数据权限的bug修改260113

mhd_finance/src/main/java/com/linke/finance/application/server/receivingAccount/ReceivingAccountApplicationService.java

@@ -5,6 +5,8 @@ import com.linke.finance.domain.receivingAccount.repository.persistence.Receivin
 import com.linke.finance.domain.receivingAccount.repository.po.ReceivingAccountPO;
 import com.linke.finance.domain.receivingAccount.repository.todo.ReceivingAccountDO;
 import com.mhd.common.core.utils.bean.BeanUtils;
+import com.mhd.common.security.utils.SecurityUtils;
+import com.mhd.system.api.model.LoginUser;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -46,8 +48,42 @@ public class ReceivingAccountApplicationService {
      */
     public Boolean insert(ReceivingAccountDO receivingAccountDTO) {
         log.info("新增收款账户，参数：{}", receivingAccountDTO);
+        
+        // 获取当前登录用户信息
+        LoginUser loginUser = SecurityUtils.getLoginUser();
+        if (loginUser == null || loginUser.getUserPo() == null) {
+            log.error("新增收款账户失败：未获取到登录用户信息");
+            throw new RuntimeException("未获取到登录用户信息");
+        }
+        
+        // 获取当前登录用户的组织ID
+        Long loginUserOrganizationId = loginUser.getUserPo().getOrganizationId();
+        String organizationId = null;
+        String topOrganizationId = null;
+        if (loginUserOrganizationId != null) {
+            organizationId = String.valueOf(loginUserOrganizationId);
+        }
+        if (loginUser.getUserPo().getTopOrganizationId() != null) {
+            topOrganizationId = String.valueOf(loginUser.getUserPo().getTopOrganizationId());
+        }
+        
         ReceivingAccount receivingAccount = new ReceivingAccount();
         BeanUtils.copyProperties(receivingAccountDTO, receivingAccount);
+        
+        // 立即清空从DTO复制过来的组织ID，防止其他组织的数据被添加
+        receivingAccount.setOrganizationId(null);
+        receivingAccount.setTopOrganizationId(null);
+        
+        // 强制使用当前登录用户的组织ID，不允许添加其他组织的数据
+        receivingAccount.setOrganizationId(organizationId);
+        
+        // 如果organizationId为2827（南光组织），不设置topOrganizationId（设为null）
+        if (loginUserOrganizationId != null && loginUserOrganizationId.equals(2827L)) {
+            receivingAccount.setTopOrganizationId(null);
+        } else {
+            receivingAccount.setTopOrganizationId(topOrganizationId);
+        }
+        
         receivingAccount.setDelFlag(1); // 1-正常
         receivingAccount.setCreateTime(new Date());
         receivingAccount.setUpdateTime(new Date());
@@ -56,32 +92,148 @@ public class ReceivingAccountApplicationService {
     }
 
     /**
-     * 批量新增收款账户（追加式新增，不删除旧数据）
+     * 批量新增收款账户（新增，删除旧数据）
      * 
      * @param receivingAccountDTOList 收款账户DTO列表
      * @return 是否成功
      */
     @Transactional
     public Boolean batchInsert(List<ReceivingAccountDO> receivingAccountDTOList) {
-        log.info("批量新增收款账户，数量：{}", receivingAccountDTOList.size());
+//        log.info("批量新增收款账户，数量：{}", receivingAccountDTOList.size());
 
-        if (receivingAccountDTOList == null || receivingAccountDTOList.isEmpty()) {
+        // 获取当前登录用户信息
-            log.warn("批量新增收款账户：数据列表为空");
+        LoginUser loginUser = SecurityUtils.getLoginUser();
-            return false;
+        if (loginUser == null || loginUser.getUserPo() == null) {
+            log.error("批量新增收款账户失败：未获取到登录用户信息");
+            throw new RuntimeException("未获取到登录用户信息");
         }
         
+        // 获取当前登录用户的组织ID
+        String organizationId = null;
+        if (loginUser.getUserPo().getOrganizationId() != null) {
+            organizationId = String.valueOf(loginUser.getUserPo().getOrganizationId());
+        }
+        
+        if (organizationId == null || organizationId.isEmpty()) {
+            log.error("当前登录用户的organizationId为空，无法执行批量新增操作");
+            throw new RuntimeException("当前登录用户的organizationId为空，无法执行批量新增操作");
+        }
+        
+        log.info("批量新增收款账户 - 当前登录用户organizationId={}", organizationId);
+        
+        // 根据当前登录用户的组织ID删除该组织的所有收款账户
+        int deleteCount = receivingAccountRepository.deleteByOrganization(null, organizationId);
+        log.info("已删除当前登录用户组织（organizationId={}）的收款账户数量：{}", organizationId, deleteCount);
+        
         List<ReceivingAccount> receivingAccountList = new ArrayList<>();
         Date now = new Date();
+        int skippedCount = 0; // 跳过的数据条数
         
