fix(xg): 显式绑定班级学生列表查询参数

坏 JWT 会导致 logout 接口失败，原先 removeToken 执行不到，且 getInfo 失败后跳到 / 形成死循环。

Confidence: high
Scope-risk: narrow
Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/cursorrules-backend.md

@@ -741,6 +741,29 @@ public class UserBo {
 }
 ```
 
+#### 🔴 请求参数名必须显式声明（强制性）
+
+**背景**：生产环境若未使用 `-parameters` 编译，Spring 无法通过反射获取方法参数名，会报错：
+`Name for argument of type [java.lang.Long] not specified, and parameter name information not available via reflection.`
+
+**强制要求**：`@RequestParam` / `@PathVariable` 必须写明参数名，禁止依赖编译器保留参数名。
+
+```java
+// ✅ 正确
+@PutMapping("/authUser/selectAll")
+public R<Void> selectAuthUserAll(@RequestParam("roleId") Long roleId,
+                                 @RequestParam("userIds") Long[] userIds) { ... }
+
+@GetMapping("/{roleId}")
+public R<SysRoleVo> getInfo(@PathVariable("roleId") Long roleId) { ... }
+
+// ❌ 错误（本地 IDEA 可能正常，生产易 500）
+public R<Void> selectAuthUserAll(Long roleId, Long[] userIds) { ... }
+public R<SysRoleVo> getInfo(@PathVariable Long roleId) { ... }
+```
+
+父 POM 已配置 `<parameters>true</parameters>` 与 `-parameters` 作为兜底，但接口代码仍必须显式声明参数名。
+
 #### 🚨 接口开发检查清单
 
 **每个新接口必须检查**：
@@ -752,6 +775,7 @@ public class UserBo {
 -   [ ] 是否添加了@SaCheckPermission 权限注解？
 -   [ ] 是否添加了@Operation 接口描述？
 -   [ ] 是否进行了参数校验？
+-   [ ] `@RequestParam`/`@PathVariable` 是否显式声明了参数名？
 -   [ ] 是否符合 RESTful 命名规范？
 -   [ ] 是否包含了必要的请求头（clientid、Content-Type 等）？
 -   [ ] 是否在 API 文档中记录了接口信息？

.cursor/cursorrules-frontend.md

@@ -933,15 +933,16 @@ FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memor
 ```json
 {
   "scripts": {
-    "build:prod": "node --max-old-space-size=8192 node_modules/vite/bin/vite.js build --mode production",
-    "build:dev": "node --max-old-space-size=8192 node_modules/vite/bin/vite.js build --mode development"
+    "build:prod": "node --max-old-space-size=6144 node_modules/vite/bin/vite.js build --mode production",
+    "build:dev": "node --max-old-space-size=6144 node_modules/vite/bin/vite.js build --mode development"
   }
 }
 ```
 
 #### 参数说明
-- `--max-old-space-size=8192`：设置堆内存限制为8GB
-- 可根据项目规模和机器内存调整数值（4096=4GB, 8192=8GB）
+- `--max-old-space-size=6144`：设置堆内存限制为 6GB
+- 可根据项目规模和机器内存调整数值（4096=4GB, 6144=6GB, 8192=8GB）
+- 2026-10-21：4096MB 会在生产构建 transform 约 2400 个模块时 OOM。当前开发机物理内存为 8GB，脚本使用 6144MB，避免堆上限等于整机内存
 
 #### 适用场景
 - 大型前端项目构建

.cursor/cursorrules-workflow.md

@@ -632,6 +632,12 @@ const handleStartWorkFlow = async (businessData: any) => {
 // - 退回 (backProcess)
 ```
 
+**🔴 退回残留任务清理（强制性，2026-10-15）**：
+
+- `backProcess` 在 `skip(REJECT)` 后必须清理同实例下非目标节点残留 `flow_task`/`flow_user`（`cleanResidualTasksAfterBack`）
+- 草稿/撤销/退回重新提交时，`startWorkFlow` 需自愈多任务脏数据并按实例状态解析正确 taskId（`healResidualTasksOnRestart`）
+- 背景：退回后若残留原审批节点 + draft 申请人任务，移动端再提交会报「启动工作流失败」
+
 ### 3. 流程撤销
 
 ```typescript

.drone.yml

@@ -0,0 +1,76 @@
+# 仅 tag 触发：在内网 Runner 顺序打包 backend / mobile-h5 / web
+# 产物：/root/hzdyjs-releases/<tag>/{backend,mobile-h5,web}-<tag>.*
+# Maven 缓存：宿主机 /root/maven-repo → 容器 /maven-repo（由 runner DRONE_RUNNER_VOLUMES 注入）
+# 发版目录：/root/hzdyjs-releases → /hzdyjs-releases（同上，勿在本文件重复挂载）
+
+kind: pipeline
+type: docker
+name: package-prod
+
+concurrency:
+  limit: 1
+
+trigger:
+  event:
+    - tag
+
+clone:
+  depth: 1
+
+steps:
+  - name: package-backend
+    image: maven:3.9-eclipse-temurin-17
+    commands:
+      - set -eu
+      - echo "==> backend tag=${DRONE_TAG} commit=${DRONE_COMMIT}"
+      - test -n "${DRONE_TAG}"
+      - mkdir -p "/hzdyjs-releases/${DRONE_TAG}"
+      - cd backend
+      - |
+        mvn clean package -Pprod \
+          -Dmaven.test.skip=true \
+          -Dmaven.compiler.parameters=true \
+          -Dmaven.repo.local=/maven-repo
+      - test -f ruoyi-admin/target/ruoyi-admin.jar
+      - cp -v ruoyi-admin/target/ruoyi-admin.jar "/hzdyjs-releases/${DRONE_TAG}/backend-${DRONE_TAG}.jar"
+      - ls -lh "/hzdyjs-releases/${DRONE_TAG}/backend-${DRONE_TAG}.jar"
+
+  - name: package-mobile-h5
+    image: node:20-bookworm
+    environment:
+      NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
+    commands:
+      - set -eu
+      - echo "==> mobile-h5 tag=${DRONE_TAG}"
+      - mkdir -p "/hzdyjs-releases/${DRONE_TAG}"
+      - corepack enable
+      - corepack prepare pnpm@9 --activate
+      - cd mobile
+      # H5 构建不需要 Chromium
+      - export PUPPETEER_SKIP_DOWNLOAD=1 PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
+      - pnpm install --frozen-lockfile --registry https://registry.npmmirror.com
+      - pnpm run build
+      - test -d dist/build/h5
+      - tar -C dist/build/h5 -czf "/hzdyjs-releases/${DRONE_TAG}/mobile-h5-${DRONE_TAG}.tar.gz" .
+      - ls -lh "/hzdyjs-releases/${DRONE_TAG}/"
+      - ls -lh "/hzdyjs-releases/${DRONE_TAG}/mobile-h5-${DRONE_TAG}.tar.gz"
+
+  - name: package-web
+    image: node:20-bookworm
+    environment:
+      NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
+    commands:
+      - set -eu
+      - echo "==> web tag=${DRONE_TAG} commit=${DRONE_COMMIT}"
+      - test -n "${DRONE_TAG}"
+      - mkdir -p "/hzdyjs-releases/${DRONE_TAG}"
+      - cd web
+      # 固定兼容 Node 20 的 npm 11，避开镜像内 npm 10 的 edgesOut 解析异常。
+      - npm install --global npm@11.21.1 --no-audit --no-fund --registry https://registry.npmmirror.com
+      - npm install --no-audit --no-fund --registry https://registry.npmmirror.com
+      # build:ci 使用 6 GB Node 堆并限制 Vite 并行，避免与其他打包步骤叠加内存。
+      - npm run build:ci
+      - test -s dist/index.html
+      - tar -C dist -czf "/hzdyjs-releases/${DRONE_TAG}/web-${DRONE_TAG}.tar.gz" .
+      - ls -lh "/hzdyjs-releases/${DRONE_TAG}/web-${DRONE_TAG}.tar.gz"
+      - sha256sum "/hzdyjs-releases/${DRONE_TAG}/web-${DRONE_TAG}.tar.gz"

.gitignore

@@ -80,7 +80,7 @@ mobile/yarn-debug.log*
 mobile/yarn-error.log*
 mobile/package-lock.json
 mobile/yarn.lock
-mobile/pnpm-lock.yaml
+# mobile/pnpm-lock.yaml 纳入仓库，保证 CI 与本地依赖树一致
 
 # Vue 自动生成的文件
 web/auto-imports.d.ts

backend/package-prod.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# 生产环境打包脚本
+# 强制保留方法参数名，避免 Spring 在生产环境无法绑定请求参数
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+echo "==> 开始生产打包: mvn clean package -Pprod -Dmaven.compiler.parameters=true"
+mvn clean package -Pprod -Dmaven.compiler.parameters=true "$@"
+
+JAR="ruoyi-admin/target/ruoyi-admin.jar"
+if [[ -f "$JAR" ]]; then
+  echo "==> 打包成功: $JAR"
+  ls -lh "$JAR"
+else
+  echo "==> 未找到 $JAR，请检查构建日志" >&2
+  exit 1
+fi

backend/pom.xml

@@ -17,6 +17,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <java.version>17</java.version>
+        <!-- 强制 javac 保留方法参数名，避免生产环境 Spring 绑定 @RequestParam 失败 -->
+        <maven.compiler.parameters>true</maven.compiler.parameters>
         <mybatis.version>3.5.16</mybatis.version>
         <springdoc.version>2.8.8</springdoc.version>
         <therapi-javadoc.version>0.15.0</therapi-javadoc.version>
@@ -78,7 +80,7 @@
                 <profiles.active>dev</profiles.active>
                 <logging.level>info</logging.level>
                 <monitor.username>ruoyi</monitor.username>
-                <monitor.password>123456</monitor.password>
+                <monitor.password>HzdyjsMon@Dev#9Kx7mQ2pL</monitor.password>
             </properties>
             <activation>
                 <!-- 默认环境 -->
@@ -92,7 +94,7 @@
                 <profiles.active>prod-local</profiles.active>
                 <logging.level>warn</logging.level>
                 <monitor.username>ruoyi</monitor.username>
-                <monitor.password>123456</monitor.password>
+                <monitor.password>HzdyjsMon@Prod#TclhloNMWuVjq</monitor.password>
             </properties>
         </profile>
         <profile>
@@ -101,7 +103,7 @@
                 <profiles.active>prod</profiles.active>
                 <logging.level>warn</logging.level>
                 <monitor.username>ruoyi</monitor.username>
-                <monitor.password>123456</monitor.password>
+                <monitor.password>HzdyjsMon@Prod#TclhloNMWuVjq</monitor.password>
             </properties>
         </profile>
     </profiles>
@@ -480,6 +482,8 @@
                             <version>${mapstruct-plus.lombok.version}</version>
                         </path>
                     </annotationProcessorPaths>
+                    <!-- 强制保留方法参数名，避免 @PathVariable/@RequestParam 缺少显式名称时运行时报错 -->
+                    <parameters>true</parameters>
                     <compilerArgs>
                         <arg>-parameters</arg>
                     </compilerArgs>

backend/ruoyi-admin/pom.xml

@@ -80,11 +80,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再打入运行包（含 /demo/mail、/demo/queue 等） -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-admin/src/main/java/org/dromara/test/controller/XgStuMsgController.java

@@ -64,7 +64,7 @@ public class XgStuMsgController extends BaseController {
     @SaCheckPermission("test:stuMsg:query")
     @GetMapping("/{id}")
     public R<XgStuMsgVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(xgStuMsgService.queryById(id));
     }
 
@@ -99,7 +99,7 @@ public class XgStuMsgController extends BaseController {
     @Log(title = "学生信息", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(xgStuMsgService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java

@@ -21,6 +21,8 @@ import org.dromara.common.core.domain.model.SocialLoginBody;
 import org.dromara.common.core.utils.*;
 import org.dromara.common.encrypt.annotation.ApiEncrypt;
 import org.dromara.common.json.utils.JsonUtils;
+import org.dromara.common.ratelimiter.annotation.RateLimiter;
+import org.dromara.common.ratelimiter.enums.LimitType;
 import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.common.social.config.properties.SocialLoginConfigProperties;
 import org.dromara.common.social.config.properties.SocialProperties;
@@ -41,6 +43,7 @@ import org.dromara.web.domain.vo.TenantListVo;
 import org.dromara.web.service.IAuthStrategy;
 import org.dromara.web.service.SysLoginService;
 import org.dromara.web.service.SysRegisterService;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
@@ -73,6 +76,12 @@ public class AuthController {
     private final ISysClientService clientService;
     private final ScheduledExecutorService scheduledExecutorService;
 
+    /**
+     * 配置层注册总开关，默认 false（优先于数据库 sys.account.registerUser）
+     */
+    @Value("${user.register.enabled:false}")
+    private boolean registerEnabled;
+
     /**
      * 登录方法
      *
@@ -118,7 +127,8 @@ public class AuthController {
      */
     @GetMapping("/binding/{source}")
     public R<String> authBinding(@PathVariable("source") String source,
-            @RequestParam String tenantId, @RequestParam String domain) {
+            @RequestParam("tenantId") String tenantId, @RequestParam("domain") String domain) {
+        loginService.checkTenant(tenantId);
         SocialLoginConfigProperties obj = socialProperties.getType().get(source);
         if (ObjectUtil.isNull(obj)) {
             return R.fail(source + "平台账号暂不支持");
@@ -161,7 +171,7 @@ public class AuthController {
      * @param socialId socialId
      */
     @DeleteMapping(value = "/unlock/{socialId}")
-    public R<Void> unlockSocial(@PathVariable Long socialId) {
+    public R<Void> unlockSocial(@PathVariable("socialId") Long socialId) {
         // 校验token
         StpUtil.checkLogin();
         Boolean rows = socialUserService.deleteWithValidById(socialId);
@@ -178,11 +188,18 @@ public class AuthController {
     }
 
     /**
-     * 用户注册
+     * 用户注册（免登接口；默认关闭，需同时打开配置与数据库开关）
      */
     @ApiEncrypt
+    @RateLimiter(time = 60, count = 5, limitType = LimitType.IP)
     @PostMapping("/register")
     public R<Void> register(@Validated @RequestBody RegisterBody user) {
+        // P6：配置层硬关闭，避免仅依赖库开关被后台误开后遭滥用
+        if (!registerEnabled) {
+            return R.fail("当前系统没有开启注册功能！");
+        }
+        // 先校验租户（含格式白名单），禁止脏 tenantId 进入 selectRegisterEnabled 触发 SQL 注入
+        loginService.checkTenant(user.getTenantId());
         if (!configService.selectRegisterEnabled(user.getTenantId())) {
             return R.fail("当前系统没有开启注册功能！");
         }

backend/ruoyi-admin/src/main/java/org/dromara/web/controller/CasController.java

@@ -1,5 +1,6 @@
 package org.dromara.web.controller;
 
+import org.dromara.common.web.handler.GlobalExceptionHandler;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.domain.R;
@@ -68,9 +69,11 @@ public class CasController {
                     CAS_BASE, CLIENT_ID, CLIENT_SECRET, URLEncoder.encode(code, StandardCharsets.UTF_8.toString()),
                     REDIRECT_URI_ENCODED);
 
-            log.info("请求 CAS accessToken: {}", url);
+            // 禁止打印 client_secret、完整换票 URL、access_token
+            log.info("请求 CAS accessToken: base={}, client_id={}, codeLen={}", CAS_BASE, CLIENT_ID,
+                    code != null ? code.length() : 0);
             String resp = HttpUtil.get(url);
-            log.info("CAS accessToken 响应: {}", resp);
+            log.info("CAS accessToken 响应已收到: respLen={}", resp != null ? resp.length() : 0);
 
             // 尝试解析 access_token（CAS 可能返回 JSON 或 query-string 风格）
             String accessToken = null;
@@ -96,9 +99,10 @@ public class CasController {
                 // 使用 access_token 请求 profile 接口
                 String profileUrl = String.format("%s/cas/oauth2.0/profile?access_token=%s", CAS_BASE,
                         URLEncoder.encode(accessToken, StandardCharsets.UTF_8.toString()));
-                log.info("请求 CAS profile: {}", profileUrl);
+                // 禁止打印 access_token 与完整 profile
+                log.info("请求 CAS profile: base={}", CAS_BASE);
                 String profileResp = HttpUtil.get(profileUrl);
-                log.info("CAS profile 响应: {}", profileResp);
+                log.info("CAS profile 响应已收到: respLen={}", profileResp != null ? profileResp.length() : 0);
 
                 // 解析 profile，尝试从 attributes 中找到 CODE(用户名) 和 TENANTID
                 try {
@@ -175,14 +179,14 @@ public class CasController {
                     return R.fail(ue.getMessage());
                 } catch (Exception e) {
                     log.error("处理 CAS profile 失败", e);
-                    return R.fail("处理 CAS profile 失败: " + e.getMessage());
+                    return R.fail("处理 CAS profile 失败: " + GlobalExceptionHandler.safeMessage(e.getMessage()));
                 }
             } else {
-                return R.fail("无法解析 CAS access_token，原始响应: " + resp);
+                return R.fail("无法解析 CAS access_token");
             }
         } catch (Exception e) {
             log.error("请求 CAS accessToken 失败", e);
-            return R.fail("请求 CAS accessToken 失败: " + e.getMessage());
+            return R.fail("请求 CAS accessToken 失败: " + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 }

backend/ruoyi-admin/src/main/java/org/dromara/web/listener/UserActionListener.java

@@ -73,7 +73,27 @@ public class UserActionListener implements SaTokenListener {
         SpringUtils.context().publishEvent(logininforEvent);
         // 更新登录信息
         loginService.recordLoginInfo((Long) loginParameter.getExtra(LoginHelper.USER_KEY), ip);
-        log.info("user doLogin, userId:{}, token:{}", loginId, tokenValue);
+        log.info("user doLogin, userId:{}", loginId);
+    }
+
+    /**
+     * 清理在线用户缓存。JWT 密钥变更后旧 token 无法 getExtra，绝不能抛异常打断登录流程
+     * （登录时 logoutByMaxLoginCount 会回调 doLogout/doReplaced）。
+     */
+    private void clearOnlineCache(Object loginId, String tokenValue) {
+        try {
+            String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY));
+            TenantHelper.dynamic(tenantId, () ->
+                RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue));
+        } catch (Exception e) {
+            log.warn("清理在线缓存时 token 无法解析（多为 JWT 密钥变更后的旧会话）, userId={}, err={}",
+                loginId, e.getMessage());
+            try {
+                RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
+            } catch (Exception ignored) {
+                // ignore
+            }
+        }
     }
 
     /**
@@ -81,11 +101,8 @@ public class UserActionListener implements SaTokenListener {
      */
     @Override
     public void doLogout(String loginType, Object loginId, String tokenValue) {
-        String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY));
-        TenantHelper.dynamic(tenantId, () -> {
-            RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        });
-        log.info("user doLogout, userId:{}, token:{}", loginId, tokenValue);
+        clearOnlineCache(loginId, tokenValue);
+        log.info("user doLogout, userId:{}", loginId);
     }
 
     /**
@@ -93,11 +110,8 @@ public class UserActionListener implements SaTokenListener {
      */
     @Override
     public void doKickout(String loginType, Object loginId, String tokenValue) {
-        String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY));
-        TenantHelper.dynamic(tenantId, () -> {
-            RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        });
-        log.info("user doKickout, userId:{}, token:{}", loginId, tokenValue);
+        clearOnlineCache(loginId, tokenValue);
+        log.info("user doKickout, userId:{}", loginId);
     }
 
     /**
@@ -105,11 +119,8 @@ public class UserActionListener implements SaTokenListener {
      */
     @Override
     public void doReplaced(String loginType, Object loginId, String tokenValue) {
-        String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY));
-        TenantHelper.dynamic(tenantId, () -> {
-            RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        });
-        log.info("user doReplaced, userId:{}, token:{}", loginId, tokenValue);
+        clearOnlineCache(loginId, tokenValue);
+        log.info("user doReplaced, userId:{}", loginId);
     }
 
     /**

backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysLoginService.java

@@ -56,6 +56,9 @@ public class SysLoginService {
     @Value("${user.password.lockTime}")
     private Integer lockTime;
 
+    @Value("${user.password.ipMaxRetryCount:30}")
+    private Integer ipMaxRetryCount;
+
     private final ISysTenantService tenantService;
     private final ISysPermissionService permissionService;
     private final ISysSocialService sysSocialService;
@@ -200,7 +203,23 @@ public class SysLoginService {
             throw new UserException(loginType.getRetryLimitExceed(), maxRetryCount, lockTime);
         }
 
+        // 按公网来源 IP 统计失败次数，防止对大量账号逐个试密码；校园内网 / 本机 IP 不计
+        String clientIp = ServletUtils.getClientIP();
+        String ipErrorKey = null;
+        if (ipMaxRetryCount > 0 && StringUtils.isNotBlank(clientIp) && isPublicClientIp(clientIp)) {
+            ipErrorKey = CacheConstants.PWD_ERR_CNT_KEY + "ip:" + clientIp;
+            int ipErrorNumber = ObjectUtil.defaultIfNull(RedisUtils.getCacheObject(ipErrorKey), 0);
+            if (ipErrorNumber >= ipMaxRetryCount) {
+                recordLogininfor(tenantId, username, loginFail, MessageUtils.message("user.ip.retry.limit.exceed", lockTime));
+                throw new UserException("user.ip.retry.limit.exceed", lockTime);
+            }
+        }
+
         if (supplier.get()) {
+            if (ipErrorKey != null) {
+                int ipErrorNumber = ObjectUtil.defaultIfNull(RedisUtils.getCacheObject(ipErrorKey), 0);
+                RedisUtils.setCacheObject(ipErrorKey, ipErrorNumber + 1, Duration.ofMinutes(lockTime));
+            }
             // 错误次数递增
             errorNumber++;
             RedisUtils.setCacheObject(errorKey, errorNumber, Duration.ofMinutes(lockTime));
@@ -219,12 +238,33 @@ public class SysLoginService {
         RedisUtils.deleteObject(errorKey);
     }
 
+    /**
+     * 是否为需要计入失败锁定的公网 IP。本机、内网 IPv4/IPv6 不计；无法解析时按公网处理，且不得抛异常阻断登录。
+     */
+    private boolean isPublicClientIp(String ip) {
+        try {
+            if (NetUtils.isIPv6(ip)) {
+                return !NetUtils.isInnerIPv6(ip);
+            }
+            if (NetUtils.isIPv4(ip)) {
+                return !NetUtils.isInnerIP(ip);
+            }
+        } catch (Exception e) {
+            log.warn("无法判断登录来源 IP 是否内网: {}", ip);
+        }
+        return true;
+    }
+
     /**
      * 校验租户
      *
      * @param tenantId 租户ID
      */
     public void checkTenant(String tenantId) {
+        // 只要传入了 tenantId，无论租户开关是否开启都先做格式白名单（防注入）
+        if (StringUtils.isNotBlank(tenantId)) {
+            TenantHelper.checkTenantIdFormat(tenantId);
+        }
         if (!TenantHelper.isEnable()) {
             return;
         }

backend/ruoyi-admin/src/main/java/org/dromara/web/service/SysRegisterService.java

@@ -22,6 +22,7 @@ import org.dromara.system.domain.SysUser;
 import org.dromara.system.domain.bo.SysUserBo;
 import org.dromara.system.mapper.SysUserMapper;
 import org.dromara.system.service.ISysUserService;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
 /**
@@ -37,11 +38,19 @@ public class SysRegisterService {
     private final SysUserMapper userMapper;
     private final CaptchaProperties captchaProperties;
 
+    @Value("${user.register.enabled:false}")
+    private boolean registerEnabled;
+
     /**
      * 注册
      */
     public void register(RegisterBody registerBody) {
+        if (!registerEnabled) {
+            throw new UserException("user.register.disabled");
+        }
         String tenantId = registerBody.getTenantId();
+        // 动态租户查询前校验格式，防止绕过 Controller 时注入
+        TenantHelper.checkTenantIdFormat(tenantId);
         String username = registerBody.getUsername();
         String password = registerBody.getPassword();
         // 校验用户类型是否存在

backend/ruoyi-admin/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java

@@ -64,7 +64,9 @@ public class PasswordAuthStrategy implements IAuthStrategy {
         }
         LoginUser loginUser = TenantHelper.dynamic(tenantId, () -> {
             SysUserVo user = loadUserByUsername(username);
-            loginService.checkLogin(LoginType.PASSWORD, tenantId, username, () -> !BCrypt.checkpw(password, user.getPassword()));
+            // 用户不存在时按密码错误处理，避免通过提示差异枚举账号
+            loginService.checkLogin(LoginType.PASSWORD, tenantId, username,
+                () -> user == null || !BCrypt.checkpw(password, user.getPassword()));
             // 此处可根据登录用户的数据不同 自行创建 loginUser
             return loginService.buildLoginUser(user);
         });
@@ -112,7 +114,7 @@ public class PasswordAuthStrategy implements IAuthStrategy {
         SysUserVo user = userMapper.selectVoOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getUserName, username));
         if (ObjectUtil.isNull(user)) {
             log.info("登录用户：{} 不存在.", username);
-            throw new UserException("user.not.exists", username);
+            return null;
         } else if (SystemConstants.DISABLE.equals(user.getStatus())) {
             log.info("登录用户：{} 已被停用.", username);
             throw new UserException("user.blocked", username);

backend/ruoyi-admin/src/main/resources/application-dev.yml

@@ -1,7 +1,19 @@
---- # 监控中心配置
+--- # Actuator 全关（不使用）
+management:
+  endpoints:
+    enabled-by-default: false
+    web:
+      exposure:
+        include: ""
+  endpoint:
+    health:
+      enabled: false
+    heapdump:
+      enabled: false
+
+--- # 监控中心配置（不使用，关闭客户端）
 spring.boot.admin.client:
-  # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://localhost:9090/admin
   instance:
     service-host-type: IP
@@ -74,8 +86,8 @@ spring:
           # rewriteBatchedStatements=true 批处理优化 大幅提升批量插入更新删除性能(对数据库有性能损耗 使用批量操作应考虑性能问题)
           # 增加锁等待超时参数，减少锁冲突
           url: jdbc:mysql://47.99.164.66:3306/hzdyjs_xg?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8&autoReconnect=true&rewriteBatchedStatements=true&allowPublicKeyRetrieval=true&nullCatalogMeansCurrent=true&innodb_lock_wait_timeout=120&autocommit=true
-          username: root
-          password: hn02le.34lkdLKD
+          username: hzdyjs_app
+          password: Hzdyjs@App#n4SQi8AfPHldNj49
 #        # 从库数据源
 #        slave:
 #          lazy: true
@@ -130,7 +142,7 @@ spring.data:
     # 数据库索引
     database: 8
     # redis 密码必须配置
-    password: Hzdyjs@123456
+    password: "Fwd7y-8UDlZ3%3VO8kwn%J1T"
     # 连接超时时间
     timeout: 30s
     # 是否开启ssl

backend/ruoyi-admin/src/main/resources/application-prod-68-9900.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-68-9901.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-68-9902.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-68-9903.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-9900.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-9901.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-9902.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-9903.yml

@@ -18,7 +18,7 @@ logging:
 
 # 监控中心配置 - 端口漂移
 spring.boot.admin.client:
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-admin/src/main/resources/application-prod-local.yml

@@ -1,10 +1,22 @@
 --- # 临时文件存储位置 避免临时文件被系统清理报错
 spring.servlet.multipart.location: /ruoyi/server/temp
 
---- # 监控中心配置
+--- # Actuator 全关（不使用）
+management:
+  endpoints:
+    enabled-by-default: false
+    web:
+      exposure:
+        include: ""
+  endpoint:
+    health:
+      enabled: false
+    heapdump:
+      enabled: false
+
+--- # 监控中心配置（不使用，关闭客户端）
 spring.boot.admin.client:
-  # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://47.121.125.41:9090/admin
   instance:
     service-host-type: IP
@@ -53,8 +65,8 @@ spring:
           # jdbc 所有参数配置参考 https://lionli.blog.csdn.net/article/details/122018562
           # rewriteBatchedStatements=true 批处理优化 大幅提升批量插入更新删除性能(对数据库有性能损耗 使用批量操作应考虑性能问题)
           url: jdbc:mysql://47.99.164.66:3306/hzdyjs_xg?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8&autoReconnect=true&rewriteBatchedStatements=true&allowPublicKeyRetrieval=true&nullCatalogMeansCurrent=true
-          username: root
-          password: hn02le.34lkdLKD
+          username: hzdyjs_app
+          password: Hzdyjs@App#n4SQi8AfPHldNj49
 #        # 从库数据源
 #        slave:
 #          lazy: true
@@ -107,7 +119,7 @@ spring.data:
     # 数据库索引
     database: 3
     # redis 密码必须配置
-    password: Hzdyjs@123456
+    password: "Fwd7y-8UDlZ3%3VO8kwn%J1T"
     # 连接超时时间
     timeout: 10s
     # 是否开启ssl

backend/ruoyi-admin/src/main/resources/application-prod.yml

@@ -1,10 +1,26 @@
+--- # Sa-Token（生产显式固定 JWT 密钥，禁止使用随机密钥，否则已登录会话会整体失效）
+sa-token:
+  jwt-secret-key: abcdefghijklmnopqrstuvwxyz
+
 --- # 临时文件存储位置 避免临时文件被系统清理报错
 spring.servlet.multipart.location: /ruoyi/server/temp
 
---- # 监控中心配置
+--- # Actuator 全关（不使用）
+management:
+  endpoints:
+    enabled-by-default: false
+    web:
+      exposure:
+        include: ""
+  endpoint:
+    health:
+      enabled: false
+    heapdump:
+      enabled: false
+
+--- # 监控中心配置（不使用，关闭客户端）
 spring.boot.admin.client:
-  # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP
@@ -53,8 +69,8 @@ spring:
           # jdbc 所有参数配置参考 https://lionli.blog.csdn.net/article/details/122018562
           # rewriteBatchedStatements=true 批处理优化 大幅提升批量插入更新删除性能(对数据库有性能损耗 使用批量操作应考虑性能问题)
           url: jdbc:mysql://172.16.0.67:3306/hzdyjs_xg?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&useSSL=true&serverTimezone=GMT%2B8&autoReconnect=true&rewriteBatchedStatements=true&allowPublicKeyRetrieval=true&nullCatalogMeansCurrent=true
-          username: root
-          password: Hzdyjs@Root@123456
+          username: hzdyjs_app
+          password: Hzdyjs@App#n4SQi8AfPHldNj49
 #        # 从库数据源
 #        slave:
 #          lazy: true
@@ -107,7 +123,7 @@ spring.data:
     # 数据库索引
     database: 3
     # redis 密码必须配置
-    password: Hzdyjs@redis@123456
+    password: Hzdyschool@redis@15937
     # 连接超时时间
     timeout: 10s
     # 是否开启ssl
@@ -336,7 +352,8 @@ logging:
 mybatis-plus:
   configuration:
     # 生产环境关闭 SQL 日志打印，避免性能影响和敏感信息泄露
-    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
+    # 生产禁止将完整 SQL 及参数（身份证号、手机号等）打印到控制台，需排查时在 dev 环境开启
+    # log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
     # 开启驼峰命名转换
     map-underscore-to-camel-case: true
     # 开启缓存

backend/ruoyi-admin/src/main/resources/application.yml

@@ -58,11 +58,16 @@ logging:
 
 # 用户配置
 user:
+  # 开放注册总开关（P6：校园场景默认关闭，防止免登 /auth/register 被滥用）
+  register:
+    enabled: false
   password:
     # 密码最大错误次数
     maxRetryCount: 5
     # 密码锁定时间（默认10分钟）
     lockTime: 10
+    # 同一公网IP在锁定时间内允许的最大登录失败次数（内网IP不计，0为关闭）
+    ipMaxRetryCount: 30
 
 # Spring配置
 spring:
@@ -125,7 +130,7 @@ sa-token:
 
 # security配置
 security:
-  # 排除路径
+  # 排除路径（P0：已下线 Swagger/api-docs，不再加入白名单）
   excludes:
     - /*.html
     - /**/*.html
@@ -133,20 +138,10 @@ security:
     - /**/*.js
     - /favicon.ico
     - /error
-    - /*/api-docs
-    - /*/api-docs/**
-    - /api-docs
-    - /api-docs/**
-    - /swagger-ui/**
-    - /swagger-ui.html
-    - /swagger-ui/index.html
-    - /v3/api-docs/**
-    - /webjars/**
     - /warm-flow-ui/config
  # 招聘门户公开接口 weizhong
     - /rs/job/public/**
     - /rs/job/view/**
-    - /rs/application/submit
     - /system/dict/data/type/*
 
 # 多租户配置
@@ -164,6 +159,7 @@ tenant:
     - sys_user_role
     - sys_client
     - sys_oss_config
+    - sys_bucket_access_record
     - xljk_evaluation
     - xljk_evaluation_detail
 
@@ -180,7 +176,8 @@ mybatis-plus:
   typeAliasesPackage: org.dromara.**.domain
   # 启用SQL日志输出，用于调试数据库插入问题
   configuration:
-    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
+    # 生产禁止将完整 SQL 及参数（身份证号、手机号等）打印到控制台，需排查时在 dev 环境开启
+    # log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
   global-config:
     dbConfig:
       # 主键类型
@@ -215,50 +212,25 @@ api-decrypt:
   # 对应前端加密公钥 MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKoR8mX0rGKLqzcWmOzbfj64K8ZIgOdHnzkXSOVOZbFu/TJhZ7rFAN+eaGkl3C4buccQd/EjEsj9ir7ijT7h96MCAwEAAQ==
   privateKey: MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAqhHyZfSsYourNxaY7Nt+PrgrxkiA50efORdI5U5lsW79MmFnusUA355oaSXcLhu5xxB38SMSyP2KvuKNPuH3owIDAQABAkAfoiLyL+Z4lf4Myxk6xUDgLaWGximj20CUf+5BKKnlrK+Ed8gAkM0HqoTt2UZwA5E2MzS4EI2gjfQhz5X28uqxAiEA3wNFxfrCZlSZHb0gn2zDpWowcSxQAgiCstxGUoOqlW8CIQDDOerGKH5OmCJ4Z21v+F25WaHYPxCFMvwxpcw99EcvDQIgIdhDTIqD2jfYjPTY8Jj3EDGPbH2HHuffvflECt3Ek60CIQCFRlCkHpi7hthhYhovyloRYsM+IS9h/0BzlEAuO0ktMQIgSPT3aFAgJYwKpqRYKlLDVcflZFCKY7u3UP8iWi1Qw0Y=
 
+# P0：Swagger / api-docs 已下线，禁止对外暴露接口清单
 springdoc:
   api-docs:
-    # 是否开启接口文档
-    enabled: true
-    # 接口文档路径
+    enabled: false
     path: /api-docs
   swagger-ui:
-    # 启用 Swagger UI
-    enabled: true
-    # Swagger UI 路径
+    enabled: false
     path: /swagger-ui.html
   info:
-    # 标题
     title: '标题：杭州第一技师学院智慧校园管理系统_接口文档'
-    # 描述
-    description: '描述：用于管理集团旗下公司的人员信息,具体包括XXX,XXX模块...'
