只能查看已经授权的bu数据

src/main/java/com/xujie/sys/modules/pms/controller/ProofingInformationController.java

@@ -385,7 +385,10 @@ public class ProofingInformationController {
     @PostMapping(value = "/queryAllProofing2")
     @ResponseBody
     public R queryAllProofing2(@RequestBody QuerySavedVo querySavedVo) {
-        String userId = String.valueOf(((SysUserEntity) SecurityUtils.getSubject().getPrincipal()).getUserId());
+        SysUserEntity currentUser = (SysUserEntity) SecurityUtils.getSubject().getPrincipal();
+        String userId = String.valueOf(currentUser.getUserId());
+        // 查询条件可由前端自由组合，用户名必须以后端会话为准，防止跨 BU 越权查询。
+        querySavedVo.setUserName(currentUser.getUsername());
         if (querySavedVo.getQuerySavedDetailList() != null && !querySavedVo.getQuerySavedDetailList().isEmpty()) {
             String sql = queryCriteriaConstructorDefault.lastConditionalStatement(querySavedVo);
             querySavedVo.setSql(sql);
@@ -400,7 +403,13 @@ public class ProofingInformationController {
     @PostMapping(value = "/searchAllProofing")
     @ResponseBody
     public R searchAllProofing(@RequestBody ProofDocumentData inData) {
-        String userId = String.valueOf(((SysUserEntity) SecurityUtils.getSubject().getPrincipal()).getUserId());
+        SysUserEntity currentUser = (SysUserEntity) SecurityUtils.getSubject().getPrincipal();
+        String userId = String.valueOf(currentUser.getUserId());
+        // BU 权限过滤依赖 AccessBu.username，必须使用当前登录人而不是前端入参。
+        inData.setUsername(currentUser.getUsername());
+        if (inData.getSite() == null || inData.getSite().trim().isEmpty()) {
+            inData.setSite(currentUser.getSite());
+        }
 
         // 查询所有打样信息（分页）
         PageUtils page = proofingInformationService.queryAllProofing(userId,inData);

src/main/resources/mapper/pms/ProofingInformationMapper.xml

@@ -1126,6 +1126,11 @@
                  left join plm_project_info as b on ppi.project_id = b.id
                  left join plm_project_part as ppp on ppi.test_part_id = ppp.id
         <where> ppp.status != '草稿'
+            AND (b.site + '-' + b.bu_no) IN (
+            SELECT (site + '-' + bu_no)
+            FROM AccessBu
+            WHERE username = #{query.username}
+            )
         <if test="query.projectNo != null and query.projectNo != ''">
             AND (
             b.project_no like '%' + #{query.projectNo} + '%'
@@ -1269,6 +1274,11 @@
     left join plm_project_info as b on ppi.project_id = b.id
     left join plm_project_part as ppp on ppi.test_part_id = ppp.id
     <where> ppp.status != '草稿'
+        AND (b.site + '-' + b.bu_no) IN (
+        SELECT (site + '-' + bu_no)
+        FROM AccessBu
+        WHERE username = #{params.userName}
+        )
         <if test="params.sql != null and params.sql != ''">
             ${params.sql}
         </if>