From 1561df924fbe05c55e4a78f64e9c4f3b43173c55 Mon Sep 17 00:00:00 2001 From: wjj <2069666735@qq.com> Date: Mon, 20 Jul 2026 11:26:58 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=B5=81=E6=B0=B4=E6=98=8E?= =?UTF-8?q?=E7=BB=86=E5=AF=BC=E5=87=BA=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../controller/CcdiBankStatementController.java | 2 -- ...project-read-access-backend-implementation.md | 15 +++++++++++++++ ...-bank-statement-export-project-read-access.md | 16 ++++++++++++++++ 3 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 docs/plans/backend/2026-07-20-bank-statement-export-project-read-access-backend-implementation.md create mode 100644 docs/reports/implementation/2026-07-20-bank-statement-export-project-read-access.md diff --git a/ccdi-project/src/main/java/com/ruoyi/ccdi/project/controller/CcdiBankStatementController.java b/ccdi-project/src/main/java/com/ruoyi/ccdi/project/controller/CcdiBankStatementController.java index 4d504285..cec48f6f 100644 --- a/ccdi-project/src/main/java/com/ruoyi/ccdi/project/controller/CcdiBankStatementController.java +++ b/ccdi-project/src/main/java/com/ruoyi/ccdi/project/controller/CcdiBankStatementController.java @@ -18,7 +18,6 @@ import io.swagger.v3.oas.annotations.Operation; import io.swagger.v3.oas.annotations.tags.Tag; import jakarta.annotation.Resource; import jakarta.servlet.http.HttpServletResponse; -import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.PostMapping; @@ -87,7 +86,6 @@ public class CcdiBankStatementController extends BaseController { */ @PostMapping("/export") @Operation(summary = "导出流水明细") - @PreAuthorize("@ss.hasPermi('ccdi:project:export')") public void export(HttpServletResponse response, CcdiBankStatementQueryDTO queryDTO) { projectAccessService.assertCanRead(queryDTO.getProjectId()); List list = bankStatementService.selectStatementListForExport(queryDTO); diff --git a/docs/plans/backend/2026-07-20-bank-statement-export-project-read-access-backend-implementation.md b/docs/plans/backend/2026-07-20-bank-statement-export-project-read-access-backend-implementation.md new file mode 100644 index 00000000..255e1bb9 --- /dev/null +++ b/docs/plans/backend/2026-07-20-bank-statement-export-project-read-access-backend-implementation.md @@ -0,0 +1,15 @@ +# 流水明细导出项目可读权限后端实施计划 + +## 目标 + +普通用户进入本人可读项目后，可以导出该项目的流水明细；不可读项目仍禁止导出。 + +## 实施范围 + +1. 调整 `CcdiBankStatementController.export`，移除 `ccdi:project:export` 菜单权限前置校验。 +2. 保留并依赖 `projectAccessService.assertCanRead(projectId)`，导出权限与流水列表、筛选项、详情的项目可读口径保持一致。 +3. 不调整项目列表导出、结果总览导出、专项核查导出等其他链路；本次仅修正流水明细导出遗留的旧权限标识。 + +## 验证 + +执行 `mvn -pl ccdi-project -am -Dtest=CcdiBankStatementControllerTest -Dsurefire.failIfNoSpecifiedTests=false test`，确认流水明细 Controller 单测通过。 diff --git a/docs/reports/implementation/2026-07-20-bank-statement-export-project-read-access.md b/docs/reports/implementation/2026-07-20-bank-statement-export-project-read-access.md new file mode 100644 index 00000000..807a6536 --- /dev/null +++ b/docs/reports/implementation/2026-07-20-bank-statement-export-project-read-access.md @@ -0,0 +1,16 @@ +# 流水明细导出项目可读权限实施记录 + +## 修改内容 + +- 移除流水明细导出接口上的 `ccdi:project:export` 菜单权限前置校验。 +- 导出接口继续执行 `projectAccessService.assertCanRead(projectId)`，普通用户仅能导出自己可读项目的流水明细。 + +## 影响范围 + +- 影响接口：`POST /ccdi/project/bank-statement/export`。 +- 流水列表、筛选项、详情接口权限口径不变。 +- 已复核项目详情内其他导出入口，当前没有使用 `ccdi:project:export`；结果总览与专项核查导出仍按 `ccdi:project:query` 加项目可读校验执行。 + +## 验证记录 + +- 通过：`mvn -pl ccdi-project -am -Dtest=CcdiBankStatementControllerTest "-Dsurefire.failIfNoSpecifiedTests=false" test`。