feat: 后端接口添加角色权限标识

权限算法=请求API+操作类型
操作类型=增加(post)+删除(delete)+修改(update)

+分页查询(page)+列表查询(list)+明细(get)

+导出(export)+导入(import)+分享(share)
例如：api:yt:user:update

@@ -25,7 +25,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/alarm/profile")
 @Api(tags = {"告警配置"})
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class AlarmProfileController extends BaseController {
 
     private final AlarmProfileService alarmProfileService;
@@ -61,6 +61,7 @@ public class AlarmProfileController extends BaseController {
 
     @PostMapping
     @ApiOperation("新增|编辑")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarm:profile:post','api:yt:alarm:profile:update'})")
     public AlarmProfileDTO saveOrUpdateAlarmProfile(
             @Validated @RequestBody AlarmProfileDTO alarmProfileDTO) throws ThingsboardException {
         alarmProfileDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -69,6 +70,7 @@ public class AlarmProfileController extends BaseController {
 
     @DeleteMapping
     @ApiOperation("删除")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarm:profile:delete'})")
     public boolean deleteAlarmProfile(@Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -77,6 +79,7 @@ public class AlarmProfileController extends BaseController {
 
     @GetMapping("{alarmProfileId}/{status}")
     @ApiOperation("更新状态")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarm:profile:update'})")
     public AlarmProfileDTO saveOrUpdateAlarmProfile(
             @PathVariable("alarmProfileId") String alarmProfileId, @PathVariable("status") Integer status)
             throws ThingsboardException {

@@ -14,7 +14,9 @@ import org.springframework.web.context.request.async.DeferredResult;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.query.TsValue;
 import org.thingsboard.server.common.data.yunteng.core.message.ErrorMessage;
-import org.thingsboard.server.common.data.yunteng.dto.*;
+import org.thingsboard.server.common.data.yunteng.dto.HomePageLeftTopDTO;
+import org.thingsboard.server.common.data.yunteng.dto.TenantDTO;
+import org.thingsboard.server.common.data.yunteng.dto.TenantTransportMessageDTO;
 import org.thingsboard.server.common.data.yunteng.dto.statistics.HomePageAppDTO;
 import org.thingsboard.server.common.data.yunteng.enums.TrendType;
 import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
@@ -52,7 +54,7 @@ public class HomePageController extends BaseController {
 
     @GetMapping("right/overdue")
     @ApiOperation(value = "获取右侧过期租户信息")
-    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+    @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
     public ResponseEntity<YtPageData<TenantDTO>> getRightTopInfo(
             @RequestParam(PAGE) int page, @RequestParam(PAGE_SIZE) int pageSize) {
         HashMap<String, Object> queryMap = new HashMap<>();
@@ -63,14 +65,14 @@ public class HomePageController extends BaseController {
 
     @GetMapping("right/top10")
     @ApiOperation(value = "获取右侧Top10")
-    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+    @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
     public DeferredResult<List<TenantTransportMessageDTO>> getTop10() {
         return homePageService.getTop10();
     }
 
     @GetMapping("left/bottom")
     @ApiOperation(value = "获取左侧底部信息")
-    @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN','CUSTOMER_USER'},{})")
     public DeferredResult<List<TsValue>> getLeftBottomInfo(
             @RequestParam(value = "startTs") long startTs,
             @RequestParam("endTs") long endTs,

@@ -37,7 +37,10 @@ import org.thingsboard.server.service.install.InstallScripts;
 import org.thingsboard.server.service.security.permission.Operation;
 
 import java.net.URI;
-import java.util.*;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
 
@@ -45,7 +48,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/admin")
 @Api(tags = {"租户管理", "菜单管理"})
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+@PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
 public class YtAdminController extends BaseController {
 
   private final YtTenantService ytTenantService;
@@ -56,7 +59,7 @@ public class YtAdminController extends BaseController {
   private final UserService tbUserService;
 
   @PostMapping("/tenant")
-  @PreAuthorize("hasAnyAuthority('api:yt:admin:saveTenant')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:admin:tenant:post'})")
   public ResponseEntity<TenantDTO> saveTenant(@RequestBody TenantReqDTO tenantReqDTO) {
     TenantDTO newTenant = ytTenantService.createNewTenant(tenantReqDTO);
     URI location =
@@ -88,6 +91,7 @@ public class YtAdminController extends BaseController {
   }
 
   @PutMapping("/tenant")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:admin:tenant:update'})")
   public TenantDTO updateTenant(@RequestBody TenantDTO tenantDTO) {
     Assert.notNull(tenantDTO, "tenant cannot be null");
     Assert.notNull(tenantDTO.getId(), "tenant id cannot be null when update");
@@ -101,6 +105,7 @@ public class YtAdminController extends BaseController {
   }
 
   @DeleteMapping("/tenant")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:admin:tenant:delete'})")
   public void deleteTenant(@Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO)
       throws ThingsboardException {
 
@@ -124,6 +129,7 @@ public class YtAdminController extends BaseController {
   }
 
   @DeleteMapping("/user/deleteTenantAdmin")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:admin:user:deleteTenantAdmin:delete'})")
   public ResponseEntity<Boolean> deleteTenantAdmin(
       @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
     for (String strUserId : deleteDTO.getIds()) {
@@ -146,6 +152,7 @@ public class YtAdminController extends BaseController {
   }
 
   @PostMapping("/tenant/adminUser")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:admin:tenant:adminUser:post'})")
   public ResponseEntity<UserDTO> createTenantAdmin(
       @RequestParam(value = "sendEmail", required = false, defaultValue = "false")
           boolean sendEmail,

@@ -43,6 +43,7 @@ public class YtAlarmContactController extends BaseController {
 
   @ApiOperation(value = "新增联系人|编辑")
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarmContact:post','api:yt:alarmContact:update'})")
   public ResponseEntity<AlarmContactDTO> saveAlarmContact(
       @Validated(AddGroup.class) @RequestBody AlarmContactDTO alarmContactDTO)
       throws ThingsboardException {
@@ -70,8 +71,9 @@ public class YtAlarmContactController extends BaseController {
     return ResponseEntity.ok(all);
   }
 
