From 1760d43c9e0340cbbaba1025c5dcdd697b738185 Mon Sep 17 00:00:00 2001
From: ibuler <ibuler@qq.com>
Date: Thu, 4 Jun 2020 14:55:07 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E4=BF=AE=E6=94=B9=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E5=92=8C=E8=B7=AF=E7=94=B1=E7=9A=84=E8=AE=A1=E7=AE=97=E6=96=B9?=
 =?UTF-8?q?=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/layout/components/NavBar/Organization.vue |  9 +-
 .../components/NavHeader/AccountDropdown.vue  | 30 ++++---
 src/router/audits.js                          | 11 +--
 src/router/common.js                          |  1 +
 src/router/index.js                           | 13 ++-
 src/router/sessions.js                        |  7 +-
 src/router/userPage.js                        | 26 +++---
 src/store/getters.js                          |  4 +-
 src/store/modules/permission.js               | 14 +--
 src/store/modules/users.js                    | 75 +++++++++++-----
 src/utils/auth.js                             |  7 +-
 src/utils/role.js                             | 90 +++++++++++++++++++
 src/utils/startup.js                          | 37 +++++---
 .../DatesLoginSummary/LoginActivePin.vue      |  2 +-
 .../AssetPermissionCreateUpdate.vue           |  2 +-
 .../AssetPermissionUser.vue                   |  2 +-
 .../AssetPermission/AssetPermissionList.vue   |  2 +-
 .../DatabaseAppPermissionCreateUpdate.vue     |  2 +-
 .../DatabaseAppPermissionUser.vue             |  2 +-
 .../DatabaseAppPermissionList.vue             |  2 +-
 .../RemoteAppPermissionCreateUpdate.vue       |  2 +-
 .../RemoteAppPermissionUser.vue               |  2 +-
 .../UserDetail/UserAssetPermissionRules.vue   |  2 +-
 .../xpack/Org/OrganizationCreateUpdate.vue    |  2 +-
 .../OrganizationDetail/OrganizationDetail.vue |  2 +-
 src/views/xpack/router.js                     |  5 +-
 26 files changed, 255 insertions(+), 98 deletions(-)
 create mode 100644 src/utils/role.js

diff --git a/src/layout/components/NavBar/Organization.vue b/src/layout/components/NavBar/Organization.vue
index 62e4fb83b..28ba53368 100644
--- a/src/layout/components/NavBar/Organization.vue
+++ b/src/layout/components/NavBar/Organization.vue
@@ -26,6 +26,7 @@
 <script>
 import { mapGetters } from 'vuex'
 import { hasUUID } from '@/utils/common'
+import rolec from '@/utils/role'
 export default {
   props: {
     isCollapse: {
@@ -41,8 +42,8 @@ export default {
       'currentRole',
       'userAdminOrgList'
     ]),
-    hasOrgPermission() {
-      return this.currentRole === 'Admin'
+    inAdminPage() {
+      return (this.currentRole & rolec.PERM_USE) !== rolec.PERM_USE
     },
     orgIdMapper() {
       const mapper = {}
@@ -53,13 +54,13 @@ export default {
     }
   },
   mounted() {
-    if (this.hasOrgPermission) {
+    if (this.inAdminPage) {
       this.checkCurrentOrgIsNeedChange()
     }
   },
   methods: {
     needShow() {
-      return !this.isCollapse && this.userAdminOrgList.length > 1 && this.hasOrgPermission
+      return !this.isCollapse && this.userAdminOrgList.length > 1 && this.inAdminPage
     },
     checkCurrentOrgIsNeedChange() {
       if (!this.currentOrg || typeof this.currentOrg !== 'object') {
diff --git a/src/layout/components/NavHeader/AccountDropdown.vue b/src/layout/components/NavHeader/AccountDropdown.vue
index 9da9d5b1c..4d00e7718 100644
--- a/src/layout/components/NavHeader/AccountDropdown.vue
+++ b/src/layout/components/NavHeader/AccountDropdown.vue
@@ -8,12 +8,14 @@
       </span>
       <el-dropdown-menu slot="dropdown">
         <el-dropdown-item icon="el-icon-user" command="profile">{{ $t('common.nav.Profile') }}</el-dropdown-item>
-        <el-dropdown-item v-if="isInAdminRole && hasAdminRole " icon="el-icon-guide" command="userPage">
-          {{ $t('common.nav.UserPage') }}
-        </el-dropdown-item>
-        <el-dropdown-item v-if="!isInAdminRole && hasAdminRole " icon="el-icon-guide" command="adminPage">
-          {{ $t('common.nav.AdminPage') }}
-        </el-dropdown-item>
+        <div v-if="currentOrgRoles.length > 1">
+          <el-dropdown-item v-if="isInAdminRole " icon="el-icon-guide" command="userPage">
+            {{ $t('common.nav.UserPage') }}
+          </el-dropdown-item>
+          <el-dropdown-item v-else icon="el-icon-guide" command="adminPage">
+            {{ $t('common.nav.AdminPage') }}
+          </el-dropdown-item>
+        </div>
         <el-dropdown-item icon="el-icon-key" command="apiKey">{{ $t('common.nav.APIKey') }}</el-dropdown-item>
         <el-dropdown-item divided command="logout">{{ $t('common.nav.Logout') }}</el-dropdown-item>
       </el-dropdown-menu>
@@ -25,6 +27,7 @@
 <script>
 import { mapGetters } from 'vuex'
 import ApiKey from './ApiKey'
+import rolec from '@/utils/role'
 
