From 19c59a07ab0e5ecc68619de52d36975be45512ea Mon Sep 17 00:00:00 2001 From: let5sne Date: Tue, 14 Jul 2026 10:49:35 +0800 Subject: [PATCH] fix(aihr): record authenticated sop reviewer --- .../dromara/aihr/controller/AihrSopController.java | 6 +++++- .../dromara/aihr/service/AihrSopSeedService.java | 6 +++++- .../aihr/service/AihrSopSeedServiceTest.java | 13 +++++++++++++ docs/BRD_IMPLEMENTATION_AUDIT.md | 1 + scripts/demo-check.sh | 1 + 5 files changed, 25 insertions(+), 2 deletions(-) diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java index 360121da..7b6dc1aa 100644 --- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java +++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java @@ -29,6 +29,8 @@ import org.dromara.aihr.service.AihrSopSeedService; import org.dromara.aihr.service.AihrUploadQueueService; import org.dromara.common.core.constant.TenantConstants; import org.dromara.common.core.domain.R; +import org.dromara.common.core.domain.model.LoginUser; +import org.dromara.common.satoken.utils.LoginHelper; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.PostMapping; @@ -111,7 +113,9 @@ public class AihrSopController { @SaCheckRole(value = {TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE}, mode = SaMode.OR) @PostMapping("/reviews/{id}") public R review(@PathVariable Long id, @RequestBody(required = false) SopReviewRequest request) { - SopReviewResponse response = sopSeedService.reviewSearch(id, request); + LoginUser loginUser = LoginHelper.getLoginUser(); + String operator = loginUser == null ? "unknown" : loginUser.getUsername(); + SopReviewResponse response = sopSeedService.reviewSearch(id, request, operator); return response == null ? R.fail("SOP问答评审记录不存在") : R.ok(response); } diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java index ff243d94..a036494b 100644 --- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java +++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java @@ -192,6 +192,10 @@ public class AihrSopSeedService { } public SopReviewResponse reviewSearch(Long id, SopReviewRequest request) { + return reviewSearch(id, request, null); + } + + public SopReviewResponse reviewSearch(Long id, SopReviewRequest request, String operator) { if (id == null) { return null; } @@ -202,7 +206,7 @@ public class AihrSopSeedService { WHERE tenant_id = ? AND id = ? """, request != null && Boolean.TRUE.equals(request.usable()), - firstNonBlank(request == null ? null : request.reviewer(), "人工评审"), + firstNonBlank(operator, "人工评审"), firstNonBlank(request == null ? null : request.note(), ""), Timestamp.valueOf(java.time.LocalDateTime.now()), Timestamp.valueOf(java.time.LocalDateTime.now()), diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java index b792a5ea..dc4f296c 100644 --- a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java +++ b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java @@ -104,6 +104,19 @@ public class AihrSopSeedServiceTest { assertTrue(code.contains("runLocalImportTask(taskId, plan)")); } + @Test + @Tag("dev") + public void sopReviewUsesAuthenticatedOperatorForAuditTrail() throws Exception { + Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrSopController.java"); + if (!Files.exists(source)) { + source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java"); + } + String code = Files.readString(source); + + assertTrue(code.contains("LoginHelper.getLoginUser()")); + assertTrue(code.contains("reviewSearch(id, request, operator)")); + } + private static AihrSopSeedService.KnowledgeHit hit(Long fragmentId, String title) { return new AihrSopSeedService.KnowledgeHit(fragmentId, title, "sop", "", "doc-" + fragmentId, "片段内容", 1, 1.0); } diff --git a/docs/BRD_IMPLEMENTATION_AUDIT.md b/docs/BRD_IMPLEMENTATION_AUDIT.md index 03752e85..fa05c4d0 100644 --- a/docs/BRD_IMPLEMENTATION_AUDIT.md +++ b/docs/BRD_IMPLEMENTATION_AUDIT.md @@ -178,3 +178,4 @@ - 2026-07-14 BRD G3 候选资料审核状态复核：候选人资料审核接口此前在空请求体时默认写回“待审核”，可能覆盖已有“已通过/已驳回”状态；现要求审核动作显式提交三态之一，空值和未知状态直接拒绝，避免后台误操作回退审核结论。 - 2026-07-14 BRD 案例署名复核：案例库已有负责人字段，但此前上传、整理和入库记录都硬编码为“培训组”，无法追溯案例贡献者；现复用既有 `owner` 字段保存首次上传身份，整理和入库阶段保留原署名，手机号身份仅显示员工末四位，避免把原始手机号写入案例展示。 - 2026-07-14 BRD 候选人关联完整性复核：候选人—员工关联接口此前只校验员工主体在职，允许给不存在的任意 `candidateId` 建立入职关联；现要求候选人必须来自内置候选档案、活动面试会话或当前租户已持久化面试记录，保留已有幂等关联和历史数据兼容。 +- 2026-07-14 BRD SOP 审核留痕复核：SOP 问答评审接口此前接受请求体中的 `reviewer` 并直接入库，登录用户可伪造审核人；现由控制器从当前登录用户传入服务端操作人，请求体仅保留评审结论和备注，保留旧服务调用的默认“人工评审”兼容。 diff --git a/scripts/demo-check.sh b/scripts/demo-check.sh index db3de829..534f9b7e 100755 --- a/scripts/demo-check.sh +++ b/scripts/demo-check.sh @@ -516,6 +516,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "storeSourceAudio" contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "currentCaseOwner" contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrInterviewService.java "候选人不存在，请先创建或完成一次面试记录" +contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "reviewSearch(id, request, operator)" contains mobile-uni/src/pages/user/cases/index.vue "case-audio" contains frontend/src/views/knowledge/cases.vue "case-audio" contains backend/script/sql/aihr_practice_mysql8.sql "aihr_case_record"