code: public String save() {
      Role role = entityDao.get(Role.class, getInt("role.id"));
      MenuProfile menuProfile = (MenuProfile) entityDao.get(MenuProfile.class, getInt("menuProfileId"));
      Set<FuncResource> newResources = CollectUtils
          .newHashSet(entityDao.get(FuncResource.class, Strings.splitToInt(get("resourceId"))));
  
      // 管理员拥有的菜单权限和系统资源
      User manager = userService.get(SecurityUtils.getUsername());
      Set<Menu> mngMenus = null;
      Set<Resource> mngResources = CollectUtils.newHashSet();
      if (isAdmin()) {
        mngMenus = CollectUtils.newHashSet(menuProfile.getMenus());
      } else {
        mngMenus = CollectUtils
            .newHashSet(securityHelper.getMenuService().getMenus(menuProfile, manager, manager.getProfiles()));
      }
      for (final Menu m : mngMenus) {
        mngResources.addAll(m.getResources());
      }
      newResources.retainAll(mngResources);
      securityHelper.getFuncPermissionService().authorize(role, newResources);
      authorityManager.refreshRolePermissions(new GrantedAuthorityBean(role.getId()));
  
      Action redirect = Action.to(this).method("edit");
      redirect.param("role.id", role.getId()).param("menuProfileId", menuProfile.getId());
      String displayFreezen = get("displayFreezen");
      if (null != displayFreezen) redirect.param("displayFreezen", displayFreezen);
  
      return redirect(redirect, "info.save.success");
    }
docs: 保存模块级权限