIds).Find(&links).Error; err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		dptToPmn := make(map[uint][]uint)
+		pmnIdSet := make(map[uint]struct{})
+		for _, l := range links {
+			dptToPmn[l.DptId] = append(dptToPmn[l.DptId], l.PmnId)
+			pmnIdSet[l.PmnId] = struct{}{}
+		}
+		pmnIds := make([]uint, 0, len(pmnIdSet))
+		for id := range pmnIdSet {
+			pmnIds = append(pmnIds, id)
+		}
+		var perms []models.MgtPermission
+		if len(pmnIds) > 0 {
+			if err := models.DBService.Select("id", "identity", "title", "title_en", "sort_key", "parent_id").
+				Where("id in ?", pmnIds).Find(&perms).Error; err != nil {
+				infra.Response.Error(c, errcode.ErrDB)
+				return
+			}
+		}
+		permMap := make(map[uint]models.MgtPermission)
+		for _, p := range perms {
+			permMap[p.ID] = p
+		}
+		for i := range data {
+			ids := dptToPmn[data[i].ID]
+			data[i].Permissions = make([]models.MgtPermission, 0, len(ids))
+			for _, pid := range ids {
+				if p, ok := permMap[pid]; ok {
+					data[i].Permissions = append(data[i].Permissions, p)
+				}
+			}
+		}
+		infra.Response.Success(c, data)
+		return
+	}
+
+	preloadPerm := func(db *gorm.DB) *gorm.DB {
+		return db.Select("id", "identity", "title", "title_en", "sort_key", "parent_id")
+	}
+	if err := db.Select("id", "identity", "name").Preload("Permissions", preloadPerm).Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	infra.Response.Success(c, data)
+}

module/base/mgt/internal/logic/department/fetch_pmn_tree.go

@@ -0,0 +1,129 @@
+package department
+
+import (
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func PermissionsFetchTree(c *gin.Context) {
+	var (
+		request = types.FetchBase{}
+		data    = make([]models.MgtDepartment, 0)
+		db      = models.DBService.Model(&models.MgtDepartment{})
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.ID != 0 {
+		db = db.Where("id = ?", request.ID)
+	}
+	var appId uint
+	if request.Workspace != "" {
+		appModel := models.MgtApplication{Workspace: request.Workspace}
+		var err error
+		appId, err = appModel.WorkspaceToId()
+		if err != nil {
+			printer.Error("workspace not found: workspace=%s", request.Workspace)
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		db = db.Where("app_id = ?", appId)
+	}
+
+	if request.Workspace != "" {
+		if err := db.Select("id", "identity", "name").Find(&data).Error; err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		if len(data) == 0 {
+			infra.Response.Success(c, data)
+			return
+		}
+		deptIds := make([]uint, 0, len(data))
+		for _, d := range data {
+			deptIds = append(deptIds, d.ID)
+		}
+		var links []models.MgtLinkDptPmn
+		if err := models.DBService.Where("app_id = ? and dpt_id in ?", appId, deptIds).Find(&links).Error; err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		dptToPmn := make(map[uint][]uint)
+		pmnIdSet := make(map[uint]struct{})
+		for _, l := range links {
+			dptToPmn[l.DptId] = append(dptToPmn[l.DptId], l.PmnId)
+			pmnIdSet[l.PmnId] = struct{}{}
+		}
+		pmnIds := make([]uint, 0, len(pmnIdSet))
+		for id := range pmnIdSet {
+			pmnIds = append(pmnIds, id)
+		}
+		var perms []models.MgtPermission
+		if len(pmnIds) > 0 {
+			if err := models.DBService.Select("id", "identity", "title", "title_en", "sort_key", "parent_id", "menu_path", "code", "component", "is_web_page", "is_new_tab", "web_url").
+				Where("id in ?", pmnIds).Order("sort_key").Find(&perms).Error; err != nil {
+				infra.Response.Error(c, errcode.ErrDB)
+				return
+			}
+		}
+		for i := range data {
+			ids := dptToPmn[data[i].ID]
+			idSet := make(map[uint]struct{})
+			for _, id := range ids {
+				idSet[id] = struct{}{}
+			}
+			data[i].Permissions = buildPermTreeFilter(perms, 0, idSet)
+		}
+		infra.Response.Success(c, data)
+		return
+	}
+
+	permTreePreload := func(db *gorm.DB) *gorm.DB {
+		return db.Select("id", "identity", "title", "title_en", "sort_key", "parent_id", "menu_path", "code", "component", "is_web_page", "is_new_tab", "web_url").
+			Where("parent_id = 0").Order("sort_key").
+			Preload("Children", func(db *gorm.DB) *gorm.DB {
+				return db.Select("id", "identity", "title", "title_en", "sort_key", "parent_id", "menu_path", "code", "component", "is_web_page", "is_new_tab", "web_url").Order("sort_key")
+			})
+	}
+
+	if err := db.Select("id", "identity", "name").Preload("Permissions", permTreePreload).Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	infra.Response.Success(c, data)
+}
+
+func buildPermTreeFilter(list []models.MgtPermission, parentId uint, idSet map[uint]struct{}) []models.MgtPermission {
+	var node []models.MgtPermission
+	for _, p := range list {
+		if _, ok := idSet[p.ID]; !ok {
+			continue
+		}
+		isRoot := parentId == 0
+		parentInSet := false
+		if p.ParentID != 0 {
+			_, parentInSet = idSet[p.ParentID]
+		}
+		matches := (p.ParentID == parentId) || (isRoot && p.ParentID != 0 && !parentInSet)
+		if !matches {
+			continue
+		}
+		children := buildPermTreeFilter(list, p.ID, idSet)
+		if len(children) > 0 {
+			p.Children = children
+		}
+		node = append(node, p)
+	}
+	return node
+}

