From bcc777539a5c5ab3f53cd957a11f81910618b082 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=A7=A6=E9=B8=BF=E5=B1=95?= <18031053041@163.com> Date: Wed, 25 Feb 2026 11:45:09 +0800 Subject: [PATCH] =?UTF-8?q?BMS=E8=AE=A1=E8=B4=B9=E7=AE=A1=E7=90=86?= =?UTF-8?q?=E5=88=97=E8=A1=A8=E6=9F=A5=E8=AF=A2=E6=95=B0=E6=8D=AE=E9=9A=94?= =?UTF-8?q?=E7=A6=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../BillingStatementApplicationService.java | 91 +++++++++++++++++-- .../BusinessDocumentApplicationService.java | 46 +++++++++- .../po/BillingStatementCollectPO.java | 3 + .../todo/BillingStatementCollectDO.java | 3 + .../BillingStatementCollectDTO.java | 3 + .../mapper/BillingStatementMapper.xml | 11 ++- .../mapper/BusinessDocumentMapper.xml | 3 + 7 files changed, 147 insertions(+), 13 deletions(-) diff --git a/mhd_bms/src/main/java/com/mhd/bms/application/server/billingStatement/BillingStatementApplicationService.java b/mhd_bms/src/main/java/com/mhd/bms/application/server/billingStatement/BillingStatementApplicationService.java index ed74c5807..ea75f98aa 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/application/server/billingStatement/BillingStatementApplicationService.java +++ b/mhd_bms/src/main/java/com/mhd/bms/application/server/billingStatement/BillingStatementApplicationService.java @@ -72,10 +72,47 @@ public class BillingStatementApplicationService { public List queryList(BillingStatementDO billingStatementDO) { LoginUser loginUser = SecurityUtils.getLoginUser(); - if (loginUser != null) { - Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); - if (topOrganizationId != null && topOrganizationId != 1) { - billingStatementDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId()); + if (loginUser != null && loginUser.getUserPo() != null) { + Long userOrganizationId = loginUser.getUserPo().getOrganizationId(); + Long frontendOrganizationId = billingStatementDO.getOrganizationId(); // 前端传递的 organizationId + // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己 + if (userOrganizationId != null && userOrganizationId == 2827L) { + // 南光组织（organizationId=2827）：可以查询所有组织的数据 + if (frontendOrganizationId != null) { + // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤 + billingStatementDO.setOrganizationId(frontendOrganizationId); + billingStatementDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件 + } else { + // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据 + billingStatementDO.setOrganizationId(null); + billingStatementDO.setTopOrganizationId(null); + } + } else { + // 其他组织：设置organizationId，只查询当前组织的数据 + // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (frontendOrganizationId != null && userOrganizationId != null) { + // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (!frontendOrganizationId.equals(userOrganizationId)) { + // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询 + billingStatementDO.setOrganizationId(userOrganizationId); + } + // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值 + } else { + // 前端没有传递 organizationId，使用当前登录用户的组织ID + if (userOrganizationId != null) { + billingStatementDO.setOrganizationId(userOrganizationId); + } + } + // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId + if (billingStatementDO.getOrganizationId() == null) { + Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); + if (topOrganizationId != null && topOrganizationId != 1) { + billingStatementDO.setTopOrganizationId(topOrganizationId); + } + } else { + // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId + billingStatementDO.setTopOrganizationId(null); + } } } return billingStatementDomainService.queryList(billingStatementDO); @@ -86,10 +123,48 @@ public class BillingStatementApplicationService { */ public List queryCollectList(BillingStatementCollectDO billingStatementCollectDO) { LoginUser loginUser = SecurityUtils.getLoginUser(); - if (loginUser != null) { - Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); - if (topOrganizationId != null && topOrganizationId != 1) { - billingStatementCollectDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId()); + if (loginUser != null && loginUser.getUserPo() != null) { + Long userOrganizationId = loginUser.getUserPo().getOrganizationId(); + Long frontendOrganizationId = billingStatementCollectDO.getOrganizationId(); // 前端传递的 organizationId + + // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己 + if (userOrganizationId != null && userOrganizationId == 2827L) { + // 南光组织（organizationId=2827）：可以查询所有组织的数据 + if (frontendOrganizationId != null) { + // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤 + billingStatementCollectDO.setOrganizationId(frontendOrganizationId); + billingStatementCollectDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件 + } else { + // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据 + billingStatementCollectDO.setOrganizationId(null); + billingStatementCollectDO.setTopOrganizationId(null); + } + } else { + // 其他组织：设置organizationId，只查询当前组织的数据 + // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (frontendOrganizationId != null && userOrganizationId != null) { + // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (!frontendOrganizationId.equals(userOrganizationId)) { + // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询 + billingStatementCollectDO.setOrganizationId(userOrganizationId); + } + // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值 + } else { + // 前端没有传递 organizationId，使用当前登录用户的组织ID + if (userOrganizationId != null) { + billingStatementCollectDO.setOrganizationId(userOrganizationId); + } + } + // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId + if (billingStatementCollectDO.getOrganizationId() == null) { + Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); + if (topOrganizationId != null && topOrganizationId != 1) { + billingStatementCollectDO.setTopOrganizationId(topOrganizationId); + } + } else { + // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId + billingStatementCollectDO.setTopOrganizationId(null); + } } } return billingStatementDomainService.queryCollectList(billingStatementCollectDO); diff --git a/mhd_bms/src/main/java/com/mhd/bms/application/server/businessDocument/BusinessDocumentApplicationService.java b/mhd_bms/src/main/java/com/mhd/bms/application/server/businessDocument/BusinessDocumentApplicationService.java index 21f2bd2ee..dde8c0caf 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/application/server/businessDocument/BusinessDocumentApplicationService.java +++ b/mhd_bms/src/main/java/com/mhd/bms/application/server/businessDocument/BusinessDocumentApplicationService.java @@ -84,10 +84,48 @@ public class BusinessDocumentApplicationService { public List queryList(BusinessDocumentDO businessDocumentDO) { LoginUser loginUser = SecurityUtils.getLoginUser(); - if (loginUser != null){ - Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); - if (topOrganizationId != null && topOrganizationId != 1){ - businessDocumentDO.setTopOrganizationId(loginUser.getUserPo().getTopOrganizationId()); + if (loginUser != null && loginUser.getUserPo() != null) { + Long userOrganizationId = loginUser.getUserPo().getOrganizationId(); + Long frontendOrganizationId = businessDocumentDO.getOrganizationId(); // 前端传递的 organizationId + + // 当前登录用户的 organizationId 为 2827 时，可查全部组织数据；其他组织只能查自己 + if (userOrganizationId != null && userOrganizationId == 2827L) { + // 南光组织（organizationId=2827）：可以查询所有组织的数据 + if (frontendOrganizationId != null) { + // 前端传递了 organizationId（包括2827或其他组织），使用前端传递的值进行过滤 + businessDocumentDO.setOrganizationId(frontendOrganizationId); + businessDocumentDO.setTopOrganizationId(null); // 明确设置为 null，避免使用 topOrganizationId 条件 + } else { + // 前端没有传递 organizationId，清空组织过滤条件，查询所有组织的数据 + businessDocumentDO.setOrganizationId(null); + businessDocumentDO.setTopOrganizationId(null); + } + } else { + // 其他组织：设置organizationId，只查询当前组织的数据 + // 如果前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (frontendOrganizationId != null && userOrganizationId != null) { + // 前端传递了 organizationId，验证是否与当前登录用户的组织ID一致 + if (!frontendOrganizationId.equals(userOrganizationId)) { + // 前端传递了其他组织的 organizationId，强制使用当前登录用户的组织ID，防止越权查询 + businessDocumentDO.setOrganizationId(userOrganizationId); + } + // 如果前端传递的 organizationId 与当前登录用户的组织ID一致，使用前端传递的值 + } else { + // 前端没有传递 organizationId，使用当前登录用户的组织ID + if (userOrganizationId != null) { + businessDocumentDO.setOrganizationId(userOrganizationId); + } + } + // 如果 organizationId 不为 null，则优先使用 organizationId，不使用 topOrganizationId + if (businessDocumentDO.getOrganizationId() == null) { + Long topOrganizationId = loginUser.getUserPo().getTopOrganizationId(); + if (topOrganizationId != null && topOrganizationId != 1) { + businessDocumentDO.setTopOrganizationId(topOrganizationId); + } + } else { + // 如果 organizationId 不为 null，清空 topOrganizationId，确保查询使用 organizationId + businessDocumentDO.setTopOrganizationId(null); + } } } return businessDocumentDomainService.queryList(businessDocumentDO); diff --git