-    # 版本
+    description: '描述：接口文档已关闭'
     version: '版本号: ${ruoyi.version}'
-    # 作者信息
-    contact:
-      name: Lion Li
-      email: crazylionli@163.com
-      url: https://gitee.com/dromara/RuoYi-Vue-Plus
   components:
-    # 鉴权方式配置
     security-schemes:
       apiKey:
         type: APIKEY
         in: HEADER
         name: ${sa-token.token-name}
-  #这里定义了两个分组，可定义多个，也可以不定义
-  group-configs:
-    - group: 1.演示模块
-      packages-to-scan: org.dromara.demo
-    - group: 2.通用模块
-      packages-to-scan: org.dromara.web
-    - group: 3.系统模块
-      packages-to-scan: org.dromara.system
-    - group: 4.代码生成模块
-      packages-to-scan: org.dromara.generator
-    - group: 5.工作流模块
-      packages-to-scan: org.dromara.workflow
-    - group: 6.所有业务模块
-      packages-to-scan: org.dromara
+  group-configs: []
 
 # 防止XSS攻击
 xss:
@@ -285,15 +257,18 @@ lock4j:
   # 分布式锁的超时时间，默认为 30 秒
   expire: 30000
 
---- # Actuator 监控端点的配置项
+--- # Actuator：不使用监控，关闭全部 Web 端点（含 heapdump）
 management:
   endpoints:
+    enabled-by-default: false
     web:
       exposure:
-        include: '*'
+        include: ""
   endpoint:
     health:
-      show-details: ALWAYS
+      enabled: false
+    heapdump:
+      enabled: false
     logfile:
       external-file: ./logs/sys-console.log
 

backend/ruoyi-admin/src/main/resources/i18n/messages.properties

@@ -6,6 +6,7 @@ user.not.exists=对不起, 您的账号：{0} 不存在.
 user.password.not.match=用户不存在/密码错误
 user.password.retry.limit.count=密码输入错误{0}次
 user.password.retry.limit.exceed=密码输入错误{0}次，帐户锁定{1}分钟
+user.ip.retry.limit.exceed=登录失败次数过多，请{0}分钟后再试
 user.password.delete=对不起，您的账号：{0} 已被删除
 user.blocked=对不起，您的账号：{0} 已禁用，请联系管理员
 role.blocked=角色已封禁，请联系管理员
@@ -25,6 +26,7 @@ user.login.success=登录成功
 user.register.success=注册成功
 user.register.save.error=保存用户 {0} 失败，注册账号已存在
 user.register.error=注册失败，请联系系统管理人员
+user.register.disabled=当前系统没有开启注册功能！
 user.notfound=请重新登录
 user.forcelogout=管理员强制退出，请重新登录
 user.unknown.error=未知错误，请重新登录
@@ -56,6 +58,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
 social.state.not.blank=第三方登录平台[state]不能为空
 ##租户
 tenant.number.not.blank=租户编号不能为空
+tenant.id.invalid=租户编号格式不正确
 tenant.not.exists=对不起, 您的租户不存在，请联系管理员
 tenant.blocked=对不起，您的租户已禁用，请联系管理员
 tenant.expired=对不起，您的租户已过期，请联系管理员

backend/ruoyi-admin/src/main/resources/i18n/messages_en_US.properties

@@ -6,6 +6,7 @@ user.not.exists=Sorry, your account: {0} does not exist
 user.password.not.match=User does not exist/Password error
 user.password.retry.limit.count=Password input error {0} times
 user.password.retry.limit.exceed=Password input error {0} times, account locked for {1} minutes
+user.ip.retry.limit.exceed=Too many failed logins, please try again in {0} minutes
 user.password.delete=Sorry, your account：{0} has been deleted
 user.blocked=Sorry, your account: {0} has been disabled. Please contact the administrator
 role.blocked=Role disabled，please contact administrators
@@ -25,6 +26,7 @@ user.login.success=Login successful
 user.register.success=Register successful
 user.register.save.error=Failed to save user {0}, The registered account already exists
 user.register.error=Register failed, please contact system administrator
+user.register.disabled=User registration is disabled
 user.notfound=Please login again
 user.forcelogout=The administrator is forced to exit，please login again
 user.unknown.error=Unknown error, please login again
@@ -56,6 +58,7 @@ social.code.not.blank=Social login platform [code] cannot be blank
 social.state.not.blank=Social login platform [state] cannot be blank
 ##租户
 tenant.number.not.blank=Tenant number cannot be blank
+tenant.id.invalid=Invalid tenant number format
 tenant.not.exists=Sorry, your tenant does not exist. Please contact the administrator
 tenant.blocked=Sorry, your tenant is disabled. Please contact the administrator
 tenant.expired=Sorry, your tenant has expired. Please contact the administrator.

backend/ruoyi-admin/src/main/resources/i18n/messages_zh_CN.properties

@@ -6,6 +6,7 @@ user.not.exists=对不起, 您的账号：{0} 不存在.
 user.password.not.match=用户不存在/密码错误
 user.password.retry.limit.count=密码输入错误{0}次
 user.password.retry.limit.exceed=密码输入错误{0}次，帐户锁定{1}分钟
+user.ip.retry.limit.exceed=登录失败次数过多，请{0}分钟后再试
 user.password.delete=对不起，您的账号：{0} 已被删除
 user.blocked=对不起，您的账号：{0} 已禁用，请联系管理员
 role.blocked=角色已封禁，请联系管理员
@@ -25,6 +26,7 @@ user.login.success=登录成功
 user.register.success=注册成功
 user.register.save.error=保存用户 {0} 失败，注册账号已存在
 user.register.error=注册失败，请联系系统管理人员
+user.register.disabled=当前系统没有开启注册功能！
 user.notfound=请重新登录
 user.forcelogout=管理员强制退出，请重新登录
 user.unknown.error=未知错误，请重新登录
@@ -56,6 +58,7 @@ social.code.not.blank=第三方登录平台[code]不能为空
 social.state.not.blank=第三方登录平台[state]不能为空
 ##租户
 tenant.number.not.blank=租户编号不能为空
+tenant.id.invalid=租户编号格式不正确
 tenant.not.exists=对不起, 您的租户不存在，请联系管理员
 tenant.blocked=对不起，您的租户已禁用，请联系管理员
 tenant.expired=对不起，您的租户已过期，请联系管理员

backend/ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/config/ApplicationConfig.java

@@ -3,6 +3,7 @@ package org.dromara.common.core.config;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
 import org.springframework.scheduling.annotation.EnableAsync;
+import org.springframework.scheduling.annotation.EnableScheduling;
 
 /**
  * 程序注解配置
@@ -12,6 +13,7 @@ import org.springframework.scheduling.annotation.EnableAsync;
 @AutoConfiguration
 @EnableAspectJAutoProxy
 @EnableAsync(proxyTargetClass = true)
+@EnableScheduling
 public class ApplicationConfig {
 
 }

backend/ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/domain/model/LoginBody.java

@@ -1,6 +1,7 @@
 package org.dromara.common.core.domain.model;
 
 import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
 import lombok.Data;
 
 import java.io.Serial;
@@ -31,8 +32,9 @@ public class LoginBody implements Serializable {
     private String grantType;
 
     /**
-     * 租户ID
+     * 租户ID（仅允许纯数字，防止拼进 SQL 导致注入）
      */
+    @Pattern(regexp = "^[0-9]{1,20}$", message = "{tenant.id.invalid}")
     private String tenantId;
 
     /**

backend/ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/utils/file/MimeTypeUtils.java

@@ -26,10 +26,10 @@ public class MimeTypeUtils {
     public static final String[] VIDEO_EXTENSION = {"mp4", "avi", "rmvb"};
 
     public static final String[] DEFAULT_ALLOWED_EXTENSION = {
-        // 图片
+        // 图片（不含 svg，避免脚本型 XSS）
         "bmp", "gif", "jpg", "jpeg", "png",
-        // word excel powerpoint
-        "doc", "docx", "xls", "xlsx", "ppt", "pptx", "html", "htm", "txt",
+        // word excel powerpoint（不含 html/htm）
+        "doc", "docx", "xls", "xlsx", "ppt", "pptx", "txt",
         // 压缩文件
         "rar", "zip", "gz", "bz2",
         // 视频格式
@@ -37,4 +37,46 @@ public class MimeTypeUtils {
         // pdf
         "pdf"};
 
+    private static final java.util.Map<String, String> SAFE_CONTENT_TYPES = java.util.Map.ofEntries(
+        java.util.Map.entry("bmp", IMAGE_BMP),
+        java.util.Map.entry("gif", IMAGE_GIF),
+        java.util.Map.entry("jpg", IMAGE_JPEG),
+        java.util.Map.entry("jpeg", IMAGE_JPEG),
+        java.util.Map.entry("png", IMAGE_PNG),
+        java.util.Map.entry("pdf", "application/pdf"),
+        java.util.Map.entry("txt", "text/plain;charset=UTF-8"),
+        java.util.Map.entry("doc", "application/msword"),
+        java.util.Map.entry("docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"),
+        java.util.Map.entry("xls", "application/vnd.ms-excel"),
+        java.util.Map.entry("xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"),
+        java.util.Map.entry("ppt", "application/vnd.ms-powerpoint"),
+        java.util.Map.entry("pptx", "application/vnd.openxmlformats-officedocument.presentationml.presentation"),
+        java.util.Map.entry("mp4", "video/mp4")
+    );
+
+    /**
+     * 扩展名是否在上传白名单内
+     */
+    public static boolean isAllowedExtension(String extension) {
+        if (extension == null || extension.isBlank()) {
+            return false;
+        }
+        for (String allowed : DEFAULT_ALLOWED_EXTENSION) {
+            if (allowed.equalsIgnoreCase(extension)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * 按扩展名确定存储时使用的 Content-Type，不信任客户端上报值，防止以 text/html 等类型上传后在浏览器中执行脚本
+     */
+    public static String getSafeContentType(String extension) {
+        if (extension == null) {
+            return "application/octet-stream";
+        }
+        return SAFE_CONTENT_TYPES.getOrDefault(extension.toLowerCase(), "application/octet-stream");
+    }
+
 }

backend/ruoyi-common/ruoyi-common-job/src/main/java/org/dromara/common/job/config/SnailJobConfig.java

@@ -10,17 +10,16 @@ import org.slf4j.LoggerFactory;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.event.EventListener;
-import org.springframework.scheduling.annotation.EnableScheduling;
 
 /**
- * 启动定时任务
+ * 启动 SnailJob 客户端
+ * <p>Spring {@code @Scheduled} 已由 {@code ApplicationConfig} 统一开启，不再依赖本配置。</p>
  *
  * @author opensnail
  * @date 2024-05-17
  */
 @AutoConfiguration
 @ConditionalOnProperty(prefix = "snail-job", name = "enabled", havingValue = "true")
-@EnableScheduling
 @EnableSnailJob
 public class SnailJobConfig {
 

backend/ruoyi-common/ruoyi-common-mybatis/src/main/java/org/dromara/common/mybatis/handler/MybatisExceptionHandler.java

@@ -41,7 +41,7 @@ public class MybatisExceptionHandler {
             return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, "未找到数据源，请联系管理员确认");
         }
         log.error("请求地址'{}', Mybatis系统异常", requestURI, e);
-        return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, message);
+        return R.fail(HttpStatus.HTTP_INTERNAL_ERROR, "数据处理异常，请稍后重试或联系管理员");
     }
 
 }

backend/ruoyi-common/ruoyi-common-redis/src/main/java/org/dromara/common/redis/config/RedisConfig.java

@@ -2,9 +2,11 @@ package org.dromara.common.redis.config;
 
 import cn.hutool.core.util.ObjectUtil;
 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.annotation.PropertyAccessor;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.jsontype.impl.LaissezFaireSubTypeValidator;
+import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
+import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import com.fasterxml.jackson.datatype.jsr310.deser.LocalDateTimeDeserializer;
 import com.fasterxml.jackson.datatype.jsr310.ser.LocalDateTimeSerializer;
@@ -51,8 +53,19 @@ public class RedisConfig {
             om.registerModule(javaTimeModule);
             om.setTimeZone(TimeZone.getDefault());
             om.setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
-            // 指定序列化输入的类型，类必须是非final修饰的。序列化时将对象全类名一起保存下来
-            om.activateDefaultTyping(LaissezFaireSubTypeValidator.instance, ObjectMapper.DefaultTyping.NON_FINAL);
+            // 使用包名白名单替代 LaissezFaireSubTypeValidator，降低 Redis 被写入恶意 @class 时的反序列化 RCE 风险
+            // 说明：RedisUtils/Sa-Token 以 Object 读写缓存，仍需保留类型信息；禁止完全放开任意类反序列化
+            PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
+                .allowIfSubType("org.dromara.")
+                .allowIfSubType("cn.dev33.satoken.")
+                .allowIfSubType("cn.hutool.")
+                .allowIfSubType("java.util.")
+                .allowIfSubType("java.lang.")
+                .allowIfSubType("java.time.")
+                .allowIfSubType("java.math.")
+                .allowIfSubType("java.util.concurrent.")
+                .build();
+            om.activateDefaultTyping(ptv, ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
 //            LoggerFactory.useSlf4jLogging(true);
 //            FuryCodec furyCodec = new FuryCodec();
 //            CompositeCodec codec = new CompositeCodec(StringCodec.INSTANCE, furyCodec, furyCodec);

backend/ruoyi-common/ruoyi-common-satoken/src/main/java/org/dromara/common/satoken/handler/SaTokenExceptionHandler.java

@@ -3,6 +3,7 @@ package org.dromara.common.satoken.handler;
 import cn.dev33.satoken.exception.NotLoginException;
 import cn.dev33.satoken.exception.NotPermissionException;
 import cn.dev33.satoken.exception.NotRoleException;
+import cn.dev33.satoken.jwt.exception.SaJwtException;
 import cn.hutool.http.HttpStatus;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.extern.slf4j.Slf4j;
@@ -49,4 +50,14 @@ public class SaTokenExceptionHandler {
         return R.fail(HttpStatus.HTTP_UNAUTHORIZED, "认证失败，无法访问系统资源");
     }
 
+    /**
+     * JWT 签名无效/解析失败（常见于密钥变更后残留旧 token）
+     */
+    @ExceptionHandler(SaJwtException.class)
+    public R<Void> handleSaJwtException(SaJwtException e, HttpServletRequest request) {
+        String requestURI = request.getRequestURI();
+        log.error("请求地址'{}',JWT校验失败'{}',无法访问系统资源", requestURI, e.getMessage());
+        return R.fail(HttpStatus.HTTP_UNAUTHORIZED, "登录状态已失效，请重新登录");
+    }
+
 }

backend/ruoyi-common/ruoyi-common-security/src/main/java/org/dromara/common/security/config/SecurityConfig.java

@@ -59,9 +59,19 @@ public class SecurityConfig implements WebMvcConfigurer {
                         StpUtil.checkLogin();
 
                         // 检查 header 与 param 里的 clientid 与 token 里的是否一致
+                        // jwt 密钥切换后旧 token 会在 getExtra 时抛 SaJwtException，转为未登录避免页面报“未知异常”
                         String headerCid = request.getHeader(LoginHelper.CLIENT_KEY);
                         String paramCid = ServletUtils.getParameter(LoginHelper.CLIENT_KEY);
-                        String clientId = StpUtil.getExtra(LoginHelper.CLIENT_KEY).toString();
+                        Object clientIdExtra;
+                        try {
+                            clientIdExtra = StpUtil.getExtra(LoginHelper.CLIENT_KEY);
+                        } catch (Exception e) {
+                            throw NotLoginException.newInstance(StpUtil.getLoginType(),
+                                NotLoginException.INVALID_TOKEN,
+                                "token无效或已过期，请重新登录",
+                                StpUtil.getTokenValue());
+                        }
+                        String clientId = clientIdExtra == null ? null : clientIdExtra.toString();
                         if (!StringUtils.equalsAny(clientId, headerCid, paramCid)) {
                             // token 无效
                             throw NotLoginException.newInstance(StpUtil.getLoginType(),

backend/ruoyi-common/ruoyi-common-sse/src/main/java/org/dromara/common/sse/controller/SseController.java

@@ -6,7 +6,6 @@ import lombok.RequiredArgsConstructor;
 import org.dromara.common.core.domain.R;
 import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.common.sse.core.SseEmitterManager;
-import org.dromara.common.sse.dto.SseMessageDto;
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.MediaType;
@@ -14,7 +13,6 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
 
-import java.util.List;
 
 /**
  * SSE 控制器
@@ -51,32 +49,6 @@ public class SseController implements DisposableBean {
         return R.ok();
     }
 
-    /**
-     * 向特定用户发送消息
-     *
-     * @param userId 目标用户的 ID
-     * @param msg    要发送的消息内容
-     */
-    @GetMapping(value = "${sse.path}/send")
-    public R<Void> send(Long userId, String msg) {
-        SseMessageDto dto = new SseMessageDto();
-        dto.setUserIds(List.of(userId));
-        dto.setMessage(msg);
-        sseEmitterManager.publishMessage(dto);
-        return R.ok();
-    }
-
-    /**
-     * 向所有用户发送消息
-     *
-     * @param msg 要发送的消息内容
-     */
-    @GetMapping(value = "${sse.path}/sendAll")
-    public R<Void> send(String msg) {
-        sseEmitterManager.publishAll(msg);
-        return R.ok();
-    }
-
     /**
      * 清理资源。此方法目前不执行任何操作，但避免因未实现而导致错误
      */

backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/handle/PlusTenantLineHandler.java

@@ -31,7 +31,8 @@ public class PlusTenantLineHandler implements TenantLineHandler {
             log.error("无法获取有效的租户id -> Null");
             return new NullValue();
         }
-        // 返回固定租户
+        // sink 白名单：非法租户ID绝不拼进 SQL（防 SQL 注入）
+        TenantHelper.checkTenantIdFormat(tenantId);
         return new StringValue(tenantId);
     }
 

backend/ruoyi-common/ruoyi-common-tenant/src/main/java/org/dromara/common/tenant/helper/TenantHelper.java

@@ -16,9 +16,11 @@ import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.core.utils.reflect.ReflectUtils;
 import org.dromara.common.redis.utils.RedisUtils;
 import org.dromara.common.satoken.utils.LoginHelper;
+import org.dromara.common.tenant.exception.TenantException;
 
 import java.util.Stack;
 import java.util.function.Supplier;
+import java.util.regex.Pattern;
 
 /**
  * 租户助手
@@ -35,6 +37,12 @@ public class TenantHelper {
 
     private static final ThreadLocal<Stack<Integer>> REENTRANT_IGNORE = ThreadLocal.withInitial(Stack::new);
 
+    /**
+     * 租户ID格式白名单：仅允许纯数字（与系统生成的 6 位租户编号及默认租户 000000 一致）
+     * 防止外部传入的 tenantId 被拼进 SQL 字面量导致注入
+     */
+    private static final Pattern TENANT_ID_PATTERN = Pattern.compile("^[0-9]{1,20}$");
+
     /**
      * 租户功能是否启用
      */
@@ -42,6 +50,30 @@ public class TenantHelper {
         return Convert.toBool(SpringUtils.getProperty("tenant.enable"), false);
     }
 
+    /**
+     * 校验租户ID格式是否合法（白名单）
+     *
+     * @param tenantId 租户ID
+     * @return true 合法
+     */
+    public static boolean isValidTenantId(String tenantId) {
+        return StringUtils.isNotBlank(tenantId) && TENANT_ID_PATTERN.matcher(tenantId).matches();
+    }
+
+    /**
+     * 校验租户ID格式，非法则抛出异常（fail-closed，不降级继续拼 SQL）
+     *
+     * @param tenantId 租户ID
+     */
+    public static void checkTenantIdFormat(String tenantId) {
+        if (!isValidTenantId(tenantId)) {
+            String safe = tenantId == null ? "null"
+                : tenantId.length() > 64 ? tenantId.substring(0, 64) + "..." : tenantId;
+            log.error("租户ID格式非法，已阻断: [{}]", safe);
+            throw new TenantException("tenant.id.invalid");
+        }
+    }
+
     private static IgnoreStrategy getIgnoreStrategy() {
         Object ignoreStrategyLocal = ReflectUtils.getStaticFieldValue(ReflectUtils.getField(InterceptorIgnoreHelper.class, "IGNORE_STRATEGY_LOCAL"));
         if (ignoreStrategyLocal instanceof ThreadLocal<?> IGNORE_STRATEGY_LOCAL) {
@@ -128,6 +160,10 @@ public class TenantHelper {
      * @param global   是否全局生效
      */
     public static void setDynamic(String tenantId, boolean global) {
+        // 传入非空时一律先校验格式，避免租户开关关闭时仍把脏数据带入后续逻辑
+        if (StringUtils.isNotBlank(tenantId)) {
+            checkTenantIdFormat(tenantId);
+        }
         if (!isEnable()) {
             return;
         }

backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/ResourcesConfig.java

@@ -36,7 +36,7 @@ public class ResourcesConfig implements WebMvcConfigurer {
     public CorsFilter corsFilter() {
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
-        // 设置访问源地址
+        // 设置访问源地址（恢复为原通配，避免生产域名/IP 不匹配导致整站接口被浏览器拦截）
         config.addAllowedOriginPattern("*");
         // 设置访问源请求头
         config.addAllowedHeader("*");

backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/handler/GlobalExceptionHandler.java

@@ -37,6 +37,30 @@ import java.io.IOException;
 @RestControllerAdvice
 public class GlobalExceptionHandler {
 
+    private static final String DEFAULT_ERROR_MESSAGE = "系统繁忙，请稍后重试或联系管理员";
+
+    private static final String[] TECHNICAL_MARKERS = {
+        "###", "sql", "jdbc", "exception", "java.", "javax.", "jakarta.", "org.", "com.", "mapper",
+        "select ", "insert ", "update ", "delete ", " from ", " where ", "table", "column", "syntax",
+        "\tat ", "nested", "cause:", "null"
+    };
+
+    /**
+     * 仅返回业务提示类异常信息，包含 SQL、类名、堆栈等技术细节的信息统一替换为通用提示，避免泄露系统内部结构
+     */
+    public static String safeMessage(String message) {
+        if (message == null || message.isBlank() || message.length() > 300) {
+            return DEFAULT_ERROR_MESSAGE;
+        }
+        String lower = message.toLowerCase();
+        for (String marker : TECHNICAL_MARKERS) {
+            if (lower.contains(marker)) {
+                return DEFAULT_ERROR_MESSAGE;
+            }
+        }
+        return message;
+    }
+
     /**
      * 请求方式不支持
      */
@@ -55,7 +79,8 @@ public class GlobalExceptionHandler {
     public R<Void> handleServiceException(ServiceException e, HttpServletRequest request) {
         log.error(e.getMessage());
         Integer code = e.getCode();
-        return ObjectUtil.isNotNull(code) ? R.fail(code, e.getMessage()) : R.fail(e.getMessage());
+        String message = safeMessage(e.getMessage());
+        return ObjectUtil.isNotNull(code) ? R.fail(code, message) : R.fail(message);
     }
 
     /**
@@ -76,7 +101,7 @@ public class GlobalExceptionHandler {
     public R<Void> handleServletException(ServletException e, HttpServletRequest request) {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',发生未知异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        return R.fail(DEFAULT_ERROR_MESSAGE);
     }
 
     /**
@@ -85,7 +110,7 @@ public class GlobalExceptionHandler {
     @ExceptionHandler(BaseException.class)
     public R<Void> handleBaseException(BaseException e, HttpServletRequest request) {
         log.error(e.getMessage());
-        return R.fail(e.getMessage());
+        return R.fail(safeMessage(e.getMessage()));
     }
 
     /**
@@ -105,7 +130,7 @@ public class GlobalExceptionHandler {
     public R<Void> handleMethodArgumentTypeMismatchException(MethodArgumentTypeMismatchException e, HttpServletRequest request) {
         String requestURI = request.getRequestURI();
         log.error("请求参数类型不匹配'{}',发生系统异常.", requestURI);
-        return R.fail(String.format("请求参数类型不匹配，参数[%s]要求类型为：'%s'，但输入值为：'%s'", e.getName(), e.getRequiredType().getName(), e.getValue()));
+        return R.fail(String.format("请求参数类型不匹配，参数[%s]格式错误", e.getName()));
     }
 
     /**
@@ -139,7 +164,7 @@ public class GlobalExceptionHandler {
     public R<Void> handleRuntimeException(RuntimeException e, HttpServletRequest request) {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',发生未知异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        return R.fail(safeMessage(e.getMessage()));
     }
 
     /**
@@ -149,7 +174,7 @@ public class GlobalExceptionHandler {
     public R<Void> handleException(Exception e, HttpServletRequest request) {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}',发生系统异常.", requestURI, e);
-        return R.fail(e.getMessage());
+        return R.fail(DEFAULT_ERROR_MESSAGE);
     }
 
     /**
@@ -190,7 +215,7 @@ public class GlobalExceptionHandler {
     public R<Void> handleJsonParseException(JsonParseException e, HttpServletRequest request) {
         String requestURI = request.getRequestURI();
         log.error("请求地址'{}' 发生 JSON 解析异常: {}", requestURI, e.getMessage());
-        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求数据格式错误（JSON 解析失败）：" + e.getMessage());
+        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求数据格式错误（JSON 解析失败）");
     }
 
     /**
@@ -199,7 +224,7 @@ public class GlobalExceptionHandler {
     @ExceptionHandler(HttpMessageNotReadableException.class)
     public R<Void> handleHttpMessageNotReadableException(HttpMessageNotReadableException e, HttpServletRequest request) {
         log.error("请求地址'{}', 参数解析失败: {}", request.getRequestURI(), e.getMessage());
-        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求参数格式错误：" + e.getMostSpecificCause().getMessage());
+        return R.fail(HttpStatus.HTTP_BAD_REQUEST, "请求参数格式错误");
     }
 
 }

backend/ruoyi-extend/ruoyi-monitor-admin/src/main/resources/application-prod-local.yml

@@ -21,22 +21,25 @@ spring:
         title: RuoYi-Vue-Plus服务监控中心
       context-path: /admin
 
---- # Actuator 监控端点的配置项
+--- # Actuator 全关（不使用）
 management:
   endpoints:
+    enabled-by-default: false
     web:
       exposure:
-        include: '*'
+        include: ""
   endpoint:
     health:
-      show-details: ALWAYS
+      enabled: false
+    heapdump:
+      enabled: false
     logfile:
       external-file: ./logs/ruoyi-monitor-admin.log
 
 --- # 监控配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   # 设置 Spring Boot Admin Server 地址
   url: http://47.121.125.41:9090/admin
   instance:

backend/ruoyi-extend/ruoyi-monitor-admin/src/main/resources/application-prod.yml

@@ -23,22 +23,25 @@ spring:
       # 配置公网访问地址，确保重定向和静态资源路径包含正确的端口号
       # public-url: http://web.hzdyjsxy.cn:18081/admin
 
---- # Actuator 监控端点的配置项
+--- # Actuator 全关（不使用）
 management:
   endpoints:
+    enabled-by-default: false
     web:
       exposure:
-        include: '*'
+        include: ""
   endpoint:
     health:
-      show-details: ALWAYS
+      enabled: false
+    heapdump:
+      enabled: false
     logfile:
       external-file: ./logs/ruoyi-monitor-admin.log
 
 --- # 监控配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   # 设置 Spring Boot Admin Server 地址
   url: http://172.16.0.67:9090/admin
   instance:

backend/ruoyi-extend/ruoyi-monitor-admin/src/main/resources/application.yml

@@ -21,22 +21,25 @@ spring:
         title: RuoYi-Vue-Plus服务监控中心
       context-path: /admin
 
---- # Actuator 监控端点的配置项
+--- # Actuator 全关（不使用）
 management:
   endpoints:
+    enabled-by-default: false
     web:
       exposure:
-        include: '*'
+        include: ""
   endpoint:
     health:
-      show-details: ALWAYS
+      enabled: false
+    heapdump:
+      enabled: false
     logfile:
       external-file: ./logs/ruoyi-monitor-admin.log
 
 --- # 监控配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   # 设置 Spring Boot Admin Server 地址
   url: http://127.0.0.1:9090/admin
   instance:

backend/ruoyi-extend/ruoyi-snailjob-server/src/main/resources/application-dev.yml

@@ -3,8 +3,8 @@ spring:
     type: com.zaxxer.hikari.HikariDataSource
     driver-class-name: com.mysql.cj.jdbc.Driver
     url: jdbc:mysql://47.99.164.66:3306/hzdyjs_xg?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-    username: root
-    password: hn02le.34lkdLKD
+    username: hzdyjs_app
+    password: Hzdyjs@App#n4SQi8AfPHldNj49
     hikari:
       connection-timeout: 30000
       validation-timeout: 5000
@@ -29,7 +29,7 @@ snail-job:
 --- # 监控中心配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://localhost:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-extend/ruoyi-snailjob-server/src/main/resources/application-prod-local.yml

@@ -3,8 +3,8 @@ spring:
     type: com.zaxxer.hikari.HikariDataSource
     driver-class-name: com.mysql.cj.jdbc.Driver
     url: jdbc:mysql://47.99.164.66:3306/hzdyjs_xg?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-    username: root
-    password: hn02le.34lkdLKD
+    username: hzdyjs_app
+    password: Hzdyjs@App#n4SQi8AfPHldNj49
     hikari:
       connection-timeout: 30000
       validation-timeout: 5000
@@ -29,7 +29,7 @@ snail-job:
 --- # 监控中心配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://47.121.125.41:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-extend/ruoyi-snailjob-server/src/main/resources/application-prod.yml

@@ -3,8 +3,8 @@ spring:
     type: com.zaxxer.hikari.HikariDataSource
     driver-class-name: com.mysql.cj.jdbc.Driver
     url: jdbc:mysql://172.16.0.67:3306/hzdyjs_xg?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-    username: root
-    password: Hzdyjs@Root@123456
+    username: hzdyjs_app
+    password: Hzdyjs@App#n4SQi8AfPHldNj49
     hikari:
       connection-timeout: 30000
       validation-timeout: 5000
@@ -29,7 +29,7 @@ snail-job:
 --- # 监控中心配置
 spring.boot.admin.client:
   # 增加客户端开关
-  enabled: true
+  enabled: false
   url: http://172.16.0.67:9090/admin
   instance:
     service-host-type: IP

backend/ruoyi-extend/ruoyi-snailjob-server/src/main/resources/application.yml

@@ -29,11 +29,14 @@ logging:
 
 management:
   endpoints:
+    enabled-by-default: false
     web:
       exposure:
-        include: '*'
+        include: ""
   endpoint:
     health:
-      show-details: ALWAYS
+      enabled: false
+    heapdump:
+      enabled: false
     logfile:
       external-file: ./logs/ruoyi-snailjob-server/console.log

backend/ruoyi-modules/ruoyi-aqbw/pom.xml

@@ -92,11 +92,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再依赖 -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-modules/ruoyi-bzrkh/pom.xml

@@ -92,11 +92,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再依赖 -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/AssessmentApprovalController.java

@@ -42,7 +42,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 查询班主任考核审核列表
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:list")
+    @SaCheckPermission("bzrkh:assessmentApproval:list")
     @GetMapping("/list")
     public TableDataInfo<AssessmentApprovalVo> list(AssessmentApprovalQueryBo bo, PageQuery pageQuery) {
         return assessmentApprovalService.queryPageList(bo, pageQuery);
@@ -51,12 +51,12 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 获取考核审核详情
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:query")
+    @SaCheckPermission("bzrkh:assessmentApproval:query")
     @GetMapping("/detail")
     public R<AssessmentApprovalDetailVo> getApprovalDetail(
-            @RequestParam @NotNull(message = "计划ID不能为空") Long planId,
-            @RequestParam @NotNull(message = "班级ID不能为空") Long classId,
-            @RequestParam @NotNull(message = "被评价用户ID不能为空") Long evaluatedUserId) {
+            @RequestParam("planId") @NotNull(message = "计划ID不能为空") Long planId,
+            @RequestParam("classId") @NotNull(message = "班级ID不能为空") Long classId,
+            @RequestParam("evaluatedUserId") @NotNull(message = "被评价用户ID不能为空") Long evaluatedUserId) {
         AssessmentApprovalDetailVo detail = assessmentApprovalService.getApprovalDetail(planId, classId,
                 evaluatedUserId);
         return R.ok(detail);
@@ -65,7 +65,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 提交考核审核
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:approve")
+    @SaCheckPermission("bzrkh:assessmentApproval:approve")
     @Log(title = "班主任考核审核", businessType = BusinessType.UPDATE)
     @PostMapping("/submit")
     public R<Void> submitApproval(@RequestBody @Validated AssessmentApprovalSubmitBo bo) {
@@ -77,7 +77,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 批量审核通过
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:approve")
+    @SaCheckPermission("bzrkh:assessmentApproval:approve")
     @Log(title = "班主任考核审核", businessType = BusinessType.UPDATE)
     @PostMapping("/batchApprove")
     public R<Void> batchApprove(@RequestBody BatchApprovalBo bo) {
@@ -89,7 +89,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 批量审核拒绝
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:approve")
+    @SaCheckPermission("bzrkh:assessmentApproval:approve")
     @Log(title = "班主任考核审核", businessType = BusinessType.UPDATE)
     @PostMapping("/batchReject")
     public R<Void> batchReject(@Validated @RequestBody BatchApprovalBo bo) {
@@ -102,10 +102,10 @@ public class AssessmentApprovalController extends BaseController {
      * 删除异常的审批记录（管理员专用）
      * 用于清理审批列表中显示但实际已被删除的异常数据
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:delete")
+    @SaCheckPermission("bzrkh:assessmentApproval:delete")
     @Log(title = "班主任考核审核", businessType = BusinessType.DELETE)
     @DeleteMapping("/deleteAbnormalRecord")
-    public R<Void> deleteAbnormalRecord(@RequestParam Long planId, @RequestParam Long evaluatedUserId) {
+    public R<Void> deleteAbnormalRecord(@RequestParam("planId") Long planId, @RequestParam("evaluatedUserId") Long evaluatedUserId) {
         boolean result = assessmentApprovalService.deleteAbnormalRecord(planId, evaluatedUserId);
         return result ? R.ok() : R.fail("删除异常记录失败");
     }
@@ -113,7 +113,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 获取考核方案下拉选项
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:list")
+    @SaCheckPermission("bzrkh:assessmentApproval:list")
     @GetMapping("/schemeOptions")