 export default {
   name: 'AccountDropdown',
@@ -39,17 +42,21 @@ export default {
   },
   computed: {
     isInAdminRole() {
-      return this.currentRole === 'Admin'
+      console.log(this.currentRole)
+      return (this.currentRole & rolec.PERM_ADMIN) === rolec.PERM_ADMIN
     },
     hasAdminRole() {
-      return this.getCurrentOrgRoles.includes('Admin')
+      return this.currentOrgRoles.includes('Admin')
     },
     ...mapGetters([
       'currentUser',
       'currentRole',
-      'getCurrentOrgRoles'
+      'currentOrgRoles'
     ])
   },
+  mounted() {
+    console.log('Roles: ', this.currentOrgRoles)
+  },
   methods: {
     handleClick(val) {
       switch (val) {
@@ -57,11 +64,12 @@ export default {
           this.$router.push({ name: 'UserProfile' })
           break
         case 'adminPage':
-          this.$store.dispatch('users/setCurrentRole', 'Admin')
+          this.$store.dispatch('users/setCurrentRole', this.currentOrgRoles[0])
           window.location.href = `/ui/`
           break
         case 'userPage':
-          this.$store.dispatch('users/setCurrentRole', 'User')
+          this.$store.dispatch('users/setCurrentRole', this.currentOrgRoles[1])
+          console.log('Switch to: ', this.currentOrgRoles[1])
           window.location.href = `/ui/`
           break
         case 'logout':
diff --git a/src/router/audits.js b/src/router/audits.js
index 98f80f733..f0dec6de5 100644
--- a/src/router/audits.js
+++ b/src/router/audits.js
@@ -1,34 +1,35 @@
 import i18n from '@/i18n/i18n'
+import rolec from '@/utils/role'
 
 export default [
   {
     path: 'login-log',
     name: 'LoginLog',
     component: () => import('@/views/audits/LoginLogList'),
-    meta: { title: i18n.t('route.LoginLog') }
+    meta: { title: i18n.t('route.LoginLog'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'ftp-log',
     name: 'FtpLog',
     component: () => import('@/views/audits/FTPLogList'),
-    meta: { title: i18n.t('route.FtpLog') }
+    meta: { title: i18n.t('route.FtpLog'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'operate-log',
     name: 'OperateLog',
     component: () => import('@/views/audits/OperateLogList'),
-    meta: { title: i18n.t('route.OperateLog') }
+    meta: { title: i18n.t('route.OperateLog'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'password-change-log',
     name: 'PasswordChangeLog',
     component: () => import('@/views/audits/PasswordChangeLogList'),
-    meta: { title: i18n.t('route.PasswordChangeLog') }
+    meta: { title: i18n.t('route.PasswordChangeLog'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'command-execution-log',
     name: 'BatchCommandLog',
     component: () => import('@/views/audits/CommandExecutionList'),
-    meta: { title: i18n.t('route.BatchCommandLog') }
+    meta: { title: i18n.t('route.BatchCommandLog'), permissions: [rolec.PERM_AUDIT] }
   }
 ]
diff --git a/src/router/common.js b/src/router/common.js
index abf32a97e..85db0dd7e 100644
--- a/src/router/common.js
+++ b/src/router/common.js
@@ -9,6 +9,7 @@ export default [
   {
     path: '/users/profile',
     component: Layout,
+    hidden: true,
     children: [
       {
         path: '',
diff --git a/src/router/index.js b/src/router/index.js
index b8aa7c414..d9faba4ca 100644
--- a/src/router/index.js
+++ b/src/router/index.js
@@ -1,6 +1,7 @@
 import Vue from 'vue'
 import Router from 'vue-router'
 import i18n from '@/i18n/i18n'
+import rolec from '@/utils/role'
 
 Vue.use(Router)
 