a/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/po/BillingStatementCollectPO.java b/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/po/BillingStatementCollectPO.java index fafe240b9..e448493a6 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/po/BillingStatementCollectPO.java +++ b/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/po/BillingStatementCollectPO.java @@ -51,6 +51,9 @@ public class BillingStatementCollectPO extends BaseVOEntity { @ApiModelProperty("所属组织") private String organizationName; + @ApiModelProperty("组织ID") + private Long organizationId; + @ApiModelProperty("一级组织表ID") private Long topOrganizationId; diff --git a/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/todo/BillingStatementCollectDO.java b/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/todo/BillingStatementCollectDO.java index 1537b16b1..6e1f37b05 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/todo/BillingStatementCollectDO.java +++ b/mhd_bms/src/main/java/com/mhd/bms/domain/billingStatement/repository/todo/BillingStatementCollectDO.java @@ -45,6 +45,9 @@ public class BillingStatementCollectDO extends BaseVOEntity { @ApiModelProperty("所属组织") private String organizationName; + @ApiModelProperty("组织ID") + private Long organizationId; + @ApiModelProperty("一级组织表ID") private Long topOrganizationId; diff --git a/mhd_bms/src/main/java/com/mhd/bms/interfaces/dto/billingStatement/BillingStatementCollectDTO.java b/mhd_bms/src/main/java/com/mhd/bms/interfaces/dto/billingStatement/BillingStatementCollectDTO.java index 560fb2414..3db38b776 100644 --- a/mhd_bms/src/main/java/com/mhd/bms/interfaces/dto/billingStatement/BillingStatementCollectDTO.java +++ b/mhd_bms/src/main/java/com/mhd/bms/interfaces/dto/billingStatement/BillingStatementCollectDTO.java @@ -44,6 +44,9 @@ public class BillingStatementCollectDTO extends BaseVOEntity { @ApiModelProperty("所属组织") private String organizationName; + @ApiModelProperty("组织ID") + private Long organizationId; + @ApiModelProperty("一级组织表ID") private Long topOrganizationId; diff --git a/mhd_bms/src/main/resources/mapper/BillingStatementMapper.xml b/mhd_bms/src/main/resources/mapper/BillingStatementMapper.xml index 0c3305957..b4212f812 100644 --- a/mhd_bms/src/main/resources/mapper/BillingStatementMapper.xml +++ b/mhd_bms/src/main/resources/mapper/BillingStatementMapper.xml @@ -42,7 +42,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" SUM( IF(account_expense_type=1,billing_amount,0)) receivable, SUM( IF(account_expense_type=2,billing_amount,0)) feesPayable, WM_CONCAT(billing_state) AS billingStateCount, - settlement_entity,settlement_customers_code,SUM(billing_amount) bill_amount_sum,account_expense_type,COUNT(settlement_customers_code) count_fee,MIN(business_date) business_start_date ,MAX(business_date) business_end_date,organization_name,top_organization_id,billing_state,update_by_name,update_by,update_time,create_by_name,create_by,create_time + settlement_entity,settlement_customers_code,SUM(billing_amount) bill_amount_sum,account_expense_type,COUNT(settlement_customers_code) count_fee,MIN(business_date) business_start_date ,MAX(business_date) business_end_date,MAX(organization_id) organization_id,organization_name,top_organization_id,billing_state,update_by_name,update_by,update_time,create_by_name,create_by,create_time from billing_statement where del_flag = 1 @@ -102,6 +102,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" AND create_by_name like concat('%', #{billingStatementDO.createByName}, '%') + + AND organization_id = #{billingStatementDO.organizationId} + AND top_organization_id = #{billingStatementDO.topOrganizationId} @@ -234,6 +237,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" and billing_state 4 + + and organization_id = #{billingStatementCollectDO.organizationId} + + + and top_organization_id = #{billingStatementCollectDO.topOrganizationId} + and organization_name = #{billingStatementCollectDO.organizationName} diff --git a/mhd_bms/src/main/resources/mapper/BusinessDocumentMapper.xml b/mhd_bms/src/main/resources/mapper/BusinessDocumentMapper.xml index 2b6c544c0..e38a07668 100644 --- a/mhd_bms/src/main/resources/mapper/BusinessDocumentMapper.xml +++ b/mhd_bms/src/main/resources/mapper/BusinessDocumentMapper.xml @@ -121,6 +121,9 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" AND create_by_name like concat('%', #{businessDocumentDO.createByName}, '%') + + AND organization_id = #{businessDocumentDO.organizationId} + AND top_organization_id = #{businessDocumentDO.topOrganizationId}