权限相关调整

SimpleAdmin.Application/Services/Onboarding/Audit/OnboardingAuditService.cs

@@ -9,16 +9,19 @@ public class OnboardingAuditService : IOnboardingAuditService
     private readonly IConfigService _config;
     private readonly IOnboardingContractSnapshotService _snapshotService;
     private readonly IOnboardingEmployeeContractSnapshotService _employeeContractSnapshotService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
     public OnboardingAuditService(
         IConfigService config,
         IOnboardingContractSnapshotService snapshotService,
-        IOnboardingEmployeeContractSnapshotService employeeContractSnapshotService)
+        IOnboardingEmployeeContractSnapshotService employeeContractSnapshotService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _config = config;
         _snapshotService = snapshotService;
         _employeeContractSnapshotService = employeeContractSnapshotService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -79,8 +82,9 @@ public class OnboardingAuditService : IOnboardingAuditService
         employee.ExtraInfoJson = global::System.Text.Json.JsonSerializer.Serialize(employeeInfo);
         employee.Status = CommonStatusConst.ENABLE;
         employee.CreateTime = DateTime.Now;
-        employee.CreateUserId = UserManager.UserId;
+        // 员工档案归属于原任务创建人，而不是执行审核的人。
-        employee.CreateUser = UserManager.Name;
+        employee.CreateUserId = task.CreateUserId;
+        employee.CreateUser = task.CreateUser;
         employee.UpdateTime = null;
         employee.UpdateUserId = null;
         employee.UpdateUser = null;
@@ -106,6 +110,27 @@ public class OnboardingAuditService : IOnboardingAuditService
 
             await _snapshotService.Build(task.Id, employeeInfo);
             await _db.Insertable(employee).ExecuteCommandAsync();
+
+            // 全局插入审计会把 CreateUserId 设置为当前审核人。管理员代审核他人任务时，
+            // 员工档案仍应归属于原任务创建人，否则普通人事将无法继续维护自己发起的员工。
+            if (task.CreateUserId.HasValue && task.CreateUserId != UserManager.UserId)
+            {
+                await _db.Updateable<ObEmployee>()
+                    .SetColumns(item => new ObEmployee
+                    {
+                        CreateUserId = task.CreateUserId,
+                        CreateUser = task.CreateUser
+                    })
+                    .Where(item => item.Id == employee.Id)
+                    .ExecuteCommandAsync();
+
+                var ownerPersisted = await _db.Queryable<ObEmployee>()
+                    .AnyAsync(item => item.Id == employee.Id
+                                      && item.CreateUserId == task.CreateUserId);
+                if (!ownerPersisted)
+                    throw Oops.Bah("员工档案创建人归属保存失败，请稍后重试");
+            }
+
             await _employeeContractSnapshotService.Build(employee.Id, task.Id);
 
             task.EmployeeId = employee.Id;
@@ -171,6 +196,15 @@ public class OnboardingAuditService : IOnboardingAuditService
             throw Oops.Bah("当前任务不在审核中");
         }
 
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
+
+        // 人事管理员/超级管理员可处理全部任务；普通人事还必须属于配置的审核人。
+        if (await _dataPermission.CanManage(null, OnboardingPermissionCodes.TaskManageAll))
+            return task;
+
         var config = await _config.GetByConfigKey(CateGoryConst.CONFIG_BIZ_DEFINE, "onboard.reviewer.userIds")
             ?? throw Oops.Bah("请配置入职审核人");
         // 审核人由全局配置与公司专属配置合并得出，不依赖独立业务表。

SimpleAdmin.Application/Services/Onboarding/Common/IOnboardingDataPermissionService.cs

@@ -0,0 +1,13 @@
+namespace SimpleAdmin.Application;
+
+/// <summary>
+/// 入职业务数据操作权限校验。
+/// </summary>
+public interface IOnboardingDataPermissionService : ITransient
+{
+    Task<bool> CanManage(long? createUserId, string manageAllPermissionCode);
+
+    Task EnsureCanManage(long? createUserId, string manageAllPermissionCode, string dataName);
+
+    Task EnsureCanManage(IEnumerable<long?> createUserIds, string manageAllPermissionCode, string dataName);
+}

SimpleAdmin.Application/Services/Onboarding/Common/OnboardingDataPermissionService.cs

