bug_fix:

1. 修正了获取周报列表时，控制访问范围的bug

pmr-biz-manager/src/routes/api/prj/member/get_list.ts

@@ -1,6 +1,6 @@
 import {IApiProcessor, ICachedData, IMethodParams, IRequest} from "@core/Defined";
 import {Resp} from "@util/Resp";
-import {QueryTypes, WhereOptions} from "sequelize";
+import {QueryTypes} from "sequelize";
 import DataCURD, {ISQLReplacements} from "@core/DataCURD";
 import {AcsUserInfo} from "@core-models/AcsUserInfo";
 import {PrjMembers} from "@core-models/PrjMembers";
@@ -11,11 +11,10 @@ interface IData {
      * 项目id
      */
     prj_id: string;
-    [property: string]: any;
 }
 
 
-function get_list(json: IRequest, params: IMethodParams, cached_data: ICachedData): Promise<any> {
+function get_list(json: IRequest, _params: IMethodParams, _cached_data: ICachedData): Promise<any> {
     return new Promise<any>(async (resolve, reject) => {
         try {
             let data = <IData>json.data;

pmr-biz-manager/src/routes/api/prj/week_report/add.ts

@@ -9,8 +9,10 @@ import "dayjs/locale/zh-cn";
 import weekOfYear from 'dayjs/plugin/weekOfYear';
 import {PrjFile} from "@core-models/PrjFile";
 import {is_project_member} from "@src/utils/prj_premission_helper";
+
 dayjs.locale("zh-cn");
 dayjs.extend(weekOfYear);
+
 interface IData {
     /**
      * 多个附件的object name数组
@@ -42,7 +44,7 @@ function existsGuard(json: IRequest, cached_data: ICachedData): Promise<void> {
         if (!prj) return reject(Resp.gen_err(Resp.ResourceNotFound, '项目不存在'));
         // 检查用户是否是本项目的负责人或成员
         if (!await is_project_member(cached_data.user_id, prj.id)) {
-            return reject(Resp.gen_err(Resp.Forbidden, '您不是项目成员，无法创建项目周报。'));
+            return reject(Resp.gen_err(Resp.Forbidden, '您不是本项目的项目成员，无法创建项目周报。'));
         }
         resolve();
     });
@@ -53,8 +55,17 @@ function add(json: IRequest, params: IMethodParams, cached_data: ICachedData): P
         let t = await PrjInfo.sequelize!.transaction();
         try {
             let data = <IData>json.data;
-            let week = dayjs().week();
-            let report = await PrjWeekReport.findOne({where: {prj_id: data.prj_id, week: week, reporter_id: cached_data.user_id}, transaction: t});
+            let date = dayjs();
+            let week = date.week();
+            let year = date.year();
+            let report = await PrjWeekReport.findOne({
+                where: {
+                    prj_id: data.prj_id,
+                    year: year,
+                    week: week,
+                    reporter_id: cached_data.user_id
+                }, transaction: t
+            });
             if (report) throw Resp.gen_err(Resp.DataExists, '您的本周周报已创建，不可重复创建。');
             let id = IdGen.id();
             let value: any = {
@@ -66,7 +77,7 @@ function add(json: IRequest, params: IMethodParams, cached_data: ICachedData): P
                 created_at: dayjs().format('YYYY-MM-DD HH:mm:ss'),
                 reporter_id: cached_data.user_id,
                 year: dayjs().year(),
-                month: dayjs().month()+1,
+                month: dayjs().month() + 1,
                 week: week,
                 begin_from: dayjs().day(1).format('YYYY-MM-DD'),
                 end_to: dayjs().day(7).format('YYYY-MM-DD')

pmr-biz-manager/src/routes/api/prj/week_report/get_list.ts

@@ -5,7 +5,7 @@ import DataCURD, {ISQLReplacements} from "@core/DataCURD";
 import {AcsUserInfo} from "@core-models/AcsUserInfo";
 import {PrjInfo} from "@core-models/PrjInfo";
 import {PrjWeekReport} from "@core-models/PrjWeekReport";
-import {is_project_leader, is_project_privileged_account} from "@src/utils/prj_premission_helper";
+import {is_project_privileged_account} from "@src/utils/prj_premission_helper";
 
 
 interface IData {
@@ -69,14 +69,13 @@ function get_list(json: IRequest, params: IMethodParams, cached_data: ICachedDat
                 from ${PrjWeekReport.table_name} report
                 left join ${PrjInfo.table_name} prj on prj.id = report.prj_id
                 left join ${AcsUserInfo.table_name} reporter on reporter.id = report.reporter_id
-                where prj.id = :prj_id 
+                where 1=1
             `;
-            let replacements: ISQLReplacements = {prj_id: data.prj_id};
+            let replacements: ISQLReplacements = {};
 
-            // 如果是项目经理或特权人员，可以看到全部周报，否则只能看到自己的周报
-            if (!await is_project_privileged_account(cached_data.user_id)&&
-                !await is_project_leader(cached_data.user_id, data.prj_id)) {
-                condition += ` and reporter.id = :reporter_id `;
+            // 如果不是特权人员，则项目负责人只能看到所负责的项目的周报，普通成员只能看到自己的周报
+            if (!await is_project_privileged_account(cached_data.user_id)) {
+                condition += ` and (prj.leader_id = :reporter_id or reporter.id = :reporter_id) `;
                 replacements.reporter_id = cached_data.user_id;
             }
 
@@ -191,8 +190,7 @@ const v1_0: IApiProcessor = {
                 "title": "请求参数内容",
                 "required": [
                     "page_no",
-                    "page_size",
-                    "prj_id"
+                    "page_size"
                 ]
             },
             "ver": {

pmr-biz-manager/src/routes/api/prj/week_report/remove.ts

@@ -22,10 +22,10 @@ function statusGuard(json: IRequest, cached_data: ICachedData): Promise<void> {
         if (!report) return reject(Resp.gen_err(Resp.ResourceNotFound));
         if (report.reporter_id !== user) return reject(Resp.gen_err(Resp.Forbidden, '只允许删除自己的周报。'));
 
-        if (report.year !== dayjs().year() || report.month !== dayjs().month() || report.week !== dayjs().week()){
+        if (report.year !== dayjs().year() || report.week !== dayjs().week()) {
             return reject(Resp.gen_err(Resp.InvalidFlow, '只允许删除本周的周报。'));
         }
-        if (report.status > 0 ) return reject(Resp.gen_err(Resp.InvalidFlow, '周报已提交，不允许删除，在未审阅前可撤回后再删除。'));
+        if (report.status > 0) return reject(Resp.gen_err(Resp.InvalidFlow, '周报已提交，不允许删除，在未审阅前可撤回后再删除。'));
 
         resolve();
     });
@@ -35,7 +35,10 @@ async function remove(json: IRequest, _params: IMethodParams, _cached_data: ICac
     let data = <IData>json.data;
     let t = await PrjWeekReport.sequelize!.transaction();
     try {
-        let attachments = await PrjFile.findAll({where: {dependent_id: data.id, category_id: 'week_report'}, raw: true});
+        let attachments = await PrjFile.findAll({
+            where: {dependent_id: data.id, category_id: 'week_report'},
+            raw: true
+        });
 
         let oss = Oss.get_instance('pmr-doc');
         for (let file of attachments) {