删除越权漏洞修复中的内部调用注解

longz

2026-08-28 3e6094c1c71f71824890baaf9163d66a76bb4433

 ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java

@@ -9,6 +9,7 @@
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.toolkit.Wrappers;
import com.baomidou.mybatisplus.extension.conditions.query.LambdaQueryChainWrapper;
import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
import com.ruoyi.account.api.dto.*;
import com.ruoyi.account.api.model.*;
@@ -16,6 +17,8 @@
import com.ruoyi.account.util.*;
import com.ruoyi.account.util.carBrand.CarBrandUtil;
import com.ruoyi.account.wx.model.WeixinProperties;
import com.ruoyi.chargingPile.api.feignClient.PartnerClient;
import com.ruoyi.chargingPile.api.model.Partner;
import com.ruoyi.common.core.constant.Constants;
import com.ruoyi.common.core.constant.MsgConstants;
import com.ruoyi.common.core.domain.R;
@@ -32,6 +35,7 @@
import com.ruoyi.common.redis.service.RedisService;
import com.ruoyi.common.security.annotation.Logical;
import com.ruoyi.common.security.annotation.RequiresPermissions;
import com.ruoyi.common.security.annotation.InnerAuth;
import com.ruoyi.common.security.auth.AuthUtil;
import com.ruoyi.common.security.service.TokenService;
import com.ruoyi.common.security.utils.SecurityUtils;
@@ -57,6 +61,8 @@
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.compress.utils.IOUtils;
import org.redisson.api.RLock;
import org.redisson.api.RedissonClient;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.validation.annotation.Validated;
@@ -148,6 +154,15 @@
    private TInviteUserService inviteUserService;
    @Resource
    private GiveVipUtil giveVipUtil;
    @Resource
    private TAppUserWhitelistService appUserWhitelistService;
    @Resource
    private PartnerClient partnerClient;
    @Resource
    private PartnerAppUserAccessService partnerAppUserAccessService;

    @Autowired
    private RedissonClient redissonClient;