@@ -0,0 +1,50 @@
+namespace SimpleAdmin.Application;
+
+/// <summary>
+/// 入职业务数据操作权限校验。
+/// 普通人事可查看全部业务数据，但只能操作本人创建的数据；拥有模块“管理全部”按钮权限的人员可操作全部数据。
+/// </summary>
+public class OnboardingDataPermissionService : IOnboardingDataPermissionService
+{
+    private readonly ISysUserService _sysUserService;
+
+    public OnboardingDataPermissionService(ISysUserService sysUserService)
+    {
+        _sysUserService = sysUserService;
+    }
+
+    public async Task<bool> CanManage(long? createUserId, string manageAllPermissionCode)
+    {
+        if (UserManager.SuperAdmin)
+            return true;
+
+        if (createUserId.HasValue && createUserId.Value == UserManager.UserId)
+            return true;
+
+        var buttonCodes = await _sysUserService.GetButtonCodeList(UserManager.UserId);
+        return buttonCodes.Contains(manageAllPermissionCode);
+    }
+
+    public async Task EnsureCanManage(long? createUserId, string manageAllPermissionCode, string dataName)
+    {
+        if (!await CanManage(createUserId, manageAllPermissionCode))
+            throw Oops.Bah($"只能操作本人创建的{dataName}");
+    }
+
+    public async Task EnsureCanManage(
+        IEnumerable<long?> createUserIds,
+        string manageAllPermissionCode,
+        string dataName)
+    {
+        var owners = createUserIds.Distinct().ToList();
+        if (owners.Count == 0)
+            return;
+
+        if (UserManager.SuperAdmin || owners.All(id => id.HasValue && id.Value == UserManager.UserId))
+            return;
+
+        var buttonCodes = await _sysUserService.GetButtonCodeList(UserManager.UserId);
+        if (!buttonCodes.Contains(manageAllPermissionCode))
+            throw Oops.Bah($"所选数据中包含他人创建的{dataName}，不能操作");
+    }
+}

SimpleAdmin.Application/Services/Onboarding/Common/OnboardingPermissionCodes.cs

@@ -0,0 +1,13 @@
+namespace SimpleAdmin.Application;
+
+/// <summary>
+/// 入职业务按钮权限编码。
+/// </summary>
+public static class OnboardingPermissionCodes
+{
+    public const string SetupManageAll = "onboardingSetupManageAll";
+    public const string EntryConfigManageAll = "onboardingEntryConfigManageAll";
+    public const string ContractManageAll = "onboardingContractManageAll";
+    public const string TaskManageAll = "onboardingTaskManageAll";
+    public const string EmployeeManageAll = "onboardingEmployeeManageAll";
+}

SimpleAdmin.Application/Services/Onboarding/Company/OnboardingCompanyService.cs

@@ -5,6 +5,13 @@ namespace SimpleAdmin.Application;
 /// </summary>
 public class OnboardingCompanyService : DbRepository<ObCompany>, IOnboardingCompanyService
 {
+    private readonly IOnboardingDataPermissionService _dataPermission;
+
+    public OnboardingCompanyService(IOnboardingDataPermissionService dataPermission)
+    {
+        _dataPermission = dataPermission;
+    }
+
     /// <summary>
     /// 分页查询入职业务公司。
     /// </summary>
@@ -54,7 +61,11 @@ public class OnboardingCompanyService : DbRepository<ObCompany>, IOnboardingComp
     public async Task Edit(OnboardingCompanyEditInput input)
     {
         NormalizeAndValidateQiyuesuoConfig(input);
-        await Detail(new BaseIdInput { Id = input.Id });
+        var company = await Detail(new BaseIdInput { Id = input.Id });
+        await _dataPermission.EnsureCanManage(
+            company.CreateUserId,
+            OnboardingPermissionCodes.SetupManageAll,
+            "公司");
         await EnsureCodeUnique(input.CompanyCode, input.Id);
         await UpdateAsync(input.Adapt<ObCompany>());
     }
@@ -67,6 +78,16 @@ public class OnboardingCompanyService : DbRepository<ObCompany>, IOnboardingComp
         if (input.Ids.Count == 0)
             return;
 
+        var companies = await Context.Queryable<ObCompany>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (companies.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("公司不存在");
+        await _dataPermission.EnsureCanManage(
+            companies.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.SetupManageAll,
+            "公司");
+
         var hasPositions = await Context.Queryable<ObPosition>()
             .AnyAsync(it => input.Ids.Contains(it.CompanyId));
         if (hasPositions)

SimpleAdmin.Application/Services/Onboarding/ContractDocument/OnboardingContractDocumentService.cs

@@ -7,11 +7,15 @@ public class OnboardingContractDocumentService : IOnboardingContractDocumentServ
 {
     private readonly SqlSugarScope _db;
     private readonly IFileService _fileService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingContractDocumentService(IFileService fileService)
+    public OnboardingContractDocumentService(
+        IFileService fileService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _fileService = fileService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -298,6 +302,10 @@ public class OnboardingContractDocumentService : IOnboardingContractDocumentServ
             ?? throw Oops.Bah("任务合同不存在");
         var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(contract.TaskId)
             ?? throw Oops.Bah("入职任务不存在");
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
         var statusAllowsGeneration = task.TaskStatus == OnboardingTaskStatus.PendingFill
                                      || task.TaskStatus == OnboardingTaskStatus.Rejected
                                      || task.TaskStatus == OnboardingTaskStatus.Reviewing

