fix(security): harden martial controllers auth and request validation

src/main/java/org/springblade/modules/martial/controller/MartialActivityScheduleController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialActivitySchedule;
 import org.springblade.modules.martial.service.IMartialActivityScheduleService;
@@ -49,6 +51,7 @@ public class MartialActivityScheduleController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialActivitySchedule activitySchedule) {
@@ -58,6 +61,7 @@ public class MartialActivityScheduleController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialAthleteController.java

@@ -66,16 +66,16 @@ public class MartialAthleteController extends BladeController {
 	@Operation(summary = "公开分页列表", description = "报名端使用，报名未结束时返回空列表")
 	public R<AthleteListResultVO> publicList(MartialAthlete athlete, Query query) {
 		AthleteListResultVO result = new AthleteListResultVO();
-		
+
 		if (athlete.getCompetitionId() != null) {
 			MartialCompetition competition = competitionService.getById(athlete.getCompetitionId());
 			if (competition != null && competition.getRegistrationEndTime() != null) {
 				LocalDateTime now = LocalDateTime.now();
 				boolean registrationEnded = now.isAfter(competition.getRegistrationEndTime());
-				
+
 				result.setRegistrationEnded(registrationEnded);
 				result.setRegistrationEndTime(competition.getRegistrationEndTime());
-				
+
 				if (!registrationEnded) {
 					result.setPage(new Page<>());
 					result.setMessage("报名尚未结束，暂不显示参赛选手");
@@ -83,7 +83,7 @@ public class MartialAthleteController extends BladeController {
 				}
 			}
 		}
-		
+
 		IPage<MartialAthleteVO> pages = athleteService.selectAthleteVOPage(Condition.getPage(query), athlete);
 		result.setPage(pages);
 		result.setRegistrationEnded(true);
@@ -97,6 +97,9 @@ public class MartialAthleteController extends BladeController {
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialAthlete athlete) {
 		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		log.info("=== 提交选手 === userId: {}, playerName: {}", userId, athlete.getPlayerName());
 		if (athlete.getId() == null) {
 			athlete.setCreateUser(userId);
@@ -111,6 +114,10 @@ public class MartialAthleteController extends BladeController {
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		return R.status(athleteService.removeByIds(Func.toLongList(ids)));
 	}
 
@@ -120,6 +127,10 @@ public class MartialAthleteController extends BladeController {
 	@PostMapping("/checkin")
 	@Operation(summary = "运动员签到", description = "比赛日签到")
 	public R checkIn(@RequestParam Long athleteId, @RequestParam Long scheduleId) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		athleteService.checkIn(athleteId, scheduleId);
 		return R.success("签到成功");
 	}
@@ -130,6 +141,10 @@ public class MartialAthleteController extends BladeController {
 	@PostMapping("/complete")
 	@Operation(summary = "完成比赛", description = "标记运动员完成表演")
 	public R completePerformance(@RequestParam Long athleteId, @RequestParam Long scheduleId) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		athleteService.completePerformance(athleteId, scheduleId);
 		return R.success("已标记完成");
 	}
@@ -140,6 +155,10 @@ public class MartialAthleteController extends BladeController {
 	@PostMapping("/status")
 	@Operation(summary = "更新比赛状态", description = "状态流转：0-待出场，1-进行中，2-已完成")
 	public R updateStatus(@RequestParam Long athleteId, @RequestParam Integer status) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		athleteService.updateCompetitionStatus(athleteId, status);
 		return R.success("状态更新成功");
 	}
@@ -156,11 +175,11 @@ public class MartialAthleteController extends BladeController {
 		wrapper.eq(MartialAthlete::getCompetitionId, competitionId)
 			.eq(MartialAthlete::getIsDeleted, 0)
 			.eq(MartialAthlete::getRegistrationStatus, 1);
-		
+
 		if (Func.isNotBlank(projectIds)) {
 			wrapper.in(MartialAthlete::getProjectId, Func.toLongList(projectIds));
 		}
-		
+
 		List<MartialAthlete> list = athleteService.list(wrapper);
 		return R.data(list);
 	}

