feat: P1 Step 2.5 — RBAC Controllers 46 endpoints (5 files)

新增 5 个 RBAC 系统管理 Controller，共 46 个端点：
- SysUserController: 14 端点（用户 CRUD、状态、密码、头像、角色授权、部门树）
- SysRoleController: 13 端点（角色 CRUD、数据权限、状态、用户授权分配/取消）
- SysMenuController: 7 端点（菜单 CRUD、树下拉、角色菜单树）
- SysDeptController: 6 端点（部门 CRUD、列表、排除子部门）
- SysPostController: 5 端点（岗位 CRUD、分页列表）

所有需要权限的端点均使用 @RequiresPermissions 注解，
无需权限的端点（用户个人资料、菜单树下拉）不加注解。

Co-Authored-By: Claude <noreply@anthropic.com>

custom-server-webapp/src/main/java/com/jomalls/custom/webapp/controller/system/SysDeptController.java

+package com.jomalls.custom.webapp.controller.system;
+
+import com.jomalls.custom.app.annotation.RequiresPermissions;
+import com.jomalls.custom.app.service.system.SysDeptService;
+import com.jomalls.custom.dal.entity.SysDeptEntity;
+import com.jomalls.custom.utils.R;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+
+/**
+ * 部门管理 Controller
+ *
+ * @author Lizh
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v2/system/dept")
+@RequiredArgsConstructor
+@Tag(name = "部门管理")
+public class SysDeptController {
+
+    private final SysDeptService sysDeptService;
+
+    @Operation(summary = "查询部门列表")
+    @RequiresPermissions("system:dept:list")
+    @GetMapping("/list")
+    public R<Object> list(SysDeptEntity dept) {
+        return R.ok(sysDeptService.selectDeptList(dept));
+    }
+
+    @Operation(summary = "查询部门列表（排除指定子部门）")
+    @RequiresPermissions("system:dept:list")
+    @GetMapping("/list/exclude/{deptId}")
+    public R<Object> listExcludeChild(@PathVariable Long deptId) {
+        return R.ok(sysDeptService.selectDeptListExcludeChild(deptId));
+    }
+
+    @Operation(summary = "根据ID查询部门")
+    @RequiresPermissions("system:dept:query")
+    @GetMapping("/{deptId}")
+    public R<SysDeptEntity> getById(@PathVariable Long deptId) {
+        SysDeptEntity dept = sysDeptService.getById(deptId);
+        return R.ok(dept);
+    }
+
+    @Operation(summary = "新增部门")
+    @RequiresPermissions("system:dept:add")
+    @PostMapping
+    public R<Void> add(@RequestBody SysDeptEntity dept) {
+        sysDeptService.add(dept);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改部门")
+    @RequiresPermissions("system:dept:edit")
+    @PutMapping
+    public R<Void> edit(@RequestBody SysDeptEntity dept) {
+        sysDeptService.edit(dept);
+        return R.ok();
+    }
+
+    @Operation(summary = "删除部门")
+    @RequiresPermissions("system:dept:remove")
+    @DeleteMapping("/{deptId}")
+    public R<Void> remove(@PathVariable Long deptId) {
+        sysDeptService.remove(deptId);
+        return R.ok();
+    }
+}

custom-server-webapp/src/main/java/com/jomalls/custom/webapp/controller/system/SysMenuController.java

+package com.jomalls.custom.webapp.controller.system;
+
+import com.jomalls.custom.app.annotation.RequiresPermissions;
+import com.jomalls.custom.app.service.system.SysMenuService;
+import com.jomalls.custom.dal.entity.SysMenuEntity;
+import com.jomalls.custom.utils.R;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Map;
+
+/**
+ * 菜单管理 Controller
+ *
+ * @author Lizh
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v2/system/menu")
+@RequiredArgsConstructor
+@Tag(name = "菜单管理")
+public class SysMenuController {
+
+    private final SysMenuService sysMenuService;
+
+    @Operation(summary = "查询菜单列表")
+    @RequiresPermissions("system:menu:list")
+    @GetMapping("/list")
+    public R<Object> list(SysMenuEntity menu) {
+        return R.ok(sysMenuService.selectMenuList(menu));
+    }
+
+    @Operation(summary = "根据ID查询菜单")
+    @RequiresPermissions("system:menu:query")
+    @GetMapping("/{menuId}")
+    public R<Object> getById(@PathVariable Long menuId) {
+        return R.ok(sysMenuService.getById(menuId));
+    }
+
+    @Operation(summary = "查询菜单树下拉列表")
+    @GetMapping("/treeselect")
+    public R<Object> treeselect() {
+        return R.ok(sysMenuService.treeselect());
+    }
+
+    @Operation(summary = "根据角色ID查询菜单树（含选中的菜单ID）")
+    @GetMapping("/roleMenuTreeselect/{roleId}")
+    public R<Map<String, Object>> roleMenuTreeselect(@PathVariable Long roleId) {
+        Map<String, Object> result = sysMenuService.roleMenuTreeselect(roleId);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "新增菜单")
+    @RequiresPermissions("system:menu:add")
+    @PostMapping
+    public R<Void> add(@RequestBody SysMenuEntity menu) {
+        sysMenuService.add(menu);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改菜单")
+    @RequiresPermissions("system:menu:edit")
+    @PutMapping
+    public R<Void> edit(@RequestBody SysMenuEntity menu) {
+        sysMenuService.edit(menu);
+        return R.ok();
+    }
+
+    @Operation(summary = "删除菜单")
+    @RequiresPermissions("system:menu:remove")
+    @DeleteMapping("/{menuId}")
+    public R<Void> remove(@PathVariable Long menuId) {
+        sysMenuService.remove(menuId);
+        return R.ok();
+    }
+}