     public R<List<SchemeOptionVo>> getSchemeOptions() {
         List<SchemeOptionVo> options = assessmentApprovalService.getSchemeOptions();
@@ -123,7 +123,7 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 导出班主任考核审核数据
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:export")
+    @SaCheckPermission("bzrkh:assessmentApproval:export")
     @Log(title = "班主任考核审核", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(AssessmentApprovalQueryBo bo, HttpServletResponse response) {
@@ -134,9 +134,9 @@ public class AssessmentApprovalController extends BaseController {
     /**
      * 获取评价等级统计数据
      */
-    // @SaCheckPermission("bzrkh:assessmentApproval:query")
+    @SaCheckPermission("bzrkh:assessmentApproval:query")
     @GetMapping("/evaluationStats")
-    public R<EvaluationLevelStatsVo> getEvaluationLevelStats(@RequestParam @NotNull(message = "计划ID不能为空") Long planId) {
+    public R<EvaluationLevelStatsVo> getEvaluationLevelStats(@RequestParam("planId") @NotNull(message = "计划ID不能为空") Long planId) {
         EvaluationLevelStatsVo stats = assessmentApprovalService.getEvaluationLevelStats(planId);
         return R.ok(stats);
     }

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/BmzrAssessmentIndicatorController.java

@@ -39,7 +39,7 @@ public class BmzrAssessmentIndicatorController extends BaseController {
     /**
      * 查询班主任考核指标体系列表
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:list")
+    @SaCheckPermission("bzrkh:assessmentIndicator:list")
     @GetMapping("/list")
     public TableDataInfo<BmzrAssessmentIndicatorVo> list(BmzrAssessmentIndicatorBo bo, PageQuery pageQuery) {
         return bmzrAssessmentIndicatorService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class BmzrAssessmentIndicatorController extends BaseController {
     /**
      * 查询班主任考核指标体系树形结构（用于父级选择）
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:list")
+    @SaCheckPermission("bzrkh:assessmentIndicator:list")
     @GetMapping("/treeselect")
     public R<List<BmzrAssessmentIndicatorVo>> treeselect(BmzrAssessmentIndicatorBo bo) {
         List<BmzrAssessmentIndicatorVo> list = bmzrAssessmentIndicatorService.queryTreeList(bo);
@@ -58,7 +58,7 @@ public class BmzrAssessmentIndicatorController extends BaseController {
     /**
      * 导出班主任考核指标体系列表
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:export")
+    @SaCheckPermission("bzrkh:assessmentIndicator:export")
     @Log(title = "班主任考核指标体系", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(BmzrAssessmentIndicatorBo bo, HttpServletResponse response) {
@@ -71,16 +71,16 @@ public class BmzrAssessmentIndicatorController extends BaseController {
      *
      * @param id 主键
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:query")
+    @SaCheckPermission("bzrkh:assessmentIndicator:query")
     @GetMapping("/{id}")
-    public R<BmzrAssessmentIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<BmzrAssessmentIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(bmzrAssessmentIndicatorService.queryById(id));
     }
 
     /**
      * 新增班主任考核指标体系
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:add")
+    @SaCheckPermission("bzrkh:assessmentIndicator:add")
     @Log(title = "班主任考核指标体系", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -91,7 +91,7 @@ public class BmzrAssessmentIndicatorController extends BaseController {
     /**
      * 修改班主任考核指标体系
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:edit")
+    @SaCheckPermission("bzrkh:assessmentIndicator:edit")
     @Log(title = "班主任考核指标体系", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -104,10 +104,10 @@ public class BmzrAssessmentIndicatorController extends BaseController {
      *
      * @param ids 主键串
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicator:remove")
+    @SaCheckPermission("bzrkh:assessmentIndicator:remove")
     @Log(title = "班主任考核指标体系", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(bmzrAssessmentIndicatorService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/BmzrAssessmentIndicatorTypeController.java

@@ -39,7 +39,7 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
     /**
      * 查询班主任考核指标类型列表
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:list")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:list")
     @GetMapping("/list")
     public TableDataInfo<BmzrAssessmentIndicatorTypeVo> list(BmzrAssessmentIndicatorTypeBo bo, PageQuery pageQuery) {
         return bmzrAssessmentIndicatorTypeService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
     /**
      * 查询所有班主任考核指标类型列表(包括已逻辑删除的)
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:list")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:list")
     @GetMapping("/listAllIncludeDeleted")
     public R<List<BmzrAssessmentIndicatorTypeVo>> listAllIncludeDeleted(BmzrAssessmentIndicatorTypeBo bo) {
         List<BmzrAssessmentIndicatorTypeVo> list = bmzrAssessmentIndicatorTypeService.queryListWithDeleted(bo);
@@ -58,7 +58,7 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
     /**
      * 导出班主任考核指标类型列表
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:export")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:export")
     @Log(title = "班主任考核指标类型", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(BmzrAssessmentIndicatorTypeBo bo, HttpServletResponse response) {
@@ -71,16 +71,16 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
      *
      * @param id 主键
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:query")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:query")
     @GetMapping("/{id}")
-    public R<BmzrAssessmentIndicatorTypeVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<BmzrAssessmentIndicatorTypeVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(bmzrAssessmentIndicatorTypeService.queryById(id));
     }
 
     /**
      * 新增班主任考核指标类型
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:add")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:add")
     @Log(title = "班主任考核指标类型", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -91,7 +91,7 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
     /**
      * 修改班主任考核指标类型
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:edit")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:edit")
     @Log(title = "班主任考核指标类型", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -104,10 +104,10 @@ public class BmzrAssessmentIndicatorTypeController extends BaseController {
      *
      * @param ids 主键串
      */
-    // @SaCheckPermission("bzrkh:assessmentIndicatorType:remove")
+    @SaCheckPermission("bzrkh:assessmentIndicatorType:remove")
     @Log(title = "班主任考核指标类型", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(bmzrAssessmentIndicatorTypeService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/BmzrAssessmentPlanController.java

@@ -39,7 +39,7 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 查询班主任考核计划列表
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:list")
+    @SaCheckPermission("bzrkh:assessmentPlan:list")
     @GetMapping("/list")
     public TableDataInfo<BmzrAssessmentPlanVo> list(BmzrAssessmentPlanBo bo, PageQuery pageQuery) {
         return bmzrAssessmentPlanService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 导出班主任考核计划列表
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:export")
+    @SaCheckPermission("bzrkh:assessmentPlan:export")
     @Log(title = "班主任考核计划", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(BmzrAssessmentPlanBo bo, HttpServletResponse response) {
@@ -59,16 +59,16 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 获取班主任考核计划详细信息
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:query")
+    @SaCheckPermission("bzrkh:assessmentPlan:query")
     @GetMapping("/{id}")
-    public R<BmzrAssessmentPlanVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<BmzrAssessmentPlanVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(bmzrAssessmentPlanService.queryById(id));
     }
 
     /**
      * 新增班主任考核计划
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:add")
+    @SaCheckPermission("bzrkh:assessmentPlan:add")
     @Log(title = "班主任考核计划", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -79,7 +79,7 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 修改班主任考核计划
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:edit")
+    @SaCheckPermission("bzrkh:assessmentPlan:edit")
     @Log(title = "班主任考核计划", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -90,17 +90,17 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 删除班主任考核计划
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:remove")
+    @SaCheckPermission("bzrkh:assessmentPlan:remove")
     @Log(title = "班主任考核计划", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(bmzrAssessmentPlanService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 修改考核计划状态
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:edit")
+    @SaCheckPermission("bzrkh:assessmentPlan:edit")
     @Log(title = "班主任考核计划", businessType = BusinessType.UPDATE)
     @PutMapping("/changeStatus")
     public R<Void> changeStatus(@RequestBody BmzrAssessmentPlanBo bo) {
@@ -110,7 +110,7 @@ public class BmzrAssessmentPlanController extends BaseController {
     /**
      * 获取可用的考核方案选项
      */
-    // @SaCheckPermission("bzrkh:assessmentPlan:list")
+    @SaCheckPermission("bzrkh:assessmentPlan:list")
     @GetMapping("/schemes/options")
     public R<List<BmzrAssessmentPlanVo>> getAvailableSchemes() {
         return R.ok(bmzrAssessmentPlanService.getAvailableSchemes());

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/BmzrAssessmentSchemeController.java

@@ -41,7 +41,7 @@ public class BmzrAssessmentSchemeController extends BaseController {
     /**
      * 查询班主任考核方案列表
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:list")
+    @SaCheckPermission("bzrkh:assessmentScheme:list")
     @GetMapping("/list")
     public TableDataInfo<BmzrAssessmentSchemeVo> list(BmzrAssessmentSchemeBo bo, PageQuery pageQuery) {
         return bmzrAssessmentSchemeService.queryPageList(bo, pageQuery);
@@ -50,7 +50,7 @@ public class BmzrAssessmentSchemeController extends BaseController {
     /**
      * 导出班主任考核方案列表
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:export")
+    @SaCheckPermission("bzrkh:assessmentScheme:export")
     @Log(title = "班主任考核方案", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(BmzrAssessmentSchemeBo bo, HttpServletResponse response) {
@@ -63,16 +63,16 @@ public class BmzrAssessmentSchemeController extends BaseController {
      *
      * @param id 主键
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:query")
+    @SaCheckPermission("bzrkh:assessmentScheme:query")
     @GetMapping("/{id}")
-    public R<BmzrAssessmentSchemeVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<BmzrAssessmentSchemeVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(bmzrAssessmentSchemeService.queryById(id));
     }
 
     /**
      * 新增班主任考核方案
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:add")
+    @SaCheckPermission("bzrkh:assessmentScheme:add")
     @Log(title = "班主任考核方案", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping
@@ -83,7 +83,7 @@ public class BmzrAssessmentSchemeController extends BaseController {
     /**
      * 修改班主任考核方案
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:edit")
+    @SaCheckPermission("bzrkh:assessmentScheme:edit")
     @Log(title = "班主任考核方案", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping
@@ -94,10 +94,10 @@ public class BmzrAssessmentSchemeController extends BaseController {
     /**
      * 删除班主任考核方案
      */
-    // @SaCheckPermission("bzrkh:assessmentScheme:remove")
+    @SaCheckPermission("bzrkh:assessmentScheme:remove")
     @Log(title = "班主任考核方案", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(bmzrAssessmentSchemeService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/BmzrAssessmentSchemeIndicatorController.java

@@ -39,7 +39,7 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
     /**
      * 查询班主任考核方案指标关联列表
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:list")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:list")
     @GetMapping("/list")
     public TableDataInfo<BmzrAssessmentSchemeIndicatorVo> list(BmzrAssessmentSchemeIndicatorBo bo,
             PageQuery pageQuery) {
@@ -49,9 +49,9 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
     /**
      * 根据方案ID查询指标关联列表（无分页）
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:list")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:list")
     @GetMapping("/listBySchemeId/{schemeId}")
-    public R<List<BmzrAssessmentSchemeIndicatorVo>> listBySchemeId(@PathVariable Long schemeId) {
+    public R<List<BmzrAssessmentSchemeIndicatorVo>> listBySchemeId(@PathVariable("schemeId") Long schemeId) {
         List<BmzrAssessmentSchemeIndicatorVo> list = bmzrAssessmentSchemeIndicatorService.queryBySchemeId(schemeId);
         return R.ok(list);
     }
@@ -59,7 +59,7 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
     /**
      * 导出班主任考核方案指标关联列表
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:export")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:export")
     @Log(title = "班主任考核方案指标关联", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(BmzrAssessmentSchemeIndicatorBo bo, HttpServletResponse response) {
@@ -72,16 +72,16 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
      *
      * @param id 主键
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:query")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:query")
     @GetMapping("/{id}")
-    public R<BmzrAssessmentSchemeIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<BmzrAssessmentSchemeIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(bmzrAssessmentSchemeIndicatorService.queryById(id));
     }
 
     /**
      * 新增班主任考核方案指标关联
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:add")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:add")
     @Log(title = "班主任考核方案指标关联", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -92,7 +92,7 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
     /**
      * 修改班主任考核方案指标关联
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:edit")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:edit")
     @Log(title = "班主任考核方案指标关联", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -105,10 +105,10 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
      *
      * @param ids 主键串
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:remove")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:remove")
     @Log(title = "班主任考核方案指标关联", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(bmzrAssessmentSchemeIndicatorService.deleteWithValidByIds(List.of(ids), true));
     }
 
@@ -118,11 +118,11 @@ public class BmzrAssessmentSchemeIndicatorController extends BaseController {
      * @param schemeId      方案ID
      * @param indicatorList 指标列表
      */
-    // @SaCheckPermission("bzrkh:assessmentSchemeIndicator:edit")
+    @SaCheckPermission("bzrkh:assessmentSchemeIndicator:edit")
     @Log(title = "批量保存方案指标关联", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/batchSave/{schemeId}")
-    public R<Void> batchSave(@PathVariable Long schemeId,
+    public R<Void> batchSave(@PathVariable("schemeId") Long schemeId,
             @RequestBody List<BmzrAssessmentSchemeIndicatorBo> indicatorList) {
         return toAjax(bmzrAssessmentSchemeIndicatorService.batchSaveSchemeIndicators(schemeId, indicatorList));
     }

backend/ruoyi-modules/ruoyi-bzrkh/src/main/java/org/dromara/bzrkh/controller/TeacherAssessmentController.java

@@ -1,5 +1,6 @@
 package org.dromara.bzrkh.controller;
 
+import org.dromara.common.web.handler.GlobalExceptionHandler;
 import java.math.BigDecimal;
 import java.util.List;
 
@@ -42,9 +43,9 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 查询班主任管理的班级列表
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:list")
+    @SaCheckPermission("bzrkh:teacherAssessment:list")
     @GetMapping("/classes")
-    public R<List<TeacherClassVo>> getTeacherClasses(@RequestParam(required = false) Long teacherId) {
+    public R<List<TeacherClassVo>> getTeacherClasses(@RequestParam(value = "teacherId", required = false) Long teacherId) {
         // 如果没有传入teacherId，则使用当前登录用户ID
         Long currentTeacherId = teacherId != null ? teacherId : LoginHelper.getUserId();
         List<TeacherClassVo> list = teacherAssessmentService.queryTeacherClassList(currentTeacherId);
@@ -54,7 +55,7 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 查询班主任考核计划列表
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:list")
+    @SaCheckPermission("bzrkh:teacherAssessment:list")
     @GetMapping("/plans")
     public TableDataInfo<BmzrAssessmentPlanVo> getTeacherAssessmentPlans(TeacherAssessmentQueryBo bo,
             PageQuery pageQuery) {
@@ -68,7 +69,7 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 提交考核
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:submit")
+    @SaCheckPermission("bzrkh:teacherAssessment:submit")
     @Log(title = "班主任考核管理", businessType = BusinessType.UPDATE)
     @PostMapping("/submit")
     public R<Void> submitAssessment(@RequestBody TeacherAssessmentSubmitRequest request) {
@@ -79,7 +80,7 @@ public class TeacherAssessmentController extends BaseController {
             return toAjax(result);
         } catch (RuntimeException e) {
             // 返回具体的错误信息
-            return R.fail(e.getMessage());
+            return R.fail(GlobalExceptionHandler.safeMessage(e.getMessage()));
         } catch (Exception e) {
             // 记录详细的异常信息
             log.error("提交考核异常", e);
@@ -90,7 +91,7 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 撤销考核提交
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:withdraw")
+    @SaCheckPermission("bzrkh:teacherAssessment:withdraw")
     @Log(title = "班主任考核管理", businessType = BusinessType.UPDATE)
     @PostMapping("/withdraw")
     public R<Void> withdrawAssessment(@RequestBody TeacherAssessmentSubmitRequest request) {
@@ -103,9 +104,9 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 查看考核详情
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:detail")
+    @SaCheckPermission("bzrkh:teacherAssessment:detail")
     @GetMapping("/detail")
-    public R<Object> getAssessmentDetail(@RequestParam Long planId, @RequestParam Long classId) {
+    public R<Object> getAssessmentDetail(@RequestParam("planId") Long planId, @RequestParam("classId") Long classId) {
         Long teacherId = LoginHelper.getUserId();
         Object detail = teacherAssessmentService.getAssessmentDetail(planId, classId, teacherId);
         return R.ok(detail);
@@ -114,9 +115,9 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 获取考核提交详情数据
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:detail")
+    @SaCheckPermission("bzrkh:teacherAssessment:detail")
     @GetMapping("/submitDetail")
-    public R<AssessmentDetailVo> getAssessmentSubmitDetail(@RequestParam Long planId, @RequestParam Long classId) {
+    public R<AssessmentDetailVo> getAssessmentSubmitDetail(@RequestParam("planId") Long planId, @RequestParam("classId") Long classId) {
         Long teacherId = LoginHelper.getUserId();
         AssessmentDetailVo detail = teacherAssessmentService.getAssessmentSubmitDetail(planId, classId, teacherId);
         return R.ok(detail);
@@ -125,7 +126,7 @@ public class TeacherAssessmentController extends BaseController {
     /**
      * 提交考核评分数据
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:submit")
+    @SaCheckPermission("bzrkh:teacherAssessment:submit")
     @Log(title = "班主任考核管理", businessType = BusinessType.INSERT)
     @PostMapping("/submitScore")
     public R<Void> submitAssessmentScore(@RequestBody AssessmentSubmitBo bo) {
@@ -135,7 +136,7 @@ public class TeacherAssessmentController extends BaseController {
             return toAjax(result);
         } catch (RuntimeException e) {
             // 返回具体的错误信息
-            return R.fail(e.getMessage());
+            return R.fail(GlobalExceptionHandler.safeMessage(e.getMessage()));
         } catch (Exception e) {
             // 记录详细的异常信息
             log.error("提交考核评分数据异常", e);
@@ -143,22 +144,12 @@ public class TeacherAssessmentController extends BaseController {
         }
     }
 
-    /**
-     * 测试人数系数计算（临时调试接口）
-     * 用于验证特定人数的系数计算是否正确
-     */
-    @GetMapping("/testCoefficient")
-    public R<Object> testStudentCountCoefficient(@RequestParam int studentCount) {
-        BigDecimal coefficient = teacherAssessmentService.testStudentCountCoefficient(studentCount);
-        return R.ok("学生人数: " + studentCount + ", 计算系数: " + coefficient);
-    }
-
     /**
      * 查询班级学生违纪记录和奖励记录
      */
-    // @SaCheckPermission("bzrkh:teacherAssessment:detail")
+    @SaCheckPermission("bzrkh:teacherAssessment:detail")
     @GetMapping("/classStudentRecords")
-    public R<ClassStudentRecordsVo> getClassStudentRecords(@RequestParam Long classId, @RequestParam Long planId) {
+    public R<ClassStudentRecordsVo> getClassStudentRecords(@RequestParam("classId") Long classId, @RequestParam("planId") Long planId) {
         ClassStudentRecordsVo records = teacherAssessmentService.queryClassStudentRecords(classId, planId);
         return R.ok(records);
     }

backend/ruoyi-modules/ruoyi-cw/pom.xml

@@ -92,11 +92,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再依赖 -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwApprovalRecordController.java

@@ -1,5 +1,6 @@
 package org.dromara.cw.controller;
 
+import org.dromara.common.web.handler.GlobalExceptionHandler;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.domain.R;
@@ -44,7 +45,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询审批记录列表
      */
-    // @SaCheckPermission("cw:approval:list")
+    @SaCheckPermission("cw:approval:list")
     @GetMapping("/list")
     public TableDataInfo<CwApprovalRecordVo> list(CwApprovalRecordBo bo, PageQuery pageQuery) {
         return approvalRecordService.queryPageList(bo, pageQuery);
@@ -53,7 +54,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 导出审批记录列表
      */
-    // @SaCheckPermission("cw:approval:export")
+    @SaCheckPermission("cw:approval:export")
     @Log(title = "审批记录", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwApprovalRecordBo bo, HttpServletResponse response) {
@@ -64,18 +65,18 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 获取审批记录详细信息
      */
-    // @SaCheckPermission("cw:approval:query")
+    @SaCheckPermission("cw:approval:query")
     @GetMapping("/{id}")
-    public R<CwApprovalRecordVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwApprovalRecordVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(approvalRecordService.queryById(id));
     }
 
     /**
      * 根据申报ID查询审批记录列表
      */
-    // @SaCheckPermission("cw:approval:query")
+    @SaCheckPermission("cw:approval:query")
     @GetMapping("/byApplication/{applicationId}")
-    public R<List<CwApprovalRecordVo>> getByApplicationId(@PathVariable Long applicationId) {
+    public R<List<CwApprovalRecordVo>> getByApplicationId(@PathVariable("applicationId") Long applicationId) {
         List<CwApprovalRecordVo> list = approvalRecordService.queryByApplicationId(applicationId);
         return R.ok(list);
     }
@@ -83,7 +84,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询当前用户待审批记录列表
      */
-    // @SaCheckPermission("cw:approval:list")
+    @SaCheckPermission("cw:approval:list")
     @GetMapping("/pending")
     public R<List<CwApprovalRecordVo>> getPendingList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryPendingByCurrentUser();
@@ -93,7 +94,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询当前用户已审批记录列表
      */
-    // @SaCheckPermission("cw:approval:list")
+    @SaCheckPermission("cw:approval:list")
     @GetMapping("/my")
     public R<List<CwApprovalRecordVo>> getMyApprovedList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryApprovedByCurrentUser();
@@ -103,7 +104,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询部门待审批申报列表
      */
-    // @SaCheckPermission("cw:approval:dept")
+    @SaCheckPermission("cw:approval:dept")
     @GetMapping("/dept/pending")
     public R<List<CwApprovalRecordVo>> getDeptPendingList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryDeptPendingApprovals();
@@ -113,7 +114,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询财务待审批申报列表
      */
-    // @SaCheckPermission("cw:approval:finance")
+    @SaCheckPermission("cw:approval:finance")
     @GetMapping("/finance/pending")
     public R<List<CwApprovalRecordVo>> getFinancePendingList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryFinancePendingApprovals();
@@ -123,7 +124,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询财务已审批申报列表
      */
-    // @SaCheckPermission("cw:approval:finance")
+    @SaCheckPermission("cw:approval:finance")
     @GetMapping("/finance/approved")
     public R<List<CwApprovalRecordVo>> getFinanceApprovedList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryFinanceApprovedRecords();
@@ -133,7 +134,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询学院领导待审批申报列表
      */
-    // @SaCheckPermission("cw:approval:leader")
+    @SaCheckPermission("cw:approval:leader")
     @GetMapping("/leader/pending")
     public R<List<CwApprovalRecordVo>> getLeaderPendingList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryLeaderPendingApprovals();
@@ -143,7 +144,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询学院领导已审批申报列表
      */
-    // @SaCheckPermission("cw:approval:leader")
+    @SaCheckPermission("cw:approval:leader")
     @GetMapping("/leader/approved")
     public R<List<CwApprovalRecordVo>> getLeaderApprovedList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryLeaderApprovedApprovals();
@@ -153,7 +154,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 查询所有待审批申报列表（超级管理员专用）
      */
-    // @SaCheckPermission("cw:approval:list")
+    @SaCheckPermission("cw:approval:list")
     @GetMapping("/all/pending")
     public R<List<CwApprovalRecordVo>> getAllPendingList() {
         List<CwApprovalRecordVo> list = approvalRecordService.queryAllPendingApprovals();
@@ -163,7 +164,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 新增审批记录
      */
-    // @SaCheckPermission("cw:approval:add")
+    @SaCheckPermission("cw:approval:add")
     @Log(title = "审批记录", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -174,7 +175,7 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 修改审批记录
      */
-    // @SaCheckPermission("cw:approval:edit")
+    @SaCheckPermission("cw:approval:edit")
     @Log(title = "审批记录", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -185,20 +186,20 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 删除审批记录
      */
-    // @SaCheckPermission("cw:approval:remove")
+    @SaCheckPermission("cw:approval:remove")
     @Log(title = "审批记录", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(approvalRecordService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 创建审批流程
      */
-    // @SaCheckPermission("cw:approval:create")
+    @SaCheckPermission("cw:approval:create")
     @Log(title = "创建审批流程", businessType = BusinessType.INSERT)
     @PostMapping("/create/{applicationId}")
-    public R<Void> createProcess(@PathVariable Long applicationId, @RequestParam String applicationNo) {
+    public R<Void> createProcess(@PathVariable("applicationId") Long applicationId, @RequestParam("applicationNo") String applicationNo) {
         // 收集当前用户上下文信息
         Long currentUserId = LoginHelper.getUserId();
         String currentUserName = LoginHelper.getUsername();
@@ -213,36 +214,36 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 审批操作
      */
-    // @SaCheckPermission("cw:approval:process")
+    @SaCheckPermission("cw:approval:process")
     @Log(title = "审批操作", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/process")
-    public R<Void> processApproval(@RequestParam Long applicationId,
-            @RequestParam String nodeCode,
-            @RequestParam String approveAction,
-            @RequestParam(required = false) String approveOpinion) {
+    public R<Void> processApproval(@RequestParam("applicationId") Long applicationId,
+            @RequestParam("nodeCode") String nodeCode,
+            @RequestParam("approveAction") String approveAction,
+            @RequestParam(value = "approveOpinion", required = false) String approveOpinion) {
         return toAjax(approvalRecordService.processApproval(applicationId, nodeCode, approveAction, approveOpinion));
     }
 
     /**
      * 部门审批
      */
-    // @SaCheckPermission("cw:approval:dept")
+    @SaCheckPermission("cw:approval:dept")
     @Log(title = "部门审批", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/dept")
-    public R<Void> deptApprove(@RequestParam Long applicationId,
-            @RequestParam String approveAction,
-            @RequestParam(required = false) String approveOpinion) {
+    public R<Void> deptApprove(@RequestParam("applicationId") Long applicationId,
+            @RequestParam("approveAction") String approveAction,
+            @RequestParam(value = "approveOpinion", required = false) String approveOpinion) {
         return toAjax(approvalRecordService.deptApprove(applicationId, approveAction, approveOpinion));
     }
 
     /**
      * 查询当前审批节点
      */
-    // @SaCheckPermission("cw:approval:query")
+    @SaCheckPermission("cw:approval:query")
     @GetMapping("/current/{applicationId}")
-    public R<CwApprovalRecordVo> getCurrentNode(@PathVariable Long applicationId) {
+    public R<CwApprovalRecordVo> getCurrentNode(@PathVariable("applicationId") Long applicationId) {
         CwApprovalRecordVo record = approvalRecordService.queryCurrentApprovalNode(applicationId);
         return R.ok(record);
     }
@@ -250,9 +251,9 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 检查审批权限
      */
-    // @SaCheckPermission("cw:approval:check")
+    @SaCheckPermission("cw:approval:check")
     @GetMapping("/check/{applicationId}")
-    public R<Boolean> checkPermission(@PathVariable Long applicationId, @RequestParam String nodeCode) {
+    public R<Boolean> checkPermission(@PathVariable("applicationId") Long applicationId, @RequestParam("nodeCode") String nodeCode) {
         Boolean hasPermission = approvalRecordService.checkApprovalPermission(applicationId, nodeCode);
         return R.ok(hasPermission);
     }
@@ -260,9 +261,9 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 检查部门审批权限
      */
-    // @SaCheckPermission("cw:approval:dept")
+    @SaCheckPermission("cw:approval:dept")
     @GetMapping("/check/dept/{applicationId}")
-    public R<Boolean> checkDeptPermission(@PathVariable Long applicationId) {
+    public R<Boolean> checkDeptPermission(@PathVariable("applicationId") Long applicationId) {
         Boolean hasPermission = approvalRecordService.checkDeptApprovalPermission(applicationId);
         return R.ok(hasPermission);
     }
@@ -270,9 +271,9 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 获取可选审批人列表（院领导）
      */
-    // @SaCheckPermission("cw:approval:finance")
+    @SaCheckPermission("cw:approval:finance")
     @GetMapping("/approvers/{applicationId}")
-    public R<List<Map<String, Object>>> getAvailableApprovers(@PathVariable Long applicationId) {
+    public R<List<Map<String, Object>>> getAvailableApprovers(@PathVariable("applicationId") Long applicationId) {
         List<Map<String, Object>> approvers = approvalRecordService.getAvailableApprovers(applicationId);
         return R.ok(approvers);
     }
@@ -280,11 +281,11 @@ public class CwApprovalRecordController extends BaseController {
     /**
      * 分管领导审批
      */
-    // @SaCheckPermission("cw:approval:leader")
+    @SaCheckPermission("cw:approval:leader")
     @PostMapping("/leader")
-    public R<Void> leaderApproval(@RequestParam Long applicationId,
-            @RequestParam String approveAction,
