fix(aihr): require explicit candidate review status

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java

@@ -227,12 +227,12 @@ public class AihrCandidateMaterialService {
         return name;
     }
 
-    private static String normalizeReviewStatus(String status) {
-        String text = clean(status, "待审核");
+    static String normalizeReviewStatus(String status) {
+        String text = clean(status, "");
         if ("已通过".equals(text) || "已驳回".equals(text) || "待审核".equals(text)) {
             return text;
         }
-        throw new IllegalArgumentException("审核状态只能是待审核、已通过或已驳回");
+        throw new IllegalArgumentException("审核接口必须明确提交待审核、已通过或已驳回");
     }
 
     public record MaterialResponse(Long id, Long ossId, String fileName, String materialType, Long fileSize, String status, String time) {

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCandidateMaterialServiceTest.java

@@ -34,4 +34,14 @@ class AihrCandidateMaterialServiceTest {
         assertEquals(".._.._candidate.pdf", AihrCandidateMaterialService.sanitizeMaterialFileName("../../candidate.pdf"));
         assertEquals("candidate_ name.pdf", AihrCandidateMaterialService.sanitizeMaterialFileName("candidate\t name.pdf"));
     }
+
+    @Test
+    @Tag("dev")
+    void reviewStatusMustBeExplicit() {
+        assertEquals("已通过", AihrCandidateMaterialService.normalizeReviewStatus(" 已通过 "));
+        assertEquals("已驳回", AihrCandidateMaterialService.normalizeReviewStatus("已驳回"));
+        assertThrows(IllegalArgumentException.class, () -> AihrCandidateMaterialService.normalizeReviewStatus(null));
+        assertThrows(IllegalArgumentException.class, () -> AihrCandidateMaterialService.normalizeReviewStatus(""));
+        assertThrows(IllegalArgumentException.class, () -> AihrCandidateMaterialService.normalizeReviewStatus("未知状态"));
+    }
 }

docs/BRD_IMPLEMENTATION_AUDIT.md

@@ -175,3 +175,4 @@
 - 2026-07-14 BRD G3 移动首页权限复核：发现公开首页方法对已登录 SYS 用户仍可能调用全局统计分支；现要求只有 APP 用户且身份非空才读取员工/主管动态数据，后台系统用户和异常身份统一返回无业务统计的公开 seed。AIHR 全量测试 `70/70` 通过，未修改生产环境。
 - 2026-07-14 BRD G3 音频读取权限复核：发现移动端音频下载接口对已登录 SYS 用户未校验角色，普通后台账号理论上可枚举 `ossId` 读取训练录音；现复用 `superadmin/hr_operator` 门禁，APP 用户继续按本人/主管项目范围校验，其他身份返回 403。AIHR 全量测试 `70/70` 通过，未修改生产环境。
 - 2026-07-14 BRD 4.4 每日三题资格补强：每日派题现在在组织快照存在 `hire_date` 列时按“入职日期至今不超过 3 个月”判断，边界按自然月且包含当天；旧 Demo 快照没有该列时继续使用“移动端训练记录少于 3 次”的兼容回退。正式试点仍需在外部组织同步落地并校验 `hire_date`，不能把回退口径当成正式新员工资格。
+- 2026-07-14 BRD G3 候选资料审核状态复核：候选人资料审核接口此前在空请求体时默认写回“待审核”，可能覆盖已有“已通过/已驳回”状态；现要求审核动作显式提交三态之一，空值和未知状态直接拒绝，避免后台误操作回退审核结论。

scripts/demo-check.sh

@@ -360,6 +360,7 @@ contains mobile-uni/src/services/candidate.ts "/api/aihr/mobile/candidate/materi
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "候选人登录态无效"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "@SaCheckLogin"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java "SUPPORTED_MATERIAL_EXTENSIONS"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCandidateMaterialService.java "审核接口必须明确提交"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "SUPPORTED_AUDIO_EXTENSIONS"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "@SaCheckLogin"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java "@SaCheckLogin"