@@ -68,12 +69,15 @@ export const allRoleRoutes = [
     path: '/',
     component: Layout,
     redirect: '/dashboard',
+    meta: {
+      permissions: [rolec.PERM_AUDIT]
+    },
     children: [
       {
         path: 'dashboard',
         name: 'dashboard',
         component: () => import('@/views/dashboard/index'),
-        meta: { title: i18n.t('route.Dashboard'), icon: 'dashboard' }
+        meta: { title: i18n.t('route.Dashboard'), icon: 'dashboard', permissions: [rolec.PERM_AUDIT] }
       }
     ]
   },
@@ -117,7 +121,7 @@ export const allRoleRoutes = [
     component: Layout,
     redirect: '/terminal/session-online/',
     name: 'Sessions',
-    meta: { title: i18n.t('route.Sessions'), icon: 'rocket' },
+    meta: { title: i18n.t('route.Sessions'), icon: 'rocket', permissions: [rolec.PERM_AUDIT] },
     children: SessionsRoute
   },
   {
@@ -143,7 +147,7 @@ export const allRoleRoutes = [
     component: Layout,
     redirect: '/audits/login-log/',
     name: 'Audits',
-    meta: { title: i18n.t('route.Audits'), icon: 'history' },
+    meta: { title: i18n.t('route.Audits'), icon: 'history', permissions: [rolec.PERM_AUDIT] },
     children: AuditsRoutes
   },
   ...requireContext.keys().map(key => requireContext(key).default),
@@ -152,11 +156,12 @@ export const allRoleRoutes = [
     path: '/settings',
     component: Layout,
     redirect: '/settings/',
+    permissions: [rolec.PERM_SUPER],
     children: [{
       path: 'settings',
       name: 'Settings',
       component: () => import('@/views/settings/index'),
-      meta: { title: i18n.t('route.Settings'), icon: 'gears', roles: ['SuperAdmin'] }
+      meta: { title: i18n.t('route.Settings'), icon: 'gears', permissions: [rolec.PERM_SUPER] }
     }]
   },
   ...userPageRoutes,
diff --git a/src/router/sessions.js b/src/router/sessions.js
index fbc509811..1d793158b 100644
--- a/src/router/sessions.js
+++ b/src/router/sessions.js
@@ -1,22 +1,23 @@
 import i18n from '@/i18n/i18n'
+import rolec from '@/utils/role'
 export default [
   {
     path: 'session',
     name: 'SessionList',
     component: () => import('@/views/sessions/SessionList/index'),
-    meta: { title: i18n.t('route.Sessions') }
+    meta: { title: i18n.t('route.Sessions'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'command',
     name: 'CommandList',
     component: () => import('@/views/sessions/CommandList'),
-    meta: { title: i18n.t('route.Commands') }
+    meta: { title: i18n.t('route.Commands'), permissions: [rolec.PERM_AUDIT] }
   },
   {
     path: 'sessions/:id',
     name: 'SessionDetail',
     component: () => import('@/views/sessions/SessionDetail/index'),
-    meta: { title: i18n.t('route.SessionDetail'), activeMenu: '/terminal/session' },
+    meta: { title: i18n.t('route.SessionDetail'), activeMenu: '/terminal/session', permissions: [rolec.PERM_AUDIT] },
     hidden: true
   },
   {
diff --git a/src/router/userPage.js b/src/router/userPage.js
index 09d1bd24a..34a26bed5 100644
--- a/src/router/userPage.js
+++ b/src/router/userPage.js
@@ -1,5 +1,6 @@
 import Layout from '@/layout/index'
 import i18n from '@/i18n/i18n'
+import rolec from '@/utils/role'
 
