1

src/main/java/com/budwk/app/zhgh/dayofficework/tour/controller/TourLedgerController.java

@@ -9,6 +9,7 @@ import cn.afterturn.easypoi.excel.entity.params.ExcelExportEntity;
 import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.util.StrUtil;
 import com.budwk.app.base.annotation.SLog;
+import com.budwk.app.base.constant.RoleConstant;
 import com.budwk.app.base.model.ExcelImportRes;
 import com.budwk.app.base.page.Pagination;
 import com.budwk.app.base.param.PageForm;
@@ -17,6 +18,8 @@ import com.budwk.app.base.utils.CommonDownloadUtil;
 import com.budwk.app.flow.enums.ProcessInstanceStateEnum;
 import com.budwk.app.sys.models.Sys_union;
 import com.budwk.app.sys.views.View_user;
+import com.budwk.app.web.commons.auth.utils.AuthUtil;
+import com.budwk.app.web.commons.auth.utils.SecurityUtil;
 import com.budwk.app.zhgh.dayofficework.tour.mode.TourLedgerImportExcelMode;
 import com.budwk.app.zhgh.dayofficework.tour.models.TourLedger;
 import com.budwk.app.zhgh.dayofficework.tour.models.TourLedgerDirectRelative;
@@ -196,6 +199,9 @@ public class TourLedgerController {
         if (ledger == null) {
             return Result.error("台账记录不存在");
         }
+        if (!canAccessLedgerUnion(ledger.getUnionId())) {
+            return Result.error("无权查看该台账记录");
+        }
         ledger.setLineName(getCurrentLineName(ledger));
         Cnd familyCnd = Cnd.NEW();
         familyCnd.and(TourLedgerFamily::getLedgerId, "=", id);
@@ -225,6 +231,9 @@ public class TourLedgerController {
         if (ledger == null) {
             return Result.error("台账记录不存在");
         }
+        if (!canAccessLedgerUnion(ledger.getUnionId())) {
+            return Result.error("无权删除该台账记录");
+        }
         tourLedgerFamilyService.clear(Cnd.where(TourLedgerFamily::getLedgerId, "=", id));
         tourLedgerService.delete(id);
         return Result.success();
@@ -239,7 +248,9 @@ public class TourLedgerController {
         if (idList.isEmpty()) {
             return Result.error("请选择要设置的参加人员");
         }
-        tourLedgerService.dao().update(TourLedger.class, Chain.make("joined", true), Cnd.where("id", "in", idList));
+        Cnd cnd = Cnd.where("id", "in", idList);
+        cnd.andEX("unionId", "=", resolveLedgerUnionId(null));
+        tourLedgerService.dao().update(TourLedger.class, Chain.make("joined", true), cnd);
         return Result.success();
     }
 
@@ -811,6 +822,9 @@ public class TourLedgerController {
     @SaCheckPermission("tour.ledger")
     public Result unionOptions() {
         Cnd cnd = Cnd.NEW();
+        if (isBranchUnionChairmanScope()) {
+            cnd.and("id", "=", SecurityUtil.getUnionId());
+        }
         cnd.asc("unionCode");
         cnd.asc("name");
         return Result.success(tourLedgerService.dao().query(Sys_union.class, cnd));
@@ -825,7 +839,7 @@ public class TourLedgerController {
         cnd.andEX("t.`year`", "<=", endYear == null ? LocalDate.now().getYear() : endYear);
         cnd.and("t.lineName", "IS NOT", null);
         cnd.and("t.lineName", "<>", "");
-        cnd.andEX("t.unionId", "=", unionId);
+        cnd.andEX("t.unionId", "=", resolveLedgerUnionId(unionId));
         cnd.andEX("t.lineType", "=", lineType);
         appendTravelPeriodFilter(cnd, travelPeriod);
         appendKeywordFilter(cnd, keyword);
@@ -864,7 +878,7 @@ public class TourLedgerController {
         cnd.and("m.travelStartTime", "<>", "");
         cnd.and("m.travelEndTime", "IS NOT", null);
         cnd.and("m.travelEndTime", "<>", "");
-        cnd.andEX("t.unionId", "=", unionId);
+        cnd.andEX("t.unionId", "=", resolveLedgerUnionId(unionId));
         cnd.andEX("t.lineType", "=", lineType);
         appendLineFilter(cnd, lineId);
         appendKeywordFilter(cnd, keyword);
@@ -892,7 +906,7 @@ public class TourLedgerController {
         cnd.and("t.delFlag", "=", false);
         cnd.andEX("t.`year`", ">=", startYear);
         cnd.andEX("t.`year`", "<=", endYear == null ? LocalDate.now().getYear() : endYear);
-        cnd.andEX("t.unionId", "=", unionId);
+        cnd.andEX("t.unionId", "=", resolveLedgerUnionId(unionId));
         cnd.andEX("t.lineType", "=", lineType);
         appendLineFilter(cnd, lineId);
         appendTravelPeriodFilter(cnd, travelPeriod);
@@ -902,6 +916,31 @@ public class TourLedgerController {
         return cnd;
     }
 