-            @RequestParam String approveOpinion) {
+    public R<Void> leaderApproval(@RequestParam("applicationId") Long applicationId,
+            @RequestParam("approveAction") String approveAction,
+            @RequestParam("approveOpinion") String approveOpinion) {
         log.info("🔍 分管领导审批：applicationId={}, approveAction={}, approveOpinion={}",
                 applicationId, approveAction, approveOpinion);
 
@@ -298,19 +299,19 @@ public class CwApprovalRecordController extends BaseController {
             return R.ok();
         } catch (Exception e) {
             log.error("❌ 分管领导审批失败：applicationId={}, error={}", applicationId, e.getMessage(), e);
-            return R.fail("审批失败：" + e.getMessage());
+            return R.fail("审批失败：" + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
     /**
      * 财务审批
      */
-    // @SaCheckPermission("cw:approval:finance")
+    @SaCheckPermission("cw:approval:finance")
     @PostMapping("/finance")
-    public R<Void> financeApproval(@RequestParam Long applicationId,
-            @RequestParam String approveAction,
-            @RequestParam String approveOpinion,
-            @RequestParam(required = false) Long selectedApproverId) {
+    public R<Void> financeApproval(@RequestParam("applicationId") Long applicationId,
+            @RequestParam("approveAction") String approveAction,
+            @RequestParam("approveOpinion") String approveOpinion,
+            @RequestParam(value = "selectedApproverId", required = false) Long selectedApproverId) {
         log.info("🔍 财务审批：applicationId={}, approveAction={}, approveOpinion={}, selectedApproverId={}",
                 applicationId, approveAction, approveOpinion, selectedApproverId);
 
@@ -330,7 +331,7 @@ public class CwApprovalRecordController extends BaseController {
             return R.ok();
         } catch (Exception e) {
             log.error("❌ 财务审批失败：applicationId={}, error={}", applicationId, e.getMessage(), e);
-            return R.fail("审批失败：" + e.getMessage());
+            return R.fail("审批失败：" + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwBudgetExecutionImportController.java

@@ -30,7 +30,7 @@ public class CwBudgetExecutionImportController extends BaseController {
      * @param file 导入文件
      */
     @Log(title = "预算执行导入", businessType = BusinessType.IMPORT)
-    //@SaCheckPermission("cw:budgetExecutionImport:import")
+    @SaCheckPermission("cw:budgetExecutionImport:import")
     @PostMapping(value = "/importData", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     public R<Void> importData(@RequestPart("file") MultipartFile file) throws Exception {
         try (InputStream is = file.getInputStream()) {
@@ -45,7 +45,7 @@ public class CwBudgetExecutionImportController extends BaseController {
     /**
      * 获取导入模板（导出空模板）
      */
-    //@SaCheckPermission("cw:budgetExecutionImport:import")
+    @SaCheckPermission("cw:budgetExecutionImport:import")
     @PostMapping("/importTemplate")
     public void importTemplate(HttpServletResponse response) {
         ExcelUtil.exportExcel(java.util.List.of(), "预算执行导入模板", CwBudgetExecutionImportVo.class, response);
@@ -54,7 +54,7 @@ public class CwBudgetExecutionImportController extends BaseController {
     /**
      * 查询导入批次分页列表
      */
-    //@SaCheckPermission("cw:budgetExecutionImport:list")
+    @SaCheckPermission("cw:budgetExecutionImport:list")
     @GetMapping("/batch/list")
     public org.dromara.common.mybatis.core.page.TableDataInfo<?> batchList(org.dromara.common.mybatis.core.page.PageQuery pageQuery) {
         var service = org.dromara.common.core.utils.SpringUtils.getBean(org.dromara.cw.service.ICwBudgetExecutionImportService.class);
@@ -64,7 +64,7 @@ public class CwBudgetExecutionImportController extends BaseController {
     /**
      * 查询导入明细分页列表
      */
-    //@SaCheckPermission("cw:budgetExecutionImport:list")
+    @SaCheckPermission("cw:budgetExecutionImport:list")
     @GetMapping("/item/list")
     public org.dromara.common.mybatis.core.page.TableDataInfo<?> itemList(@RequestParam("batchId") Long batchId, org.dromara.common.mybatis.core.page.PageQuery pageQuery) {
         var service = org.dromara.common.core.utils.SpringUtils.getBean(org.dromara.cw.service.ICwBudgetExecutionImportService.class);

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwMonitoringManagementController.java

@@ -40,7 +40,7 @@ public class CwMonitoringManagementController extends BaseController {
      * 查询绩效自评列表（运行监控管理）
      * 财务管理员和学校领导可以看到所有人的数据
      */
-    //@SaCheckPermission("cw:monitoringManagement:list")
+    @SaCheckPermission("cw:monitoringManagement:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectPerformanceSelfEvaluationVo> list(CwProjectPerformanceSelfEvaluationBo bo, PageQuery pageQuery) {
         return monitoringManagementService.queryPageList(bo, pageQuery);
@@ -49,38 +49,38 @@ public class CwMonitoringManagementController extends BaseController {
     /**
      * 获取绩效自评详细信息（运行监控管理）
      */
-    //@SaCheckPermission("cw:monitoringManagement:query")
+    @SaCheckPermission("cw:monitoringManagement:query")
     @GetMapping("/{id}")
-    public R<CwProjectPerformanceSelfEvaluationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwProjectPerformanceSelfEvaluationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(monitoringManagementService.queryById(id));
     }
 
     /**
      * 锁定绩效自评（单个）
      */
-    //@SaCheckPermission("cw:monitoringManagement:lock")
+    @SaCheckPermission("cw:monitoringManagement:lock")
     @Log(title = "运行监控管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/lock/{id}")
-    public R<Void> lock(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<Void> lock(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return toAjax(monitoringManagementService.lockEvaluation(id));
     }
 
     /**
      * 解锁绩效自评（单个）
      */
-    //@SaCheckPermission("cw:monitoringManagement:unlock")
+    @SaCheckPermission("cw:monitoringManagement:unlock")
     @Log(title = "运行监控管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/unlock/{id}")
-    public R<Void> unlock(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<Void> unlock(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return toAjax(monitoringManagementService.unlockEvaluation(id));
     }
 
     /**
      * 批量锁定绩效自评
      */
-    //@SaCheckPermission("cw:monitoringManagement:lock")
+    @SaCheckPermission("cw:monitoringManagement:lock")
     @Log(title = "运行监控管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/lock/batch")
@@ -91,7 +91,7 @@ public class CwMonitoringManagementController extends BaseController {
     /**
      * 批量解锁绩效自评
      */
-    //@SaCheckPermission("cw:monitoringManagement:unlock")
+    @SaCheckPermission("cw:monitoringManagement:unlock")
     @Log(title = "运行监控管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/unlock/batch")

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwPerformanceMonitoringController.java

@@ -35,25 +35,25 @@ public class CwPerformanceMonitoringController extends BaseController {
     /**
      * 根据自评ID查询运行监控列表
      */
-    //@SaCheckPermission("cw:performanceMonitoring:query")
+    @SaCheckPermission("cw:performanceMonitoring:query")
     @GetMapping("/list/{evaluationId}")
-    public R<List<CwPerformanceMonitoringVo>> listByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable Long evaluationId) {
+    public R<List<CwPerformanceMonitoringVo>> listByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable("evaluationId") Long evaluationId) {
         return R.ok(performanceMonitoringService.queryByEvaluationId(evaluationId));
     }
 
     /**
      * 获取绩效运行监控详细信息
      */
-    //@SaCheckPermission("cw:performanceMonitoring:query")
+    @SaCheckPermission("cw:performanceMonitoring:query")
     @GetMapping("/{id}")
-    public R<CwPerformanceMonitoringVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwPerformanceMonitoringVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(performanceMonitoringService.queryById(id));
     }
 
     /**
      * 新增绩效运行监控
      */
-    //@SaCheckPermission("cw:performanceMonitoring:add")
+    @SaCheckPermission("cw:performanceMonitoring:add")
     @Log(title = "绩效运行监控", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -64,7 +64,7 @@ public class CwPerformanceMonitoringController extends BaseController {
     /**
      * 修改绩效运行监控
      */
-    //@SaCheckPermission("cw:performanceMonitoring:edit")
+    @SaCheckPermission("cw:performanceMonitoring:edit")
     @Log(title = "绩效运行监控", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -75,10 +75,10 @@ public class CwPerformanceMonitoringController extends BaseController {
     /**
      * 删除绩效运行监控
      */
-    //@SaCheckPermission("cw:performanceMonitoring:remove")
+    @SaCheckPermission("cw:performanceMonitoring:remove")
     @Log(title = "绩效运行监控", businessType = BusinessType.DELETE)
     @DeleteMapping("/{id}")
-    public R<Void> remove(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<Void> remove(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return toAjax(performanceMonitoringService.deleteWithValidByIds(List.of(id), true));
     }
 }

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectApplicationController.java

@@ -43,7 +43,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 查询项目预算申报列表
      */
-    //@SaCheckPermission("cw:application:list")
+    @SaCheckPermission("cw:application:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectApplicationVo> list(CwProjectApplicationBo bo, PageQuery pageQuery) {
         return projectApplicationService.queryPageList(bo, pageQuery);
@@ -52,9 +52,9 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 查询我的申报列表
      */
-    //@SaCheckPermission("cw:application:list")
+    @SaCheckPermission("cw:application:list")
     @GetMapping("/myList")
-    public R<List<CwProjectApplicationVo>> myList(@RequestParam(required = false) Integer year) {
+    public R<List<CwProjectApplicationVo>> myList(@RequestParam(value = "year", required = false) Integer year) {
         Long applicantId = LoginHelper.getUserId();
         List<CwProjectApplicationVo> list = projectApplicationService.queryMyApplications(applicantId, year);
         return R.ok(list);
@@ -63,9 +63,9 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 查询部门申报列表
      */
-    //@SaCheckPermission("cw:application:list")
+    @SaCheckPermission("cw:application:list")
     @GetMapping("/deptList")
-    public R<List<CwProjectApplicationVo>> deptList(@RequestParam Long departmentId, @RequestParam(required = false) Integer year) {
+    public R<List<CwProjectApplicationVo>> deptList(@RequestParam("departmentId") Long departmentId, @RequestParam(value = "year", required = false) Integer year) {
         List<CwProjectApplicationVo> list = projectApplicationService.queryDeptApplications(departmentId, year);
         return R.ok(list);
     }
@@ -73,7 +73,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 查询待我审批的申报列表
      */
-    //@SaCheckPermission("cw:approvalRecord:list")
+    @SaCheckPermission("cw:approvalRecord:list")
     @GetMapping("/pendingList")
     public R<List<CwProjectApplicationVo>> pendingList() {
         Long approverId = LoginHelper.getUserId();
@@ -84,7 +84,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 导出项目申报信息
      */
-    //@SaCheckPermission("cw:application:export")
+    @SaCheckPermission("cw:application:export")
     @Log(title = "项目申报", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwProjectApplicationBo bo, HttpServletResponse response) {
@@ -95,7 +95,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 项目预算统计 - 获取项目清单
      */
-    //@SaCheckPermission("cw:statistics:list")
+    @SaCheckPermission("cw:statistics:list")
     @GetMapping("/statistics/list")
     public TableDataInfo<CwProjectApplicationVo> getStatisticsList(CwProjectApplicationBo bo, PageQuery pageQuery) {
         log.info("🚀 [统计页面-项目清单] Controller接收到统计查询请求");
@@ -113,9 +113,9 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 项目预算统计 - 状态统计
      */
-    //@SaCheckPermission("cw:statistics:list")
+    @SaCheckPermission("cw:statistics:list")
     @GetMapping("/statistics/status")
-    public R<Map<String, Object>> getStatusStatistics(@RequestParam(required = false) String budgetYear) {
+    public R<Map<String, Object>> getStatusStatistics(@RequestParam(value = "budgetYear", required = false) String budgetYear) {
         Map<String, Object> statistics = projectApplicationService.getStatusStatistics(budgetYear);
         return R.ok(statistics);
     }
@@ -123,9 +123,9 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 项目预算统计 - 部门预算汇总
      */
-    //@SaCheckPermission("cw:statistics:list")
+    @SaCheckPermission("cw:statistics:list")
     @GetMapping("/statistics/department")
-    public R<List<Map<String, Object>>> getDepartmentStatistics(@RequestParam(required = false) String budgetYear) {
+    public R<List<Map<String, Object>>> getDepartmentStatistics(@RequestParam(value = "budgetYear", required = false) String budgetYear) {
         List<Map<String, Object>> statistics = projectApplicationService.getDepartmentStatistics(budgetYear);
         return R.ok(statistics);
     }
@@ -133,7 +133,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 项目预算统计 - 年度汇总
      */
-    //@SaCheckPermission("cw:statistics:list")
+    @SaCheckPermission("cw:statistics:list")
     @GetMapping("/statistics/yearly")
     public R<List<Map<String, Object>>> getYearlyStatistics() {
         List<Map<String, Object>> statistics = projectApplicationService.getYearlyStatistics();
@@ -143,26 +143,26 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 获取项目预算申报详细信息
      */
-    //@SaCheckPermission("cw:application:query")
+    @SaCheckPermission("cw:application:query")
     @GetMapping("/{id}")
     public R<CwProjectApplicationVo> getInfo(@NotNull(message = "主键不能为空")
-                                             @PathVariable Long id) {
+                                             @PathVariable("id") Long id) {
         return R.ok(projectApplicationService.queryById(id));
     }
 
     /**
      * 根据申报编号获取详细信息
      */
-    //@SaCheckPermission("cw:application:query")
+    @SaCheckPermission("cw:application:query")
     @GetMapping("/byNo/{applicationNo}")
-    public R<CwProjectApplicationVo> getInfoByNo(@PathVariable String applicationNo) {
+    public R<CwProjectApplicationVo> getInfoByNo(@PathVariable("applicationNo") String applicationNo) {
         return R.ok(projectApplicationService.queryByApplicationNo(applicationNo));
     }
 
     /**
      * 新增项目预算申报
      */
-    //@SaCheckPermission("cw:application:add")
+    @SaCheckPermission("cw:application:add")
     @Log(title = "项目预算申报", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -180,7 +180,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 修改项目预算申报
      */
-    //@SaCheckPermission("cw:application:edit")
+    @SaCheckPermission("cw:application:edit")
     @Log(title = "项目预算申报", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -191,7 +191,7 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 保存草稿
      */
-    //@SaCheckPermission("cw:application:add")
+    @SaCheckPermission("cw:application:add")
     @Log(title = "保存申报草稿", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/saveDraft")
@@ -213,49 +213,49 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 提交申报
      */
-    //@SaCheckPermission("cw:application:submit")
+    @SaCheckPermission("cw:application:submit")
     @Log(title = "提交项目预算申报", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/submit/{id}")
-    public R<Void> submit(@PathVariable Long id) {
+    public R<Void> submit(@PathVariable("id") Long id) {
         return toAjax(projectApplicationService.submitApplication(id));
     }
 
     /**
      * 撤回申报
      */
-    //@SaCheckPermission("cw:application:edit")
+    @SaCheckPermission("cw:application:edit")
     @Log(title = "撤回项目预算申报", businessType = BusinessType.UPDATE)
     @PostMapping("/withdraw/{id}")
-    public R<Void> withdraw(@PathVariable Long id) {
+    public R<Void> withdraw(@PathVariable("id") Long id) {
         return toAjax(projectApplicationService.withdrawApplication(id));
     }
 
     /**
      * 取消申报
      */
-    //@SaCheckPermission("cw:application:remove")
+    @SaCheckPermission("cw:application:remove")
     @Log(title = "取消项目预算申报", businessType = BusinessType.UPDATE)
     @PostMapping("/cancel/{id}")
-    public R<Void> cancel(@PathVariable Long id) {
+    public R<Void> cancel(@PathVariable("id") Long id) {
         return toAjax(projectApplicationService.cancelApplication(id));
     }
 
     /**
      * 删除项目预算申报
      */
-    //@SaCheckPermission("cw:application:remove")
+    @SaCheckPermission("cw:application:remove")
     @Log(title = "项目预算申报", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(projectApplicationService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 生成申报编号
      */
-    //@SaCheckPermission("cw:application:add")
+    @SaCheckPermission("cw:application:add")
     @GetMapping("/generateNo")
     public R<String> generateApplicationNo() {
         return R.ok(projectApplicationService.generateApplicationNo());
@@ -264,9 +264,9 @@ public class CwProjectApplicationController extends BaseController {
     /**
      * 统计数据
      */
-    //@SaCheckPermission("cw:application:list")
+    @SaCheckPermission("cw:application:list")
     @GetMapping("/statistics")
-    public R<java.util.Map<String, Object>> statistics(@RequestParam(required = false) Integer year) {
+    public R<java.util.Map<String, Object>> statistics(@RequestParam(value = "year", required = false) Integer year) {
         java.util.Map<String, Object> result = new java.util.HashMap<>();
 
         // 申报数量统计 - 使用字符串状态值

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectApprovalController.java

@@ -38,7 +38,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 启动自定义审批流程
      */
-    //@SaCheckPermission("cw:projectApproval:start")
+    @SaCheckPermission("cw:projectApproval:start")
     @Log(title = "启动审批流程", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/start")
@@ -52,7 +52,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 执行审批操作
      */
-    //@SaCheckPermission("cw:projectApproval:approve")
+    @SaCheckPermission("cw:projectApproval:approve")
     @Log(title = "执行审批操作", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/approve")
@@ -63,7 +63,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 获取我的待审批列表
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/pending")
     public TableDataInfo<CwApprovalRecordVo> getMyPendingApprovals(PageQuery pageQuery) {
         return projectApprovalService.getMyPendingApprovals(pageQuery);
@@ -72,7 +72,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 获取我的已审批列表
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/processed")
     public TableDataInfo<CwApprovalRecordVo> getMyProcessedApprovals(PageQuery pageQuery) {
         return projectApprovalService.getMyProcessedApprovals(pageQuery);
@@ -81,7 +81,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 查询审批流程列表
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/list")
     public TableDataInfo<CwProjectApprovalProcessVo> list(PageQuery pageQuery) {
         return projectApprovalService.queryProcessList(pageQuery);
@@ -90,37 +90,37 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 获取审批流程详情
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/{id}")
     public R<CwProjectApprovalProcessVo> getInfo(@NotNull(message = "主键不能为空")
-                                                @PathVariable Long id) {
+                                                @PathVariable("id") Long id) {
         return R.ok(projectApprovalService.getProcessDetail(id));
     }
 
     /**
      * 获取审批记录列表
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/records/{applicationId}")
-    public R<List<CwApprovalRecordVo>> getApprovalRecords(@PathVariable Long applicationId) {
+    public R<List<CwApprovalRecordVo>> getApprovalRecords(@PathVariable("applicationId") Long applicationId) {
         return R.ok(projectApprovalService.getApprovalRecords(applicationId));
     }
 
     /**
      * 终止审批流程
      */
-    //@SaCheckPermission("cw:projectApproval:terminate")
+    @SaCheckPermission("cw:projectApproval:terminate")
     @Log(title = "终止审批流程", businessType = BusinessType.UPDATE)
     @DeleteMapping("/{ids}")
     public R<Void> terminate(@NotEmpty(message = "主键不能为空")
-                           @PathVariable Long[] ids) {
+                           @PathVariable("ids") Long[] ids) {
         return toAjax(projectApprovalService.terminateProcess(List.of(ids)));
     }
 
     /**
      * 审批流程验证
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @PostMapping("/validate")
     public R<String> validateApprovalProcess(@RequestBody CwCustomApprovalBo bo) {
         // 简单验证逻辑
@@ -136,7 +136,7 @@ public class CwProjectApprovalController extends BaseController {
     /**
      * 审批选项查询（用于下拉选择）
      */
-    //@SaCheckPermission("cw:projectApproval:query")
+    @SaCheckPermission("cw:projectApproval:query")
     @GetMapping("/options")
     public R<Object> getApprovalOptions() {
         // 返回一些选项数据，比如审批动作选项等

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectAuditorController.java

@@ -40,7 +40,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 查询项目审核人配置列表
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectAuditorVo> list(CwProjectAuditorBo bo, PageQuery pageQuery) {
         return cwProjectAuditorService.queryPageList(bo, pageQuery);
@@ -49,7 +49,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 导出项目审核人配置列表
      */
-    //@SaCheckPermission("cw:projectAuditor:export")
+    @SaCheckPermission("cw:projectAuditor:export")
     @Log(title = "项目审核人配置", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwProjectAuditorBo bo, HttpServletResponse response) {
@@ -60,17 +60,17 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 获取项目审核人配置详细信息
      */
-    //@SaCheckPermission("cw:projectAuditor:query")
+    @SaCheckPermission("cw:projectAuditor:query")
     @GetMapping("/{id}")
     public R<CwProjectAuditorVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(cwProjectAuditorService.queryById(id));
     }
 
     /**
      * 新增项目审核人配置
      */
-    //@SaCheckPermission("cw:projectAuditor:add")
+    @SaCheckPermission("cw:projectAuditor:add")
     @Log(title = "项目审核人配置", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -84,7 +84,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 修改项目审核人配置
      */
-    //@SaCheckPermission("cw:projectAuditor:edit")
+    @SaCheckPermission("cw:projectAuditor:edit")
     @Log(title = "项目审核人配置", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -95,18 +95,18 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 删除项目审核人配置
      */
-    //@SaCheckPermission("cw:projectAuditor:remove")
+    @SaCheckPermission("cw:projectAuditor:remove")
     @Log(title = "项目审核人配置", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(cwProjectAuditorService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 批量添加审核人
      */
-    //@SaCheckPermission("cw:projectAuditor:add")
+    @SaCheckPermission("cw:projectAuditor:add")
     @Log(title = "批量添加审核人", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/batchAdd")
@@ -122,7 +122,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 获取可用审核人列表
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/available")
     public R<List<CwProjectAuditorVo>> getAvailableAuditors() {
         return R.ok(cwProjectAuditorService.getAvailableAuditors());
@@ -131,9 +131,9 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 根据部门ID获取用户列表
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/deptUsers/{deptId}")
-    public R<List<Object>> getDeptUsers(@PathVariable Long deptId) {
+    public R<List<Object>> getDeptUsers(@PathVariable("deptId") Long deptId) {
         // 参数验证
         if (deptId == null || deptId <= 0) {
             return R.fail("部门ID参数无效");
@@ -144,7 +144,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 批量更新状态
      */
-    //@SaCheckPermission("cw:projectAuditor:edit")
+    @SaCheckPermission("cw:projectAuditor:edit")
     @Log(title = "批量更新审核人状态", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/status")
@@ -155,7 +155,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 我配置的审核人
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/myConfig")
     public TableDataInfo<CwProjectAuditorVo> getMyConfig(CwProjectAuditorBo bo, PageQuery pageQuery) {
         bo.setConfigBy(LoginHelper.getUserId());
@@ -165,7 +165,7 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 获取审核人选项（用于下拉选择）
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/options")
     public R<List<CwProjectAuditorVo>> getAuditorOptions() {
         return R.ok(cwProjectAuditorService.getAvailableAuditors());
@@ -174,27 +174,27 @@ public class CwProjectAuditorController extends BaseController {
     /**
      * 批量启用
      */
-    //@SaCheckPermission("cw:projectAuditor:edit")
+    @SaCheckPermission("cw:projectAuditor:edit")
     @Log(title = "批量启用审核人", businessType = BusinessType.UPDATE)
     @PutMapping("/enable/{ids}")
-    public R<Void> enable(@PathVariable Long[] ids) {
+    public R<Void> enable(@PathVariable("ids") Long[] ids) {
         return toAjax(cwProjectAuditorService.updateStatus(List.of(ids), "1"));
     }
 
     /**
      * 批量停用
      */
-    //@SaCheckPermission("cw:projectAuditor:edit")
+    @SaCheckPermission("cw:projectAuditor:edit")
     @Log(title = "批量停用审核人", businessType = BusinessType.UPDATE)
     @PutMapping("/disable/{ids}")
-    public R<Void> disable(@PathVariable Long[] ids) {
+    public R<Void> disable(@PathVariable("ids") Long[] ids) {
         return toAjax(cwProjectAuditorService.updateStatus(List.of(ids), "0"));
     }
 
     /**
      * 获取审核人统计数据
      */
-    //@SaCheckPermission("cw:projectAuditor:list")
+    @SaCheckPermission("cw:projectAuditor:list")
     @GetMapping("/statistics")
     public R<Object> getStatistics() {
         return R.ok(cwProjectAuditorService.getStatistics());

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectEvaluationIndicatorController.java

@@ -40,7 +40,7 @@ public class CwProjectEvaluationIndicatorController extends BaseController {
     /**
      * 查询项目绩效自评指标明细列表
      */
-    //@SaCheckPermission("cw:indicator:list")
+    @SaCheckPermission("cw:indicator:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectEvaluationIndicatorVo> list(CwProjectEvaluationIndicatorBo bo, PageQuery pageQuery) {
         return indicatorService.queryPageList(bo, pageQuery);
@@ -49,36 +49,36 @@ public class CwProjectEvaluationIndicatorController extends BaseController {
     /**
      * 获取项目绩效自评指标明细详细信息
      */
-    //@SaCheckPermission("cw:indicator:query")
+    @SaCheckPermission("cw:indicator:query")
     @GetMapping("/{id}")
-    public R<CwProjectEvaluationIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwProjectEvaluationIndicatorVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(indicatorService.queryById(id));
     }
 
     /**
      * 根据自评ID查询指标明细列表
      */
-    //@SaCheckPermission("cw:indicator:query")
+    @SaCheckPermission("cw:indicator:query")
     @GetMapping("/evaluation/{evaluationId}")
-    public R<List<CwProjectEvaluationIndicatorVo>> getByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable Long evaluationId) {
+    public R<List<CwProjectEvaluationIndicatorVo>> getByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable("evaluationId") Long evaluationId) {
         return R.ok(indicatorService.queryByEvaluationId(evaluationId));
     }
 
     /**
      * 根据自评ID和指标类型查询指标明细列表
      */
-    //@SaCheckPermission("cw:indicator:query")
+    @SaCheckPermission("cw:indicator:query")
     @GetMapping("/evaluation/{evaluationId}/type/{indicatorType}")
     public R<List<CwProjectEvaluationIndicatorVo>> getByEvaluationIdAndType(
-            @NotNull(message = "自评ID不能为空") @PathVariable Long evaluationId,
-            @NotBlank(message = "指标类型不能为空") @PathVariable String indicatorType) {
+            @NotNull(message = "自评ID不能为空") @PathVariable("evaluationId") Long evaluationId,
+            @NotBlank(message = "指标类型不能为空") @PathVariable("indicatorType") String indicatorType) {
         return R.ok(indicatorService.queryByEvaluationIdAndType(evaluationId, indicatorType));
     }
 
     /**
      * 新增项目绩效自评指标明细
      */
-    //@SaCheckPermission("cw:indicator:add")
+    @SaCheckPermission("cw:indicator:add")
     @Log(title = "项目绩效自评指标明细", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -89,7 +89,7 @@ public class CwProjectEvaluationIndicatorController extends BaseController {
     /**
      * 修改项目绩效自评指标明细
      */
-    //@SaCheckPermission("cw:indicator:edit")
+    @SaCheckPermission("cw:indicator:edit")
     @Log(title = "项目绩效自评指标明细", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -100,28 +100,28 @@ public class CwProjectEvaluationIndicatorController extends BaseController {
     /**
      * 批量保存指标明细
      */
-    //@SaCheckPermission("cw:indicator:edit")
+    @SaCheckPermission("cw:indicator:edit")
     @Log(title = "批量保存指标明细", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/batch")
-    public R<Void> batchSave(@RequestParam Long evaluationId, @RequestBody List<CwProjectEvaluationIndicatorBo> boList) {
+    public R<Void> batchSave(@RequestParam("evaluationId") Long evaluationId, @RequestBody List<CwProjectEvaluationIndicatorBo> boList) {
         return toAjax(indicatorService.batchSave(evaluationId, boList));
     }
 
     /**
      * 删除项目绩效自评指标明细
      */
-    //@SaCheckPermission("cw:indicator:remove")
+    @SaCheckPermission("cw:indicator:remove")
     @Log(title = "项目绩效自评指标明细", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(indicatorService.deleteWithValidByIds(Arrays.asList(ids), true));
     }
 
     /**
      * 导出项目绩效自评指标明细列表
      */
-    //@SaCheckPermission("cw:indicator:export")
+    @SaCheckPermission("cw:indicator:export")
     @Log(title = "项目绩效自评指标明细", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwProjectEvaluationIndicatorBo bo, HttpServletResponse response) {

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectMonthlyMonitoringController.java

@@ -41,7 +41,7 @@ public class CwProjectMonthlyMonitoringController extends BaseController {
     /**
      * 查询项目月度运行监控列表
      */
-    //@SaCheckPermission("cw:monitoring:list")
+    @SaCheckPermission("cw:monitoring:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectMonthlyMonitoringVo> list(CwProjectMonthlyMonitoringBo bo, PageQuery pageQuery) {
         return monitoringService.queryPageList(bo, pageQuery);
@@ -50,36 +50,36 @@ public class CwProjectMonthlyMonitoringController extends BaseController {
     /**
      * 获取项目月度运行监控详细信息
      */
-    //@SaCheckPermission("cw:monitoring:query")
+    @SaCheckPermission("cw:monitoring:query")
     @GetMapping("/{id}")
-    public R<CwProjectMonthlyMonitoringVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwProjectMonthlyMonitoringVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(monitoringService.queryById(id));
     }
 
     /**
      * 根据自评ID查询月度监控列表
      */
-    //@SaCheckPermission("cw:monitoring:query")
+    @SaCheckPermission("cw:monitoring:query")
     @GetMapping("/evaluation/{evaluationId}")
-    public R<List<CwProjectMonthlyMonitoringVo>> getByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable Long evaluationId) {
+    public R<List<CwProjectMonthlyMonitoringVo>> getByEvaluationId(@NotNull(message = "自评ID不能为空") @PathVariable("evaluationId") Long evaluationId) {
         return R.ok(monitoringService.queryByEvaluationId(evaluationId));
     }
 
     /**
      * 查询某个自评的全年监控数据
      */
