fix(aihr): protect daily drill submissions

This commit is contained in:
2026-07-14 11:23:26 +08:00
parent 88702867b8
commit 83161569d1
4 changed files with 17 additions and 2 deletions
@@ -204,7 +204,7 @@ public class AihrMobileController {
@PostMapping("/practice/assignments/{id}/answer")
public R<DailyDrillAnswerResponse> answerDailyDrill(@PathVariable Long id, @RequestBody(required = false) DailyDrillAnswerRequest request) {
DailyDrillAnswerResponse response = mobileSeedService.answerDailyDrill(id, request, ownMobileExtPartyId(null));
return response == null ? R.fail("每日三题不存在") : R.ok(response);
return response == null ? R.fail("每日三题不存在或已完成") : R.ok(response);
}
@PostMapping("/practice/satisfaction")
@@ -1913,6 +1913,7 @@ public class AihrPracticeSeedService {
SELECT id, reason, source, status, scenario_id
FROM aihr_practice_assignment
WHERE tenant_id = ? AND id = ? AND source = 'daily'
AND status = '待训练'
AND (? = '' OR ext_party_id = ?)
LIMIT 1
""", tenantId(), id, party, party);
@@ -1935,7 +1936,7 @@ public class AihrPracticeSeedService {
correct = ?,
finished_time = ?,
update_time = ?
WHERE tenant_id = ? AND id = ? AND source = 'daily'
WHERE tenant_id = ? AND id = ? AND source = 'daily' AND status = '待训练'
""",
answer,
audioUrl,
@@ -120,6 +120,19 @@ public class AihrPracticeSeedServiceTest {
assertFalse(AihrPracticeSeedService.isWithinNewHireWindow(null, asOf));
}
@Test
public void dailyDrillAnswerDoesNotOverwriteCompletedAttempt() throws Exception {
String source = Files.readString(Path.of("src/main/java/org/dromara/aihr/service/AihrPracticeSeedService.java"));
int methodStart = source.indexOf("public DailyDrillAnswerResponse answerDailyDrill");
int methodEnd = source.indexOf("public List<PromptTemplateResponse> promptTemplates", methodStart);
assertTrue(methodStart >= 0 && methodEnd > methodStart);
String method = source.substring(methodStart, methodEnd);
String statusGuard = "status = '待训练'";
assertTrue(method.contains("AND " + statusGuard));
assertTrue(method.indexOf("AND " + statusGuard) != method.lastIndexOf("AND " + statusGuard));
}
@Test
public void mobilePracticeSessionRejectsForeignAndUnknownOwner() {
JdbcTemplate jdbcTemplate = mock(JdbcTemplate.class);