fix: 79534 【水平越权】企业标准 部分接口没有处理水平越权

laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/EnterpriseStandardAuthUserService.java

@@ -10,34 +10,38 @@ import java.util.List;
 import java.util.Map;
 
 /**
-* @author ThinkBook
+ * @author ThinkBook
-* @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service
+ * @description 针对表【laws_enterprise_standard_temp_permission(企业标准)】的数据库操作Service
-* @createDate 2023-09-07 11:20:30
+ * @createDate 2023-09-07 11:20:30
-*/
+ */
 public interface EnterpriseStandardAuthUserService extends IService<EnterpriseStandardAuthUser> {
 
     void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission);
 
     /**
      * 不校验当前登陆人账号是否有权限
+     *
      * @param lawsStandardTempPermission
      */
     void saveTempPermissionTwo(LawsStandardTempPermission lawsStandardTempPermission);
 
     /**
      * 查看详情权限设置
+     *
      * @param records
      */
     void detailFlagSet(List<Map<String, Object>> records);
 
     /**
      * 编辑权限设置
+     *
      * @param records
      */
     void editFlagSet(List<Map<String, Object>> records);
 
     /**
      * 删除权限设置
+     *
      * @param records
      */
     void delFlagSet(List<Map<String, Object>> records);
@@ -48,13 +52,15 @@ public interface EnterpriseStandardAuthUserService extends IService<EnterpriseSt
 
     /**
      * 企标编辑保存后 重置授权部门
+     *
      * @param id
      * @param string
      */
-    void resetAuthDept(String id,String string);
+    void resetAuthDept(String id, String string);
 
     /**
      * 临时授权记录分页列表接口
+     *
      * @param tempAuthRecordQueryDto
      * @param pageNo
      * @param pageSize
@@ -64,9 +70,36 @@ public interface EnterpriseStandardAuthUserService extends IService<EnterpriseSt
 
     /**
      * 解除授权
+     *
      * @param authId
      */
     void revokeAuth(String authId);
 
     boolean hasESAuth(String userId, List<String> standardIds);
+
+    /**
+     * 指定用户Id是否有指定企标的删除权限
+     * @param standardId 企标Id
+     * @param userId 用户Id
+     */
+    boolean hasDelAuth(String standardId, String userId);
+
+    /**
+     * 指定用户Id是否有指定企标的删除权限
+     * @param standardId 企标Id
+     * @param userId 用户Id
+     */
+    boolean hasEditAuth(String standardId, String userId);
+
+    /**
+     * 编辑水平越权校验
+     * @param standardId 企标Id
+     */
+    void isEditHorizontalOverstep(String standardId);
+
+    /**
+     * 删除水平越权校验
+     * @param standardId 企标Id
+     */
+    void isDeleteHorizontalOverstep(String standardId);
 }

laws-modules/src/main/java/com/jero/modules/laws/enterprise/service/impl/EnterpriseStandardAuthUserServiceImpl.java

@@ -82,6 +82,9 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
     @Value("#{'${adminRoleCode}'.split(',')}")
     private List<String> adminRoleCodeList;
 
+    @Resource
+    private ILawsEnterpriseStandardService esService;
+
 
     @Override
     public void saveTempPermission(LawsStandardTempPermission lawsStandardTempPermission) {
@@ -396,7 +399,7 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
         SysUser currentUser = sysUserService.getById(userId);
         String username = currentUser.getUsername();
         // 获取当前用户的角色roleCode
-        List<String> roleList = sysUserRoleService.getRole(currentUser.getUsername());
+        List<String> roleList = sysUserRoleService.getRole(username);
         if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
             records.forEach(kv -> kv.put(FieldCommon.EDIT_FLAG, true));
             return;
@@ -411,6 +414,79 @@ public class EnterpriseStandardAuthUserServiceImpl extends ServiceImpl<Enterpris
         }
     }
 
