禅道#1171问题修复

cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java

@@ -71,6 +71,7 @@ public class ErrorCodeConstants {
     public static final ErrorCode DEPT_NOT_ENABLE = new ErrorCode(1_002_004_006, "部门({})不处于开启状态，不允许选择");
     public static final ErrorCode DEPT_PARENT_IS_CHILD = new ErrorCode(1_002_004_007, "不能设置自己的子部门为父部门");
     public static final ErrorCode DEPT_USER_OPER_NOT_ALLOW = new ErrorCode(1_002_015_008, "不允许操作用户自身部门");
+    public static final ErrorCode PARENT_DEPT_USER_OPER_NOT_ALLOW = new ErrorCode(1_002_015_008, "不允许操作用户自身部门及其上级部门");
     public static final ErrorCode DEPT_DISABLE = new ErrorCode(1_002_004_006, "部门({})已被禁用");
 
     // ========== 岗位模块 1-002-005-000 ==========

cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/dept/DeptServiceImpl.java

@@ -36,6 +36,7 @@ import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.e
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.module.system.dal.redis.RedisKeyConstants.OAUTH2_ACCESS_TOKEN;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.DEPT_USER_OPER_NOT_ALLOW;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.PARENT_DEPT_USER_OPER_NOT_ALLOW;
 
 /**
  * 部门 Service 实现类
@@ -105,14 +106,14 @@ public class DeptServiceImpl implements DeptService {
     @CacheEvict(cacheNames = RedisKeyConstants.DEPT_CHILDREN_ID_LIST,
             allEntries = true) // allEntries 清空所有缓存，因为操作一个部门，涉及到多个缓存
     public void deleteDept(Long id) {
-        // 校验部门内用户操作
-        checkCurrentWhenOperate(id);
         // 校验是否存在
         validateDeptExists(id);
         // 校验是否有子部门
         if (deptMapper.selectCountByParentId(id) > 0) {
             throw ServiceExceptionUtil.exception(ErrorCodeConstants.DEPT_EXITS_CHILDREN);
         }
+        // 校验部门内用户操作
+        checkCurrentWhenOperate(id);
         // 删除部门
         deptMapper.deleteById(id);
         // 删除关联的用户
@@ -153,9 +154,15 @@ public class DeptServiceImpl implements DeptService {
      */
     private void checkCurrentWhenOperate(Long deptId) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
-        if (ObjectUtil.isNotNull(loginUser) && ObjectUtil.equal(deptId, loginUser.getDeptId())) {
+        Long currentDeptId = loginUser.getDeptId();
+        if (ObjectUtil.isNotNull(loginUser) && ObjectUtil.equal(deptId, currentDeptId)) {
             throw exception(DEPT_USER_OPER_NOT_ALLOW);
         }
+        // 递归查询所有下级，如果当前用户在范围内不允许操作
+        List<DeptDO> childDeptList = getChildDeptList(deptId);
+        childDeptList.stream().filter(d -> d.getId().equals(currentDeptId)).findAny().ifPresent(deptDO -> {
+            throw exception(PARENT_DEPT_USER_OPER_NOT_ALLOW);
+        });
     }
 
     @VisibleForTesting