    /**
     * 远程调用 发送邮件
@@ -282,6 +297,7 @@
    }

    @ApiOperation(value = "管理后台-根据手机号查询用户ids", tags = {"管理后台-活动费用统计"})
    @RequiresPermissions(value = {"/appUser/select", "/appUser/list"}, logical = Logical.OR)
    @PostMapping(value = "/user/getUserIdsByPhone")
    public R<List<Long>> getUserIdsByPhone(@RequestParam("phone") String phone) {
        return R.ok(appUserService.list(new QueryWrapper<TAppUser>().like("phone",phone)).stream().map(TAppUser::getId).collect(Collectors.toList()));
@@ -357,9 +373,29 @@
        //如果要筛选标签。用标签获取useids
        if (userListQueryDto.getUserTagId() != null){
            userIds = appUserTagService.lambdaQuery().eq(TAppUserTag::getUserTagId, userListQueryDto.getUserTagId()).list().stream().map(TAppUserTag::getAppUserId).collect(Collectors.toList());
            if (userIds.isEmpty()) {
                userIds.add(-1L);
            }
        }
        List<TAppUserWhitelist> whitelistList = new ArrayList<>();
        List<Long> whitelistUserIds = new ArrayList<>();
        List<String> whitelistPhones = new ArrayList<>();
        if (userListQueryDto.getWhitelistFlag() != null) {
            whitelistList = appUserWhitelistService.lambdaQuery()
                    .eq(TAppUserWhitelist::getStatus, 1)
                    .eq(TAppUserWhitelist::getDelFlag, false)
                    .list();
            whitelistUserIds = whitelistList.stream()
                    .map(TAppUserWhitelist::getAppUserId)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toList());
            whitelistPhones = whitelistList.stream()
                    .map(TAppUserWhitelist::getPhone)
                    .filter(StringUtils::isNotBlank)
                    .collect(Collectors.toList());
        }
        //列表查询
        Page<TAppUser> page = appUserService.lambdaQuery()
        LambdaQueryChainWrapper<TAppUser> query = appUserService.lambdaQuery()
                .like(userListQueryDto.getUserPhone() != null && !"".equals(userListQueryDto.getUserPhone()), TAppUser::getPhone, userListQueryDto.getUserPhone())
                .eq(userListQueryDto.getCompanyId() != null, TAppUser::getCompanyId, userListQueryDto.getCompanyId())
                .eq(userListQueryDto.getProvinceCode() != null && !"".equals(userListQueryDto.getProvinceCode()), TAppUser::getProvinceCode, userListQueryDto.getProvinceCode())
@@ -367,12 +403,65 @@
                .eq(userListQueryDto.getStatus() != null, TAppUser::getStatus, userListQueryDto.getStatus())
                .eq(userListQueryDto.getVipTypeId() != null, TAppUser::getVipId, userListQueryDto.getVipTypeId())
                .in(!userIds.isEmpty(),TAppUser::getId,userIds)
                .orderByDesc(BasePojo::getCreateTime)
                .page(Page.of(userListQueryDto.getPageCurr(), userListQueryDto.getPageSize()));
                .orderByDesc(BasePojo::getCreateTime);
        List<Long> partnerVisibleUserIds = partnerAppUserAccessService.getVisibleUserIdsForCurrentPartner();
        if (partnerVisibleUserIds != null) {
            query.in(TAppUser::getId, partnerVisibleUserIds);
        }
        if (Integer.valueOf(1).equals(userListQueryDto.getWhitelistFlag())) {
            if (whitelistUserIds.isEmpty() && whitelistPhones.isEmpty()) {
                query.eq(TAppUser::getId, -1L);
            } else {
                List<Long> finalWhitelistUserIds = whitelistUserIds;
                List<String> finalWhitelistPhones = whitelistPhones;
                query.and(wrapper -> {
                    if (!finalWhitelistUserIds.isEmpty()) {
                        wrapper.in(TAppUser::getId, finalWhitelistUserIds);
                    }
                    if (!finalWhitelistPhones.isEmpty()) {
                        if (!finalWhitelistUserIds.isEmpty()) {
                            wrapper.or();
                        }
                        wrapper.in(TAppUser::getPhone, finalWhitelistPhones);
                    }
                });
            }
        }
        if (Integer.valueOf(2).equals(userListQueryDto.getWhitelistFlag())) {
            query.notIn(!whitelistUserIds.isEmpty(), TAppUser::getId, whitelistUserIds)
                    .notIn(!whitelistPhones.isEmpty(), TAppUser::getPhone, whitelistPhones);
        }
        Page<TAppUser> page = query.page(Page.of(userListQueryDto.getPageCurr(), userListQueryDto.getPageSize()));
        if (page.getRecords().isEmpty()){
            return R.ok(page);
        }
        List<Long> pageUserIds = page.getRecords().stream().map(TAppUser::getId).collect(Collectors.toList());
        List<String> pageUserPhones = page.getRecords().stream()
                .map(TAppUser::getPhone)
                .filter(StringUtils::isNotBlank)
                .map(String::trim)
                .distinct()
                .collect(Collectors.toList());
        LambdaQueryChainWrapper<TAppUserWhitelist> pageWhitelistQuery = appUserWhitelistService.lambdaQuery()
                .eq(TAppUserWhitelist::getStatus, 1)
                .eq(TAppUserWhitelist::getDelFlag, false)
                .and(wrapper -> {
                    wrapper.in(TAppUserWhitelist::getAppUserId, pageUserIds);
                    if (!pageUserPhones.isEmpty()) {
                        wrapper.or().in(TAppUserWhitelist::getPhone, pageUserPhones);
                    }
                });
        List<TAppUserWhitelist> pageWhitelistList = pageWhitelistQuery.list();
        Set<Long> activeWhitelistUserIds = pageWhitelistList.stream()
                .map(TAppUserWhitelist::getAppUserId)
                .filter(Objects::nonNull)
                .collect(Collectors.toSet());
        Set<String> activeWhitelistPhones = pageWhitelistList.stream()
                .map(TAppUserWhitelist::getPhone)
                .filter(StringUtils::isNotBlank)
                .map(String::trim)
                .collect(Collectors.toSet());
        Map<Long, String> userTagNameMap = getUserTagNameMap(pageUserIds);
        Map<Long, BigDecimal> exchangeCodeBalanceMap = otherClient.getExchangeCodeBalanceMap(pageUserIds).getData();
        if (exchangeCodeBalanceMap == null) {
            exchangeCodeBalanceMap = new HashMap<>();
@@ -384,15 +473,10 @@
        //循环处理
        for (TAppUser appUser : page.getRecords()) {
            appUser.setExchangeCodeBalance(exchangeCodeBalanceMap.getOrDefault(appUser.getId(), BigDecimal.ZERO));
            //拿到最新的tagId
            TAppUserTag one = appUserTagService.lambdaQuery().eq(TAppUserTag::getAppUserId, appUser.getId()).orderByDesc(TAppUserTag::getCreateTime).last("limit 1").one();
            if (one!=null) {
                //设置最新的tagName
                R<TUserTag> byIdTag = otherClient.getByIdTag(one.getUserTagId());
                if (byIdTag.getData() != null) {
                    appUser.setTagName(byIdTag.getData().getName());
                }
            }
            appUser.setTagName(userTagNameMap.get(appUser.getId()));
            boolean activeWhitelist = activeWhitelistUserIds.contains(appUser.getId())
                    || (StringUtils.isNotBlank(appUser.getPhone()) && activeWhitelistPhones.contains(appUser.getPhone().trim()));
            appUser.setWhitelistFlag(activeWhitelist ? 1 : 2);
            if (appUser.getVipEndTime()!=null&&appUser.getVipEndTime().isAfter(LocalDateTime.now())) {
                //匹配vipMap的值
                appUser.setVipName(vipMap.getData().get(appUser.getVipId()));
@@ -419,6 +503,37 @@
        }
        return R.ok(page);
    }

