weiaisuosi/nanguangszwlback
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

数据权限的bug修改260113

Browse Source
This commit is contained in:
1745237360-cloud
2026-01-13 20:43:04 +08:00
parent 8924757467
commit 6606c65d73
3 changed files with 170 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mhd_finance/src/main/java/com/linke/finance/application/server/receivingAccount/ReceivingAccountApplicationService.java
+158 -6
View File
@@ -5,6 +5,8 @@ import com.linke.finance.domain.receivingAccount.repository.persistence.Receivin
import com.linke.finance.domain.receivingAccount.repository.po.ReceivingAccountPO;
import com.linke.finance.domain.receivingAccount.repository.todo.ReceivingAccountDO;
import com.mhd.common.core.utils.bean.BeanUtils;
import com.mhd.common.security.utils.SecurityUtils;
import com.mhd.system.api.model.LoginUser;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
@@ -46,8 +48,42 @@ public class ReceivingAccountApplicationService {
*/
public Boolean insert(ReceivingAccountDO receivingAccountDTO) {
log.info("新增收款账户，参数：{}", receivingAccountDTO);
// 获取当前登录用户信息
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser == null || loginUser.getUserPo() == null) {
log.error("新增收款账户失败：未获取到登录用户信息");
throw new RuntimeException("未获取到登录用户信息");
}
// 获取当前登录用户的组织ID
Long loginUserOrganizationId = loginUser.getUserPo().getOrganizationId();
String organizationId = null;
String topOrganizationId = null;
if (loginUserOrganizationId != null) {
organizationId = String.valueOf(loginUserOrganizationId);
}
if (loginUser.getUserPo().getTopOrganizationId() != null) {
topOrganizationId = String.valueOf(loginUser.getUserPo().getTopOrganizationId());
}
ReceivingAccount receivingAccount = new ReceivingAccount();
BeanUtils.copyProperties(receivingAccountDTO, receivingAccount);
// 立即清空从DTO复制过来的组织ID，防止其他组织的数据被添加
receivingAccount.setOrganizationId(null);
receivingAccount.setTopOrganizationId(null);
// 强制使用当前登录用户的组织ID，不允许添加其他组织的数据
receivingAccount.setOrganizationId(organizationId);
// 如果organizationId为2827（南光组织），不设置topOrganizationId（设为null）
if (loginUserOrganizationId != null && loginUserOrganizationId.equals(2827L)) {
receivingAccount.setTopOrganizationId(null);
} else {
receivingAccount.setTopOrganizationId(topOrganizationId);
}
receivingAccount.setDelFlag(1); // 1-正常
receivingAccount.setCreateTime(new Date());
receivingAccount.setUpdateTime(new Date());
@@ -56,32 +92,148 @@ public class ReceivingAccountApplicationService {
}
/**
* 批量新增收款账户（追加式新增，不删除旧数据）
* 批量新增收款账户（新增，删除旧数据）
*
* @param receivingAccountDTOList 收款账户DTO列表
* @return 是否成功
*/
@Transactional
public Boolean batchInsert(List<ReceivingAccountDO> receivingAccountDTOList) {
log.info("批量新增收款账户，数量：{}", receivingAccountDTOList.size());
if (receivingAccountDTOList == null || receivingAccountDTOList.isEmpty()) {
log.warn("批量新增收款账户：数据列表为空");
return false;
// log.info("批量新增收款账户，数量：{}", receivingAccountDTOList.size());
// 获取当前登录用户信息
LoginUser loginUser = SecurityUtils.getLoginUser();
if (loginUser == null || loginUser.getUserPo() == null) {
log.error("批量新增收款账户失败：未获取到登录用户信息");
throw new RuntimeException("未获取到登录用户信息");
}
// 获取当前登录用户的组织ID
String organizationId = null;
if (loginUser.getUserPo().getOrganizationId() != null) {
organizationId = String.valueOf(loginUser.getUserPo().getOrganizationId());
}