+    @Override
+    public boolean hasDelAuth(String standardId, String userId) {
+        SysUser currentUser = sysUserService.getById(userId);
+        String username = currentUser.getUsername();
+        LawsEnterpriseStandard es = enterpriseStandardService.getById(standardId);
+
+        Date currentDate = new Date();
+        // 获取当前用户的角色roleCode
+        List<String> roleList = sysUserRoleService.getRole(currentUser.getUsername());
+        // 管理员能够删除所有试用期的企标
+        if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
+            String tryFlag = es.getTryFlag();
+            if (tryFlag.equals(YesOrNoEnum.NO.getValue())) {
+                return false;
+            }
+
+            Date releaseDate = es.getReleaseDate();
+            int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数
+            Calendar calendar = Calendar.getInstance();
+            calendar.setTime(releaseDate);
+            calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上
+            Date trialEndDate = calendar.getTime(); // 获取试用期结束日期
+
+            // 在适用周期之内的可以删除
+            return tryFlag.equals(YesOrNoEnum.YES.getValue()) && currentDate.compareTo(trialEndDate) <= 0;
+        }
+
+        // 创建人只能删除自己的试用期的企标
+        String createBy = es.getCreateBy();
+        String tryFlag = es.getTryFlag();
+        if (tryFlag.equals(YesOrNoEnum.NO.getValue())) {
+            return false;
+        }
+        Date releaseDate = es.getReleaseDate();
+        int trialPeriodMonths = Integer.parseInt(es.getTrialPeriod()); // 将试用周期转换为天数
+        Calendar calendar = Calendar.getInstance();
+        calendar.setTime(releaseDate);
+        calendar.add(Calendar.MONTH, trialPeriodMonths); // 将试用周期加到发布日期上
+        Date trialEndDate = calendar.getTime(); // 获取试用期结束日期
+        return username.equals(createBy) && tryFlag.equals(YesOrNoEnum.YES.getValue())
+                && currentDate.compareTo(trialEndDate) <= 0;
+    }
+
+    @Override
+    public boolean hasEditAuth(String standardId, String userId) {
+        SysUser user = sysUserService.getById(userId);
+        String username = user.getUsername();
+        // 获取当前用户的角色roleCode
+        List<String> roleList = sysUserRoleService.getRole(username);
+        if (roleList != null && roleList.stream().anyMatch(adminRoleCodeList::contains)) {
+            return true;
+        }
+        LawsEnterpriseStandard es = esService.getById(standardId);
+        String createBy = es.getCreateBy();
+        return username.equals(createBy);
+    }
+
+    @Override
+    public void isEditHorizontalOverstep(String standardId) {
+        if (hasEditAuth(standardId, UserUtils.getUserId())) {
+            return;
+        }
+        throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId));
+    }
+
+    @Override
+    public void isDeleteHorizontalOverstep(String standardId) {
+        if (hasDelAuth(standardId, UserUtils.getUserId())) {
+            return;
+        }
+        throw new JeroBootException(MessageUtils.getMessage(ResultCommon.YOU_HAVE_NOT_DATA_AUTH, standardId));
+    }
+
     @Override
     public void delFlagSet(List<Map<String, Object>> records) {
         String userId = UserUtils.getUserId();

laws-modules/src/main/java/com/jero/modules/laws/standard/controller/LawsEnterpriseController.java

@@ -123,6 +123,8 @@ public class LawsEnterpriseController {
     @ApiOperationSupport(order = 4)
     @RequiresPermissions("enterpriseStandard:edit")
     public Result<String> commonEdit(@RequestBody @ApiParam("标签管理") Map<String,Object> parameterMap) {
+        // 水平越权校验
+        esAuthUserService.isEditHorizontalOverstep((String) parameterMap.get("id"));
         parameterMap.put(FieldCommon.MODULE, MODULE_VALUE);
         return Result.OK(lawsCommonService.commonEdit(parameterMap));
     }
@@ -192,6 +194,8 @@ public class LawsEnterpriseController {
     @ApiOperationSupport(order = 9)
     @RequiresPermissions("enterpriseStandard:delete")
     public Result<String> singleDelete(@RequestBody @ApiParam(name = "ids", value = "主键（多个用逗号分隔）") Map<String,Object> parameterMap) {
+        // 水平越权校验
+        esAuthUserService.isDeleteHorizontalOverstep((String) parameterMap.get("id"));
         // 删除标准时同步删除这个标准的收藏数据
         lawsStandardCollectionService.deleteByStandardId((String) parameterMap.get("ids"));
         lawsStandardSharingService.deleteByStandardId((String) parameterMap.get("ids"));