fix 81716 【水平越权】车型项目库-部分接口未处理水平越权

laws-modules/src/main/java/com/jero/modules/projectLibrary/service/ILawsProjectLibraryService.java

@@ -31,7 +31,9 @@ public interface ILawsProjectLibraryService extends IService<LawsProjectLibrary>
 	 */
     void editById(LawsProjectLibrary lawsProjectLibrary);
 
-	/**
+    void checkPermission(LawsProjectLibrary projectLibrary);
+
+    /**
 	 * 通过id删除
 	 */
     void deleteById(String id);

laws-modules/src/main/java/com/jero/modules/projectLibrary/service/impl/LawsAssessServiceImpl.java

@@ -15,10 +15,12 @@ import com.jero.modules.projectLibrary.common.AssessCommon;
 import com.jero.modules.projectLibrary.entity.LawsAssess;
 import com.jero.modules.projectLibrary.entity.LawsAssessResults;
 import com.jero.modules.projectLibrary.entity.LawsEvaluationNotMet;
+import com.jero.modules.projectLibrary.entity.LawsProjectLibrary;
 import com.jero.modules.projectLibrary.mapper.LawsAssessMapper;
 import com.jero.modules.projectLibrary.service.ILawsAssessResultsService;
 import com.jero.modules.projectLibrary.service.ILawsAssessService;
 import com.jero.modules.projectLibrary.service.ILawsEvaluationNotMetService;
+import com.jero.modules.projectLibrary.service.ILawsProjectLibraryService;
 import com.jero.modules.projectLibrary.vo.DecompositionOrderSourceVO;
 import com.jero.modules.projectLibrary.vo.LawsAssessAddVo;
 import com.jero.modules.split.entity.SarFileSplitInfoEO;
@@ -66,6 +68,8 @@ public class LawsAssessServiceImpl extends ServiceImpl<LawsAssessMapper, LawsAss
 	private ILawsAssessResultsService lawsAssessResultsService;
 	@Resource
 	private ILawsEvaluationNotMetService notMetService;
+	@Resource
+	private ILawsProjectLibraryService lawsProjectLibraryService;
     /**
      * 分页查询
      *
@@ -139,13 +143,17 @@ public class LawsAssessServiceImpl extends ServiceImpl<LawsAssessMapper, LawsAss
 	@Override
     public void deleteById(String id) {
 		LawsAssess lawsAssess = getById(id);
+		String projectId = lawsAssess.getProjectId();
+		//校验权限
+		LawsProjectLibrary projectLibrary = lawsProjectLibraryService.getById(projectId);
+		lawsProjectLibraryService.checkPermission(projectLibrary);
 		String processStatus = lawsAssess.getProcessStatus();
 		if (AssessCommon.UNDER_EVALUATION.equals(processStatus)){
 			throw new JeroBootException(ResultCommon.ERROR);
 		}
 		//未符合项中有整改中、审批中的数据时，不允许删除
 		LambdaQueryWrapper<LawsEvaluationNotMet> queryWrapper = new LambdaQueryWrapper<>();
-		queryWrapper.eq(LawsEvaluationNotMet::getProjectId, lawsAssess.getProjectId());
+		queryWrapper.eq(LawsEvaluationNotMet::getProjectId, projectId);
 		queryWrapper.in(LawsEvaluationNotMet::getStandardId, lawsAssess.getStandardId());
 		List<LawsEvaluationNotMet> notMetList = notMetService.list(queryWrapper);
 		for (LawsEvaluationNotMet notMet : notMetList) {

laws-modules/src/main/java/com/jero/modules/projectLibrary/service/impl/LawsProjectLibraryServiceImpl.java

