From 15fb0df080e3cfae4c64ce4e675d0d251c92c362 Mon Sep 17 00:00:00 2001
From: PIGCLOUD <wangiegie@gmail.com>
Date: Wed, 1 Jul 2026 16:48:32 +0800
Subject: [PATCH] fix(upms): restrict user list by ids to inner calls

---
 .../com/pig4cloud/pigx/admin/api/feign/RemoteUserService.java    | 1 +
 .../com/pig4cloud/pigx/admin/controller/SysUserController.java   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/pigx-upms/pigx-upms-api/src/main/java/com/pig4cloud/pigx/admin/api/feign/RemoteUserService.java b/pigx-upms/pigx-upms-api/src/main/java/com/pig4cloud/pigx/admin/api/feign/RemoteUserService.java
index 975c969b1..64c153372 100644
--- a/pigx-upms/pigx-upms-api/src/main/java/com/pig4cloud/pigx/admin/api/feign/RemoteUserService.java
+++ b/pigx-upms/pigx-upms-api/src/main/java/com/pig4cloud/pigx/admin/api/feign/RemoteUserService.java
@@ -53,6 +53,7 @@ public interface RemoteUserService {
      * @param userIds ID
      * @return SysUser
      */
+    @NoToken
     @GetMapping("/user/list")
     R<List<SysUser>> getUserById(@RequestParam("userIds") List<Long> userIds);
 
diff --git a/pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/controller/SysUserController.java b/pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/controller/SysUserController.java
index edf66b850..5a935ce1d 100644
--- a/pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/controller/SysUserController.java
+++ b/pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/controller/SysUserController.java
@@ -322,6 +322,7 @@ public class SysUserController {
      * @param userIds ID列表
      * @return 用户列表
      */
+    @Inner
     @GetMapping("/list")
     public R<List<SysUser>> getUserListByIds(@RequestParam("userIds") List<Long> userIds) {
         return R.ok(TenantBroker