BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 5460160619fa4ce5c3c0121015bc73786c8a4b28

Authored by YunaiV
1 parent f94dd152

fix(trade): 校验会员售后日志查询归属

Inline Side-by-side
Showing 1 changed file with 12 additions and 0 deletions
yudao-module-mall/yudao-module-trade/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java
  View file @5460160
@@ -3,8 +3,10 @@ package cn.iocoder.yudao.module.trade.controller.app.aftersale; @@ -3,8 +3,10 @@ package cn.iocoder.yudao.module.trade.controller.app.aftersale;
3 import cn.iocoder.yudao.framework.common.pojo.CommonResult; 3 import cn.iocoder.yudao.framework.common.pojo.CommonResult;
4 import cn.iocoder.yudao.framework.common.util.object.BeanUtils; 4 import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
5 import cn.iocoder.yudao.module.trade.controller.app.aftersale.vo.log.AppAfterSaleLogRespVO; 5 import cn.iocoder.yudao.module.trade.controller.app.aftersale.vo.log.AppAfterSaleLogRespVO;
  6 +import cn.iocoder.yudao.module.trade.dal.dataobject.aftersale.AfterSaleDO;
6 import cn.iocoder.yudao.module.trade.dal.dataobject.aftersale.AfterSaleLogDO; 7 import cn.iocoder.yudao.module.trade.dal.dataobject.aftersale.AfterSaleLogDO;
7 import cn.iocoder.yudao.module.trade.service.aftersale.AfterSaleLogService; 8 import cn.iocoder.yudao.module.trade.service.aftersale.AfterSaleLogService;
  9 +import cn.iocoder.yudao.module.trade.service.aftersale.AfterSaleService;
8 import io.swagger.v3.oas.annotations.Operation; 10 import io.swagger.v3.oas.annotations.Operation;
9 import io.swagger.v3.oas.annotations.Parameter; 11 import io.swagger.v3.oas.annotations.Parameter;
10 import io.swagger.v3.oas.annotations.tags.Tag; 12 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -18,7 +20,10 @@ import org.springframework.web.bind.annotation.RestController; @@ -18,7 +20,10 @@ import org.springframework.web.bind.annotation.RestController;
18 20
19 import java.util.List; 21 import java.util.List;
20 22
  23 +import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
21 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success; 24 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
  25 +import static cn.iocoder.yudao.framework.security.core.util.SecurityFrameworkUtils.getLoginUserId;
  26 +import static cn.iocoder.yudao.module.trade.enums.ErrorCodeConstants.AFTER_SALE_NOT_FOUND;
22 27
23 @Tag(name = "用户 App - 售后日志") 28 @Tag(name = "用户 App - 售后日志")
24 @RestController 29 @RestController
@@ -28,6 +33,8 @@ import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success; @@ -28,6 +33,8 @@ import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
28 public class AppAfterSaleLogController { 33 public class AppAfterSaleLogController {
29 34
30 @Resource 35 @Resource
  36 + private AfterSaleService afterSaleService;
  37 + @Resource
31 private AfterSaleLogService afterSaleLogService; 38 private AfterSaleLogService afterSaleLogService;
32 39
33 @GetMapping("/list") 40 @GetMapping("/list")
@@ -35,6 +42,11 @@ public class AppAfterSaleLogController { @@ -35,6 +42,11 @@ public class AppAfterSaleLogController {
35 @Parameter(name = "afterSaleId", description = "售后编号", required = true, example = "1") 42 @Parameter(name = "afterSaleId", description = "售后编号", required = true, example = "1")
36 public CommonResult<List<AppAfterSaleLogRespVO>> getAfterSaleLogList( 43 public CommonResult<List<AppAfterSaleLogRespVO>> getAfterSaleLogList(
37 @RequestParam("afterSaleId") Long afterSaleId) { 44 @RequestParam("afterSaleId") Long afterSaleId) {
  45 + // 校验售后单属于当前用户。注意：日志的 userId 是操作人（可能是管理员、系统），不能用于归属过滤
  46 + AfterSaleDO afterSale = afterSaleService.getAfterSale(getLoginUserId(), afterSaleId);
  47 + if (afterSale == null) {
  48 + throw exception(AFTER_SALE_NOT_FOUND);
  49 + }
38 List<AfterSaleLogDO> logs = afterSaleLogService.getAfterSaleLogList(afterSaleId); 50 List<AfterSaleLogDO> logs = afterSaleLogService.getAfterSaleLogList(afterSaleId);
39 return success(BeanUtils.toBean(logs, AppAfterSaleLogRespVO.class)); 51 return success(BeanUtils.toBean(logs, AppAfterSaleLogRespVO.class));
40 } 52 }