admin/prop-ai-hr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(aihr): restrict interview record access

Browse Source
This commit is contained in:
admin
2026-07-14 08:46:53 +08:00
parent 6e34ddcd61
commit 13e5545ca4
3 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
+7
View File
@@ -3,6 +3,7 @@ package org.dromara.aihr.controller;
import cn.dev33.satoken.annotation.SaCheckLogin;
import cn.dev33.satoken.annotation.SaCheckRole;
import cn.dev33.satoken.annotation.SaMode;
import cn.dev33.satoken.stp.StpUtil;
import lombok.RequiredArgsConstructor;
import org.dromara.aihr.domain.AihrInterviewDto.AnswerRequest;
import org.dromara.aihr.domain.AihrInterviewDto.AnswerResponse;
@@ -59,6 +60,12 @@ public class AihrInterviewController {
@GetMapping("/records")
public R<List<RecordResponse>> records(@RequestParam(value = "limit", required = false, defaultValue = "20") int limit,
@RequestParam(value = "candidateId", required = false) String candidateId) {
LoginUser loginUser = LoginHelper.getLoginUser();
if (loginUser != null
&& UserType.SYS_USER.getUserType().equals(loginUser.getUserType())
&& !StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE)) {
return R.fail("无权查看面试记录");
}
String appUsername = currentAppUsername();
return R.ok(interviewService.records(limit, appUsername.isBlank() ? candidateId : appUsername));
}
backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrInterviewServiceTest.java
+17
View File
@@ -9,9 +9,13 @@ import org.junit.jupiter.api.Test;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import java.nio.file.Files;
import java.nio.file.Path;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.doReturn;
@@ -103,4 +107,17 @@ class AihrInterviewServiceTest {
verify(jdbcTemplate).query(anyString(), org.mockito.ArgumentMatchers.<RowMapper<RecordResponse>>any(), eq("000000"));
}
@Test
@Tag("dev")
void interviewRecordsRequireHrRoleForSystemUsers() throws Exception {
Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrInterviewController.java");
if (!Files.exists(source)) {
source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java");
}
String controllerSource = Files.readString(source);
assertTrue(controllerSource.contains("StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE)"));
assertTrue(controllerSource.contains("return R.fail(\"无权查看面试记录\")"));
}
}
scripts/demo-check.sh
+1
View File
@@ -376,6 +376,7 @@ contains frontend/src/router/index.ts "/system/prompts"
contains frontend/src/api/aihr/interview.ts "/api/recruit/interview/start"
contains frontend/src/api/aihr/interview.ts "/api/recruit/interview/candidate-links"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "/api/recruit/interview"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "无权查看面试记录"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "@SaCheckRole"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrInterviewService.java "aihr_candidate_employee_link"
contains frontend/src/api/aihr/practice.ts "/api/train/practice/start"