src/main/java/org/springblade/modules/martial/controller/MartialBannerController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialBanner;
 import org.springblade.modules.martial.service.IMartialBannerService;
@@ -49,6 +51,7 @@ public class MartialBannerController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialBanner banner) {
@@ -58,6 +61,7 @@ public class MartialBannerController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialCompetitionAttachmentController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialCompetitionAttachment;
 import org.springblade.modules.martial.service.IMartialCompetitionAttachmentService;
@@ -73,6 +75,7 @@ public class MartialCompetitionAttachmentController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialCompetitionAttachment attachment) {
@@ -90,6 +93,7 @@ public class MartialCompetitionAttachmentController extends BladeController {
 	/**
 	 * 批量保存附件
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/batchSubmit")
 	@Operation(summary = "批量保存附件", description = "传入附件列表")
 	public R batchSubmit(@RequestBody List<MartialCompetitionAttachment> attachments) {
@@ -107,6 +111,7 @@ public class MartialCompetitionAttachmentController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
@@ -116,6 +121,7 @@ public class MartialCompetitionAttachmentController extends BladeController {
 	/**
 	 * 删除赛事的指定类型附件
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/removeByType")
 	@Operation(summary = "删除赛事的指定类型附件", description = "传入赛事ID和附件类型")
 	public R removeByType(

src/main/java/org/springblade/modules/martial/controller/MartialCompetitionRulesController.java

@@ -2,24 +2,29 @@ package org.springblade.modules.martial.controller;
 
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
+import org.springblade.modules.martial.pojo.dto.BatchSaveRulesContentsDTO;
 import org.springblade.modules.martial.pojo.entity.MartialCompetitionAttachment;
 import org.springblade.modules.martial.pojo.entity.MartialCompetitionRulesChapter;
 import org.springblade.modules.martial.pojo.entity.MartialCompetitionRulesContent;
 import org.springblade.modules.martial.pojo.vo.MartialCompetitionRulesVO;
 import org.springblade.modules.martial.service.IMartialCompetitionRulesService;
+import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
-import java.util.Map;
 
 /**
  * 赛事规程 控制器
  *
  * @author BladeX
  */
+@Validated
 @RestController
 @AllArgsConstructor
 @RequestMapping("/martial/competition/rules")
@@ -54,8 +59,9 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 保存附件
 	 */
 	@PostMapping("/attachment/save")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "保存附件", description = "新增或修改附件")
-	public R saveAttachment(@RequestBody MartialCompetitionAttachment attachment) {
+	public R saveAttachment(@Valid @RequestBody MartialCompetitionAttachment attachment) {
 		return R.status(rulesService.saveAttachment(attachment));
 	}
 
@@ -63,6 +69,7 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 删除附件
 	 */
 	@PostMapping("/attachment/remove")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "删除附件", description = "传入附件ID")
 	public R removeAttachment(@RequestParam Long id) {
 		return R.status(rulesService.removeAttachment(id));
@@ -84,8 +91,9 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 保存章节
 	 */
 	@PostMapping("/chapter/save")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "保存章节", description = "新增或修改章节")
-	public R saveChapter(@RequestBody MartialCompetitionRulesChapter chapter) {
+	public R saveChapter(@Valid @RequestBody MartialCompetitionRulesChapter chapter) {
 		return R.status(rulesService.saveChapter(chapter));
 	}
 
@@ -93,6 +101,7 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 删除章节
 	 */
 	@PostMapping("/chapter/remove")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "删除章节", description = "传入章节ID")
 	public R removeChapter(@RequestParam Long id) {
 		return R.status(rulesService.removeChapter(id));
@@ -114,8 +123,9 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 保存章节内容
 	 */
 	@PostMapping("/content/save")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "保存章节内容", description = "新增或修改章节内容")
-	public R saveContent(@RequestBody MartialCompetitionRulesContent content) {
+	public R saveContent(@Valid @RequestBody MartialCompetitionRulesContent content) {
 		return R.status(rulesService.saveContent(content));
 	}
 
@@ -123,18 +133,17 @@ public class MartialCompetitionRulesController extends BladeController {
 	 * 批量保存章节内容
 	 */
 	@PostMapping("/content/batch-save")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "批量保存章节内容", description = "批量保存章节内容")
-	public R batchSaveContents(@RequestBody Map<String, Object> params) {
-		Long chapterId = Long.valueOf(params.get("chapterId").toString());
-		@SuppressWarnings("unchecked")
-		List<String> contents = (List<String>) params.get("contents");
-		return R.status(rulesService.batchSaveContents(chapterId, contents));
+	public R batchSaveContents(@Valid @RequestBody BatchSaveRulesContentsDTO dto) {
+		return R.status(rulesService.batchSaveContents(dto.getChapterId(), dto.getContents()));
 	}
 