-  @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+
   @ApiOperation(value = "分页查询")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
   @GetMapping(params = {PAGE_SIZE, PAGE})
   public YtPageData<AlarmContactDTO> pageAlarm(
       @RequestParam(PAGE_SIZE) int pageSize,
@@ -97,6 +99,7 @@ public class YtAlarmContactController extends BaseController {
 
   @ApiOperation(value = "删除")
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarmContact:delete'})")
   public void deleteById(@RequestBody String[] ids) throws ThingsboardException {
     if (ids.length == 0) {
       throw new YtDataValidationException("please provide alarm ids to delete");
@@ -117,6 +120,7 @@ public class YtAlarmContactController extends BaseController {
 
   @ApiOperation(value = "修改告警联系人信息")
   @PostMapping("/update")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:alarmContact:update:update'})")
   public void update(@RequestBody AlarmContactDTO alarmContactDTO) {
 
     alarmService.update(alarmContactDTO);

@@ -3,7 +3,6 @@ package org.thingsboard.server.controller.yunteng;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -14,8 +13,6 @@ import org.thingsboard.server.common.data.EntityType;
 import org.thingsboard.server.common.data.alarm.AlarmSeverity;
 import org.thingsboard.server.common.data.alarm.AlarmStatus;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
-import org.thingsboard.server.common.data.id.CustomerId;
-import org.thingsboard.server.common.data.page.TimePageLink;
 import org.thingsboard.server.common.data.yunteng.dto.SysDictDTO;
 import org.thingsboard.server.common.data.yunteng.enums.DeviceTypeEnum;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
@@ -46,8 +43,8 @@ public class YtAlarmInfoController extends BaseController {
 
 
     //分页测试通过
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
     @ApiOperation(value = "查询")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @GetMapping(params = {PAGE_SIZE, PAGE})
     public YtPageData<YtAlarmEntity> pageAlarmInfo(
             @RequestParam(PAGE_SIZE) int pageSize,

@@ -4,6 +4,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.yunteng.dto.SysAppDesignDTO;
@@ -25,12 +26,14 @@ public class YtAppDesignController extends BaseController {
 
   @GetMapping("get")
   @ApiOperation("查询详情")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:appDesign:get:get'})")
   public ResponseEntity<SysAppDesignDTO> get() throws ThingsboardException {
     return ResponseEntity.ok(sysAppDesignService.get(getCurrentUser().getCurrentTenantId()));
   }
 
   @PutMapping("update")
   @ApiOperation("更新")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:appDesign:update:update'})")
   public ResponseEntity update(@RequestBody SysAppDesignDTO sysAppDesignDTO)
       throws ThingsboardException {
     sysAppDesignDTO.setId(null);

@@ -23,13 +23,12 @@ import org.thingsboard.server.dao.yunteng.service.YtConfigurationCenterService;
 import java.util.HashMap;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
-import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.ORDER_TYPE;
 
 @RestController
 @RequestMapping("/api/yt/configuration/center")
 @RequiredArgsConstructor
 @Api(tags = "组态中心")
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtConfigurationCenterController extends BaseController {
 
   private final YtConfigurationCenterService ytConfigurationCenterService;
@@ -68,6 +67,7 @@ public class YtConfigurationCenterController extends BaseController {
 
   @PostMapping
   @ApiOperation("新增")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:configuration:center:post'})")
   public ResponseEntity<ConfigurationCenterDTO> save(
       @Validated({AddGroup.class}) @RequestBody ConfigurationCenterDTO configurationCenterDTO)
       throws ThingsboardException {
@@ -78,6 +78,7 @@ public class YtConfigurationCenterController extends BaseController {
 
   @PutMapping
   @ApiOperation("修改")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:configuration:center:update'})")
   public ResponseEntity<ConfigurationCenterDTO> update(
       @Validated({UpdateGroup.class}) @RequestBody ConfigurationCenterDTO configurationCenterDTO)
       throws ThingsboardException {
@@ -88,6 +89,7 @@ public class YtConfigurationCenterController extends BaseController {
 
   @DeleteMapping
   @ApiOperation("删除")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:configuration:center:delete'})")
   public ResponseEntity<Boolean> delete(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO)
       throws ThingsboardException {

@@ -4,6 +4,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
@@ -26,6 +27,7 @@ public class YtConfigurationContentController extends BaseController {
 
   @PostMapping
   @ApiOperation("新增")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:content:post'})")
   public ResponseEntity<ConfigurationContentDTO> save(
       @Validated({AddGroup.class}) @RequestBody ConfigurationContentDTO configurationContentDTO)
       throws ThingsboardException {
@@ -36,6 +38,7 @@ public class YtConfigurationContentController extends BaseController {
 
   @PutMapping
   @ApiOperation("修改")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:content:update'})")
   public ResponseEntity<ConfigurationContentInfoDTO> update(
       @Validated({UpdateGroup.class}) @RequestBody ConfigurationContentInfoDTO contentReqDTO)
       throws ThingsboardException {
@@ -50,6 +53,7 @@ public class YtConfigurationContentController extends BaseController {
 
   @DeleteMapping
   @ApiOperation("删除")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:content:delete'})")
   public ResponseEntity<Boolean> delete(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO)
       throws ThingsboardException {

@@ -5,15 +5,13 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.yunteng.common.AddGroup;
-import org.thingsboard.server.common.data.yunteng.core.exception.YtDataValidationException;
-import org.thingsboard.server.common.data.yunteng.core.message.ErrorMessage;
 import org.thingsboard.server.common.data.yunteng.dto.*;
 import org.thingsboard.server.common.data.yunteng.utils.JacksonUtil;
-import org.thingsboard.server.common.transport.util.JsonUtils;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.YtConfigurationActService;
 import org.thingsboard.server.dao.yunteng.service.YtConfigurationDatasourceService;
@@ -37,6 +35,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @PostMapping
     @ApiOperation("保存节点数据源并刷新节点的交互和动效信息")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:post'})")
     public ResponseEntity<ConfigurationNodeStateDTO> saveNode(
             @Validated({AddGroup.class}) @RequestBody ConfigurationNodeStateDTO nodeDTO)
             throws ThingsboardException {
@@ -75,6 +74,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @PostMapping("datascource")
     @ApiOperation("编辑数据源")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:datascource:post'})")
     public ResponseEntity<ConfigurationDatasourceDTO> saveDatascource(
             @Validated({AddGroup.class}) @RequestBody ConfigurationDatasourceDTO datasourceDTO)
             throws ThingsboardException {
@@ -85,6 +85,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @PostMapping("event")
     @ApiOperation("编辑数据交互")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:event:post'})")
     public ResponseEntity<ConfigurationEventDTO> saveEvent(
             @Validated({AddGroup.class}) @RequestBody ConfigurationEventDTO eventDTO)
             throws ThingsboardException {
@@ -95,6 +96,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @PostMapping("act")
     @ApiOperation("编辑动画效果")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:act:post'})")
     public ResponseEntity<ConfigurationActDTO> saveAct(
             @Validated({AddGroup.class}) @RequestBody ConfigurationActDTO actDTO)
             throws ThingsboardException {
@@ -106,6 +108,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @DeleteMapping("datascource")
     @ApiOperation("删除数据源")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:datascource:delete'})")
     public ResponseEntity<Boolean> deleteDatascource(@RequestBody ConfigurationDatasourceDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -114,6 +117,7 @@ public class YtConfigurationNodeController extends BaseController {
 
