fix(aihr): restrict supervisor mobile access

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java

@@ -1,6 +1,7 @@
 package org.dromara.aihr.controller;
 
 import cn.dev33.satoken.annotation.SaIgnore;
+import cn.dev33.satoken.stp.StpUtil;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrPracticeDto.AnnotationResponse;
@@ -25,6 +26,8 @@ import org.dromara.aihr.service.AihrMobileSeedService;
 import org.dromara.common.core.domain.R;
 import org.dromara.common.core.domain.model.LoginUser;
 import org.dromara.common.core.enums.UserType;
+import org.dromara.common.core.constant.TenantConstants;
+import org.dromara.common.core.exception.ServiceException;
 import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.system.service.ISysOssService;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -196,6 +199,9 @@ public class AihrMobileController {
     private String supervisorScopeExtPartyId() {
         LoginUser loginUser = LoginHelper.getLoginUser();
         if (loginUser != null && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
+            if (!StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, "hr_operator")) {
+                throw new ServiceException("无主管权限，无法访问主管功能");
+            }
             return "";
         }
         return mobileSeedService.requireSupervisorIdentity(currentAppUsername());

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrPracticeSeedServiceTest.java

@@ -360,6 +360,7 @@ public class AihrPracticeSeedServiceTest {
         assertTrue(controllerSource.contains("private String supervisorScopeExtPartyId()"));
         assertTrue(controllerSource.contains("mobileSeedService.requireSupervisorIdentity(currentAppUsername())"));
         assertTrue(controllerSource.contains("UserType.SYS_USER.getUserType().equals(loginUser.getUserType())"));
+        assertTrue(controllerSource.contains("StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, \"hr_operator\")"));
         assertFalse(controllerSource.contains("private static String supervisorScopeExtPartyId()"));
         assertFalse(controllerSource.contains("supervisor H5 keeps team-scope"));
     }