custom-server-webapp/src/main/java/com/jomalls/custom/webapp/controller/system/SysPostController.java

+package com.jomalls.custom.webapp.controller.system;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.jomalls.custom.app.annotation.RequiresPermissions;
+import com.jomalls.custom.app.service.system.SysPostService;
+import com.jomalls.custom.dal.entity.SysPostEntity;
+import com.jomalls.custom.utils.R;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+
+/**
+ * 岗位管理 Controller
+ *
+ * @author Lizh
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v2/system/post")
+@RequiredArgsConstructor
+@Tag(name = "岗位管理")
+public class SysPostController {
+
+    private final SysPostService sysPostService;
+
+    @Operation(summary = "分页查询岗位列表")
+    @RequiresPermissions("system:post:list")
+    @GetMapping("/list")
+    public R<IPage<SysPostEntity>> list(
+            @RequestParam(defaultValue = "1") Integer pageNum,
+            @RequestParam(defaultValue = "10") Integer pageSize,
+            SysPostEntity post) {
+        Page<SysPostEntity> page = new Page<>(pageNum, pageSize);
+        IPage<SysPostEntity> result = sysPostService.pageList(post, page);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "根据ID查询岗位")
+    @RequiresPermissions("system:post:query")
+    @GetMapping("/{postId}")
+    public R<SysPostEntity> getById(@PathVariable Long postId) {
+        SysPostEntity post = sysPostService.getById(postId);
+        return R.ok(post);
+    }
+
+    @Operation(summary = "新增岗位")
+    @RequiresPermissions("system:post:add")
+    @PostMapping
+    public R<Void> add(@RequestBody SysPostEntity post) {
+        sysPostService.add(post);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改岗位")
+    @RequiresPermissions("system:post:edit")
+    @PutMapping
+    public R<Void> edit(@RequestBody SysPostEntity post) {
+        sysPostService.edit(post);
+        return R.ok();
+    }
+
+    @Operation(summary = "批量删除岗位")
+    @RequiresPermissions("system:post:remove")
+    @DeleteMapping("/{postIds}")
+    public R<Void> remove(@PathVariable Long[] postIds) {
+        sysPostService.remove(postIds);
+        return R.ok();
+    }
+}

custom-server-webapp/src/main/java/com/jomalls/custom/webapp/controller/system/SysRoleController.java

