✨ feat(im): 增加频道的检查

YunaiV
1 parent 032d9558
Showing 4 changed files with 9 additions and 52 deletions
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/controller/admin/channel/ImChannelMaterialController.java
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/dal/mysql/channel/ImChannelMessageMapper.java
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageService.java
yudao-module-im/src/main/java/cn/iocoder/yudao/module/im/service/channel/ImChannelMessageServiceImpl.java
@@ -5,7 +5,6 @@ import cn.iocoder.yudao.framework.common.util.object.BeanUtils;
 import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.material.ImChannelMaterialRespVO;
 import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMaterialDO;
 import cn.iocoder.yudao.module.im.service.channel.ImChannelMaterialService;
-import cn.iocoder.yudao.module.im.service.channel.ImChannelMessageService;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -16,10 +15,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
-import static cn.iocoder.yudao.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static cn.iocoder.yudao.framework.common.pojo.CommonResult.success;
-import static cn.iocoder.yudao.framework.web.core.util.WebFrameworkUtils.getLoginUserId;
-import static cn.iocoder.yudao.module.im.enums.ErrorCodeConstants.IM_CHANNEL_MATERIAL_NOT_EXISTS;
 @Tag(name = "用户 APP - IM 频道素材")
 @RestController
@@ -29,19 +25,11 @@ public class ImChannelMaterialController {
     @Resource
     private ImChannelMaterialService channelMaterialService;
-    @Resource
-    private ImChannelMessageService channelMessageService;
-    // TODO @AI：要不，还是不校验了。会存在一个情况，有人转发图文消息到私聊里。（先不考虑这块的安全性了；简化简化！）
     @GetMapping("/get")
     @Operation(summary = "获取素材详情；用于客户端点击图文卡片渲染详情页")
     @Parameter(name = "id", description = "素材编号", required = true, example = "1024")
     public CommonResult<ImChannelMaterialRespVO> getMaterial(@RequestParam("id") Long id) {
-        // 防横向越权：仅允许拉取自己曾经收到过的素材，否则视为不存在
-        if (!channelMessageService.isUserReceivedMaterial(getLoginUserId(), id)) {
-            throw exception(IM_CHANNEL_MATERIAL_NOT_EXISTS);
-        }
-        // 获取素材详情
         ImChannelMaterialDO material = channelMaterialService.validateMaterialExists(id);
         return success(BeanUtils.toBean(material, ImChannelMaterialRespVO.class));
     }
@@ -6,8 +6,6 @@ import cn.iocoder.yudao.framework.mybatis.core.query.LambdaQueryWrapperX;
 import cn.iocoder.yudao.module.im.controller.admin.manager.channel.vo.message.ImChannelMessagePageReqVO;
 import cn.iocoder.yudao.module.im.dal.dataobject.channel.ImChannelMessageDO;
 import org.apache.ibatis.annotations.Mapper;
-import org.apache.ibatis.annotations.Param;
-import org.apache.ibatis.annotations.Select;
 import java.util.List;
@@ -19,7 +17,6 @@ import java.util.List;
 @Mapper
 public interface ImChannelMessageMapper extends BaseMapperX<ImChannelMessageDO> {
-    // TODO @AI：代码风格，和别的 message 一致；
     /**
      * 拉取指定用户应收的频道消息
      * <p>
@@ -30,30 +27,15 @@ public interface ImChannelMessageMapper extends BaseMapperX&lt;ImChannelMessageDO&gt; 
      * @param size   返回条数
      * @return 频道消息列表；按 id 升序
      */
-    @Select("SELECT * FROM im_channel_message "
-            + "WHERE deleted = 0 "
-            + "AND id > #{minId} "
-            + "AND (receiver_user_ids IS NULL "
-            + "     OR receiver_user_ids = '' "
-            + "     OR FIND_IN_SET(#{userId}, receiver_user_ids)) "
-            + "ORDER BY id ASC "
-            + "LIMIT #{size}")
-    List<ImChannelMessageDO> selectListByUserAndMinId(@Param("userId") Long userId,
-                                                     @Param("minId") Long minId,
-                                                     @Param("size") Integer size);
-
-    // TODO @AI：代码风格，和别的 message 一致；
-    /**
-     * 校验用户是否曾经收到过指定素材（receiver_user_ids 为空表示全员）；用于详情接口归属校验
-     */
-    @Select("SELECT EXISTS(SELECT 1 FROM im_channel_message "
-            + "WHERE deleted = 0 AND material_id = #{materialId} "
-            + "AND (receiver_user_ids IS NULL "
-            + "     OR receiver_user_ids = '' "
-            + "     OR FIND_IN_SET(#{userId}, receiver_user_ids)) "
-            + "LIMIT 1)")
-    boolean existsByUserAndMaterial(@Param("userId") Long userId,
-                                    @Param("materialId") Long materialId);
+    default List<ImChannelMessageDO> selectListByUserAndMinId(Long userId, Long minId, Integer size) {
+        return selectList(new LambdaQueryWrapperX<ImChannelMessageDO>()
+                .gt(ImChannelMessageDO::getId, minId)
+                .and(w -> w.isNull(ImChannelMessageDO::getReceiverUserIds)
+                        .or().eq(ImChannelMessageDO::getReceiverUserIds, "")
+                        .or().apply("FIND_IN_SET({0}, receiver_user_ids)", userId))
+                .orderByAsc(ImChannelMessageDO::getId)
+                .last("LIMIT " + size));
+    }
     default Long selectCountByMaterialId(Long materialId) {
         return selectCount(ImChannelMessageDO::getMaterialId, materialId);
@@ -28,14 +28,6 @@ public interface ImChannelMessageService {
      */
     List<ImChannelMessageDO> getMessageListForPull(Long userId, Long minId, Integer size);
-    /**
-     * 校验用户是否曾经收到过指定素材；防横向越权
-     *
-     * @param userId     当前用户编号
-     * @param materialId 素材编号
-     * @return 是否曾收到（receiver_user_ids 命中 / 全员）
-     */
-    boolean isUserReceivedMaterial(Long userId, Long materialId);
     // ==================== 管理后台 ====================
@@ -47,11 +47,6 @@ public class ImChannelMessageServiceImpl implements ImChannelMessageService {
         return channelMessageMapper.selectListByUserAndMinId(userId, minId, size);
     }
-    @Override
-    public boolean isUserReceivedMaterial(Long userId, Long materialId) {
-        return channelMessageMapper.existsByUserAndMaterial(userId, materialId);
-    }
-
     // ==================== 管理后台 ====================
     @Override