     @DeleteMapping("event")
     @ApiOperation("删除数据交互")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:event:delete'})")
     public ResponseEntity<Boolean> deleteEvent( @RequestBody ConfigurationEventDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -121,6 +125,7 @@ public class YtConfigurationNodeController extends BaseController {
     }
     @DeleteMapping("act")
     @ApiOperation("删除动画效果")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:configuration:node:act:delete'})")
     public ResponseEntity<Boolean> deleteAct( @RequestBody ConfigurationActDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());

@@ -41,13 +41,12 @@ import java.util.*;
 import java.util.concurrent.ConcurrentMap;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
-import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.ORDER_TYPE;
 
 @RestController
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
 @RequestMapping("api/yt/convert")
 @Api(tags = {"数据流转控制器"})
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{})")
 public class YtConvertDataToController extends BaseController {
     private final YtRuleChainService ytRuleChainService;
 
@@ -89,6 +88,7 @@ public class YtConvertDataToController extends BaseController {
 
     @PostMapping("config")
     @ApiOperation("添加或修改转换配置")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:convert:config:post','api:yt:convert:config:update'})")
     public ResponseEntity<ConvertConfigDTO> createOrUpdateConvertData(
             @Validated @RequestBody ConvertConfigDTO convertConfigDTO) throws ThingsboardException {
         convertConfigDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -98,6 +98,7 @@ public class YtConvertDataToController extends BaseController {
 
     @PostMapping("js")
     @ApiOperation("添加或修改转换脚本")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:convert:js:post','api:yt:convert:js:update'})")
     public ResponseEntity<ConvertConfigDTO> createOrUpdateConvertJS(
             @Validated @RequestBody ConvertConfigDTO convertConfigDTO) throws ThingsboardException {
         convertConfigDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -121,6 +122,7 @@ public class YtConvertDataToController extends BaseController {
 
     @DeleteMapping("config")
     @ApiOperation("删除转换配置")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:convert:config:delete'})")
     public ResponseEntity<Boolean> deleteConfig(
             @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
         return delete(deleteDTO, FastIotConstants.CONVERT_DATA);
@@ -128,6 +130,7 @@ public class YtConvertDataToController extends BaseController {
 
     @DeleteMapping("js")
     @ApiOperation("删除转换脚本")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:convert:js:delete'})")
     public ResponseEntity<Boolean> deleteJS(
             @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
         return delete(deleteDTO, FastIotConstants.JAVA_SCRIPT);

@@ -28,12 +28,11 @@ import java.util.List;
 import java.util.Map;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
-import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.ORDER_TYPE;
 
 @RestController
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
 @RequestMapping("api/yt/data_board")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 @Api(tags = {"数据看板"})
 public class YtDataBoardController extends BaseController {
   private final YtDataBoardService ytDataBoardService;
@@ -57,6 +56,7 @@ public class YtDataBoardController extends BaseController {
 
   @DeleteMapping
   @ApiOperation(value = "删除数据看板")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:data_board:delete'})")
   public ResponseResult<Boolean> deleteDataBoard(
       @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
     deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -65,6 +65,7 @@ public class YtDataBoardController extends BaseController {
 
   @PostMapping("/add")
   @ApiOperation(value = "新增数据看板")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:data_board:add:post'})")
   public ResponseResult<DataBoardDTO> save(
       @RequestBody @Validated(AddGroup.class) DataBoardDTO dataBoard)
       throws SchedulerException, ThingsboardException {
@@ -75,6 +76,7 @@ public class YtDataBoardController extends BaseController {
   }
 
   @PostMapping("/update")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:data_board:update:update'})")
   @ApiOperation(value = "编辑数据看板")
   public ResponseResult<DataBoardDTO> update(
       @RequestBody @Validated(UpdateGroup.class) DataBoardDTO dataBoard)

@@ -28,7 +28,7 @@ import java.util.List;
 
 @RestController
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 @RequestMapping("api/yt/data_component")
 @Api(tags = {"数据组件"})
 public class YtDataComponentController extends BaseController {
@@ -88,6 +88,7 @@ public class YtDataComponentController extends BaseController {
 
   @DeleteMapping
   @ApiOperation(value = "删除数据组件")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:data_component:delete'})")
   public ResponseResult<Boolean> deleteDataBoard(
       @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
     deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());

@@ -61,8 +61,7 @@ public class YtDeviceController extends BaseController {
 
     @PostMapping
     @ApiOperation("创建|编辑")
-//    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
-    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{})")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:device:post','api:yt:device:update'})")
     public ResponseEntity<DeviceDTO> saveDevice(
             @Validated(AddGroup.class) @RequestBody DeviceDTO deviceDTO) throws ThingsboardException, ExecutionException, InterruptedException {
         String currentTenantId = getCurrentUser().getCurrentTenantId();
@@ -222,12 +221,13 @@ public class YtDeviceController extends BaseController {
 
     @GetMapping("{id}")
     @ApiOperation("详情")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:device:get'})")
     public ResponseEntity<DeviceDTO> getDevice(@PathVariable("id") String id)
             throws ThingsboardException {
         return ResponseEntity.of(deviceService.getDevice(getCurrentUser().getCurrentTenantId(), id));
     }
 
