admin/prop-ai-hr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(aihr): restrict case write access

Browse Source
This commit is contained in:
admin
2026-07-14 08:48:39 +08:00
parent 9e5c9b8b6a
commit a728904a7e
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java
+5 -1
View File
@@ -1,7 +1,9 @@
package org.dromara.aihr.controller;
import cn.dev33.satoken.annotation.SaCheckLogin;
import cn.dev33.satoken.stp.StpUtil;
import lombok.RequiredArgsConstructor;
import org.dromara.common.core.constant.TenantConstants;
import org.dromara.common.core.domain.model.LoginUser;
import org.dromara.common.core.enums.UserType;
import org.dromara.common.satoken.utils.LoginHelper;
@@ -36,6 +38,8 @@ import java.util.List;
@SaCheckLogin
public class AihrCaseController {
private static final String HR_OPERATOR_ROLE = "hr_operator";
private final AihrCaseService caseService;
@PostMapping(value = "/upload", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
@@ -87,7 +91,7 @@ public class AihrCaseController {
private boolean canManageCases() {
LoginUser loginUser = LoginHelper.getLoginUser();
if (loginUser != null && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
return true;
return StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE);
}
return loginUser != null
&& UserType.APP_USER.getUserType().equals(loginUser.getUserType())
backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java
+15
View File
@@ -12,6 +12,8 @@ import org.springframework.mock.web.MockMultipartFile;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import java.util.Optional;
@@ -127,6 +129,19 @@ class AihrCaseServiceTest {
));
}
@Test
@Tag("dev")
void caseWriteControllerRequiresHrRoleForSystemUsers() throws Exception {
Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
if (!Files.exists(source)) {
source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java");
}
String controllerSource = Files.readString(source);
assertTrue(controllerSource.contains("StpUtil.hasRoleOr"));
assertTrue(controllerSource.contains("HR_OPERATOR_ROLE = \"hr_operator\""));
}
@Test
@Tag("dev")
void caseContributorPositionRecognizesProjectManagersAndLeads() {
scripts/demo-check.sh
+1
View File
@@ -476,6 +476,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrVideoService.java "AihrSensitiveText.forModel(fileName)"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrOrgSyncService.java "外部响应体已隐藏"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "仅项目负责人或主管可提交案例素材"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "StpUtil.hasRoleOr"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "position_level IN ('主管', '项目经理')"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "media_oss_id"
contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "storeSourceAudio"