    private Map<Long, String> getUserTagNameMap(List<Long> userIds) {
        if (userIds == null || userIds.isEmpty()) {
            return new HashMap<>();
        }
        List<TAppUserTag> userTags = appUserTagService.lambdaQuery()
                .in(TAppUserTag::getAppUserId, userIds)
                .orderByDesc(TAppUserTag::getCreateTime)
                .list();
        if (userTags.isEmpty()) {
            return new HashMap<>();
        }
        List<Integer> tagIds = userTags.stream()
                .map(TAppUserTag::getUserTagId)
                .filter(Objects::nonNull)
                .distinct()
                .collect(Collectors.toList());
        R<Map<Integer, String>> tagMapResult = otherClient.getTagMap(tagIds);
        Map<Integer, String> tagMap = tagMapResult == null || tagMapResult.getData() == null ? new HashMap<>() : tagMapResult.getData();
        Map<Long, LinkedHashSet<String>> userTagNames = new HashMap<>();
        for (TAppUserTag userTag : userTags) {
            String tagName = tagMap.get(userTag.getUserTagId());
            if (StringUtils.isBlank(tagName)) {
                continue;
            }
            userTagNames.computeIfAbsent(userTag.getAppUserId(), key -> new LinkedHashSet<>()).add(tagName);
        }
        Map<Long, String> result = new HashMap<>();
        userTagNames.forEach((userId, names) -> result.put(userId, String.join(",", names)));
        return result;
    }
    
    
    @RequiresPermissions(value = {"/vipList"}, logical = Logical.OR)
@@ -439,17 +554,7 @@
            end2 = LocalDateTime.now().plusDays(userListQueryDto.getVipEndTime2());
        }
        //列表查询
        Page<TAppUser> page = appUserService.lambdaQuery()
                .ge(TAppUser::getVipEndTime, LocalDateTime.now())
                .like(userListQueryDto.getUserPhone() != null && !"".equals(userListQueryDto.getUserPhone()), TAppUser::getPhone, userListQueryDto.getUserPhone())
                .eq(userListQueryDto.getCompanyId() != null, TAppUser::getCompanyId, userListQueryDto.getCompanyId())
                .eq(userListQueryDto.getProvinceCode() != null && !"".equals(userListQueryDto.getProvinceCode()), TAppUser::getProvinceCode, userListQueryDto.getProvinceCode())
                .eq(userListQueryDto.getCityCode() != null && !"".equals(userListQueryDto.getCityCode()), TAppUser::getCityCode, userListQueryDto.getCityCode())
                .eq(userListQueryDto.getStatus() != null, TAppUser::getStatus, userListQueryDto.getStatus())
                .eq(userListQueryDto.getVipTypeId() != null, TAppUser::getVipId, userListQueryDto.getVipTypeId())
                .ge(userListQueryDto.getVipEndTime1() != null, TAppUser::getVipEndTime, end1 )
                .le(userListQueryDto.getVipEndTime2() != null, TAppUser::getVipEndTime, end2)
                .in(!userIds.isEmpty(), TAppUser::getId, userIds)
        Page<TAppUser> page = buildVipUserQuery(userListQueryDto)
                .page(Page.of(userListQueryDto.getPageCurr(), userListQueryDto.getPageSize()));
        if (page.getRecords().isEmpty()){
            return R.ok(page);
@@ -486,6 +591,47 @@
            }
        }
        return R.ok(page);
    }

    @ApiOperation(value = "会员列表筛选用户ids", tags = {"用户管理-会员列表"})
    @PostMapping(value = "/user/vip/userIds")
    public R<List<Long>> vipUserIds(@RequestBody UserListQueryDto userListQueryDto) {
        List<Long> userIds = buildVipUserQuery(userListQueryDto).list().stream()
                .map(TAppUser::getId)
                .collect(Collectors.toList());
        return R.ok(userIds);
    }