+    private boolean hasSchoolLedgerScope() {
+        return AuthUtil.hasRoleOr(RoleConstant.SYSADMIN.name(), RoleConstant.SCHOOL_UNION_ADMIN.name());
+    }
+
+    private boolean isBranchUnionChairmanScope() {
+        return !hasSchoolLedgerScope() && AuthUtil.hasRole(RoleConstant.BRANCH_UNION_CHAIRMAN.name());
+    }
+
+    private String resolveLedgerUnionId(String unionId) {
+        // 分工会主席只能查询当前登录人所在分工会；校工会管理员保留页面传入条件，支持查全部。
+        if (isBranchUnionChairmanScope()) {
+            String currentUnionId = SecurityUtil.getUnionId();
+            return StrUtil.isBlank(currentUnionId) ? "__NO_UNION__" : currentUnionId;
+        }
+        return unionId;
+    }
+
+    private boolean canAccessLedgerUnion(String unionId) {
+        if (!isBranchUnionChairmanScope()) {
+            return true;
+        }
+        String currentUnionId = SecurityUtil.getUnionId();
+        return StrUtil.isNotBlank(currentUnionId) && StrUtil.equals(currentUnionId, unionId);
+    }
+
     private void appendApprovedWorkflowFilter(Cnd cnd) {
         SqlExpressionGroup group = new SqlExpressionGroup();
         group.or("ins.id", "IS", null);

src/main/java/com/budwk/app/zhgh/staffbenefit/recuperation/controller/RecuperationLineController.java

@@ -49,7 +49,6 @@ import javax.servlet.http.HttpServletResponse;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.stream.Collectors;
 
 /**
@@ -110,9 +109,7 @@ public class RecuperationLineController {
 	@ApiOperation("获取编号")
 	@SaCheckPermission("recuperation.line")
 	public Result getNo() {
-		Object serialNumber = dao.func2(RecuperationLine.class, "max", "serialNumber");
-		serialNumber = Objects.requireNonNullElse(serialNumber, 0);
-		return Result.success(Integer.parseInt(serialNumber.toString()) + 1);
+		return Result.success(lineService.generateNextSerialNumber());
 	}
 
 	@At

src/main/java/com/budwk/app/zhgh/staffbenefit/recuperation/service/RecuperationLineService.java

@@ -39,6 +39,13 @@ public interface RecuperationLineService extends BaseService<RecuperationLine> {
 	 */
 	void editLine(RecuperationLine line);
 
+	/**
+	 * 生成新增线路默认编码，按现有纯数字线路编码最大值自增。
+	 *
+	 * @return 新线路默认编码
+	 */
+	String generateNextSerialNumber();
+
 	/**
 	 * 开启或关闭线路
 	 *

src/main/java/com/budwk/app/zhgh/staffbenefit/recuperation/service/impl/RecuperationLineServiceImpl.java

@@ -81,6 +81,20 @@ public class RecuperationLineServiceImpl extends BaseServiceImpl<RecuperationLin
 		deleteLineInfoCache(line.getId());
 	}
 
+	@Override
+	public String generateNextSerialNumber() {
+		Sql sql = Sqls.fetchInt("""
+				SELECT
+					IFNULL(MAX(CAST(serialNumber AS UNSIGNED)), 0) + 1
+				FROM
+					recuperation_line
+				WHERE
+					serialNumber REGEXP '^[0-9]+$'
+				""");
+		dao().execute(sql);
+		return String.valueOf(sql.getInt());
+	}
+
 	@Override
 	public void openClosedLine(String lineId) {
 		update(Chain.makeSpecial("isDisabled", "isDisabled ^ 1"), Cnd.where("id", "=", lineId));