 const scheme = document.location.protocol
 const port = document.location.port ? ':' + document.location.port : ''
@@ -11,9 +12,10 @@ export default [
     path: '/',
     component: Layout,
     meta: {
-      roles: ['User'],
+      roles: [rolec.USER],
       title: i18n.t('route.MyAssets'),
-      icon: 'files-o'
+      icon: 'files-o',
+      permissions: [rolec.PERM_USE]
     },
     children: [
       {
@@ -23,7 +25,7 @@ export default [
         meta: {
           title: i18n.t('route.MyAssets'),
           icon: 'files-o',
-          roles: ['User']
+          permissions: [rolec.PERM_USE]
         }
       }
     ]
@@ -33,19 +35,19 @@ export default [
     name: 'Apps',
     component: Layout,
     redirect: '/apps/remoteapp',
-    meta: { title: i18n.t('route.MyApps'), icon: 'th', roles: ['User'] },
+    meta: { title: i18n.t('route.MyApps'), icon: 'th', permissions: [rolec.PERM_USE] },
     children: [
       {
         path: '/apps/remoteapp',
         name: 'remoteapp',
         component: () => import('@/userviews/apps/RemoteApp'),
-        meta: { title: i18n.t('route.RemoteApp'), roles: ['User'] }
+        meta: { title: i18n.t('route.RemoteApp'), permissions: [rolec.PERM_USE] }
       },
       {
         path: '/apps/database',
         name: 'assets',
         component: () => import('@/userviews/apps/DatabaseApp'),
-        meta: { title: i18n.t('route.DatabaseApp'), roles: ['User'] }
+        meta: { title: i18n.t('route.DatabaseApp'), permissions: [rolec.PERM_USE] }
       }
     ]
   },
@@ -53,14 +55,14 @@ export default [
     path: '/command-executions',
     component: Layout,
     meta: {
-      roles: ['User']
+      permissions: [rolec.PERM_USE]
     },
     children: [
       {
         path: '',
         name: 'CommandExecutions',
         component: () => import('@/views/ops/CommandExecution'),
-        meta: { title: i18n.t('route.CommandExecutions'), icon: 'terminal', roles: ['User'] }
+        meta: { title: i18n.t('route.CommandExecutions'), icon: 'terminal', permissions: [rolec.PERM_USE] }
       }
     ]
   },
@@ -68,12 +70,12 @@ export default [
     path: `external-luna`,
     component: Layout,
     meta: {
-      roles: ['User']
+      permissions: [rolec.PERM_USE]
     },
     children: [
       {
         path: `${URL}/luna/`,
-        meta: { title: i18n.t('route.WebTerminal'), icon: 'window-maximize', activeMenu: '/assets', roles: ['User'] }
+        meta: { title: i18n.t('route.WebTerminal'), icon: 'window-maximize', activeMenu: '/assets', permissions: [rolec.PERM_USE] }
       }
     ]
   },
@@ -81,12 +83,12 @@ export default [
     path: 'external-elfinder',
     component: Layout,
     meta: {
-      roles: ['User']
+      permissions: [rolec.PERM_USE]
     },
     children: [
       {
         path: `${URL}/koko/elfinder/sftp/`,
-        meta: { title: i18n.t('route.WebFTP'), icon: 'file', activeMenu: '/assets', roles: ['User'] }
+        meta: { title: i18n.t('route.WebFTP'), icon: 'file', activeMenu: '/assets', permissions: [rolec.PERM_USE] }
       }
     ]
   }
diff --git a/src/store/getters.js b/src/store/getters.js
index 6c0035d63..623625c08 100644
--- a/src/store/getters.js
+++ b/src/store/getters.js
@@ -3,7 +3,7 @@ const getters = {
   device: state => state.app.device,
   token: state => state.users.token,
   currentOrg: state => state.users.currentOrg,
-  currentRole: state => state.users.currentRoles,
+  currentRole: state => state.users.currentRole,
   userAdminOrgList: state => state.users.orgs,
   currentUser: state => state.users.profile,
   permission_routes: state => state.permission.routes,
@@ -11,6 +11,6 @@ const getters = {
   cachedViews: state => state.tagsView.cachedViews,
   publicSettings: state => state.settings.publicSettings,
   customSettings: state => state.settings.customSettings,
-  getCurrentOrgRoles: state => state.users.profile.current_org_roles
+  currentOrgRoles: state => state.users.roles
 }
 export default getters
diff --git a/src/store/modules/permission.js b/src/store/modules/permission.js
index c7756a025..abf05595c 100644
--- a/src/store/modules/permission.js
+++ b/src/store/modules/permission.js
@@ -2,18 +2,22 @@ import {
   allRoleRoutes,
   constantRoutes
 } from '@/router'
+import rolec from '@/utils/role'
 /**
  * Use meta.role to determine if the current user has permission
  * @param roles
  * @param route
  */
 function hasPermission(roles, route) {
-  let requireRoles = route.meta ? route.meta.roles : null
-  if (!requireRoles) {
-    requireRoles = ['Admin', 'SuperAdmin']
+  let requirePerms = route.meta ? route.meta.permissions : null
+  if (!requirePerms) {
+    requirePerms = [rolec.PERM_ADMIN]
   }
-  return roles.some(role => requireRoles.includes(role))
-  // return has
+  const requirePermsSum = rolec.sumPerms(requirePerms)
+  const userRolesSum = rolec.sumPerms(roles)
+  const has = (requirePermsSum & userRolesSum) === requirePermsSum
+  // console.log('Has route permission: ', route.path, requirePermsSum, userRolesSum, ' => ', has, roles)
+  return has
 }
 
 /**
diff --git a/src/store/modules/users.js b/src/store/modules/users.js
index eb770d294..7daed9457 100644
--- a/src/store/modules/users.js
+++ b/src/store/modules/users.js
@@ -7,6 +7,7 @@ import {
   saveCurrentRoleToCookie
 } from '@/utils/auth'
 import { resetRouter } from '@/router'
+import rolec from '@/utils/role'
 
 const getDefaultState = () => {
   return {
@@ -14,8 +15,9 @@ const getDefaultState = () => {
     currentOrg: getCurrentOrgFromCookie(),
     currentRole: getCurrentRoleFromCookie(),
     profile: {},
-    roles: [],
-    orgs: []
+    roles: {},
+    orgs: [],
+    perms: 0b00000000
   }
 }
 
@@ -34,6 +36,12 @@ const mutations = {
   SET_ORGS: (state, orgs) => {
     state.orgs = orgs
   },
+  SET_ROLES(state, roles) {
+    state.roles = roles
+  },
+  SET_PERMS(state, perms) {
+    state.perms = perms
+  },
   SET_CURRENT_ORG(state, org) {
     saveCurrentOrgToCookie(org)
     state.currentOrg = org
@@ -41,9 +49,6 @@ const mutations = {
   SET_CURRENT_ROLE(state, role) {
     saveCurrentRoleToCookie(role)
     state.currentRole = role
-  },
-  SET_ROLES(state, roles) {
-    state.roles = roles
   }
 }
 
