autumn/jsowell-charger-web
1
0
Fork 0
mirror of https://codeup.aliyun.com/67c68d4e484ca2f0a13ac3c1/ydc/jsowell-charger-web.git synced 2026-07-23 15:41:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

增强待办路由安全和查询索引

Browse Source
This commit is contained in:
jsowell
2026-07-17 18:12:53 +08:00
parent fd678c9ab3
commit 1bffb95b18
6 changed files with 208 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
jsowell-admin/src/main/resources/application.yml
View File

@@ -214,3 +214,9 @@ sms:
enable: false
host: 127.0.0.1
port: 8080
# 待办中心
todo:
operator-admin-role-id: 3
retention-days: 180
route-whitelist: invoiceDetail,financeDetail

24
jsowell-admin/src/test/java/com/jsowell/system/service/TodoTaskServiceImplTest.java
View File

@@ -118,13 +118,35 @@ class TodoTaskServiceImplTest {
assertThrows(ServiceException.class, () -> service.complete(20L, 8L, "tester"));
}
@Test
void createTask_shouldRejectRouteOutsideWhitelist() {
SysTodoTaskMapper mapper = mock(SysTodoTaskMapper.class);
TodoTaskServiceImpl service = newService(mapper);
TodoTaskCreateCommand command = createCommand();
command.setRouteName("UnsafeRoute");
assertThrows(ServiceException.class, () -> service.createTask(command));
verify(mapper, never()).insertTodoTask(any(SysTodoTask.class));
}
@Test
void createTask_shouldRejectNestedRouteParams() {
SysTodoTaskMapper mapper = mock(SysTodoTaskMapper.class);
TodoTaskServiceImpl service = newService(mapper);
TodoTaskCreateCommand command = createCommand();
command.setRouteParams("{\"query\":{\"payload\":{\"admin\":true}}}");
assertThrows(ServiceException.class, () -> service.createTask(command));
verify(mapper, never()).insertTodoTask(any(SysTodoTask.class));
}
private static TodoTaskCreateCommand createCommand() {
return TodoTaskCreateCommand.builder()
.taskType("INVOICE_REVIEW")
.title("充电订单开票申请")
.businessType("INVOICE_APPLY")
.businessId("100")
.routeName("InvoiceApplyDetail")
.routeName("invoiceDetail")
.assigneeUserId(8L)
.idempotentKey("INVOICE:100:8")
.createBy("tester")