SimpleAdmin.Application/Services/Onboarding/ContractTemplate/OnboardingContractTemplateService.cs

@@ -6,10 +6,14 @@ namespace SimpleAdmin.Application;
 public class OnboardingContractTemplateService : DbRepository<ObContractTemplate>, IOnboardingContractTemplateService
 {
     private readonly IFileService _fileService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingContractTemplateService(IFileService fileService)
+    public OnboardingContractTemplateService(
+        IFileService fileService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _fileService = fileService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -122,7 +126,11 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
     /// </summary>
     public async Task Edit(OnboardingContractTemplateEditInput input)
     {
-        await Detail(new BaseIdInput { Id = input.Id });
+        var template = await Detail(new BaseIdInput { Id = input.Id });
+        await _dataPermission.EnsureCanManage(
+            template.CreateUserId,
+            OnboardingPermissionCodes.ContractManageAll,
+            "合同模板");
         NormalizeInput(input);
         await ValidateBusinessScope(input.CompanyId, input.DepartmentId, input.PositionIds);
         await ValidateReferencedOnboardingTemplates(input);
@@ -156,6 +164,16 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
         if (input.Ids.Count == 0)
             return;
 
+        var templates = await Context.Queryable<ObContractTemplate>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (templates.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("合同模板不存在");
+        await _dataPermission.EnsureCanManage(
+            templates.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.ContractManageAll,
+            "合同模板");
+
         var hasOnboardingTemplates = await Context.Queryable<ObOnboardingTemplateContract>()
             .AnyAsync(it => input.Ids.Contains(it.ContractTemplateId));
         if (hasOnboardingTemplates)
@@ -209,6 +227,7 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
     {
         var version = await Context.Queryable<ObContractTemplateVersion>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("合同版本不存在");
+        await EnsureTemplateCanManage(version.TemplateId);
 
         var isUsedInOnboardingTemplate = await Context.Queryable<ObOnboardingTemplateContract>()
             .AnyAsync(it => it.ContractTemplateVersionId == version.Id);
@@ -258,7 +277,11 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
     /// </summary>
     public async Task AddVersion(OnboardingContractVersionAddInput input)
     {
-        await Detail(new BaseIdInput { Id = input.TemplateId });
+        var template = await Detail(new BaseIdInput { Id = input.TemplateId });
+        await _dataPermission.EnsureCanManage(
+            template.CreateUserId,
+            OnboardingPermissionCodes.ContractManageAll,
+            "合同模板");
         var file = await Context.Queryable<SysFile>().InSingleAsync(input.SourceDocxFileId)
             ?? throw Oops.Bah("DOCX 源文件不存在");
         if (!string.Equals(file.Suffix, "docx", StringComparison.OrdinalIgnoreCase))
@@ -337,6 +360,7 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
 
         var version = await Context.Queryable<ObContractTemplateVersion>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("模板版本不存在");
+        await EnsureTemplateCanManage(version.TemplateId);
 
         if (input.VersionStatus == ContractTemplateVersionStatus.Enabled)
         {
@@ -374,6 +398,11 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
         if (!string.Equals(variable.VariableCode, input.VariableCode, StringComparison.Ordinal))
             throw Oops.Bah("DOCX 占位符编码由系统识别，不能修改");
 
+        var version = await Context.Queryable<ObContractTemplateVersion>()
+            .InSingleAsync(variable.TemplateVersionId)
+            ?? throw Oops.Bah("模板版本不存在");
+        await EnsureTemplateCanManage(version.TemplateId);
+
         var isUsedInTask = await Context.Queryable<ObTaskContract>()
             .AnyAsync(it => it.TemplateVersionId == input.TemplateVersionId);
         if (isUsedInTask)
@@ -384,6 +413,16 @@ public class OnboardingContractTemplateService : DbRepository<ObContractTemplate
         await Context.Updateable(entity).ExecuteCommandAsync();
     }
 
+    private async Task EnsureTemplateCanManage(long templateId)
+    {
+        var template = await Context.Queryable<ObContractTemplate>().InSingleAsync(templateId)
+            ?? throw Oops.Bah("合同模板不存在");
+        await _dataPermission.EnsureCanManage(
+            template.CreateUserId,
+            OnboardingPermissionCodes.ContractManageAll,
+            "合同模板");
+    }
+
     private static ObTemplateVariable BuildDetectedVariable(long versionId, string code, ObVariableDefinition def, int index)
     {
         var separatorIndex = code.IndexOf('.');

