diff --git a/src/main/java/org/springblade/modules/martial/controller/MartialAthleteController.java b/src/main/java/org/springblade/modules/martial/controller/MartialAthleteController.java index 265dc1f..7da8bfb 100644 --- a/src/main/java/org/springblade/modules/martial/controller/MartialAthleteController.java +++ b/src/main/java/org/springblade/modules/martial/controller/MartialAthleteController.java @@ -1,8 +1,6 @@ package org.springblade.modules.martial.controller; import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper; -import java.time.LocalDateTime; -import java.util.List; import com.baomidou.mybatisplus.core.metadata.IPage; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import io.swagger.v3.oas.annotations.Operation; @@ -23,6 +21,9 @@ import org.springblade.modules.martial.service.IMartialAthleteService; import org.springblade.modules.martial.service.IMartialCompetitionService; import org.springframework.web.bind.annotation.*; +import java.time.LocalDateTime; +import java.util.List; + /** * 参赛选手 控制器 * @@ -44,7 +45,17 @@ public class MartialAthleteController extends BladeController { @GetMapping("/detail") @Operation(summary = "详情", description = "传入ID") public R detail(@RequestParam Long id) { + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + return R.fail("请先登录"); + } MartialAthlete detail = athleteService.getById(id); + if (detail == null) { + return R.fail("选手不存在"); + } + if (!isAdminUser() && !userId.equals(detail.getCreateUser())) { + return R.fail("无权限访问该选手"); + } return R.data(detail); } @@ -54,6 +65,13 @@ public class MartialAthleteController extends BladeController { @GetMapping("/list") @Operation(summary = "分页列表", description = "分页查询") public R> list(MartialAthlete athlete, Query query, @RequestParam(required = false, defaultValue = "false") Boolean includeTeamRecords) { + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + return R.fail("请先登录"); + } + if (!isAdminUser()) { + athlete.setCreateUser(userId); + } IPage pages = athleteService.selectAthleteVOPage(Condition.getPage(query), athlete, includeTeamRecords); return R.data(pages); } @@ -100,10 +118,21 @@ public class MartialAthleteController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } - log.info("=== 提交选手 === userId: {}, playerName: {}", userId, athlete.getPlayerName()); - if (athlete.getId() == null) { + + if (athlete.getId() != null) { + MartialAthlete existing = athleteService.getById(athlete.getId()); + if (existing == null) { + return R.fail("选手不存在"); + } + if (!isAdminUser() && !userId.equals(existing.getCreateUser())) { + return R.fail("无权限修改该选手"); + } + athlete.setCreateUser(existing.getCreateUser()); + } else { athlete.setCreateUser(userId); } + + log.info("=== 提交选手 === userId: {}, playerName: {}", userId, athlete.getPlayerName()); athlete.setUpdateUser(userId); return R.status(athleteService.saveOrUpdate(athlete)); } @@ -118,7 +147,21 @@ public class MartialAthleteController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } - return R.status(athleteService.removeByIds(Func.toLongList(ids))); + List idList = Func.toLongList(ids); + if (idList.isEmpty()) { + return R.fail("请选择要删除的选手"); + } + if (!isAdminUser()) { + long ownCount = athleteService.lambdaQuery() + .in(MartialAthlete::getId, idList) + .eq(MartialAthlete::getCreateUser, userId) + .eq(MartialAthlete::getIsDeleted, 0) + .count(); + if (ownCount != idList.size()) { + return R.fail("仅可删除自己的选手"); + } + } + return R.status(athleteService.removeByIds(idList)); } /** @@ -131,6 +174,9 @@ public class MartialAthleteController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + if (!isAdminUser()) { + return R.fail("无权限操作"); + } athleteService.checkIn(athleteId, scheduleId); return R.success("签到成功"); } @@ -145,6 +191,9 @@ public class MartialAthleteController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + if (!isAdminUser()) { + return