 	/**
 	 * 删除章节内容
 	 */
 	@PostMapping("/content/remove")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "删除章节内容", description = "传入内容ID")
 	public R removeContent(@RequestParam Long id) {
 		return R.status(rulesService.removeContent(id));

src/main/java/org/springblade/modules/martial/controller/MartialContactController.java

@@ -27,6 +27,9 @@ public class MartialContactController extends BladeController {
 	@Operation(summary = "分页列表", description = "获取当前用户的联系人列表")
 	public R<IPage<MartialContact>> list(Query query) {
 		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		IPage<MartialContact> pages = contactService.getContactList(userId, query.getCurrent(), query.getSize());
 		return R.data(pages);
 	}
@@ -34,6 +37,10 @@ public class MartialContactController extends BladeController {
 	@GetMapping("/detail")
 	@Operation(summary = "详情", description = "获取联系人详情")
 	public R<MartialContact> detail(@RequestParam Long id) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		return R.data(contactService.getContactDetail(id));
 	}
 
@@ -41,15 +48,22 @@ public class MartialContactController extends BladeController {
 	@Operation(summary = "保存", description = "新增或修改联系人")
 	public R<Boolean> submit(@RequestBody MartialContact contact) {
 		Long userId = AuthUtil.getUserId();
-		log.info("Contact submit - id: {}, name: {}, userId: {}, isDefault: {}", 
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
+		log.info("Contact submit - id: {}, name: {}, userId: {}, isDefault: {}",
 			contact.getId(), contact.getName(), userId, contact.getIsDefault());
-		
+
 		return R.data(contactService.saveContact(contact, userId));
 	}
 
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "删除联系人")
 	public R<Boolean> remove(@RequestParam String ids) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		return R.data(contactService.removeByIds(Func.toLongList(ids)));
 	}
 

src/main/java/org/springblade/modules/martial/controller/MartialDeductionItemController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialDeductionItem;
 import org.springblade.modules.martial.pojo.entity.MartialProject;
@@ -63,6 +65,7 @@ public class MartialDeductionItemController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialDeductionItem deductionItem) {
@@ -72,6 +75,7 @@ public class MartialDeductionItemController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
@@ -81,6 +85,7 @@ public class MartialDeductionItemController extends BladeController {
 	/**
 	 * 更新排序
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/update-order")
 	@Operation(summary = "更新排序", description = "传入排序数据")
 	public R updateOrder(@RequestBody List<MartialDeductionItem> sortData) {

src/main/java/org/springblade/modules/martial/controller/MartialExceptionEventController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialExceptionEvent;
 import org.springblade.modules.martial.service.IMartialExceptionEventService;
@@ -49,6 +51,7 @@ public class MartialExceptionEventController extends BladeController {
 	/**
 	 * Task 2.4: 记录异常事件
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/record")
 	@Operation(summary = "记录异常事件", description = "比赛日异常情况记录")
 	public R recordException(
@@ -65,6 +68,7 @@ public class MartialExceptionEventController extends BladeController {
 	/**
 	 * Task 2.4: 处理异常事件
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/handle")
 	@Operation(summary = "处理异常事件", description = "标记异常事件为已处理")
 	public R handleException(
@@ -79,6 +83,7 @@ public class MartialExceptionEventController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialExportController.java

@@ -6,7 +6,9 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.AllArgsConstructor;
 import org.springblade.core.excel.util.ExcelUtil;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.DateUtil;
 import org.springblade.modules.martial.excel.*;
 import org.springblade.modules.martial.pojo.dto.CompetitionGroupDTO;
@@ -26,6 +28,7 @@ import java.util.List;
 
