# feat: 用户资料接口改为本人+admin权限（含coach），修复密码更新不生效与管理员重置

src/main/java/space/anyi/serve/controller/UserController.java

@@ -21,6 +21,7 @@ import space.anyi.serve.entity.PageVo;
 import space.anyi.serve.entity.Response;
 import space.anyi.serve.entity.user.*;
 import space.anyi.serve.service.UserService;
+import space.anyi.serve.util.SecurityUtils;
 
 import java.util.List;
 import java.util.stream.Collectors;
@@ -93,9 +94,10 @@ public class UserController {
      * @return 单条数据
      */
     @Operation(summary = "查询用户详情", security = @SecurityRequirement(name = "openApiSecurityScheme"))
-    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user')")
+    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user', 'ROLE_coach')")
     @GetMapping("{id}")
     public Response<UserVo> queryById(@Parameter(description = "用户ID") @NotBlank(message = "用户ID不能为空") @PathVariable String id) {
+        assertSelfOrAdmin(id);
         User user = this.userService.queryById(Long.valueOf(id));
         return Response.ok(UserVo.form(user));
     }
@@ -166,9 +168,10 @@ public class UserController {
      * @return
      */
     @Operation(summary = "更新用户头像", security = @SecurityRequirement(name = "openApiSecurityScheme"))
-    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user')")
+    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user', 'ROLE_coach')")
     @PutMapping("/updateAvatar")
     public Response updateUserAvatar(@Valid@RequestBody UpdateUserAvatarDto dto){
+        assertSelfOrAdmin(dto.getId());
         User user = new User();
         BeanUtils.copyProperties(dto,user);
         user.setId(Long.valueOf(dto.getId()));
@@ -181,14 +184,23 @@ public class UserController {
      * @return
      */
     @Operation(summary = "更新用户密码", security = @SecurityRequirement(name = "openApiSecurityScheme"))
-    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user')")
+    @PreAuthorize("hasAnyRole('ROLE_admin', 'ROLE_user', 'ROLE_coach')")
     @PutMapping("/updatePassword")
     public Response updatePassword(@Valid @RequestBody UpdateUserPasswordDto dto){
+        assertSelfOrAdmin(dto.getId());
         User user = new User();
         BeanUtils.copyProperties(dto,user);
         user.setId(Long.valueOf(dto.getId()));
         return Response.ok(userService.updatePassword(user,dto.getOldPassword()));
     }
 
+    private void assertSelfOrAdmin(String id) {
+        Long targetId = Long.valueOf(id);
+        if (!User.ROLE_ADMIN.equals(SecurityUtils.getCurrentRole())
+                && !targetId.equals(SecurityUtils.getCurrentUserId())) {
+            throw new IllegalArgumentException("只能操作自己的账号");
+        }
+    }
+
 }
 

src/main/java/space/anyi/serve/service/impl/UserServiceImpl.java

@@ -15,6 +15,7 @@ import space.anyi.serve.entity.auth.AuthTokenVo;
 import space.anyi.serve.entity.user.User;
 import space.anyi.serve.mapper.UserMapper;
 import space.anyi.serve.service.UserService;
+import space.anyi.serve.util.SecurityUtils;
 
 import java.util.List;
 import java.util.Objects;
@@ -79,7 +80,11 @@ public class UserServiceImpl extends ServiceImpl<UserMapper,User> implements Use
     @Override
     public Boolean updatePassword(User user, String oldPassword) {
         User user1 = getById(user.getId());
-        if (!passwordEncoder.matches(oldPassword, user1.getPassword())) {
+        if (user1 == null) {
+            return false;
+        }
+        if (!User.ROLE_ADMIN.equals(SecurityUtils.getCurrentRole())
+                && (oldPassword == null || !passwordEncoder.matches(oldPassword, user1.getPassword()))) {
             return false;
         }
         return update(user);
@@ -93,6 +98,9 @@ public class UserServiceImpl extends ServiceImpl<UserMapper,User> implements Use
      */
     @Override
     public Boolean insert(User user) {
+        if (user.getPassword() != null) {
+            user.setPassword(passwordEncoder.encode(user.getPassword()));
+        }
         return save(user);
     }
 
@@ -104,13 +112,17 @@ public class UserServiceImpl extends ServiceImpl<UserMapper,User> implements Use
      */
     @Override
     public Boolean update(User user) {
+        if (user.getPassword() != null) {
+            user.setPassword(passwordEncoder.encode(user.getPassword()));
+        }
         LambdaUpdateWrapper<User> updateWrapper = new LambdaUpdateWrapper<User>()
                 .eq(User::getId, user.getId())
                 .set(Objects.nonNull(user.getAccount()),User::getAccount, user.getAccount())
                 .set(Objects.nonNull(user.getUsername()),User::getUsername, user.getUsername())
                 .set(Objects.nonNull(user.getAvatar()), User::getAvatar,user.getAvatar())
                 .set(Objects.nonNull(user.getRole()),User::getRole, user.getRole())
-                .set(Objects.nonNull(user.getEnable()),User::getEnable, user.getEnable());
+                .set(Objects.nonNull(user.getEnable()),User::getEnable, user.getEnable())
+                .set(Objects.nonNull(user.getPassword()),User::getPassword, user.getPassword());
         return this.update(updateWrapper);
     }
 

src/main/java/space/anyi/serve/util/SecurityUtils.java

@@ -4,6 +4,7 @@ import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import space.anyi.serve.entity.auth.JwtUserPrincipal;
+import space.anyi.serve.entity.user.User;
 
 public final class SecurityUtils {
 
@@ -39,4 +40,9 @@ public final class SecurityUtils {
         }
         return null;
     }
+
+    public static boolean isStaff() {
+        String role = getCurrentRole();
+        return User.ROLE_COACH.equals(role) || User.ROLE_ADMIN.equals(role);
+    }
 }