fix(aihr): bind candidate materials to app identity

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java

@@ -38,15 +38,19 @@ public class AihrCandidateMaterialController {
                                       @RequestParam(value = "candidateName", required = false) String candidateName,
                                       @RequestParam(value = "materialType", required = false) String materialType) {
         String appUsername = currentAppUsername();
-        String boundCandidateId = appUsername.isBlank() ? candidateId : appUsername;
-        String boundCandidateName = appUsername.isBlank() ? candidateName : appCandidateName(appUsername);
-        return R.ok(materialService.upload(file, boundCandidateId, boundCandidateName, materialType));
+        if (appUsername.isBlank()) {
+            return R.fail("候选人登录态无效");
+        }
+        return R.ok(materialService.upload(file, appUsername, appCandidateName(appUsername), materialType));
     }
 
     @GetMapping("/api/aihr/mobile/candidate/materials")
     public R<List<MaterialResponse>> list(@RequestParam(value = "candidateId", required = false) String candidateId) {
         String appUsername = currentAppUsername();
-        return R.ok(materialService.list(appUsername.isBlank() ? candidateId : appUsername));
+        if (appUsername.isBlank()) {
+            return R.fail("候选人登录态无效");
+        }
+        return R.ok(materialService.list(appUsername));
     }
 
     @SaCheckRole(value = {TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE}, mode = SaMode.OR)

docs/BRD_IMPLEMENTATION_AUDIT.md

@@ -15,7 +15,7 @@
 | 员工端今日/练/问/我 | `mobile-uni/src/pages/user/*`；员工首页、训练前预习、独立练习路由已实现 | 2026-07-14 已同步线上 H5；线上主 JS 与本地构建 SHA-256 一致，学习页已显示错题本和原因筛选，后续只做发布后回归 |
 | 主管工作台/复盘/派发 | `mobile-uni/src/pages/supervisor/*`；线上工作台已完成视觉回归 | 页面主链路已在位；正式主管身份仍依赖组织数据 |
 | 训练音频对象权限 | `AihrMobileController`、`AihrPracticeSeedService`；`GET /api/aihr/mobile/oss/{ossId}` | 已按员工本人、主管项目范围和系统用户区分音频读取权限；本地真实 HTTP 验证：归属员工 200，其他员工 403；生产正式主管范围仍需组织同步数据支撑 |
-| 候选人面试与 HR 复核 | `mobile-uni/src/pages/candidate/*`、`frontend/src/views/recruit/interview.vue` | 工程闭环已在位，需继续保留人工复核证据 |
+| 候选人面试与 HR 复核 | `mobile-uni/src/pages/candidate/*`、`frontend/src/views/recruit/interview.vue` | 工程闭环已在位；候选人资料移动端上传/列表现在只接受 APP 候选人本人身份，HR 继续通过独立审核接口处理；需继续保留人工复核证据 |
 | SOP/RAG/资料处理 | `frontend/src/views/knowledge/*`、`backend/.../AihrSopSeedService.java` | 搜索、引用、反馈、异步处理和评审入口已在位 |
 | 对练/每日题/主管带教 | `backend/.../AihrPracticeSeedService.java`、`mobile-uni/src/pages/user/practice` | 主闭环已在位；低分再练、错题归因仍需更明确的用户可见闭环 |
 | 案例上传/整理/筛选 | `backend/.../AihrCaseService.java`、`mobile-uni/src/pages/user/cases`、`frontend/src/views/knowledge/cases.vue` | 上传与整理已在位，案例状态在内存缺失时可从 `aihr_case_record` 回读恢复；APP 用户的读取按项目范围校验，写入接口已增加“主管/项目经理/系统用户”门禁，普通员工不能提交、整理或入库案例；当前仓库仍没有可用预渲染视频样片资产，也没有稳定的案例详情/学习点模型，不能用假播放器宣称案例学习闭环完成 |

scripts/demo-check.sh

@@ -340,6 +340,7 @@ contains mobile-uni/src/services/case.ts "/api/knowledge/case/records/"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "/records/{caseId}"
 contains mobile-uni/src/services/candidate.ts "/api/recruit/interview/start"
 contains mobile-uni/src/services/candidate.ts "/api/aihr/mobile/candidate/materials"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "候选人登录态无效"
 contains mobile-uni/src/pages/candidate/interview/index.vue "startCandidateInterview"
 contains mobile-uni/src/pages/candidate/materials/index.vue "uploadCandidateMaterial"
 contains mobile-uni/src/pages/candidate/progress/index.vue "buildCandidateFlow"