         for (ReceivingAccountDO dto : receivingAccountDTOList) {
+            // 验证：只检查organizationId字段
+            // 1. 如果DTO中没有organizationId，跳过该条数据（不设置默认值，完全保留DTO中的原始数据）
+            // 2. 如果DTO中的organizationId与当前登录用户的organizationId不一致，跳过该条数据
+            String dtoOrganizationId = dto.getOrganizationId();
+            
+            log.info("处理DTO数据：accountName={}, dtoOrganizationId={}, 当前登录用户organizationId={}", 
+                dto.getAccountName(), dtoOrganizationId, organizationId);
+            
+            if (dtoOrganizationId == null || dtoOrganizationId.isEmpty()) {
+                log.warn("【跳过】DTO中没有organizationId，跳过该条数据");
+                skippedCount++;
+                continue;
+            }
+            
+            try {
+                Long dtoOrgId = Long.parseLong(dtoOrganizationId);
+                Long currentOrgId = Long.parseLong(organizationId);
+                
+                // 如果DTO中的organizationId与当前登录用户的organizationId不一致，跳过该条数据
+                if (!dtoOrgId.equals(currentOrgId)) {
+                    log.error("【跳过】DTO中的organizationId（{}）与当前登录用户的organizationId（{}）不一致，跳过该条数据", 
+                        dtoOrgId, currentOrgId);
+                    skippedCount++;
+                    continue;
+                }
+                
+                log.info("【通过验证】DTO中的organizationId（{}）与当前登录用户的organizationId（{}）一致，继续处理", 
+                    dtoOrgId, currentOrgId);
+            } catch (NumberFormatException e) {
+                log.warn("【跳过】解析DTO中的organizationId失败：{}，跳过该条数据", dtoOrganizationId);
+                skippedCount++;
+                continue;
+            }
+            
             ReceivingAccount receivingAccount = new ReceivingAccount();
             BeanUtils.copyProperties(dto, receivingAccount);
+            
+            // 复制属性后，再次验证organizationId，确保没有被覆盖
+            String finalOrgId = receivingAccount.getOrganizationId();
+            if (finalOrgId == null || finalOrgId.isEmpty()) {
+                log.error("【跳过】复制属性后，organizationId为空，跳过该条数据");
+                skippedCount++;
+                continue;
+            }
+            
+            try {
+                Long finalOrgIdLong = Long.parseLong(finalOrgId);
+                Long currentOrgIdLong = Long.parseLong(organizationId);
+                
+                // 再次验证：确保复制后的organizationId与当前登录用户的organizationId一致
+                if (!finalOrgIdLong.equals(currentOrgIdLong)) {
+                    log.error("【跳过】复制属性后，organizationId（{}）与当前登录用户的organizationId（{}）不一致，跳过该条数据", 
+                        finalOrgIdLong, currentOrgIdLong);
+                    skippedCount++;
+                    continue;
+                }
+            } catch (NumberFormatException e) {
+                log.warn("【跳过】解析复制后的organizationId失败：{}，跳过该条数据", finalOrgId);
+                skippedCount++;
+                continue;
+            }
+            
             receivingAccount.setDelFlag(1); // 1-正常
             receivingAccount.setCreateTime(now);
             receivingAccount.setUpdateTime(now);
+            
+            // 添加到列表前的最终验证：确保organizationId与当前登录用户的organizationId完全一致
+            // 这是最后一道防线，确保不会将不符合条件的数据添加到列表
+            String finalCheckOrgId = receivingAccount.getOrganizationId();
+            if (finalCheckOrgId == null || finalCheckOrgId.isEmpty()) {
+                log.error("【清除】添加到列表前验证失败：organizationId为空，清除该条数据");
+                skippedCount++;
+                continue;
+            }
+            
+            try {
+                Long finalCheckOrgIdLong = Long.parseLong(finalCheckOrgId);
+                Long currentOrgIdLong = Long.parseLong(organizationId);
+                
+                // 最终验证：确保organizationId与当前登录用户的organizationId完全一致
+                if (!finalCheckOrgIdLong.equals(currentOrgIdLong)) {
+                    log.error("【清除】添加到列表前验证失败：organizationId（{}）与当前登录用户的organizationId（{}）不一致，清除该条数据，不添加到列表", 
+                        finalCheckOrgIdLong, currentOrgIdLong);
+                    skippedCount++;
+                    continue; // 清除该条数据，不添加到列表
+                }
+            } catch (NumberFormatException e) {
+                log.error("【清除】添加到列表前验证失败：解析organizationId失败：{}，清除该条数据", finalCheckOrgId);
+                skippedCount++;
+                continue;
+            }
+            
+            log.info("【添加】准备新增收款账户：accountName={}, organizationId={}, 当前登录用户organizationId={}", 
+                receivingAccount.getAccountName(), receivingAccount.getOrganizationId(), organizationId);
+            
             receivingAccountList.add(receivingAccount);
         }
         