 @RestController
 @AllArgsConstructor
+@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 @RequestMapping("/martial/export")
 @Tag(name = "导出打印管理", description = "成绩单、赛程表、证书等导出打印接口")
 public class MartialExportController {

src/main/java/org/springblade/modules/martial/controller/MartialInfoPublishController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialInfoPublish;
 import org.springblade.modules.martial.service.IMartialInfoPublishService;
@@ -49,6 +51,7 @@ public class MartialInfoPublishController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialInfoPublish infoPublish) {
@@ -58,6 +61,7 @@ public class MartialInfoPublishController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialJudgeController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialJudge;
 import org.springblade.modules.martial.service.IMartialJudgeService;
@@ -49,6 +51,7 @@ public class MartialJudgeController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialJudge judge) {
@@ -58,6 +61,7 @@ public class MartialJudgeController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialJudgeInviteController.java

@@ -3,17 +3,21 @@ package org.springblade.modules.martial.controller;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
-import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.dto.BatchGenerateInviteDTO;
 import org.springblade.modules.martial.pojo.dto.GenerateInviteDTO;
+import org.springblade.modules.martial.pojo.dto.UpdateInviteProjectsDTO;
 import org.springblade.modules.martial.pojo.entity.MartialJudgeInvite;
 import org.springblade.modules.martial.pojo.vo.MartialJudgeInviteVO;
 import org.springblade.modules.martial.service.IMartialJudgeInviteService;
+import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
@@ -24,6 +28,7 @@ import java.util.Map;
  *
  * @author BladeX
  */
+@Validated
 @RestController
 @AllArgsConstructor
 @RequestMapping("/martial/judgeInvite")
@@ -56,8 +61,9 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 新增或修改
 	 */
 	@PostMapping("/submit")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "新增或修改", description = "传入实体")
-	public R submit(@RequestBody MartialJudgeInvite judgeInvite) {
+	public R submit(@Valid @RequestBody MartialJudgeInvite judgeInvite) {
 		return R.status(judgeInviteService.saveOrUpdate(judgeInvite));
 	}
 
@@ -65,6 +71,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 删除
 	 */
 	@PostMapping("/remove")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
 		return R.status(judgeInviteService.removeByIds(Func.toLongList(ids)));
@@ -84,8 +91,9 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 生成邀请码
 	 */
 	@PostMapping("/generate")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "生成邀请码", description = "为评委生成邀请码")
-	public R<MartialJudgeInvite> generateInviteCode(@RequestBody GenerateInviteDTO dto) {
+	public R<MartialJudgeInvite> generateInviteCode(@Valid @RequestBody GenerateInviteDTO dto) {
 		MartialJudgeInvite invite = judgeInviteService.generateInviteCode(dto);
 		return R.data(invite);
 	}
@@ -94,8 +102,9 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 批量生成邀请码
 	 */
 	@PostMapping("/generate/batch")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "批量生成邀请码", description = "为多个评委批量生成邀请码")
-	public R<List<MartialJudgeInvite>> batchGenerateInviteCode(@RequestBody BatchGenerateInviteDTO dto) {
+	public R<List<MartialJudgeInvite>> batchGenerateInviteCode(@Valid @RequestBody BatchGenerateInviteDTO dto) {
 		List<MartialJudgeInvite> invites = judgeInviteService.batchGenerateInviteCode(dto);
 		return R.data(invites);
 	}
@@ -104,6 +113,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 重新生成邀请码
 	 */
 	@PutMapping("/regenerate/{inviteId}")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "重新生成邀请码", description = "重新生成邀请码（旧码失效）")
 	public R<MartialJudgeInvite> regenerateInviteCode(@PathVariable Long inviteId) {
 		MartialJudgeInvite invite = judgeInviteService.regenerateInviteCode(inviteId);
@@ -133,8 +143,9 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 发送邀请
 	 */
 	@PostMapping("/send")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "发送邀请", description = "向评委发送邀请")
-	public R sendInvite(@RequestBody MartialJudgeInvite judgeInvite) {
+	public R sendInvite(@Valid @RequestBody MartialJudgeInvite judgeInvite) {
 		// TODO: 实现邮件/短信发送逻辑
 		judgeInvite.setInviteStatus(0); // 待回复
 		judgeInvite.setInviteTime(java.time.LocalDateTime.now());
@@ -145,6 +156,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 重发邀请
 	 */
 	@PostMapping("/resend/{inviteId}")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "重发邀请", description = "重新发送邀请")
 	public R resendInvite(@PathVariable Long inviteId) {
 		MartialJudgeInvite invite = judgeInviteService.getById(inviteId);
@@ -160,6 +172,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 取消邀请
 	 */
 	@PostMapping("/cancel/{inviteId}")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "取消邀请", description = "取消邀请")
 	public R cancelInvite(@PathVariable Long inviteId, @RequestParam(required = false) String reason) {
 		MartialJudgeInvite invite = judgeInviteService.getById(inviteId);
@@ -175,6 +188,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 确认邀请
 	 */
 	@PostMapping("/confirm/{inviteId}")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "确认邀请", description = "确认接受邀请")
 	public R confirmInvite(@PathVariable Long inviteId) {
 		MartialJudgeInvite invite = judgeInviteService.getById(inviteId);
@@ -192,6 +206,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 发送提醒
 	 */
 	@PostMapping("/reminder/{inviteId}")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "发送提醒", description = "提醒评委回复邀请")
 	public R sendReminder(@PathVariable Long inviteId, @RequestParam(required = false) String message) {
 		MartialJudgeInvite invite = judgeInviteService.getById(inviteId);
@@ -206,6 +221,7 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 从评委库导入
 	 */
 	@PostMapping("/import/pool")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "从评委库导入", description = "从评委库批量导入评委")
 	public R importFromPool(@RequestParam Long competitionId, @RequestParam String judgeIds) {
 		// TODO: 实现从评委库导入逻辑
@@ -229,17 +245,15 @@ public class MartialJudgeInviteController extends BladeController {
 	 * 更新邀请的项目分配
 	 */
 	@PutMapping("/updateProjects")
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@Operation(summary = "更新项目分配", description = "更新裁判邀请的项目分配")
-	public R updateProjects(@RequestBody java.util.Map<String, Object> params) {
-		Long inviteId = Long.valueOf(params.get("inviteId").toString());
-		String projects = params.get("projects").toString();
-		
-		MartialJudgeInvite invite = judgeInviteService.getById(inviteId);
+	public R updateProjects(@Valid @RequestBody UpdateInviteProjectsDTO dto) {
+		MartialJudgeInvite invite = judgeInviteService.getById(dto.getInviteId());
 		if (invite == null) {
 			return R.fail("邀请记录不存在");
 		}
-		
-		invite.setProjects(projects);
+
+		invite.setProjects(dto.getProjects());
 		boolean success = judgeInviteService.updateById(invite);
 		return success ? R.success("更新成功") : R.fail("更新失败");
 	}