    private LambdaQueryChainWrapper<TAppUser> buildVipUserQuery(UserListQueryDto userListQueryDto) {
        if (userListQueryDto == null) {
            userListQueryDto = new UserListQueryDto();
        }
        List<Long> userIds = new ArrayList<>();
        if (userListQueryDto.getUserTagId() != null){
            userIds = appUserTagService.lambdaQuery().eq(TAppUserTag::getUserTagId, userListQueryDto.getUserTagId()).list().stream().map(TAppUserTag::getAppUserId).collect(Collectors.toList());
            if (userIds.isEmpty()) {
                userIds.add(-1L);
            }
        }
        LocalDateTime end1 = null;
        LocalDateTime end2 = null ;
        if (userListQueryDto.getVipEndTime1()!=null) {
            end1 = LocalDateTime.now().plusDays(userListQueryDto.getVipEndTime1());
        }
        if (userListQueryDto.getVipEndTime2()!=null){
            end2 = LocalDateTime.now().plusDays(userListQueryDto.getVipEndTime2());
        }
        return appUserService.lambdaQuery()
                .ge(TAppUser::getVipEndTime, LocalDateTime.now())
                .like(userListQueryDto.getUserPhone() != null && !"".equals(userListQueryDto.getUserPhone()), TAppUser::getPhone, userListQueryDto.getUserPhone())
                .eq(userListQueryDto.getCompanyId() != null, TAppUser::getCompanyId, userListQueryDto.getCompanyId())
                .eq(userListQueryDto.getProvinceCode() != null && !"".equals(userListQueryDto.getProvinceCode()), TAppUser::getProvinceCode, userListQueryDto.getProvinceCode())
                .eq(userListQueryDto.getCityCode() != null && !"".equals(userListQueryDto.getCityCode()), TAppUser::getCityCode, userListQueryDto.getCityCode())
                .eq(userListQueryDto.getStatus() != null, TAppUser::getStatus, userListQueryDto.getStatus())
                .eq(userListQueryDto.getVipTypeId() != null, TAppUser::getVipId, userListQueryDto.getVipTypeId())
                .ge(userListQueryDto.getVipEndTime1() != null, TAppUser::getVipEndTime, end1 )
                .le(userListQueryDto.getVipEndTime2() != null, TAppUser::getVipEndTime, end2)
                .in(!userIds.isEmpty(), TAppUser::getId, userIds);
    }
    
    
@@ -553,6 +699,8 @@
    @Log(title = "【用户列表】添加编辑用户", businessType = BusinessType.INSERT,operatorType = OperatorType.MANAGE)
    public R addOrUpdate(@RequestBody TAppUser  tAppUser) {
        if (tAppUser.getId() != null){
            AuthUtil.checkPermi("/appUser/update");
            partnerAppUserAccessService.assertUserVisible(tAppUser.getId());
            //为编辑操作，要进行vip的逻辑处理
            TAppUser nowUser = appUserService.getById(tAppUser.getId());
            //会员结束时间不为空
@@ -586,6 +734,7 @@
            }

        }else {
           AuthUtil.checkPermi("/appUser/add");
           List<TAppUser> list = appUserService.lambdaQuery().eq(TAppUser::getPhone, tAppUser.getPhone()).list();
           if (!list.isEmpty()){
               return R.fail("该手机号已注册");
@@ -596,10 +745,11 @@
    }
    
    
    @RequiresPermissions(value = {"/appUser/select", "/vipList/select"}, logical = Logical.OR)
    @RequiresPermissions(value = {"/appUser/list", "/appUser/select", "/vipList/select"}, logical = Logical.OR)
    @ApiOperation(value = "用户详情", tags = {"用户管理-用户列表"})
    @GetMapping(value = "/user/detail/{id}")
    public R<UserDetailDto> userDetail(@PathVariable Long id) {
        partnerAppUserAccessService.assertUserVisible(id);
        TAppUser user = appUserService.getById(id);
        R<Map<Integer, String>> vipMap = otherClient.getVipMap(Collections.singletonList(user.getVipId()));
        if (user.getVipEndTime()!=null&&user.getVipEndTime().isAfter(LocalDateTime.now())) {
@@ -610,6 +760,12 @@

        UserDetailDto userDetailDto =  new UserDetailDto();
        BeanUtils.copyProperties(user,userDetailDto);
        Map<Long, BigDecimal> exchangeCodeBalanceMap = otherClient
                .getExchangeCodeBalanceMap(Collections.singletonList(id))
                .getData();
        userDetailDto.setExchangeCodeBalance(exchangeCodeBalanceMap == null
                ? BigDecimal.ZERO
                : exchangeCodeBalanceMap.getOrDefault(id, BigDecimal.ZERO));

        //获取累计充电数量
        R<Long> useOrderCount = chargingOrderClient.useOrderCount(user.getId());
@@ -621,24 +777,21 @@
        List<TAppUserCar> carList = appUserCarService.lambdaQuery().eq(TAppUserCar::getAppUserId, id).orderByDesc(BasePojo::getCreateTime).list();
        userDetailDto.setCarList(carList);

        List<Integer> tagIds = appUserTagService.lambdaQuery().eq(TAppUserTag::getAppUserId, id).orderByDesc(TAppUserTag::getCreateTime).list().stream().map(TAppUserTag::getUserTagId).collect(Collectors.toList());
        R<Map<Integer, String>> tagMap = otherClient.getTagMap(tagIds);
        userDetailDto.setTagName(tagMap.getData().values()
                .stream()
                .collect(Collectors.joining(",")));
        userDetailDto.setTagName(getUserTagNameMap(Collections.singletonList(id)).get(id));



