hailin
/
rwadurian
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(authorization): 暂时禁止所有用户查看私密资料 

由于系统尚未实现权限管理功能，暂时将 checkPrivateProfileAccess
始终返回 false，禁止所有用户查看其他用户的手机号、邮箱等隐私信息。

后续实现权限系统后可恢复原有逻辑。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
hailin 2025-12-23 22:46:15 -08:00
parent 27a4bbfbef
commit 647f86ec89
1 changed files with 18 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
backend/services/authorization-service/src/application/services/authorization-application.service.ts
View File

@ -3375,31 +3375,33 @@ export class AuthorizationApplicationService {
/** /**
* 检查用户是否有权限查看私密资料 * 检查用户是否有权限查看私密资料
* 规则： *
* 注意：目前系统尚未实现权限管理功能，暂时禁止所有用户查看私密资料。
* 后续实现权限系统后，可以根据以下规则开放：
* - 省区域公司(PROVINCE_COMPANY)可以查看 * - 省区域公司(PROVINCE_COMPANY)可以查看
* - 省团队(AUTH_PROVINCE_COMPANY)可以查看 * - 省团队(AUTH_PROVINCE_COMPANY)可以查看
* - 市区域公司(CITY_COMPANY)可以查看 * - 市区域公司(CITY_COMPANY)可以查看
* - 其他角色不能查看 * - 其他角色不能查看
*/ */
private async checkPrivateProfileAccess( private async checkPrivateProfileAccess(
requestAccountSequence: string, _requestAccountSequence: string,
_targetAccountSequence: string, _targetAccountSequence: string,
): Promise<boolean> { ): Promise<boolean> {
// 获取请求者的授权 // TODO: 权限系统实现后，取消下面的注释并启用权限检查
const requestorAuthorizations = await this.authorizationRepository.findByAccountSequence(requestAccountSequence) // const requestorAuthorizations = await this.authorizationRepository.findByAccountSequence(requestAccountSequence)
// const privilegedRoleTypes = [
// RoleType.PROVINCE_COMPANY,
// RoleType.AUTH_PROVINCE_COMPANY,
// RoleType.CITY_COMPANY,
// ]
// return requestorAuthorizations.some(
// (auth) =>
// auth.status === AuthorizationStatus.AUTHORIZED &&
// privilegedRoleTypes.includes(auth.roleType),
// )
// 检查是否有高级权限 // 目前暂时禁止所有用户查看私密资料
const privilegedRoleTypes = [ return false
RoleType.PROVINCE_COMPANY,
RoleType.AUTH_PROVINCE_COMPANY,
RoleType.CITY_COMPANY,
]
return requestorAuthorizations.some(
(auth) =>
auth.status === AuthorizationStatus.AUTHORIZED &&
privilegedRoleTypes.includes(auth.roleType),
)
} }
/** /**