-    //@SaCheckPermission("cw:monitoring:query")
+    @SaCheckPermission("cw:monitoring:query")
     @GetMapping("/year/{evaluationId}/{year}")
     public R<Map<Integer, CwProjectMonthlyMonitoringVo>> getYearlyMonitoring(
-            @NotNull(message = "自评ID不能为空") @PathVariable Long evaluationId,
-            @NotNull(message = "年份不能为空") @PathVariable Integer year) {
+            @NotNull(message = "自评ID不能为空") @PathVariable("evaluationId") Long evaluationId,
+            @NotNull(message = "年份不能为空") @PathVariable("year") Integer year) {
         return R.ok(monitoringService.queryYearlyMonitoring(evaluationId, year));
     }
 
     /**
      * 新增项目月度运行监控
      */
-    //@SaCheckPermission("cw:monitoring:add")
+    @SaCheckPermission("cw:monitoring:add")
     @Log(title = "项目月度运行监控", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -90,7 +90,7 @@ public class CwProjectMonthlyMonitoringController extends BaseController {
     /**
      * 修改项目月度运行监控
      */
-    //@SaCheckPermission("cw:monitoring:edit")
+    @SaCheckPermission("cw:monitoring:edit")
     @Log(title = "项目月度运行监控", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -101,7 +101,7 @@ public class CwProjectMonthlyMonitoringController extends BaseController {
     /**
      * 填报月度数据
      */
-    //@SaCheckPermission("cw:monitoring:fill")
+    @SaCheckPermission("cw:monitoring:fill")
     @Log(title = "填报月度数据", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/fill")
@@ -112,28 +112,28 @@ public class CwProjectMonthlyMonitoringController extends BaseController {
     /**
      * 批量保存月度监控数据
      */
-    //@SaCheckPermission("cw:monitoring:edit")
+    @SaCheckPermission("cw:monitoring:edit")
     @Log(title = "批量保存月度监控数据", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/batch")
-    public R<Void> batchSave(@RequestParam Long evaluationId, @RequestBody List<CwProjectMonthlyMonitoringBo> boList) {
+    public R<Void> batchSave(@RequestParam("evaluationId") Long evaluationId, @RequestBody List<CwProjectMonthlyMonitoringBo> boList) {
         return toAjax(monitoringService.batchSave(evaluationId, boList));
     }
 
     /**
      * 删除项目月度运行监控
      */
-    //@SaCheckPermission("cw:monitoring:remove")
+    @SaCheckPermission("cw:monitoring:remove")
     @Log(title = "项目月度运行监控", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(monitoringService.deleteWithValidByIds(Arrays.asList(ids), true));
     }
 
     /**
      * 导出项目月度运行监控列表
      */
-    //@SaCheckPermission("cw:monitoring:export")
+    @SaCheckPermission("cw:monitoring:export")
     @Log(title = "项目月度运行监控", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwProjectMonthlyMonitoringBo bo, HttpServletResponse response) {

backend/ruoyi-modules/ruoyi-cw/src/main/java/org/dromara/cw/controller/CwProjectPerformanceSelfEvaluationController.java

@@ -43,7 +43,7 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 查询项目绩效自评列表
      */
-    //@SaCheckPermission("cw:evaluation:list")
+    @SaCheckPermission("cw:evaluation:list")
     @GetMapping("/list")
     public TableDataInfo<CwProjectPerformanceSelfEvaluationVo> list(CwProjectPerformanceSelfEvaluationBo bo, PageQuery pageQuery) {
         return evaluationService.queryPageList(bo, pageQuery);
@@ -52,16 +52,16 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 获取项目绩效自评详细信息
      */
-    //@SaCheckPermission("cw:evaluation:query")
+    @SaCheckPermission("cw:evaluation:query")
     @GetMapping("/{id}")
-    public R<CwProjectPerformanceSelfEvaluationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<CwProjectPerformanceSelfEvaluationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(evaluationService.queryById(id));
     }
 
     /**
      * 新增项目绩效自评
      */
-    //@SaCheckPermission("cw:evaluation:add")
+    @SaCheckPermission("cw:evaluation:add")
     @Log(title = "项目绩效自评", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -76,7 +76,7 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 修改项目绩效自评
      */
-    //@SaCheckPermission("cw:evaluation:edit")
+    @SaCheckPermission("cw:evaluation:edit")
     @Log(title = "项目绩效自评", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -87,7 +87,7 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 保存草稿
      */
-    //@SaCheckPermission("cw:evaluation:add")
+    @SaCheckPermission("cw:evaluation:add")
     @Log(title = "保存自评草稿", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/saveDraft")
@@ -98,41 +98,41 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 提交自评
      */
-    //@SaCheckPermission("cw:evaluation:submit")
+    @SaCheckPermission("cw:evaluation:submit")
     @Log(title = "提交自评", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/submit/{id}")
-    public R<Void> submit(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<Void> submit(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return toAjax(evaluationService.submitEvaluation(id));
     }
 
     /**
      * 审核自评
      */
-    //@SaCheckPermission("cw:evaluation:approve")
+    @SaCheckPermission("cw:evaluation:approve")
     @Log(title = "审核自评", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/approve/{id}")
-    public R<Void> approve(@NotNull(message = "主键不能为空") @PathVariable Long id, 
-                          @RequestParam String opinion, 
-                          @RequestParam Boolean approved) {
+    public R<Void> approve(@NotNull(message = "主键不能为空") @PathVariable("id") Long id, 
+                          @RequestParam("opinion") String opinion, 
+                          @RequestParam("approved") Boolean approved) {
         return toAjax(evaluationService.approveEvaluation(id, opinion, approved));
     }
 
     /**
      * 删除项目绩效自评
      */
-    //@SaCheckPermission("cw:evaluation:remove")
+    @SaCheckPermission("cw:evaluation:remove")
     @Log(title = "项目绩效自评", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(evaluationService.deleteWithValidByIds(Arrays.asList(ids), true));
     }
 
     /**
      * 查询我的自评列表
      */
-    //@SaCheckPermission("cw:evaluation:list")
+    @SaCheckPermission("cw:evaluation:list")
     @GetMapping("/my")
     public R<List<CwProjectPerformanceSelfEvaluationVo>> myEvaluations() {
         return R.ok(evaluationService.queryMyEvaluations(LoginHelper.getUserId()));
@@ -141,7 +141,7 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 查询待审核自评列表
      */
-    //@SaCheckPermission("cw:evaluation:approve")
+    @SaCheckPermission("cw:evaluation:approve")
     @GetMapping("/pending")
     public R<List<CwProjectPerformanceSelfEvaluationVo>> pendingApprovals() {
         return R.ok(evaluationService.queryPendingApprovals());
@@ -150,7 +150,7 @@ public class CwProjectPerformanceSelfEvaluationController extends BaseController
     /**
      * 导出项目绩效自评列表
      */
-    //@SaCheckPermission("cw:evaluation:export")
+    @SaCheckPermission("cw:evaluation:export")
     @Log(title = "项目绩效自评", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(CwProjectPerformanceSelfEvaluationBo bo, HttpServletResponse response) {

backend/ruoyi-modules/ruoyi-demo/src/main/java/org/dromara/demo/controller/TestDemoController.java

@@ -141,7 +141,7 @@ public class TestDemoController extends BaseController {
     @Log(title = "测试单表", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(testDemoService.deleteWithValidByIds(Arrays.asList(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-demo/src/main/java/org/dromara/demo/controller/TestTreeController.java

@@ -101,7 +101,7 @@ public class TestTreeController extends BaseController {
     @Log(title = "测试树表", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(testTreeService.deleteWithValidByIds(Arrays.asList(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-generator/src/main/java/org/dromara/generator/controller/GenController.java

@@ -52,7 +52,7 @@ public class GenController extends BaseController {
      */
     @SaCheckPermission("tool:gen:query")
     @GetMapping(value = "/{tableId}")
-    public R<Map<String, Object>> getInfo(@PathVariable Long tableId) {
+    public R<Map<String, Object>> getInfo(@PathVariable("tableId") Long tableId) {
         GenTable table = genTableService.selectGenTableById(tableId);
         List<GenTable> tables = genTableService.selectGenTableAll();
         List<GenTableColumn> list = genTableService.selectGenTableColumnListByTableId(tableId);
@@ -123,7 +123,7 @@ public class GenController extends BaseController {
     @SaCheckPermission("tool:gen:remove")
     @Log(title = "代码生成", businessType = BusinessType.DELETE)
     @DeleteMapping("/{tableIds}")
-    public R<Void> remove(@PathVariable Long[] tableIds) {
+    public R<Void> remove(@PathVariable("tableIds") Long[] tableIds) {
         genTableService.deleteGenTableByIds(tableIds);
         return R.ok();
     }

backend/ruoyi-modules/ruoyi-hq/pom.xml

@@ -92,11 +92,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再依赖 -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqHallInfoController.java

@@ -41,7 +41,7 @@ public class HqHallInfoController extends BaseController {
      * 查询报告厅信息列表
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:list")
+    @SaCheckPermission("hq:hallInfo:list")
     @GetMapping("/list")
     public TableDataInfo<HqHallInfoVo> list(HqHallInfoBo bo, PageQuery pageQuery) {
         return hqHallInfoService.queryPageList(bo, pageQuery);
@@ -51,7 +51,7 @@ public class HqHallInfoController extends BaseController {
      * 导出报告厅信息列表
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:export")
+    @SaCheckPermission("hq:hallInfo:export")
     @Log(title = "报告厅信息", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqHallInfoBo bo, HttpServletResponse response) {
@@ -65,9 +65,9 @@ public class HqHallInfoController extends BaseController {
      * @param id 主键
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:query")
+    @SaCheckPermission("hq:hallInfo:query")
     @GetMapping("/{id}")
-    public R<HqHallInfoVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqHallInfoVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(hqHallInfoService.queryById(id));
     }
 
@@ -75,7 +75,7 @@ public class HqHallInfoController extends BaseController {
      * 新增报告厅信息
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:add")
+    @SaCheckPermission("hq:hallInfo:add")
     @Log(title = "报告厅信息", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -87,7 +87,7 @@ public class HqHallInfoController extends BaseController {
      * 修改报告厅信息
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:edit")
+    @SaCheckPermission("hq:hallInfo:edit")
     @Log(title = "报告厅信息", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -101,10 +101,10 @@ public class HqHallInfoController extends BaseController {
      * @param ids 主键串
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallInfo:remove")
+    @SaCheckPermission("hq:hallInfo:remove")
     @Log(title = "报告厅信息", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(hqHallInfoService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqHallReservationController.java

@@ -44,7 +44,7 @@ public class HqHallReservationController extends BaseController {
      * 查询报告厅预约列表
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:list")
+    @SaCheckPermission("hq:hallReservation:list")
     @GetMapping("/list")
     public TableDataInfo<HqHallReservationVo> list(HqHallReservationBo bo, PageQuery pageQuery) {
         return hqHallReservationService.queryPageList(bo, pageQuery);
@@ -54,7 +54,7 @@ public class HqHallReservationController extends BaseController {
      * 导出报告厅预约列表
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:export")
+    @SaCheckPermission("hq:hallReservation:export")
     @Log(title = "报告厅预约", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqHallReservationBo bo, HttpServletResponse response) {
@@ -68,9 +68,9 @@ public class HqHallReservationController extends BaseController {
      * @param id 主键
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:query")
+    @SaCheckPermission("hq:hallReservation:query")
     @GetMapping("/{id}")
-    public R<HqHallReservationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqHallReservationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(hqHallReservationService.queryById(id));
     }
 
@@ -78,7 +78,7 @@ public class HqHallReservationController extends BaseController {
      * 新增报告厅预约
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:add")
+    @SaCheckPermission("hq:hallReservation:add")
     @Log(title = "报告厅预约", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -90,7 +90,7 @@ public class HqHallReservationController extends BaseController {
      * 修改报告厅预约
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:edit")
+    @SaCheckPermission("hq:hallReservation:edit")
     @Log(title = "报告厅预约", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -104,10 +104,10 @@ public class HqHallReservationController extends BaseController {
      * @param ids 主键串
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:remove")
+    @SaCheckPermission("hq:hallReservation:remove")
     @Log(title = "报告厅预约", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(hqHallReservationService.deleteWithValidByIds(List.of(ids), true));
     }
 
@@ -115,7 +115,7 @@ public class HqHallReservationController extends BaseController {
      * 审核报告厅预约（批准/拒绝）
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:audit")
+    @SaCheckPermission("hq:hallReservation:audit")
     @Log(title = "报告厅预约审核", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/audit")
@@ -127,7 +127,7 @@ public class HqHallReservationController extends BaseController {
      * 检查报告厅时间冲突
      */
     @ApiEncrypt(response = true)
-    //@SaCheckPermission("hq:hallReservation:query")
+    @SaCheckPermission("hq:hallReservation:query")
     @PostMapping("/checkTimeConflict")
     public R<HqHallTimeCheckVo> checkTimeConflict(@Validated @RequestBody HqHallTimeCheckBo timeCheckBo) {
         HqHallTimeCheckVo result = hqHallReservationService.checkTimeConflict(timeCheckBo);

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqPmRepairAttachmentController.java

@@ -1,5 +1,7 @@
 package org.dromara.hq.controller;
 
+import org.dromara.common.core.utils.file.FileUtils;
+import org.dromara.common.web.handler.GlobalExceptionHandler;
 import cn.dev33.satoken.annotation.SaCheckPermission;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.constraints.NotEmpty;
@@ -42,7 +44,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 查询报修附件列表
      */
-    //@SaCheckPermission("pm:attachment:list")
+    @SaCheckPermission("pm:attachment:list")
     @GetMapping("/list")
     public TableDataInfo<HqPmRepairAttachmentVo> list(HqPmRepairAttachmentBo bo, PageQuery pageQuery) {
         return attachmentService.queryPageList(bo, pageQuery);
@@ -51,7 +53,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 根据工单ID获取附件列表
      */
-    //@SaCheckPermission("pm:attachment:list")
+    @SaCheckPermission("pm:attachment:list")
     @GetMapping("/order/{orderId}")
     public R<List<HqPmRepairAttachmentVo>> getByOrderId(@PathVariable("orderId") Long orderId) {
         List<HqPmRepairAttachmentVo> list = attachmentService.queryByOrderId(orderId);
@@ -61,16 +63,16 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 获取报修附件详细信息
      */
-    //@SaCheckPermission("pm:attachment:query")
+    @SaCheckPermission("pm:attachment:query")
     @GetMapping("/{id}")
-    public R<HqPmRepairAttachmentVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqPmRepairAttachmentVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(attachmentService.queryById(id));
     }
 
     /**
      * 新增报修附件
      */
-    //@SaCheckPermission("pm:attachment:add")
+    @SaCheckPermission("pm:attachment:add")
     @Log(title = "报修附件", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping
@@ -81,7 +83,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 修改报修附件
      */
-    //@SaCheckPermission("pm:attachment:edit")
+    @SaCheckPermission("pm:attachment:edit")
     @Log(title = "报修附件", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping
@@ -93,17 +95,17 @@ public class HqPmRepairAttachmentController extends BaseController {
      * 删除报修附件
      * //
      */
-    //@SaCheckPermission("pm:attachment:remove")
+    @SaCheckPermission("pm:attachment:remove")
     @Log(title = "报修附件", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(attachmentService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 上传单个附件文件
      */
-    //@SaCheckPermission("pm:attachment:upload")
+    @SaCheckPermission("pm:attachment:upload")
     @Log(title = "上传报修附件", businessType = BusinessType.INSERT)
     @PostMapping("/upload")
     public R<HqPmRepairAttachmentVo> uploadFile(
@@ -120,14 +122,14 @@ public class HqPmRepairAttachmentController extends BaseController {
             HqPmRepairAttachmentVo result = attachmentService.uploadFile(orderId, uploadStage, file, description);
             return R.ok(result);
         } catch (Exception e) {
-            return R.fail("上传失败: " + e.getMessage());
+            return R.fail("上传失败: " + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
     /**
      * 批量上传附件文件
      */
-    //@SaCheckPermission("pm:attachment:upload")
+    @SaCheckPermission("pm:attachment:upload")
     @Log(title = "批量上传报修附件", businessType = BusinessType.INSERT)
     @PostMapping("/upload/batch")
     public R<List<HqPmRepairAttachmentVo>> uploadFiles(
@@ -145,14 +147,14 @@ public class HqPmRepairAttachmentController extends BaseController {
                     descriptions);
             return R.ok(results);
         } catch (Exception e) {
-            return R.fail("批量上传失败: " + e.getMessage());
+            return R.fail("批量上传失败: " + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
     /**
      * 删除附件文件（包括OSS文件和数据库记录）
      */
-    //@SaCheckPermission("pm:attachment:remove")
+    @SaCheckPermission("pm:attachment:remove")
     @Log(title = "删除报修附件文件", businessType = BusinessType.DELETE)
     @DeleteMapping("/file/{id}")
     public R<Void> deleteAttachment(@PathVariable("id") Long id) {
@@ -162,7 +164,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 下载附件文件
      */
-    //@SaCheckPermission("pm:attachment:download")
+    @SaCheckPermission("pm:attachment:download")
     @GetMapping("/download/{id}")
     public void downloadFile(@PathVariable("id") Long id, HttpServletResponse response) {
         HqPmRepairAttachmentVo attachment = attachmentService.queryById(id);
@@ -172,12 +174,16 @@ public class HqPmRepairAttachmentController extends BaseController {
 
         try {
             // 设置响应头
+            String filePath = attachment.getFilePath();
+            if (filePath == null || !(filePath.startsWith("https://") || filePath.startsWith("http://"))) {
+                response.sendError(HttpServletResponse.SC_NOT_FOUND);
+                return;
+            }
             response.setContentType("application/octet-stream");
-            response.setHeader("Content-Disposition", "attachment; filename=\"" + attachment.getFileName() + "\"");
+            FileUtils.setAttachmentResponseHeader(response, attachment.getFileName());
 
-            // 这里需要根据具体的文件存储方式来实现下载逻辑
             // 如果使用OSS，可以直接重定向到OSS的URL
-            response.sendRedirect(attachment.getFilePath());
+            response.sendRedirect(filePath);
         } catch (Exception e) {
             log.error("下载文件失败: {}", e.getMessage(), e);
         }
@@ -186,7 +192,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 更新附件的工单ID（用于新增工单时关联已上传的附件）
      */
-    //@SaCheckPermission("pm:attachment:edit")
+    @SaCheckPermission("pm:attachment:edit")
     @Log(title = "更新附件工单ID", businessType = BusinessType.UPDATE)
     @PutMapping("/{attachmentId}/order/{orderId}")
     public R<Void> updateAttachmentOrderId(@PathVariable("attachmentId") Long attachmentId,
@@ -197,7 +203,7 @@ public class HqPmRepairAttachmentController extends BaseController {
     /**
      * 批量更新附件的工单ID（用于新增工单时关联已上传的附件）
      */
-    //@SaCheckPermission("pm:attachment:edit")
+    @SaCheckPermission("pm:attachment:edit")
     @Log(title = "批量更新附件工单ID", businessType = BusinessType.UPDATE)
     @PutMapping("/batch-update-order")
     public R<Void> batchUpdateAttachmentOrderId(@RequestBody BatchUpdateOrderIdRequest request) {

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqPmRepairCategoryController.java

@@ -39,7 +39,7 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 查询维修类型列表
      */
-    //@SaCheckPermission("pm:category:list")
+    @SaCheckPermission("pm:category:list")
     @GetMapping("/list")
     public TableDataInfo<HqPmRepairCategoryVo> list(HqPmRepairCategoryBo bo, PageQuery pageQuery) {
         return repairCategoryService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 导出维修类型列表
      */
-    //@SaCheckPermission("pm:category:export")
+    @SaCheckPermission("pm:category:export")
     @Log(title = "维修类型", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqPmRepairCategoryBo bo, HttpServletResponse response) {
@@ -59,16 +59,16 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 获取维修类型详细信息
      */
-    //@SaCheckPermission("pm:category:query")
+    @SaCheckPermission("pm:category:query")
     @GetMapping("/{id}")
-    public R<HqPmRepairCategoryVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqPmRepairCategoryVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(repairCategoryService.queryById(id));
     }
 
     /**
      * 新增维修类型
      */
-    //@SaCheckPermission("pm:category:add")
+    @SaCheckPermission("pm:category:add")
     @Log(title = "维修类型", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -79,7 +79,7 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 修改维修类型
      */
-    //@SaCheckPermission("pm:category:edit")
+    @SaCheckPermission("pm:category:edit")
     @Log(title = "维修类型", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -90,17 +90,17 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 删除维修类型
      */
-    //@SaCheckPermission("pm:category:remove")
+    @SaCheckPermission("pm:category:remove")
     @Log(title = "维修类型", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(repairCategoryService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 获取维修类型树形结构
      */
-    //@SaCheckPermission("pm:category:tree")
+    @SaCheckPermission("pm:category:tree")
     @GetMapping("/tree")
     public R<List<HqPmRepairCategoryVo>> tree() {
         return R.ok(repairCategoryService.queryTree());
@@ -109,7 +109,7 @@ public class HqPmRepairCategoryController extends BaseController {
     /**
      * 获取维修类型下拉选项
      */
-    //@SaCheckPermission("pm:category:options")
+    @SaCheckPermission("pm:category:options")
     @GetMapping("/options")
     public R<List<java.util.Map<String, Object>>> options() {
         List<HqPmRepairCategoryVo> list = repairCategoryService.queryTree();

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqPmRepairOrderController.java

@@ -42,7 +42,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 查询报修工单列表
      */
-    //@SaCheckPermission("pm:repairOrder:list")
+    @SaCheckPermission("pm:repairOrder:list")
     @GetMapping("/list")
     public TableDataInfo<HqPmRepairOrderVo> list(HqPmRepairOrderBo bo, PageQuery pageQuery) {
         TableDataInfo<HqPmRepairOrderVo> result = repairOrderService.queryPageList(bo, pageQuery);
@@ -52,7 +52,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 导出报修工单列表
      */
-    //@SaCheckPermission("pm:repairOrder:export")
+    @SaCheckPermission("pm:repairOrder:export")
     @Log(title = "报修工单", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqPmRepairOrderBo bo, HttpServletResponse response) {
@@ -63,16 +63,16 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 获取报修工单详细信息
      */
-    //@SaCheckPermission("pm:repairOrder:query")
+    @SaCheckPermission("pm:repairOrder:query")
     @GetMapping("/{id}")
-    public R<HqPmRepairOrderVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqPmRepairOrderVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(repairOrderService.queryById(id));
     }
 
     /**
      * 新增报修工单
      */
-    //@SaCheckPermission("pm:repairOrder:add")
+    @SaCheckPermission("pm:repairOrder:add")
     @Log(title = "报修工单", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -89,7 +89,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 修改报修工单
      */
-    //@SaCheckPermission("pm:repairOrder:edit")
+    @SaCheckPermission("pm:repairOrder:edit")
     @Log(title = "报修工单", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -100,69 +100,69 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 删除报修工单
      */
-    //@SaCheckPermission("pm:repairOrder:remove")
+    @SaCheckPermission("pm:repairOrder:remove")
     @Log(title = "报修工单", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(repairOrderService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 分派工单
      */
-    //@SaCheckPermission("pm:repairOrder:assign")
+    @SaCheckPermission("pm:repairOrder:assign")
     @Log(title = "分派工单", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{orderId}/assign")
     public R<Void> assignOrder(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId,
-            @NotNull(message = "维修员ID不能为空") @RequestParam Long assigneeId,
-            @RequestParam(required = false) String assignRemark) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId,
+            @NotNull(message = "维修员ID不能为空") @RequestParam("assigneeId") Long assigneeId,
+            @RequestParam(value = "assignRemark", required = false) String assignRemark) {
         return toAjax(repairOrderService.assignOrder(orderId, assigneeId, assignRemark));
     }
 
     /**
      * 开始维修
      */
-    //@SaCheckPermission("pm:repairOrder:start")
+    @SaCheckPermission("pm:repairOrder:start")
     @Log(title = "开始维修", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{orderId}/start")
-    public R<Void> startRepair(@NotNull(message = "工单ID不能为空") @PathVariable Long orderId) {
+    public R<Void> startRepair(@NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId) {
         return toAjax(repairOrderService.startRepair(orderId));
     }
 
     /**
      * 完成维修
      */
-    //@SaCheckPermission("pm:repairOrder:finish")
+    @SaCheckPermission("pm:repairOrder:finish")
     @Log(title = "完成维修", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{orderId}/finish")
     public R<Void> finishRepair(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId,
-            @RequestParam(required = false) String repairResult,
-            @RequestParam(required = false) String usedMaterials) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId,
+            @RequestParam(value = "repairResult", required = false) String repairResult,
+            @RequestParam(value = "usedMaterials", required = false) String usedMaterials) {
         return toAjax(repairOrderService.finishRepair(orderId, repairResult, usedMaterials));
     }
 
     /**
      * 取消工单
      */
-    //@SaCheckPermission("pm:repairOrder:cancel")
+    @SaCheckPermission("pm:repairOrder:cancel")
     @Log(title = "取消工单", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{orderId}/cancel")
     public R<Void> cancelOrder(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId,
-            @RequestParam(required = false) String cancelReason) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId,
+            @RequestParam(value = "cancelReason", required = false) String cancelReason) {
         return toAjax(repairOrderService.cancelOrder(orderId, cancelReason));
     }
 
     /**
      * 生成工单编号
      */
-    //@SaCheckPermission("pm:repairOrder:generateOrderNo")
+    @SaCheckPermission("pm:repairOrder:generateOrderNo")
     @GetMapping("/generateOrderNo")
     public R<String> generateOrderNo() {
         return R.ok(repairOrderService.generateOrderNo());
@@ -171,7 +171,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 获取报修统计数据
      */
-    //@SaCheckPermission("pm:repairOrder:statistics")
+    @SaCheckPermission("pm:repairOrder:statistics")
     @GetMapping("/statistics")
     public R<java.util.Map<String, Object>> statistics() {
         // 模拟统计数据，实际项目中应该从service获取真实统计
@@ -247,7 +247,7 @@ public class HqPmRepairOrderController extends BaseController {
      * 获取维修人员选项
      * 返回拥有"维修人员"角色的用户列表
      */
-    //@SaCheckPermission("pm:repairOrder:assign")
+    @SaCheckPermission("pm:repairOrder:assign")
     @GetMapping("/maintenance-workers")
     public R<List<java.util.Map<String, Object>>> getMaintenanceWorkers() {
         return R.ok(repairOrderService.getMaintenanceWorkers());
@@ -256,10 +256,10 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 获取工单进度列表
      */
-    //@SaCheckPermission("pm:repairOrder:progress")
+    @SaCheckPermission("pm:repairOrder:progress")
     @GetMapping("/{orderId}/progress")
     public R<List<java.util.Map<String, Object>>> getRepairProgress(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId) {
         List<java.util.Map<String, Object>> progressList = repairOrderService.getRepairProgress(orderId);
         return R.ok(progressList);
     }
@@ -267,7 +267,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 更新维修进度
      */
-    //@SaCheckPermission("pm:repairOrder:updateProgress")
+    @SaCheckPermission("pm:repairOrder:updateProgress")
     @Log(title = "更新进度", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/progress")
@@ -279,12 +279,12 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 完成工单（新的完成接口，支持详细信息）
      */
-    //@SaCheckPermission("pm:repairOrder:complete")
+    @SaCheckPermission("pm:repairOrder:complete")
     @Log(title = "完成工单", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{orderId}/complete")
     public R<Void> completeOrder(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId,
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId,
             @RequestBody java.util.Map<String, Object> completeData) {
         String repairResult = (String) completeData.get("repairResult");
         String usedMaterials = (String) completeData.get("usedMaterials");
@@ -296,7 +296,7 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 创建服务评价
      */
-    //@SaCheckPermission("pm:repairOrder:evaluate")
+    @SaCheckPermission("pm:repairOrder:evaluate")
     @Log(title = "服务评价", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/evaluation")
@@ -309,10 +309,10 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 获取工单的服务评价
      */
-    //@SaCheckPermission("pm:repairOrder:query")
+    @SaCheckPermission("pm:repairOrder:query")
     @GetMapping("/{orderId}/evaluation")
     public R<java.util.Map<String, Object>> getServiceEvaluation(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId) {
         // 从service获取真实评价数据
         java.util.Map<String, Object> evaluation = repairOrderService.getServiceEvaluation(orderId);
         return R.ok(evaluation);
@@ -321,10 +321,10 @@ public class HqPmRepairOrderController extends BaseController {
     /**
      * 获取工单附件列表
      */
-    //@SaCheckPermission("pm:repairOrder:query")
+    @SaCheckPermission("pm:repairOrder:query")
     @GetMapping("/{orderId}/attachments")
     public R<List<HqPmRepairAttachmentVo>> getRepairAttachments(
-            @NotNull(message = "工单ID不能为空") @PathVariable Long orderId) {
+            @NotNull(message = "工单ID不能为空") @PathVariable("orderId") Long orderId) {
         List<HqPmRepairAttachmentVo> attachments = attachmentService.queryByOrderId(orderId);
         return R.ok(attachments);
     }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatCategoryController.java

@@ -39,7 +39,7 @@ public class HqSatCategoryController extends BaseController {
     /**
      * 查询题目分类列表
      */
-    //@SaCheckPermission("hq:satCategory:list")
