Merge branch 'master' of https://gitea.zianxin.com/zax/biz-api-cloud

pjcloud-app-server/pjcloud-app-server-api/src/main/java/com/bsd/pjcloud/app/api/constant/menu/AppMenuPlatformEnum.java

@@ -14,6 +14,7 @@ import java.util.Arrays;
 public enum AppMenuPlatformEnum {
 
     WECHAT("10", "微信小程序"),
+    ZZD("30", "浙政钉"),
     ;
 
     private final String type;

pjcloud-integrated/pjcloud-integrated-biz/src/main/java/com/bsd/pjcloud/integrated/controller/AppMenuOpenController.java

@@ -57,7 +57,11 @@ public class AppMenuOpenController {
         if (!isValidAppCredentials(appId, appSecret)) {
             return R.failed("无效的应用ID或密钥");
         }
-        return remoteAppMenuService.innerAppList(typeEnum, platformEnum);
+        //todo 由于浙政钉还要irs发布太麻烦，先写死吧，下次更新在由前端控制
+        R<List<AppMenuEntity>> listR = remoteAppMenuService.innerAppList(typeEnum, AppMenuPlatformEnum.ZZD);
+//        List<AppMenuEntity> list = listR.getData().stream().filter(appMenu -> appMenu.getZzdVisible() != null).toList();
+//        listR.setData(list);
+        return listR;
     }
 
     private boolean isValidAppCredentials(String appId, String appSecret) {

pjcloud-thirdparty/pjcloud-thirdparty-biz/src/main/java/com/bsd/pjcloud/thirdparty/controller/ThirdPartyOAth2Cotroller.java

@@ -320,12 +320,12 @@ public class ThirdPartyOAth2Cotroller {
         String generate = DeviceFingerprintUtil.generate(httpServletRequest);
         R<UserTrustedDeviceEntity> userTrustedDeviceR = remoteUserTrustedDeviceService.getUserTrustedDeviceByIdAndMD5(dto.getMobilePhone(), generate, SH_DEVICE_NAME);
         if (userTrustedDeviceR.getData() != null) {
-            userTrustedDeviceR.getData().setExpireTime(LocalDateTime.now().plusMonths(3));
+            userTrustedDeviceR.getData().setExpireTime(LocalDateTime.now().plusMonths(6));
             remoteUserTrustedDeviceService.updateById(userTrustedDeviceR.getData());
         } else {
             UserTrustedDeviceEntity userTrustedDevice = new UserTrustedDeviceEntity();
             userTrustedDevice.setMobilePhone(dto.getMobilePhone());
-            userTrustedDevice.setExpireTime(LocalDateTime.now().plusMonths(3));
+            userTrustedDevice.setExpireTime(LocalDateTime.now().plusMonths(6));
             userTrustedDevice.setDeviceName(SH_DEVICE_NAME);
             userTrustedDevice.setDeviceFingerprint(generate);
             remoteUserTrustedDeviceService.save(userTrustedDevice);

pjcloud-thirdparty/pjcloud-thirdparty-biz/src/main/resources/application.yml

@@ -47,8 +47,8 @@ zzd:
     domain: openplatform-pro.ding.zj.gov.cn
 #    domain: openplatform.dg-work.cn
     tenant-id: "196729"
-    app-key: ${ZZD_OPEN_APP_KEY:pjx_zhhqyth-wt2VrVa0olcqEBBJJb}
-    app-secret: ${ZZD_OPEN_APP_SECRET:rT5zbpHO0L7raRHJtvlIs26N8hn53JDv1K1SNa7X}
+    app-key: ${ZZD_OPEN_APP_KEY:pjx_zhhqyht-b6HV85D3Fc7EfiUBNr}
+    app-secret: ${ZZD_OPEN_APP_SECRET:3GWA7Hk73xI3gQ8zxLZhZo2M92a07dTI1tVqTU7S}
     # H5 使用 dd.authConfig 时仅需 ak/sk；jsapi-agent-id 为旧版 dd.config 方案保留，可不配
     # jsapi-agent-id:
 

pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserController.java

@@ -47,6 +47,7 @@ import com.bsd.pjcloud.common.excel.annotation.ResponseExcel;
 import com.bsd.pjcloud.common.log.annotation.SysLog;
 import com.bsd.pjcloud.common.security.annotation.HasPermission;
 import com.bsd.pjcloud.common.security.annotation.Inner;
+import com.bsd.pjcloud.common.security.component.PermissionService;
 import com.bsd.pjcloud.common.security.service.PjcloudUser;
 import com.bsd.pjcloud.common.security.util.SecurityUtils;
 import com.bsd.pjcloud.flow.task.dto.ProcessNodeRecordAssignUserParamDto;
@@ -65,12 +66,14 @@ import lombok.AllArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.springdoc.core.annotations.ParameterObject;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.CollectionUtils;
 import org.springframework.validation.BindingResult;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -99,6 +102,8 @@ public class SysUserController {
 
     private final SysUserRoleService sysUserRoleService;
 
+    private final PermissionService permissionService;
+
     /* ************************************* start 回调 start ************************************* */
 
     @Inner(value = false)
@@ -194,6 +199,7 @@ public class SysUserController {
 
     @GetMapping("/get-by-user-id")
     public R getByUserId(@RequestParam Long userId) {
+        assertUserDetailAllowed(userId);
         SysUser user = userService.getOne(Wrappers.<SysUser>query().lambda().eq(SysUser::getUserId, userId));
         if (user == null) return R.failed(MsgUtils.getMessage(ErrorCodes.SYS_USER_USERINFO_EMPTY, userId));
         return R.ok(userService.findUserInfo(user));
@@ -226,6 +232,7 @@ public class SysUserController {
      */
     @GetMapping("/details/{id}")
     public R user(@PathVariable Long id) {
+        assertUserDetailAllowed(id);
         return R.ok(userService.selectUserVoById(id));
     }
 
@@ -578,4 +585,21 @@ public class SysUserController {
         }).collect(Collectors.toList());
         return R.ok(userVOList);
     }
+
+    /**
+     * 用户详情：仅本人或具备用户管理类权限的管理员可查看指定 userId
+     */
+    private void assertUserDetailAllowed(Long targetUserId) {
+        PjcloudUser current = SecurityUtils.getUser();
+        if (current == null || current.getId() == null) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, MsgUtils.getMessage(ErrorCodes.SYS_USER_QUERY_ERROR));
+        }
+        if (targetUserId != null && targetUserId.equals(current.getId())) {
+            return;
+        }
+        if (permissionService.hasPermission("sys_user_add", "sys_user_edit", "sys_user_del", "sys_user_export")) {
+            return;
+        }
+        throw new ResponseStatusException(HttpStatus.FORBIDDEN, "无权限查看该用户信息");
+    }
 }