From 03d9c93ea4a82651cad84e8a391f21a0afb4b8eb Mon Sep 17 00:00:00 2001
From: let5sne <let5sne@gmail.com>
Date: Thu, 9 Jul 2026 13:13:40 +0800
Subject: [PATCH] fix(aihr): require candidate identity for materials

---
 .../service/AihrCandidateMaterialService.java | 15 +++++++++++++--
 .../AihrCandidateMaterialServiceTest.java     | 19 +++++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCandidateMaterialServiceTest.java

diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java
index a9cb2d7f..1636d045 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java
@@ -1,6 +1,7 @@
 package org.dromara.aihr.service;
 
 import lombok.RequiredArgsConstructor;
+import org.dromara.common.core.exception.ServiceException;
 import org.dromara.system.domain.vo.SysOssVo;
 import org.dromara.system.service.ISysOssService;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -36,6 +37,7 @@ public class AihrCandidateMaterialService {
         if (file.getSize() > MAX_SIZE) {
             throw new IllegalArgumentException("资料不能超过20MB");
         }
+        String boundCandidateId = requireCandidateId(candidateId);
         String fileName = clean(file.getOriginalFilename(), "candidate-material");
         String type = clean(materialType, materialType(fileName));
         SysOssVo oss = ossService.upload(file);
@@ -47,7 +49,7 @@ public class AihrCandidateMaterialService {
                 values (?, ?, ?, ?, ?, ?, ?, ?, ?, now(), now())
                 """, Statement.RETURN_GENERATED_KEYS);
             ps.setString(1, TENANT_ID);
-            ps.setString(2, clean(candidateId, "mobile-candidate"));
+            ps.setString(2, boundCandidateId);
             ps.setString(3, clean(candidateName, "候选人"));
             ps.setString(4, type);
             ps.setString(5, fileName);
@@ -63,6 +65,7 @@ public class AihrCandidateMaterialService {
 
     public List<MaterialResponse> list(String candidateId) {
         ensureTable();
+        String boundCandidateId = requireCandidateId(candidateId);
         return jdbcTemplate.query("""
             select id, oss_id, file_name, material_type, file_size, status, create_time
               from aihr_candidate_material
@@ -77,7 +80,7 @@ public class AihrCandidateMaterialService {
             rs.getLong("file_size"),
             rs.getString("status"),
             rs.getTimestamp("create_time").toLocalDateTime().format(TIME_FORMAT)
-        ), TENANT_ID, clean(candidateId, "mobile-candidate"));
+        ), TENANT_ID, boundCandidateId);
     }
 
     public List<MaterialReviewResponse> reviewList(String status) {
@@ -188,6 +191,14 @@ public class AihrCandidateMaterialService {
         return text.isEmpty() ? fallback : text;
     }
 
+    static String requireCandidateId(String candidateId) {
+        String text = clean(candidateId, "");
+        if (text.isEmpty()) {
+            throw new ServiceException("候选人身份缺失，请重新登录");
+        }
+        return text;
+    }
+
     private static String normalizeReviewStatus(String status) {
         String text = clean(status, "待审核");
         if ("已通过".equals(text) || "已驳回".equals(text) || "待审核".equals(text)) {
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCandidateMaterialServiceTest.java b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCandidateMaterialServiceTest.java
new file mode 100644
index 00000000..5d884c92
--- /dev/null
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCandidateMaterialServiceTest.java
@@ -0,0 +1,19 @@
+package org.dromara.aihr.service;
+
+import org.dromara.common.core.exception.ServiceException;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class AihrCandidateMaterialServiceTest {
+
+    @Test
+    @Tag("dev")
+    void candidateIdMustComeFromLoginOrExplicitParameter() {
+        assertEquals("13900000001", AihrCandidateMaterialService.requireCandidateId(" 13900000001 "));
+        assertThrows(ServiceException.class, () -> AihrCandidateMaterialService.requireCandidateId(""));
+        assertThrows(ServiceException.class, () -> AihrCandidateMaterialService.requireCandidateId(null));
+    }
+}