bug：员工权限问题

刘帅

2026-09-23 5113fbc23d0a906bfe0c3ff4b0d7d8e35d8ccaf4

 cloud-server-management/src/main/java/com/dsh/guns/modular/system/controller/code/TShopController.java

@@ -335,6 +335,9 @@
        model.addAttribute("time",byId.getStartTime()+" - "+byId.getEndTime());
        User byId1 = userMapper.selectById(byId.getStoreStaffId());
        model.addAttribute("city",byId1);
        model.addAttribute("managerName", byId1 == null ? "" : byId1.getName());
        // 历史门店的手机号可能只保存在店长账号中，编辑页需与列表保持一致地回填可用手机号。
        model.addAttribute("managerPhone", resolveStoreManagerPhone(byId, byId1));
        model.addAttribute("type",1);
        // 如果当前登陆人是运营商
        if (UserExt.getUser().getObjectType()==2){
@@ -416,6 +419,8 @@
        model.addAttribute("time",byId.getStartTime()+" - "+byId.getEndTime());
        User byId1 = userMapper.selectById(byId.getStoreStaffId());
        model.addAttribute("city",byId1);
        model.addAttribute("managerName", byId1 == null ? "" : byId1.getName());
        model.addAttribute("managerPhone", resolveStoreManagerPhone(byId, byId1));
        model.addAttribute("type",0);

        return PREFIX + "TShop_edit.html";
@@ -454,7 +459,13 @@
        }
        //玩湃惠民卡
        StoreConfig c10 = storeConfigService.getOne(new LambdaQueryWrapper<StoreConfig>().eq(StoreConfig::getStoreId, id).eq(StoreConfig::getType,10));
        model.addAttribute("c10",c10);
        model.addAttribute("c10",c10!=null?c10:new StoreConfig());
        //会员卡板块
        StoreConfig c11 = storeConfigService.getOne(new LambdaQueryWrapper<StoreConfig>().eq(StoreConfig::getStoreId, id).eq(StoreConfig::getType,11));
        model.addAttribute("c11",c11!=null?c11:new StoreConfig());
        //散客入场
        StoreConfig c12 = storeConfigService.getOne(new LambdaQueryWrapper<StoreConfig>().eq(StoreConfig::getStoreId, id).eq(StoreConfig::getType,12));
        model.addAttribute("c12",c12!=null?c12:new StoreConfig());
        return PREFIX + "TShop_imgAll.html";
    }

@@ -463,14 +474,22 @@
    @ResponseBody
    public Object list(String provinceCode, String cityCode , String name, String phone,String shopName) {
        Page<TStoreListVo> page = new PageFactory<TStoreListVo>().defaultPage();
        String roleid = UserExt.getUser().getRoleid();
        List<TStoreListVo> list =new ArrayList<>();
        if("3".equals(roleid)){
            Integer objectId = UserExt.getUser().getObjectId();
            list = storeService.listAllStore(page,provinceCode,cityCode,name,phone,shopName,objectId);
        }else {
        Integer objectType = UserExt.getUser().getObjectType();
        if (Integer.valueOf(3).equals(objectType)) {
            // 门店员工按员工-门店中间表的数据范围查询；getStoreIdsByUserId 同时兼容
            // sys_user.objectId 和 t_store.storeStaffId 两种历史归属数据。
            List<Integer> storeIds = userMapper.getStoreIdsByUserId(UserExt.getUser().getId());
            if (!CollectionUtils.isEmpty(storeIds)) {
                list = storeService.listAllStoresByIds(page, provinceCode, cityCode, name, phone, shopName, storeIds);
            }
        } else if (Integer.valueOf(2).equals(objectType)) {
            Integer objectId = UserExt.getUser().getObjectId();
            list = storeService.listAll(page,provinceCode,cityCode,name,phone,shopName,objectId);
        } else {
            // 平台账号不带运营商条件，查询全部门店；数据范围由 objectType 决定，
            // 不能用 roleid（菜单权限）判断，避免员工被授予角色 1 后被误当成运营商。
            list = storeService.listAll(page, provinceCode, cityCode, name, phone, shopName, null);
        }
        page.setRecords(list);
        return  super.packForBT(page);
@@ -495,15 +514,22 @@
    @ResponseBody
    public Object listTwo1(Integer id) {
        Page<TStoreOtherConfigTrue> page = new PageFactory<TStoreOtherConfigTrue>().defaultPage();
        List<TStoreOtherConfigTrue> list = tStoreOtherConfigTrueService.page(page,new LambdaQueryWrapper<TStoreOtherConfigTrue>().eq(TStoreOtherConfigTrue::getPid, id).eq(TStoreOtherConfigTrue::getState,1)).getRecords();
        List<TStoreOtherConfigTrue> list = tStoreOtherConfigTrueService.page(page,new LambdaQueryWrapper<TStoreOtherConfigTrue>().eq(TStoreOtherConfigTrue::getPid, id).eq(TStoreOtherConfigTrue::getState,1).orderByDesc(TStoreOtherConfigTrue::getId)).getRecords();
        page.setRecords(list);
        return  super.packForBT(page);
    }