        return R.ok(userDetailDto);
    }
    
    @RequiresPermissions(value = {"/appUser/select", "/vipList/select"}, logical = Logical.OR)
    @RequiresPermissions(value = {"/appUser/list", "/appUser/select", "/vipList/select"}, logical = Logical.OR)
    @ApiOperation(value = "用户详情积分明细", tags = {"后台-用户管理-用户列表"})
    @PostMapping(value = "/user/points/page")
    public R<Page<TAppUserIntegralChange>> pointsDetail(@RequestBody PointsQueryDto pointsQueryDto) {
        if (pointsQueryDto.getUserId()==null){
            pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
        }
        partnerAppUserAccessService.assertUserVisible(pointsQueryDto.getUserId());
        List<Integer> types = new ArrayList<>();
        if (pointsQueryDto.getType()==null){
            types.add(1);
@@ -687,9 +840,8 @@
    @ApiOperation(value = "用户详情积分明细", tags = {"小程序-个人中心"})
    @PostMapping(value = "/user/points/page1")
    public R<Page<TAppUserIntegralChange>> pointsDetail1(@RequestBody PointsQueryDto pointsQueryDto) {
        if (pointsQueryDto.getUserId()==null){
            pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
        }
        // 强制绑定当前登录用户，防止越权查询他人积分明细
        pointsQueryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
        List<Integer> types = new ArrayList<>();
        if (pointsQueryDto.getType()==null){
            types.add(1);
@@ -734,12 +886,19 @@

    }

    @RequiresPermissions(value = {"/appUser/list", "/appUser/select", "/vipList/select"}, logical = Logical.OR)
    @ApiOperation(value = "用户详情余额明细", tags = {"后台-用户管理-用户列表"})
    @PostMapping(value = "/user/balance/page")
    public R<Page<TExchangeCodeUseRecord>> adminBalanceDetail(@RequestBody ExchangeCodeUseRecordQuery queryDto) {
        partnerAppUserAccessService.assertUserVisible(queryDto.getUserId());
        return otherClient.exchangeCodeUseRecordPage(queryDto);
    }

    @ApiOperation(value = "余额明细", tags = {"小程序-个人中心"})
    @PostMapping(value = "/user/balance/page1")
    public R<Page<TExchangeCodeUseRecord>> balanceDetail(@RequestBody ExchangeCodeUseRecordQuery queryDto) {
        if (queryDto.getUserId() == null) {
            queryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
        }
        // 强制绑定当前登录用户，防止越权查询他人余额明细
        queryDto.setUserId(tokenService.getLoginUserApplet().getUserId());
        return otherClient.exchangeCodeUseRecordPage(queryDto);
    }

@@ -798,6 +957,7 @@
    @PostMapping(value = "/user/status/change")
    @Log(title = "【用户列表】冻结解冻用户", businessType = BusinessType.UPDATE,operatorType = OperatorType.MANAGE)
    public R pointsDetail(@RequestBody UserChangeDto userChangeDto) {
        partnerAppUserAccessService.assertUserVisible(userChangeDto.getUserId());
        TAppUser appUser = appUserService.getById(userChangeDto.getUserId());
        appUser.setStatus(userChangeDto.getStatus());
        appUser.setRemark(userChangeDto.getRemark());
@@ -811,8 +971,10 @@
    @PostMapping(value = "/user/unit/change")
    @Log(title = "【用户列表】修改用户单位", businessType = BusinessType.UPDATE,operatorType = OperatorType.MANAGE)
    public R unitChange(@RequestBody UnitChangeDto unitChangeDto) {
        for (String s : unitChangeDto.getIds().split(",")) {
            TAppUser byId = appUserService.getById(s);
        List<Long> userIds = parseUserIds(unitChangeDto.getIds());
        partnerAppUserAccessService.assertUsersVisible(userIds);
        for (Long userId : userIds) {
            TAppUser byId = appUserService.getById(userId);
            byId.setCompanyId(unitChangeDto.getUnitId());
            appUserService.updateById(byId);
        }
@@ -825,9 +987,10 @@
    @DeleteMapping(value = "/user/delete")
    @Log(title = "【用户列表】删除用户", businessType = BusinessType.DELETE,operatorType = OperatorType.MANAGE)
    public R userDelete(String ids) {
        String[] split = ids.split(",");
        for (String s : split) {
            appUserService.removeById(s);
        List<Long> userIds = parseUserIds(ids);
        partnerAppUserAccessService.assertUsersVisible(userIds);
        for (Long userId : userIds) {
            appUserService.removeById(userId);
        }
        return R.ok();