SimpleAdmin.Application/Services/Onboarding/Department/OnboardingDepartmentService.cs

@@ -5,6 +5,13 @@
 /// </summary>
 public class OnboardingDepartmentService : DbRepository<ObDepartment>, IOnboardingDepartmentService
 {
+    private readonly IOnboardingDataPermissionService _dataPermission;
+
+    public OnboardingDepartmentService(IOnboardingDataPermissionService dataPermission)
+    {
+        _dataPermission = dataPermission;
+    }
+
     /// <summary>
     /// 分页查询入职业务部门。
     /// </summary>
@@ -78,6 +85,10 @@ public class OnboardingDepartmentService : DbRepository<ObDepartment>, IOnboardi
     {
         NormalizeInput(input);
         var department = await Detail(new BaseIdInput { Id = input.Id });
+        await _dataPermission.EnsureCanManage(
+            department.CreateUserId,
+            OnboardingPermissionCodes.SetupManageAll,
+            "部门");
         await EnsureCompanyCanChange(department, input.CompanyId);
         await EnsureCompanyExists(input.CompanyId);
         await EnsureCodeUnique(input.CompanyId, input.DepartmentCode, input.Id);
@@ -92,6 +103,16 @@ public class OnboardingDepartmentService : DbRepository<ObDepartment>, IOnboardi
         if (input.Ids.Count == 0)
             return;
 
+        var departments = await Context.Queryable<ObDepartment>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (departments.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("部门不存在");
+        await _dataPermission.EnsureCanManage(
+            departments.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.SetupManageAll,
+            "部门");
+
         var hasPositions = await Context.Queryable<ObPosition>()
             .AnyAsync(it => it.DepartmentId.HasValue && input.Ids.Contains(it.DepartmentId.Value));
         if (hasPositions)

SimpleAdmin.Application/Services/Onboarding/ElectronicSign/OnboardingElectronicSignService.cs

@@ -17,20 +17,20 @@ public class OnboardingElectronicSignService : IOnboardingElectronicSignService
     private readonly IQiyuesuoClient _qiyuesuoClient;
     private readonly IOnboardingContractDocumentService _contractDocumentService;
     private readonly IFileService _fileService;
-    private readonly IConfigService _configService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
     private readonly QiyuesuoSettingOptions _setting;
 
     public OnboardingElectronicSignService(
         IQiyuesuoClient qiyuesuoClient,
         IOnboardingContractDocumentService contractDocumentService,
         IFileService fileService,
-        IConfigService configService)
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _qiyuesuoClient = qiyuesuoClient;
         _contractDocumentService = contractDocumentService;
         _fileService = fileService;
-        _configService = configService;
+        _dataPermission = dataPermission;
         _setting = App.GetConfig<QiyuesuoSettingOptions>(
                        "QiyuesuoSetting",
                        true)
@@ -41,7 +41,7 @@ public class OnboardingElectronicSignService : IOnboardingElectronicSignService
     public async Task<OnboardingElectronicSignDetailOutput> Detail(
         BaseIdInput input)
     {
-        var task = await GetAuthorizedTask(input.Id);
+        var task = await GetTask(input.Id);
         return await BuildDetail(task);
     }
 
@@ -290,7 +290,7 @@ public class OnboardingElectronicSignService : IOnboardingElectronicSignService
     public async Task<OnboardingElectronicSignPreviewOutput> PreviewEmployeeSignedDocument(
         OnboardingElectronicSignPreviewInput input)
     {
-        var task = await GetAuthorizedTask(input.TaskId);
+        var task = await GetTask(input.TaskId);
         var process = await GetRequiredProcess(task.Id);
 
         // 不信任前端缓存状态。每次预览前重新查询契约锁，确保员工确实已完成签署。
@@ -1247,24 +1247,24 @@ public class OnboardingElectronicSignService : IOnboardingElectronicSignService
     }
 
     /// <summary>
-    /// 电子签管理沿用入职审核人权限，不新增另一套权限来源。
+    /// 电子签操作遵循任务创建人/任务管理全部权限。
     /// </summary>
     private async Task<ObOnboardingTask> GetAuthorizedTask(long taskId)
     {
-        var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(taskId)
+        var task = await GetTask(taskId);
-            ?? throw Oops.Bah("入职任务不存在");
+        await _dataPermission.EnsureCanManage(
-        var config = await _configService.GetByConfigKey(
+            task.CreateUserId,
-                         CateGoryConst.CONFIG_BIZ_DEFINE,
+            OnboardingPermissionCodes.TaskManageAll,
-                         "onboard.reviewer.userIds")
+            "入职任务");
-                     ?? throw Oops.Bah("请配置入职审核人");
-        var reviewerIds = OnboardingReviewerConfigParser.Parse(
-            config.ConfigValue,
-            task.CompanyId);
-        if (!reviewerIds.Contains(UserManager.UserId))
-            throw Oops.Bah("您不是该入职任务的审核人");
         return task;
     }
 
