添加权限控制

client-api/src/main/java/org/jiayunet/aop/FuncPermissionAspect.java

@@ -41,7 +41,13 @@ public class FuncPermissionAspect {
     @Around("@annotation(funcPermission)")
     public Object check(ProceedingJoinPoint joinPoint, FuncPermission funcPermission) throws Throwable {
 
-        Long userId = UserSecurityTool.getUserId();
+        Long userId = 0L;
+        try {
+            userId = UserSecurityTool.getUserId();
+        } catch (Exception e) {
+            // 接口允许不登录，未登录用户ID为0
+        }
+
         String funcCode = funcPermission.value();
         String bizKey = resolveBizKey(joinPoint, funcPermission.key());
 

client-api/src/main/java/org/jiayunet/controller/JobController.java

@@ -1,6 +1,7 @@
 package org.jiayunet.controller;
 
 import lombok.AllArgsConstructor;
+import org.jiayunet.annotation.FuncPermission;
 import org.jiayunet.pojo.PageResult;
 import org.jiayunet.pojo.dto.job.JobApplicationDto;
 import org.jiayunet.pojo.dto.job.JobDetailDto;
@@ -32,6 +33,7 @@ public class JobController {
      * <p>支持按地区/岗位类型/行业/工作类型筛选，自动排除不感兴趣的岗位/公司/地区/行业，返回匹配度和收藏状态</p>
      */
     @PostMapping("/list")
+    @FuncPermission(value = "job_list", key = "#param.pageNum")
     public PageResult<JobDto> listJobs(@Validated @RequestBody JobQueryParam param) {
 
         Long userId = 0L;
@@ -50,6 +52,7 @@ public class JobController {
      * <p>返回岗位完整信息、公司信息、匹配度、收藏状态</p>
      */
     @GetMapping("/detail")
+    @FuncPermission(value = "job_detail", key = "#jobId")
     public JobDetailDto getJobDetail(@RequestParam Long jobId) {
 
         Long userId = 0L;

client-api/src/main/java/org/jiayunet/controller/RecruitAnnouncementController.java

@@ -1,6 +1,7 @@
 package org.jiayunet.controller;
 
 import lombok.AllArgsConstructor;
+import org.jiayunet.annotation.FuncPermission;
 import org.jiayunet.pojo.PageResult;
 import org.jiayunet.pojo.dto.recruitAnnouncement.RecruitAnnouncementDetailDto;
 import org.jiayunet.pojo.dto.recruitAnnouncement.RecruitAnnouncementDto;
@@ -48,6 +49,7 @@ public class RecruitAnnouncementController {
 
     /** 分页查询公告列表 */
     @PostMapping("/page")
+    @FuncPermission(value = "ann_list", key = "#param.pageNum")
     public PageResult<RecruitAnnouncementDto> pageAnnouncement(@Validated @RequestBody RecruitAnnouncementQueryParam param) {
         return recruitAnnouncementService.pageAnnouncement(param);
     }
@@ -60,24 +62,28 @@ public class RecruitAnnouncementController {
 
     /** 查询公告详情 */
     @GetMapping("/detail")
+    @FuncPermission(value = "ann_detail", key = "#id")
     public RecruitAnnouncementDetailDto getDetail(@RequestParam Long id) {
         return recruitAnnouncementService.getDetail(id);
     }
 
     /** 根据公告id查询公告地址 */
     @GetMapping("/announcementUrl")
+    @FuncPermission(value = "ann_url", key = "#id")
     public String getAnnouncementUrl(@RequestParam Long id) {
         return recruitAnnouncementService.getAnnouncementUrl(id);
     }
 
     /** 根据公告id查询岗位投递地址 */
     @GetMapping("/applyUrl")
+    @FuncPermission(value = "ann_url", key = "#id")
     public String getApplyUrl(@RequestParam Long id) {
         return recruitAnnouncementService.getApplyUrl(id);
     }
 
     /** 根据公告id查询投递邮箱 */
     @GetMapping("/applyEmail")
+    @FuncPermission(value = "ann_url", key = "#id")
     public String getApplyEmail(@RequestParam Long id) {
         return recruitAnnouncementService.getApplyEmail(id);
     }