fix(upms): register user can not set roleId

特别重要的更新，涉及安全问题

pigx-upms/pigx-upms-api/src/main/java/com/pig4cloud/pigx/admin/api/dto/RegisterUserDTO.java

@@ -0,0 +1,33 @@
+package com.pig4cloud.pigx.admin.api.dto;
+
+import lombok.Data;
+
+/**
+ * 注册用户 DTO
+ *
+ * @author lengleng
+ * @date 2024/12/23
+ */
+@Data
+public class RegisterUserDTO {
+
+    /**
+     * 用户名
+     */
+    private String username;
+
+    /**
+     * 密码
+     */
+    private String password;
+
+    /**
+     * 新密码1
+     */
+    private String newpassword1;
+
+    /**
+     * 电话
+     */
+    private String phone;
+}

pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/controller/SysRegisterController.java

@@ -1,6 +1,6 @@
 package com.pig4cloud.pigx.admin.controller;
 
-import com.pig4cloud.pigx.admin.api.dto.UserDTO;
+import com.pig4cloud.pigx.admin.api.dto.RegisterUserDTO;
 import com.pig4cloud.pigx.admin.service.SysUserService;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.log.annotation.SysLog;
@@ -22,7 +22,7 @@ import org.springframework.web.bind.annotation.RestController;
 @RestController
 @RequestMapping("/register")
 @RequiredArgsConstructor
-public class RegisterController {
+public class SysRegisterController {
 
     private final SysUserService userService;
 
@@ -35,7 +35,7 @@ public class RegisterController {
     @SysLog("注册用户")
     @PostMapping("/user")
     @ConditionalOnProperty(name = "register.user", matchIfMissing = true)
-    public R<Boolean> registerUser(@RequestBody UserDTO userDto) {
+    public R<Boolean> registerUser(@RequestBody RegisterUserDTO userDto) {
         return userService.registerUser(userDto);
     }
 
@@ -47,7 +47,7 @@ public class RegisterController {
      */
     @SysLog("重置用户密码")
     @PostMapping("/password")
-    public R<Boolean> resetUserPassword(@RequestBody UserDTO userDto) {
+    public R<Boolean> resetUserPassword(@RequestBody RegisterUserDTO userDto) {
         return userService.resetUserPassword(userDto);
     }
 

pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/service/SysUserService.java

@@ -22,6 +22,7 @@ package com.pig4cloud.pigx.admin.service;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.IService;
+import com.pig4cloud.pigx.admin.api.dto.RegisterUserDTO;
 import com.pig4cloud.pigx.admin.api.dto.UserDTO;
 import com.pig4cloud.pigx.admin.api.dto.UserInfo;
 import com.pig4cloud.pigx.admin.api.entity.SysUser;
@@ -127,7 +128,7 @@ public interface SysUserService extends IService<SysUser> {
      * @param userDto 用户信息
      * @return success/false
      */
-    R<Boolean> registerUser(UserDTO userDto);
+    R<Boolean> registerUser(RegisterUserDTO userDto);
 
     /**
      * 锁定用户
@@ -184,5 +185,5 @@ public interface SysUserService extends IService<SysUser> {
      * @param userDto 用户信息
      * @return
      */
-    R<Boolean> resetUserPassword(UserDTO userDto);
+    R<Boolean> resetUserPassword(RegisterUserDTO userDto);
 }

pigx-upms/pigx-upms-biz/src/main/java/com/pig4cloud/pigx/admin/service/impl/SysUserServiceImpl.java

@@ -29,6 +29,7 @@ import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.pig4cloud.pigx.admin.api.constant.UserStateEnum;
+import com.pig4cloud.pigx.admin.api.dto.RegisterUserDTO;
 import com.pig4cloud.pigx.admin.api.dto.UserDTO;
 import com.pig4cloud.pigx.admin.api.dto.UserInfo;
 import com.pig4cloud.pigx.admin.api.entity.*;
@@ -427,7 +428,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
      */
     @Override
     @Transactional(rollbackFor = Exception.class)
-    public R<Boolean> registerUser(UserDTO userDto) {
+    public R<Boolean> registerUser(RegisterUserDTO userDto) {
         // 判断用户名是否存在
         boolean usernameExists = this.exists(Wrappers.<SysUser>lambdaQuery()
                 .eq(SysUser::getUsername, userDto.getUsername()));
@@ -443,7 +444,11 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
             String message = MsgUtils.getMessage(ErrorCodes.SYS_USER_PHONE_EXISTING, userDto.getPhone());
             return R.failed(message);
         }
-        return R.ok(saveUser(userDto));
+
+        // 单独的用户避免越权
+        UserDTO user = new UserDTO();
+        BeanUtils.copyProperties(userDto, user);
+        return R.ok(saveUser(user));
     }
 
     /**
@@ -547,7 +552,7 @@ public class SysUserServiceImpl extends ServiceImpl<SysUserMapper, SysUser> impl
      */
     @Override
     @CacheEvict(value = CacheConstants.USER_DETAILS, key = "#userDto.username")
-    public R<Boolean> resetUserPassword(UserDTO userDto) {
+    public R<Boolean> resetUserPassword(RegisterUserDTO userDto) {
         // 校验密码
         R checkedPassword = checkPassword(userDto.getUsername(), userDto.getPassword());
         if (!checkedPassword.isOk()) {