fix: allow same-school class task reads

src/main/java/com/sztzjy/linkCommerce/controller/stu/TrainingTaskController.java

@@ -80,7 +80,7 @@ public class TrainingTaskController {
         JwtUser user = requireTeacher(request);
         try {
             return new ResultEntity<>(HttpStatus.OK, "Query success",
-                    trainingTaskService.listForTeachingClass(teachingClassId, enabledOnly, user.getUserId()));
+                    trainingTaskService.listForTeachingClass(teachingClassId, enabledOnly, user));
         } catch (IllegalArgumentException e) {
             return new ResultEntity<>(HttpStatus.BAD_REQUEST, e.getMessage());
         }

src/main/java/com/sztzjy/linkCommerce/service/TrainingTaskService.java

@@ -27,7 +27,7 @@ public interface TrainingTaskService {
 
     List<TrainingTask> listDefaults(String projectName, String taskName, Boolean enabledOnly);
 
-    List<TrainingTask> listForTeachingClass(String teachingClassId, Boolean enabledOnly, String operatorId);
+    List<TrainingTask> listForTeachingClass(String teachingClassId, Boolean enabledOnly, JwtUser operator);
 
     TrainingTask getClassTaskByTaskKey(String teachingClassId, String taskKey, String operatorId);
 

src/main/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImpl.java

@@ -196,11 +196,11 @@ public class TrainingTaskServiceImpl implements TrainingTaskService {
     }
 
     @Override
-    public List<TrainingTask> listForTeachingClass(String teachingClassId, Boolean enabledOnly, String operatorId) {
-        requireOwnedTeachingClass(teachingClassId, operatorId);
+    public List<TrainingTask> listForTeachingClass(String teachingClassId, Boolean enabledOnly, JwtUser operator) {
+        requireReadableTeachingClass(teachingClassId, operator);
         ensureDefaultTasks(null);
         List<TrainingTask> defaults = trainingTaskMapper.selectList(null, null, null);
-        List<TrainingTaskClassConfig> classTasks = ensureClassTasksInitialized(teachingClassId, defaults, operatorId);
+        List<TrainingTaskClassConfig> classTasks = ensureClassTasksInitialized(teachingClassId, defaults, operator.getUserId());
         return filterEnabled(toTasks(classTasks), enabledOnly);
     }
 
@@ -375,6 +375,18 @@ public class TrainingTaskServiceImpl implements TrainingTaskService {
         return schoolClass;
     }
 
+    SchoolClass requireReadableTeachingClass(String teachingClassId, JwtUser operator) {
+        SchoolClass schoolClass = schoolClassMapper.selectByPrimaryKey(StringUtils.trimToEmpty(teachingClassId));
+        if (schoolClass == null || !"TEACHING".equals(schoolClass.getClassType())) {
+            throw new IllegalArgumentException("Teaching class not found");
+        }
+        if (operator == null || StringUtils.isBlank(operator.getUserId())
+                || !StringUtils.equals(operator.getSchoolId(), schoolClass.getSchoolId())) {
+            throw new IllegalArgumentException("Teaching class is unavailable");
+        }
+        return schoolClass;
+    }
+
     private String resolveStudentTeachingClassId(String studentUserId) {
         if (StringUtils.isBlank(studentUserId) || teachingClassStudentMapper == null) {
             return null;

src/test/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImplTest.java

@@ -1,5 +1,6 @@
 package com.sztzjy.linkCommerce.service.impl;
 
+import com.sztzjy.linkCommerce.config.security.JwtUser;
 import com.sztzjy.linkCommerce.entity.SchoolClass;
 import com.sztzjy.linkCommerce.entity.TeachingClassStudent;
 import com.sztzjy.linkCommerce.entity.TrainingTask;
@@ -304,6 +305,37 @@ class TrainingTaskServiceImplTest {
         assertThrows(IllegalArgumentException.class, () -> service.saveClassTask("class-2", "new-product-survey", task, "teacher-b"));
     }
 
+    @Test
+    void teacherCanReadAnotherTeachersTeachingClassInTheSameSchool() {
+        TrainingTaskServiceImpl service = new TrainingTaskServiceImpl();
+        service.schoolClassMapper = mock(SchoolClassMapper.class);
+        SchoolClass schoolClass = teachingClass("class-2", "teacher-a");
+        schoolClass.setSchoolId("school-1");
+        when(service.schoolClassMapper.selectByPrimaryKey("class-2")).thenReturn(schoolClass);
+
+        JwtUser reader = new JwtUser();
+        reader.setUserId("teacher-b");
+        reader.setSchoolId("school-1");
+
+        assertEquals(schoolClass, service.requireReadableTeachingClass("class-2", reader));
+    }
+
+    @Test
+    void teacherCannotReadTeachingClassFromAnotherSchool() {
+        TrainingTaskServiceImpl service = new TrainingTaskServiceImpl();
+        service.schoolClassMapper = mock(SchoolClassMapper.class);
+        SchoolClass schoolClass = teachingClass("class-2", "teacher-a");
+        schoolClass.setSchoolId("school-1");
+        when(service.schoolClassMapper.selectByPrimaryKey("class-2")).thenReturn(schoolClass);
+
+        JwtUser reader = new JwtUser();
+        reader.setUserId("teacher-b");
+        reader.setSchoolId("school-2");
+
+        assertThrows(IllegalArgumentException.class,
+                () -> service.requireReadableTeachingClass("class-2", reader));
+    }
+
     @Test
     void restoreClassTaskDefaultDeletesOnlySelectedClassTaskCopy() {
         TrainingTaskServiceImpl service = new TrainingTaskServiceImpl();
@@ -444,6 +476,7 @@ class TrainingTaskServiceImplTest {
         schoolClass.setSchoolClassId("class-1");
         schoolClass.setClassType("TEACHING");
         schoolClass.setCreatedBy("teacher-1");
+        schoolClass.setSchoolId("school-1");
         when(service.schoolClassMapper.selectByPrimaryKey("class-1")).thenReturn(schoolClass);
 
         TrainingTask defaultTask = storedTask("task-1", "new-product-survey");
@@ -454,7 +487,10 @@ class TrainingTaskServiceImplTest {
         override.setEnabled(Boolean.FALSE);
         when(service.trainingTaskClassConfigMapper.selectListByTeachingClass("class-1", null)).thenReturn(Collections.singletonList(override));
 
-        List<TrainingTask> result = service.listForTeachingClass("class-1", true, "teacher-1");
+        JwtUser teacher = new JwtUser();
+        teacher.setUserId("teacher-1");
+        teacher.setSchoolId("school-1");
+        List<TrainingTask> result = service.listForTeachingClass("class-1", true, teacher);
 
         assertEquals(0, result.size());
     }