fix(aihr): require login for position sop navigation

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java

@@ -2,7 +2,6 @@ package org.dromara.aihr.controller;
 
 import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
-import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.annotation.SaMode;
 import cn.dev33.satoken.stp.StpUtil;
 import lombok.RequiredArgsConstructor;
@@ -102,8 +101,8 @@ public class AihrSopController {
         return new SearchRequest(request.queryText(), request.category(), request.position(), "knowledge_search", request.limit());
     }
 
+    @SaCheckLogin
     @GetMapping("/position-sop")
-    @SaIgnore
     public R<PositionSopResponse> positionSop(@RequestParam(required = false) String position,
                                               @RequestParam(required = false) String projectType) {
         return R.ok(sopSeedService.positionSop(position, projectType));

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java

@@ -231,6 +231,19 @@ public class AihrSopSeedServiceTest {
         assertTrue(code.contains("restrictDemoVerificationSource(request)"));
     }
 
+    @Test
+    @Tag("dev")
+    public void positionSopSummaryRequiresLogin() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrSopController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java");
+        }
+        String code = Files.readString(source);
+
+        assertTrue(code.contains("@SaCheckLogin\n    @GetMapping(\"/position-sop\")"));
+        assertFalse(code.contains("@SaIgnore\n    @GetMapping(\"/position-sop\")"));
+    }
+
     @Test
     @Tag("dev")
     public void answerFeedbackReviewUsesAuthenticatedOperatorForAuditTrail() throws Exception {

docs/BRD_IMPLEMENTATION_AUDIT.md

@@ -1,5 +1,7 @@
 # BRD 功能审查与未完成项记录
 
+- 2026-07-15 BRD G3 知识导航匿名访问收紧：岗位 SOP 导航接口虽然只返回学习摘要，但后端此前使用 `@SaIgnore`，匿名请求可以直接读取生活顾问流程主题；移动端实际只在登录后调用。现改为 `@SaCheckLogin`，补源码回归和 `demo-check` marker；不改变登录后的员工学习路径，也未修改知识库数据。
+
 - 2026-07-15 BRD 候选人/面试生产迁移缺口修复：生产只读复核发现 `aihr_candidate_material` 缺少 `reviewer/reviewed_time`，`aihr_interview_result` 缺少人工复核字段和 `questions_json`，`aihr_candidate_employee_link` 尚不存在；这些路径此前依赖运行时懒迁移。现新增可重复执行的 `aihr_20260715_candidate_interview_review_mysql8.sql`，兼容空库、旧表和重复执行，纳入生产迁移 Runbook、schema 回归和 `demo-check` marker；仅补结构，不写生产业务数据，正式迁移仍需发布窗口、备份和回滚责任。
 
 - 2026-07-15 BRD 4.3/4.4/4.5 生产迁移缺口修复：严格试点门禁要求 `aihr_practice_session` 的 8 个证据字段，但版本化迁移此前只覆盖三项五维字段，`annotations_json`、主管复盘建议、人工贡献分和满意度字段仍可能依赖运行时懒迁移。现新增幂等 MySQL 8 迁移补齐其余 5 列，纳入 Runbook、schema 回归和 `demo-check` marker；仅补结构，不写业务数据，尚未执行生产迁移。

scripts/demo-check.sh

@@ -590,7 +590,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaCheckRole"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/domain/AihrSopDto.java "String position"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "/position-sop"
-contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaIgnore"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaCheckLogin"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java "@SaCheckLogin"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java "@SaCheckRole"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java 'firstNonBlank(position, "生活顾问")'