bug：查看敏感信息、员工&门店管理修改问题

刘帅

2026-09-22 ee9f387a56ca3fd620c56a91c1860201a98f0ca0

 cloud-server-account/src/main/java/com/dsh/account/controller/StudentController.java

@@ -73,6 +73,14 @@
    }

    /**
     * MyBatis-Plus 会将空集合拼成 IN ()，ShardingSphere 无法解析该 SQL。
     * 空集合按无匹配用户处理，使用不可能的 ID 进行查询。
     */
    private List<Integer> normalizeQueryIds(List<Integer> ids) {
        return ids == null || ids.isEmpty() ? Collections.singletonList(-1) : ids;
    }

    /**
     * 查询玩湃惠民卡绑定学员列表信息
     *
     * @return
@@ -312,10 +320,35 @@
        return studentService.listOne(id);
    }

    /** 仅供管理端超级管理员经受控接口查看学员完整敏感信息。 */
    @PostMapping("/internal/sensitive/student/{id}")
    public Map<String, Object> sensitiveStudent(@PathVariable("id") Integer id,
                                                @RequestHeader(value = "X-Internal-Sensitive-Access", required = false) String access) {
        if (!"true".equalsIgnoreCase(access)) {
            throw new IllegalStateException("Sensitive data access is restricted to the management service");
        }
        TStudent student = studentService.getById(id);
        if (student == null) return null;
        Map<String, Object> result = new HashMap<String, Object>();
        result.put("id", student.getId());
        result.put("appUserId", student.getAppUserId());
        result.put("name", student.getName());
        result.put("phone", student.getPhone());
        result.put("idCard", student.getIdCard());
        return result;
    }

    @ResponseBody
    @PostMapping("/student/update")
    public void update(@RequestBody TStudent tStudent) {
        System.out.println("======tStudent======" + tStudent);
        // 管理端不会回显加密手机号；空值代表未修改，必须保留数据库中的原始值。
        if (StringUtils.isEmpty(tStudent.getPhone()) && tStudent.getId() != null) {
            TStudent originalStudent = studentService.getById(tStudent.getId());
            if (originalStudent != null) {
                tStudent.setPhone(originalStudent.getPhone());
            }
        }
        studentService.updateById(tStudent);
    }

@@ -733,6 +766,7 @@
    @ResponseBody
    @PostMapping("/student/stuStores")
    public HashMap<String, Object> stuStores(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();

        List<Integer> activeUserIds = getActiveUserIds(ids);
@@ -835,6 +869,7 @@
    @ResponseBody
    @PostMapping("/student/userAndVipYys")
    public HashMap<String, Object> userAndVipYys(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();

        // 所有的
@@ -949,6 +984,7 @@
    @ResponseBody
    @PostMapping("/student/userAndVipStore")
    public HashMap<String, Object> userAndVipStore(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();
        // 所有的
        List<TAppUser> list = appUserService.list(new LambdaQueryWrapper<TAppUser>()
@@ -1073,10 +1109,11 @@
        if (ToolUtil.isNotEmpty(data)) {
            String stime = data.split(" - ")[0] + " 00:00:00";
            String etime = data.split(" - ")[1] + " 23:59:59";
            vipPaymentLambdaQueryWrapper.between(VipPayment::getInsertTime, stime, etime);
            vipPaymentLambdaQueryWrapper.between(VipPayment::getPayTime, stime, etime);
        }
        vipPaymentLambdaQueryWrapper.in(VipPayment::getAppUserId, ids);
        vipPaymentLambdaQueryWrapper.eq(VipPayment::getPayStatus, 2);
        vipPaymentLambdaQueryWrapper.eq(VipPayment::getState, 1);
        List<VipPayment> list = vipPaymentService.list(vipPaymentLambdaQueryWrapper);
        double sum = list.stream().mapToDouble(VipPayment::getAmount).sum();

@@ -1086,10 +1123,11 @@
        if (ToolUtil.isNotEmpty(data)) {
            String stime = data.split(" - ")[0] + " 00:00:00";
            String etime = data.split(" - ")[1] + " 23:59:59";
            rechargeRecordsLambdaQueryWrapper.between(RechargeRecords::getInsertTime, stime, etime);
            rechargeRecordsLambdaQueryWrapper.between(RechargeRecords::getPayTime, stime, etime);
        }
        rechargeRecordsLambdaQueryWrapper.in(RechargeRecords::getAppUserId, ids);
        rechargeRecordsLambdaQueryWrapper.eq(RechargeRecords::getPayStatus, 2);
        rechargeRecordsLambdaQueryWrapper.eq(RechargeRecords::getState, 1);
        List<RechargeRecords> list1 = rechargeRecordsService.list(rechargeRecordsLambdaQueryWrapper);
        double sum1 = list1.stream().map(RechargeRecords::getAmount).reduce(BigDecimal.ZERO, BigDecimal::add).doubleValue();

@@ -1168,6 +1206,9 @@
        ArrayList<Integer> integers = new ArrayList<>();

        for (String string : strings) {
            if (string.equals("中华人民共和国")) {
                continue;
            }
            int a = 0;
            strings1.add(string);
            for (TAppUser tAppUser : list) {
@@ -1230,6 +1271,7 @@

    @PostMapping("/student/queryUserAgeYys")
    public HashMap<String, Object> queryUserAgeYys(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();
        List<TAppUser> list = appUserService.list(new LambdaQueryWrapper<TAppUser>().in(TAppUser::getId, ids)
                .isNotNull(TAppUser::getPhone)
@@ -1313,6 +1355,7 @@

    @PostMapping("/student/queryUserAgeStore")
    public HashMap<String, Object> queryUserAgeStore(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();
        List<TAppUser> list = appUserService.list(new LambdaQueryWrapper<TAppUser>().in(TAppUser::getId, ids)
                .isNotNull(TAppUser::getPhone)
@@ -1396,6 +1439,7 @@

    @PostMapping("/student/queryUserAgeYys1")
    public HashMap<String, Object> queryUserAgeYys1(@RequestBody List<Integer> ids) {
        ids = normalizeQueryIds(ids);
        HashMap<String, Object> map = new HashMap<>();
        List<TAppUser> list = appUserService.list(new LambdaQueryWrapper<TAppUser>().in(TAppUser::getId, ids));
        List<Integer> collect = list.stream().map(TAppUser::getId).collect(Collectors.toList());