Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions server_code/sql/tongzhifasong_table.sql
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
--
-- Table structure for table `tongzhifasong`
--

DROP TABLE IF EXISTS `tongzhifasong`;
/*!40101 SET @saved_cs_client = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `tongzhifasong` (
`id` bigint(20) NOT NULL AUTO_INCREMENT COMMENT '主键',
`addtime` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
`tongzhibianhao` varchar(200) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '通知编号',
`zhanghao` varchar(200) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '账号',
`shouji` varchar(200) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '手机',
`tongzhileixing` varchar(200) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '通知类型',
`fasongzhuangtai` varchar(200) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '发送状态',
`shibaiyuanyin` text COLLATE utf8mb4_unicode_ci COMMENT '失败原因',
`chongshicishu` int(11) DEFAULT 0 COMMENT '重试次数',
`chongshishijian` datetime DEFAULT NULL COMMENT '重试时间',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='通知发送记录';
/*!40101 SET character_set_client = @saved_cs_client */;
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,11 @@
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;
import org.springframework.scheduling.annotation.EnableScheduling;

@SpringBootApplication
@MapperScan(basePackages = {"com.cl.dao"})
@EnableScheduling
public class SpringbootSchemaApplication extends SpringBootServletInitializer{

public static void main(String[] args) {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
package com.cl.config;

import com.cl.service.TongzhifasongService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;

@Component
public class NotificationScheduleTask {

@Autowired
private TongzhifasongService tongzhifasongService;

@Scheduled(cron = "0 0/30 * * * ?")
public void retryFailedNotifications() {
tongzhifasongService.retryFailedNotifications();
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
package com.cl.controller;

import java.math.BigDecimal;
import java.text.SimpleDateFormat;
import java.text.ParseException;
import java.util.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

import com.cl.utils.ValidatorUtils;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import com.baomidou.mybatisplus.mapper.EntityWrapper;
import com.baomidou.mybatisplus.mapper.Wrapper;
import com.cl.annotation.IgnoreAuth;
import com.cl.annotation.SysLog;

import com.cl.entity.TongzhifasongEntity;
import com.cl.entity.view.TongzhifasongView;

import com.cl.service.TongzhifasongService;
import com.cl.service.TokenService;
import com.cl.utils.PageUtils;
import com.cl.utils.R;
import com.cl.utils.MPUtil;
import com.cl.utils.MapUtils;
import com.cl.utils.CommonUtil;

@RestController
@RequestMapping("/tongzhifasong")
public class TongzhifasongController {
@Autowired
private TongzhifasongService tongzhifasongService;

@RequestMapping("/page")
public R page(@RequestParam Map<String, Object> params,TongzhifasongEntity tongzhifasong,
HttpServletRequest request){
String tableName = request.getSession().getAttribute("tableName").toString();
EntityWrapper<TongzhifasongEntity> ew = new EntityWrapper<TongzhifasongEntity>();

PageUtils page = tongzhifasongService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, tongzhifasong), params), params));
return R.ok().put("data", page);
}
Comment on lines +44 to +52
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

5. 发送记录缺少数据隔离 🐞 Bug ⛨ Security

TongzhifasongController 的 /page 读取 session 的 tableName 但未按角色/用户过滤数据,导致任意登录用户都可查询全部发送记录(含手机号等)。同时提供
/retry 触发重试但未做角色限制,存在越权触发后台任务风险。
Agent Prompt
## Issue description
Tongzhifasong 的查询与重试触发接口缺少按用户/角色的数据隔离与权限限制,可能导致 PII 泄露与越权触发重试任务。

## Issue Context
同项目中部分资源(如 `JiuzhentongzhiController.page`)会基于 session 的 `tableName/username` 进行过滤,但 `TongzhifasongController.page` 未做任何过滤。

## Fix Focus Areas
- server_code/src/main/java/com/cl/controller/TongzhifasongController.java[44-52]
- server_code/src/main/java/com/cl/controller/TongzhifasongController.java[126-131]
- server_code/src/main/java/com/cl/controller/JiuzhentongzhiController.java[62-72]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


@IgnoreAuth
@RequestMapping("/list")
public R list(@RequestParam Map<String, Object> params,TongzhifasongEntity tongzhifasong,
HttpServletRequest request){
EntityWrapper<TongzhifasongEntity> ew = new EntityWrapper<TongzhifasongEntity>();

PageUtils page = tongzhifasongService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, tongzhifasong), params), params));
return R.ok().put("data", page);
}

@RequestMapping("/lists")
public R list( TongzhifasongEntity tongzhifasong){
EntityWrapper<TongzhifasongEntity> ew = new EntityWrapper<TongzhifasongEntity>();
ew.allEq(MPUtil.allEQMapPre( tongzhifasong, "tongzhifasong"));
return R.ok().put("data", tongzhifasongService.selectListView(ew));
}

