package com.sinata.appointment.util;
|
|
import com.sinata.appointment.constants.BizErrorCode;
|
import com.sinata.appointment.entity.BaseEntity;
|
import com.sinata.appointment.exception.BizException;
|
import org.springframework.util.StringUtils;
|
|
/**
|
* 单条资源读写防水平越权：除 id 外须校验与库中一致的 uuid（不明示是 id 错还是 uuid 错）。
|
*/
|
public final class UuidAssert {
|
|
private UuidAssert() {}
|
|
public static void match(BaseEntity entity, String submittedUuid) {
|
if (entity == null
|
|| !StringUtils.hasText(submittedUuid)
|
|| !StringUtils.hasText(entity.getUuid())
|
|| !entity.getUuid().equals(submittedUuid.trim())) {
|
throw new BizException(BizErrorCode.RESOURCE_VERIFY_FAILED, "资源不存在或无权访问");
|
}
|
}
|
}
|
