From 13e5545ca43cd141cbecc9f0c12e3d7cb8686c4d Mon Sep 17 00:00:00 2001
From: let5sne <let5sne@gmail.com>
Date: Tue, 14 Jul 2026 08:46:53 +0800
Subject: [PATCH] fix(aihr): restrict interview record access

---
 .../controller/AihrInterviewController.java     |  7 +++++++
 .../aihr/service/AihrInterviewServiceTest.java  | 17 +++++++++++++++++
 scripts/demo-check.sh                           |  1 +
 3 files changed, 25 insertions(+)

diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
index 7ed3d5bb..e29934c6 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java
@@ -3,6 +3,7 @@ package org.dromara.aihr.controller;
 import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
+import cn.dev33.satoken.stp.StpUtil;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerRequest;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerResponse;
@@ -59,6 +60,12 @@ public class AihrInterviewController {
     @GetMapping("/records")
     public R<List<RecordResponse>> records(@RequestParam(value = "limit", required = false, defaultValue = "20") int limit,
                                            @RequestParam(value = "candidateId", required = false) String candidateId) {
+        LoginUser loginUser = LoginHelper.getLoginUser();
+        if (loginUser != null
+            && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())
+            && !StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE)) {
+            return R.fail("无权查看面试记录");
+        }
         String appUsername = currentAppUsername();
         return R.ok(interviewService.records(limit, appUsername.isBlank() ? candidateId : appUsername));
     }
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrInterviewServiceTest.java b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrInterviewServiceTest.java
index ab54c639..69841023 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrInterviewServiceTest.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrInterviewServiceTest.java
@@ -9,9 +9,13 @@ import org.junit.jupiter.api.Test;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.RowMapper;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
+
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doReturn;
@@ -103,4 +107,17 @@ class AihrInterviewServiceTest {
 
         verify(jdbcTemplate).query(anyString(), org.mockito.ArgumentMatchers.<RowMapper<RecordResponse>>any(), eq("000000"));
     }
+
+    @Test
+    @Tag("dev")
+    void interviewRecordsRequireHrRoleForSystemUsers() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrInterviewController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java");
+        }
+        String controllerSource = Files.readString(source);
+
+        assertTrue(controllerSource.contains("StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE)"));
+        assertTrue(controllerSource.contains("return R.fail(\"无权查看面试记录\")"));
+    }
 }
diff --git a/scripts/demo-check.sh b/scripts/demo-check.sh
index 7f4917aa..7b165d34 100755
--- a/scripts/demo-check.sh
+++ b/scripts/demo-check.sh
@@ -376,6 +376,7 @@ contains frontend/src/router/index.ts "/system/prompts"
 contains frontend/src/api/aihr/interview.ts "/api/recruit/interview/start"
 contains frontend/src/api/aihr/interview.ts "/api/recruit/interview/candidate-links"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "/api/recruit/interview"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "无权查看面试记录"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "@SaCheckRole"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrInterviewService.java "aihr_candidate_employee_link"
 contains frontend/src/api/aihr/practice.ts "/api/train/practice/start"