R.fail("无权限操作"); + } athleteService.completePerformance(athleteId, scheduleId); return R.success("已标记完成"); } @@ -159,6 +208,9 @@ public class MartialAthleteController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + if (!isAdminUser()) { + return R.fail("无权限操作"); + } athleteService.updateCompetitionStatus(athleteId, status); return R.success("状态更新成功"); } @@ -169,19 +221,28 @@ public class MartialAthleteController extends BladeController { @GetMapping("/registered") @Operation(summary = "获取已报名选手", description = "查询指定赛事和项目的已报名选手") public R> getRegisteredAthletes( - @RequestParam Long competitionId, - @RequestParam(required = false) String projectIds) { + @RequestParam Long competitionId, + @RequestParam(required = false) String projectIds) { + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + return R.fail("请先登录"); + } LambdaQueryWrapper wrapper = new LambdaQueryWrapper<>(); wrapper.eq(MartialAthlete::getCompetitionId, competitionId) .eq(MartialAthlete::getIsDeleted, 0) .eq(MartialAthlete::getRegistrationStatus, 1); - + if (!isAdminUser()) { + wrapper.eq(MartialAthlete::getCreateUser, userId); + } if (Func.isNotBlank(projectIds)) { wrapper.in(MartialAthlete::getProjectId, Func.toLongList(projectIds)); } - List list = athleteService.list(wrapper); return R.data(list); } + private boolean isAdminUser() { + return AuthUtil.isAdmin() || AuthUtil.isAdministrator(); + } + } diff --git a/src/main/java/org/springblade/modules/martial/controller/MartialContactController.java b/src/main/java/org/springblade/modules/martial/controller/MartialContactController.java index 5bd8bdb..278f173 100644 --- a/src/main/java/org/springblade/modules/martial/controller/MartialContactController.java +++ b/src/main/java/org/springblade/modules/martial/controller/MartialContactController.java @@ -14,6 +14,8 @@ import org.springblade.modules.martial.pojo.entity.MartialContact; import org.springblade.modules.martial.service.IMartialContactService; import org.springframework.web.bind.annotation.*; +import java.util.List; + @Slf4j @RestController @AllArgsConstructor @@ -41,7 +43,15 @@ public class MartialContactController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } - return R.data(contactService.getContactDetail(id)); + MartialContact contact = contactService.lambdaQuery() + .eq(MartialContact::getId, id) + .eq(MartialContact::getCreateUser, userId) + .eq(MartialContact::getIsDeleted, 0) + .one(); + if (contact == null) { + return R.fail("联系人不存在或无权限访问"); + } + return R.data(contact); } @PostMapping("/submit") @@ -51,6 +61,21 @@ public class MartialContactController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + + if (contact.getId() != null) { + MartialContact existing = contactService.lambdaQuery() + .eq(MartialContact::getId, contact.getId()) + .eq(MartialContact::getCreateUser, userId) + .eq(MartialContact::getIsDeleted, 0) + .one(); + if (existing == null) { + return R.fail("联系人不存在或无权限修改"); + } + contact.setCreateUser(existing.getCreateUser()); + } else { + contact.setCreateUser(userId); + } + log.info("Contact submit - id: {}, name: {}, userId: {}, isDefault: {}", contact.getId(), contact.getName(), userId, contact.getIsDefault()); @@ -64,7 +89,19 @@ public class MartialContactController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } - return R.data(contactService.removeByIds(Func.toLongList(ids))); + List idList = Func.toLongList(ids); + if (idList.isEmpty()) { + return R.fail("请选择要删除的联系人"); + } + long ownCount = contactService.lambdaQuery() + .in(MartialContact::getId, idList) + .eq(MartialContact::getCreateUser, userId) + .eq(MartialContact::getIsDeleted, 0) + .count(); + if (ownCount != idList.size()) { + return R.fail("仅可删除自己的联系人"); + } + return R.data(contactService.removeByIds(idList)); } } diff --git a/src/main/java/org/springblade/modules/martial/controller/MartialRegistrationOrderController.java b/src/main/java/org/springblade/modules/martial/controller/MartialRegistrationOrderController.java