if (organizationId == null || organizationId.isEmpty()) {
log.error("当前登录用户的organizationId为空，无法执行批量新增操作");
throw new RuntimeException("当前登录用户的organizationId为空，无法执行批量新增操作");
}
log.info("批量新增收款账户 - 当前登录用户organizationId={}", organizationId);
// 根据当前登录用户的组织ID删除该组织的所有收款账户
int deleteCount = receivingAccountRepository.deleteByOrganization(null, organizationId);
log.info("已删除当前登录用户组织（organizationId={}）的收款账户数量：{}", organizationId, deleteCount);
List<ReceivingAccount> receivingAccountList = new ArrayList<>();
Date now = new Date();
int skippedCount = 0; // 跳过的数据条数
for (ReceivingAccountDO dto : receivingAccountDTOList) {
// 验证：只检查organizationId字段
// 1. 如果DTO中没有organizationId，跳过该条数据（不设置默认值，完全保留DTO中的原始数据）
// 2. 如果DTO中的organizationId与当前登录用户的organizationId不一致，跳过该条数据
String dtoOrganizationId = dto.getOrganizationId();
log.info("处理DTO数据：accountName={}, dtoOrganizationId={}, 当前登录用户organizationId={}",
dto.getAccountName(), dtoOrganizationId, organizationId);
if (dtoOrganizationId == null || dtoOrganizationId.isEmpty()) {
log.warn("【跳过】DTO中没有organizationId，跳过该条数据");
skippedCount++;
continue;
}
try {
Long dtoOrgId = Long.parseLong(dtoOrganizationId);
Long currentOrgId = Long.parseLong(organizationId);
// 如果DTO中的organizationId与当前登录用户的organizationId不一致，跳过该条数据
if (!dtoOrgId.equals(currentOrgId)) {
log.error("【跳过】DTO中的organizationId（{}）与当前登录用户的organizationId（{}）不一致，跳过该条数据",
dtoOrgId, currentOrgId);
skippedCount++;
continue;
}
log.info("【通过验证】DTO中的organizationId（{}）与当前登录用户的organizationId（{}）一致，继续处理",
dtoOrgId, currentOrgId);
} catch (NumberFormatException e) {
log.warn("【跳过】解析DTO中的organizationId失败：{}，跳过该条数据", dtoOrganizationId);
skippedCount++;
continue;
}
ReceivingAccount receivingAccount = new ReceivingAccount();
BeanUtils.copyProperties(dto, receivingAccount);
// 复制属性后，再次验证organizationId，确保没有被覆盖
String finalOrgId = receivingAccount.getOrganizationId();
if (finalOrgId == null || finalOrgId.isEmpty()) {
log.error("【跳过】复制属性后，organizationId为空，跳过该条数据");
skippedCount++;
continue;
}
try {
Long finalOrgIdLong = Long.parseLong(finalOrgId);
Long currentOrgIdLong = Long.parseLong(organizationId);
// 再次验证：确保复制后的organizationId与当前登录用户的organizationId一致
if (!finalOrgIdLong.equals(currentOrgIdLong)) {
log.error("【跳过】复制属性后，organizationId（{}）与当前登录用户的organizationId（{}）不一致，跳过该条数据",
finalOrgIdLong, currentOrgIdLong);
skippedCount++;
continue;
}
} catch (NumberFormatException e) {
log.warn("【跳过】解析复制后的organizationId失败：{}，跳过该条数据", finalOrgId);
skippedCount++;
continue;
}
receivingAccount.setDelFlag(1); // 1-正常
receivingAccount.setCreateTime(now);
receivingAccount.setUpdateTime(now);
// 添加到列表前的最终验证：确保organizationId与当前登录用户的organizationId完全一致
// 这是最后一道防线，确保不会将不符合条件的数据添加到列表
String finalCheckOrgId = receivingAccount.getOrganizationId();
if (finalCheckOrgId == null || finalCheckOrgId.isEmpty()) {
log.error("【清除】添加到列表前验证失败：organizationId为空，清除该条数据");
skippedCount++;
continue;
}
try {
Long finalCheckOrgIdLong = Long.parseLong(finalCheckOrgId);
Long currentOrgIdLong = Long.parseLong(organizationId);
// 最终验证：确保organizationId与当前登录用户的organizationId完全一致
if (!finalCheckOrgIdLong.equals(currentOrgIdLong)) {
log.error("【清除】添加到列表前验证失败：organizationId（{}）与当前登录用户的organizationId（{}）不一致，清除该条数据，不添加到列表",
finalCheckOrgIdLong, currentOrgIdLong);
skippedCount++;
continue; // 清除该条数据，不添加到列表
}
} catch (NumberFormatException e) {