module/base/mgt/internal/logic/department/fetch_tree.go

@@ -0,0 +1,50 @@
+package department
+
+import (
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+)
+
+func FetchTree(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+		data    = make([]models.MgtDepartment, 0)
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.Workspace == "" {
+		printer.Error("workspace is required: workspace=%s", request.Workspace)
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("workspace not found: workspace=%s", request.Workspace)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	if err := models.DBService.Model(&models.MgtDepartment{}).
+		Where("app_id = ?", appId).
+		Select("id", "identity", "name", "app_id", "parent_id").
+		Order("parent_id asc").Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	tree := buildDeptTree(data, 0)
+	infra.Response.Success(c, types.FetchResp{Data: tree})
+}

module/base/mgt/internal/logic/department/list.go

@@ -0,0 +1,82 @@
+package department
+
+import (
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+)
+
+// List 下拉用部门列表，必传 workspace；tree=true 时返回树形
+func List(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+		data    = make([]models.MgtDepartment, 0)
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.Workspace == "" {
+		printer.Error("部门列表参数异常: workspace 不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: workspace=%s", request.Workspace)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	db := models.DBService.Model(&models.MgtDepartment{}).
+		Where("app_id = ?", appId).
+		Select("id", "identity", "name", "app_id", "parent_id")
+	if request.Keyword != "" {
+		db = db.Where("name LIKE ?", "%"+request.Keyword+"%")
+	}
+	if request.Status != 0 {
+		db = db.Where("status = ?", request.Status)
+	}
+
+	if request.Tree {
+		if err := db.Order("parent_id asc").Find(&data).Error; err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		tree := buildDeptTree(data, 0)
+		infra.Response.Success(c, types.FetchResp{Data: tree})
+		return
+	}
+
+	if err := db.Order("parent_id asc").Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	infra.Response.Success(c, types.FetchResp{Data: data})
+}
+
+// buildDeptTree 将扁平部门列表按 parent_id 建树，parentId 为根节点父ID（0 表示顶层）
+func buildDeptTree(list []models.MgtDepartment, parentId uint) []models.MgtDepartment {
+	var node []models.MgtDepartment
+	for _, d := range list {
+		if d.ParentID != parentId {
+			continue
+		}
+		children := buildDeptTree(list, d.ID)
+		if len(children) > 0 {
+			d.Children = children
+		}
+		node = append(node, d)
+	}
+	return node
+}