    @RequestMapping(value = "/add")
    @ResponseBody
    public Object list(TStore tStore,String time,String userName,String userPhone,String ids,Integer type,Integer yyId,String lat,String lon,String pCode1,String cCode1) {
    public Object list(TStore tStore, String time, String ids, Integer type, Integer yyId, String lat, String lon,
                       String pCode1, String cCode1, String userName) {
        try {
            if (ToolUtil.isEmpty(userName) || ToolUtil.isEmpty(tStore.getPhone())) {
                return ERROR;
            }
            if (!userMapper.selectList(new LambdaQueryWrapper<User>().eq(User::getAccount, tStore.getPhone())).isEmpty()) {
                return "5001";
            }
            if(yyId==null || type==1){
                yyId=0;
            }
@@ -563,20 +589,6 @@
            tStore.setOperatorId(yyId);
            tStore.setState(1);
            tStore.setCreateTime(new Date());
            User user = new User();
            List<User> users = userMapper.selectList(new LambdaQueryWrapper<User>().eq(User::getAccount, userPhone));
            if(users.size()>0){
                return "5001";
            }
            user.setAccount(userPhone);
            user.setName(userName);
            user.setRoleid("3");
            user.setPhone(userPhone);
            user.setPassword(SecureUtil.md5("a123456"));
            user.setObjectType(3);
            user.setStatus(1);
            userMapper.insert(user);
            tStore.setStoreStaffId(user.getId());
            tStore.setLon(lon);
            tStore.setLat(lat);
            if (yyId == null || yyId == 0){
@@ -596,12 +608,13 @@
            map1.put("location",tStore.getCity());
            map1.put("address",tStore.getAddress());
            map1.put("telephone",tStore.getPhone());
            map1.put("linkman",userName);
            map1.put("linkman",tStore.getName());
            map1.put("business_time","[{\"start_time\":\""+tStore.getStartTime()+"\",\"close_time\":\""+tStore.getEndTime()+"\"}]");
            map1.put("logo",tStore.getCoverDrawing());
            map1.put("remark",tStore.getIntroduce());
            map1.put("lat",tStore.getLat());
            map1.put("lng",tStore.getLon());
//            String result = HttpRequestUtil.postRequest("https://try.daowepark.com/v7/user_api/general/addSpace", map1);
            String result = HttpRequestUtil.postRequest("https://port.daowepark.com/v7/user_api/general/addSpace", map1);
            System.out.println(result);
            JSONObject jsonObject = JSONObject.parseObject(result);
@@ -609,9 +622,10 @@
            String space_id = data.getString("space_id");
            Integer integer = Integer.valueOf(space_id);
            tStore.setId(integer);
            User storeManager = createStoreManager(userName, tStore.getPhone(), tStore.getId());
            userMapper.insert(storeManager);
            tStore.setStoreStaffId(storeManager.getId());
            storeService.save(tStore);
            user.setObjectId(tStore.getId());
            userService.updateById(user);
            ArrayList<StoreConfig> storeConfigs = new ArrayList<>();
            for (int i = 1; i < 9; i++) {
                StoreConfig storeConfig = new StoreConfig();
@@ -648,9 +662,21 @@

    @RequestMapping(value = "/update")
    @ResponseBody
    public Object update(TStore tStore,String time,String userName,String userPhone,String ids,Integer type,Integer yyId,String lat,String lon,String pCode1,String cCode1) {
    public Object update(TStore tStore, String time, String ids, Integer type, Integer yyId, String lat, String lon,
                         String pCode1, String cCode1, String userName) {
        try {
            TStore byIdc = storeService.getById(tStore.getId());
            if (ToolUtil.isEmpty(userName) || ToolUtil.isEmpty(tStore.getPhone())) {
                return ERROR;
            }
            LambdaQueryWrapper<User> managerAccountQuery = new LambdaQueryWrapper<User>()
                    .eq(User::getAccount, tStore.getPhone());
            if (byIdc.getStoreStaffId() != null) {
                managerAccountQuery.ne(User::getId, byIdc.getStoreStaffId());
            }
            if (!userMapper.selectList(managerAccountQuery).isEmpty()) {
                return "5001";
            }