log.error("【清除】添加到列表前验证失败：解析organizationId失败：{}，清除该条数据", finalCheckOrgId);
skippedCount++;
continue;
}
log.info("【添加】准备新增收款账户：accountName={}, organizationId={}, 当前登录用户organizationId={}",
receivingAccount.getAccountName(), receivingAccount.getOrganizationId(), organizationId);
receivingAccountList.add(receivingAccount);
}
if (skippedCount > 0) {
log.info("批量新增收款账户 - 已跳过 {} 条包含其他组织organizationId的数据", skippedCount);
}
log.info("批量新增收款账户 - 准备插入的数据条数：{}, 所有数据的organizationId={}", receivingAccountList.size(), organizationId);
int result = receivingAccountRepository.batchInsert(receivingAccountList);
log.info("新增收款账户数量：{}", result);
return result > 0;
mhd_finance/src/main/java/com/linke/finance/interfaces/facadeApp/tmsReceipt/TmsReceiptApi.java
+6 -18
View File
@@ -26,6 +26,7 @@ import javax.annotation.Resource;
import com.mhd.common.core.web.controller.BaseController;
import com.mhd.common.core.web.domain.AjaxResult;
import com.mhd.common.core.web.page.TableDataInfo;
import lombok.extern.slf4j.Slf4j;
/**
* 收款单Api
@@ -33,6 +34,7 @@ import com.mhd.common.core.web.page.TableDataInfo;
* @author gen
* @date 2025-04-28
*/
@Slf4j
@RestController
@RequestMapping("/tmsReceiptApi")
@CrossOrigin
@@ -161,28 +163,14 @@ public class TmsReceiptApi extends BaseController{
@PostMapping("/batchAddAccount")
public AjaxResult batchAddAccount(@RequestBody List<ReceivingAccountDTO> receivingAccountDTOList)
{
// 获取当前登录用户的组织信息
LoginUser loginUser = SecurityUtils.getLoginUser();
String topOrganizationId = null;
String organizationId = null;
if (loginUser != null && loginUser.getUserPo() != null) {
Long topOrgId = loginUser.getUserPo().getTopOrganizationId();
Long orgId = loginUser.getUserPo().getOrganizationId();
if (topOrgId != null) {
topOrganizationId = String.valueOf(topOrgId);
}
if (orgId != null) {
organizationId = String.valueOf(orgId);
}
}
//转换实体
List<ReceivingAccountDO> receivingAccountDOList = new ArrayList<>();
for (ReceivingAccountDTO dto : receivingAccountDTOList) {
ReceivingAccountDO receivingAccountDO = new ReceivingAccountDO();
BeanUtils.copyProperties(dto, receivingAccountDO);
// 设置当前登录用户的组织信息
receivingAccountDO.setTopOrganizationId(topOrganizationId);
receivingAccountDO.setOrganizationId(organizationId);
// 完全保留DTO中的原始organizationId和topOrganizationId，不做任何修改
// ApplicationService层会验证organizationId是否与当前登录用户一致，不一致则跳过
log.debug("接口层转换：DTO中的organizationId={}, topOrganizationId={}，完全保留，不做修改",
dto.getOrganizationId(), dto.getTopOrganizationId());
receivingAccountDOList.add(receivingAccountDO);
}
return toAjax(receivingAccountApplicationService.batchInsert(receivingAccountDOList));
mhd_finance/src/main/resources/mapper/receivingAccount/ReceivingAccountMapper.xml
+6 -3
View File
@@ -102,11 +102,14 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
set del_flag = 2,
update_time = now()
where del_flag = 1
<if test="topOrganizationId != null and topOrganizationId != ''">
and top_organization_id = #{topOrganizationId}
</if>
<!-- 必须匹配 organizationId，确保只删除当前登录用户组织的数据 -->
<!-- 只根据 organizationId 来删除，不使用 topOrganizationId -->
<if test="organizationId != null and organizationId != ''">
and organization_id = #{organizationId}
</if>
<!-- 如果 organizationId 为空，则不执行删除操作，防止误删所有数据 -->
<if test="organizationId == null or organizationId == ''">
and 1 = 0
</if>
</update>
</mapper>