@@ -5,6 +5,8 @@ import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.jero.common.api.vo.ResultCommon;
 import com.jero.common.constant.CommonConstant;
+import com.jero.common.system.vo.LoginUser;
+import com.jero.modules.laws.common.util.CurrentUserUtil;
 import com.jero.modules.projectLibrary.common.AssessCommon;
 import com.jero.modules.projectLibrary.entity.LawsAssess;
 import com.jero.modules.projectLibrary.entity.LawsEvaluationNotMet;
@@ -22,6 +24,8 @@ import org.springframework.transaction.annotation.Transactional;
 import com.jero.common.exception.JeroBootException;
 import java.util.List;
 import java.util.Date;
+import java.util.Objects;
+
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.jero.common.system.query.QueryGenerator;
 
@@ -79,15 +83,29 @@ public class LawsProjectLibraryServiceImpl extends ServiceImpl<LawsProjectLibrar
 	 */
 	@Override
     public void editById(LawsProjectLibrary lawsProjectLibrary) {
+		LawsProjectLibrary projectLibrary = getById(lawsProjectLibrary.getId());
+		checkPermission(projectLibrary);
     	saveOrUpdate(lawsProjectLibrary);
     }
 
+	/**
+	 * 校验权限
+	 * @param projectLibrary
+	 */
+	@Override
+	public void checkPermission(LawsProjectLibrary projectLibrary){
+		LoginUser loginUser = CurrentUserUtil.getLoginUser();
+		if (!loginUser.getIsAdmin()&& !Objects.equals(loginUser.getUsername(),projectLibrary.getCreateBy())){
+			throw new JeroBootException(ResultCommon.NO_PERMISSIONS_PLEASE_SELECT);
+		}
+	}
 	/**
 	 * 通过id删除
 	 */
 	@Override
     public void deleteById(String id) {
 		LawsProjectLibrary projectLibrary = getById(id);
+		checkPermission(projectLibrary);
 		List<LawsAssess> allByProjectIdNotDeleted = lawsAssessService.getAllByProjectIdNotDeleted(id);
 		for (LawsAssess lawsAssess : allByProjectIdNotDeleted) {
 			String processStatus = lawsAssess.getProcessStatus();
@@ -117,6 +135,31 @@ public class LawsProjectLibraryServiceImpl extends ServiceImpl<LawsProjectLibrar
     public void deleteByIds(List<String> ids) {
 		LambdaUpdateWrapper<LawsProjectLibrary> wrapper = new LambdaUpdateWrapper<>();
 		wrapper.in(LawsProjectLibrary::getId, ids);
+		List<LawsProjectLibrary> projectLibraryList = this.list(wrapper);
+		for (LawsProjectLibrary projectLibrary : projectLibraryList) {
+			checkPermission(projectLibrary);
+			String id = projectLibrary.getId();
+			List<LawsAssess> allByProjectIdNotDeleted = lawsAssessService.getAllByProjectIdNotDeleted(id);
+			for (LawsAssess lawsAssess : allByProjectIdNotDeleted) {
+				String processStatus = lawsAssess.getProcessStatus();
+				if (AssessCommon.UNDER_EVALUATION.equals(processStatus)){
+					throw new JeroBootException(ResultCommon.ASSESS_DELETE_ERROR2);
+				}
+				//未符合项中有整改中、审批中的数据时，不允许删除
+				LambdaQueryWrapper<LawsEvaluationNotMet> queryWrapper = new LambdaQueryWrapper<>();
+				queryWrapper.eq(LawsEvaluationNotMet::getProjectId, lawsAssess.getProjectId());
+				queryWrapper.in(LawsEvaluationNotMet::getStandardId, lawsAssess.getStandardId());
+				List<LawsEvaluationNotMet> notMetList = notMetService.list(queryWrapper);
+				for (LawsEvaluationNotMet notMet : notMetList) {
+					String state = notMet.getState();
+					if (AssessCommon.RECTIFICATION.equals(state)||
+							AssessCommon.UNDER_APPROVAL.equals(state)){
+						throw new JeroBootException(ResultCommon.ASSESS_DELETE_ERROR);
+					}
+				}
+			}
+		}
+
 		wrapper.set(LawsProjectLibrary::getDelFlag, CommonConstant.DEL_FLAG_1.toString());
 		update(wrapper);
     }