+    private async Task<ObOnboardingTask> GetTask(long taskId)
+    {
+        return await _db.Queryable<ObOnboardingTask>().InSingleAsync(taskId)
+            ?? throw Oops.Bah("入职任务不存在");
+    }
+
     private async Task<ObElectronicSignProcess> GetLatestProcess(long taskId)
     {
         return await _db.Queryable<ObElectronicSignProcess>()

SimpleAdmin.Application/Services/Onboarding/Employee/OnboardingEmployeeService.cs

@@ -11,10 +11,12 @@ namespace SimpleAdmin.Application;
 public class OnboardingEmployeeService : IOnboardingEmployeeService
 {
     private readonly SqlSugarScope _db;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingEmployeeService()
+    public OnboardingEmployeeService(IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -184,6 +186,7 @@ public class OnboardingEmployeeService : IOnboardingEmployeeService
 
         var employee = await _db.Queryable<ObEmployee>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("员工档案不存在");
+        await EnsureEmployeeCanManage(employee);
         var before = CreateHrState(employee);
         var regularizationStatus = employee.RegularizationStatus;
         var regularizationDate = employee.RegularizationDate;
@@ -266,6 +269,7 @@ public class OnboardingEmployeeService : IOnboardingEmployeeService
 
         var employee = await _db.Queryable<ObEmployee>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("员工档案不存在");
+        await EnsureEmployeeCanManage(employee);
         if (employee.EmploymentType == EmployeeEmploymentType.PartTime)
             throw Oops.Bah("兼职员工不适用转正流程，请先调整用工类型");
         if (employee.RegularizationStatus == EmployeeRegularizationStatus.Regular)
@@ -360,6 +364,7 @@ public class OnboardingEmployeeService : IOnboardingEmployeeService
 
         var employee = await _db.Queryable<ObEmployee>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("员工档案不存在");
+        await EnsureEmployeeCanManage(employee);
         if (employee.RegularizationStatus != EmployeeRegularizationStatus.Regular)
             throw Oops.Bah("该员工当前不是已转正状态");
 
@@ -411,6 +416,14 @@ public class OnboardingEmployeeService : IOnboardingEmployeeService
     /// <summary>
     /// 查询员工来源任务中上传的全部材料，并补充原始文件名、后缀和文件大小。
     /// </summary>
+    private Task EnsureEmployeeCanManage(ObEmployee employee)
+    {
+        return _dataPermission.EnsureCanManage(
+            employee.CreateUserId,
+            OnboardingPermissionCodes.EmployeeManageAll,
+            "员工档案");
+    }
+
     private async Task<List<OnboardingTaskMaterialDetailOutput>> GetEmployeeMaterials(long? taskId)
     {
         if (!taskId.HasValue)

SimpleAdmin.Application/Services/Onboarding/EntryConfig/OnboardingEntryConfigService.cs

@@ -6,10 +6,12 @@ namespace SimpleAdmin.Application;
 public class OnboardingEntryConfigService : IOnboardingEntryConfigService
 {
     private readonly SqlSugarScope _db;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingEntryConfigService()
+    public OnboardingEntryConfigService(IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -55,10 +57,15 @@ public class OnboardingEntryConfigService : IOnboardingEntryConfigService
 
         if (input.Id.HasValue)
         {
-            var exists = await _db.Queryable<ObFormField>().AnyAsync(x => x.Id == input.Id.Value);
+            var exists = await _db.Queryable<ObFormField>().InSingleAsync(input.Id.Value)
-            if (!exists)
+                ?? throw Oops.Bah("字段不存在");
-                throw Oops.Bah("字段不存在");
+            await _dataPermission.EnsureCanManage(
-
+                exists.CreateUserId,
+                OnboardingPermissionCodes.EntryConfigManageAll,
+                "入职字段");
+            entity.CreateUserId = exists.CreateUserId;
+            entity.CreateUser = exists.CreateUser;
+            entity.CreateTime = exists.CreateTime;
             await _db.Updateable(entity).ExecuteCommandAsync();
             return;
         }
@@ -95,6 +102,16 @@ public class OnboardingEntryConfigService : IOnboardingEntryConfigService
         if (input.Ids.Count == 0)
             return;
 
