v2.0.3

jpress-core/src/main/java/io/jpress/core/addon/controller/AddonControllerManager.java

@@ -69,6 +69,11 @@ public class AddonControllerManager {
         controllerAddonMapping.put(c, addonId);
     }
 
+    public static List<String> getAllActionKeys() {
+        return actionMapping.getAllActionKeys();
+    }
+
+
     public static void deleteController(Class<? extends Controller> c) {
         RequestMapping mapping = c.getAnnotation(RequestMapping.class);
         if (mapping == null) return;

jpress-web/src/main/java/io/jpress/web/admin/_PermissionController.java

@@ -21,6 +21,7 @@ import com.jfinal.core.JFinal;
 import com.jfinal.kit.Ret;
 import io.jboot.web.controller.annotation.RequestMapping;
 import io.jpress.JPressConsts;
+import io.jpress.core.addon.controller.AddonControllerManager;
 import io.jpress.core.annotation.AdminPermission;
 import io.jpress.core.menu.MenuGroup;
 import io.jpress.core.menu.MenuItem;
@@ -140,14 +141,23 @@ public class _PermissionController extends AdminControllerBase {
      */
     private static List<Permission> buildActionPermissions() {
         List<Permission> permissions = new ArrayList<>();
-        List<String> allActionKeys = JFinal.me().getAllActionKeys();
+
+        List<String> allActionKeys = AddonControllerManager.getAllActionKeys();
+        allActionKeys.addAll(JFinal.me().getAllActionKeys());
 
         String[] urlPara = new String[1];
+
         for (String actionKey : allActionKeys) {
             // 只处理后台的权限 和 API的权限
             if (actionKey.startsWith("/admin") || actionKey.startsWith("/api")) {
 
                 Action action = JFinal.me().getAction(actionKey, urlPara);
+
+                //去获取 插件的 Action
+                if (action == null){
+                    action = AddonControllerManager.getAction(actionKey,urlPara);
+                }
+
                 if (action == null || excludedMethodName.contains(action.getMethodName())) {
                     continue;
                 }