+    @SaCheckPermission("hq:satCategory:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatCategoryVo> list(HqSatCategoryBo bo, PageQuery pageQuery) {
         return hqSatCategoryService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqSatCategoryController extends BaseController {
     /**
      * 查询所有题目分类列表(包括已逻辑删除的)
      */
-    //@SaCheckPermission("hq:satCategory:list")
+    @SaCheckPermission("hq:satCategory:list")
     @GetMapping("/listAllIncludeDeleted")
     public R<List<HqSatCategoryVo>> listAllIncludeDeleted(HqSatCategoryBo bo) {
         List<HqSatCategoryVo> list = hqSatCategoryService.queryListWithDeleted(bo);
@@ -58,7 +58,7 @@ public class HqSatCategoryController extends BaseController {
     /**
      * 导出题目分类列表
      */
-    //@SaCheckPermission("hq:satCategory:export")
+    @SaCheckPermission("hq:satCategory:export")
     @Log(title = "题目分类", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatCategoryBo bo, HttpServletResponse response) {
@@ -71,17 +71,17 @@ public class HqSatCategoryController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satCategory:query")
+    @SaCheckPermission("hq:satCategory:query")
     @GetMapping("/{id}")
     public R<HqSatCategoryVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(hqSatCategoryService.queryById(id));
     }
 
     /**
      * 新增题目分类
      */
-    //@SaCheckPermission("hq:satCategory:add")
+    @SaCheckPermission("hq:satCategory:add")
     @Log(title = "题目分类", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -92,7 +92,7 @@ public class HqSatCategoryController extends BaseController {
     /**
      * 修改题目分类
      */
-    //@SaCheckPermission("hq:satCategory:edit")
+    @SaCheckPermission("hq:satCategory:edit")
     @Log(title = "题目分类", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -105,11 +105,11 @@ public class HqSatCategoryController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satCategory:remove")
+    @SaCheckPermission("hq:satCategory:remove")
     @Log(title = "题目分类", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatCategoryService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatDetailController.java

@@ -39,7 +39,7 @@ public class HqSatDetailController extends BaseController {
     /**
      * 查询答题详情列表
      */
-    //@SaCheckPermission("hq:satDetail:list")
+    @SaCheckPermission("hq:satDetail:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatDetailVo> list(HqSatDetailBo bo, PageQuery pageQuery) {
         return hqSatDetailService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqSatDetailController extends BaseController {
     /**
      * 导出答题详情列表
      */
-    //@SaCheckPermission("hq:satDetail:export")
+    @SaCheckPermission("hq:satDetail:export")
     @Log(title = "答题详情", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatDetailBo bo, HttpServletResponse response) {
@@ -61,17 +61,17 @@ public class HqSatDetailController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satDetail:query")
+    @SaCheckPermission("hq:satDetail:query")
     @GetMapping("/{id}")
     public R<HqSatDetailVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(hqSatDetailService.queryById(id));
     }
 
     /**
      * 新增答题详情
      */
-    //@SaCheckPermission("hq:satDetail:add")
+    @SaCheckPermission("hq:satDetail:add")
     @Log(title = "答题详情", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -82,7 +82,7 @@ public class HqSatDetailController extends BaseController {
     /**
      * 修改答题详情
      */
-    //@SaCheckPermission("hq:satDetail:edit")
+    @SaCheckPermission("hq:satDetail:edit")
     @Log(title = "答题详情", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -95,11 +95,11 @@ public class HqSatDetailController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satDetail:remove")
+    @SaCheckPermission("hq:satDetail:remove")
     @Log(title = "答题详情", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatDetailService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatOptionController.java

@@ -39,7 +39,7 @@ public class HqSatOptionController extends BaseController {
     /**
      * 查询评分选项列表
      */
-    //@SaCheckPermission("hq:satOption:list")
+    @SaCheckPermission("hq:satOption:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatOptionVo> list(HqSatOptionBo bo, PageQuery pageQuery) {
         return hqSatOptionService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqSatOptionController extends BaseController {
     /**
      * 导出评分选项列表
      */
-    //@SaCheckPermission("hq:satOption:export")
+    @SaCheckPermission("hq:satOption:export")
     @Log(title = "评分选项", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatOptionBo bo, HttpServletResponse response) {
@@ -61,17 +61,17 @@ public class HqSatOptionController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satOption:query")
+    @SaCheckPermission("hq:satOption:query")
     @GetMapping("/{id}")
     public R<HqSatOptionVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(hqSatOptionService.queryById(id));
     }
 
     /**
      * 新增评分选项
      */
-    //@SaCheckPermission("hq:satOption:add")
+    @SaCheckPermission("hq:satOption:add")
     @Log(title = "评分选项", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -82,7 +82,7 @@ public class HqSatOptionController extends BaseController {
     /**
      * 修改评分选项
      */
-    //@SaCheckPermission("hq:satOption:edit")
+    @SaCheckPermission("hq:satOption:edit")
     @Log(title = "评分选项", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -95,11 +95,11 @@ public class HqSatOptionController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satOption:remove")
+    @SaCheckPermission("hq:satOption:remove")
     @Log(title = "评分选项", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatOptionService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatQuestionController.java

@@ -43,7 +43,7 @@ public class HqSatQuestionController extends BaseController {
     /**
      * 查询题库列表
      */
-    //@SaCheckPermission("hq:satQuestion:list")
+    @SaCheckPermission("hq:satQuestion:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatQuestionVo> list(HqSatQuestionBo bo, PageQuery pageQuery) {
         return hqSatQuestionService.queryPageList(bo, pageQuery);
@@ -52,7 +52,7 @@ public class HqSatQuestionController extends BaseController {
     /**
      * 导出题库列表
      */
-    //@SaCheckPermission("hq:satQuestion:export")
+    @SaCheckPermission("hq:satQuestion:export")
     @Log(title = "题库", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatQuestionBo bo, HttpServletResponse response) {
@@ -65,16 +65,16 @@ public class HqSatQuestionController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satQuestion:query")
+    @SaCheckPermission("hq:satQuestion:query")
     @GetMapping("/{id}")
-    public R<HqSatQuestionVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqSatQuestionVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(hqSatQuestionService.queryById(id));
     }
 
     /**
      * 新增题库
      */
-    //@SaCheckPermission("hq:satQuestion:add")
+    @SaCheckPermission("hq:satQuestion:add")
     @Log(title = "题库", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -85,7 +85,7 @@ public class HqSatQuestionController extends BaseController {
     /**
      * 修改题库
      */
-    //@SaCheckPermission("hq:satQuestion:edit")
+    @SaCheckPermission("hq:satQuestion:edit")
     @Log(title = "题库", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -98,10 +98,10 @@ public class HqSatQuestionController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satQuestion:remove")
+    @SaCheckPermission("hq:satQuestion:remove")
     @Log(title = "题库", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatQuestionService.deleteWithValidByIds(List.of(ids), true));
     }
 
@@ -110,9 +110,9 @@ public class HqSatQuestionController extends BaseController {
      *
      * @param questionId 题目ID
      */
-    //@SaCheckPermission("hq:satQuestion:query")
+    @SaCheckPermission("hq:satQuestion:query")
     @GetMapping("/{questionId}/options")
-    public R<List<HqSatOptionVo>> getQuestionOptions(@PathVariable Long questionId) {
+    public R<List<HqSatOptionVo>> getQuestionOptions(@PathVariable("questionId") Long questionId) {
         // 根据题目ID获取该题目的选项
         HqSatOptionBo bo = new HqSatOptionBo();
         bo.setQuestionId(questionId); // 使用questionId进行过滤

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatRecordController.java

@@ -39,7 +39,7 @@ public class HqSatRecordController extends BaseController {
     /**
      * 查询答题记录列表
      */
-    //@SaCheckPermission("hq:satRecord:list")
+    @SaCheckPermission("hq:satRecord:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatRecordVo> list(HqSatRecordBo bo, PageQuery pageQuery) {
         return hqSatRecordService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqSatRecordController extends BaseController {
     /**
      * 导出答题记录列表
      */
-    //@SaCheckPermission("hq:satRecord:export")
+    @SaCheckPermission("hq:satRecord:export")
     @Log(title = "答题记录", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatRecordBo bo, HttpServletResponse response) {
@@ -61,17 +61,17 @@ public class HqSatRecordController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satRecord:query")
+    @SaCheckPermission("hq:satRecord:query")
     @GetMapping("/{id}")
     public R<HqSatRecordVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(hqSatRecordService.queryById(id));
     }
 
     /**
      * 新增答题记录
      */
-    //@SaCheckPermission("hq:satRecord:add")
+    @SaCheckPermission("hq:satRecord:add")
     @Log(title = "答题记录", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -82,7 +82,7 @@ public class HqSatRecordController extends BaseController {
     /**
      * 修改答题记录
      */
-    //@SaCheckPermission("hq:satRecord:edit")
+    @SaCheckPermission("hq:satRecord:edit")
     @Log(title = "答题记录", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -95,11 +95,11 @@ public class HqSatRecordController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satRecord:remove")
+    @SaCheckPermission("hq:satRecord:remove")
     @Log(title = "答题记录", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatRecordService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatSurveyController.java

@@ -1,5 +1,6 @@
 package org.dromara.hq.controller;
 
+import org.dromara.common.web.handler.GlobalExceptionHandler;
 import java.util.List;
 
 import lombok.RequiredArgsConstructor;
@@ -45,7 +46,7 @@ public class HqSatSurveyController extends BaseController {
     /**
      * 查询问卷列表
      */
-    //@SaCheckPermission("hq:satSurvey:list")
+    @SaCheckPermission("hq:satSurvey:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatSurveyVo> list(HqSatSurveyBo bo, PageQuery pageQuery) {
         // 从params中获取权限过滤参数
@@ -77,7 +78,7 @@ public class HqSatSurveyController extends BaseController {
     /**
      * 导出问卷列表
      */
-    //@SaCheckPermission("hq:satSurvey:export")
+    @SaCheckPermission("hq:satSurvey:export")
     @Log(title = "问卷", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatSurveyBo bo, HttpServletResponse response) {
@@ -90,16 +91,16 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satSurvey:query")
+    @SaCheckPermission("hq:satSurvey:query")
     @GetMapping("/{id}")
-    public R<HqSatSurveyVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqSatSurveyVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(hqSatSurveyService.queryById(id));
     }
 
     /**
      * 新增问卷
      */
-    //@SaCheckPermission("hq:satSurvey:add")
+    @SaCheckPermission("hq:satSurvey:add")
     @Log(title = "问卷", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -110,7 +111,7 @@ public class HqSatSurveyController extends BaseController {
     /**
      * 修改问卷
      */
-    //@SaCheckPermission("hq:satSurvey:edit")
+    @SaCheckPermission("hq:satSurvey:edit")
     @Log(title = "问卷", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -123,10 +124,10 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satSurvey:remove")
+    @SaCheckPermission("hq:satSurvey:remove")
     @Log(title = "问卷", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatSurveyService.deleteWithValidByIds(List.of(ids), true));
     }
 
@@ -135,10 +136,10 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param surveyId 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:question")
+    @SaCheckPermission("hq:satSurvey:question")
     @GetMapping("/{surveyId}/questions")
     public R<List<HqSatSurveyQuestionVo>> getSurveyQuestions(
-            @NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId) {
+            @NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId) {
         return R.ok(hqSatSurveyService.getSurveyQuestions(surveyId));
     }
 
@@ -148,11 +149,11 @@ public class HqSatSurveyController extends BaseController {
      * @param surveyId  问卷ID
      * @param questions 题目列表
      */
-    //@SaCheckPermission("hq:satSurvey:question")
+    @SaCheckPermission("hq:satSurvey:question")
     @Log(title = "问卷题目管理", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{surveyId}/questions")
-    public R<Void> updateSurveyQuestions(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId,
+    public R<Void> updateSurveyQuestions(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId,
             @RequestBody List<Object> questions) {
         return toAjax(hqSatSurveyService.updateSurveyQuestions(surveyId, questions));
     }
@@ -162,11 +163,11 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param id 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:publish")
+    @SaCheckPermission("hq:satSurvey:publish")
     @Log(title = "发布问卷", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{id}/publish")
-    public R<Void> publishSurvey(@NotNull(message = "问卷ID不能为空") @PathVariable Long id) {
+    public R<Void> publishSurvey(@NotNull(message = "问卷ID不能为空") @PathVariable("id") Long id) {
         return toAjax(hqSatSurveyService.publishSurvey(id));
     }
 
@@ -175,11 +176,11 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param id 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:unpublish")
+    @SaCheckPermission("hq:satSurvey:unpublish")
     @Log(title = "撤销发布问卷", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/{id}/unpublish")
-    public R<Void> unpublishSurvey(@NotNull(message = "问卷ID不能为空") @PathVariable Long id) {
+    public R<Void> unpublishSurvey(@NotNull(message = "问卷ID不能为空") @PathVariable("id") Long id) {
         return toAjax(hqSatSurveyService.unpublishSurvey(id));
     }
 
@@ -204,7 +205,7 @@ public class HqSatSurveyController extends BaseController {
             return R.ok(result);
         } catch (Exception e) {
             log.error("提交问卷答案失败", e);
-            return R.fail("提交失败：" + e.getMessage());
+            return R.fail("提交失败：" + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
@@ -229,7 +230,7 @@ public class HqSatSurveyController extends BaseController {
             return R.ok(result);
         } catch (Exception e) {
             log.error("保存问卷答案草稿失败", e);
-            return R.fail("保存草稿失败：" + e.getMessage());
+            return R.fail("保存草稿失败：" + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
@@ -239,7 +240,7 @@ public class HqSatSurveyController extends BaseController {
      * @param surveyId 问卷ID
      */
     @GetMapping("/{surveyId}/answered")
-    public R<Boolean> checkUserAnswered(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId) {
+    public R<Boolean> checkUserAnswered(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId) {
         return R.ok(hqSatSurveyService.checkUserAnswered(surveyId));
     }
 
@@ -249,7 +250,7 @@ public class HqSatSurveyController extends BaseController {
      * @param surveyId 问卷ID
      */
     @GetMapping("/{surveyId}/answer")
-    public R<HqSatRecordVo> getUserSurveyAnswer(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId) {
+    public R<HqSatRecordVo> getUserSurveyAnswer(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId) {
         try {
             HqSatRecordVo recordVo = hqSatSurveyService.getUserSurveyAnswer(surveyId);
 
@@ -366,7 +367,7 @@ public class HqSatSurveyController extends BaseController {
             if (e.getMessage() != null && e.getMessage().contains("未找到有效的答题记录")) {
                 return R.fail(404, "未找到有效的答题记录");
             }
-            return R.fail("获取答题记录失败：" + e.getMessage());
+            return R.fail("获取答题记录失败：" + GlobalExceptionHandler.safeMessage(e.getMessage()));
         }
     }
 
@@ -398,9 +399,9 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param surveyId 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:result")
+    @SaCheckPermission("hq:satSurvey:result")
     @GetMapping("/{surveyId}/statistics")
-    public R<java.util.Map<String, Object>> getSurveyStatistics(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId) {
+    public R<java.util.Map<String, Object>> getSurveyStatistics(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId) {
         return R.ok(hqSatSurveyService.getSurveyStatistics(surveyId));
     }
 
@@ -414,15 +415,15 @@ public class HqSatSurveyController extends BaseController {
      * @param pageNum 页码
      * @param pageSize 每页大小
      */
-    //@SaCheckPermission("hq:satSurvey:result")
+    @SaCheckPermission("hq:satSurvey:result")
     @GetMapping("/{surveyId}/records")
     public R<java.util.Map<String, Object>> getSurveyAnswerRecords(
-            @NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId,
-            @RequestParam(required = false) String status,
-            @RequestParam(required = false) String userName,
-            @RequestParam(required = false) String[] dateRange,
-            @RequestParam(defaultValue = "1") int pageNum,
-            @RequestParam(defaultValue = "10") int pageSize) {
+            @NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId,
+            @RequestParam(value = "status", required = false) String status,
+            @RequestParam(value = "userName", required = false) String userName,
+            @RequestParam(value = "dateRange", required = false) String[] dateRange,
+            @RequestParam(value = "pageNum", defaultValue = "1") int pageNum,
+            @RequestParam(value = "pageSize", defaultValue = "10") int pageSize) {
 
         java.util.Map<String, Object> query = new java.util.HashMap<>();
         query.put("status", status);
@@ -439,9 +440,9 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param recordId 答题记录ID
      */
-    //@SaCheckPermission("hq:satSurvey:result")
+    @SaCheckPermission("hq:satSurvey:result")
     @GetMapping("/record/{recordId}")
-    public R<java.util.Map<String, Object>> getAnswerRecordDetail(@NotNull(message = "记录ID不能为空") @PathVariable Long recordId) {
+    public R<java.util.Map<String, Object>> getAnswerRecordDetail(@NotNull(message = "记录ID不能为空") @PathVariable("recordId") Long recordId) {
         return R.ok(hqSatSurveyService.getAnswerRecordDetail(recordId));
     }
 
@@ -450,10 +451,10 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param surveyId 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:export")
+    @SaCheckPermission("hq:satSurvey:export")
     @Log(title = "导出调查报告", businessType = BusinessType.EXPORT)
     @PostMapping("/{surveyId}/exportReport")
-    public void exportSurveyReport(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId, HttpServletResponse response) {
+    public void exportSurveyReport(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId, HttpServletResponse response) {
         hqSatSurveyService.exportSurveyReport(surveyId, response);
     }
 
@@ -462,10 +463,10 @@ public class HqSatSurveyController extends BaseController {
      *
      * @param surveyId 问卷ID
      */
-    //@SaCheckPermission("hq:satSurvey:export")
+    @SaCheckPermission("hq:satSurvey:export")
     @Log(title = "导出原始数据", businessType = BusinessType.EXPORT)
     @PostMapping("/{surveyId}/exportRawData")
-    public void exportSurveyRawData(@NotNull(message = "问卷ID不能为空") @PathVariable Long surveyId, HttpServletResponse response) {
+    public void exportSurveyRawData(@NotNull(message = "问卷ID不能为空") @PathVariable("surveyId") Long surveyId, HttpServletResponse response) {
         hqSatSurveyService.exportSurveyRawData(surveyId, response);
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqSatSurveyQuestionController.java

@@ -39,7 +39,7 @@ public class HqSatSurveyQuestionController extends BaseController {
     /**
      * 查询问卷题目关联列表
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:list")
+    @SaCheckPermission("hq:satSurveyQuestion:list")
     @GetMapping("/list")
     public TableDataInfo<HqSatSurveyQuestionVo> list(HqSatSurveyQuestionBo bo, PageQuery pageQuery) {
         return hqSatSurveyQuestionService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqSatSurveyQuestionController extends BaseController {
     /**
      * 导出问卷题目关联列表
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:export")
+    @SaCheckPermission("hq:satSurveyQuestion:export")
     @Log(title = "问卷题目关联", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqSatSurveyQuestionBo bo, HttpServletResponse response) {
@@ -61,17 +61,17 @@ public class HqSatSurveyQuestionController extends BaseController {
      *
      * @param id 主键
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:query")
+    @SaCheckPermission("hq:satSurveyQuestion:query")
     @GetMapping("/{id}")
     public R<HqSatSurveyQuestionVo> getInfo(@NotNull(message = "主键不能为空")
-                                     @PathVariable Long id) {
+                                     @PathVariable("id") Long id) {
         return R.ok(hqSatSurveyQuestionService.queryById(id));
     }
 
     /**
      * 新增问卷题目关联
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:add")
+    @SaCheckPermission("hq:satSurveyQuestion:add")
     @Log(title = "问卷题目关联", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -82,7 +82,7 @@ public class HqSatSurveyQuestionController extends BaseController {
     /**
      * 修改问卷题目关联
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:edit")
+    @SaCheckPermission("hq:satSurveyQuestion:edit")
     @Log(title = "问卷题目关联", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -95,11 +95,11 @@ public class HqSatSurveyQuestionController extends BaseController {
      *
      * @param ids 主键串
      */
-    //@SaCheckPermission("hq:satSurveyQuestion:remove")
+    @SaCheckPermission("hq:satSurveyQuestion:remove")
     @Log(title = "问卷题目关联", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(hqSatSurveyQuestionService.deleteWithValidByIds(List.of(ids), true));
     }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqVenueInfoController.java

@@ -39,7 +39,7 @@ public class HqVenueInfoController extends BaseController {
     /**
      * 查询场地信息列表
      */
-    //@SaCheckPermission("hq:venue:list")
+    @SaCheckPermission("hq:venue:list")
     @GetMapping("/list")
     public TableDataInfo<HqVenueInfoVo> list(HqVenueInfoBo bo, PageQuery pageQuery) {
         return venueInfoService.queryPageList(bo, pageQuery);
@@ -48,7 +48,7 @@ public class HqVenueInfoController extends BaseController {
     /**
      * 导出场地信息列表
      */
-    //@SaCheckPermission("hq:venue:export")
+    @SaCheckPermission("hq:venue:export")
     @Log(title = "场地信息", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqVenueInfoBo bo, HttpServletResponse response) {
@@ -59,16 +59,16 @@ public class HqVenueInfoController extends BaseController {
     /**
      * 获取场地信息详细信息
      */
-    //@SaCheckPermission("hq:venue:query")
+    @SaCheckPermission("hq:venue:query")
     @GetMapping("/{id}")
-    public R<HqVenueInfoVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqVenueInfoVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(venueInfoService.queryById(id));
     }
 
     /**
      * 新增场地信息
      */
-    //@SaCheckPermission("hq:venue:add")
+    @SaCheckPermission("hq:venue:add")
     @Log(title = "场地信息", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -79,7 +79,7 @@ public class HqVenueInfoController extends BaseController {
     /**
      * 修改场地信息
      */
-    //@SaCheckPermission("hq:venue:edit")
+    @SaCheckPermission("hq:venue:edit")
     @Log(title = "场地信息", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -90,26 +90,26 @@ public class HqVenueInfoController extends BaseController {
     /**
      * 删除场地信息
      */
-    //@SaCheckPermission("hq:venue:remove")
+    @SaCheckPermission("hq:venue:remove")
     @Log(title = "场地信息", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(venueInfoService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 根据场地编码查询场地信息
      */
-    //@SaCheckPermission("hq:venue:query")
+    @SaCheckPermission("hq:venue:query")
     @GetMapping("/code/{venueCode}")
-    public R<HqVenueInfoVo> getByCode(@PathVariable String venueCode) {
+    public R<HqVenueInfoVo> getByCode(@PathVariable("venueCode") String venueCode) {
         return R.ok(venueInfoService.queryByVenueCode(venueCode));
     }
 
     /**
      * 获取可用场地列表
      */
-    //@SaCheckPermission("hq:venue:query")
+    @SaCheckPermission("hq:venue:query")
     @GetMapping("/available")
     public R<List<HqVenueInfoVo>> getAvailableVenues() {
         return R.ok(venueInfoService.getAvailableVenues());

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/controller/HqVenueReservationController.java

@@ -41,7 +41,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 查询场地预约列表
      */
-    //@SaCheckPermission("hq:reservation:list")
+    @SaCheckPermission("hq:reservation:list")
     @GetMapping("/list")
     public TableDataInfo<HqVenueReservationVo> list(HqVenueReservationBo bo, PageQuery pageQuery) {
         return reservationService.queryPageList(bo, pageQuery);
@@ -50,7 +50,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 查询我的预约列表
      */
-    //@SaCheckPermission("hq:reservation:my")
+    @SaCheckPermission("hq:reservation:my")
     @GetMapping("/my")
     public TableDataInfo<HqVenueReservationVo> myList(HqVenueReservationBo bo, PageQuery pageQuery) {
         return reservationService.queryMyPageList(bo, pageQuery);
@@ -59,7 +59,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 查询待审批预约列表
      */
-    //@SaCheckPermission("hq:reservation:approve")
+    @SaCheckPermission("hq:reservation:approve")
     @GetMapping("/pending")
     public TableDataInfo<HqVenueReservationVo> pendingList(HqVenueReservationBo bo, PageQuery pageQuery) {
         return reservationService.queryPendingPageList(bo, pageQuery);
@@ -68,7 +68,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 导出场地预约列表
      */
-    //@SaCheckPermission("hq:reservation:export")
+    @SaCheckPermission("hq:reservation:export")
     @Log(title = "场地预约", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(HqVenueReservationBo bo, HttpServletResponse response) {
@@ -79,16 +79,16 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 获取场地预约详细信息
      */
-    //@SaCheckPermission("hq:reservation:query")
+    @SaCheckPermission("hq:reservation:query")
     @GetMapping("/{id}")
-    public R<HqVenueReservationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<HqVenueReservationVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(reservationService.queryById(id));
     }
 
     /**
      * 新增场地预约
      */
-    //@SaCheckPermission("hq:reservation:add")
+    @SaCheckPermission("hq:reservation:add")
     @Log(title = "场地预约", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -99,7 +99,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 修改场地预约
      */
-    //@SaCheckPermission("hq:reservation:edit")
+    @SaCheckPermission("hq:reservation:edit")
     @Log(title = "场地预约", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -110,23 +110,23 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 删除场地预约
      */
-    //@SaCheckPermission("hq:reservation:remove")
+    @SaCheckPermission("hq:reservation:remove")
     @Log(title = "场地预约", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(reservationService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 检查时间冲突
      */
-    //@SaCheckPermission("hq:reservation:query")
+    @SaCheckPermission("hq:reservation:query")
     @GetMapping("/conflict")
     public R<List<HqVenueReservationVo>> checkTimeConflict(
-            @RequestParam Long venueId,
-            @RequestParam LocalDateTime startTime,
-            @RequestParam LocalDateTime endTime,
-            @RequestParam(required = false) Long excludeId) {
+            @RequestParam("venueId") Long venueId,
+            @RequestParam("startTime") LocalDateTime startTime,
+            @RequestParam("endTime") LocalDateTime endTime,
+            @RequestParam(value = "excludeId", required = false) Long excludeId) {
         List<HqVenueReservationVo> conflicts = reservationService.checkTimeConflict(venueId, startTime, endTime, excludeId);
         return R.ok(conflicts);
     }
@@ -134,7 +134,7 @@ public class HqVenueReservationController extends BaseController {
     /**
      * 审批场地预约
      */
-    //@SaCheckPermission("hq:reservation:approve")
+    @SaCheckPermission("hq:reservation:approve")
     @Log(title = "场地预约审批", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/approve")

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/service/IHqSatSurveyService.java

@@ -174,4 +174,11 @@ public interface IHqSatSurveyService {
      * @param response HTTP响应
      */
     void exportSurveyRawData(Long surveyId, jakarta.servlet.http.HttpServletResponse response);
+
+    /**
+     * 将已过期问卷状态更新为已结束（status=2）
+     *
+     * @return 更新条数
+     */
+    int updateExpiredSurveys();
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/service/impl/HqSatSurveyServiceImpl.java

@@ -6,7 +6,9 @@ import org.dromara.common.mybatis.core.page.TableDataInfo;
 import org.dromara.common.mybatis.core.page.PageQuery;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
+import org.dromara.common.tenant.helper.TenantHelper;
 import cn.hutool.core.collection.CollUtil;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -1741,4 +1743,21 @@ public class HqSatSurveyServiceImpl implements IHqSatSurveyService {
         public java.util.List<java.util.Map<String, Object>> getAnswers() { return answers; }
         public void setAnswers(java.util.List<java.util.Map<String, Object>> answers) { this.answers = answers; }
     }
+
+    /**
+     * 将 end_time 已过期且未结束的问卷标记为已结束。
+     * 定时任务无登录上下文，需忽略租户插件，覆盖全部租户。
+     */
+    @Override
+    public int updateExpiredSurveys() {
+        Date now = new Date();
+        return TenantHelper.ignore(() -> {
+            LambdaUpdateWrapper<HqSatSurvey> updateWrapper = Wrappers.lambdaUpdate();
+            updateWrapper.set(HqSatSurvey::getStatus, "2")
+                .set(HqSatSurvey::getUpdateTime, now)
+                .lt(HqSatSurvey::getEndTime, now)
+                .ne(HqSatSurvey::getStatus, "2");
+            return baseMapper.update(null, updateWrapper);
+        });
+    }
 }

backend/ruoyi-modules/ruoyi-hq/src/main/java/org/dromara/hq/task/HqSatSurveyExpireTask.java

@@ -0,0 +1,46 @@
+package org.dromara.hq.task;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.dromara.common.redis.utils.RedisUtils;
+import org.dromara.hq.service.IHqSatSurveyService;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+
+/**
+ * 满意度调查问卷过期扫描任务
+ * <p>替代原 SnailJob surveyEndTimeJobExecutor：每小时将 end_time 已过期的问卷 status 更新为 2（已结束）。</p>
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class HqSatSurveyExpireTask {
+
+    private static final String LOCK_KEY = "hq:sat:survey:expire:lock";
+    private static final Duration LOCK_TTL = Duration.ofMinutes(10);
+
+    private final IHqSatSurveyService satSurveyService;
+
+    /**
+     * 每小时整点执行（与原 SnailJob 3600 秒间隔对齐）
+     */
+    @Scheduled(cron = "0 0 * * * ?")
