From a728904a7e0d95c4fc8dcd4e193d86e71e3f9c5c Mon Sep 17 00:00:00 2001
From: let5sne <let5sne@gmail.com>
Date: Tue, 14 Jul 2026 08:48:39 +0800
Subject: [PATCH] fix(aihr): restrict case write access

---
 .../aihr/controller/AihrCaseController.java       |  6 +++++-
 .../dromara/aihr/service/AihrCaseServiceTest.java | 15 +++++++++++++++
 scripts/demo-check.sh                             |  1 +
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
index 67ccef72..6644daa5 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
@@ -1,7 +1,9 @@
 package org.dromara.aihr.controller;
 
 import cn.dev33.satoken.annotation.SaCheckLogin;
+import cn.dev33.satoken.stp.StpUtil;
 import lombok.RequiredArgsConstructor;
+import org.dromara.common.core.constant.TenantConstants;
 import org.dromara.common.core.domain.model.LoginUser;
 import org.dromara.common.core.enums.UserType;
 import org.dromara.common.satoken.utils.LoginHelper;
@@ -36,6 +38,8 @@ import java.util.List;
 @SaCheckLogin
 public class AihrCaseController {
 
+    private static final String HR_OPERATOR_ROLE = "hr_operator";
+
     private final AihrCaseService caseService;
 
     @PostMapping(value = "/upload", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
@@ -87,7 +91,7 @@ public class AihrCaseController {
     private boolean canManageCases() {
         LoginUser loginUser = LoginHelper.getLoginUser();
         if (loginUser != null && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
-            return true;
+            return StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE);
         }
         return loginUser != null
             && UserType.APP_USER.getUserType().equals(loginUser.getUserType())
diff --git a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java
index 45fe05fd..f69fcd92 100644
--- a/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java
+++ b/backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java
@@ -12,6 +12,8 @@ import org.springframework.mock.web.MockMultipartFile;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
 
@@ -127,6 +129,19 @@ class AihrCaseServiceTest {
         ));
     }
 
+    @Test
+    @Tag("dev")
+    void caseWriteControllerRequiresHrRoleForSystemUsers() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
+        }
+        String controllerSource = Files.readString(source);
+
+        assertTrue(controllerSource.contains("StpUtil.hasRoleOr"));
+        assertTrue(controllerSource.contains("HR_OPERATOR_ROLE = \"hr_operator\""));
+    }
+
     @Test
     @Tag("dev")
     void caseContributorPositionRecognizesProjectManagersAndLeads() {
diff --git a/scripts/demo-check.sh b/scripts/demo-check.sh
index 7b165d34..d72a51a2 100755
--- a/scripts/demo-check.sh
+++ b/scripts/demo-check.sh
@@ -476,6 +476,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrVideoService.java "AihrSensitiveText.forModel(fileName)"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrOrgSyncService.java "外部响应体已隐藏"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "仅项目负责人或主管可提交案例素材"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "StpUtil.hasRoleOr"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "position_level IN ('主管', '项目经理')"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "media_oss_id"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "storeSourceAudio"