@@ -839,7 +1002,8 @@
    @ApiOperation(value = "个人中心信息", tags = {"小程序-个人中心"})
    @GetMapping(value = "/user/info")
    public R<AppUserInfoDto> info() {
        Long userId = tokenService.getLoginUserApplet().getUserId();
        LoginUserApplet loginUserApplet = tokenService.getLoginUserApplet();
        Long userId = loginUserApplet.getUserId();
        TAppUser byId = appUserService.getById(userId);
        AppUserInfoDto appUserInfoDto = new AppUserInfoDto();
        TVip data = vipClient.getVipInfoByType(2).getData();
@@ -874,6 +1038,40 @@
        appUserInfoDto.setUserCars(list);
        appUserInfoDto.setFirstAdd(byId.getFirstAdd()!=null?byId.getFirstAdd():0);
        appUserInfoDto.setPoints(byId.getPoints()==null?0:byId.getPoints());
        appUserInfoDto.setWxOpenid(byId.getWxOpenid());
        appUserInfoDto.setAliOpenid(byId.getAliOpenid());
        appUserInfoDto.setAliUserId(loginUserApplet.getAliUserId());
        appUserInfoDto.setAliUnionId(loginUserApplet.getAliUnionId());
        appUserInfoDto.setBalance(byId.getBalance()==null?BigDecimal.ZERO:byId.getBalance());
        Partner boundPartner = null;
        try {
            R<Partner> partnerResult = partnerClient.getPartnerByAppUserId(userId);
            boundPartner = partnerResult == null ? null : partnerResult.getData();
        } catch (Exception e) {
            log.warn("查询小程序用户绑定合作商失败，继续兼容旧白名单关系: {}", e.getMessage());
        }

        Integer partnerId = boundPartner == null ? null : boundPartner.getId();
        String partnerName = boundPartner == null ? null : boundPartner.getName();
        if (partnerId == null) {
            TAppUserWhitelist partnerWhitelist = appUserWhitelistService.lambdaQuery()
                    .eq(TAppUserWhitelist::getAppUserId, userId)
                    .eq(TAppUserWhitelist::getScopeType, 3)
                    .eq(TAppUserWhitelist::getStatus, 1)
                    .eq(TAppUserWhitelist::getDelFlag, false)
                    .isNotNull(TAppUserWhitelist::getPartnerId)
                    .last("limit 1")
                    .one();
            if (partnerWhitelist != null) {
                partnerId = partnerWhitelist.getPartnerId();
                R<Partner> legacyPartnerResult = partnerClient.getPartnerById(partnerId);
                Partner legacyPartner = legacyPartnerResult == null ? null : legacyPartnerResult.getData();
                partnerName = legacyPartner == null ? null : legacyPartner.getName();
            }
        }
        appUserInfoDto.setIsPartnerUser(partnerId == null ? 0 : 1);
        appUserInfoDto.setPartnerId(partnerId);
        appUserInfoDto.setPartnerName(partnerName);
        return R.ok(appUserInfoDto);
    }
    
@@ -969,9 +1167,10 @@
    @PostMapping(value = "/user/give/vip")
    @Log(title = "【用户列表】赠送会员", businessType = BusinessType.OTHER,operatorType = OperatorType.MANAGE)
    public R giveVip(@RequestBody GiveVipDto  giveVipDto) {
        String[] split = giveVipDto.getUserIds().split(",");
        for (String s : split) {
            TAppUser nowUser = appUserService.getById(s);
        List<Long> userIds = parseUserIds(giveVipDto.getUserIds());
        partnerAppUserAccessService.assertUsersVisible(userIds);
        for (Long userId : userIds) {
            TAppUser nowUser = appUserService.getById(userId);
            int plusDay = 0;
            if (giveVipDto.getType() == 1) {
                plusDay = 1;
@@ -1008,9 +1207,22 @@
        }
        return R.ok();
    }

    private List<Long> parseUserIds(String ids) {
        if (StringUtils.isBlank(ids)) {
            return Collections.emptyList();
        }
        return Arrays.stream(ids.split(","))
                .map(String::trim)
                .filter(StringUtils::isNotBlank)
                .map(Long::valueOf)
                .distinct()
                .collect(Collectors.toList());
    }
    
    
    
    @RequiresPermissions(value = {"/appUser/giftVip", "/appUser/gift_vip"}, logical = Logical.OR)
    @PostMapping(value = "/user/give/vip1")
    public R giveVip1(@RequestBody GiveVipDto  giveVipDto) {
        String[] split = giveVipDto.getUserIds().split(",");
@@ -1163,6 +1375,18 @@
        return R.ok(appUserService.list(Wrappers.lambdaQuery(TAppUser.class)
                .eq(TAppUser::getPhone,phone)));
    }

    @GetMapping("/user/searchPartnerBindUsers")
    public R<Page<TAppUser>> searchPartnerBindUsers(@RequestParam(value = "phone", required = false) String phone,
                                                     @RequestParam(defaultValue = "1") Integer pageNum,
                                                     @RequestParam(defaultValue = "10") Integer pageSize) {
        Page<TAppUser> page = appUserService.lambdaQuery()
                .like(StringUtils.isNotEmpty(phone), TAppUser::getPhone, phone)
                .orderByDesc(BasePojo::getCreateTime)
                .page(Page.of(pageNum, pageSize));
        page.getRecords().forEach(user -> user.setUid(user.getId().toString()));
        return R.ok(page);
    }
    
