fix(security): 修复会员与名片数据越权

销售端会员修改/启停与名片删除增加归属校验，补齐登录注解。

Co-authored-by: Cursor <cursoragent@cursor.com>

fs-company-app/src/main/java/com/fs/app/controller/FsUserController.java

@@ -140,6 +140,7 @@ public class FsUserController extends AppBaseController {
     @ApiOperation("批量禁用会员")
     public ResponseResult<Boolean> disabledUser(@ApiParam(value = "联系人id集合", required = true) @RequestBody List<Long> userCompanyUserIds) {
         log.debug("批量禁用会员 ids: {}", JSON.toJSONString(userCompanyUserIds));
+        checkUserCompanyUserOwnership(userCompanyUserIds);
         Boolean r = userCompanyUserService.batchUpdateStatus(userCompanyUserIds, 2);
         return ResponseResult.ok(r);
     }
@@ -149,10 +150,27 @@ public class FsUserController extends AppBaseController {
     @ApiOperation("批量启用会员")
     public ResponseResult<Boolean> enabledUser(@ApiParam(value = "联系人id集合", required = true) @RequestBody List<Long> userCompanyUserIds) {
         log.debug("批量启用会员 ids: {}", JSON.toJSONString(userCompanyUserIds));
+        checkUserCompanyUserOwnership(userCompanyUserIds);
         Boolean r = userCompanyUserService.batchUpdateStatus(userCompanyUserIds, 1);
         return ResponseResult.ok(r);
     }
 
+    /**
+     * 校验联系人记录均归属当前销售，防止批量越权启停
+     */
+    private void checkUserCompanyUserOwnership(List<Long> userCompanyUserIds) {
+        if (userCompanyUserIds == null || userCompanyUserIds.isEmpty()) {
+            throw new ServiceException("参数不能为空");
+        }
+        Long currentUserId = Long.parseLong(getUserId());
+        for (Long id : userCompanyUserIds) {
+            FsUserCompanyUser rel = userCompanyUserService.selectFsUserCompanyUserById(id);
+            if (rel == null || rel.getCompanyUserId() == null || !rel.getCompanyUserId().equals(currentUserId)) {
+                throw new ServiceException("无权操作该会员");
+            }
+        }
+    }
+
     @Login
     @GetMapping("/firstPage/summaryCount")
     @ApiOperation("首页数据-顶部汇总统计")
@@ -268,6 +286,15 @@ public class FsUserController extends AppBaseController {
         if (Objects.isNull(fsUser)) {
             throw new ServiceException("用户不存在");
         }
+        // 校验会员是否归属当前销售，防止水平越权
+        Long currentUserId = Long.parseLong(getUserId());
+        FsUserCompanyUser query = new FsUserCompanyUser();
+        query.setUserId(param.getFsUserId());
+        query.setCompanyUserId(currentUserId);
+        List<FsUserCompanyUser> relations = userCompanyUserService.selectFsUserCompanyUserList(query);
+        if (relations == null || relations.isEmpty()) {
+            throw new ServiceException("无权操作该会员");
+        }
 
         fsUser.setNickName(param.getNickName());
         fsUser.setRemark(param.getRemark());
@@ -287,6 +314,11 @@ public class FsUserController extends AppBaseController {
         if (Objects.isNull(userCompanyUser)) {
             throw new ServiceException("用户不存在");
         }
+        // 校验归属当前销售
+        Long currentUserId = Long.parseLong(getUserId());
+        if (userCompanyUser.getCompanyUserId() == null || !userCompanyUser.getCompanyUserId().equals(currentUserId)) {
+            throw new ServiceException("无权操作该会员");
+        }
 
         userCompanyUser.setRemark(param.getRemark());
         userCompanyUserService.updateFsUserCompanyUser(userCompanyUser);

fs-company-app/src/main/java/com/fs/app/controller/UserController.java

@@ -546,6 +546,14 @@ public class UserController extends AppBaseController {
     public R delMyCard(@RequestParam("cardId") Long cardId) {
         try {
             CompanyUserCard companyUserCard = companyUserCardService.selectCompanyUserCardById(cardId);
+            if (companyUserCard == null) {
+                return R.error("名片不存在");
+            }
+            // 校验名片归属，防止越权删除他人名片
+            Long currentUserId = Long.parseLong(getUserId());
+            if (companyUserCard.getUserId() == null || !companyUserCard.getUserId().equals(currentUserId)) {
+                return R.error("无权删除他人名片");
+            }
             String shortUrl = companyUserCard.getShortUrl();
             String[] chainArr = shortUrl.split(".cn/");
             String chain = "";
@@ -652,6 +660,7 @@ public class UserController extends AppBaseController {
         }
     }
 
+    @Login
     @GetMapping("/getUserList")
     public R getUserList() {
         CompanyUser companyUser = companyUserService.selectCompanyUserById(Long.parseLong(getUserId()));
@@ -666,10 +675,18 @@ public class UserController extends AppBaseController {
     @PostMapping("/changeUserState")
     public R changeUserState(@RequestParam Long userId) {
         log.debug("修改用户状态 userId :{}", userId);
+        CompanyUser operator = companyUserService.selectCompanyUserById(Long.parseLong(getUserId()));
+        if (Objects.isNull(operator) || !operator.isAdmin()) {
+            return R.error("仅管理员可操作");
+        }
         CompanyUser companyUser = companyUserService.selectCompanyUserById(userId);
         if (Objects.isNull(companyUser)) {
             throw new ServiceException("用户不存在");
         }
+        // 仅允许操作同公司用户
+        if (operator.getCompanyId() == null || !operator.getCompanyId().equals(companyUser.getCompanyId())) {
+            return R.error("无权操作其他公司用户");
+        }
 
         String state = "0".equals(companyUser.getStatus()) ? "1" : "0";
         companyUser.setStatus(state);