src/main/java/org/springblade/modules/martial/controller/MartialJudgeProjectController.java

@@ -7,7 +7,9 @@ import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialJudgeProject;
 import org.springblade.modules.martial.service.IMartialJudgeProjectService;
@@ -51,6 +53,7 @@ public class MartialJudgeProjectController extends BladeController {
 	/**
 	 * Task 2.5: 批量分配裁判到项目
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/assign")
 	@Operation(summary = "分配裁判到项目", description = "批量分配裁判权限")
 	public R assign(
@@ -102,6 +105,7 @@ public class MartialJudgeProjectController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialLiveUpdateController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialLiveUpdate;
 import org.springblade.modules.martial.service.IMartialLiveUpdateService;
@@ -49,6 +51,7 @@ public class MartialLiveUpdateController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialLiveUpdate liveUpdate) {
@@ -58,6 +61,7 @@ public class MartialLiveUpdateController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialProjectController.java

@@ -7,9 +7,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.core.tool.utils.StringUtil;
 import org.springblade.modules.martial.pojo.entity.MartialProject;
@@ -76,6 +78,7 @@ public class MartialProjectController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialProject project) {
@@ -108,6 +111,7 @@ public class MartialProjectController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialRegistrationOrderController.java

@@ -488,6 +488,7 @@ public class MartialRegistrationOrderController extends BladeController {
 		return R.data(order);
 	}
 