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @GetMapping(params = {PAGE_SIZE, PAGE})
     @ApiOperation("查询")
     public YtPageData<DeviceDTO> pageDevice(
@@ -272,7 +272,7 @@ public class YtDeviceController extends BaseController {
         return deviceService.page(getCurrentUser().getCurrentTenantId(), queryMap);
     }
 
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @GetMapping(path = {"/relation"}, params = {PAGE_SIZE, PAGE})
     @ApiOperation("子设备查询")
     public YtPageData<RelationDeviceDTO> pageRelationDevice(
@@ -309,6 +309,7 @@ public class YtDeviceController extends BaseController {
 
     @PostMapping("/import")
     @ApiOperation("导入配置")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:device:import'})")
     public ResponseEntity<String> importDeviceProfile() {
         // TODO   实现的业务功能
         return ResponseEntity.ok("");
@@ -316,6 +317,7 @@ public class YtDeviceController extends BaseController {
 
     @PostMapping("/export")
     @ApiOperation("导出")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:device:export'})")
     public ResponseEntity<String> exportDeviceProfile() {
         // TODO   实现的业务功能
         return ResponseEntity.ok("");
@@ -323,6 +325,7 @@ public class YtDeviceController extends BaseController {
 
     @DeleteMapping
     @ApiOperation("删除")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:device:delete'})")
     public void deleteDevices(@Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO)
             throws ThingsboardException {
         String currentTenantId = getCurrentUser().getCurrentTenantId();
@@ -349,7 +352,7 @@ public class YtDeviceController extends BaseController {
     }
 
     @GetMapping("/list/{deviceType}")
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{})")
     @ApiOperation("获取该组织的所有设备")
     public List<DeviceDTO> getGatewayDevices(
             @ApiParam(value = "组织ID") @RequestParam("organizationId") String organizationId,
@@ -358,7 +361,7 @@ public class YtDeviceController extends BaseController {
     }
 
     @GetMapping("/list/master/{organizationId}")
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @ApiOperation("主设备列表")
     public List<SelectItemDTO> getMasterDevices(
             @ApiParam(value = "组织ID") @PathVariable("organizationId") String organizationId) throws ThingsboardException {
@@ -367,7 +370,7 @@ public class YtDeviceController extends BaseController {
                 , organizationId);
     }
     @GetMapping("/list/slave/{organizationId}")
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @ApiOperation("从设备列表")
     public List<SelectItemDTO> getSlaveDevices(
             @ApiParam(value = "组织ID") @PathVariable("organizationId") String organizationId,
@@ -378,7 +381,7 @@ public class YtDeviceController extends BaseController {
     }
 
     @GetMapping("/keys/{organizationId}")
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
     @ApiOperation("设备遥测指标名称")
     public List<String> listKeys(
             @ApiParam(value = "组织ID") @PathVariable("organizationId") String organizationId,

@@ -13,7 +13,10 @@ import org.thingsboard.server.common.data.DeviceProfileProvisionType;
 import org.thingsboard.server.common.data.DeviceProfileType;
 import org.thingsboard.server.common.data.DeviceTransportType;
 import org.thingsboard.server.common.data.audit.ActionType;
-import org.thingsboard.server.common.data.device.profile.*;
+import org.thingsboard.server.common.data.device.profile.DefaultDeviceProfileConfiguration;
+import org.thingsboard.server.common.data.device.profile.DefaultDeviceProfileTransportConfiguration;
+import org.thingsboard.server.common.data.device.profile.DeviceProfileData;
+import org.thingsboard.server.common.data.device.profile.DisabledDeviceProfileProvisionConfiguration;
 import org.thingsboard.server.common.data.edge.EdgeEventActionType;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.id.DeviceProfileId;
@@ -36,7 +39,9 @@ import org.thingsboard.server.service.security.permission.Operation;
 
 import java.time.LocalDateTime;
 import java.time.ZoneOffset;
-import java.util.*;
+import java.util.List;
+import java.util.Objects;
+import java.util.UUID;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
 
@@ -48,7 +53,7 @@ public class YtDeviceProfileController extends BaseController {
     private final YtDeviceProfileService ytDeviceProfileService;
 
     @PostMapping()
-    @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:deviceProfile:post','api:yt:deviceProfile:update'})")
     @ApiOperation("创建 | 编辑")
     public ResponseEntity<DeviceProfileDTO> saveDeviceProfile(
             @RequestBody DeviceProfileDTO deviceProfileDTO) throws ThingsboardException {
@@ -111,6 +116,7 @@ public class YtDeviceProfileController extends BaseController {
 
     @GetMapping("{id}")
     @ApiOperation("详情")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:deviceProfile:get'})")
     public ResponseEntity<DeviceProfileDTO> getDevice(@PathVariable("id") String id) throws ThingsboardException {
         return ResponseEntity.of(ytDeviceProfileService.getDeviceProfile(getCurrentUser().getCurrentTenantId(), id));
     }
@@ -138,6 +144,7 @@ public class YtDeviceProfileController extends BaseController {
 
     @DeleteMapping
     @ApiOperation("删除")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:deviceProfile:delete'})")
     public void deleteDevices(@Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
         ytDeviceProfileService.checkDeviceProfiles(getCurrentUser().getCurrentTenantId(), deleteDTO.getIds());
 
@@ -170,6 +177,7 @@ public class YtDeviceProfileController extends BaseController {
     }
 
     @PostMapping("/import")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:deviceProfile:import'})")
     @ApiOperation("导入配置")
     public ResponseEntity<String> importDeviceProfile(){
         //TODO   实现的业务功能
@@ -177,6 +185,7 @@ public class YtDeviceProfileController extends BaseController {
     }
 
     @PostMapping("/export")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:deviceProfile:export'})")
     @ApiOperation("导出")
     public ResponseEntity<String> exportDeviceProfile(){
         //TODO   实现的业务功能

@@ -5,6 +5,7 @@ import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiParam;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
@@ -35,6 +36,7 @@ public class YtDeviceTypeController extends BaseController {
 