index c5818fc..216f079 100644 --- a/src/main/java/org/springblade/modules/martial/controller/MartialRegistrationOrderController.java +++ b/src/main/java/org/springblade/modules/martial/controller/MartialRegistrationOrderController.java @@ -488,11 +488,27 @@ public class MartialRegistrationOrderController extends BladeController { return R.data(order); } + @PreAuth(RoleConstant.HAS_ROLE_USER) @PostMapping("/remove") @Operation(summary = "删除", description = "传入ID") public R remove(@RequestParam String ids) { - return R.status(registrationOrderService.removeByIds(Func.toLongList(ids))); + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + return R.fail("请先登录"); + } + List idList = Func.toLongList(ids); + if (idList.isEmpty()) { + return R.fail("请选择要删除的订单"); + } + long ownCount = registrationOrderService.lambdaQuery() + .in(MartialRegistrationOrder::getId, idList) + .eq(MartialRegistrationOrder::getUserId, userId) + .count(); + if (ownCount != idList.size()) { + return R.fail("仅可删除自己的订单"); + } + return R.status(registrationOrderService.removeByIds(idList)); } } diff --git a/src/main/java/org/springblade/modules/martial/controller/MartialTeamController.java b/src/main/java/org/springblade/modules/martial/controller/MartialTeamController.java index 32df1c1..88fdee3 100644 --- a/src/main/java/org/springblade/modules/martial/controller/MartialTeamController.java +++ b/src/main/java/org/springblade/modules/martial/controller/MartialTeamController.java @@ -43,6 +43,14 @@ public class MartialTeamController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + MartialTeam team = teamService.lambdaQuery() + .eq(MartialTeam::getId, id) + .eq(MartialTeam::getCreateUser, userId) + .eq(MartialTeam::getIsDeleted, 0) + .one(); + if (team == null) { + return R.fail("集体不存在或无权限访问"); + } return R.data(teamService.getTeamDetail(id)); } @@ -61,7 +69,22 @@ public class MartialTeamController extends BladeController { boolean result; if (StringUtil.isNotBlank(dto.getTeamId())) { - Long teamId = Long.parseLong(dto.getTeamId()); + Long teamId; + try { + teamId = Long.parseLong(dto.getTeamId()); + } catch (NumberFormatException e) { + return R.fail("集体ID格式错误"); + } + + MartialTeam existing = teamService.lambdaQuery() + .eq(MartialTeam::getId, teamId) + .eq(MartialTeam::getCreateUser, userId) + .eq(MartialTeam::getIsDeleted, 0) + .one(); + if (existing == null) { + return R.fail("集体不存在或无权限修改"); + } + team.setId(teamId); log.info("Updating team with id: {}", teamId); result = teamService.updateTeamWithMembers(team, dto.getMemberIds()); @@ -79,6 +102,14 @@ public class MartialTeamController extends BladeController { if (userId == null || userId <= 0) { return R.fail("请先登录"); } + MartialTeam team = teamService.lambdaQuery() + .eq(MartialTeam::getId, id) + .eq(MartialTeam::getCreateUser, userId) + .eq(MartialTeam::getIsDeleted, 0) + .one(); + if (team == null) { + return R.fail("集体不存在或无权限删除"); + } return R.data(teamService.removeTeamWithMembers(id)); } diff --git a/src/main/java/org/springblade/modules/martial/service/impl/MartialContactServiceImpl.java b/src/main/java/org/springblade/modules/martial/service/impl/MartialContactServiceImpl.java index 8475dc2..db79634 100644 --- a/src/main/java/org/springblade/modules/martial/service/impl/MartialContactServiceImpl.java +++ b/src/main/java/org/springblade/modules/martial/service/impl/MartialContactServiceImpl.java @@ -46,25 +46,28 @@ public class MartialContactServiceImpl extends ServiceImpl updateWrapper = new LambdaUpdateWrapper<>(); updateWrapper.eq(MartialContact::getCreateUser, userId) - .eq(MartialContact::getIsDeleted, 0) - .set(MartialContact::getIsDefault, false); - // Exclude current contact if it's an update + .eq(MartialContact::getIsDeleted, 0) + .set(MartialContact::getIsDefault, false); + // Exclude current contact if it is an update if (contact.getId() != null) { updateWrapper.ne(MartialContact::getId, contact.getId()); } this.update(updateWrapper); - log.info("Cleared default status for user {}'s other contacts", userId); + log.info("Cleared default status for user {} contacts", userId); } - - // Set audit fields + + Date now = new Date(); if (contact.getId() == null) { contact.setCreateUser(userId); - contact.setCreateTime(new Date()); + contact.setCreateTime(now); + contact.setUpdateUser(userId); + contact.setUpdateTime(now); + return this.save(contact); } + contact.setUpdateUser(userId); - contact.setUpdateTime(new Date()); - - return this.saveOrUpdate(contact); + contact.setUpdateTime(now); + return this.updateById(contact); } } diff --git a/src/main/java/org/springblade/modules/martial/service/impl/MartialTeamServiceImpl.java b/src/main/java/org/springblade/modules/martial/service/impl/MartialTeamServiceImpl.java index 369bbea..835470b 100644 --- a/src/main/java/org/springblade/modules/martial/service/impl/MartialTeamServiceImpl.java +++ b/src/main/java/org/springblade/modules/martial/service/impl/MartialTeamServiceImpl.java @@ -5,6 +5,8 @@ import com.baomidou.mybatisplus.core.metadata.IPage; import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import lombok.AllArgsConstructor; +import org.springblade.core.log.exception.ServiceException; +import org.springblade.core.secure.utils.AuthUtil; import org.springblade.modules.martial.mapper.MartialTeamMapper; import org.springblade.modules.martial.mapper.MartialTeamMemberMapper; import org.springblade.modules.martial.pojo.entity.MartialAthlete; @@ -16,7 +18,6 @@ import org.springblade.modules.martial.service.IMartialTeamService; import org.springframework.beans.BeanUtils; import org.springframework.stereotype.Service; import org.springframework.transaction.annotation.Transactional; -import org.springblade.core.secure.utils.AuthUtil; import java.time.LocalDateTime; import java.util.ArrayList; @@ -34,10 +35,16 @@ public class MartialTeamServiceImpl extends ServiceImpl memberIds) { + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + throw new ServiceException("请先登录"); + } + validateMemberOwnership(memberIds, userId); + team.setMemberCount(memberIds != null ? memberIds.size() : 0); - team.setCreateUser(AuthUtil.getUserId()); + team.setCreateUser(userId); boolean saved = this.save(team); - + if (saved && memberIds != null && !memberIds.isEmpty()) { for (Long athleteId : memberIds) { MartialTeamMember member = new MartialTeamMember(); @@ -49,23 +56,36 @@ public class MartialTeamServiceImpl extends ServiceImpl memberIds) { + Long userId = AuthUtil.getUserId(); + if (userId == null || userId <= 0) { + throw new ServiceException("请先登录"); + } + MartialTeam existing = this.getById(team.getId()); + if (existing == null || existing.getIsDeleted() != null && existing.getIsDeleted() == 1) { + throw new ServiceException("集体不存在"); + } + if (!AuthUtil.isAdmin() && !AuthUtil.isAdministrator() && !userId.equals(existing.getCreateUser())) { + throw new ServiceException("无权限修改该集体"); + } + validateMemberOwnership(memberIds, userId); + team.setMemberCount(memberIds != null ? memberIds.size() : 0); - team.setUpdateUser(AuthUtil.getUserId()); + team.setUpdateUser(userId); boolean updated = this.updateById(team); - + if (updated) { // Delete old members LambdaQueryWrapper deleteWrapper = new LambdaQueryWrapper<>(); deleteWrapper.eq(MartialTeamMember::getTeamId, team.getId()); teamMemberMapper.delete(deleteWrapper); - + // Insert new members if (memberIds != null && !memberIds.isEmpty()) { for (Long athleteId : memberIds) { @@ -79,7 +99,7 @@ public class MartialTeamServiceImpl extends ServiceImpl wrapper = new LambdaQueryWrapper<>(); wrapper.eq(MartialTeam::getCreateUser, createUser); wrapper.orderByDesc(MartialTeam::getCreateTime); - + IPage page = new Page<>(current, size); IPage teamPage = this.page(page, wrapper); - + IPage voPage = new Page<>(current, size, teamPage.getTotal()); - + if (teamPage.getRecords().isEmpty()) { voPage.setRecords(new ArrayList<>()); return voPage; } - + List voList = teamPage.getRecords().stream() - .map(team -> { - MartialTeamVO vo = new MartialTeamVO(); - BeanUtils.copyProperties(team, vo); - // Calculate actual member count (excluding deleted athletes) - int actualMemberCount = getActualMemberCount(team.getId()); - vo.setMemberCount(actualMemberCount); - return vo; - }) - .collect(Collectors.toList()); - + .map(team -> { + MartialTeamVO vo = new MartialTeamVO(); + BeanUtils.copyProperties(team, vo); + // Calculate actual member count (excluding deleted athletes) + int actualMemberCount = getActualMemberCount(team.getId()); + vo.setMemberCount(actualMemberCount); + return vo; + }) + .collect(Collectors.toList()); + voPage.setRecords(voList); return voPage; } @@ -122,15 +142,15 @@ public class MartialTeamServiceImpl extends ServiceImpl members = teamMemberMapper.selectList(memberWrapper); - + if (members.isEmpty()) { return 0; } - + List athleteIds = members.stream() - .map(MartialTeamMember::getAthleteId) - .collect(Collectors.toList()); - + .map(MartialTeamMember::getAthleteId) + .collect(Collectors.toList()); + LambdaQueryWrapper athleteWrapper = new LambdaQueryWrapper<>(); athleteWrapper.in(MartialAthlete::getId, athleteIds); athleteWrapper.eq(MartialAthlete::getIsDeleted, 0); @@ -143,46 +163,46 @@ public class MartialTeamServiceImpl extends ServiceImpl memberWrapper = new LambdaQueryWrapper<>(); memberWrapper.eq(MartialTeamMember::getTeamId, id); memberWrapper.eq(MartialTeamMember::getIsDeleted, 0); List teamMembers = teamMemberMapper.selectList(memberWrapper); - + if (!teamMembers.isEmpty()) { List athleteIds = teamMembers.stream() - .map(MartialTeamMember::getAthleteId) - .collect(Collectors.toList()); - + .map(MartialTeamMember::getAthleteId) + .collect(Collectors.toList()); + LambdaQueryWrapper athleteWrapper = new LambdaQueryWrapper<>(); athleteWrapper.in(MartialAthlete::getId, athleteIds); athleteWrapper.eq(MartialAthlete::getIsDeleted, 0); List athletes = athleteService.list(athleteWrapper); Map athleteMap = athletes.stream() - .collect(Collectors.toMap(MartialAthlete::getId, a -> a)); - + .collect(Collectors.toMap(MartialAthlete::getId, a -> a)); + List members = teamMembers.stream() - .map(tm -> { - MartialTeamVO.MemberInfo info = new MartialTeamVO.MemberInfo(); - MartialAthlete athlete = athleteMap.get(tm.getAthleteId()); - if (athlete != null) { - info.setId(athlete.getId()); - info.setName(athlete.getPlayerName()); - info.setIdCard(athlete.getIdCard()); - info.setGender(athlete.getGender()); - } - return info; - }) - .filter(info -> info.getId() != null) - .collect(Collectors.toList()); - + .map(tm -> { + MartialTeamVO.MemberInfo info = new MartialTeamVO.MemberInfo(); + MartialAthlete athlete = athleteMap.get(tm.getAthleteId()); + if (athlete != null) { + info.setId(athlete.getId()); + info.setName(athlete.getPlayerName()); + info.setIdCard(athlete.getIdCard()); + info.setGender(athlete.getGender()); + } + return info; + }) + .filter(info -> info.getId() != null) + .collect(Collectors.toList()); + vo.setMembers(members); } - + return vo; } @@ -193,9 +213,24 @@ public class MartialTeamServiceImpl extends ServiceImpl memberWrapper = new LambdaQueryWrapper<>(); memberWrapper.eq(MartialTeamMember::getTeamId, id); teamMemberMapper.delete(memberWrapper); - + // Delete team return this.removeById(id); } + private void validateMemberOwnership(List memberIds, Long userId) { + if (memberIds == null || memberIds.isEmpty()) { + return; + } + List distinctIds = memberIds.stream().distinct().collect(Collectors.toList()); + long ownCount = athleteService.lambdaQuery() + .in(MartialAthlete::getId, distinctIds) + .eq(MartialAthlete::getCreateUser, userId) + .eq(MartialAthlete::getIsDeleted, 0) + .count(); + if (ownCount != distinctIds.size()) { + throw new ServiceException("成员包含非本人选手"); + } + } + }