From 6d7e16f7e0cbb6946b496d2b517bad583b48e76a Mon Sep 17 00:00:00 2001 From: chenyuan Date: Fri, 31 Jul 2026 12:39:17 +0800 Subject: [PATCH] fix: allow same-school class task reads --- .../stu/TrainingTaskController.java | 2 +- .../service/TrainingTaskService.java | 2 +- .../service/impl/TrainingTaskServiceImpl.java | 18 +++++++-- .../impl/TrainingTaskServiceImplTest.java | 38 ++++++++++++++++++- 4 files changed, 54 insertions(+), 6 deletions(-) diff --git a/src/main/java/com/sztzjy/linkCommerce/controller/stu/TrainingTaskController.java b/src/main/java/com/sztzjy/linkCommerce/controller/stu/TrainingTaskController.java index 3e1a24f..7a2db1d 100644 --- a/src/main/java/com/sztzjy/linkCommerce/controller/stu/TrainingTaskController.java +++ b/src/main/java/com/sztzjy/linkCommerce/controller/stu/TrainingTaskController.java @@ -80,7 +80,7 @@ public class TrainingTaskController { JwtUser user = requireTeacher(request); try { return new ResultEntity<>(HttpStatus.OK, "Query success", - trainingTaskService.listForTeachingClass(teachingClassId, enabledOnly, user.getUserId())); + trainingTaskService.listForTeachingClass(teachingClassId, enabledOnly, user)); } catch (IllegalArgumentException e) { return new ResultEntity<>(HttpStatus.BAD_REQUEST, e.getMessage()); } diff --git a/src/main/java/com/sztzjy/linkCommerce/service/TrainingTaskService.java b/src/main/java/com/sztzjy/linkCommerce/service/TrainingTaskService.java index 6345583..f81d2b7 100644 --- a/src/main/java/com/sztzjy/linkCommerce/service/TrainingTaskService.java +++ b/src/main/java/com/sztzjy/linkCommerce/service/TrainingTaskService.java @@ -27,7 +27,7 @@ public interface TrainingTaskService { List listDefaults(String projectName, String taskName, Boolean enabledOnly); - List listForTeachingClass(String teachingClassId, Boolean enabledOnly, String operatorId); + List listForTeachingClass(String teachingClassId, Boolean enabledOnly, JwtUser operator); TrainingTask getClassTaskByTaskKey(String teachingClassId, String taskKey, String operatorId); diff --git a/src/main/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImpl.java b/src/main/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImpl.java index e25023b..b86d492 100644 --- a/src/main/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImpl.java +++ b/src/main/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImpl.java @@ -196,11 +196,11 @@ public class TrainingTaskServiceImpl implements TrainingTaskService { } @Override - public List listForTeachingClass(String teachingClassId, Boolean enabledOnly, String operatorId) { - requireOwnedTeachingClass(teachingClassId, operatorId); + public List listForTeachingClass(String teachingClassId, Boolean enabledOnly, JwtUser operator) { + requireReadableTeachingClass(teachingClassId, operator); ensureDefaultTasks(null); List defaults = trainingTaskMapper.selectList(null, null, null); - List classTasks = ensureClassTasksInitialized(teachingClassId, defaults, operatorId); + List classTasks = ensureClassTasksInitialized(teachingClassId, defaults, operator.getUserId()); return filterEnabled(toTasks(classTasks), enabledOnly); } @@ -375,6 +375,18 @@ public class TrainingTaskServiceImpl implements TrainingTaskService { return schoolClass; } + SchoolClass requireReadableTeachingClass(String teachingClassId, JwtUser operator) { + SchoolClass schoolClass = schoolClassMapper.selectByPrimaryKey(StringUtils.trimToEmpty(teachingClassId)); + if (schoolClass == null || !"TEACHING".equals(schoolClass.getClassType())) { + throw new