fix(aihr): restrict dashboard access

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java

@@ -1,9 +1,12 @@
 package org.dromara.aihr.controller;
 
 import cn.dev33.satoken.annotation.SaCheckLogin;
+import cn.dev33.satoken.annotation.SaCheckRole;
+import cn.dev33.satoken.annotation.SaMode;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrDashboardDto.OverviewResponse;
 import org.dromara.aihr.service.AihrDashboardService;
+import org.dromara.common.core.constant.TenantConstants;
 import org.dromara.common.core.domain.R;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -13,6 +16,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @RequestMapping("/api/aihr/dashboard")
 @SaCheckLogin
+@SaCheckRole(value = {TenantConstants.SUPER_ADMIN_ROLE_KEY, "hr_operator"}, mode = SaMode.OR)
 public class AihrDashboardController {
 
     private final AihrDashboardService dashboardService;

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrPracticeSeedServiceTest.java

@@ -367,6 +367,19 @@ public class AihrPracticeSeedServiceTest {
         assertFalse(controllerSource.contains("supervisor H5 keeps team-scope"));
     }
 
+    @Test
+    public void dashboardControllerRequiresHrRole() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrDashboardController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java");
+        }
+        String controllerSource = Files.readString(source);
+
+        assertTrue(controllerSource.contains("@SaCheckRole"));
+        assertTrue(controllerSource.contains("TenantConstants.SUPER_ADMIN_ROLE_KEY"));
+        assertTrue(controllerSource.contains("\"hr_operator\""));
+    }
+
     @Test
     public void practiceControllerRequiresLoginBeforeSessionCreation() throws Exception {
         Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrPracticeController.java");

scripts/demo-check.sh

@@ -415,6 +415,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/domain/
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "/position-sop"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaIgnore"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrDashboardController.java "@SaCheckRole"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java 'firstNonBlank(position, "生活顾问")'
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "normalizeSearchSource"
 contains frontend/src/views/train/practice.vue "practice_help"