Repository: answerdev/answer
File: internal/service/siteinfo/siteinfo_service.go (Go)

Code before:
		options = append(options, op)
	}
	return
}

func (s *SiteInfoService) UpdatePrivilegesConfig(ctx context.Context, req *schema.UpdatePrivilegesConfigReq) (err error) {
	var chooseOption *schema.PrivilegeOption
	if req.Level == schema.PrivilegeLevelCustom {
		chooseOption = req.Custom
	} else {
		chooseOption = schema.DefaultPrivilegeOptions.Choose(req.Level)
	}
	if chooseOption == nil {
		return nil
	}

	// update site info that user choose which privilege level
	if req.Level == schema.PrivilegeLevelCustom {
		req.Custom.LevelDesc = "privilege.level_custom.description"
		privilegeMap := map[string]string{}
		for _, privilege := range constant.RankAllPrivileges {
			privilegeMap[privilege.Key] = privilege.Label
		}
		for _, privilege := range req.Custom.Privileges {
			privilege.Label = privilegeMap[privilege.Key]
		}
	} else {
		privilege := &schema.UpdatePrivilegesConfigReq{}
		if err = s.siteInfoCommonService.GetSiteInfoByType(ctx, constant.SiteTypePrivileges, privilege); err != nil {
			return nil
		}
		req.Custom = privilege.Custom
	}

	content, _ := json.Marshal(req)
	data := &entity.SiteInfo{
		Type:    constant.SiteTypePrivileges,
		Content: string(content),
		Status:  1,
	}
	err = s.siteInfoRepo.SaveByType(ctx, constant.SiteTypePrivileges, data)
	if err != nil {
		return err
	}

	// update privilege in config
	for _, privilege := range chooseOption.Privileges {
		err = s.configService.UpdateConfig(ctx, privilege.Key, fmt.Sprintf("%d", privilege.Value))
		if err != nil {
			return err
		}

Review comment (security):
I think it would be better to use `constant.RankAllPrivileges` as a standard to loop. The first reason is that the requested value may not be accurate, and if there is a problem with the requested value, the value of the corresponding key may not be saved, leading to accidents. Another reason is that if new permissions are added in the future, looping on the requested value may result in the new value not being displayed.

FYI: 
```go
		privilegeMap := make(map[string]int)
		for _, privilege := range req.Custom.Privileges {
			privilegeMap[privilege.Key] = privilege.Value
		}
		var privileges []*constant.Privilege
		for _, privilege := range constant.RankAllPrivileges {
			privileges = append(privileges, &constant.Privilege{
				Key:   privilege.Key,
				Label: privilege.Label,
				Value: privilegeMap[privilege.Key],
			})
		}
		req.CustomPrivileges = privileges
```

Code after:
				Label: translator.Tr(la, privilege.Label),
				Value: privilege.Value,
			})
		}
		options = append(options, op)
	}
	return
}

func (s *SiteInfoService) UpdatePrivilegesConfig(ctx context.Context, req *schema.UpdatePrivilegesConfigReq) (err error) {
	var choosePrivileges []*constant.Privilege
	if req.Level == schema.PrivilegeLevelCustom {
		choosePrivileges = req.CustomPrivileges
	} else {
		chooseOption := schema.DefaultPrivilegeOptions.Choose(req.Level)
		if chooseOption == nil {
			return nil
		}
		choosePrivileges = chooseOption.Privileges
	}
	if choosePrivileges == nil {
		return nil
	}

	// update site info that user choose which privilege level
	if req.Level == schema.PrivilegeLevelCustom {
		privilegeMap := make(map[string]int)
		for _, privilege := range req.CustomPrivileges {
			privilegeMap[privilege.Key] = privilege.Value
		}
		var privileges []*constant.Privilege
		for _, privilege := range constant.RankAllPrivileges {
			privileges = append(privileges, &constant.Privilege{
				Key:   privilege.Key,
				Label: privilege.Label,
				Value: privilegeMap[privilege.Key],
			})
		}
		req.CustomPrivileges = privileges
	} else {
		privilege := &schema.UpdatePrivilegesConfigReq{}
		if err = s.siteInfoCommonService.GetSiteInfoByType(ctx, constant.SiteTypePrivileges, privilege); err != nil {
			return err
		}
		req.CustomPrivileges = privilege.CustomPrivileges
	}

	content, _ := json.Marshal(req)
	data := &entity.SiteInfo{
		Type:    constant.SiteTypePrivileges,
		Content: string(content),