+        var fields = await _db.Queryable<ObFormField>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (fields.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("字段不存在");
+        await _dataPermission.EnsureCanManage(
+            fields.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.EntryConfigManageAll,
+            "入职字段");
+
         var isReferenced = await _db.Queryable<ObFormRequirement>()
             .AnyAsync(x => input.Ids.Contains(x.FieldId));
         var isReferencedByTemplate = await _db.Queryable<ObOnboardingTemplateFormField>()
@@ -145,10 +162,15 @@ public class OnboardingEntryConfigService : IOnboardingEntryConfigService
 
         if (input.Id.HasValue)
         {
-            var exists = await _db.Queryable<ObMaterialType>().AnyAsync(x => x.Id == input.Id.Value);
+            var exists = await _db.Queryable<ObMaterialType>().InSingleAsync(input.Id.Value)
-            if (!exists)
+                ?? throw Oops.Bah("资料类型不存在");
-                throw Oops.Bah("资料类型不存在");
+            await _dataPermission.EnsureCanManage(
-
+                exists.CreateUserId,
+                OnboardingPermissionCodes.EntryConfigManageAll,
+                "资料类型");
+            entity.CreateUserId = exists.CreateUserId;
+            entity.CreateUser = exists.CreateUser;
+            entity.CreateTime = exists.CreateTime;
             await _db.Updateable(entity).ExecuteCommandAsync();
             return;
         }
@@ -164,6 +186,16 @@ public class OnboardingEntryConfigService : IOnboardingEntryConfigService
         if (input.Ids.Count == 0)
             return;
 
+        var materialTypes = await _db.Queryable<ObMaterialType>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (materialTypes.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("资料类型不存在");
+        await _dataPermission.EnsureCanManage(
+            materialTypes.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.EntryConfigManageAll,
+            "资料类型");
+
         var isReferenced = await _db.Queryable<ObMaterialRequirement>()
             .AnyAsync(x => input.Ids.Contains(x.MaterialTypeId));
         var isReferencedByTemplate = await _db.Queryable<ObOnboardingTemplateMaterial>()

SimpleAdmin.Application/Services/Onboarding/Lifecycle/OnboardingTaskLifecycleService.cs

@@ -6,12 +6,12 @@ namespace SimpleAdmin.Application;
 public class OnboardingTaskLifecycleService : IOnboardingTaskLifecycleService
 {
     private readonly SqlSugarScope _db;
-    private readonly IConfigService _config;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingTaskLifecycleService(IConfigService config)
+    public OnboardingTaskLifecycleService(IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
-        _config = config;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -147,14 +147,10 @@ public class OnboardingTaskLifecycleService : IOnboardingTaskLifecycleService
     {
         var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(taskId)
             ?? throw Oops.Bah("入职任务不存在");
-        var config = await _config.GetByConfigKey(CateGoryConst.CONFIG_BIZ_DEFINE, "onboard.reviewer.userIds")
+        await _dataPermission.EnsureCanManage(
-            ?? throw Oops.Bah("请配置入职审核人");
+            task.CreateUserId,
-        var reviewerIds = OnboardingReviewerConfigParser.Parse(config.ConfigValue, task.CompanyId);
+            OnboardingPermissionCodes.TaskManageAll,
-
+            "入职任务");
-        if (!reviewerIds.Contains(UserManager.UserId))
-        {
-            throw Oops.Bah("您不是该入职任务的审核人");
-        }
 
         return task;
     }

SimpleAdmin.Application/Services/Onboarding/MaterialReview/OnboardingMaterialReviewService.cs

@@ -7,11 +7,15 @@ public class OnboardingMaterialReviewService : IOnboardingMaterialReviewService
 {
     private readonly SqlSugarScope _db;
     private readonly IConfigService _config;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingMaterialReviewService(IConfigService config)
+    public OnboardingMaterialReviewService(
+        IConfigService config,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _config = config;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -48,6 +52,13 @@ public class OnboardingMaterialReviewService : IOnboardingMaterialReviewService
 
     private async Task EnsureReviewer(ObOnboardingTask task)
     {
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
+        if (await _dataPermission.CanManage(null, OnboardingPermissionCodes.TaskManageAll))
+            return;
+
         var config = await _config.GetByConfigKey(CateGoryConst.CONFIG_BIZ_DEFINE, "onboard.reviewer.userIds")
             ?? throw Oops.Bah("请配置入职审核人");
         var reviewerIds = OnboardingReviewerConfigParser.Parse(config.ConfigValue, task.CompanyId);

SimpleAdmin.Application/Services/Onboarding/OnboardingTemplate/OnboardingTemplateService.cs