+        if (skippedCount > 0) {
+            log.info("批量新增收款账户 - 已跳过 {} 条包含其他组织organizationId的数据", skippedCount);
+        }
+        
+        log.info("批量新增收款账户 - 准备插入的数据条数：{}, 所有数据的organizationId={}", receivingAccountList.size(), organizationId);
+        
         int result = receivingAccountRepository.batchInsert(receivingAccountList);
         log.info("新增收款账户数量：{}", result);
         return result > 0;

mhd_finance/src/main/java/com/linke/finance/interfaces/facadeApp/tmsReceipt/TmsReceiptApi.java

@@ -26,6 +26,7 @@ import javax.annotation.Resource;
 import com.mhd.common.core.web.controller.BaseController;
 import com.mhd.common.core.web.domain.AjaxResult;
 import com.mhd.common.core.web.page.TableDataInfo;
+import lombok.extern.slf4j.Slf4j;
 
 /**
  * 收款单Api
@@ -33,6 +34,7 @@ import com.mhd.common.core.web.page.TableDataInfo;
  * @author gen
  * @date 2025-04-28
  */
+@Slf4j
 @RestController
 @RequestMapping("/tmsReceiptApi")
 @CrossOrigin
@@ -161,28 +163,14 @@ public class TmsReceiptApi extends BaseController{
     @PostMapping("/batchAddAccount")
     public AjaxResult batchAddAccount(@RequestBody List<ReceivingAccountDTO> receivingAccountDTOList)
     {
-        // 获取当前登录用户的组织信息
-        LoginUser loginUser = SecurityUtils.getLoginUser();
-        String topOrganizationId = null;
-        String organizationId = null;
-        if (loginUser != null && loginUser.getUserPo() != null) {
-            Long topOrgId = loginUser.getUserPo().getTopOrganizationId();
-            Long orgId = loginUser.getUserPo().getOrganizationId();
-            if (topOrgId != null) {
-                topOrganizationId = String.valueOf(topOrgId);
-            }
-            if (orgId != null) {
-                organizationId = String.valueOf(orgId);
-            }
-        }
-        //转换实体
         List<ReceivingAccountDO> receivingAccountDOList = new ArrayList<>();
         for (ReceivingAccountDTO dto : receivingAccountDTOList) {
             ReceivingAccountDO receivingAccountDO = new ReceivingAccountDO();
             BeanUtils.copyProperties(dto, receivingAccountDO);
-            // 设置当前登录用户的组织信息
+            // 完全保留DTO中的原始organizationId和topOrganizationId，不做任何修改
-            receivingAccountDO.setTopOrganizationId(topOrganizationId);
+            // ApplicationService层会验证organizationId是否与当前登录用户一致，不一致则跳过
-            receivingAccountDO.setOrganizationId(organizationId);
+            log.debug("接口层转换：DTO中的organizationId={}, topOrganizationId={}，完全保留，不做修改",
+                dto.getOrganizationId(), dto.getTopOrganizationId());
             receivingAccountDOList.add(receivingAccountDO);
         }
         return toAjax(receivingAccountApplicationService.batchInsert(receivingAccountDOList));

mhd_finance/src/main/resources/mapper/receivingAccount/ReceivingAccountMapper.xml

@@ -102,11 +102,14 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         set del_flag = 2,
             update_time = now()
         where del_flag = 1
-        <if test="topOrganizationId != null and topOrganizationId != ''">
+        <!-- 必须匹配 organizationId，确保只删除当前登录用户组织的数据 -->
-            and top_organization_id = #{topOrganizationId}
+        <!-- 只根据 organizationId 来删除，不使用 topOrganizationId -->
-        </if>
         <if test="organizationId != null and organizationId != ''">
             and organization_id = #{organizationId}
         </if>
+        <!-- 如果 organizationId 为空，则不执行删除操作，防止误删所有数据 -->
+        <if test="organizationId == null or organizationId == ''">
+            and 1 = 0
+        </if>
     </update>
 </mapper>