|
|
@@ -2540,7 +2540,8 @@ async function createGuestbook(input,current) {
|
|
|
}
|
|
|
async function authorizeRequestedUser(current, requestedId) {
|
|
|
const targetId = number(requestedId || ownLegacyId(current)); if (!targetId) fail(400, '缺少用户 ID'); if (isAdminUser(current) || targetId === ownLegacyId(current)) return targetId;
|
|
|
- const fields = await fieldsOf('_User'); const target = await findByLegacyId('_User', fields, targetId, ['legacyUserId','userid','num']); const agent = target && target.get('agent'); if (!target || !agent || agent.id !== current.id) fail(403, '无权查看该学员的业务记录'); return targetId;
|
|
|
+ const fields = await fieldsOf('_User'); const target = await findByLegacyId('_User', fields, targetId, ['legacyUserId','userid','num']); const agent = target && target.get('agent'); if (target && agent && agent.id === current.id) return targetId;
|
|
|
+ return appLearningTarget(current, targetId);
|
|
|
}
|
|
|
async function authorizeBusinessRow(current, row, subjectFields, actorFields = []) {
|
|
|
if (isAdminUser(current)) return; const ownId = ownLegacyId(current); const allIds = subjectFields.concat(actorFields).map((name) => number(row[name] ?? row[name.toLowerCase()] ?? row[name.toUpperCase()])).filter(Boolean); if (allIds.includes(ownId)) return;
|