fix(aihr): require login for private aihr APIs

2026-07-14 05:34:42 +08:00
parent cc8ce7c372
commit 841df00740
7 changed files with 18 additions and 0 deletions
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;

+import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
 import lombok.RequiredArgsConstructor;
@@ -26,6 +27,7 @@ import java.util.List;

@RequiredArgsConstructor
@RestController
+@SaCheckLogin
 public class AihrCandidateMaterialController {

    private static final String HR_OPERATOR_ROLE = "hr_operator";
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;

+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import org.dromara.common.core.domain.model.LoginUser;
 import org.dromara.common.core.enums.UserType;
@@ -32,6 +33,7 @@ import java.util.List;
@RequiredArgsConstructor
@RestController
@RequestMapping("/api/knowledge/case")
+@SaCheckLogin
 public class AihrCaseController {

    private final AihrCaseService caseService;
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;

+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerRequest;
 import org.dromara.aihr.domain.AihrInterviewDto.AnswerResponse;
@@ -28,6 +29,7 @@ import java.util.List;
@RequiredArgsConstructor
@RestController
@RequestMapping("/api/recruit/interview")
+@SaCheckLogin
 public class AihrInterviewController {

    private final AihrInterviewService interviewService;
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;

+import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaMode;
 import lombok.RequiredArgsConstructor;
@@ -73,6 +74,7 @@ public class AihrSopController {
        return R.ok(uploadQueueService.retry(id));
    }

+    @SaCheckLogin
    @PostMapping("/search")
    public R<SearchResponse> search(@RequestBody SearchRequest request) {
        return R.ok(sopSeedService.search(request));
@@ -84,6 +86,7 @@ public class AihrSopController {
        return R.ok(sopSeedService.positionSop(position, projectType));
    }

+    @SaCheckLogin
    @PostMapping("/answer-feedback")
    public R<AnswerFeedbackResponse> answerFeedback(@RequestBody AnswerFeedbackRequest request) {
        return R.ok(sopSeedService.answerFeedback(request));
@@ -110,6 +113,7 @@ public class AihrSopController {
        return response == null ? R.fail("SOP问答评审记录不存在") : R.ok(response);
    }

+    @SaCheckLogin
    @PostMapping("/summary-card")
    public R<SummaryCardResponse> summaryCard(@RequestBody SummaryCardRequest request) {
        return R.ok(sopSeedService.summaryCard(request));
@@ -1,5 +1,6 @@
 package org.dromara.aihr.controller;

+import cn.dev33.satoken.annotation.SaCheckLogin;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.aihr.domain.AihrSpeechDto.AsrResponse;
@@ -30,6 +31,7 @@ import java.util.Base64;
@RequiredArgsConstructor
@RestController
@RequestMapping("/api/ai")
+@SaCheckLogin
 public class AihrSpeechController {

    private static final String NOT_CONFIGURED_HINT = "语音模型未配置：请在「模型管理」启用 asr/tts 类目模型（如硅基流动 SenseVoice/CosyVoice2）";
@@ -80,3 +80,4 @@
 - 2026-07-14 线上只读复核：生产根站点与 `/h5/` 均返回 HTTP 200，线上 H5 入口仍加载 `index-Dh7w59t7.js`；`/prod-api/api/aihr/mobile/home/user` 返回业务 `code=200`。本次未发布、未修改生产数据；该结果只证明公开入口和员工首页 API 可用，不替代正式登录、主管身份和试点验收。
 - 本次线上核对发现 schema 漂移：生产库已存在 `aihr_practice_session.satisfaction_score`、`satisfaction_comment`，但尚未显式创建 `aihr_practice_audio`。当前代码仍有运行时懒建表兜底，满意度链路不受影响；正式音频留痕试点前必须执行并核验显式迁移，不能依赖首次请求触发；严格预检已增加该表存在性检查。
 - 2026-07-14 后续 BRD 审查：`组织与权限` 页已确认具备组织快照、dry-run、写入确认和 HR/管理员角色门禁；本轮修正写入模式按钮文案，并避免取消确认时误报“同步接口不可用”。岗位-SOP 页面继续明确显示“当前摘要不代表正式上岗资格”，在正式 `sop_applicability`、培训任务和资格规则未由 HR 确认前，不扩展为伪资格 gating。
+- 2026-07-14 权限审查：候选人面试、案例处理、ASR/TTS、SOP 搜索/反馈/总结卡、候选人资料接口均补控制器级登录门禁；匿名首页与 `position-sop` 导航摘要仍保持公开只读，写入、模型调用和候选人私有记录不再依赖业务层“失败返回”兜底。
@@ -344,6 +344,10 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains mobile-uni/src/services/candidate.ts "/api/recruit/interview/start"
 contains mobile-uni/src/services/candidate.ts "/api/aihr/mobile/candidate/materials"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "候选人登录态无效"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCandidateMaterialController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrInterviewController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java "@SaCheckLogin"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "@SaCheckLogin"
 contains mobile-uni/src/pages/candidate/interview/index.vue "startCandidateInterview"
 contains mobile-uni/src/pages/candidate/materials/index.vue "uploadCandidateMaterial"
 contains mobile-uni/src/pages/candidate/progress/index.vue "buildCandidateFlow"
@@ -431,6 +435,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "projectScopesForAppUser"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "/api/knowledge/case"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/search"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "@SaCheckLogin"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/doc/upload"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/reviews"
 contains frontend/src/api/aihr/sop.ts "/api/knowledge/answer-feedback"