@@ -64,9 +69,9 @@ const actions = {
   // },
 
   // get user Profile
-  getProfile({ commit, state }) {
+  getProfile({ commit, state }, refresh = false) {
     return new Promise((resolve, reject) => {
-      if (state.profile) {
+      if (!refresh && state.profile && state.profile.length > 0) {
         resolve(state.profile)
         return
       }
@@ -74,19 +79,7 @@ const actions = {
         if (!response) {
           reject('Verification failed, please Login again.')
         }
-        const { admin_or_audit_orgs, current_org_roles, role } = response
-        // roles must be a non-empty array
-        const roles = current_org_roles || []
-        if (role === 'Admin') {
-          roles.push('SuperAdmin')
-        }
-        if (!roles || roles.length <= 0) {
-          reject('getProfile: roles must be a non-null array!')
-        }
-
-        commit('SET_ROLES', roles)
         commit('SET_PROFILE', response)
-        commit('SET_ORGS', admin_or_audit_orgs)
         resolve(response)
       }).catch(error => {
         console.log(error)
@@ -94,11 +87,47 @@ const actions = {
       })
     })
   },
-  getRoles({ commit, state }) {
-
+  getRoles({ commit, dispatch, state }, refresh) {
+    return new Promise((resolve, reject) => {
+      if (!refresh && state.roles && state.roles.length > 0) {
+        return resolve(state.roles)
+      }
+      return dispatch('getProfile').then((profile) => {
+        const { current_org_roles: currentOrgRoles, role } = profile
+        const roles = rolec.parseUserRoles(currentOrgRoles, role)
+        commit('SET_ROLES', roles)
+        resolve(roles)
+      }).catch((e) => {
+        reject(e)
+      })
+    })
   },
-  getOrgs({ commit, state }) {
-
+  getInOrgs({ commit, dispatch, state }, refresh) {
+    return new Promise((resolve, reject) => {
+      if (!refresh && state.role && state.role.length > 0) {
+        return resolve(state.roles)
+      }
+      dispatch('getProfile').then(profile => {
+        const { admin_or_audit_orgs: inOrgs } = profile
+        commit('SET_ORGS', inOrgs)
+        resolve(inOrgs)
+      }).catch((e) => reject(e))
+    })
+  },
+  getTotalPerms({ commit, dispatch, state }, refresh) {
+    return new Promise((resolve, reject) => {
+      if (!refresh && state.perms && state.perms !== 0) {
+        return resolve(state.perms)
+      }
+      dispatch('getRoles').then(roles => {
+        let perms = 0b00000000
+        for (const role of roles) {
+          perms |= role
+        }
+        commit('SET_PERMS', perms)
+        resolve(perms)
+      }).catch((e) => reject(e))
+    })
   },
   // user logout
   logout({ commit, state }) {
diff --git a/src/utils/auth.js b/src/utils/auth.js
index fa69aba2e..e7cd126b3 100644
--- a/src/utils/auth.js
+++ b/src/utils/auth.js
@@ -9,10 +9,15 @@ export function getTokenFromCookie() {
 }
 
 export function getCurrentRoleFromCookie() {
-  return VueCookie.get(CURRENT_ROLE_KEY)
+  const role = VueCookie.get(CURRENT_ROLE_KEY)
+  if (role) {
+    return parseInt(role) || null
+  }
+  return role
 }
 
 export function saveCurrentRoleToCookie(role) {
+  console.log('Save current role to cookie: ', role)
   return VueCookie.set(CURRENT_ROLE_KEY, role, 14)
 }
 