+	@PreAuth(RoleConstant.HAS_ROLE_USER)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialResultController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialResult;
 import org.springblade.modules.martial.service.IMartialResultService;
@@ -49,6 +51,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialResult result) {
@@ -58,6 +61,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
@@ -69,6 +73,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 计算运动员最终成绩
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/calculate")
 	@Operation(summary = "计算最终成绩", description = "根据裁判评分计算运动员最终成绩")
 	public R<MartialResult> calculateScore(
@@ -82,6 +87,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 项目自动排名
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/ranking")
 	@Operation(summary = "自动排名", description = "根据最终成绩自动排名")
 	public R autoRanking(@RequestParam Long projectId) {
@@ -92,6 +98,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 分配奖牌
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/medals")
 	@Operation(summary = "分配奖牌", description = "为前三名分配金银铜牌")
 	public R assignMedals(@RequestParam Long projectId) {
@@ -102,6 +109,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 成绩复核
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/review")
 	@Operation(summary = "成绩复核", description = "复核并调整成绩")
 	public R reviewResult(
@@ -116,6 +124,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 发布成绩
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/publish")
 	@Operation(summary = "发布成绩", description = "将成绩标记为最终并发布")
 	public R publishResults(@RequestParam Long projectId) {
@@ -126,6 +135,7 @@ public class MartialResultController extends BladeController {
 	/**
 	 * 撤销发布
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/unpublish")
 	@Operation(summary = "撤销发布", description = "撤销成绩发布状态")
 	public R unpublishResults(@RequestParam Long projectId) {

src/main/java/org/springblade/modules/martial/controller/MartialScheduleArrangeController.java

@@ -12,9 +12,11 @@ import org.springblade.core.secure.utils.AuthUtil;
 import org.springblade.core.tool.api.R;
 import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.modules.martial.config.ScheduleConfig;
+import org.springblade.modules.martial.pojo.dto.AutoArrangeDTO;
 import org.springblade.modules.martial.pojo.dto.MoveScheduleGroupDTO;
 import org.springblade.modules.martial.pojo.dto.SaveScheduleDraftDTO;
 import org.springblade.modules.martial.pojo.dto.ScheduleResultDTO;
+import org.springblade.modules.martial.pojo.dto.UpdateCheckInStatusDTO;
 import org.springblade.modules.martial.service.IMartialScheduleArrangeService;
 import org.springblade.modules.martial.service.IMartialScheduleService;
 import org.springframework.validation.annotation.Validated;
@@ -110,10 +112,9 @@ public class MartialScheduleArrangeController extends BladeController {
 	 */
 	@PostMapping("/auto-arrange")
 	@Operation(summary = "手动触发自动编排", description = "传入赛事ID,仅用于测试")
-	public R autoArrange(@RequestBody Map<String, Object> params) {
+	public R autoArrange(@Valid @RequestBody AutoArrangeDTO dto) {
 		try {
-			Long competitionId = Long.valueOf(String.valueOf(params.get("competitionId")));
-			scheduleArrangeService.autoArrange(competitionId);
+			scheduleArrangeService.autoArrange(dto.getCompetitionId());
 			return R.success("自动编排完成");
 		} catch (Exception e) {
 			log.error("自动编排失败", e);
@@ -190,11 +191,9 @@ public class MartialScheduleArrangeController extends BladeController {
 	 */
 	@PostMapping("/update-check-in-status")
 	@Operation(summary = "更新签到状态", description = "更新参赛者签到状态：未签到/已签到/异常")
-	public R updateCheckInStatus(@RequestBody java.util.Map<String, Object> params) {
+	public R updateCheckInStatus(@Valid @RequestBody UpdateCheckInStatusDTO dto) {
 		try {
-			Long participantId = Long.valueOf(String.valueOf(params.get("participantId")));
-			String status = String.valueOf(params.get("status"));
-			boolean success = scheduleService.updateParticipantCheckInStatus(participantId, status);
+			boolean success = scheduleService.updateParticipantCheckInStatus(dto.getParticipantId(), dto.getStatus());
 			return success ? R.success("状态更新成功") : R.fail("状态更新失败");
 		} catch (Exception e) {
 			log.error("更新签到状态失败", e);

