From 4f6f15b818704079ff2e4e4719b798f48d68a335 Mon Sep 17 00:00:00 2001
From: liujie <1793218484@qq.com>
Date: 星期五, 11 九月 2026 13:52:19 +0800
Subject: [PATCH] update
---
backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java | 16 +++++++++++++---
1 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java b/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
index 58f8aaa..66e4241 100644
--- a/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
+++ b/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
@@ -2,12 +2,15 @@
import com.tourguide.common.api.ApiResponse;
import com.tourguide.common.api.PageResponse;
+import com.tourguide.common.exception.BusinessException;
import com.tourguide.modules.finance.dto.FinanceLedgerPageResponse;
import com.tourguide.modules.finance.dto.WithdrawalProcessRequest;
import com.tourguide.modules.finance.dto.WithdrawalResponse;
import com.tourguide.modules.finance.service.AdminFinanceService;
+import com.tourguide.security.AppUserPrincipal;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.security.core.Authentication;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PutMapping;
@@ -50,7 +53,14 @@
@RequestParam(required = false) String keyword,
@RequestParam(required = false) String paymentMethod,
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate startDate,
- @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate) {
+ @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate,
+ Authentication authentication) {
+ String requiredAuthority = "REFUND".equalsIgnoreCase(direction)
+ ? "PERM_FINANCE_REFUND_VIEW" : "PERM_FINANCE_DETAIL_VIEW";
+ if (authentication.getAuthorities().stream()
+ .noneMatch(authority -> requiredAuthority.equals(authority.getAuthority()))) {
+ throw new BusinessException(403, "无权访问该财务流水");
+ }
return ApiResponse.success(financeService.ledger(page, size, direction, keyword, paymentMethod, startDate, endDate));
}
@@ -87,7 +97,7 @@
@PutMapping("/withdrawals/{id}/process")
public ApiResponse<WithdrawalResponse> processWithdrawal(@PathVariable Long id,
@Valid @RequestBody WithdrawalProcessRequest request,
- Authentication authentication) {
- return ApiResponse.success(financeService.processWithdrawal(id, request, authentication.getName()));
+ @AuthenticationPrincipal AppUserPrincipal principal) {
+ return ApiResponse.success(financeService.processWithdrawal(id, request, principal.getUsername()));
}
}
--
Gitblit v1.7.1