Commit d60156015be9e9cc130a579755be66c164a17859
1 parent
032d9558
✨ feat(im): 增加频道的检查
Showing
4 changed files
with
9 additions
and
52 deletions
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java
| ... | ... | @@ -5,7 +5,6 @@ import cn.iocoder.yudao.framework.common.util.object.BeanUtils; |
| 5 | 5 | import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.material.ImChannelMaterialRespVO; |
| 6 | 6 | import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMaterialDO; |
| 7 | 7 | import cn.iocoder.yudao.module.im.service.channel.ImChannelMaterialService; |
| 8 | -import cn.iocoder.yudao.module.im.service.channel.ImChannelMessageService; | |
| 9 | 8 | import io.swagger.v3.oas.annotations.Operation; |
| 10 | 9 | import io.swagger.v3.oas.annotations.Parameter; |
| 11 | 10 | import io.swagger.v3.oas.annotations.tags.Tag; |
| ... | ... | @@ -16,10 +15,7 @@ import org.springframework.web.bind.annotation.RequestMapping; |
| 16 | 15 | import org.springframework.web.bind.annotation.RequestParam; |
| 17 | 16 | import org.springframework.web.bind.annotation.RestController; |
| 18 | 17 | |
| 19 | -import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception; | |
| 20 | 18 | import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success; |
| 21 | -import static cn.iocoder.yudao.framework.web.core.util.WebFrameworkUtils.getLoginUserId; | |
| 22 | -import static cn.iocoder.yudao.module.im.enums.ErrorCodeConstants.IM_CHANNEL_MATERIAL_NOT_EXISTS; | |
| 23 | 19 | |
| 24 | 20 | @Tag(name = "用户 APP - IM 频道素材") |
| 25 | 21 | @RestController |
| ... | ... | @@ -29,19 +25,11 @@ public class ImChannelMaterialController { |
| 29 | 25 | |
| 30 | 26 | @Resource |
| 31 | 27 | private ImChannelMaterialService channelMaterialService; |
| 32 | - @Resource | |
| 33 | - private ImChannelMessageService channelMessageService; | |
| 34 | 28 | |
| 35 | - // TODO @AI：要不，还是不校验了。会存在一个情况，有人转发图文消息到私聊里。（先不考虑这块的安全性了；简化简化！） | |
| 36 | 29 | @GetMapping("/get") |
| 37 | 30 | @Operation(summary = "获取素材详情；用于客户端点击图文卡片渲染详情页") |
| 38 | 31 | @Parameter(name = "id", description = "素材编号", required = true, example = "1024") |
| 39 | 32 | public CommonResult<ImChannelMaterialRespVO> getMaterial(@RequestParam("id") Long id) { |
| 40 | - // 防横向越权：仅允许拉取自己曾经收到过的素材，否则视为不存在 | |
| 41 | - if (!channelMessageService.isUserReceivedMaterial(getLoginUserId(), id)) { | |
| 42 | - throw exception(IM_CHANNEL_MATERIAL_NOT_EXISTS); | |
| 43 | - } | |
| 44 | - // 获取素材详情 | |
| 45 | 33 | ImChannelMaterialDO material = channelMaterialService.validateMaterialExists(id); |
| 46 | 34 | return success(BeanUtils.toBean(material, ImChannelMaterialRespVO.class)); |
| 47 | 35 | } | ... | ... |
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java
| ... | ... | @@ -6,8 +6,6 @@ import cn.iocoder.yudao.framework.mybatis.core.query.LambdaQueryWrapperX; |
| 6 | 6 | import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.message.ImChannelMessagePageReqVO; |
| 7 | 7 | import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMessageDO; |
| 8 | 8 | import org.apache.ibatis.annotations.Mapper; |
| 9 | -import org.apache.ibatis.annotations.Param; | |
| 10 | -import org.apache.ibatis.annotations.Select; | |
| 11 | 9 | |
| 12 | 10 | import java.util.List; |
| 13 | 11 | |
| ... | ... | @@ -19,7 +17,6 @@ import java.util.List; |
| 19 | 17 | @Mapper |
| 20 | 18 | public interface ImChannelMessageMapper extends BaseMapperX<ImChannelMessageDO> { |
| 21 | 19 | |
