fix(aihr): protect demo sop review bypass

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java

@@ -4,6 +4,7 @@ import cn.dev33.satoken.annotation.SaCheckLogin;
 import cn.dev33.satoken.annotation.SaCheckRole;
 import cn.dev33.satoken.annotation.SaIgnore;
 import cn.dev33.satoken.annotation.SaMode;
+import cn.dev33.satoken.stp.StpUtil;
 import lombok.RequiredArgsConstructor;
 import org.dromara.aihr.domain.AihrSopDto.AnswerFeedbackItemResponse;
 import org.dromara.aihr.domain.AihrSopDto.AnswerFeedbackRequest;
@@ -52,6 +53,7 @@ import java.util.List;
 public class AihrSopController {
 
     private static final String HR_OPERATOR_ROLE = "hr_operator";
+    private static final String DEMO_VERIFY_SOURCE = "verify_demo_questions";
 
     private final AihrSopSeedService sopSeedService;
     private final AihrUploadQueueService uploadQueueService;
@@ -80,7 +82,15 @@ public class AihrSopController {
     @SaCheckLogin
     @PostMapping("/search")
     public R<SearchResponse> search(@RequestBody SearchRequest request) {
-        return R.ok(sopSeedService.search(request));
+        return R.ok(sopSeedService.search(restrictDemoVerificationSource(request)));
+    }
+
+    private SearchRequest restrictDemoVerificationSource(SearchRequest request) {
+        if (request == null || !DEMO_VERIFY_SOURCE.equals(request.source())
+            || StpUtil.hasRole(TenantConstants.SUPER_ADMIN_ROLE_KEY)) {
+            return request;
+        }
+        return new SearchRequest(request.queryText(), request.category(), request.position(), "knowledge_search", request.limit());
     }
 
     @GetMapping("/position-sop")

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrSopSeedServiceTest.java

@@ -139,6 +139,20 @@ public class AihrSopSeedServiceTest {
         assertTrue(code.contains("reviewSearch(id, request, operator)"));
     }
 
+    @Test
+    @Tag("dev")
+    public void demoVerificationSourceIsRestrictedToSuperAdmin() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/aihr/controller/AihrSopController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java");
+        }
+        String code = Files.readString(source);
+
+        assertTrue(code.contains("DEMO_VERIFY_SOURCE = \"verify_demo_questions\""));
+        assertTrue(code.contains("StpUtil.hasRole(TenantConstants.SUPER_ADMIN_ROLE_KEY)"));
+        assertTrue(code.contains("restrictDemoVerificationSource(request)"));
+    }
+
     @Test
     @Tag("dev")
     public void answerFeedbackReviewUsesAuthenticatedOperatorForAuditTrail() throws Exception {