src/main/java/org/springblade/modules/martial/controller/MartialScheduleAthleteController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialScheduleAthlete;
 import org.springblade.modules.martial.service.IMartialScheduleAthleteService;
@@ -49,6 +51,7 @@ public class MartialScheduleAthleteController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialScheduleAthlete scheduleAthlete) {
@@ -58,6 +61,7 @@ public class MartialScheduleAthleteController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialScheduleController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.dto.SaveScheduleDraftDTO;
 import org.springblade.modules.martial.pojo.dto.ScheduleResultDTO;
@@ -51,6 +53,7 @@ public class MartialScheduleController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialSchedule schedule) {
@@ -60,6 +63,7 @@ public class MartialScheduleController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/controller/MartialSchedulePlanController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.dto.AthleteOrderDTO;
 import org.springblade.modules.martial.pojo.dto.MoveAthletesDTO;
@@ -57,6 +59,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialSchedulePlan schedulePlan) {
@@ -66,6 +69,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
@@ -77,6 +81,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 自动编排
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/auto-schedule")
 	@Operation(summary = "自动编排", description = "根据赛事ID自动生成编排方案")
 	public R<MartialSchedulePlan> autoSchedule(@RequestParam Long competitionId) {
@@ -97,6 +102,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 检测移动冲突
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/check-move-conflicts")
 	@Operation(summary = "检测移动冲突", description = "检测移动运动员是否会产生冲突")
 	public R<List<MartialScheduleConflict>> checkMoveConflicts(@RequestBody MoveAthletesDTO moveDTO) {
@@ -107,6 +113,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 移动运动员
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/move-athletes")
 	@Operation(summary = "移动运动员", description = "批量移动运动员到其他时间槽")
 	public R<Boolean> moveAthletes(@RequestBody MoveAthletesDTO moveDTO) {
@@ -117,6 +124,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 调整出场顺序
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/update-order")
 	@Operation(summary = "调整出场顺序", description = "调整场地内运动员出场顺序")
 	public R<Boolean> updateAppearanceOrder(
@@ -130,6 +138,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 确认并发布方案
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/confirm-and-publish")
 	@Operation(summary = "确认并发布", description = "确认编排方案并发布")
 	public R<Boolean> confirmAndPublish(@RequestParam Long planId) {
@@ -140,6 +149,7 @@ public class MartialSchedulePlanController extends BladeController {
 	/**
 	 * 解决冲突
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/resolve-conflicts")
 	@Operation(summary = "解决冲突", description = "标记冲突为已解决")
 	public R<Boolean> resolveConflicts(

src/main/java/org/springblade/modules/martial/controller/MartialScoreController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialScore;
 import org.springblade.modules.martial.pojo.vo.MartialScoreVO;
@@ -52,6 +54,7 @@ public class MartialScoreController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialScore score) {
@@ -61,6 +64,7 @@ public class MartialScoreController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {
@@ -83,6 +87,7 @@ public class MartialScoreController extends BladeController {
 	/**
 	 * Task 2.2: 批量验证评分
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/validate")
 	@Operation(summary = "批量验证评分", description = "验证运动员项目的所有评分是否有效")
 	public R validateScores(

src/main/java/org/springblade/modules/martial/controller/MartialTeamController.java

@@ -29,6 +29,9 @@ public class MartialTeamController extends BladeController {
 	@Operation(summary = "分页列表", description = "获取当前用户的集体列表")
 	public R<IPage<MartialTeamVO>> list(Query query) {
 		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		IPage<MartialTeamVO> pages = teamService.getTeamList(userId, query.getCurrent(), query.getSize());
 		return R.data(pages);
 	}
@@ -36,18 +39,26 @@ public class MartialTeamController extends BladeController {
 	@GetMapping("/detail")
 	@Operation(summary = "详情", description = "获取集体详情")
 	public R<MartialTeamVO> detail(@RequestParam Long id) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		return R.data(teamService.getTeamDetail(id));
 	}
 
 	@PostMapping("/submit")
 	@Operation(summary = "保存", description = "新增或修改集体")
 	public R<Boolean> submit(@RequestBody TeamSubmitDTO dto) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		log.info("Team submit - teamId: {}, teamName: {}, memberIds: {}", dto.getTeamId(), dto.getTeamName(), dto.getMemberIds());
-		
+
 		MartialTeam team = new MartialTeam();
 		team.setTeamName(dto.getTeamName());
 		team.setRemark(dto.getRemark());
-		
+
 		boolean result;
 		if (StringUtil.isNotBlank(dto.getTeamId())) {
 			Long teamId = Long.parseLong(dto.getTeamId());
@@ -64,6 +75,10 @@ public class MartialTeamController extends BladeController {
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "删除集体")
 	public R<Boolean> remove(@RequestParam Long id) {
+		Long userId = AuthUtil.getUserId();
+		if (userId == null || userId <= 0) {
+			return R.fail("请先登录");
+		}
 		return R.data(teamService.removeTeamWithMembers(id));
 	}
 

src/main/java/org/springblade/modules/martial/controller/MartialVenueController.java