    @Log(title = "【我的】签到", businessType = BusinessType.INSERT,operatorType = OperatorType.MOBILE)
    @ApiOperation(value = "签到", tags = {"小程序-个人中心-签到"})
@@ -1262,15 +1486,7 @@



    //积分变化记录用
//    @PostMapping(value = "/user/points/change")
//    public R change(@RequestBody PointChangeDto points) {
//        TAppUser byId = appUserService.getById(points.getUserId());
//        pointDetailUtil.addDetail(byId.getPoints(),byId.getPoints()+points.getPoints(),points.getType(),points.getUserId(),points.getRemark(),"JF");
//        byId.setPoints(byId.getPoints()+points.getPoints());
//        appUserService.updateById(byId);
//        return R.ok();
//    }


    @PostMapping(value = "/user/points/change/down")
    public R changeDown(@RequestBody PointChangeDto points) {
@@ -1286,93 +1502,104 @@
    @ApiOperation(value = "添加编辑车辆", tags = {"小程序-个人中心-车辆"})
    @PostMapping(value = "/user/car/addOrUpdate")
    public R carAdd(@RequestBody TAppUserCar appUserCar) {
        Long userId = tokenService.getLoginUserApplet().getUserId();
        if(null != appUserCar.getId()){
            TAppUserCar userCar = appUserCarService.getById(appUserCar.getId());
            Long userId = tokenService.getLoginUserApplet().getUserId();
            if(!userCar.getAppUserId().equals(userId)){
                return R.fail("权限不足");
            }
        }
        TAppUserCar one1 = appUserCarService.getOne(new LambdaQueryWrapper<TAppUserCar>().eq(TAppUserCar::getLicensePlate, appUserCar.getLicensePlate())
                .eq(TAppUserCar::getDelFlag, 0));
        if(null != one1){
            return R.fail("车辆已存在");
        }
        LoginUserApplet loginUserApplet = tokenService.getLoginUserApplet();
        Long userId = loginUserApplet.getUserId();
        TAppUser byId = appUserService.getById(userId);
        appUserCar.setAppUserId(userId);

        //判断当前生效的vipDetail
        TAppUserVipDetail one = tAppUserVipDetailService.lambdaQuery().le(TAppUserVipDetail::getStartTime, LocalDateTime.now()).ge(TAppUserVipDetail::getEndTime, LocalDateTime.now()).eq(TAppUserVipDetail::getAppUserId, userId).last("limit 1").one();
        boolean doubleVip = false;
        if (one!=null){
             TVip tVip = JSONObject.parseObject(one.getVipJson(), TVip.class);
             if (tVip.getDoubleIntegration()!=null&&tVip.getDoubleIntegration()==1){
                 doubleVip = true;
             }
        }

        //如果是第一次添加车辆，增加积分
        Long count = appUserCarService.lambdaQuery().eq(TAppUserCar::getAppUserId, userId).count();


        if (count==0){
            R<TIntegralRule> set = integralRuleClient.getSet();
            TIntegralRule data = set.getData();
            if(null != data){
                JSONObject jsonObject = JSON.parseObject(data.getAddVehiclesEarnsPoints());
                Integer point = 0;
                //增加车牌50分，必填
                point = point+jsonObject.getInteger("num1");
                if (doubleVip){
                    point = point+jsonObject.getInteger("num1");
        RLock lock = redissonClient.getLock("CREATE_CAR:" + userId);
        try {
            boolean tryLock = lock.tryLock(5, 10, TimeUnit.SECONDS);
            if(tryLock){
                TAppUserCar one1 = appUserCarService.getOne(new LambdaQueryWrapper<TAppUserCar>()
                        .eq(TAppUserCar::getLicensePlate, appUserCar.getLicensePlate())
                        .eq(TAppUserCar::getAppUserId, userId)
                        .eq(TAppUserCar::getDelFlag, 0));
                if(null != one1 && null == appUserCar.getId()){
                    return R.fail("车辆已存在");
                }
                //增加车型分
                if (StringUtils.isNotEmpty(appUserCar.getVehicleModel())){
                    point = point+jsonObject.getInteger("num2");
                    if (doubleVip){
                        point = point+jsonObject.getInteger("num2");
                    }
                }
                //增加车辆用途分
                if (StringUtils.isNotEmpty(appUserCar.getVehicleUse())){
                    point = point+jsonObject.getInteger("num3");
                    if (doubleVip){
                        point = point+jsonObject.getInteger("num3");
                    }
                }
                //增加续航分
                if(NumberUtil.isNumber(appUserCar.getEndurance())){
                    point = point+jsonObject.getInteger("num4");
                    if (doubleVip){
                        point = point+jsonObject.getInteger("num4");

                TAppUser byId = appUserService.getById(userId);
                appUserCar.setAppUserId(userId);

