爱心帮扶-职工慰问-分工会审核（手机端）：

1.superadmin（工号）：查看并审核全部分工会数据；
2.gh01（分工会主席角色）、sp01（职工慰问审批员）：只能查看并审核自己分工会的数据；
3.sysadmin（角色）：不再自动拥有分工会审核权限。

src/main/java/io/v/nutz/mobile/condolence/CondolenceAuditControll.java

@@ -65,20 +65,28 @@ public class CondolenceAuditControll {
 
         Cnd cnd = Cnd.NEW();
 
-        if (!ShiroUtil.hasAnyRoles("sysadmin")) {
+        if (!"superadmin".equals(ShiroUtil.getPrincipalProperty("loginname"))) {
             SqlExpressionGroup group = new SqlExpressionGroup();
-            if (ShiroUtil.hasAnyRoles("A06")) {
+            boolean hasAuditRole = false;
-                group.or(Cnd.exps("con.state_id", isAudit ? ">" : "=", 2020).or("con.state_id", isAudit ? ">" : "=", 2000));
+            if (ShiroUtil.hasAnyRoles("gh01,sp01")) {
-//                cnd.and("con.state_id", isAudit ? ">" : "=", 2020);
+                group.or(Cnd.exps("con.state_id", isAudit ? ">" : "=", 2000)
+                        .and("sqr.unionid", "=", Vi.getUnionId()));
+                hasAuditRole = true;
             }
-            if (ShiroUtil.hasAnyRoles("H04")) {
+            if (ShiroUtil.hasAnyRoles("A06,sysadmin")) {
-                group.and("con.state_id", isAudit ? ">" : "=", 2000);
+                group.or(Cnd.exps("con.state_id", isAudit ? ">" : "=", 2020));
-                group.and("be.unionid", "=", Vi.getUnionId());
+                hasAuditRole = true;
             }
-            if (ShiroUtil.hasAnyRoles("xghkj")) {
+            if (ShiroUtil.hasAnyRoles("xghkj,sysadmin")) {
-                group.and("con.state_id", isAudit ? ">" : "=", 2012);
+                group.or(Cnd.exps("con.state_id", isAudit ? ">" : "=", 2012));
+                hasAuditRole = true;
             }
+            if (hasAuditRole) {
                 cnd.and(group);
+            } else {
+                // 非慰问审核角色不允许查看手机端慰问审核数据。
+                cnd.and("1", "=", 0);
+            }
         } else {
             cnd.and("con.state_id", "in", isAudit ? "1990,2010,2014,2030,2040" : "2000,2012,2020");
         }
@@ -108,11 +116,12 @@ public class CondolenceAuditControll {
     @At("/auditHtml")
     @Ok("re")
     public String auditHtml(Integer state_id) {
-        if (state_id == 2000 && ShiroUtil.hasAnyRoles("H04,A06,sysadmin")) {
+        boolean superadmin = "superadmin".equals(ShiroUtil.getPrincipalProperty("loginname"));
+        if (state_id == 2000 && (superadmin || ShiroUtil.hasAnyRoles("gh01,sp01"))) {
             return "beetl:/mobile/condolence/union_Audit.html";
-        } else if (state_id == 2012 && ShiroUtil.hasAnyRoles("gh03,xghkj,sysadmin")) {
+        } else if (state_id == 2012 && (superadmin || ShiroUtil.hasAnyRoles("gh03,xghkj,sysadmin"))) {
             return "beetl:/mobile/condolence/fr_Audit.html";
-        } else if (state_id == 2020 && ShiroUtil.hasAnyRoles("A06,sysadmin")) {
+        } else if (state_id == 2020 && (superadmin || ShiroUtil.hasAnyRoles("A06,sysadmin"))) {
             return "beetl:/mobile/condolence/school_Audit.html";
         }
         return "beetl:/mobile/condolence/apply_info.html";

src/main/java/io/v/nutz/zgfw/controller/condolence/CondolenceUcrCon.java

@@ -1,5 +1,6 @@
 package io.v.nutz.zgfw.controller.condolence;
 