   @PostMapping
   @ApiOperation(value = "保存设备类型")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:device_type:post'})")
   public ResponseEntity<DeviceTypeDTO> saveDeviceType(
       @Validated({AddGroup.class}) @RequestBody DeviceTypeDTO deviceTypeDTO) throws ThingsboardException {
     return ResponseEntity.ok(deviceTypeService.saveDeviceTye(getCurrentUser().getCurrentTenantId(), deviceTypeDTO));
@@ -42,6 +44,7 @@ public class YtDeviceTypeController extends BaseController {
 
   @PutMapping
   @ApiOperation(value = "修改设备类型")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:device_type:update'})")
   public ResponseEntity<DeviceTypeDTO> updateDeviceType(
       @Validated({UpdateGroup.class}) @RequestBody DeviceTypeDTO deviceTypeDTO) {
     return ResponseEntity.ok(deviceTypeService.updateDeviceType(deviceTypeDTO));
@@ -49,6 +52,7 @@ public class YtDeviceTypeController extends BaseController {
 
   @DeleteMapping
   @ApiOperation(value = "删除设备类型")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:device_type:delete'})")
   public ResponseResult<Boolean> deleteDeviceType(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return ResponseResult.success(deviceTypeService.deleteDeviceType(deleteDTO));

@@ -12,8 +12,8 @@ import org.thingsboard.server.common.data.yunteng.constant.FastIotConstants;
 import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.SysDictDTO;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
+import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.SysDictService;
 
@@ -24,7 +24,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RestController
 @RequestMapping("api/yt/dict")
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+@PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
 public class YtDictController extends BaseController {
   private final SysDictService sysDictService;
 
@@ -50,6 +50,7 @@ public class YtDictController extends BaseController {
   }
 
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dict:post'})")
   public ResponseResult<SysDictDTO> saveSysDict(
       @Validated({AddGroup.class}) @RequestBody SysDictDTO sysDictDTO) throws ThingsboardException {
     SysDictDTO newDTO =
@@ -58,6 +59,7 @@ public class YtDictController extends BaseController {
   }
 
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dict:delete'})")
   public ResponseResult<String> deleteSysDict(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return sysDictService.deleteSysDict(deleteDTO.getIds())
@@ -66,6 +68,7 @@ public class YtDictController extends BaseController {
   }
 
   @PutMapping
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dict:update'})")
   public ResponseResult<SysDictDTO> updateSysDict(
       @Validated({UpdateGroup.class}) @RequestBody SysDictDTO SysDictDTO)
       throws ThingsboardException {

@@ -13,8 +13,8 @@ import org.thingsboard.server.common.data.yunteng.constant.FastIotConstants;
 import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.SysDictItemDTO;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
+import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.SysDictItemService;
 
@@ -30,7 +30,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 public class YtDictItemController extends BaseController {
   private final SysDictItemService sysDictItemService;
 
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
   @GetMapping(params = {PAGE_SIZE, PAGE})
   public YtPageData<SysDictItemDTO> pageSysDictItem(
       @RequestParam(PAGE_SIZE) int pageSize,
@@ -55,7 +55,7 @@ public class YtDictItemController extends BaseController {
   }
 
   @PostMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dictItem:post'})")
   public ResponseResult<SysDictItemDTO> saveSysDictItem(
       @Validated({AddGroup.class}) @RequestBody SysDictItemDTO sysDictItemDTO)
       throws ThingsboardException {
@@ -65,7 +65,7 @@ public class YtDictItemController extends BaseController {
   }
 
   @DeleteMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dictItem:delete'})")
   public ResponseResult<String> deleteSysDictItem(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return sysDictItemService.deleteSysDictItem(deleteDTO.getIds())
@@ -74,7 +74,7 @@ public class YtDictItemController extends BaseController {
   }
 
   @PutMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{'api:yt:dictItem:update'})")
   public ResponseResult<SysDictItemDTO> updateSysDictItem(
       @Validated({UpdateGroup.class}) @RequestBody SysDictItemDTO SysDictItemDTO)
       throws ThingsboardException {

@@ -4,6 +4,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.yunteng.dto.SysEnterpriseDTO;
@@ -24,12 +25,14 @@ public class YtEnterpriseController extends BaseController {
   private final SysEnterpriseService sysEnterpriseService;
 
   @GetMapping("get")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:enterprise:get:get'})")
   @ApiOperation("查询详情")
   public ResponseEntity<SysEnterpriseDTO> get() throws ThingsboardException {
     return ResponseEntity.ok(sysEnterpriseService.get(getCurrentUser().getCurrentTenantId()));
   }
 
   @PutMapping("update")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:enterprise:update:update'})")
   @ApiOperation("更新")
   public ResponseEntity<Boolean> update(@RequestBody SysEnterpriseDTO sysEnterpriseDTO)
       throws ThingsboardException {

@@ -13,7 +13,7 @@ import org.thingsboard.server.dao.yunteng.service.YtFrpInfoService;
 @RequestMapping("api/yt/frp")
 @Api(tags = "Frp内网穿透信息")
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtFrpInfoController {
 
   private final YtFrpInfoService frpInfoService;

@@ -53,7 +53,7 @@ public class YtMenuController extends BaseController {
   }
 
   @PutMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
   public MenuDTO updateMenu(@RequestBody MenuDTO menuDTO) throws ThingsboardException {
     Assert.notNull(menuDTO.getId(), "menuId cannot be null");
     return menuService.updateMenu(
@@ -61,7 +61,7 @@ public class YtMenuController extends BaseController {
   }
 
   @PostMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
   public ResponseEntity<MenuDTO> saveMenu(@RequestBody MenuDTO menuDTO)
       throws ThingsboardException {
     MenuDTO newMenuDTO =
@@ -81,7 +81,7 @@ public class YtMenuController extends BaseController {
   }
 
   @DeleteMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','PLATFORM_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','PLATFORM_ADMIN'},{})")
   public void deleteMenus(@RequestBody String[] ids) throws ThingsboardException {
     if (ids.length == 0) {
       throw new YtDataValidationException("需要删除的菜单不能为空");

@@ -2,6 +2,7 @@ package org.thingsboard.server.controller.yunteng;
 
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
@@ -12,8 +13,8 @@ import org.thingsboard.server.common.data.yunteng.constant.FastIotConstants;
 import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.MessageConfigDTO;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
+import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.YtMessageConfigService;
 
@@ -54,6 +55,7 @@ public class YtMessageConfigController extends BaseController {
   }
 