+    public void updateExpiredSurveys() {
+        boolean locked = RedisUtils.setObjectIfAbsent(LOCK_KEY, "1", LOCK_TTL);
+        if (!locked) {
+            log.debug("满意度调查过期扫描跳过：其他实例正在执行");
+            return;
+        }
+        try {
+            log.info("开始执行满意度调查过期扫描");
+            int updatedCount = satSurveyService.updateExpiredSurveys();
+            log.info("满意度调查过期扫描完成，更新数量: {}", updatedCount);
+        } catch (Exception e) {
+            log.error("满意度调查过期扫描失败", e);
+        } finally {
+            RedisUtils.deleteObject(LOCK_KEY);
+        }
+    }
+}

backend/ruoyi-modules/ruoyi-jcbt/pom.xml

@@ -92,11 +92,13 @@
             <artifactId>ruoyi-generator</artifactId>
         </dependency>
 
-        <!--  demo模块  -->
+        <!-- P0：demo 模块已下线，不再依赖 -->
+        <!--
         <dependency>
             <groupId>org.dromara</groupId>
             <artifactId>ruoyi-demo</artifactId>
         </dependency>
+        -->
 
         <!--  工作流模块  -->
         <dependency>

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtPovertyApplicationController.java

@@ -52,7 +52,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 查询贫困生认定申请列表
      */
-    //@SaCheckPermission("jcbt:povertyApplication:list")
+    @SaCheckPermission("jcbt:povertyApplication:list")
     @GetMapping("/list")
     @Operation(summary = "查询贫困生认定申请列表")
     public TableDataInfo<JcbtPovertyApplicationVo> list(JcbtPovertyApplicationBo bo, PageQuery pageQuery) {
@@ -62,17 +62,17 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 获取贫困生认定申请详细信息
      */
-    //@SaCheckPermission("jcbt:povertyApplication:query")
+    @SaCheckPermission("jcbt:povertyApplication:query")
     @GetMapping("/{id}")
     @Operation(summary = "获取贫困生认定申请详细信息")
-    public R<JcbtPovertyApplicationVo> getInfo(@Parameter(description = "主键") @PathVariable Long id) {
+    public R<JcbtPovertyApplicationVo> getInfo(@Parameter(description = "主键") @PathVariable("id") Long id) {
         return R.ok(povertyApplicationService.queryById(id));
     }
 
     /**
      * 新增贫困生认定申请
      */
-    //@SaCheckPermission("jcbt:povertyApplication:add")
+    @SaCheckPermission("jcbt:povertyApplication:add")
     @Log(title = "贫困生认定申请", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping
@@ -89,7 +89,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 修改贫困生认定申请
      */
-    //@SaCheckPermission("jcbt:povertyApplication:edit")
+    @SaCheckPermission("jcbt:povertyApplication:edit")
     @Log(title = "贫困生认定申请", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping
@@ -101,18 +101,18 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 删除贫困生认定申请
      */
-    //@SaCheckPermission("jcbt:povertyApplication:remove")
+    @SaCheckPermission("jcbt:povertyApplication:remove")
     @Log(title = "删除贫困生认定申请", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     @Operation(summary = "删除贫困生认定申请")
-    public R<Void> remove(@Parameter(description = "主键集合") @NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@Parameter(description = "主键集合") @NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(povertyApplicationService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 导出贫困生认定申请列表
      */
-    //@SaCheckPermission("jcbt:povertyApplication:export")
+    @SaCheckPermission("jcbt:povertyApplication:export")
     @Log(title = "导出贫困生认定申请", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     @Operation(summary = "导出贫困生认定申请列表")
@@ -124,7 +124,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 导出我的申请列表（班主任导出自己提交的申请）
      */
-    //@SaCheckPermission("jcbt:povertyApplication:myList")
+    @SaCheckPermission("jcbt:povertyApplication:myList")
     @Log(title = "导出我的贫困生认定申请", businessType = BusinessType.EXPORT)
     @PostMapping("/myExport")
     @Operation(summary = "导出我的申请列表")
@@ -139,7 +139,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 查询我的申请列表（班主任查看自己提交的申请）
      */
-    //@SaCheckPermission("jcbt:povertyApplication:myList")
+    @SaCheckPermission("jcbt:povertyApplication:myList")
     @GetMapping("/myList")
     @Operation(summary = "查询我的申请列表")
     public TableDataInfo<JcbtPovertyApplicationVo> myList(JcbtPovertyApplicationBo bo, PageQuery pageQuery) {
@@ -150,7 +150,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 查询待审核申请列表（审核人员使用）
      */
-    //@SaCheckPermission("jcbt:povertyApplication:pendingList")
+    @SaCheckPermission("jcbt:povertyApplication:pendingList")
     @GetMapping("/pendingList")
     @Operation(summary = "查询待审核申请列表")
     public TableDataInfo<JcbtPovertyApplicationVo> pendingList(JcbtPovertyApplicationBo bo, PageQuery pageQuery) {
@@ -160,24 +160,24 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 提交申请
      */
-    //@SaCheckPermission("jcbt:povertyApplication:submit")
+    @SaCheckPermission("jcbt:povertyApplication:submit")
     @Log(title = "提交贫困生认定申请", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/submit/{id}")
     @Operation(summary = "提交申请")
-    public R<Void> submit(@Parameter(description = "申请ID") @PathVariable Long id) {
+    public R<Void> submit(@Parameter(description = "申请ID") @PathVariable("id") Long id) {
         return toAjax(povertyApplicationService.submitApplication(id));
     }
 
     /**
      * 撤销申请
      */
-    //@SaCheckPermission("jcbt:povertyApplication:cancel")
+    @SaCheckPermission("jcbt:povertyApplication:cancel")
     @Log(title = "撤销贫困生认定申请", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/cancel/{id}")
     @Operation(summary = "撤销申请")
-    public R<Void> cancel(@Parameter(description = "申请ID") @PathVariable Long id) {
+    public R<Void> cancel(@Parameter(description = "申请ID") @PathVariable("id") Long id) {
         return toAjax(povertyApplicationService.cancelApplication(id));
     }
 
@@ -186,17 +186,17 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 根据申请编号获取申请信息
      */
-    //@SaCheckPermission("jcbt:povertyApplication:query")
+    @SaCheckPermission("jcbt:povertyApplication:query")
     @GetMapping("/byApplicationNo/{applicationNo}")
     @Operation(summary = "根据申请编号获取申请信息")
-    public R<JcbtPovertyApplicationVo> getInfoByApplicationNo(@Parameter(description = "申请编号") @PathVariable String applicationNo) {
+    public R<JcbtPovertyApplicationVo> getInfoByApplicationNo(@Parameter(description = "申请编号") @PathVariable("applicationNo") String applicationNo) {
         return R.ok(povertyApplicationService.queryByApplicationNo(applicationNo));
     }
 
     /**
      * 保存草稿
      */
-    //@SaCheckPermission("jcbt:povertyApplication:saveDraft")
+    @SaCheckPermission("jcbt:povertyApplication:saveDraft")
     @Log(title = "保存贫困生认定申请草稿", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/saveDraft")
@@ -208,7 +208,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 审核通过
      */
-    //@SaCheckPermission("jcbt:povertyApplication:approve")
+    @SaCheckPermission("jcbt:povertyApplication:approve")
     @Log(title = "审核通过贫困生认定申请", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/approve")
@@ -220,7 +220,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 审核驳回
      */
-    //@SaCheckPermission("jcbt:povertyApplication:reject")
+    @SaCheckPermission("jcbt:povertyApplication:reject")
     @Log(title = "审核驳回贫困生认定申请", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping("/reject")
@@ -232,7 +232,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 生成申请编号
      */
-    //@SaCheckPermission("jcbt:povertyApplication:add")
+    @SaCheckPermission("jcbt:povertyApplication:add")
     @GetMapping("/generateApplicationNo")
     @Operation(summary = "生成申请编号")
     public R<String> generateApplicationNo() {
@@ -242,13 +242,13 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 检查学生申请是否重复
      */
-    //@SaCheckPermission("jcbt:povertyApplication:add")
+    @SaCheckPermission("jcbt:povertyApplication:add")
     @GetMapping("/checkDuplicate")
     @Operation(summary = "检查学生申请是否重复")
-    public R<Boolean> checkDuplicate(@Parameter(description = "学生ID") @RequestParam Long studentId,
-                                    @Parameter(description = "学年") @RequestParam String academicYear,
-                                    @Parameter(description = "认定类型ID") @RequestParam Long recognitionTypeId,
-                                    @Parameter(description = "排除的申请ID") @RequestParam(required = false) Long excludeId) {
+    public R<Boolean> checkDuplicate(@Parameter(description = "学生ID") @RequestParam("studentId") Long studentId,
+                                    @Parameter(description = "学年") @RequestParam("academicYear") String academicYear,
+                                    @Parameter(description = "认定类型ID") @RequestParam("recognitionTypeId") Long recognitionTypeId,
+                                    @Parameter(description = "排除的申请ID") @RequestParam(value = "excludeId", required = false) Long excludeId) {
         boolean exists = povertyApplicationService.checkStudentApplicationExists(studentId, academicYear, recognitionTypeId, excludeId);
         return R.ok(exists);
     }
@@ -258,10 +258,10 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 获取申请统计信息
      */
-    //@SaCheckPermission("jcbt:povertyApplication:statistics")
+    @SaCheckPermission("jcbt:povertyApplication:statistics")
     @GetMapping("/statistics")
     @Operation(summary = "获取申请统计信息")
-    public R<Map<String, Object>> statistics(@Parameter(description = "班主任ID") @RequestParam(required = false) Long teacherId) {
+    public R<Map<String, Object>> statistics(@Parameter(description = "班主任ID") @RequestParam(value = "teacherId", required = false) Long teacherId) {
         List<JcbtPovertyApplicationVo> statisticsList = povertyApplicationService.getApplicationStatistics(teacherId);
 
         // 转换为前端需要的格式
@@ -284,7 +284,7 @@ public class JcbtPovertyApplicationController extends BaseController {
     /**
      * 获取我的申请统计信息（班主任使用）
      */
-    //@SaCheckPermission("jcbt:povertyApplication:myList")
+    @SaCheckPermission("jcbt:povertyApplication:myList")
     @GetMapping("/myStatistics")
     @Operation(summary = "获取我的申请统计信息")
     public R<Map<String, Object>> myStatistics() {
@@ -312,7 +312,7 @@ public class JcbtPovertyApplicationController extends BaseController {
      * 获取当前用户班级信息
      */
     @Operation(summary = "获取当前用户班级信息")
-    //@SaCheckPermission("jcbt:povertyApplication:list")
+    @SaCheckPermission("jcbt:povertyApplication:list")
     @GetMapping("/user/classes")
     public R<List<Map<String, Object>>> getCurrentUserClasses() {
         Long currentUserId = LoginHelper.getLoginUser().getUserId();
@@ -325,9 +325,9 @@ public class JcbtPovertyApplicationController extends BaseController {
      */
     @Operation(summary = "获取班级学生列表")
     @Parameter(name = "classId", description = "班级ID", required = true)
-    //@SaCheckPermission("jcbt:povertyApplication:list")
+    @SaCheckPermission("jcbt:povertyApplication:list")
     @GetMapping("/class/{classId}/students")
-    public R<List<Map<String, Object>>> getClassStudents(@PathVariable Long classId) {
+    public R<List<Map<String, Object>>> getClassStudents(@PathVariable("classId") Long classId) {
         List<Map<String, Object>> students = povertyApplicationService.getClassStudents(classId);
         return R.ok(students);
     }

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtPovertyApplicationReviewController.java

@@ -51,7 +51,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 查询待审核申请列表
      */
-    //@SaCheckPermission("jcbt:povertyApplication:query")
+    @SaCheckPermission("jcbt:povertyApplication:query")
     @GetMapping("/pendingList")
     @Operation(summary = "查询待审核申请列表")
     public TableDataInfo<JcbtPovertyApplicationVo> pendingList(JcbtPovertyApplicationBo bo, PageQuery pageQuery) {
@@ -61,7 +61,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 查询所有申请列表（支持多状态筛选）
      */
-    //@SaCheckPermission("jcbt:povertyApplication:query")
+    @SaCheckPermission("jcbt:povertyApplication:query")
     @GetMapping("/list")
     @Operation(summary = "查询所有申请列表")
     public TableDataInfo<JcbtPovertyApplicationVo> list(JcbtPovertyApplicationBo bo, PageQuery pageQuery) {
@@ -86,17 +86,17 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 获取申请详情
      */
-    //@SaCheckPermission("jcbt:povertyApplication:detail")
+    @SaCheckPermission("jcbt:povertyApplication:detail")
     @GetMapping("/{id}")
     @Operation(summary = "获取申请详情")
-    public R<JcbtPovertyApplicationVo> getInfo(@Parameter(description = "申请ID") @PathVariable Long id) {
+    public R<JcbtPovertyApplicationVo> getInfo(@Parameter(description = "申请ID") @PathVariable("id") Long id) {
         return R.ok(povertyApplicationService.queryById(id));
     }
 
     /**
      * 审核通过
      */
-    //@SaCheckPermission("jcbt:povertyApplication:approve")
+    @SaCheckPermission("jcbt:povertyApplication:approve")
     @Log(title = "审核通过贫困生认定申请", businessType = BusinessType.UPDATE)
     @PutMapping("/approve")
     @Operation(summary = "审核通过")
@@ -107,7 +107,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 审核驳回
      */
-    //@SaCheckPermission("jcbt:povertyApplication:reject")
+    @SaCheckPermission("jcbt:povertyApplication:reject")
     @Log(title = "审核驳回贫困生认定申请", businessType = BusinessType.UPDATE)
     @PutMapping("/reject")
     @Operation(summary = "审核驳回")
@@ -118,7 +118,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 打回修改
      */
-    //@SaCheckPermission("jcbt:povertyApplication:reject")
+    @SaCheckPermission("jcbt:povertyApplication:reject")
     @Log(title = "打回修改贫困生认定申请", businessType = BusinessType.UPDATE)
     @PutMapping("/returnToDraft")
     @Operation(summary = "打回修改")
@@ -129,24 +129,24 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 批量审核通过
      */
-    //@SaCheckPermission("jcbt:povertyApplication:approve")
+    @SaCheckPermission("jcbt:povertyApplication:approve")
     @Log(title = "批量审核通过贫困生认定申请", businessType = BusinessType.UPDATE)
     @PutMapping("/batchApprove")
     @Operation(summary = "批量审核通过")
     public R<Void> batchApprove(@Parameter(description = "申请ID列表") @RequestBody List<Long> ids,
-                               @Parameter(description = "审核意见") @RequestParam(required = false) String auditOpinion) {
+                               @Parameter(description = "审核意见") @RequestParam(value = "auditOpinion", required = false) String auditOpinion) {
         return toAjax(povertyApplicationService.batchApproveApplications(ids, auditOpinion));
     }
 
     /**
      * 批量审核驳回
      */
-    //@SaCheckPermission("jcbt:povertyApplication:reject")
+    @SaCheckPermission("jcbt:povertyApplication:reject")
     @Log(title = "批量审核驳回贫困生认定申请", businessType = BusinessType.UPDATE)
     @PutMapping("/batchReject")
     @Operation(summary = "批量审核驳回")
     public R<Void> batchReject(@Parameter(description = "申请ID列表") @RequestBody List<Long> ids,
-                              @Parameter(description = "审核意见") @RequestParam String auditOpinion) {
+                              @Parameter(description = "审核意见") @RequestParam("auditOpinion") String auditOpinion) {
         return toAjax(povertyApplicationService.batchRejectApplications(ids, auditOpinion));
     }
 
@@ -155,11 +155,11 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 获取审核统计信息
      */
-    //@SaCheckPermission("jcbt:povertyApplication:statistics")
+    @SaCheckPermission("jcbt:povertyApplication:statistics")
     @GetMapping("/statistics")
     @Operation(summary = "获取审核统计信息")
-    public R<Map<String, Object>> statistics(@Parameter(description = "学年") @RequestParam(required = false) String academicYear,
-                                            @Parameter(description = "学院ID") @RequestParam(required = false) Long collegeId) {
+    public R<Map<String, Object>> statistics(@Parameter(description = "学年") @RequestParam(value = "academicYear", required = false) String academicYear,
+                                            @Parameter(description = "学院ID") @RequestParam(value = "collegeId", required = false) Long collegeId) {
         List<JcbtPovertyApplicationVo> statisticsList = povertyApplicationService.getReviewStatistics(academicYear, collegeId);
 
         // 转换为前端需要的格式
@@ -182,11 +182,11 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 获取审核工作量统计
      */
-    //@SaCheckPermission("jcbt:povertyApplication:statistics")
+    @SaCheckPermission("jcbt:povertyApplication:statistics")
     @GetMapping("/workloadStatistics")
     @Operation(summary = "获取审核工作量统计")
-    public R<List<Map<String, Object>>> workloadStatistics(@Parameter(description = "开始时间") @RequestParam(required = false) String startTime,
-                                                           @Parameter(description = "结束时间") @RequestParam(required = false) String endTime) {
+    public R<List<Map<String, Object>>> workloadStatistics(@Parameter(description = "开始时间") @RequestParam(value = "startTime", required = false) String startTime,
+                                                           @Parameter(description = "结束时间") @RequestParam(value = "endTime", required = false) String endTime) {
         List<Map<String, Object>> workloadStats = povertyApplicationService.getAuditorWorkloadStatistics(startTime, endTime);
         return R.ok(workloadStats);
     }
@@ -196,7 +196,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 导出申请数据
      */
-    //@SaCheckPermission("jcbt:povertyApplication:export")
+    @SaCheckPermission("jcbt:povertyApplication:export")
     @Log(title = "导出贫困生认定申请数据", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     @Operation(summary = "导出申请数据")
@@ -208,7 +208,7 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 导出待审核申请数据
      */
-    //@SaCheckPermission("jcbt:povertyApplication:export")
+    @SaCheckPermission("jcbt:povertyApplication:export")
     @Log(title = "导出待审核贫困生认定申请数据", businessType = BusinessType.EXPORT)
     @PostMapping("/exportPending")
     @Operation(summary = "导出待审核申请数据")
@@ -224,10 +224,10 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 获取申请附件预览信息
      */
-    //@SaCheckPermission("jcbt:povertyApplication:detail")
+    @SaCheckPermission("jcbt:povertyApplication:detail")
     @GetMapping("/{id}/attachments")
     @Operation(summary = "获取申请附件预览信息")
-    public R<Map<String, Object>> getAttachments(@Parameter(description = "申请ID") @PathVariable Long id) {
+    public R<Map<String, Object>> getAttachments(@Parameter(description = "申请ID") @PathVariable("id") Long id) {
         JcbtPovertyApplicationVo application = povertyApplicationService.queryById(id);
         if (application == null) {
             return R.fail("申请不存在");
@@ -253,10 +253,10 @@ public class JcbtPovertyApplicationReviewController extends BaseController {
     /**
      * 获取审核历史记录
      */
-    //@SaCheckPermission("jcbt:povertyApplication:detail")
+    @SaCheckPermission("jcbt:povertyApplication:detail")
     @GetMapping("/{id}/history")
     @Operation(summary = "获取审核历史记录")
-    public R<List<Map<String, Object>>> getAuditHistory(@Parameter(description = "申请ID") @PathVariable Long id) {
+    public R<List<Map<String, Object>>> getAuditHistory(@Parameter(description = "申请ID") @PathVariable("id") Long id) {
         List<Map<String, Object>> history = povertyApplicationService.getApplicationAuditHistory(id);
         return R.ok(history);
     }

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtScholarshipApplicationController.java

@@ -1,6 +1,8 @@
 package org.dromara.jcbt.controller;
 
 import cn.dev33.satoken.annotation.SaCheckPermission;
+import cn.dev33.satoken.stp.StpUtil;
+import org.dromara.common.satoken.utils.LoginHelper;
 import org.dromara.common.core.domain.R;
 import org.dromara.common.core.validate.AddGroup;
 import org.dromara.common.core.validate.EditGroup;
@@ -53,7 +55,7 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 查询奖学金申请记录列表
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:list")
+    @SaCheckPermission("jcbt:scholarshipApplication:list")
     @GetMapping("/list")
     @Operation(summary = "查询奖学金申请记录列表")
     public TableDataInfo<JcbtScholarshipApplicationVo> list(JcbtScholarshipApplicationBo bo, PageQuery pageQuery) {
@@ -63,17 +65,17 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 获取奖学金申请记录详细信息
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:query")
+    @SaCheckPermission("jcbt:scholarshipApplication:query")
     @GetMapping("/{id}")
     @Operation(summary = "获取奖学金申请记录详细信息")
-    public R<JcbtScholarshipApplicationVo> getInfo(@Parameter(description = "主键") @PathVariable Long id) {
+    public R<JcbtScholarshipApplicationVo> getInfo(@Parameter(description = "主键") @PathVariable("id") Long id) {
         return R.ok(applicationService.queryById(id));
     }
 
     /**
      * 新增奖学金申请记录
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:add")
+    @SaCheckPermission("jcbt:scholarshipApplication:add")
     @Log(title = "奖学金申请记录", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping
@@ -85,7 +87,7 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 修改奖学金申请记录
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:edit")
+    @SaCheckPermission("jcbt:scholarshipApplication:edit")
     @Log(title = "奖学金申请记录", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping
@@ -116,22 +118,22 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 删除奖学金申请记录
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:remove")
+    @SaCheckPermission("jcbt:scholarshipApplication:remove")
     @Log(title = "奖学金申请记录", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     @Operation(summary = "删除奖学金申请记录")
-    public R<Void> remove(@Parameter(description = "主键串") @PathVariable Long[] ids) {
+    public R<Void> remove(@Parameter(description = "主键串") @PathVariable("ids") Long[] ids) {
         return toAjax(applicationService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 获取可申请的奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:available")
+    @SaCheckPermission("jcbt:scholarshipApplication:available")
     @GetMapping("/available")
     @Operation(summary = "获取可申请的奖学金类型列表")
-    public R<List<Map<String, Object>>> getAvailableScholarshipTypes(@Parameter(description = "班级ID") @RequestParam Long classId,
-                                                                     @Parameter(description = "批次ID") @RequestParam Long batchId) {
+    public R<List<Map<String, Object>>> getAvailableScholarshipTypes(@Parameter(description = "班级ID") @RequestParam("classId") Long classId,
+                                                                     @Parameter(description = "批次ID") @RequestParam("batchId") Long batchId) {
         return R.ok(applicationService.queryAvailableScholarshipTypes(classId, batchId));
     }
 
@@ -140,49 +142,52 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 查询我的申请记录（班主任）
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:my")
+    @SaCheckPermission("jcbt:scholarshipApplication:my")
     @GetMapping("/my")
     @Operation(summary = "查询我的申请记录")
-    public R<List<JcbtScholarshipApplicationVo>> getMyApplications(@Parameter(description = "申请人ID") @RequestParam Long applicantId,
-                                                                   @Parameter(description = "批次ID") @RequestParam(required = false) Long batchId) {
+    public R<List<JcbtScholarshipApplicationVo>> getMyApplications(@Parameter(description = "申请人ID") @RequestParam("applicantId") Long applicantId,
+                                                                   @Parameter(description = "批次ID") @RequestParam(value = "batchId", required = false) Long batchId) {
+        if (!StpUtil.hasPermission("jcbt:scholarshipApplication:list")) {
+            applicantId = LoginHelper.getUserId();
+        }
         return R.ok(applicationService.queryApplicationsByApplicant(applicantId, batchId));
     }
 
     /**
      * 查询待审核申请
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:pending")
+    @SaCheckPermission("jcbt:scholarshipApplication:pending")
     @GetMapping("/pending")
     @Operation(summary = "查询待审核申请")
-    public R<List<JcbtScholarshipApplicationVo>> getPendingApplications(@Parameter(description = "审核人ID") @RequestParam(required = false) Long reviewerId,
-                                                                        @Parameter(description = "申请状态") @RequestParam(required = false) String status) {
+    public R<List<JcbtScholarshipApplicationVo>> getPendingApplications(@Parameter(description = "审核人ID") @RequestParam(value = "reviewerId", required = false) Long reviewerId,
+                                                                        @Parameter(description = "申请状态") @RequestParam(value = "status", required = false) String status) {
         return R.ok(applicationService.queryPendingApplications(reviewerId, status));
     }
 
     /**
      * 检查学生申请资格
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:check")
+    @SaCheckPermission("jcbt:scholarshipApplication:check")
     @GetMapping("/check")
     @Operation(summary = "检查学生申请资格")
-    public R<Map<String, Object>> checkStudentEligibility(@Parameter(description = "学生ID") @RequestParam Long studentId,
-                                                          @Parameter(description = "批次ID") @RequestParam Long batchId,
-                                                          @Parameter(description = "奖学金类型ID") @RequestParam Long scholarshipTypeId) {
+    public R<Map<String, Object>> checkStudentEligibility(@Parameter(description = "学生ID") @RequestParam("studentId") Long studentId,
+                                                          @Parameter(description = "批次ID") @RequestParam("batchId") Long batchId,
+                                                          @Parameter(description = "奖学金类型ID") @RequestParam("scholarshipTypeId") Long scholarshipTypeId) {
         return R.ok(applicationService.checkStudentEligibility(studentId, batchId, scholarshipTypeId));
     }
 
     /**
      * 批量审核申请
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:approve")
+    @SaCheckPermission("jcbt:scholarshipApplication:approve")
     @Log(title = "批量审核奖学金申请", businessType = BusinessType.UPDATE)
     @PostMapping("/approve")
     @Operation(summary = "批量审核申请")
     public R<Void> batchApprove(@Parameter(description = "申请ID列表") @RequestBody @NotEmpty List<Long> applicationIds,
-                               @Parameter(description = "审核状态") @RequestParam String status,
-                               @Parameter(description = "审核人ID") @RequestParam Long reviewerId,
-                               @Parameter(description = "审核人姓名") @RequestParam String reviewerName,
-                               @Parameter(description = "审核意见") @RequestParam(required = false) String reviewComment) {
+                               @Parameter(description = "审核状态") @RequestParam("status") String status,
+                               @Parameter(description = "审核人ID") @RequestParam("reviewerId") Long reviewerId,
+                               @Parameter(description = "审核人姓名") @RequestParam("reviewerName") String reviewerName,
+                               @Parameter(description = "审核意见") @RequestParam(value = "reviewComment", required = false) String reviewComment) {
         return toAjax(applicationService.batchReviewApplications(applicationIds, status, reviewerId, reviewerName, reviewComment));
     }
 
@@ -191,7 +196,7 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 导出奖学金申请记录列表
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:export")
+    @SaCheckPermission("jcbt:scholarshipApplication:export")
     @Log(title = "奖学金申请记录", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     @Operation(summary = "导出奖学金申请记录列表")
@@ -203,7 +208,7 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 导入奖学金申请记录
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:import")
+    @SaCheckPermission("jcbt:scholarshipApplication:import")
     @Log(title = "奖学金申请记录", businessType = BusinessType.IMPORT)
     @PostMapping(value = "/import", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(summary = "导入奖学金申请记录")
@@ -222,24 +227,24 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 获取申请统计数据
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:statistics")
+    @SaCheckPermission("jcbt:scholarshipApplication:statistics")
     @GetMapping("/statistics")
     @Operation(summary = "获取申请统计数据")
-    public R<Map<String, Object>> getStatistics(@Parameter(description = "批次ID") @RequestParam(required = false) Long batchId,
-                                               @Parameter(description = "学院ID") @RequestParam(required = false) Long deptId) {
+    public R<Map<String, Object>> getStatistics(@Parameter(description = "批次ID") @RequestParam(value = "batchId", required = false) Long batchId,
+                                               @Parameter(description = "学院ID") @RequestParam(value = "deptId", required = false) Long deptId) {
         return R.ok(applicationService.getApplicationStatistics(batchId, deptId));
     }
 
     /**
      * 班主任批量申请提交
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:batch")
+    @SaCheckPermission("jcbt:scholarshipApplication:batch")
     @Log(title = "班主任批量申请提交", businessType = BusinessType.INSERT)
     @PostMapping("/batch")
     @Operation(summary = "班主任批量申请提交")
-    public R<Void> batchSubmitByTeacher(@Parameter(description = "批次ID") @RequestParam Long batchId,
-                                       @Parameter(description = "奖学金类型ID") @RequestParam Long scholarshipTypeId,
-                                       @Parameter(description = "班级ID") @RequestParam Long classId,
+    public R<Void> batchSubmitByTeacher(@Parameter(description = "批次ID") @RequestParam("batchId") Long batchId,
+                                       @Parameter(description = "奖学金类型ID") @RequestParam("scholarshipTypeId") Long scholarshipTypeId,
+                                       @Parameter(description = "班级ID") @RequestParam("classId") Long classId,
                                        @Parameter(description = "学生申请列表") @RequestBody @NotEmpty List<JcbtScholarshipApplicationBo> studentApplications) {
         return toAjax(applicationService.batchSubmitApplicationsByTeacher(batchId, scholarshipTypeId, classId, studentApplications));
     }
@@ -247,23 +252,23 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 提交申请
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:submit")
+    @SaCheckPermission("jcbt:scholarshipApplication:submit")
     @Log(title = "提交奖学金申请", businessType = BusinessType.UPDATE)
     @PostMapping("/{id}/submit")
     @Operation(summary = "提交申请")
-    public R<Void> submitApplication(@Parameter(description = "申请ID") @PathVariable @NotNull Long id) {
+    public R<Void> submitApplication(@Parameter(description = "申请ID") @PathVariable("id") @NotNull Long id) {
         return toAjax(applicationService.submitApplication(id));
     }
 
     /**
      * 撤回申请
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:withdraw")
+    @SaCheckPermission("jcbt:scholarshipApplication:withdraw")
     @Log(title = "撤回奖学金申请", businessType = BusinessType.UPDATE)
     @PostMapping("/{id}/withdraw")
     @Operation(summary = "撤回申请")
-    public R<Void> withdrawApplication(@Parameter(description = "申请ID") @PathVariable @NotNull Long id,
-                                      @Parameter(description = "撤回原因") @RequestParam(required = false) String reason) {
+    public R<Void> withdrawApplication(@Parameter(description = "申请ID") @PathVariable("id") @NotNull Long id,
+                                      @Parameter(description = "撤回原因") @RequestParam(value = "reason", required = false) String reason) {
         return toAjax(applicationService.withdrawApplication(id, reason));
     }
 
@@ -272,11 +277,11 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 获取班级名额使用情况
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:quota")
+    @SaCheckPermission("jcbt:scholarshipApplication:quota")
     @GetMapping("/quota")
     @Operation(summary = "获取班级名额使用情况")
-    public R<Map<String, Object>> getClassQuotaUsage(@Parameter(description = "班级ID") @RequestParam Long classId,
-                                                     @Parameter(description = "批次ID") @RequestParam Long batchId) {
+    public R<Map<String, Object>> getClassQuotaUsage(@Parameter(description = "班级ID") @RequestParam("classId") Long classId,
+                                                     @Parameter(description = "批次ID") @RequestParam("batchId") Long batchId) {
         return R.ok(applicationService.getClassQuotaUsage(classId, batchId));
     }
 
@@ -285,133 +290,54 @@ public class JcbtScholarshipApplicationController extends BaseController {
     /**
      * 获取班主任所带班级信息
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:classInfo")
+    @SaCheckPermission("jcbt:scholarshipApplication:classInfo")
     @GetMapping("/classInfo")
     @Operation(summary = "获取班主任所带班级信息")
-    public R<Map<String, Object>> getClassInfoByTeacher(@Parameter(description = "班主任ID") @RequestParam Long teacherId) {
+    public R<Map<String, Object>> getClassInfoByTeacher(@Parameter(description = "班主任ID") @RequestParam("teacherId") Long teacherId) {
         return R.ok(applicationService.getClassInfoByTeacher(teacherId));
     }
 
     /**
      * 获取班级学生列表（用于勾选）
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:students")
+    @SaCheckPermission("jcbt:scholarshipApplication:students")
     @GetMapping("/students")
     @Operation(summary = "获取班级学生列表")
-    public R<List<Map<String, Object>>> getClassStudents(@Parameter(description = "班级ID") @RequestParam Long classId) {
+    public R<List<Map<String, Object>>> getClassStudents(@Parameter(description = "班级ID") @RequestParam("classId") Long classId) {
         return R.ok(applicationService.getClassStudents(classId));
     }
 
     /**
      * 根据批次获取可申请的奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
+    @SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
     @GetMapping("/scholarshipTypes")
     @Operation(summary = "根据批次获取可申请的奖学金类型")
-    public R<List<Map<String, Object>>> getScholarshipTypesByBatch(@Parameter(description = "批次ID") @RequestParam Long batchId) {
+    public R<List<Map<String, Object>>> getScholarshipTypesByBatch(@Parameter(description = "批次ID") @RequestParam("batchId") Long batchId) {
         return R.ok(applicationService.getScholarshipTypesByBatch(batchId));
     }
 
     /**
      * 根据批次和班级获取带名额信息的奖学金类型（班主任专用）
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
+    @SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
     @GetMapping("/scholarshipTypesWithQuota")
     @Operation(summary = "根据批次和班级获取带名额信息的奖学金类型")
     public R<List<Map<String, Object>>> getScholarshipTypesWithQuota(
-            @Parameter(description = "批次ID") @RequestParam Long batchId,
-            @Parameter(description = "班级ID") @RequestParam Long classId) {
+            @Parameter(description = "批次ID") @RequestParam("batchId") Long batchId,
+            @Parameter(description = "班级ID") @RequestParam("classId") Long classId) {
         return R.ok(applicationService.getScholarshipTypesWithQuota(batchId, classId));
     }
 
     /**
      * 确认选择班级（多班级时用户选择后调用）
      */
-    //@SaCheckPermission("jcbt:scholarshipApplication:classInfo")
+    @SaCheckPermission("jcbt:scholarshipApplication:classInfo")
     @PostMapping("/confirmClass")
     @Operation(summary = "确认选择班级")
-    public R<Map<String, Object>> confirmClassSelection(@Parameter(description = "班主任ID") @RequestParam Long teacherId,
-                                                        @Parameter(description = "班级ID") @RequestParam Long classId) {
+    public R<Map<String, Object>> confirmClassSelection(@Parameter(description = "班主任ID") @RequestParam("teacherId") Long teacherId,
+                                                        @Parameter(description = "班级ID") @RequestParam("classId") Long classId) {
         return R.ok(applicationService.confirmClassSelection(teacherId, classId));
     }
 
-    /**
-     * 测试接口：获取奖学金类型数据结构
-     */
-    //@SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
-    @GetMapping("/test/scholarshipTypesStructure")
-    @Operation(summary = "测试接口：获取奖学金类型数据结构")
-    public R<Map<String, Object>> testScholarshipTypesStructure(@Parameter(description = "批次ID") @RequestParam Long batchId,
-                                                               @Parameter(description = "班级ID") @RequestParam(required = false) Long classId) {
-        Map<String, Object> result = new HashMap<>();
-        try {
-            if (classId != null) {
-                result.put("withQuota", applicationService.getScholarshipTypesWithQuota(batchId, classId));
-            }
-            result.put("withoutQuota", applicationService.getScholarshipTypesByBatch(batchId));
-            result.put("batchId", batchId);
-            result.put("classId", classId);
-            result.put("timestamp", System.currentTimeMillis());
-        } catch (Exception e) {
-            result.put("error", e.getMessage());
-        }
-        return R.ok(result);
-    }
-
-    /**
-     * 调试接口：详细SQL日志输出测试
-     */
-    //@SaCheckPermission("jcbt:scholarshipApplication:scholarshipTypes")
-    @GetMapping("/debug/sqlLogs")
-    @Operation(summary = "调试接口：详细SQL日志输出测试")
-    public R<Map<String, Object>> debugSqlLogs(@Parameter(description = "批次ID") @RequestParam Long batchId,
-                                              @Parameter(description = "班级ID") @RequestParam Long classId,
-                                              @Parameter(description = "奖学金类型ID（可选，测试单个类型）") @RequestParam(required = false) Long scholarshipTypeId) {
-        Map<String, Object> result = new HashMap<>();
-
-        try {
-            log.info("🚀 === SQL调试接口开始 ===");
-            log.info("📥 接收参数: batchId={}, classId={}, scholarshipTypeId={}", batchId, classId, scholarshipTypeId);
-
-            result.put("requestParams", Map.of(
-                "batchId", batchId,
-                "classId", classId,
-                "scholarshipTypeId", scholarshipTypeId
-            ));
-
-            // 如果指定了奖学金类型ID，则只测试该类型
-            if (scholarshipTypeId != null) {
-                log.info("🎯 单个奖学金类型测试模式");
-
-                // 测试班级名额查询
-                log.info("📊 开始测试班级名额查询");
-                var classQuota = applicationService.testClassQuotaQuery(classId, scholarshipTypeId, batchId);
-                result.put("classQuotaTest", classQuota);
-
-                // 测试全校名额查询
-                log.info("🏫 开始测试全校名额查询");
-                var schoolQuota = applicationService.testSchoolQuotaQuery(batchId, scholarshipTypeId);
-                result.put("schoolQuotaTest", schoolQuota);
-
-            } else {
-                log.info("📋 完整流程测试模式");
-                // 完整流程测试
-                var quotaResult = applicationService.getScholarshipTypesWithQuota(batchId, classId);
-                result.put("fullProcessTest", quotaResult);