diff --git a/src/utils/role.js b/src/utils/role.js
new file mode 100644
index 000000000..391a322e2
--- /dev/null
+++ b/src/utils/role.js
@@ -0,0 +1,90 @@
+import _ from 'lodash'
+
+const PERM_USE = 0b00000001
+const PERM_AUDIT = 0b00000010
+const PERM_ADMIN = 0b00010000
+const PERM_SUPER = 0b10000000
+const PERM_NONE = 0b00000000
+
+const SUPER_ADMIN = PERM_SUPER | PERM_ADMIN | PERM_AUDIT
+const SUPER_AUDITOR = PERM_SUPER | PERM_AUDIT
+const ORG_ADMIN = PERM_ADMIN | PERM_AUDIT
+const ORG_AUDITOR = PERM_AUDIT
+const USER = PERM_USE
+const ANON = PERM_NONE
+
+const ROLE_NAME_MAPPER = {
+  SuperAdmin: SUPER_ADMIN,
+  SuperAuditor: SUPER_AUDITOR,
+  OrgAdmin: ORG_ADMIN,
+  OrgAuditor: ORG_AUDITOR,
+  User: USER,
+  Anon: ANON
+}
+
+const ROLE_NAME_MAPPER_REVERSED = _.invert(ROLE_NAME_MAPPER)
+
+export function getPermsToRolesDisplay(perms) {
+  const display = []
+  for (const [name, role] of Object.entries(ROLE_NAME_MAPPER)) {
+    if ((role & perms) === role) {
+      display.push(name)
+    }
+  }
+  return display
+}
+
+export function getRolesDisplay(roles) {
+  const display = []
+  for (const role of roles) {
+    if (ROLE_NAME_MAPPER_REVERSED[role]) {
+      display.push(ROLE_NAME_MAPPER_REVERSED[role])
+    }
+  }
+  return display
+}
+
+export function parseUserRoles(currentOrgRoles, role) {
+  if (role === 'Admin') {
+    return [SUPER_ADMIN, USER]
+  }
+  if (currentOrgRoles.includes('Admin')) {
+    return [ORG_ADMIN, USER]
+  }
+  if (role === 'Auditor' || currentOrgRoles.includes('Auditor')) {
+    return [ORG_AUDITOR]
+  }
+  return [USER]
+}
+
+export function getAdminOrUserPageRole(allRoles, page) {
+  // 切换到管理员页面的时候应该的最高权限
+  if (allRoles.length === 1) {
+    return allRoles[0]
+  }
+  if (!page) {
+    page = 'admin'
+  }
+  // 优先admin
+  if (page === 'admin') {
+    // 第一个是管理员或超级管理员，第二个肯定是用户
+    return allRoles[0]
+  }
+  return allRoles[1]
+}
+
+export function sumPerms(perms) {
+  let sum = 0
+  for (const perm of perms) {
+    sum |= perm
+  }
+  return sum
+}
+
+export default {
+  PERM_USE, PERM_AUDIT, PERM_ADMIN, PERM_SUPER,
+  SUPER_ADMIN, SUPER_AUDITOR, ORG_ADMIN, ORG_AUDITOR,
+  USER, ANON,
+  getRolesDisplay, getPermsToRolesDisplay, getAdminOrUserPageRole,
+  parseUserRoles, sumPerms
+}
diff --git a/src/utils/startup.js b/src/utils/startup.js
index 1469e19cc..03a460a91 100644
--- a/src/utils/startup.js
+++ b/src/utils/startup.js
@@ -4,6 +4,7 @@ import router from '@/router'
 import { Message } from 'element-ui'
 import 'nprogress/nprogress.css' // progress bar style
 import { getTokenFromCookie } from '@/utils/auth'
+import rolec from '@/utils/role'
 
 const whiteList = ['/login', process.env.VUE_APP_LOGIN_PATH] // no redirect whitelist
 let initial = false
@@ -25,15 +26,16 @@ async function checkLogin({ to, from, next }) {
   if (!hasToken) {
     setTimeout(() => {
       window.location = process.env.VUE_APP_LOGIN_PATH
-    }, 1000)
+    }, 100)
     return reject('No token found in cookie')
   }
 
   try {
     return await store.dispatch('users/getProfile')
   } catch (e) {
-    // return false
-    // window.location = process.env.VUE_APP_LOGIN_PATH
+    setTimeout(() => {
+      window.location = process.env.VUE_APP_LOGIN_PATH
+    }, 100)
     return reject('No profile get: ' + e)
   }
 }
@@ -53,11 +55,11 @@ export async function getUserRoleAndSetRoutes({ to, from, next }) {
     // try get user profile
     // note: roles must be a object array! such as: ['admin'] or ,['developer','editor']
     // 不能改名 current_org_roles, 里面返回的就是这个
-    const { current_org_roles } = await store.dispatch('users/getProfile')
-    // console.log('Current org role: ', current_org_roles)
+    const roles = await store.dispatch('users/getRoles')
+    console.log(roles, rolec.getRolesDisplay(roles))
 
-    const cleanedRoles = cleanCurrentRole(current_org_roles)
-    console.log('Current org role: ', cleanedRoles)
+    const cleanedRoles = cleanCurrentRole(roles)
+    console.log('Current org role: ', cleanedRoles, rolec.getRolesDisplay(cleanedRoles))
 
     // generate accessible routes map based on roles
     const accessRoutes = await store.dispatch('permission/generateRoutes', cleanedRoles)
@@ -92,20 +94,27 @@ export async function startup({ to, from, next }) {
   // set page title
   await setHeadTitle({ to, from, next })
   await checkLogin({ to, from, next })
+  await store.dispatch('users/getInOrgs')
+  await store.dispatch('users/getRoles')
   await getPublicSetting({ to, from, next })
   await getUserRoleAndSetRoutes({ to, from, next })
   await checkUserFirstLogin({ to, from, next })
   return true
 }
 
