From aea4388cb5b4257470de269a5241149135fe9ca2 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 31 Mar 2026 13:35:23 +0800 Subject: [PATCH] fix: restrict primary detail editing to assigned member --- .../com/designhub/service/TaskService.java | 36 ++----------------- frontend/src/views/TaskHall.vue | 17 ++------- 2 files changed, 4 insertions(+), 49 deletions(-) diff --git a/backend/src/main/java/com/designhub/service/TaskService.java b/backend/src/main/java/com/designhub/service/TaskService.java index 5b7bba1..c0b69bb 100644 --- a/backend/src/main/java/com/designhub/service/TaskService.java +++ b/backend/src/main/java/com/designhub/service/TaskService.java @@ -963,24 +963,7 @@ public class TaskService { // 非管理员只能看到分配给自己的待审核任务 if (!isAdmin) { - boolean isDemandDeptMember = userService.getUserDepartments(userId).stream() - .filter(java.util.Objects::nonNull) - .anyMatch(dept -> "demand".equals(dept.getDeptType()) - && dept.getStatus() != null && dept.getStatus() == 1 - && (dept.getDeleted() == null || dept.getDeleted() == 0)); - - if (isDemandDeptMember) { - wrapper.and(w -> w - .eq(Task::getCurrentApproverId, userId) - .or(ow -> ow - .eq(Task::getApprovalStatus, "pending_detail_completion") - .eq(Task::getIsPrimaryTask, 1) - ) - ); - log.info("需求部门成员 {} 查询待审核任务,包含一级需求任务待完善明细列表", userId); - } else { - wrapper.eq(Task::getCurrentApproverId, userId); - } + wrapper.eq(Task::getCurrentApproverId, userId); } // 根据任务类型筛选 @@ -1898,23 +1881,8 @@ public class TaskService { && existTask.getDetailCompleterId() != null && userId.equals(existTask.getDetailCompleterId()); - // 对于一级需求任务在待完善明细状态,需求部门的成员都可以编辑 - boolean isDemandDeptMemberForPrimaryTask = false; - if (existTask.getIsPrimaryTask() != null && existTask.getIsPrimaryTask() == 1 - && "pending_detail_completion".equals(existTask.getApprovalStatus())) { - List userDepartments = userService.getUserDepartments(userId); - isDemandDeptMemberForPrimaryTask = userDepartments.stream() - .filter(java.util.Objects::nonNull) - .anyMatch(dept -> "demand".equals(dept.getDeptType()) - && dept.getStatus() != null && dept.getStatus() == 1 - && (dept.getDeleted() == null || dept.getDeleted() == 0)); - if (isDemandDeptMemberForPrimaryTask) { - log.info("需求部门成员 {} 编辑一级需求任务 {}", userId, id); - } - } - if (!isAdmin && !userId.equals(existTask.getPublisherId()) && !isPrimaryTaskDetailCompleter - && !isDemandDeptMemberForPrimaryTask && !leaderCanEditPending) { + && !leaderCanEditPending) { throw new BusinessException(ResultCode.FORBIDDEN, "只有任务发布人、指定的明细完善人或接单部门负责人(待接单任务)可以更新任务"); } diff --git a/frontend/src/views/TaskHall.vue b/frontend/src/views/TaskHall.vue index 23bc52c..c378d0e 100644 --- a/frontend/src/views/TaskHall.vue +++ b/frontend/src/views/TaskHall.vue @@ -5641,27 +5641,14 @@ const canRejectTask = (task: Task) => { return canApproveTask(task) } -const isDemandDepartmentMember = () => { - const userInfo = currentUserInfo.value || JSON.parse(localStorage.getItem('userInfo') || '{}') - const departments = Array.isArray(userInfo.departments) ? userInfo.departments : [] - - if (departments.some((dept: any) => dept?.deptType === 'demand')) { - return true - } - - return userInfo.deptType === 'demand' -} - // 判断是否可以编辑完善任务明细(一级需求部门任务) const canEditDetailTask = (task: Task) => { const userInfo = JSON.parse(localStorage.getItem('userInfo') || '{}') const currentUserId = userInfo.id - // 一级需求任务在待完善明细状态下,需求部门成员也允许补充任务明细 + // 只有待完善明细状态的任务,且当前用户是指定的完善人 if (task.approvalStatus === 'pending_detail_completion') { - return task.currentApproverId === currentUserId - || task.detailCompleterId === currentUserId - || isDemandDepartmentMember() + return task.currentApproverId === currentUserId || task.detailCompleterId === currentUserId } return false