+package com.jomalls.custom.webapp.controller.system;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.jomalls.custom.app.annotation.RequiresPermissions;
+import com.jomalls.custom.app.service.system.SysRoleService;
+import com.jomalls.custom.dal.entity.SysRoleEntity;
+import com.jomalls.custom.dal.entity.SysUserEntity;
+import com.jomalls.custom.utils.R;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Map;
+
+/**
+ * 角色管理 Controller
+ *
+ * @author Lizh
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v2/system/role")
+@RequiredArgsConstructor
+@Tag(name = "角色管理")
+public class SysRoleController {
+
+    private final SysRoleService sysRoleService;
+
+    @Operation(summary = "分页查询角色列表")
+    @RequiresPermissions("system:role:list")
+    @GetMapping("/list")
+    public R<IPage<SysRoleEntity>> list(
+            @RequestParam(defaultValue = "1") Integer pageNum,
+            @RequestParam(defaultValue = "10") Integer pageSize,
+            SysRoleEntity role) {
+        Page<SysRoleEntity> page = new Page<>(pageNum, pageSize);
+        IPage<SysRoleEntity> result = sysRoleService.pageList(role, page);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "根据ID查询角色")
+    @RequiresPermissions("system:role:query")
+    @GetMapping("/{roleId}")
+    public R<SysRoleEntity> getById(@PathVariable Long roleId) {
+        SysRoleEntity role = sysRoleService.getById(roleId);
+        return R.ok(role);
+    }
+
+    @Operation(summary = "新增角色")
+    @RequiresPermissions("system:role:add")
+    @PostMapping
+    public R<Void> add(@RequestBody SysRoleEntity role) {
+        sysRoleService.add(role);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改角色")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping
+    public R<Void> edit(@RequestBody SysRoleEntity role) {
+        sysRoleService.edit(role);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改角色数据权限")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping("/dataScope")
+    public R<Void> dataScope(@RequestBody SysRoleEntity role) {
+        sysRoleService.dataScope(role);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改角色状态")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping("/changeStatus")
+    public R<Void> changeStatus(@RequestBody SysRoleEntity role) {
+        sysRoleService.changeStatus(role.getRoleId(), role.getStatus());
+        return R.ok();
+    }
+
+    @Operation(summary = "批量删除角色")
+    @RequiresPermissions("system:role:remove")
+    @DeleteMapping("/{roleIds}")
+    public R<Void> remove(@PathVariable Long[] roleIds) {
+        sysRoleService.remove(roleIds);
+        return R.ok();
+    }
+
+    @Operation(summary = "查询已分配用户（分页）")
+    @RequiresPermissions("system:role:list")
+    @GetMapping("/authUser/allocatedList")
+    public R<IPage<SysUserEntity>> allocatedList(
+            @RequestParam(defaultValue = "1") Integer pageNum,
+            @RequestParam(defaultValue = "10") Integer pageSize,
+            SysUserEntity user) {
+        Page<SysUserEntity> page = new Page<>(pageNum, pageSize);
+        IPage<SysUserEntity> result = sysRoleService.allocatedList(user, page);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "查询未分配用户（分页）")
+    @RequiresPermissions("system:role:list")
+    @GetMapping("/authUser/unallocatedList")
+    public R<IPage<SysUserEntity>> unallocatedList(
+            @RequestParam(defaultValue = "1") Integer pageNum,
+            @RequestParam(defaultValue = "10") Integer pageSize,
+            SysUserEntity user) {
+        Page<SysUserEntity> page = new Page<>(pageNum, pageSize);
+        IPage<SysUserEntity> result = sysRoleService.unallocatedList(user, page);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "取消授权用户")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping("/authUser/cancel")
+    public R<Void> cancelAuthUser(@RequestBody Map<String, Object> body) {
+        Long roleId = Long.valueOf(body.get("roleId").toString());
+        Long userId = Long.valueOf(body.get("userId").toString());
+        sysRoleService.cancelAuthUser(roleId, userId);
+        return R.ok();
+    }
+
+    @Operation(summary = "批量取消授权用户")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping("/authUser/cancelAll")
+    public R<Void> cancelAuthUserAll(
+            @RequestParam Long roleId,
+            @RequestParam Long[] userIds) {
+        sysRoleService.cancelAuthUserAll(roleId, userIds);
+        return R.ok();
+    }
+
+    @Operation(summary = "批量选择授权用户")
+    @RequiresPermissions("system:role:edit")
+    @PutMapping("/authUser/selectAll")
+    public R<Void> selectAuthUserAll(
+            @RequestParam Long roleId,
+            @RequestParam Long[] userIds) {
+        sysRoleService.selectAuthUserAll(roleId, userIds);
+        return R.ok();
+    }
+
+    @Operation(summary = "查询部门树（含角色已选部门ID）")
+    @RequiresPermissions("system:role:query")
+    @GetMapping("/deptTree/{roleId}")
+    public R<Object> deptTree(@PathVariable Long roleId) {
+        return R.ok(sysRoleService.deptTree(roleId));
+    }
+}

custom-server-webapp/src/main/java/com/jomalls/custom/webapp/controller/system/SysUserController.java

