BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 5460160619fa4ce5c3c0121015bc73786c8a4b28

Authored by YunaiV
1 parent f94dd152

fix(trade): 校验会员售后日志查询归属

Inline Side-by-side
Showing 1 changed file with 12 additions and 0 deletions
yudao-module-mall/yudao-module-trade/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java
  View file @5460160
... ... @@ -3,8 +3,10 @@ package cn.iocoder.yudao.module.trade.controller.app.aftersale;
3 3 import cn.iocoder.yudao.framework.common.pojo.CommonResult;
4 4 import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
5 5 import cn.iocoder.yudao.module.trade.controller.app.aftersale.vo.log.AppAfterSaleLogRespVO;
  6 +import cn.iocoder.yudao.module.trade.dal.dataobject.aftersale.AfterSaleDO;
6 7 import cn.iocoder.yudao.module.trade.dal.dataobject.aftersale.AfterSaleLogDO;
7 8 import cn.iocoder.yudao.module.trade.service.aftersale.AfterSaleLogService;
  9 +import cn.iocoder.yudao.module.trade.service.aftersale.AfterSaleService;
8 10 import io.swagger.v3.oas.annotations.Operation;
9 11 import io.swagger.v3.oas.annotations.Parameter;
10 12 import io.swagger.v3.oas.annotations.tags.Tag;
... ... @@ -18,7 +20,10 @@ import org.springframework.web.bind.annotation.RestController;
18 20  
19 21 import java.util.List;
20 22  
  23 +import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
21 24 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
  25 +import static cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
  26 +import static cn.iocoder.yudao.module.trade.enums.ErrorCodeConstants.AFTER_SALE_NOT_FOUND;
22 27  
23 28 @Tag(name = "用户 App - 售后日志")
24 29 @RestController
... ... @@ -28,6 +33,8 @@ import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
28 33 public class AppAfterSaleLogController {
29 34  
30 35 @Resource
  36 + private AfterSaleService afterSaleService;
  37 + @Resource
31 38 private AfterSaleLogService afterSaleLogService;
32 39  
33 40 @GetMapping("/list")
... ... @@ -35,6 +42,11 @@ public class AppAfterSaleLogController {
35 42 @Parameter(name = "afterSaleId", description = "售后编号", required = true, example = "1")
36 43 public CommonResult<List<AppAfterSaleLogRespVO>> getAfterSaleLogList(
37 44 @RequestParam("afterSaleId") Long afterSaleId) {
  45 + // 校验售后单属于当前用户。注意：日志的 userId 是操作人（可能是管理员、系统），不能用于归属过滤
  46 + AfterSaleDO afterSale = afterSaleService.getAfterSale(getLoginUserId(), afterSaleId);
  47 + if (afterSale == null) {
  48 + throw exception(AFTER_SALE_NOT_FOUND);
  49 + }
38 50 List<AfterSaleLogDO> logs = afterSaleLogService.getAfterSaleLogList(afterSaleId);
39 51 return success(BeanUtils.toBean(logs, AppAfterSaleLogRespVO.class));
40 52 }
... ...