module/base/mgt/internal/logic/department/modify.go

@@ -0,0 +1,112 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	coreTypes "git.apinb.com/bsm-sdk/core/types"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func Modify(c *gin.Context) {
+	var (
+		request = types.DptReq{}
+		data    = models.MgtDepartment{}
+	)
+
+	err := c.ShouldBindJSON(&request)
+	if err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	if request.ID == 0 {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	if err = models.DBService.Select("id", "app_id", "identity").Where("id = ?", request.ID).First(&data).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	appId := data.AppID
+
+	if request.ParentID > 0 {
+		if request.ParentID == request.ID {
+			printer.Error("self-reference is not allowed: id=%d", request.ID)
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+		descendantIds, err := getDepartmentIdsRecursive(models.DBService, appId, request.ID)
+		if err != nil {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		for _, id := range descendantIds {
+			if id == request.ParentID {
+				printer.Error("self-reference is not allowed: parent_id=%d", request.ParentID)
+				infra.Response.Error(c, errcode.ErrInvalidArgument)
+				return
+			}
+		}
+	}
+
+	if request.Name != "" {
+		var exist models.MgtDepartment
+		if err = models.DBService.Model(&models.MgtDepartment{}).
+			Where("app_id = ? and name = ? and id <> ?", appId, request.Name, request.ID).First(&exist).Error; err == nil {
+			infra.Response.Error(c, errcode.ErrAlreadyExists)
+			return
+		}
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+	}
+
+	if request.ParentID > 0 {
+		var parent models.MgtDepartment
+		if err = models.DBService.Select("id", "app_id").Where("id = ?", request.ParentID).First(&parent).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				infra.Response.Error(c, errcode.ErrInvalidArgument)
+				return
+			}
+			infra.Response.Error(c, errcode.ErrDB)
+			return
+		}
+		if parent.AppID != appId {
+			printer.Error("parent department not found: parent_id=%d, app_id=%d", request.ParentID, appId)
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+	}
+
+	var dataModel = models.MgtDepartment{
+		Name:       request.Name,
+		ParentID:   request.ParentID,
+		LeaderID:   request.LeaderID,
+		Std_IICUDS: coreTypes.Std_IICUDS{Status: request.Status},
+	}
+	if err := models.DBService.Model(&models.MgtDepartment{}).Where("id = ?", request.ID).Updates(&dataModel).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("department modified: id=%d", request.ID)
+	infra.Response.Success(c, types.IdResp{Id: request.ID, Identity: data.Identity})
+}

module/base/mgt/internal/logic/department/set_pmn.go

@@ -0,0 +1,199 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+// SetPmn 给部门设置权限（应用->部门->权限，校验部门所属应用与 workspace 一致）
+func SetPmn(c *gin.Context) {
+	var (
+		request = types.AddPmnRequest{}
+		pmnData = make([]models.MgtLinkDptPmn, 0)
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: %v", err)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	var dpt models.MgtDepartment
+	if err := models.DBService.Select("id", "app_id").Where("id = ?", request.Id).First(&dpt).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	if dpt.AppID != appId {
+		printer.Error("部门不属于当前应用: dpt_id=%d", request.Id)
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	for _, v := range request.List {
+		if v == 0 {
+			printer.Error("权限ID不能为空")
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+		pmnData = append(pmnData, models.MgtLinkDptPmn{AppId: appId, PmnId: v, DptId: request.Id})
+	}
+
+	if err := models.DBService.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "dpt_id"}, {Name: "app_id"}, {Name: "pmn_id"}},
+		DoUpdates: clause.AssignmentColumns([]string{"dpt_id", "app_id", "pmn_id"}),
+	}).Create(&pmnData).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("部门权限设置成功: dptId=%d", request.Id)
+	infra.Response.Success(c, "")
+}
+
+// ModifyPmn 按应用维度覆盖部门权限
+func ModifyPmn(c *gin.Context) {
+	var (
+		request = types.AddPmnRequest{}
+		pmnData = make([]models.MgtLinkDptPmn, 0)
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: %v", err)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	var dpt models.MgtDepartment
+	if err := models.DBService.Select("id", "app_id").Where("id = ?", request.Id).First(&dpt).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	if dpt.AppID != appId {
+		printer.Error("部门不属于当前应用: dpt_id=%d", request.Id)
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	for _, v := range request.List {
+		if v == 0 {
+			printer.Error("权限ID不能为空")
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+		pmnData = append(pmnData, models.MgtLinkDptPmn{AppId: appId, PmnId: v, DptId: request.Id})
+	}
+
+	if err := models.DBService.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("dpt_id = ? and app_id = ?", request.Id, appId).Delete(&models.MgtLinkDptPmn{}).Error; err != nil {
+			return err
+		}
+		if len(pmnData) > 0 {
+			if err := tx.Create(&pmnData).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("部门权限修改成功: dptId=%d", request.Id)
+	infra.Response.Success(c, "")
+}
+
+// DelPmn 移除部门权限
+func DelPmn(c *gin.Context) {
+	var request = types.AddPmnRequest{}
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if len(request.List) == 0 {
+		printer.Error("移除部门权限参数异常: list 不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	appModel := models.MgtApplication{Workspace: request.Workspace}
+	appId, err := appModel.WorkspaceToId()
+	if err != nil {
+		printer.Error("未获取到应用: %v", err)
+		infra.Response.Error(c, errcode.ErrRecordNotFound)
+		return
+	}
+
+	var dpt models.MgtDepartment
+	if err := models.DBService.Select("id", "app_id").Where("id = ?", request.Id).First(&dpt).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	if dpt.AppID != appId {
+		printer.Error("部门不属于当前应用: dpt_id=%d", request.Id)
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	pmnIds := make([]uint, 0, len(request.List))
+	for _, v := range request.List {
+		if v == 0 {
+			printer.Error("权限ID不能为空")
+			infra.Response.Error(c, errcode.ErrInvalidArgument)
+			return
+		}
+		pmnIds = append(pmnIds, v)
+	}
+	if err := models.DBService.Where("dpt_id = ? AND app_id = ? AND pmn_id in ?", request.Id, appId, pmnIds).
+		Delete(&models.MgtLinkDptPmn{}).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("部门权限删除成功: dptId=%d", request.Id)
+	infra.Response.Success(c, "")
+}