            if(yyId==null){
                yyId=0;
@@ -683,10 +709,17 @@
                        }
                    }
                }else {
                    TCity one = cityService.getOne(new LambdaQueryWrapper<TCity>().eq(TCity::getId, tStore.getProvinceCode()));
                    // 编辑页提交的是行政区划编码；按 id 查询会导致查不到省、市，随后访问名称时抛出 NPE。
                    TCity one = cityService.getOne(new LambdaQueryWrapper<TCity>().eq(TCity::getCode, tStore.getProvinceCode()));
                    if (one == null) {
                        return ERROR;
                    }
                    tStore.setProvince(one.getName());
                    tStore.setProvinceCode(one.getCode());
                    TCity one1 = cityService.getOne(new LambdaQueryWrapper<TCity>().eq(TCity::getId, tStore.getCityCode()));
                    TCity one1 = cityService.getOne(new LambdaQueryWrapper<TCity>().eq(TCity::getCode, tStore.getCityCode()));
                    if (one1 == null) {
                        return ERROR;
                    }
                    tStore.setCity(one1.getName());
                    tStore.setCityCode(one1.getCode());
                }
@@ -707,20 +740,22 @@
            if(ToolUtil.isEmpty(tStore.getCoverDrawing())){
                tStore.setCoverDrawing(byIdc.getCoverDrawing());
            }
            User user = userMapper.selectById(byIdc.getStoreStaffId());
            List<User> users = userMapper.selectList(new LambdaQueryWrapper<User>().eq(User::getAccount, userPhone).ne(User::getId,tStore.getStoreStaffId()));
            if(users.size()>0){
                return "5001";
            }
            user.setAccount(userPhone);
            user.setName(userName);
            user.setPhone(userPhone);
            userMapper.updateById(user);
            tStore.setLon(lon);
            tStore.setLat(lat);
            // 运营商编辑
            if (UserExt.getUser().getObjectType()==2){
                tStore.setOperatorId(null);
            }
            User storeManager = byIdc.getStoreStaffId() == null ? null : userMapper.selectById(byIdc.getStoreStaffId());
            if (storeManager == null) {
                storeManager = createStoreManager(userName, tStore.getPhone(), tStore.getId());
                userMapper.insert(storeManager);
                tStore.setStoreStaffId(storeManager.getId());
            } else {
                storeManager.setName(userName);
                storeManager.setPhone(tStore.getPhone());
                storeManager.setAccount(tStore.getPhone());
                userMapper.updateById(storeManager);
            }
            storeService.updateById(tStore);

@@ -729,6 +764,27 @@
            e.printStackTrace();
            return ERROR;
        }
    }

    private User createStoreManager(String name, String phone, Integer storeId) {
        User user = new User();
        user.setName(name);
        user.setPhone(phone);
        user.setAccount(phone);
        user.setPassword(SecureUtil.md5("a123456"));
        user.setRoleid("3");
        user.setObjectType(3);
        user.setObjectId(storeId);
        user.setStatus(1);
        user.setCreatetime(new Date());
        return user;
    }

    private String resolveStoreManagerPhone(TStore store, User storeManager) {
        if (ToolUtil.isNotEmpty(store.getPhone())) {
            return store.getPhone();
        }
        return storeManager == null ? "" : storeManager.getPhone();
    }
    @RequestMapping(value = "/onChange")
    @ResponseBody
@@ -743,9 +799,9 @@
    }
    @RequestMapping(value = "/saveImgAll")
    @ResponseBody
    public Object saveImgAll(Integer id,Integer px1,Integer px2,Integer px3,Integer px4,Integer px5,Integer px6,Integer px7,Integer px8,Integer px10,
                             String c1,String c2,String c3,String c4,String c5,String c6,String c7,String c8,String c10,
                             Integer r1,Integer r2,Integer r3,Integer r4,Integer r5,Integer r6,Integer r7,Integer r8,Integer r10,String str) {
    public Object saveImgAll(Integer id,Integer px1,Integer px2,Integer px3,Integer px4,Integer px5,Integer px6,Integer px7,Integer px8,Integer px10,Integer px11,Integer px12,
                             String c1,String c2,String c3,String c4,String c5,String c6,String c7,String c8,String c10,String c111,String c12,
                             Integer r1,Integer r2,Integer r3,Integer r4,Integer r5,Integer r6,Integer r7,Integer r8,Integer r10,Integer r11,Integer r12,String str) {
        try {
            ArrayList<StoreConfig> storeConfigs = new ArrayList<>();
            StoreConfig collect1 = collect(id, px1, r1, c1, 1);
@@ -757,6 +813,8 @@
            StoreConfig collect7 = collect(id, px7, r7, c7, 7);
            StoreConfig collect8 = collect(id, px8, r8, c8, 8);
            StoreConfig collect10 = collect(id, px10, r10, c10, 10);
            StoreConfig collect11 = collect(id, px11, r11, c111, 11);
            StoreConfig collect12 = collect(id, px12, r12, c12, 12);
            storeConfigs.add(collect1);
            storeConfigs.add(collect2);
            storeConfigs.add(collect3);
@@ -766,6 +824,8 @@
            storeConfigs.add(collect7);
            storeConfigs.add(collect8);
            storeConfigs.add(collect10);
            storeConfigs.add(collect11);
            storeConfigs.add(collect12);
            storeConfigService.saveOrUpdateBatch(storeConfigs);

            // 修改世界杯