| 22 | - // TODO @AI：代码风格，和别的 message 一致； | |
| 23 | 20 | /** |
| 24 | 21 | * 拉取指定用户应收的频道消息 |
| 25 | 22 | * <p> |
| ... | ... | @@ -30,30 +27,15 @@ public interface ImChannelMessageMapper extends BaseMapperX<ImChannelMessageDO> |
| 30 | 27 | * @param size 返回条数 |
| 31 | 28 | * @return 频道消息列表；按 id 升序 |
| 32 | 29 | */ |
| 33 | - @Select("SELECT * FROM im_channel_message " | |
| 34 | - + "WHERE deleted = 0 " | |
| 35 | - + "AND id > #{minId} " | |
| 36 | - + "AND (receiver_user_ids IS NULL " | |
| 37 | - + " OR receiver_user_ids = '' " | |
| 38 | - + " OR FIND_IN_SET(#{userId}, receiver_user_ids)) " | |
| 39 | - + "ORDER BY id ASC " | |
| 40 | - + "LIMIT #{size}") | |
| 41 | - List<ImChannelMessageDO> selectListByUserAndMinId(@Param("userId") Long userId, | |
| 42 | - @Param("minId") Long minId, | |
| 43 | - @Param("size") Integer size); | |
| 44 | - | |
| 45 | - // TODO @AI：代码风格，和别的 message 一致； | |
| 46 | - /** | |
| 47 | - * 校验用户是否曾经收到过指定素材（receiver_user_ids 为空表示全员）；用于详情接口归属校验 | |
| 48 | - */ | |
| 49 | - @Select("SELECT EXISTS(SELECT 1 FROM im_channel_message " | |
| 50 | - + "WHERE deleted = 0 AND material_id = #{materialId} " | |
| 51 | - + "AND (receiver_user_ids IS NULL " | |
| 52 | - + " OR receiver_user_ids = '' " | |
| 53 | - + " OR FIND_IN_SET(#{userId}, receiver_user_ids)) " | |
| 54 | - + "LIMIT 1)") | |
| 55 | - boolean existsByUserAndMaterial(@Param("userId") Long userId, | |
| 56 | - @Param("materialId") Long materialId); | |
| 30 | + default List<ImChannelMessageDO> selectListByUserAndMinId(Long userId, Long minId, Integer size) { | |
| 31 | + return selectList(new LambdaQueryWrapperX<ImChannelMessageDO>() | |
| 32 | + .gt(ImChannelMessageDO::getId, minId) | |
| 33 | + .and(w -> w.isNull(ImChannelMessageDO::getReceiverUserIds) | |
| 34 | + .or().eq(ImChannelMessageDO::getReceiverUserIds, "") | |
| 35 | + .or().apply("FIND_IN_SET({0}, receiver_user_ids)", userId)) | |
| 36 | + .orderByAsc(ImChannelMessageDO::getId) | |
| 37 | + .last("LIMIT " + size)); | |
| 38 | + } | |
| 57 | 39 | |
| 58 | 40 | default Long selectCountByMaterialId(Long materialId) { |
| 59 | 41 | return selectCount(ImChannelMessageDO::getMaterialId, materialId); | ... | ... |
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java
| ... | ... | @@ -28,14 +28,6 @@ public interface ImChannelMessageService { |
| 28 | 28 | */ |
| 29 | 29 | List<ImChannelMessageDO> getMessageListForPull(Long userId, Long minId, Integer size); |
| 30 | 30 | |
| 31 | - /** | |
| 32 | - * 校验用户是否曾经收到过指定素材；防横向越权 | |
| 33 | - * | |
| 34 | - * @param userId 当前用户编号 | |
| 35 | - * @param materialId 素材编号 | |
| 36 | - * @return 是否曾收到（receiver_user_ids 命中 / 全员） | |
| 37 | - */ | |
| 38 | - boolean isUserReceivedMaterial(Long userId, Long materialId); | |
| 39 | 31 | |
| 40 | 32 | // ==================== 管理后台 ==================== |
| 41 | 33 | ... | ... |
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java
| ... | ... | @@ -47,11 +47,6 @@ public class ImChannelMessageServiceImpl implements ImChannelMessageService { |
| 47 | 47 | return channelMessageMapper.selectListByUserAndMinId(userId, minId, size); |
| 48 | 48 | } |
| 49 | 49 | |
| 50 | - @Override | |
| 51 | - public boolean isUserReceivedMaterial(Long userId, Long materialId) { | |
| 52 | - return channelMessageMapper.existsByUserAndMaterial(userId, materialId); | |
| 53 | - } | |
| 54 | - | |
| 55 | 50 | // ==================== 管理后台 ==================== |
| 56 | 51 | |
| 57 | 52 | @Override | ... | ... |