@@ -5,9 +5,11 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
+import org.springblade.core.secure.annotation.PreAuth;
 import org.springblade.core.mp.support.Condition;
 import org.springblade.core.mp.support.Query;
 import org.springblade.core.tool.api.R;
+import org.springblade.core.tool.constant.RoleConstant;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.modules.martial.pojo.entity.MartialVenue;
 import org.springblade.modules.martial.service.IMartialVenueService;
@@ -49,6 +51,7 @@ public class MartialVenueController extends BladeController {
 	/**
 	 * 新增或修改
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/submit")
 	@Operation(summary = "新增或修改", description = "传入实体")
 	public R submit(@RequestBody MartialVenue venue) {
@@ -58,6 +61,7 @@ public class MartialVenueController extends BladeController {
 	/**
 	 * 删除
 	 */
+	@PreAuth(RoleConstant.HAS_ROLE_ADMIN)
 	@PostMapping("/remove")
 	@Operation(summary = "删除", description = "传入ID")
 	public R remove(@RequestParam String ids) {

src/main/java/org/springblade/modules/martial/pojo/dto/AutoArrangeDTO.java

@@ -0,0 +1,21 @@
+package org.springblade.modules.martial.pojo.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+import java.io.Serializable;
+
+/**
+ * 手动触发自动编排请求DTO
+ */
+@Data
+@Schema(description = "手动触发自动编排请求DTO")
+public class AutoArrangeDTO implements Serializable {
+
+	private static final long serialVersionUID = 1L;
+
+	@NotNull(message = "赛事ID不能为空")
+	@Schema(description = "赛事ID", required = true)
+	private Long competitionId;
+}

src/main/java/org/springblade/modules/martial/pojo/dto/BatchSaveRulesContentsDTO.java

@@ -0,0 +1,28 @@
+package org.springblade.modules.martial.pojo.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotEmpty;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+import java.io.Serializable;
+import java.util.List;
+
+/**
+ * 批量保存规程内容DTO
+ */
+@Data
+@Schema(description = "批量保存规程内容DTO")
+public class BatchSaveRulesContentsDTO implements Serializable {
+
+	private static final long serialVersionUID = 1L;
+
+	@NotNull(message = "章节ID不能为空")
+	@Schema(description = "章节ID", required = true)
+	private Long chapterId;
+
+	@NotEmpty(message = "章节内容不能为空")
+	@Schema(description = "章节内容列表", required = true)
+	private List<@NotBlank(message = "章节内容不能为空") String> contents;
+}

src/main/java/org/springblade/modules/martial/pojo/dto/UpdateCheckInStatusDTO.java

@@ -0,0 +1,26 @@
+package org.springblade.modules.martial.pojo.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+import java.io.Serializable;
+
+/**
+ * 更新签到状态请求DTO
+ */
+@Data
+@Schema(description = "更新签到状态请求DTO")
+public class UpdateCheckInStatusDTO implements Serializable {
+
+	private static final long serialVersionUID = 1L;
+
+	@NotNull(message = "参赛记录ID不能为空")
+	@Schema(description = "参赛记录ID", required = true)
+	private Long participantId;
+
+	@NotBlank(message = "签到状态不能为空")
+	@Schema(description = "签到状态", required = true)
+	private String status;
+}

src/main/java/org/springblade/modules/martial/pojo/dto/UpdateInviteProjectsDTO.java

@@ -0,0 +1,25 @@
+package org.springblade.modules.martial.pojo.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+import java.io.Serializable;
+
+/**
+ * 更新裁判邀请项目分配DTO
+ */
+@Data
+@Schema(description = "更新裁判邀请项目分配DTO")
+public class UpdateInviteProjectsDTO implements Serializable {
+
+	private static final long serialVersionUID = 1L;
+
+	@NotNull(message = "邀请ID不能为空")
+	@Schema(description = "邀请ID", required = true)
+	private Long inviteId;
+
+	@NotNull(message = "项目分配不能为空")
+	@Schema(description = "项目分配(JSON字符串)", required = true)
+	private String projects;
+}