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:message:post'})")
   public ResponseResult<MessageConfigDTO> saveMessageConfig(
       @Validated({AddGroup.class}) @RequestBody MessageConfigDTO configDTO)
       throws ThingsboardException {
@@ -63,11 +65,13 @@ public class YtMessageConfigController extends BaseController {
   }
 
   @GetMapping("/{id}")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:message:get'})")
   public ResponseResult<MessageConfigDTO> findMessageConfigById(@PathVariable String id) {
     return ResponseResult.success(messageConfigService.findMessageConfigById(id));
   }
 
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:message:delete'})")
   public ResponseResult<String> deleteMessageConfig(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return messageConfigService.deleteMessageConfig(deleteDTO.getIds())
@@ -76,6 +80,7 @@ public class YtMessageConfigController extends BaseController {
   }
 
   @PutMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:message:update'})")
   public MessageConfigDTO updateMessageConfig(
       @Validated({UpdateGroup.class}) @RequestBody MessageConfigDTO configDTO)
       throws ThingsboardException {

 package org.thingsboard.server.controller.yunteng;
 
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.util.Assert;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
@@ -16,13 +17,15 @@ import org.thingsboard.server.common.data.yunteng.dto.request.SmsReqDTO;
 import org.thingsboard.server.common.data.yunteng.enums.AssetStatusEnum;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
 import org.thingsboard.server.common.data.yunteng.enums.ResponseCodeEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
+import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.YtMailService;
 import org.thingsboard.server.dao.yunteng.service.YtMessageTemplateService;
 import org.thingsboard.server.dao.yunteng.service.YtSmsService;
+
 import java.util.HashMap;
+
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
 
 @RestController
@@ -59,6 +62,7 @@ public class YtMessageTemplateController extends BaseController {
   }
 
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:template:post'})")
   public ResponseResult<MessageTemplateDTO> saveMessageTemplate(
       @Validated({AddGroup.class}) @RequestBody MessageTemplateDTO templateDTO) throws ThingsboardException {
       templateDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -68,6 +72,7 @@ public class YtMessageTemplateController extends BaseController {
   }
 
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:template:delete'})")
   public ResponseResult<String> deleteMessageTemplate(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return messageTemplateService.deleteMessageTemplate(deleteDTO.getIds())
@@ -76,6 +81,7 @@ public class YtMessageTemplateController extends BaseController {
   }
 
   @PutMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:template:update'})")
   public MessageTemplateDTO updateMessageTemplate(
       @Validated({UpdateGroup.class}) @RequestBody MessageTemplateDTO templateDTO) {
     Assert.notNull(templateDTO.getId(), "messageTemplate id cannot be null");

@@ -4,6 +4,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
@@ -64,6 +65,7 @@ public class YtNoticeController extends BaseController {
     }
 
     @GetMapping("{id}")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:notice:get'})")
     @ApiOperation("详情")
     public ResponseEntity<SysNoticeDTO> get(@PathVariable("id") String id)
             throws ThingsboardException {
@@ -71,12 +73,14 @@ public class YtNoticeController extends BaseController {
     }
 
     @DeleteMapping("delete")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:notice:delete:delete'})")
     @ApiOperation("批量删除")
     public void delete(@Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
         sysNoticeService.delete(deleteDTO.getIds(), getCurrentUser().getCurrentTenantId());
     }
 
     @PostMapping("save")
+    @PreAuthorize("@check.checkPermissions({},{'api:yt:notice:post'})")
     @ApiOperation("保存草稿")
     public ResponseEntity<SysNoticeDTO> save(@Validated(AddGroup.class) @RequestBody SysNoticeDTO sysNoticeDTO) throws ThingsboardException {
         sysNoticeDTO.setStatus(FastIotConstants.DraftStatus.DRAFT);

@@ -4,6 +4,7 @@ import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.jetbrains.annotations.NotNull;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.yunteng.dto.SysNoticeUserDTO;

@@ -58,7 +58,7 @@ public class YtOpinionController extends BaseController {
     }
 
     @DeleteMapping
-    @PreAuthorize("hasAnyAuthority('PLATFORM_ADMIN','SYS_ADMIN')")
+    @PreAuthorize("@check.checkPermissions({'PLATFORM_ADMIN','SYS_ADMIN'},{'api:yt:opinion:delete'})")
     @ApiOperation("删除")
     public boolean deleteAlarmProfile(@Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO)
             throws ThingsboardException {
@@ -67,7 +67,6 @@ public class YtOpinionController extends BaseController {
     }
 
     @GetMapping("{entityId}")
-    @PreAuthorize("hasAnyAuthority('PLATFORM_ADMIN','SYS_ADMIN')")
     @ApiOperation("详情")
     public YtOpinionDTO detail(@PathVariable("entityId") String entityId)
             throws ThingsboardException {

 package org.thingsboard.server.controller.yunteng;
+
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
@@ -14,6 +16,7 @@ import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.OrganizationDTO;
 import org.thingsboard.server.controller.BaseController;
 import org.thingsboard.server.dao.yunteng.service.YtOrganizationService;
+
 import java.net.URI;
 import java.util.List;
 import java.util.Optional;
@@ -27,6 +30,7 @@ public class YtOrganizationController extends BaseController {
   private final YtOrganizationService organizationService;
 
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:organization:post'})")
   public ResponseEntity<OrganizationDTO> saveGroup(@RequestBody OrganizationDTO groupDTO)
           throws ThingsboardException {
     //如果当前登录的用户不是超级管理员或者租户管理员
@@ -47,6 +51,7 @@ public class YtOrganizationController extends BaseController {
   }
 
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:organization:delete'})")
   public ResponseEntity<Boolean> deleteOrganizations(
           @Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO) throws ThingsboardException {
     return ResponseEntity.ok(
@@ -65,6 +70,7 @@ public class YtOrganizationController extends BaseController {
   }
 
   @PutMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:organization:update'})")
   public ResponseEntity updateOrganization(@Validated(UpdateGroup.class) @RequestBody OrganizationDTO groupDTO) throws ThingsboardException {
     //如果当前登录的用户不是超级管理员或者租户管理员
     boolean isCustomerOrPlatform = !getCurrentUser().isPtSysadmin() && !getCurrentUser().isPtTenantAdmin();