IllegalArgumentException("Teaching class not found"); + } + if (operator == null || StringUtils.isBlank(operator.getUserId()) + || !StringUtils.equals(operator.getSchoolId(), schoolClass.getSchoolId())) { + throw new IllegalArgumentException("Teaching class is unavailable"); + } + return schoolClass; + } + private String resolveStudentTeachingClassId(String studentUserId) { if (StringUtils.isBlank(studentUserId) || teachingClassStudentMapper == null) { return null; diff --git a/src/test/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImplTest.java b/src/test/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImplTest.java index 9d8d94a..3de30ee 100644 --- a/src/test/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImplTest.java +++ b/src/test/java/com/sztzjy/linkCommerce/service/impl/TrainingTaskServiceImplTest.java @@ -1,5 +1,6 @@ package com.sztzjy.linkCommerce.service.impl; +import com.sztzjy.linkCommerce.config.security.JwtUser; import com.sztzjy.linkCommerce.entity.SchoolClass; import com.sztzjy.linkCommerce.entity.TeachingClassStudent; import com.sztzjy.linkCommerce.entity.TrainingTask; @@ -304,6 +305,37 @@ class TrainingTaskServiceImplTest { assertThrows(IllegalArgumentException.class, () -> service.saveClassTask("class-2", "new-product-survey", task, "teacher-b")); } + @Test + void teacherCanReadAnotherTeachersTeachingClassInTheSameSchool() { + TrainingTaskServiceImpl service = new TrainingTaskServiceImpl(); + service.schoolClassMapper = mock(SchoolClassMapper.class); + SchoolClass schoolClass = teachingClass("class-2", "teacher-a"); + schoolClass.setSchoolId("school-1"); + when(service.schoolClassMapper.selectByPrimaryKey("class-2")).thenReturn(schoolClass); + + JwtUser reader = new JwtUser(); + reader.setUserId("teacher-b"); + reader.setSchoolId("school-1"); + + assertEquals(schoolClass, service.requireReadableTeachingClass("class-2", reader)); + } + + @Test + void teacherCannotReadTeachingClassFromAnotherSchool() { + TrainingTaskServiceImpl service = new TrainingTaskServiceImpl(); + service.schoolClassMapper = mock(SchoolClassMapper.class); + SchoolClass schoolClass = teachingClass("class-2", "teacher-a"); + schoolClass.setSchoolId("school-1"); + when(service.schoolClassMapper.selectByPrimaryKey("class-2")).thenReturn(schoolClass); + + JwtUser reader = new JwtUser(); + reader.setUserId("teacher-b"); + reader.setSchoolId("school-2"); + + assertThrows(IllegalArgumentException.class, + () -> service.requireReadableTeachingClass("class-2", reader)); + } + @Test void restoreClassTaskDefaultDeletesOnlySelectedClassTaskCopy() { TrainingTaskServiceImpl service = new TrainingTaskServiceImpl(); @@ -444,6 +476,7 @@ class TrainingTaskServiceImplTest { schoolClass.setSchoolClassId("class-1"); schoolClass.setClassType("TEACHING"); schoolClass.setCreatedBy("teacher-1"); + schoolClass.setSchoolId("school-1"); when(service.schoolClassMapper.selectByPrimaryKey("class-1")).thenReturn(schoolClass); TrainingTask defaultTask = storedTask("task-1", "new-product-survey"); @@ -454,7 +487,10 @@ class TrainingTaskServiceImplTest { override.setEnabled(Boolean.FALSE); when(service.trainingTaskClassConfigMapper.selectListByTeachingClass("class-1", null)).thenReturn(Collections.singletonList(override)); - List result = service.listForTeachingClass("class-1", true, "teacher-1"); + JwtUser teacher = new JwtUser(); + teacher.setUserId("teacher-1"); + teacher.setSchoolId("school-1"); + List result = service.listForTeachingClass("class-1", true, teacher); assertEquals(0, result.size()); }