From 416ac1367a1c2b6ed533f6986713ed2111595c13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=A7=A6=E9=B8=BF=E5=B1=95?= <18031053041@163.com>
Date: Wed, 25 Feb 2026 14:00:00 +0800
Subject: [PATCH] =?UTF-8?q?BMS=E5=BA=94=E4=BB=98=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E5=88=97=E8=A1=A8=E6=9F=A5=E8=AF=A2=E6=95=B0=E6=8D=AE=E9=9A=94?=
 =?UTF-8?q?=E7=A6=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../PaymentOrderApplicationService.java       | 46 +++++++++++++++++--
 .../resources/mapper/PaymentOrderMapper.xml   |  3 ++
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/mhd_bms/src/main/java/com/mhd/bms/application/server/paymentOrder/PaymentOrderApplicationService.java b/mhd_bms/src/main/java/com/mhd/bms/application/server/paymentOrder/PaymentOrderApplicationService.java
index 67a33870e..39c11c87e 100644
--- a/mhd_bms/src/main/java/com/mhd/bms/application/server/paymentOrder/PaymentOrderApplicationService.java
+++ b/mhd_bms/src/main/java/com/mhd/bms/application/server/paymentOrder/PaymentOrderApplicationService.java
@@ -40,10 +40,48 @@ public class PaymentOrderApplicationService {
 
     public List<PaymentOrderPO> queryList(PaymentOrderDO paymentOrderDO) {
         LoginUser loginUser = SecurityUtils.getLoginUser();
-        if (loginUser != null){
-            Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
-            if (topOrganizationId != null && topOrganizationId != 1){
-                paymentOrderDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId());
+        if (loginUser != null && loginUser.getUserPo() != null) {
+            Long userOrganizationId = loginUser.getUserPo().getOrganizationId();
+            Long frontendOrganizationId = paymentOrderDO.getOrganizationId(); // 前端传递的 organizationId
+            
+            // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己
+            if (userOrganizationId != null && userOrganizationId == 2827L) {
+                // 南光组织（organizationId=2827）：可以查询所有组织的数据
+                if (frontendOrganizationId != null) {
+                    // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤
+                    paymentOrderDO.setOrganizationId(frontendOrganizationId);
+                    paymentOrderDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件
+                } else {
+                    // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据
+                    paymentOrderDO.setOrganizationId(null);
+                    paymentOrderDO.setTopOrganizationId(null);
+                }
+            } else {
+                // 其他组织：设置organizationId，只查询当前组织的数据
+                // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
+                if (frontendOrganizationId != null && userOrganizationId != null) {
+                    // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致
+                    if (!frontendOrganizationId.equals(userOrganizationId)) {
+                        // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询
+                        paymentOrderDO.setOrganizationId(userOrganizationId);
+                    }
+                    // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值
+                } else {
+                    // 前端没有传递 organizationId，使用当前登录用户的组织ID
+                    if (userOrganizationId != null) {
+                        paymentOrderDO.setOrganizationId(userOrganizationId);
+                    }
+                }
+                // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId
+                if (paymentOrderDO.getOrganizationId() == null) {
+                    Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId();
+                    if (topOrganizationId != null && topOrganizationId != 1) {
+                        paymentOrderDO.setTopOrganizationId(topOrganizationId);
+                    }
+                } else {
+                    // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId
+                    paymentOrderDO.setTopOrganizationId(null);
+                }
             }
         }
         return paymentOrderDomainService.queryList(paymentOrderDO);
diff --git a/mhd_bms/src/main/resources/mapper/PaymentOrderMapper.xml b/mhd_bms/src/main/resources/mapper/PaymentOrderMapper.xml
index a920c88b1..d5ac52816 100644
--- a/mhd_bms/src/main/resources/mapper/PaymentOrderMapper.xml
+++ b/mhd_bms/src/main/resources/mapper/PaymentOrderMapper.xml
@@ -34,6 +34,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
     </select>
 
     <sql id="common_where">
+        <if test="paymentOrderDO.organizationId != null">
+            AND a.organization_id = #{paymentOrderDO.organizationId}
+        </if>
         <if test="paymentOrderDO.topOrganizationId != null  and paymentOrderDO.topOrganizationId != ''">
             AND a.top_organization_id = #{paymentOrderDO.topOrganizationId}
         </if>