@@ -4,6 +4,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.yunteng.dto.SysPlatformDesignDTO;
@@ -24,12 +25,14 @@ public class YtPlatformDesignController extends BaseController {
   private final SysPlatformDesignService sysPlatformDesignService;
 
   @GetMapping("get")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:platform:get:get'})")
   @ApiOperation("查询详情")
   public ResponseEntity<SysPlatformDesignDTO> get() throws ThingsboardException {
     return ResponseEntity.ok(sysPlatformDesignService.get(getCurrentUser().getCurrentTenantId()));
   }
 
   @PutMapping("update")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:platform:update:update'})")
   @ApiOperation("更新")
   public ResponseEntity update(@RequestBody SysPlatformDesignDTO sysPlatformDesignDTO)
       throws ThingsboardException {

@@ -33,7 +33,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/report_form/config")
 @Api(tags = "报表配置信息")
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtReportFormConfigController extends BaseController {
 
   private final YtReportFormConfigService reportFormConfigService;
@@ -76,6 +76,7 @@ public class YtReportFormConfigController extends BaseController {
 
   @PostMapping
   @ApiOperation("新增")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:report_form:config:post'})")
   public ResponseResult<ReportFormConfigDTO> saveReportFromConfig(
       @Validated({AddGroup.class}) @RequestBody ReportFormConfigDTO configDTO)
       throws ThingsboardException, SchedulerException {
@@ -87,6 +88,7 @@ public class YtReportFormConfigController extends BaseController {
 
   @PutMapping
   @ApiOperation("编辑")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:report_form:config:update'})")
   public ResponseResult<ReportFormConfigDTO> updateReportFromConfig(
       @Validated({UpdateGroup.class}) @RequestBody ReportFormConfigDTO configDTO)
       throws ThingsboardException, SchedulerException {
@@ -105,6 +107,7 @@ public class YtReportFormConfigController extends BaseController {
 
   @DeleteMapping
   @ApiOperation("删除")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:report_form:config:delete'})")
   public ResponseResult<Boolean> deleteReportFormConfig(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) throws SchedulerException {
     return reportFormConfigService.deleteReportFormConfig(deleteDTO)

@@ -37,7 +37,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/report/generate/record")
 @Api(tags = "报表生成记录")
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtReportGenerateRecordController extends BaseController {
 
   private final YtReportGenerateRecordService reportFormGenerateRecordService;
@@ -80,6 +80,7 @@ public class YtReportGenerateRecordController extends BaseController {
 
   @DeleteMapping
   @ApiOperation("删除")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:report:generate:record:delete'})")
   public ResponseResult<Boolean> deleteReportGenerateRecord(
       @Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO) {
     return reportFormGenerateRecordService.deleteReportGenerateRecord(deleteDTO)

@@ -56,6 +56,7 @@ public class YtRoleController extends BaseController {
   }
 
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:role:delete'})")
   public void deleteRole(@RequestBody String[] ids) throws ThingsboardException {
     roleService.deleteRole(ids,getCurrentUser().getCurrentTenantId());
   }
@@ -73,6 +74,7 @@ public class YtRoleController extends BaseController {
   }
 
   @PostMapping("saveOrUpdateRoleInfoWithMenu")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:role:post','api:yt:role:update'})")
   public RoleDTO saveOrUpdateRoleInfoWithMenu(@RequestBody RoleReqDTO roleReqDTO) throws ThingsboardException {
     return roleService.saveOrUpdateRoleInfoWithMenu(
         roleReqDTO,

@@ -38,13 +38,14 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("/api/yt/sceneLinkage")
 @RequiredArgsConstructor
 @Api(tags = "场景联动")
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtSceneLinkageController extends BaseController {
 
   private final SceneLinkageService sceneLinkageService;
 
   @ApiOperation(value = "新增场景联动")
   @PostMapping
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:sceneLinkage:post'})")
   public ResponseEntity<SceneLinkageDTO> saveSceneLinkage(
       @Validated(AddGroup.class) @RequestBody SceneLinkageDTO sceneLinkageDTO)
       throws ThingsboardException {
@@ -73,6 +74,7 @@ public class YtSceneLinkageController extends BaseController {
 
   @ApiOperation("编辑")
   @PostMapping("/update")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:sceneLinkage:update'})")
   public SceneLinkageDTO updateSceneLinkage(
       @Validated(UpdateGroup.class) @RequestBody SceneLinkageDTO sceneLinkageDTO)
       throws ThingsboardException {
@@ -109,6 +111,7 @@ public class YtSceneLinkageController extends BaseController {
 
   @ApiOperation(value = "删除")
   @DeleteMapping
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:sceneLinkage:delete'})")
   @AutoLog(value = EntityType.SCENE_ACT,actionType = ActionType.DELETED)
   public void delete(@Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO)
       throws ThingsboardException {

@@ -18,14 +18,14 @@ import org.thingsboard.server.controller.BaseController;
 import java.util.List;
 
 import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.*;
-import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.PAGE;
 
 @RestController
 @RequestMapping("/api/yt/tenantProfiles")
 @RequiredArgsConstructor
 public class YtTenantProfilesController extends BaseController {
 
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN'},{})")
   @GetMapping(
       name = "page",
       params = {PAGE_SIZE, PAGE})

@@ -27,8 +27,6 @@ import org.thingsboard.server.common.data.yunteng.common.UpdateGroup;
 import org.thingsboard.server.common.data.yunteng.core.exception.YtDataValidationException;
 import org.thingsboard.server.common.data.yunteng.core.message.ErrorMessage;
 import org.thingsboard.server.common.data.yunteng.core.utils.AccountProperties;
-import org.thingsboard.server.common.data.yunteng.utils.Demo;
-import org.thingsboard.server.common.data.yunteng.utils.ExcelUtil;
 import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.UserDTO;
 import org.thingsboard.server.common.data.yunteng.dto.UserInfoDTO;
@@ -36,8 +34,10 @@ import org.thingsboard.server.common.data.yunteng.dto.request.AccountReqDTO;
 import org.thingsboard.server.common.data.yunteng.dto.request.RoleOrOrganizationReqDTO;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
 import org.thingsboard.server.common.data.yunteng.enums.RoleEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
+import org.thingsboard.server.common.data.yunteng.utils.Demo;
+import org.thingsboard.server.common.data.yunteng.utils.ExcelUtil;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
+import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.dao.user.UserService;
 import org.thingsboard.server.dao.yunteng.service.YtUserService;
 import org.thingsboard.server.service.security.model.SecurityUser;
@@ -70,6 +70,7 @@ public class YtUserController extends AbstractUserAccount {
     this.accountProperties = accountProperties;
   }
   @GetMapping("{userId}")
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{'api:yt:user:get'})")
   public ResponseEntity<UserDTO> getUser(@PathVariable("userId") String userId)
       throws ThingsboardException {
     return ResponseEntity.of(
@@ -127,6 +128,7 @@ public class YtUserController extends AbstractUserAccount {
 
