fix(aihr): restrict case read access

backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java

@@ -68,11 +68,17 @@ public class AihrCaseController {
 
     @GetMapping("/records")
     public R<List<RecordResponse>> records(@RequestParam(value = "limit", required = false) Integer limit) {
+        if (!canViewCases()) {
+            return R.fail("无权查看案例素材");
+        }
         return R.ok(caseService.records(limit, currentProjectScopes()));
     }
 
     @GetMapping("/records/{caseId}")
     public R<DetailResponse> detail(@PathVariable String caseId) {
+        if (!canViewCases()) {
+            return R.fail("无权查看案例素材");
+        }
         DetailResponse detail = caseService.detail(caseId, currentProjectScopes());
         return detail == null ? R.fail("案例不存在或无权访问") : R.ok(detail);
     }
@@ -97,4 +103,12 @@ public class AihrCaseController {
             && UserType.APP_USER.getUserType().equals(loginUser.getUserType())
             && caseService.isCaseContributor(loginUser.getUsername());
     }
+
+    private boolean canViewCases() {
+        LoginUser loginUser = LoginHelper.getLoginUser();
+        if (loginUser != null && UserType.SYS_USER.getUserType().equals(loginUser.getUserType())) {
+            return StpUtil.hasRoleOr(TenantConstants.SUPER_ADMIN_ROLE_KEY, HR_OPERATOR_ROLE);
+        }
+        return loginUser != null && UserType.APP_USER.getUserType().equals(loginUser.getUserType());
+    }
 }

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/service/AihrCaseServiceTest.java

@@ -140,6 +140,7 @@ class AihrCaseServiceTest {
 
         assertTrue(controllerSource.contains("StpUtil.hasRoleOr"));
         assertTrue(controllerSource.contains("HR_OPERATOR_ROLE = \"hr_operator\""));
+        assertTrue(controllerSource.contains("private boolean canViewCases()"));
     }
 
     @Test

scripts/demo-check.sh

@@ -477,6 +477,7 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrOrgSyncService.java "外部响应体已隐藏"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "仅项目负责人或主管可提交案例素材"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "StpUtil.hasRoleOr"
+contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrCaseController.java "private boolean canViewCases()"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "position_level IN ('主管', '项目经理')"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "media_oss_id"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrCaseService.java "storeSourceAudio"