fix: 修改菜单权限控制，菜单只允许超级管理员控制，在修改用户信息时，先删除用户与角色的关系，再添加新的关系

@@ -59,7 +59,7 @@ public class YtMenuController extends BaseController {
   }
 
   @PostMapping
-  @PreAuthorize("hasAnyRole('SYS_ADMIN','TENANT_ADMIN')")
+  @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
   public ResponseEntity<MenuDTO> saveMenu(@RequestBody MenuDTO menuDTO)
       throws ThingsboardException {
     MenuDTO newMenuDTO =
@@ -79,7 +79,7 @@ public class YtMenuController extends BaseController {
   }
 
   @DeleteMapping
-  @PreAuthorize("hasAnyRole('SYS_ADMIN','TENANT_ADMIN')")
+  @PreAuthorize("hasAnyAuthority('SYS_ADMIN')")
   public void deleteMenus(@RequestBody String[] ids) throws ThingsboardException {
     if (ids.length == 0) {
       throw new YtDataValidationException("please provide menu ids to delete");

 package org.thingsboard.server.common.data.yunteng.dto;
+
 import com.fasterxml.jackson.annotation.JsonFormat;
 import com.fasterxml.jackson.databind.JsonNode;
 import lombok.Data;
@@ -29,10 +30,13 @@ public class SmsLogDTO extends BaseDTO {
   /** 租户Code */
   private String tenantId;
 
-  /**用途*/
+  /** 用途 */
   @AutoDict(dictCode = "template_purpose")
   private String templatePurpose;
 
-  /**备注*/
+  /** 备注 */
   private String remark;
+
+  /** 消息模板ID */
+  private String messageTemplateId;
 }

@@ -136,16 +136,6 @@ public class MenuServiceImpl extends AbstractBaseService<MenuMapper, Menu> imple
   @Transactional
   public boolean deleteMenus(String tenantId,String[] menuIds) {
     Set<String> ids = Set.of(menuIds);
-    // 1. 判断是否所有的id都属于此人，admin也不可删除租户的menu
-    int notTenantMenuCount =
-        baseMapper.selectCount(
-            new QueryWrapper<Menu>()
-                .lambda()
-                .ne(Menu::getTenantId, tenantId)
-                .in(Menu::getId, ids));
-    if (notTenantMenuCount > 0) {
-      throw new AccessDeniedException("cannot delete menu that not create by you");
-    }
     // 2. 删除角色对应的menu
     roleMapper.deleteRoleMenuMappingByMenuIds(ids);
     // 3. 删除租户对应menu

@@ -263,6 +263,7 @@ public class YtUserServiceImpl extends AbstractBaseService<UserMapper, User>
       user.setPassword(passwordEncoder.encode(userDTO.getPassword()));
     }
     baseMapper.updateById(user);
+    deleteAndAddUserRole(user.getId(), Arrays.asList(userDTO.getRoleIds()));
     user.copyToDTO(userDTO, PASSWORD, ACTIVATE_TOKEN);
     return userDTO;
   }
@@ -516,4 +517,22 @@ public class YtUserServiceImpl extends AbstractBaseService<UserMapper, User>
     userDTO.setUsername(userName);
     return baseMapper.findUserInfo(userDTO);
   }
+
+  /**
+   * 先删除用户与角色的关系，再添加新的关系
+   * @param userId 用户ID
+   * @param roleIds 角色ID
+   */
+  private void deleteAndAddUserRole(String userId,List<String> roleIds){
+    if(StringUtils.isAllEmpty(userId) || null == roleIds || roleIds.size()<1){
+      throw new YtDataValidationException(ErrorMessage.INVALID_PARAMETER.getMessage());
+    }
+    //先删除用户与角色的关系,再添加用户与角色的关系
+    List<String> userIds = new ArrayList<>();
+    userIds.add(userId);
+    roleMapper.deleteRoleUserMappingByUserIds(userIds);
+    roleIds.forEach(role ->{
+      roleMapper.saveUserRoleMapping(userId,role);
+    });
+  }
 }

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 
-<mapper namespace="com.codeez.mapper.SmsLogMapper">
+<mapper namespace="org.thingsboard.server.dao.yunteng.mapper.SmsLogMapper">
     <resultMap id="smsLogDTOMap" type="org.thingsboard.server.common.data.yunteng.dto.SmsLogDTO" >
         <result property="id" column="id"/>
         <result property="type" column="type"/>