feat: restrict expert post list + edit ownership

build.gradle

@@ -34,6 +34,10 @@ dependencies {
     developmentOnly 'org.springframework.boot:spring-boot-devtools'
     implementation 'org.postgresql:postgresql'
     implementation 'io.jsonwebtoken:jjwt-api:0.12.6'
+    implementation platform('software.amazon.awssdk:bom:2.20.151')
+    implementation 'software.amazon.awssdk:s3'
+    implementation 'software.amazon.awssdk:s3-transfer-manager'
+    implementation 'software.amazon.awssdk:sts'
     runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.12.6'
     runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.12.6'
     annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'

src/main/java/space/anyi/serve/controller/PostController.java

@@ -39,11 +39,16 @@ public class PostController {
             @RequestParam(defaultValue = "10") int pageSize,
             Authentication authentication) {
         Long userId = null;
+        Long expertId = null;
         if (authentication != null && authentication.isAuthenticated()) {
             JwtUserDetails details = (JwtUserDetails) authentication.getPrincipal();
-            userId = details.getUser().getId();
+            User currentUser = details.getUser();
+            userId = currentUser.getId();
+            if ("expert".equals(currentUser.getRole())) {
+                expertId = currentUser.getId();
+            }
         }
-        Page<PostVo> page = postService.listPosts(keyword, status, pageNum, pageSize, userId);
+        Page<PostVo> page = postService.listPosts(keyword, status, pageNum, pageSize, userId, expertId);
         return Response.ok(new PageVo<>(page.getTotal(), page.getRecords()));
     }
 
@@ -99,10 +104,21 @@ public class PostController {
         return Response.ok();
     }
 
-    @Operation(summary = "更新帖子（管理员）")
-    @PreAuthorize("hasRole('ROLE_admin')")
+    @Operation(summary = "更新帖子（管理员/本人）")
     @PutMapping("{id}")
-    public Response<Void> updatePost(@PathVariable Long id, @Valid @RequestBody PostDto dto) {
+    public Response<Void> updatePost(@PathVariable Long id, @Valid @RequestBody PostDto dto, Authentication authentication) {
+        JwtUserDetails details = (JwtUserDetails) authentication.getPrincipal();
+        User currentUser = userService.queryById(details.getUser().getId());
+
+        Post existing = postService.getById(id);
+        if (existing == null) return Response.error("帖子不存在");
+
+        boolean isAdmin = "admin".equals(currentUser.getRole());
+        boolean isOwner = existing.getExpertId().equals(currentUser.getId());
+        if (!isAdmin && !isOwner) {
+            return Response.error("无权编辑此帖子");
+        }
+
         Post post = new Post();
         post.setTitle(dto.getTitle());
         post.setContentIntro(dto.getContentIntro());

src/main/java/space/anyi/serve/service/PostService.java

@@ -6,7 +6,7 @@ import space.anyi.serve.entity.post.Post;
 import space.anyi.serve.entity.post.PostVo;
 
 public interface PostService extends IService<Post> {
-    Page<PostVo> listPosts(String keyword, String status, int pageNum, int pageSize, Long currentUserId);
+    Page<PostVo> listPosts(String keyword, String status, int pageNum, int pageSize, Long currentUserId, Long expertId);
     PostVo getPostDetail(Long id, Long currentUserId);
     Long createPost(Post post);
     void updateHitStatus(Long id, String hitStatus);

src/main/java/space/anyi/serve/service/impl/PostServiceImpl.java

@@ -36,7 +36,7 @@ public class PostServiceImpl extends ServiceImpl<PostMapper, Post> implements Po
     }
 
     @Override
-    public Page<PostVo> listPosts(String keyword, String status, int pageNum, int pageSize, Long currentUserId) {
+    public Page<PostVo> listPosts(String keyword, String status, int pageNum, int pageSize, Long currentUserId, Long expertId) {
         Page<Post> page = new Page<>(pageNum, pageSize);
         LambdaQueryWrapper<Post> wrapper = new LambdaQueryWrapper<Post>()
                 .eq(Post::getDeleteFlag, 0);
@@ -45,6 +45,10 @@ public class PostServiceImpl extends ServiceImpl<PostMapper, Post> implements Po
             wrapper.like(Post::getTitle, keyword);
         }
 
+        if (expertId != null) {
+            wrapper.eq(Post::getExpertId, expertId);
+        }
+
         LocalDateTime now = LocalDateTime.now();
         if ("on_sale".equals(status)) {
             wrapper.gt(Post::getExpireTime, now);