   @PutMapping
   @ApiOperation(value = "修改用户信息")
+  @PreAuthorize("@check.checkPermissions({},{'api:yt:user:update'})")
   public UserDTO updateUser(@Validated(UpdateGroup.class) @RequestBody UserDTO userDTO)
       throws ThingsboardException {
     return userService.updateUser(
@@ -144,7 +146,7 @@ public class YtUserController extends AbstractUserAccount {
   }
 
   @PostMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','TENANT_ADMIN'},{'api:yt:user:post'})")
   @ApiOperation(value = "新增用户")
   public ResponseEntity<UserDTO> addUser(
       @RequestParam(value = "sendEmail", required = false, defaultValue = "false")
@@ -177,7 +179,8 @@ public class YtUserController extends AbstractUserAccount {
             getCurrentUser().getCurrentTenantId()));
   }
 
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
+
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN'},{'api:yt:user:saveTenantAdmin:post'})")
   @PostMapping("saveTenantAdmin")
   public UserDTO saveTenantAdmin(@Validated(AddGroup.class) @RequestBody UserDTO userDTO)
       throws ThingsboardException {
@@ -207,7 +210,7 @@ public class YtUserController extends AbstractUserAccount {
   }
 
   @DeleteMapping
-  @PreAuthorize("hasAnyAuthority('SYS_ADMIN','TENANT_ADMIN')")
+  @PreAuthorize("@check.checkPermissions({'SYS_ADMIN','TENANT_ADMIN'},{'api:yt:user:delete'})")
   public void deleteUser(@Validated({DeleteGroup.class}) @RequestBody DeleteDTO deleteDTO)
       throws ThingsboardException {
     // 如果当前用户是租户管理员，则代表创建的用户为CUSTOMER_USER,则需要调用TB,否则为本平台的管理员不需要调用TB
@@ -274,7 +277,8 @@ public class YtUserController extends AbstractUserAccount {
     return ResponseResult.success(userService.changePassword(user));
   }
 
-  @PreAuthorize("hasAnyAuthority('TENANT_ADMIN')")
+
+  @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN'},{})")
   @ApiOperation(value = "获取租户下对应组织的所有客户")
   @GetMapping("/customers/{organizationId}")
   public ResponseEntity<List<UserDTO>> getMyCustomers(@PathVariable String organizationId)

@@ -12,7 +12,6 @@ import org.thingsboard.server.common.data.yunteng.common.DeleteGroup;
 import org.thingsboard.server.common.data.yunteng.dto.DeleteDTO;
 import org.thingsboard.server.common.data.yunteng.dto.YtVideoDTO;
 import org.thingsboard.server.common.data.yunteng.enums.OrderTypeEnum;
-import org.thingsboard.server.common.data.yunteng.utils.tools.ProtocolType;
 import org.thingsboard.server.common.data.yunteng.utils.tools.ResponseResult;
 import org.thingsboard.server.common.data.yunteng.utils.tools.YtPageData;
 import org.thingsboard.server.controller.BaseController;
@@ -28,7 +27,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/video")
 @Api(tags = {"视频流"})
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtVideoController extends BaseController {
 
     private final YtVideoService videoService;
@@ -56,6 +55,7 @@ public class YtVideoController extends BaseController {
 
     @PostMapping
     @ApiOperation("新增|编辑")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:video:post','api:yt:video:update'})")
     public YtVideoDTO saveOrUpdateAlarmProfile(
             @Validated @RequestBody YtVideoDTO dto) throws ThingsboardException {
         dto.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -64,6 +64,7 @@ public class YtVideoController extends BaseController {
 
     @DeleteMapping
     @ApiOperation("删除")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:video:delete'})")
     public boolean deleteAlarmProfile(@Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -72,6 +73,7 @@ public class YtVideoController extends BaseController {
 
     @GetMapping("{entityId}")
     @ApiOperation("详情")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:video:get'})")
     public YtVideoDTO detail(@PathVariable("entityId") String entityId)
             throws ThingsboardException {
         return videoService.detail(getCurrentUser().getCurrentTenantId(), entityId);

@@ -25,7 +25,7 @@ import static org.thingsboard.server.common.data.yunteng.constant.QueryConstant.
 @RequestMapping("api/yt/video/platform")
 @Api(tags = {"流媒体平台配置"})
 @RequiredArgsConstructor
-@PreAuthorize("hasAnyAuthority('TENANT_ADMIN','CUSTOMER_USER')")
+@PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{})")
 public class YtVideoPlatformController extends BaseController {
 
     private final YtVideoPlatformService videoPlatformService;
@@ -49,6 +49,7 @@ public class YtVideoPlatformController extends BaseController {
 
     @PostMapping
     @ApiOperation("新增|编辑")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:video:platform:post','api:yt:video:platform:update'})")
     public YtVideoPlatformDTO saveOrUpdateVideoPlatform(
             @Validated @RequestBody YtVideoPlatformDTO dto) throws ThingsboardException {
         dto.setTenantId(getCurrentUser().getCurrentTenantId());
@@ -57,6 +58,7 @@ public class YtVideoPlatformController extends BaseController {
 
     @DeleteMapping
     @ApiOperation("删除")
+    @PreAuthorize("@check.checkPermissions({'TENANT_ADMIN','CUSTOMER_USER'},{'api:yt:video:platform:delete'})")
     public boolean deleteVideoPlatform(@Validated(DeleteGroup.class) @RequestBody DeleteDTO deleteDTO)
             throws ThingsboardException {
         deleteDTO.setTenantId(getCurrentUser().getCurrentTenantId());