-            }
-
-            result.put("status", "success");
-            result.put("timestamp", System.currentTimeMillis());
-
-            log.info("✅ === SQL调试接口完成 ===");
-
-        } catch (Exception e) {
-            log.error("❌ === SQL调试接口异常 ===", e);
-            result.put("status", "error");
-            result.put("error", e.getMessage());
-            result.put("stackTrace", e.getStackTrace());
-        }
-
-        return R.ok(result);
-    }
 }

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtScholarshipBatchController.java

@@ -41,7 +41,7 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 查询奖学金评定批次列表
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:list")
+    @SaCheckPermission("jcbt:scholarshipBatch:list")
     @GetMapping("/list")
     public TableDataInfo<JcbtScholarshipBatchVo> list(JcbtScholarshipBatchBo bo, PageQuery pageQuery) {
         return scholarshipBatchService.queryPageList(bo, pageQuery);
@@ -50,7 +50,7 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 导出奖学金评定批次列表
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:export")
+    @SaCheckPermission("jcbt:scholarshipBatch:export")
     @Log(title = "奖学金评定批次", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(JcbtScholarshipBatchBo bo, HttpServletResponse response) {
@@ -61,17 +61,17 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 获取奖学金评定批次详细信息
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/{id}")
     public R<JcbtScholarshipBatchVo> getInfo(@NotNull(message = "主键不能为空")
-                                            @PathVariable Long id) {
+                                            @PathVariable("id") Long id) {
         return R.ok(scholarshipBatchService.queryById(id));
     }
 
     /**
      * 新增奖学金评定批次
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:add")
+    @SaCheckPermission("jcbt:scholarshipBatch:add")
     @Log(title = "奖学金评定批次", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -82,7 +82,7 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 修改奖学金评定批次
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:edit")
+    @SaCheckPermission("jcbt:scholarshipBatch:edit")
     @Log(title = "奖学金评定批次", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -93,38 +93,38 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 删除奖学金评定批次
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:remove")
+    @SaCheckPermission("jcbt:scholarshipBatch:remove")
     @Log(title = "奖学金评定批次", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(scholarshipBatchService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 根据批次编码查询批次信息
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/getByCode/{batchCode}")
-    public R<JcbtScholarshipBatchVo> getByBatchCode(@PathVariable String batchCode) {
+    public R<JcbtScholarshipBatchVo> getByBatchCode(@PathVariable("batchCode") String batchCode) {
         return R.ok(scholarshipBatchService.queryByBatchCode(batchCode));
     }
 
     /**
      * 根据学年和学期查询批次列表
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/getByAcademicYear")
     public R<List<JcbtScholarshipBatchVo>> getByAcademicYearAndSemester(
-            @RequestParam String academicYear,
-            @RequestParam(required = false) Integer semester) {
+            @RequestParam("academicYear") String academicYear,
+            @RequestParam(value = "semester", required = false) Integer semester) {
         return R.ok(scholarshipBatchService.queryByAcademicYearAndSemester(academicYear, semester));
     }
 
     /**
      * 查询启用状态的批次列表
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/getActiveBatches")
     public R<List<JcbtScholarshipBatchVo>> getActiveBatches() {
         return R.ok(scholarshipBatchService.queryActiveBatches());
@@ -133,27 +133,27 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 检查批次编码是否唯一
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/checkBatchCodeUnique")
-    public R<Boolean> checkBatchCodeUnique(@RequestParam String batchCode,
-                                          @RequestParam(required = false) Long id) {
+    public R<Boolean> checkBatchCodeUnique(@RequestParam("batchCode") String batchCode,
+                                          @RequestParam(value = "id", required = false) Long id) {
         return R.ok(scholarshipBatchService.checkBatchCodeUnique(batchCode, id));
     }
 
     /**
      * 更改批次状态
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:edit")
+    @SaCheckPermission("jcbt:scholarshipBatch:edit")
     @Log(title = "奖学金评定批次", businessType = BusinessType.UPDATE)
     @PutMapping("/changeStatus")
-    public R<Void> changeStatus(@RequestParam Long id, @RequestParam String status) {
+    public R<Void> changeStatus(@RequestParam("id") Long id, @RequestParam("status") String status) {
         return toAjax(scholarshipBatchService.changeStatus(id, status));
     }
 
     /**
      * 查询当前进行中的批次
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/getCurrentActiveBatches")
     public R<List<JcbtScholarshipBatchVo>> getCurrentActiveBatches() {
         return R.ok(scholarshipBatchService.queryCurrentActiveBatches());
@@ -162,16 +162,16 @@ public class JcbtScholarshipBatchController extends BaseController {
     /**
      * 根据状态查询批次列表
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @GetMapping("/getByStatus/{status}")
-    public R<List<JcbtScholarshipBatchVo>> getByStatus(@PathVariable String status) {
+    public R<List<JcbtScholarshipBatchVo>> getByStatus(@PathVariable("status") String status) {
         return R.ok(scholarshipBatchService.queryByStatus(status));
     }
 
     /**
      * 检查批次时间是否有冲突
      */
-    //@SaCheckPermission("jcbt:scholarshipBatch:query")
+    @SaCheckPermission("jcbt:scholarshipBatch:query")
     @PostMapping("/checkTimeConflict")
     public R<Boolean> checkTimeConflict(@RequestBody JcbtScholarshipBatchBo bo) {
         return R.ok(scholarshipBatchService.checkTimeConflict(bo));

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtScholarshipQuotaController.java

@@ -41,7 +41,7 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 查询奖学金名额分配列表
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:list")
+    @SaCheckPermission("jcbt:scholarshipQuota:list")
     @GetMapping("/list")
     public TableDataInfo<JcbtScholarshipQuotaVo> list(JcbtScholarshipQuotaBo bo, PageQuery pageQuery) {
         return scholarshipQuotaService.queryPageList(bo, pageQuery);
@@ -50,9 +50,9 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 查询指定批次的名额分配列表
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:list")
+    @SaCheckPermission("jcbt:scholarshipQuota:list")
     @GetMapping("/listByBatch/{batchId}")
-    public R<List<JcbtScholarshipQuotaVo>> listByBatch(@PathVariable Long batchId) {
+    public R<List<JcbtScholarshipQuotaVo>> listByBatch(@PathVariable("batchId") Long batchId) {
         List<JcbtScholarshipQuotaVo> list = scholarshipQuotaService.queryListByBatchId(batchId);
         return R.ok(list);
     }
@@ -60,10 +60,10 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 查询指定批次和奖学金类型的名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:list")
+    @SaCheckPermission("jcbt:scholarshipQuota:list")
     @GetMapping("/listByBatchAndType")
-    public R<List<JcbtScholarshipQuotaVo>> listByBatchAndType(@RequestParam Long batchId,
-                                                              @RequestParam Long scholarshipTypeId) {
+    public R<List<JcbtScholarshipQuotaVo>> listByBatchAndType(@RequestParam("batchId") Long batchId,
+                                                              @RequestParam("scholarshipTypeId") Long scholarshipTypeId) {
         List<JcbtScholarshipQuotaVo> list = scholarshipQuotaService.queryListByBatchAndType(batchId, scholarshipTypeId);
         return R.ok(list);
     }
@@ -71,10 +71,10 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 查询名额分配树形结构
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:list")
+    @SaCheckPermission("jcbt:scholarshipQuota:list")
     @GetMapping("/tree")
-    public R<List<JcbtScholarshipQuotaVo>> tree(@RequestParam Long batchId,
-                                                @RequestParam Long scholarshipTypeId) {
+    public R<List<JcbtScholarshipQuotaVo>> tree(@RequestParam("batchId") Long batchId,
+                                                @RequestParam("scholarshipTypeId") Long scholarshipTypeId) {
         List<JcbtScholarshipQuotaVo> tree = scholarshipQuotaService.queryQuotaTree(batchId, scholarshipTypeId);
         return R.ok(tree);
     }
@@ -82,9 +82,9 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 查询名额使用统计
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:list")
+    @SaCheckPermission("jcbt:scholarshipQuota:list")
     @GetMapping("/statistics/{batchId}")
-    public R<Map<String, Object>> statistics(@PathVariable Long batchId) {
+    public R<Map<String, Object>> statistics(@PathVariable("batchId") Long batchId) {
         Map<String, Object> statistics = scholarshipQuotaService.queryQuotaUsageStatistics(batchId);
         return R.ok(statistics);
     }
@@ -92,7 +92,7 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 导出奖学金名额分配列表
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:export")
+    @SaCheckPermission("jcbt:scholarshipQuota:export")
     @Log(title = "导出奖学金名额分配", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(JcbtScholarshipQuotaBo bo, HttpServletResponse response) {
@@ -103,16 +103,16 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 获取奖学金名额分配详细信息
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:query")
+    @SaCheckPermission("jcbt:scholarshipQuota:query")
     @GetMapping("/{id}")
-    public R<JcbtScholarshipQuotaVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<JcbtScholarshipQuotaVo> getInfo(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(scholarshipQuotaService.queryById(id));
     }
 
     /**
      * 新增奖学金名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:add")
+    @SaCheckPermission("jcbt:scholarshipQuota:add")
     @Log(title = "新增奖学金名额分配", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -123,7 +123,7 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 修改奖学金名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:edit")
+    @SaCheckPermission("jcbt:scholarshipQuota:edit")
     @Log(title = "修改奖学金名额分配", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -134,17 +134,17 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 删除奖学金名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:remove")
+    @SaCheckPermission("jcbt:scholarshipQuota:remove")
     @Log(title = "删除奖学金名额分配", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
-    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable Long[] ids) {
+    public R<Void> remove(@NotEmpty(message = "主键不能为空") @PathVariable("ids") Long[] ids) {
         return toAjax(scholarshipQuotaService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 批量删除奖学金名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:remove")
+    @SaCheckPermission("jcbt:scholarshipQuota:remove")
     @Log(title = "批量删除奖学金名额分配", businessType = BusinessType.DELETE)
     @DeleteMapping("/batch")
     public R<Void> batchRemove(@RequestBody @NotEmpty(message = "主键不能为空") List<Long> ids) {
@@ -154,23 +154,23 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 清空指定批次和奖学金类型的名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:remove")
+    @SaCheckPermission("jcbt:scholarshipQuota:remove")
     @Log(title = "清空奖学金名额分配", businessType = BusinessType.DELETE)
     @DeleteMapping("/clear")
-    public R<Void> clearQuotaByBatchAndType(@RequestParam Long batchId,
-                                           @RequestParam(required = false) Long scholarshipTypeId) {
+    public R<Void> clearQuotaByBatchAndType(@RequestParam("batchId") Long batchId,
+                                           @RequestParam(value = "scholarshipTypeId", required = false) Long scholarshipTypeId) {
         return toAjax(scholarshipQuotaService.clearQuotaByBatchAndType(batchId, scholarshipTypeId));
     }
 
     /**
      * 批量分配名额
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:add")
+    @SaCheckPermission("jcbt:scholarshipQuota:add")
     @Log(title = "批量分配奖学金名额", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/batchAllocate")
-    public R<Void> batchAllocate(@RequestParam Long batchId,
-                                @RequestParam Long scholarshipTypeId,
+    public R<Void> batchAllocate(@RequestParam("batchId") Long batchId,
+                                @RequestParam("scholarshipTypeId") Long scholarshipTypeId,
                                 @RequestBody List<JcbtScholarshipQuotaBo> quotaAllocations) {
         return toAjax(scholarshipQuotaService.batchAllocateQuota(batchId, scholarshipTypeId, quotaAllocations));
     }
@@ -178,49 +178,49 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 调整名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:edit")
+    @SaCheckPermission("jcbt:scholarshipQuota:edit")
     @Log(title = "调整奖学金名额分配", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/adjust")
-    public R<Void> adjustQuota(@RequestParam Long fromQuotaId,
-                              @RequestParam Long toQuotaId,
-                              @RequestParam Integer adjustAmount,
-                              @RequestParam String reason) {
+    public R<Void> adjustQuota(@RequestParam("fromQuotaId") Long fromQuotaId,
+                              @RequestParam("toQuotaId") Long toQuotaId,
+                              @RequestParam("adjustAmount") Integer adjustAmount,
+                              @RequestParam("reason") String reason) {
         return toAjax(scholarshipQuotaService.adjustQuotaAllocation(fromQuotaId, toQuotaId, adjustAmount, reason));
     }
 
     /**
      * 锁定/解锁名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:edit")
+    @SaCheckPermission("jcbt:scholarshipQuota:edit")
     @Log(title = "锁定/解锁奖学金名额分配", businessType = BusinessType.UPDATE)
     @PutMapping("/lock/{id}")
-    public R<Void> lockQuota(@PathVariable Long id, @RequestParam Integer isLocked) {
+    public R<Void> lockQuota(@PathVariable("id") Long id, @RequestParam("isLocked") Integer isLocked) {
         return toAjax(scholarshipQuotaService.lockQuotaAllocation(id, isLocked));
     }
 
     /**
      * 自动分配名额
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:edit")
+    @SaCheckPermission("jcbt:scholarshipQuota:edit")
     @Log(title = "自动分配奖学金名额", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/autoAllocate")
-    public R<Void> autoAllocate(@RequestParam Long batchId,
-                               @RequestParam Long scholarshipTypeId,
-                               @RequestParam String allocationRule) {
+    public R<Void> autoAllocate(@RequestParam("batchId") Long batchId,
+                               @RequestParam("scholarshipTypeId") Long scholarshipTypeId,
+                               @RequestParam("allocationRule") String allocationRule) {
         return toAjax(scholarshipQuotaService.autoAllocateQuota(batchId, scholarshipTypeId, allocationRule));
     }
 
     /**
      * 复制名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:add")
+    @SaCheckPermission("jcbt:scholarshipQuota:add")
     @Log(title = "复制奖学金名额分配", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping("/copy")
-    public R<Void> copyQuota(@RequestParam Long sourceBatchId,
-                            @RequestParam Long targetBatchId,
+    public R<Void> copyQuota(@RequestParam("sourceBatchId") Long sourceBatchId,
+                            @RequestParam("targetBatchId") Long targetBatchId,
                             @RequestBody List<Long> scholarshipTypeIds) {
         return toAjax(scholarshipQuotaService.copyQuotaFromBatch(sourceBatchId, targetBatchId, scholarshipTypeIds));
     }
@@ -228,17 +228,17 @@ public class JcbtScholarshipQuotaController extends BaseController {
     /**
      * 更新名额使用情况
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:edit")
+    @SaCheckPermission("jcbt:scholarshipQuota:edit")
     @Log(title = "更新奖学金名额使用情况", businessType = BusinessType.UPDATE)
     @PutMapping("/updateUsage/{id}")
-    public R<Void> updateUsage(@PathVariable Long id, @RequestParam Integer usedChange) {
+    public R<Void> updateUsage(@PathVariable("id") Long id, @RequestParam("usedChange") Integer usedChange) {
         return toAjax(scholarshipQuotaService.updateQuotaUsage(id, usedChange));
     }
 
     /**
      * 验证名额分配
      */
-    //@SaCheckPermission("jcbt:scholarshipQuota:query")
+    @SaCheckPermission("jcbt:scholarshipQuota:query")
     @PostMapping("/validate")
     public R<String> validate(@RequestBody JcbtScholarshipQuotaBo bo) {
         String validationMsg = scholarshipQuotaService.validateQuotaAllocation(bo);

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtScholarshipReviewController.java

@@ -41,7 +41,7 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 查询奖学金审核记录列表
      */
-    //@SaCheckPermission("jcbt:review:list")
+    @SaCheckPermission("jcbt:review:list")
     @GetMapping("/list")
     public TableDataInfo<JcbtScholarshipReviewVo> list(JcbtScholarshipReviewBo bo, PageQuery pageQuery) {
         return reviewService.queryPageList(bo, pageQuery);
@@ -50,7 +50,7 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 导出奖学金审核记录列表
      */
-    //@SaCheckPermission("jcbt:review:export")
+    @SaCheckPermission("jcbt:review:export")
     @Log(title = "奖学金审核记录", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(JcbtScholarshipReviewBo bo, HttpServletResponse response) {
@@ -61,10 +61,10 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 获取奖学金审核记录详细信息
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/{id}")
     public R<JcbtScholarshipReviewVo> getInfo(@NotNull(message = "主键不能为空")
-                                              @PathVariable Long id) {
+                                              @PathVariable("id") Long id) {
         return R.ok(reviewService.queryById(id));
     }
 
@@ -75,23 +75,23 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 根据申请ID查询审核记录
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/application/{applicationId}")
     public R<List<JcbtScholarshipReviewVo>> getReviewsByApplicationId(
-            @NotNull(message = "申请ID不能为空") @PathVariable Long applicationId) {
+            @NotNull(message = "申请ID不能为空") @PathVariable("applicationId") Long applicationId) {
         return R.ok(reviewService.queryReviewsByApplicationId(applicationId));
     }
 
     /**
      * 查询当前用户待审核的记录
      */
-    //@SaCheckPermission("jcbt:review:pending")
+    @SaCheckPermission("jcbt:review:pending")
     @GetMapping("/pending")
     public TableDataInfo<JcbtScholarshipReviewVo> getPendingReviews(
-            @RequestParam(required = false) Long reviewerId,
-            @RequestParam(required = false) String reviewLevel,
-            @RequestParam(required = false) String applicationNo,
-            @RequestParam(required = false) String studentName,
+            @RequestParam(value = "reviewerId", required = false) Long reviewerId,
+            @RequestParam(value = "reviewLevel", required = false) String reviewLevel,
+            @RequestParam(value = "applicationNo", required = false) String applicationNo,
+            @RequestParam(value = "studentName", required = false) String studentName,
             PageQuery pageQuery) {
         return reviewService.queryPendingReviews(reviewerId, reviewLevel, applicationNo, studentName, pageQuery);
     }
@@ -99,14 +99,14 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 查询审核历史记录
      */
-    //@SaCheckPermission("jcbt:review:history")
+    @SaCheckPermission("jcbt:review:history")
     @GetMapping("/history")
     public TableDataInfo<JcbtScholarshipReviewVo> getReviewHistory(
-            @RequestParam(required = false) Long reviewerId,
-            @RequestParam(required = false) String reviewResult,
-            @RequestParam(required = false) Long batchId,
-            @RequestParam(required = false) String startTime,
-            @RequestParam(required = false) String endTime,
+            @RequestParam(value = "reviewerId", required = false) Long reviewerId,
+            @RequestParam(value = "reviewResult", required = false) String reviewResult,
+            @RequestParam(value = "batchId", required = false) Long batchId,
+            @RequestParam(value = "startTime", required = false) String startTime,
+            @RequestParam(value = "endTime", required = false) String endTime,
             PageQuery pageQuery) {
         return reviewService.queryReviewHistory(reviewerId, reviewResult, batchId, startTime, endTime, pageQuery);
     }
@@ -114,32 +114,32 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 提交审核结果
      */
-    //@SaCheckPermission("jcbt:review:approve")
+    @SaCheckPermission("jcbt:review:approve")
     @Log(title = "提交审核结果", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/submit")
     public R<Void> submitReview(
-            @NotNull(message = "审核记录ID不能为空") @RequestParam Long reviewId,
-            @NotEmpty(message = "审核结果不能为空") @RequestParam String reviewResult,
-            @RequestParam(required = false) String reviewOpinion,
-            @RequestParam(required = false) Double reviewScore,
-            @RequestParam(required = false) Long nextReviewerId) {
+            @NotNull(message = "审核记录ID不能为空") @RequestParam("reviewId") Long reviewId,
+            @NotEmpty(message = "审核结果不能为空") @RequestParam("reviewResult") String reviewResult,
+            @RequestParam(value = "reviewOpinion", required = false) String reviewOpinion,
+            @RequestParam(value = "reviewScore", required = false) Double reviewScore,
+            @RequestParam(value = "nextReviewerId", required = false) Long nextReviewerId) {
         return toAjax(reviewService.submitReview(reviewId, reviewResult, reviewOpinion, reviewScore, nextReviewerId));
     }
 
     /**
      * 批量审核
      */
-    //@SaCheckPermission("jcbt:review:batchApprove")
+    @SaCheckPermission("jcbt:review:batchApprove")
     @Log(title = "批量审核", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/batch")
     public R<Void> batchReview(
-            @NotEmpty(message = "审核记录ID列表不能为空") @RequestParam List<Long> reviewIds,
-            @NotEmpty(message = "审核结果不能为空") @RequestParam String reviewResult,
-            @RequestParam(required = false) String reviewOpinion,
-            @NotNull(message = "审核人ID不能为空") @RequestParam Long reviewerId,
-            @NotEmpty(message = "审核人姓名不能为空") @RequestParam String reviewerName) {
+            @NotEmpty(message = "审核记录ID列表不能为空") @RequestParam("reviewIds") List<Long> reviewIds,
+            @NotEmpty(message = "审核结果不能为空") @RequestParam("reviewResult") String reviewResult,
+            @RequestParam(value = "reviewOpinion", required = false) String reviewOpinion,
+            @NotNull(message = "审核人ID不能为空") @RequestParam("reviewerId") Long reviewerId,
+            @NotEmpty(message = "审核人姓名不能为空") @RequestParam("reviewerName") String reviewerName) {
         return toAjax(reviewService.batchReview(reviewIds, reviewResult, reviewOpinion, reviewerId, reviewerName));
     }
 
@@ -149,113 +149,113 @@ public class JcbtScholarshipReviewController extends BaseController {
     /**
      * 转移审核任务
      */
-    //@SaCheckPermission("jcbt:review:transfer")
+    @SaCheckPermission("jcbt:review:transfer")
     @Log(title = "转移审核任务", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/transfer")
     public R<Void> transferReview(
-            @NotNull(message = "审核记录ID不能为空") @RequestParam Long reviewId,
-            @NotNull(message = "新审核人ID不能为空") @RequestParam Long newReviewerId,
-            @NotEmpty(message = "新审核人姓名不能为空") @RequestParam String newReviewerName,
-            @RequestParam(required = false) String reason) {
+            @NotNull(message = "审核记录ID不能为空") @RequestParam("reviewId") Long reviewId,
+            @NotNull(message = "新审核人ID不能为空") @RequestParam("newReviewerId") Long newReviewerId,
+            @NotEmpty(message = "新审核人姓名不能为空") @RequestParam("newReviewerName") String newReviewerName,
+            @RequestParam(value = "reason", required = false) String reason) {
         return toAjax(reviewService.transferReview(reviewId, newReviewerId, newReviewerName, reason));
     }
 
     /**
      * 撤回审核结果
      */
-    //@SaCheckPermission("jcbt:review:revoke")
+    @SaCheckPermission("jcbt:review:revoke")
     @Log(title = "撤回审核结果", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/withdraw")
     public R<Void> withdrawReview(
-            @NotNull(message = "审核记录ID不能为空") @RequestParam Long reviewId,
-            @RequestParam(required = false) String reason) {
+            @NotNull(message = "审核记录ID不能为空") @RequestParam("reviewId") Long reviewId,
+            @RequestParam(value = "reason", required = false) String reason) {
         return toAjax(reviewService.withdrawReview(reviewId, reason));
     }
 
     /**
      * 查询某个申请的最新审核记录
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/latest/{applicationId}")
     public R<JcbtScholarshipReviewVo> getLatestReview(
-            @NotNull(message = "申请ID不能为空") @PathVariable Long applicationId) {
+            @NotNull(message = "申请ID不能为空") @PathVariable("applicationId") Long applicationId) {
         return R.ok(reviewService.queryLatestReviewByApplicationId(applicationId));
     }
 
     /**
      * 查询某个申请的指定级别审核记录
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/level/{applicationId}/{reviewLevel}")
     public R<JcbtScholarshipReviewVo> getReviewByLevel(
-            @NotNull(message = "申请ID不能为空") @PathVariable Long applicationId,
-            @NotEmpty(message = "审核级别不能为空") @PathVariable String reviewLevel) {
+            @NotNull(message = "申请ID不能为空") @PathVariable("applicationId") Long applicationId,
+            @NotEmpty(message = "审核级别不能为空") @PathVariable("reviewLevel") String reviewLevel) {
         return R.ok(reviewService.queryReviewByApplicationAndLevel(applicationId, reviewLevel));
     }
 
     /**
      * 统计审核数量
      */
-    //@SaCheckPermission("jcbt:review:statistics")
+    @SaCheckPermission("jcbt:review:statistics")
     @GetMapping("/statistics/count")
     public R<Map<String, Long>> getReviewCount(
-            @RequestParam(required = false) Long reviewerId,
-            @RequestParam(required = false) String reviewLevel,
-            @RequestParam(required = false) String reviewResult,
-            @RequestParam(required = false) Long batchId) {
+            @RequestParam(value = "reviewerId", required = false) Long reviewerId,
+            @RequestParam(value = "reviewLevel", required = false) String reviewLevel,
+            @RequestParam(value = "reviewResult", required = false) String reviewResult,
+            @RequestParam(value = "batchId", required = false) Long batchId) {
         return R.ok(reviewService.countReviewsByCondition(reviewerId, reviewLevel, reviewResult, batchId));
     }
 
     /**
      * 获取下一级审核人员列表
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/next-reviewers/{applicationId}/{currentLevel}")
     public R<List<Long>> getNextReviewers(
-            @NotNull(message = "申请ID不能为空") @PathVariable Long applicationId,
-            @NotEmpty(message = "当前审核级别不能为空") @PathVariable String currentLevel) {
+            @NotNull(message = "申请ID不能为空") @PathVariable("applicationId") Long applicationId,
+            @NotEmpty(message = "当前审核级别不能为空") @PathVariable("currentLevel") String currentLevel) {
         return R.ok(reviewService.getNextReviewers(applicationId, currentLevel));
     }
 
     /**
      * 审核流程推进
      */
-    //@SaCheckPermission("jcbt:review:approve")
+    @SaCheckPermission("jcbt:review:approve")
     @Log(title = "审核流程推进", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PostMapping("/advance")
     public R<Void> advanceReviewProcess(
-            @NotNull(message = "申请ID不能为空") @RequestParam Long applicationId,
-            @NotEmpty(message = "当前审核级别不能为空") @RequestParam String currentLevel,
-            @NotEmpty(message = "审核结果不能为空") @RequestParam String reviewResult,
-            @RequestParam(required = false) String reviewOpinion,
-            @RequestParam(required = false) Double reviewScore) {
+            @NotNull(message = "申请ID不能为空") @RequestParam("applicationId") Long applicationId,
+            @NotEmpty(message = "当前审核级别不能为空") @RequestParam("currentLevel") String currentLevel,
+            @NotEmpty(message = "审核结果不能为空") @RequestParam("reviewResult") String reviewResult,
+            @RequestParam(value = "reviewOpinion", required = false) String reviewOpinion,
+            @RequestParam(value = "reviewScore", required = false) Double reviewScore) {
         return toAjax(reviewService.advanceReviewProcess(applicationId, currentLevel, reviewResult, reviewOpinion, reviewScore));
     }
 
     /**
      * 检查用户审核权限
      */
-    //@SaCheckPermission("jcbt:review:query")
+    @SaCheckPermission("jcbt:review:query")
     @GetMapping("/permission")
     public R<Boolean> checkReviewPermission(
-            @NotNull(message = "审核人ID不能为空") @RequestParam Long reviewerId,
-            @NotEmpty(message = "审核级别不能为空") @RequestParam String reviewLevel,
-            @NotNull(message = "申请ID不能为空") @RequestParam Long applicationId) {
+            @NotNull(message = "审核人ID不能为空") @RequestParam("reviewerId") Long reviewerId,
+            @NotEmpty(message = "审核级别不能为空") @RequestParam("reviewLevel") String reviewLevel,
+            @NotNull(message = "申请ID不能为空") @RequestParam("applicationId") Long applicationId) {
         return R.ok(reviewService.checkReviewPermission(reviewerId, reviewLevel, applicationId));
     }
 
     /**
      * 获取审核统计信息
      */
-    //@SaCheckPermission("jcbt:review:statistics")
+    @SaCheckPermission("jcbt:review:statistics")
     @GetMapping("/statistics")
     public R<Map<String, Object>> getReviewStatistics(
-            @RequestParam(required = false) Long reviewerId,
-            @RequestParam(required = false) String reviewLevel,
-            @RequestParam(required = false) Long batchId) {
+            @RequestParam(value = "reviewerId", required = false) Long reviewerId,
+            @RequestParam(value = "reviewLevel", required = false) String reviewLevel,
+            @RequestParam(value = "batchId", required = false) Long batchId) {
         return R.ok(reviewService.getReviewStatistics(reviewerId, reviewLevel, batchId));
     }
 

backend/ruoyi-modules/ruoyi-jcbt/src/main/java/org/dromara/jcbt/controller/JcbtScholarshipTypeController.java

@@ -47,7 +47,7 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 查询奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:list")
+    @SaCheckPermission("jcbt:scholarshipType:list")
     @GetMapping("/list")
     public TableDataInfo<JcbtScholarshipTypeVo> list(JcbtScholarshipTypeBo bo, PageQuery pageQuery) {
         return scholarshipTypeService.queryPageList(bo, pageQuery);
@@ -56,7 +56,7 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 导出奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:export")
+    @SaCheckPermission("jcbt:scholarshipType:export")
     @Log(title = "奖学金类型", businessType = BusinessType.EXPORT)
     @PostMapping("/export")
     public void export(JcbtScholarshipTypeBo bo, HttpServletResponse response) {
@@ -67,17 +67,17 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 获取奖学金类型详细信息
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/{id}")
     public R<JcbtScholarshipTypeVo> getInfo(@NotNull(message = "主键不能为空")
-                                          @PathVariable Long id) {
+                                          @PathVariable("id") Long id) {
         return R.ok(scholarshipTypeService.queryById(id));
     }
 
     /**
      * 新增奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:add")
+    @SaCheckPermission("jcbt:scholarshipType:add")
     @Log(title = "奖学金类型", businessType = BusinessType.INSERT)
     @RepeatSubmit()
     @PostMapping()
@@ -88,7 +88,7 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 修改奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:edit")
+    @SaCheckPermission("jcbt:scholarshipType:edit")
     @Log(title = "奖学金类型", businessType = BusinessType.UPDATE)
     @RepeatSubmit()
     @PutMapping()
@@ -99,36 +99,36 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 删除奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:remove")
+    @SaCheckPermission("jcbt:scholarshipType:remove")
     @Log(title = "奖学金类型", businessType = BusinessType.DELETE)
     @DeleteMapping("/{ids}")
     public R<Void> remove(@NotEmpty(message = "主键不能为空")
-                          @PathVariable Long[] ids) {
+                          @PathVariable("ids") Long[] ids) {
         return toAjax(scholarshipTypeService.deleteWithValidByIds(List.of(ids), true));
     }
 
     /**
      * 根据类型名称查询奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/getByName/{typeName}")
-    public R<JcbtScholarshipTypeVo> getByTypeName(@PathVariable String typeName) {
+    public R<JcbtScholarshipTypeVo> getByTypeName(@PathVariable("typeName") String typeName) {
         return R.ok(scholarshipTypeService.queryByTypeName(typeName));
     }
 
     /**
      * 根据类别查询奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/getByCategory/{typeCategory}")
-    public R<List<JcbtScholarshipTypeVo>> getByCategory(@PathVariable String typeCategory) {
+    public R<List<JcbtScholarshipTypeVo>> getByCategory(@PathVariable("typeCategory") String typeCategory) {
         return R.ok(scholarshipTypeService.queryByCategory(typeCategory));
     }
 
     /**
      * 查询启用状态的奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/getActiveTypes")
     public R<List<JcbtScholarshipTypeVo>> getActiveTypes() {
         return R.ok(scholarshipTypeService.queryActiveTypes());
@@ -137,17 +137,17 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 检查奖学金名称是否重复
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/checkTypeNameUnique")
-    public R<Boolean> checkTypeNameUnique(@RequestParam String typeName,
-                                        @RequestParam(required = false) Long id) {
+    public R<Boolean> checkTypeNameUnique(@RequestParam("typeName") String typeName,
+                                        @RequestParam(value = "id", required = false) Long id) {
         return R.ok(scholarshipTypeService.checkTypeNameUnique(typeName, id));
     }
 
     /**
      * 批量更新排序号
      */
-    //@SaCheckPermission("jcbt:scholarshipType:edit")
+    @SaCheckPermission("jcbt:scholarshipType:edit")
     @Log(title = "奖学金类型", businessType = BusinessType.UPDATE)
     @PutMapping("/batchUpdateSort")
     public R<Void> batchUpdateSortOrder(@RequestBody List<JcbtScholarshipTypeBo> scholarshipTypes) {
@@ -157,26 +157,26 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 根据兼得类型查询相关奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/getByCompatibilityType/{compatibilityType}")
-    public R<List<JcbtScholarshipTypeVo>> getByCompatibilityType(@PathVariable String compatibilityType) {
+    public R<List<JcbtScholarshipTypeVo>> getByCompatibilityType(@PathVariable("compatibilityType") String compatibilityType) {
         return R.ok(scholarshipTypeService.queryByCompatibilityType(compatibilityType));
     }
 
     /**
      * 启用/停用奖学金类型
      */
-    //@SaCheckPermission("jcbt:scholarshipType:edit")
+    @SaCheckPermission("jcbt:scholarshipType:edit")
     @Log(title = "奖学金类型", businessType = BusinessType.UPDATE)
     @PutMapping("/changeStatus")
-    public R<Void> changeStatus(@RequestParam Long id, @RequestParam Integer status) {
+    public R<Void> changeStatus(@RequestParam("id") Long id, @RequestParam("status") Integer status) {
         return toAjax(scholarshipTypeService.changeStatus(id, status));
     }
 
     /**
      * 获取奖学金类型选项列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/options")
     public R<List<JcbtScholarshipTypeVo>> getOptions() {
         return R.ok(scholarshipTypeService.queryOptions());
@@ -185,9 +185,9 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 获取奖学金类型的兼得关系配置
      */
-    //@SaCheckPermission("jcbt:scholarshipType:compatibility")
+    @SaCheckPermission("jcbt:scholarshipType:compatibility")
     @GetMapping("/{id}/compatibility")
-    public R<Map<String, Object>> getCompatibilityConfig(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<Map<String, Object>> getCompatibilityConfig(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         // 获取所有启用的奖学金类型（除了当前奖学金）
         List<JcbtScholarshipTypeVo> allTypes = scholarshipTypeService.queryActiveTypes()
                 .stream()
@@ -224,10 +224,10 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 保存奖学金类型的兼得关系配置
      */
-    //@SaCheckPermission("jcbt:scholarshipType:compatibility")
+    @SaCheckPermission("jcbt:scholarshipType:compatibility")
     @Log(title = "奖学金兼得关系配置", businessType = BusinessType.UPDATE)
     @PostMapping("/{id}/compatibility")
-    public R<Void> saveCompatibilityConfig(@NotNull(message = "主键不能为空") @PathVariable Long id,
+    public R<Void> saveCompatibilityConfig(@NotNull(message = "主键不能为空") @PathVariable("id") Long id,
                                           @RequestBody Map<String, Object> config) {
         // 安全地转换互斥类型ID列表，支持前端传递的字符串或数字类型
         @SuppressWarnings("unchecked")
@@ -270,18 +270,18 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 检查两个奖学金类型是否兼容
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/checkCompatibility")
-    public R<Boolean> checkCompatibility(@RequestParam Long typeId1, @RequestParam Long typeId2) {
+    public R<Boolean> checkCompatibility(@RequestParam("typeId1") Long typeId1, @RequestParam("typeId2") Long typeId2) {
         return R.ok(compatibilityService.checkCompatibility(typeId1, typeId2));
     }
 
     /**
      * 获取可与指定奖学金兼得的奖学金类型列表
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/{id}/compatibleTypes")
-    public R<List<JcbtScholarshipTypeVo>> getCompatibleTypes(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<List<JcbtScholarshipTypeVo>> getCompatibleTypes(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         List<Long> compatibleTypeIds = compatibilityService.getCompatibleTypeIds(id);
         List<JcbtScholarshipTypeVo> compatibleTypes = new ArrayList<>();
 
@@ -298,9 +298,9 @@ public class JcbtScholarshipTypeController extends BaseController {
     /**
      * 获取奖学金类型的互斥关系显示文本
      */
-    //@SaCheckPermission("jcbt:scholarshipType:query")
+    @SaCheckPermission("jcbt:scholarshipType:query")
     @GetMapping("/{id}/exclusiveRelationDisplay")
-    public R<String> getExclusiveRelationDisplay(@NotNull(message = "主键不能为空") @PathVariable Long id) {
+    public R<String> getExclusiveRelationDisplay(@NotNull(message = "主键不能为空") @PathVariable("id") Long id) {
         return R.ok(scholarshipTypeService.getExclusiveRelationDisplay(id));
     }