@@ -6,10 +6,12 @@ namespace SimpleAdmin.Application;
 public class OnboardingTemplateService : IOnboardingTemplateService
 {
     private readonly SqlSugarScope _db;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingTemplateService()
+    public OnboardingTemplateService(IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
+        _dataPermission = dataPermission;
     }
 
     /// <inheritdoc />
@@ -59,6 +61,8 @@ public class OnboardingTemplateService : IOnboardingTemplateService
         return new OnboardingTemplateDetailOutput
         {
             Id = summary.Id,
+            CreateUserId = summary.CreateUserId,
+            CreateUser = summary.CreateUser,
             TemplateCode = summary.TemplateCode,
             TemplateName = summary.TemplateName,
             CompanyId = summary.CompanyId,
@@ -108,6 +112,19 @@ public class OnboardingTemplateService : IOnboardingTemplateService
             ? codeOwner.Id
             : input.Id ?? global::SimpleAdmin.Core.Utils.CommonUtils.GetSingleId();
 
+        if (input.Id.HasValue || isRestore)
+        {
+            var existing = isRestore
+                ? codeOwner
+                : await _db.Queryable<ObOnboardingTemplate>().InSingleAsync(templateId);
+            if (existing == null)
+                throw Oops.Bah("入职模板不存在");
+            await _dataPermission.EnsureCanManage(
+                existing.CreateUserId,
+                OnboardingPermissionCodes.EntryConfigManageAll,
+                "入职模板");
+        }
+
         var entity = new ObOnboardingTemplate
         {
             Id = templateId,
@@ -154,6 +171,16 @@ public class OnboardingTemplateService : IOnboardingTemplateService
         if (input.Ids.Count == 0)
             return;
 
+        var templates = await _db.Queryable<ObOnboardingTemplate>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (templates.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("入职模板不存在");
+        await _dataPermission.EnsureCanManage(
+            templates.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.EntryConfigManageAll,
+            "入职模板");
+
         var isUsed = await _db.Queryable<ObOnboardingTask>()
             .AnyAsync(item => input.Ids.Contains(item.OnboardingTemplateId));
         if (isUsed)
@@ -422,6 +449,8 @@ public class OnboardingTemplateService : IOnboardingTemplateService
             return new OnboardingTemplateOutput
             {
                 Id = template.Id,
+                CreateUserId = template.CreateUserId,
+                CreateUser = template.CreateUser,
                 TemplateCode = template.TemplateCode,
                 TemplateName = template.TemplateName,
                 CompanyId = template.CompanyId,

SimpleAdmin.Application/Services/Onboarding/Position/OnboardingPositionService.cs

@@ -5,6 +5,13 @@ namespace SimpleAdmin.Application;
 /// </summary>
 public class OnboardingPositionService : DbRepository<ObPosition>, IOnboardingPositionService
 {
+    private readonly IOnboardingDataPermissionService _dataPermission;
+
+    public OnboardingPositionService(IOnboardingDataPermissionService dataPermission)
+    {
+        _dataPermission = dataPermission;
+    }
+
     /// <summary>
     /// 分页查询入职业务岗位。
     /// </summary>
@@ -107,6 +114,10 @@ public class OnboardingPositionService : DbRepository<ObPosition>, IOnboardingPo
             throw Oops.Bah("请选择所属部门");
 
         var position = await Detail(new BaseIdInput { Id = input.Id });
+        await _dataPermission.EnsureCanManage(
+            position.CreateUserId,
+            OnboardingPermissionCodes.SetupManageAll,
+            "岗位");
         await EnsureScopeCanChange(position, input.CompanyId, input.DepartmentId.Value);
         await EnsureCompanyExists(input.CompanyId);
         await EnsureDepartmentExists(input.CompanyId, input.DepartmentId.Value);
@@ -122,6 +133,16 @@ public class OnboardingPositionService : DbRepository<ObPosition>, IOnboardingPo
         if (input.Ids.Count == 0)
             return;
 
+        var positions = await Context.Queryable<ObPosition>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (positions.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("岗位不存在");
+        await _dataPermission.EnsureCanManage(
+            positions.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.SetupManageAll,
+            "岗位");
+
         var hasTasks = await Context.Queryable<ObOnboardingTask>()
             .AnyAsync(it => input.Ids.Contains(it.PositionId));
         if (hasTasks)