                //判断当前生效的vipDetail
                TAppUserVipDetail one = tAppUserVipDetailService.lambdaQuery().le(TAppUserVipDetail::getStartTime, LocalDateTime.now()).ge(TAppUserVipDetail::getEndTime, LocalDateTime.now()).eq(TAppUserVipDetail::getAppUserId, userId).last("limit 1").one();
                boolean doubleVip = false;
                if (one!=null){
                    TVip tVip = JSONObject.parseObject(one.getVipJson(), TVip.class);
                    if (tVip.getDoubleIntegration()!=null&&tVip.getDoubleIntegration()==1){
                        doubleVip = true;
                    }
                }

                //增加积分记录
                pointDetailUtil.addDetail(byId.getPoints(),byId.getPoints()+point,5,userId,appUserCar.getLicensePlate(),"","");
                byId.setPoints(byId.getPoints()+point);
                //如果是第一次添加车辆，增加积分
                Long count = appUserCarService.lambdaQuery().eq(TAppUserCar::getAppUserId, userId).count();


                if (count==0){
                    R<TIntegralRule> set = integralRuleClient.getSet();
                    TIntegralRule data = set.getData();
                    if(null != data){
                        JSONObject jsonObject = JSON.parseObject(data.getAddVehiclesEarnsPoints());
                        Integer point = 0;
                        //增加车牌50分，必填
                        point = point+jsonObject.getInteger("num1");
                        if (doubleVip){
                            point = point+jsonObject.getInteger("num1");
                        }
                        //增加车型分
                        if (StringUtils.isNotEmpty(appUserCar.getVehicleModel())){
                            point = point+jsonObject.getInteger("num2");
                            if (doubleVip){
                                point = point+jsonObject.getInteger("num2");
                            }
                        }
                        //增加车辆用途分
                        if (StringUtils.isNotEmpty(appUserCar.getVehicleUse())){
                            point = point+jsonObject.getInteger("num3");
                            if (doubleVip){
                                point = point+jsonObject.getInteger("num3");
                            }
                        }
                        //增加续航分
                        if(NumberUtil.isNumber(appUserCar.getEndurance())){
                            point = point+jsonObject.getInteger("num4");
                            if (doubleVip){
                                point = point+jsonObject.getInteger("num4");
                            }
                        }

                        //增加积分记录
                        pointDetailUtil.addDetail(byId.getPoints(),byId.getPoints()+point,5,userId,appUserCar.getLicensePlate(),"","");
                        byId.setPoints(byId.getPoints()+point);
                    }
                    byId.setFirstAdd(1);
                }
                CarNumDto carNumDto = CarUtil.carNum(appUserCar.getLicensePlate());
                if (carNumDto==null){
                    return R.fail("请输入正确的车牌");
                }

                byId.setCityCode(carNumDto.getAreaCode());
                byId.setProvinceCode(carNumDto.getAreaCode().substring(0,2)+"0000");
                appUserService.updateById(byId);

                //
                appUserCarService.saveOrUpdate(appUserCar);
            }
            byId.setFirstAdd(1);
        } catch (InterruptedException e) {
            throw new RuntimeException(e);
        }finally {
            lock.unlock();
        }
        CarNumDto carNumDto = CarUtil.carNum(appUserCar.getLicensePlate());
        if (carNumDto==null){
            return R.fail("请输入正确的车牌");
        }

        byId.setCityCode(carNumDto.getAreaCode());
        byId.setProvinceCode(carNumDto.getAreaCode().substring(0,2)+"0000");
        appUserService.updateById(byId);

        //
        appUserCarService.saveOrUpdate(appUserCar);

        return R.ok();
    }
    
    @Log(title = "【我的】添加编辑车辆", businessType = BusinessType.INSERT,operatorType = OperatorType.MOBILE)
    @ApiOperation(value = "添加编辑车辆", tags = {"小程序-个人中心-车辆"})
    @Log(title = "【我的】删除车辆", businessType = BusinessType.INSERT,operatorType = OperatorType.MOBILE)
    @ApiOperation(value = "删除车辆", tags = {"小程序-个人中心-车辆"})
    @GetMapping(value = "/user/car/delete")
    public R carDelete(String id) {
        TAppUserCar appUserCar = appUserCarService.getById(id);
@@ -1490,6 +1717,11 @@
                String reqStr2 = MsgUtil.applyCodeMsg(sendMessageDTO.getPhone(), sendMessageDTO.getCode());
                String result2 = HttpUtils.post(MsgConstants.SEND_URL, reqStr2);
                return R.ok(result2);
            case 4:
                String reqStr4 = MsgUtil.vipChargeFinishMsg(sendMessageDTO.getPhone(), sendMessageDTO.getSite(),
                        sendMessageDTO.getChargingCapacity(), sendMessageDTO.getChargingFee());
                String result4 = HttpUtils.post(MsgConstants.SEND_URL, reqStr4);
                return R.ok(result4);
            default:
                String reqStr3 = MsgUtil.faultMsg(sendMessageDTO.getPhone(), sendMessageDTO.getSite(), sendMessageDTO.getChargeGun());
                String result3 = HttpUtils.post(MsgConstants.SEND_URL, reqStr3);