From dbe2ac58792c937353ce56dccb0d33ae1c91393e Mon Sep 17 00:00:00 2001
From: gaoqr <13665037151@163.com>
Date: Sat, 15 Feb 2025 10:24:26 +0800
Subject: [PATCH] =?UTF-8?q?=E7=A6=85=E9=81=93#1171=E9=97=AE=E9=A2=98?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../module/system/enums/ErrorCodeConstants.java     |  1 +
 .../module/system/service/dept/DeptServiceImpl.java | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
index 1491880c2..149025974 100644
--- a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
+++ b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
@@ -71,6 +71,7 @@ public class ErrorCodeConstants {
     public static final ErrorCode DEPT_NOT_ENABLE = new ErrorCode(1_002_004_006, "部门({})不处于开启状态，不允许选择");
     public static final ErrorCode DEPT_PARENT_IS_CHILD = new ErrorCode(1_002_004_007, "不能设置自己的子部门为父部门");
     public static final ErrorCode DEPT_USER_OPER_NOT_ALLOW = new ErrorCode(1_002_015_008, "不允许操作用户自身部门");
+    public static final ErrorCode PARENT_DEPT_USER_OPER_NOT_ALLOW = new ErrorCode(1_002_015_008, "不允许操作用户自身部门及其上级部门");
     public static final ErrorCode DEPT_DISABLE = new ErrorCode(1_002_004_006, "部门({})已被禁用");
 
     // ========== 岗位模块 1-002-005-000 ==========
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/dept/DeptServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/dept/DeptServiceImpl.java
index 88ba11fd9..f391c6fef 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/dept/DeptServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/dept/DeptServiceImpl.java
@@ -36,6 +36,7 @@ import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.e
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.module.system.dal.redis.RedisKeyConstants.OAUTH2_ACCESS_TOKEN;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.DEPT_USER_OPER_NOT_ALLOW;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.PARENT_DEPT_USER_OPER_NOT_ALLOW;
 
 /**
  * 部门 Service 实现类
@@ -105,14 +106,14 @@ public class DeptServiceImpl implements DeptService {
     @CacheEvict(cacheNames = RedisKeyConstants.DEPT_CHILDREN_ID_LIST,
             allEntries = true) // allEntries 清空所有缓存，因为操作一个部门，涉及到多个缓存
     public void deleteDept(Long id) {
-        // 校验部门内用户操作
-        checkCurrentWhenOperate(id);
         // 校验是否存在
         validateDeptExists(id);
         // 校验是否有子部门
         if (deptMapper.selectCountByParentId(id) > 0) {
             throw ServiceExceptionUtil.exception(ErrorCodeConstants.DEPT_EXITS_CHILDREN);
         }
+        // 校验部门内用户操作
+        checkCurrentWhenOperate(id);
         // 删除部门
         deptMapper.deleteById(id);
         // 删除关联的用户
@@ -153,9 +154,15 @@ public class DeptServiceImpl implements DeptService {
      */
     private void checkCurrentWhenOperate(Long deptId) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
-        if (ObjectUtil.isNotNull(loginUser) && ObjectUtil.equal(deptId, loginUser.getDeptId())) {
+        Long currentDeptId = loginUser.getDeptId();
+        if (ObjectUtil.isNotNull(loginUser) && ObjectUtil.equal(deptId, currentDeptId)) {
             throw exception(DEPT_USER_OPER_NOT_ALLOW);
         }
+        // 递归查询所有下级，如果当前用户在范围内不允许操作
+        List<DeptDO> childDeptList = getChildDeptList(deptId);
+        childDeptList.stream().filter(d -> d.getId().equals(currentDeptId)).findAny().ifPresent(deptDO -> {
+            throw exception(PARENT_DEPT_USER_OPER_NOT_ALLOW);
+        });
     }
 
     @VisibleForTesting