SimpleAdmin.Application/Services/Onboarding/Task/OnboardingTaskService.cs

@@ -8,14 +8,17 @@ public class OnboardingTaskService : IOnboardingTaskService
     private readonly SqlSugarScope _db;
     private readonly IConfigService _configService;
     private readonly IOnboardingContractSnapshotService _snapshotService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
     public OnboardingTaskService(
         IConfigService configService,
-        IOnboardingContractSnapshotService snapshotService)
+        IOnboardingContractSnapshotService snapshotService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _configService = configService;
         _snapshotService = snapshotService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -237,6 +240,10 @@ public class OnboardingTaskService : IOnboardingTaskService
         var sourceTask = await _db.Queryable<ObOnboardingTask>()
             .InSingleAsync(input.SourceTaskId)
             ?? throw Oops.Bah("原入职任务不存在");
+        await _dataPermission.EnsureCanManage(
+            sourceTask.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
         if (!sourceTask.DepartmentId.HasValue)
             throw Oops.Bah("原入职任务未设置部门，不能复制");
 

SimpleAdmin.Application/Services/Onboarding/TaskContractVariable/OnboardingTaskContractVariableService.cs

@@ -6,9 +6,13 @@ namespace SimpleAdmin.Application;
 public class OnboardingTaskContractVariableService : IOnboardingTaskContractVariableService
 {
     private readonly SqlSugarScope _db;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingTaskContractVariableService()
+    public OnboardingTaskContractVariableService(IOnboardingDataPermissionService dataPermission)
-        => _db = DbContext.DB;
+    {
+        _db = DbContext.DB;
+        _dataPermission = dataPermission;
+    }
 
     /// <summary>
     /// 查询任务下全部合同及其变量当前值。
@@ -85,6 +89,10 @@ public class OnboardingTaskContractVariableService : IOnboardingTaskContractVari
         var task = await _db.Queryable<ObOnboardingTask>()
             .InSingleAsync(contract.TaskId)
             ?? throw Oops.Bah("入职任务不存在");
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
 
         if (task.TaskStatus != OnboardingTaskStatus.PendingFill &&
             task.TaskStatus != OnboardingTaskStatus.Rejected)

SimpleAdmin.Application/Services/Onboarding/TaskQuery/OnboardingTaskQueryService.cs

@@ -7,11 +7,15 @@ public class OnboardingTaskQueryService : IOnboardingTaskQueryService
 {
     private readonly SqlSugarScope _db;
     private readonly IConfigService _configService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
-    public OnboardingTaskQueryService(IConfigService configService)
+    public OnboardingTaskQueryService(
+        IConfigService configService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _configService = configService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -156,6 +160,10 @@ public class OnboardingTaskQueryService : IOnboardingTaskQueryService
     {
         var task = await _db.Queryable<ObOnboardingTask>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("入职任务不存在");
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
         var canShareLink = task.TaskStatus == OnboardingTaskStatus.PendingFill
                            || task.TaskStatus == OnboardingTaskStatus.Rejected;
         if (!canShareLink)

SimpleAdmin.Application/Services/Onboarding/VariableDefinition/OnboardingVariableDefinitionService.cs

@@ -6,13 +6,15 @@
 public class OnboardingVariableDefinitionService : IOnboardingVariableDefinitionService
 {
     private readonly SqlSugarScope _db;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
     /// <summary>
     /// 初始化合同变量字典服务。
     /// </summary>
-    public OnboardingVariableDefinitionService()
+    public OnboardingVariableDefinitionService(IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
+        _dataPermission = dataPermission;
     }
 
     /// <inheritdoc />
@@ -62,6 +64,10 @@ public class OnboardingVariableDefinitionService : IOnboardingVariableDefinition
 
         var entity = await _db.Queryable<ObVariableDefinition>().InSingleAsync(input.Id)
             ?? throw Oops.Bah("变量不存在");
+        await _dataPermission.EnsureCanManage(
+            entity.CreateUserId,
+            OnboardingPermissionCodes.EntryConfigManageAll,
+            "合同变量");
 
         if (!string.Equals(entity.VariableCode, input.VariableCode, StringComparison.Ordinal))
             throw Oops.Bah("变量编码创建后不能修改");
@@ -86,6 +92,16 @@ public class OnboardingVariableDefinitionService : IOnboardingVariableDefinition
         if (input.Ids.Count == 0)
             return;
 
+        var variables = await _db.Queryable<ObVariableDefinition>()
+            .Where(item => input.Ids.Contains(item.Id))
+            .ToListAsync();
+        if (variables.Count != input.Ids.Distinct().Count())
+            throw Oops.Bah("变量不存在");
+        await _dataPermission.EnsureCanManage(
+            variables.Select(item => item.CreateUserId),
+            OnboardingPermissionCodes.EntryConfigManageAll,
+            "合同变量");
+
         var hasBuiltIn = await _db.Queryable<ObVariableDefinition>()
             .Where(it => input.Ids.Contains(it.Id) && it.IsBuiltIn)
             .AnyAsync();