module/base/mgt/internal/logic/department/user.go

@@ -0,0 +1,107 @@
+package department
+
+import (
+	"errors"
+
+	"bsm/full/module/base/mgt/internal/libs"
+	"bsm/full/module/base/mgt/internal/models"
+	"bsm/full/module/base/mgt/internal/types"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/printer"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+// SetUser 将用户移入部门（可批量）
+func SetUser(c *gin.Context) {
+	var request types.DptUserRequest
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	var dpt models.MgtDepartment
+	if err := models.DBService.Select("id").Where("id = ?", request.DptId).First(&dpt).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(c, errcode.ErrRecordNotFound)
+			return
+		}
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	list := make([]models.MgtLinkUserDpt, 0, len(request.UserIds))
+	for _, uid := range request.UserIds {
+		list = append(list, models.MgtLinkUserDpt{UserId: uid, DptId: request.DptId})
+	}
+	if err := models.DBService.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "user_id"}, {Name: "dpt_id"}},
+		DoNothing: true,
+	}).Create(&list).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("用户移入部门成功: dptId=%d, count=%d", request.DptId, len(request.UserIds))
+	infra.Response.Success(c, "")
+}
+
+// DelUser 将用户移出部门（可批量）
+func DelUser(c *gin.Context) {
+	var request types.DptUserRequest
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+
+	result := models.DBService.Where("dpt_id = ? and user_id in ?", request.DptId, request.UserIds).
+		Delete(&models.MgtLinkUserDpt{})
+	if result.Error != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+
+	printer.Info("用户移出部门成功: dptId=%d, count=%d", request.DptId, result.RowsAffected)
+	infra.Response.Success(c, "")
+}
+
+// UserFetch 获取部门下用户列表
+func UserFetch(c *gin.Context) {
+	var (
+		request = types.FetchBase{}
+		data    = make([]models.MgtDepartment, 0)
+		db      = models.DBService.Model(&models.MgtDepartment{})
+	)
+	if err := c.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrJsonUnmarshal)
+		return
+	}
+	if err := libs.ValidateStruct(&request); err != nil {
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	if request.ID == 0 {
+		printer.Error("获取部门用户参数异常: 部门ID不能为空")
+		infra.Response.Error(c, errcode.ErrInvalidArgument)
+		return
+	}
+	db = db.Where("id = ?", request.ID)
+
+	if err := db.Select("id", "identity", "name").Preload("Users", func(db *gorm.DB) *gorm.DB {
+		return db.Select("id", "identity", "name")
+	}).Find(&data).Error; err != nil {
+		infra.Response.Error(c, errcode.ErrDB)
+		return
+	}
+	infra.Response.Success(c, data)
+}