fix(aihr): restrict case write access

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java

@@ -1,7 +1,9 @@
 package org.dromara.aihr.controller;
 
 import cn.dev33.satoken.annotation.SaCheckLogin;
+import cn.dev33.satoken.stp.StpUtil;
 import lombok.RequiredArgsConstructor;
+import org.dromara.common.core.constant.TenantConstants;
 import org.dromara.common.core.domain.model.LoginUser;
 import org.dromara.common.core.enums.UserType;
 import org.dromara.common.satoken.utils.LoginHelper;
@@ -36,6 +38,8 @@ import java.util.List;
 @SaCheckLogin
 public class AihrCaseController {
 
+    private static final String HR_OPERATOR_ROLE = "hr_operator";
+
     private final AihrCaseService caseService;
 
     @PostMapping(value = "/upload", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
@@ -87,7 +91,7 @@ public class AihrCaseController {
     private boolean canManageCases() {
         LoginUser loginUser = LoginHelper.getLoginUser();
         if (loginUser != null && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
-            return true;
+            return StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE);
         }
         return loginUser != null
             && UserType.APP_USER.getUserType().equals(loginUser.getUserType())

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java

@@ -12,6 +12,8 @@ import org.springframework.mock.web.MockMultipartFile;
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
 
@@ -127,6 +129,19 @@ class AihrCaseServiceTest {
         ));
     }
 
+    @Test
+    @Tag("dev")
+    void caseWriteControllerRequiresHrRoleForSystemUsers() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
+        }
+        String controllerSource = Files.readString(source);
+
+        assertTrue(controllerSource.contains("StpUtil.hasRoleOr"));
+        assertTrue(controllerSource.contains("HR_OPERATOR_ROLE = \"hr_operator\""));
+    }
+
     @Test
     @Tag("dev")
     void caseContributorPositionRecognizesProjectManagersAndLeads() {

scripts/demo-check.sh

@@ -476,6 +476,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrVideoService.java "AihrSensitiveText.forModel(fileName)"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrOrgSyncService.java "外部响应体已隐藏"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "仅项目负责人或主管可提交案例素材"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "StpUtil.hasRoleOr"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "position_level IN ('主管', '项目经理')"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "media_oss_id"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "storeSourceAudio"