-function cleanCurrentRole(val) {
+function cleanCurrentRole(allRoles) {
   let currentRole = store.getters.currentRole
-  if (!currentRole) {
-    currentRole = val[0]
-  }
-  if (val && !val.includes(currentRole)) {
-    // TODO 异常注入处理
-    currentRole = val[0]
+  // 没有的话就应该选择一个
+
+  console.log('Curernt ROle', currentRole)
+  if (!currentRole && typeof currentRole !== 'number') {
+    currentRole = rolec.getAdminOrUserPageRole(allRoles)
+    console.log('1')
+  } else {
+    console.log('2')
+    if ((currentRole & rolec.sumPerms(allRoles)) !== currentRole) {
+      currentRole = rolec.getAdminOrUserPageRole(allRoles)
+    }
   }
   store.dispatch('users/setCurrentRole', currentRole)
   return [currentRole]
diff --git a/src/views/dashboard/DatesLoginSummary/LoginActivePin.vue b/src/views/dashboard/DatesLoginSummary/LoginActivePin.vue
index 03104d0de..e643a8332 100644
--- a/src/views/dashboard/DatesLoginSummary/LoginActivePin.vue
+++ b/src/views/dashboard/DatesLoginSummary/LoginActivePin.vue
@@ -46,7 +46,7 @@ export default {
           show: false
         },
         title: {
-          subtext: this.$t('dashboard.User')
+          subtext: this.$t('dashboard.USER')
         },
         color: ['#1ab394', '#1C84C6', '#9CC3DA'],
         tooltip: {
diff --git a/src/views/perms/AssetPermission/AssetPermissionCreateUpdate.vue b/src/views/perms/AssetPermission/AssetPermissionCreateUpdate.vue
index 940f69327..3898f3629 100644
--- a/src/views/perms/AssetPermission/AssetPermissionCreateUpdate.vue
+++ b/src/views/perms/AssetPermission/AssetPermissionCreateUpdate.vue
@@ -19,7 +19,7 @@ export default {
       },
       fields: [
         [this.$t('perms.Basic'), ['name']],
-        [this.$t('perms.User'), ['users', 'user_groups']],
+        [this.$t('perms.USER'), ['users', 'user_groups']],
         [this.$t('perms.Asset'), ['assets', 'nodes', 'system_users']],
         [this.$t('common.action'), ['actions']],
         [this.$t('common.Other'), ['is_active', 'date_expired', 'comment']]
diff --git a/src/views/perms/AssetPermission/AssetPermissionDetail/AssetPermissionUser.vue b/src/views/perms/AssetPermission/AssetPermissionDetail/AssetPermissionUser.vue
index 47703b6ba..4dc334343 100644
--- a/src/views/perms/AssetPermission/AssetPermissionDetail/AssetPermissionUser.vue
+++ b/src/views/perms/AssetPermission/AssetPermissionDetail/AssetPermissionUser.vue
@@ -36,7 +36,7 @@ export default {
         ],
         columnsMeta: {
           user_display: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             align: 'center'
           },
           delete_action: {
diff --git a/src/views/perms/AssetPermission/AssetPermissionList.vue b/src/views/perms/AssetPermission/AssetPermissionList.vue
index 2febb4d15..79468aa22 100644
--- a/src/views/perms/AssetPermission/AssetPermissionList.vue
+++ b/src/views/perms/AssetPermission/AssetPermissionList.vue
@@ -45,7 +45,7 @@ export default {
             }
           },
           users_amount: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             formatter: DetailFormatter,
             formatterArgs: {
               routeQuery: {
diff --git a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionCreateUpdate.vue b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionCreateUpdate.vue
index de26de50b..315614caa 100644
--- a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionCreateUpdate.vue
+++ b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionCreateUpdate.vue
@@ -16,7 +16,7 @@ export default {
       },
       fields: [
         [this.$t('perms.' + 'Basic'), ['name']],
-        [this.$t('perms.' + 'User'), ['users', 'user_groups']],
+        [this.$t('perms.' + 'USER'), ['users', 'user_groups']],
         [this.$t('perms.' + 'databaseApp'), ['database_apps', 'system_users']],
         [this.$t('common.Other'), ['is_active', 'date_expired', 'comment']]
       ],
diff --git a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionDetail/DatabaseAppPermissionUser.vue b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionDetail/DatabaseAppPermissionUser.vue
index e001ff8bf..bdccbd521 100644
--- a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionDetail/DatabaseAppPermissionUser.vue
+++ b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionDetail/DatabaseAppPermissionUser.vue
@@ -37,7 +37,7 @@ export default {
         ],
         columnsMeta: {
           user_display: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             align: 'center'
           },
           delete_action: {
diff --git a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionList.vue b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionList.vue