+import cn.wizzer.framework.base.Result;
 import io.v.nutz.annontation.ViReturn;
 import io.v.nutz.base.utils.DateUtil;
 import io.v.nutz.base.utils.MsgApi;
@@ -90,7 +91,12 @@ public class CondolenceUcrCon {
         cnd.and("con.state_id", isAudit ? ">" : "=", 2000);
 
         if (!"superadmin".equals(ShiroUtil.getPrincipalProperty("loginname"))) {
+            if (ShiroUtil.hasAnyRoles("gh01,sp01")) {
                 cnd.and("sqr.unionid", "=", vi.getUnionId());
+            } else {
+                // 非分工会主席、职工慰问审批员角色（包括sysadmin）不允许查看分工会审核数据。
+                cnd.and("1", "=", 0);
+            }
         }
 
         Vi.cndPlus(cnd, "YEAR(con.apply_time)", "=", year);
@@ -125,6 +131,10 @@ public class CondolenceUcrCon {
     @ViReturn
     @RequiresPermissions("fw.condolence.ucr")
     public Object doEdit(String id) {
+        Condolence condolence = condolenceService.fetch(id);
+        if (!hasReviewPermission(condolence)) {
+            return Result.error("您没有分工会审核权限！");
+        }
         condolenceService.update(Chain.make("state_id", 2000), Cnd.where("id", "=", id));
         return null;
     }
@@ -133,11 +143,14 @@ public class CondolenceUcrCon {
     @ViReturn
     @RequiresPermissions("fw.condolence.ucr")
     public Object doReview(String id, Integer pass, Review review) {
+        Condolence condolence = condolenceService.fetch(id);
+        if (!hasReviewPermission(condolence)) {
+            return Result.error("您没有分工会审核权限！");
+        }
         review.setLoginname(ShiroUtil.getPrincipalProperty("loginname").toString());
         review.setUsername(ShiroUtil.getPrincipalProperty("username").toString());
         review.setTime(DateUtil.getDate());
         review = reviewService.insert(review);
-        Condolence condolence = condolenceService.fetch(id);
         condolence.setUnion_chairman_review(review.getId());
         if (pass == 1) {
             condolence.setState_id("2010");
@@ -167,5 +180,21 @@ public class CondolenceUcrCon {
         return null;
     }
 
+    /**
+     * 校验分工会审核权限：superadmin可审核全部，分工会主席和职工慰问审批员只能审核本分工会数据。
+     */
+    private boolean hasReviewPermission(Condolence condolence) {
+        if ("superadmin".equals(ShiroUtil.getPrincipalProperty("loginname"))) {
+            return true;
+        }
+        if (condolence == null || !ShiroUtil.hasAnyRoles("gh01,sp01")) {
+            return false;
+        }
+        Sql sql = Sqls.fetchString(Sqls.create("select unionid from `user` where id = @id")
+                .setParam("id", condolence.getManager()).toString());
+        condolenceService.dao().execute(sql);
+        return vi.getUnionId().equals(sql.getString());
+    }
+
 
 }

src/main/resources/views/mobile/condolence/audit_list.html

@@ -106,7 +106,8 @@ layout("/mobile/platform.html"){
             },
             async flushUnits() {
                 //this.$set(this.pageForm, "unitId", "")
-                if ("${@shiro.hasRole('sysadmin')||@shiro.hasRole('A06')||@shiro.hasRole('H03')}" === 'true') {
+                if ("${@shiro.getPrincipalProperty('loginname')}" === 'superadmin' ||
+                    "${@shiro.hasRole('sysadmin')||@shiro.hasRole('A06')||@shiro.hasRole('H03')}" === 'true') {
                     await mCommon.getUnitList(this.pageForm.unionId)
                 } else {
                     await mCommon.getUnitList("${@shiro.getPrincipalProperty('unit').getUnionid()}")