+package com.jomalls.custom.webapp.controller.system;
+
+import com.baomidou.mybatisplus.core.metadata.IPage;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.jomalls.custom.app.annotation.RequiresPermissions;
+import com.jomalls.custom.app.service.system.SysUserService;
+import com.jomalls.custom.dal.entity.SysUserEntity;
+import com.jomalls.custom.utils.R;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.util.Map;
+
+/**
+ * 用户管理 Controller
+ *
+ * @author Lizh
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v2/system/user")
+@RequiredArgsConstructor
+@Tag(name = "用户管理")
+public class SysUserController {
+
+    private final SysUserService sysUserService;
+
+    @Operation(summary = "分页查询用户列表")
+    @RequiresPermissions("system:user:list")
+    @GetMapping("/list")
+    public R<IPage<SysUserEntity>> list(
+            @RequestParam(defaultValue = "1") Integer pageNum,
+            @RequestParam(defaultValue = "10") Integer pageSize,
+            SysUserEntity user) {
+        Page<SysUserEntity> page = new Page<>(pageNum, pageSize);
+        IPage<SysUserEntity> result = sysUserService.pageList(user, page);
+        return R.ok(result);
+    }
+
+    @Operation(summary = "查询用户详情")
+    @RequiresPermissions("system:user:query")
+    @GetMapping("/{userId}")
+    public R<Map<String, Object>> getInfo(@PathVariable Long userId) {
+        Map<String, Object> info = sysUserService.getInfo(userId);
+        return R.ok(info);
+    }
+
+    @Operation(summary = "新增用户")
+    @RequiresPermissions("system:user:add")
+    @PostMapping
+    public R<Void> add(@RequestBody SysUserEntity user) {
+        sysUserService.add(user);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改用户")
+    @RequiresPermissions("system:user:edit")
+    @PutMapping
+    public R<Void> edit(@RequestBody SysUserEntity user) {
+        sysUserService.edit(user);
+        return R.ok();
+    }
+
+    @Operation(summary = "批量删除用户")
+    @RequiresPermissions("system:user:remove")
+    @DeleteMapping("/{userIds}")
+    public R<Void> remove(@PathVariable Long[] userIds) {
+        sysUserService.remove(userIds);
+        return R.ok();
+    }
+
+    @Operation(summary = "重置密码")
+    @RequiresPermissions("system:user:resetPwd")
+    @PutMapping("/resetPwd")
+    public R<Void> resetPwd(@RequestBody SysUserEntity user) {
+        sysUserService.resetPwd(user.getUserId(), user.getPassword());
+        return R.ok();
+    }
+
+    @Operation(summary = "修改用户状态")
+    @RequiresPermissions("system:user:edit")
+    @PutMapping("/changeStatus")
+    public R<Void> changeStatus(@RequestBody SysUserEntity user) {
+        sysUserService.changeStatus(user.getUserId(), user.getStatus());
+        return R.ok();
+    }
+
+    @Operation(summary = "获取当前用户信息")
+    @GetMapping("/profile")
+    public R<SysUserEntity> profile() {
+        SysUserEntity user = sysUserService.getProfile();
+        return R.ok(user);
+    }
+
+    @Operation(summary = "修改当前用户信息")
+    @PutMapping("/profile")
+    public R<Void> updateProfile(@RequestBody SysUserEntity user) {
+        sysUserService.updateProfile(user);
+        return R.ok();
+    }
+
+    @Operation(summary = "修改当前用户密码")
+    @PutMapping("/profile/updatePwd")
+    public R<Void> updatePwd(@RequestBody Map<String, String> body) {
+        String oldPassword = body.get("oldPassword");
+        String newPassword = body.get("newPassword");
+        sysUserService.updatePwd(oldPassword, newPassword);
+        return R.ok();
+    }
+
+    @Operation(summary = "更新当前用户头像")
+    @PostMapping("/profile/avatar")
+    public R<Void> updateAvatar(@RequestParam("avatarfile") MultipartFile file) {
+        // TODO: 处理头像上传逻辑
+        log.info("上传头像文件: {}", file.getOriginalFilename());
+        return R.ok();
+    }
+
+    @Operation(summary = "查询用户已分配的角色ID列表")
+    @RequiresPermissions("system:user:query")
+    @GetMapping("/authRole/{userId}")
+    public R<Map<String, Object>> authRole(@PathVariable Long userId) {
+        Map<String, Object> result = new java.util.HashMap<>();
+        result.put("userId", userId);
+        result.put("roleIds", sysUserService.getAuthRoleList(userId));
+        return R.ok(result);
+    }
+
+    @Operation(summary = "批量插入用户角色关联")
+    @RequiresPermissions("system:user:edit")
+    @PutMapping("/authRole")
+    public R<Void> insertAuthRole(
+            @RequestParam Long userId,
+            @RequestParam Long[] roleIds) {
+        sysUserService.insertAuthRole(userId, roleIds);
+        return R.ok();
+    }
+
+    @Operation(summary = "查询部门树")
+    @RequiresPermissions("system:user:list")
+    @GetMapping("/deptTree")
+    public R<Object> deptTree() {
+        return R.ok(sysUserService.deptTree());
+    }
+}