index 0e680258b..19966352e 100644
--- a/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionList.vue
+++ b/src/views/perms/DatabaseAppPermission/DatabaseAppPermissionList.vue
@@ -24,7 +24,7 @@ export default {
             }
           },
           users_amount: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             formatter: DetailFormatter,
             formatterArgs: {
               routeQuery: {
diff --git a/src/views/perms/RemoteAppPermission/RemoteAppPermissionCreateUpdate.vue b/src/views/perms/RemoteAppPermission/RemoteAppPermissionCreateUpdate.vue
index df4af998e..4a6cea905 100644
--- a/src/views/perms/RemoteAppPermission/RemoteAppPermissionCreateUpdate.vue
+++ b/src/views/perms/RemoteAppPermission/RemoteAppPermissionCreateUpdate.vue
@@ -16,7 +16,7 @@ export default {
       },
       fields: [
         [this.$t('perms.Basic'), ['name']],
-        [this.$t('perms.User'), ['users', 'user_groups']],
+        [this.$t('perms.USER'), ['users', 'user_groups']],
         [this.$t('perms.remoteApp'), ['remote_apps', 'system_users']],
         [this.$t('common.Other'), ['is_active', 'date_expired', 'comment']]
       ],
diff --git a/src/views/perms/RemoteAppPermission/RemoteAppPermissionDetail/RemoteAppPermissionUser.vue b/src/views/perms/RemoteAppPermission/RemoteAppPermissionDetail/RemoteAppPermissionUser.vue
index e9d23d20f..6caa34df8 100644
--- a/src/views/perms/RemoteAppPermission/RemoteAppPermissionDetail/RemoteAppPermissionUser.vue
+++ b/src/views/perms/RemoteAppPermission/RemoteAppPermissionDetail/RemoteAppPermissionUser.vue
@@ -36,7 +36,7 @@ export default {
         ],
         columnsMeta: {
           user_display: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             align: 'center'
           },
           delete_action: {
diff --git a/src/views/users/User/UserDetail/UserAssetPermissionRules.vue b/src/views/users/User/UserDetail/UserAssetPermissionRules.vue
index 5bb85baed..e050373da 100644
--- a/src/views/users/User/UserDetail/UserAssetPermissionRules.vue
+++ b/src/views/users/User/UserDetail/UserAssetPermissionRules.vue
@@ -45,7 +45,7 @@ export default {
             }
           },
           users_amount: {
-            label: this.$t('perms.User'),
+            label: this.$t('perms.USER'),
             formatter: DetailFormatter,
             formatterArgs: {
               routeQuery: {
diff --git a/src/views/xpack/Org/OrganizationCreateUpdate.vue b/src/views/xpack/Org/OrganizationCreateUpdate.vue
index 147d650bb..9900c779a 100644
--- a/src/views/xpack/Org/OrganizationCreateUpdate.vue
+++ b/src/views/xpack/Org/OrganizationCreateUpdate.vue
@@ -42,7 +42,7 @@ export default {
             }
           },
           users: {
-            label: this.$t('xpack.User'),
+            label: this.$t('xpack.USER'),
             el: {
               value: [],
               ajax: {
diff --git a/src/views/xpack/Org/OrganizationDetail/OrganizationDetail.vue b/src/views/xpack/Org/OrganizationDetail/OrganizationDetail.vue
index 82bcf73f6..f20047280 100644
--- a/src/views/xpack/Org/OrganizationDetail/OrganizationDetail.vue
+++ b/src/views/xpack/Org/OrganizationDetail/OrganizationDetail.vue
@@ -30,7 +30,7 @@ export default {
     return {
       userRelationConfig: {
         icon: 'fa-user',
-        title: this.$t('xpack.User'),
+        title: this.$t('xpack.USER'),
         objectsAjax: {
           url: '/api/v1/users/users/?fields_size=mini&order=name',
           transformOption: (item) => {
diff --git a/src/views/xpack/router.js b/src/views/xpack/router.js
index 3271276d4..ceea5ec33 100644
--- a/src/views/xpack/router.js
+++ b/src/views/xpack/router.js
@@ -1,6 +1,7 @@
 import Layout from '@/layout/index'
 import empty from '@/layout/empty'
 import i18n from '@/i18n/i18n'
+import rolec from '@/utils/role'
 
 export default {
   path: '/xpack',
@@ -13,7 +14,7 @@ export default {
       path: 'interface-setting',
       component: () => import('@/views/xpack/InterfaceSettings.vue'),
       name: 'InterfaceSetting',
-      meta: { title: i18n.t('xpack.InterfaceSettings'), roles: ['SuperAdmin'] }
+      meta: { title: i18n.t('xpack.InterfaceSettings'), permissions: [rolec.PERM_SUPER] }
     },
     // {
     //   path: 'license',
@@ -61,7 +62,7 @@ export default {
       component: empty,
       name: 'OrganizationList',
       redirect: '',
-      meta: { title: i18n.t('xpack.OrganizationList'), roles: ['SuperAdmin'] },
+      meta: { title: i18n.t('xpack.OrganizationList'), permissions: [rolec.PERM_SUPER] },
       children: [
         {
           path: '',