@RequestMapping("/query")
public R query(TongzhifasongEntity tongzhifasong){
EntityWrapper< TongzhifasongEntity> ew = new EntityWrapper< TongzhifasongEntity>();
ew.allEq(MPUtil.allEQMapPre( tongzhifasong, "tongzhifasong"));
TongzhifasongView tongzhifasongView = tongzhifasongService.selectView(ew);
return R.ok("查询通知发送记录成功").put("data", tongzhifasongView);
}

@RequestMapping("/info/{id}")
public R info(@PathVariable("id") Long id){
TongzhifasongEntity tongzhifasong = tongzhifasongService.selectById(id);
tongzhifasong = tongzhifasongService.selectView(new EntityWrapper<TongzhifasongEntity>().eq("id", id));
return R.ok().put("data", tongzhifasong);
}

@IgnoreAuth
@RequestMapping("/detail/{id}")
public R detail(@PathVariable("id") Long id){
TongzhifasongEntity tongzhifasong = tongzhifasongService.selectById(id);
tongzhifasong = tongzhifasongService.selectView(new EntityWrapper<TongzhifasongEntity>().eq("id", id));
return R.ok().put("data", tongzhifasong);
}


@RequestMapping("/save")
@SysLog("新增通知发送记录")
public R save(@RequestBody TongzhifasongEntity tongzhifasong, HttpServletRequest request){
tongzhifasongService.insert(tongzhifasong);
return R.ok();
}

@SysLog("新增通知发送记录")
@RequestMapping("/add")
public R add(@RequestBody TongzhifasongEntity tongzhifasong, HttpServletRequest request){
tongzhifasongService.insert(tongzhifasong);
return R.ok();
}


@RequestMapping("/update")
@Transactional
@SysLog("修改通知发送记录")
public R update(@RequestBody TongzhifasongEntity tongzhifasong, HttpServletRequest request){
tongzhifasongService.updateById(tongzhifasong);
return R.ok();
}


@RequestMapping("/delete")
@SysLog("删除通知发送记录")
public R delete(@RequestBody Long[] ids){
tongzhifasongService.deleteBatchIds(Arrays.asList(ids));
return R.ok();
}

@RequestMapping("/retry")
@SysLog("重试发送通知")
public R retry(HttpServletRequest request){
tongzhifasongService.retryFailedNotifications();
return R.ok("重试完成");
}


}
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,12 @@

import com.cl.entity.YishengyuyueEntity;
import com.cl.entity.view.YishengyuyueView;
import com.cl.entity.JiuzhentongzhiEntity;
import com.cl.entity.TongzhifasongEntity;

import com.cl.service.YishengyuyueService;
import com.cl.service.JiuzhentongzhiService;
import com.cl.service.TongzhifasongService;
import com.cl.service.TokenService;
import com.cl.utils.PageUtils;
import com.cl.utils.R;
Expand All @@ -47,6 +51,10 @@
public class YishengyuyueController {
@Autowired
private YishengyuyueService yishengyuyueService;
@Autowired
private JiuzhentongzhiService jiuzhentongzhiService;
@Autowired
private TongzhifasongService tongzhifasongService;



Expand Down Expand Up @@ -149,6 +157,7 @@ public R detail(@PathVariable("id") Long id){
public R save(@RequestBody YishengyuyueEntity yishengyuyue, HttpServletRequest request){
//ValidatorUtils.validateEntity(yishengyuyue);
yishengyuyueService.insert(yishengyuyue);
createNotifications(yishengyuyue);
return R.ok();
}

Comment on lines 157 to 163
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

4. 预约写入缺少事务且状态不一致 🐞 Bug ⛯ Reliability

医生预约保存后再创建就诊通知与发送记录,但 save/add 未加事务,任一 insert
失败会导致预约/通知/发送记录部分成功的脏数据;同时发送记录创建时直接写“发送成功”,与重试逻辑(只处理“发送失败”)不一致,导致重试机制对这些记录永远无效。
Agent Prompt
## Issue description
预约创建后写入通知与发送记录没有事务,且发送记录初始状态被设置为“发送成功”,与后续重试逻辑筛选“发送失败”相冲突。

## Issue Context
`save/add` 先 `yishengyuyueService.insert` 再执行 `createNotifications()` 的多次 insert。任何一步失败都会产生部分写入。

## Fix Focus Areas
- server_code/src/main/java/com/cl/controller/YishengyuyueController.java[155-202]
- server_code/src/main/java/com/cl/service/impl/TongzhifasongServiceImpl.java[52-56]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Expand All @@ -160,8 +169,37 @@ public R save(@RequestBody YishengyuyueEntity yishengyuyue, HttpServletRequest r
public R add(@RequestBody YishengyuyueEntity yishengyuyue, HttpServletRequest request){
//ValidatorUtils.validateEntity(yishengyuyue);
yishengyuyueService.insert(yishengyuyue);
createNotifications(yishengyuyue);
return R.ok();
}

private void createNotifications(YishengyuyueEntity yishengyuyue) {
String notificationNo = System.currentTimeMillis() + "";
List<String> notificationTypes = Arrays.asList("就诊前1天提醒", "就诊当天提醒");

for (String type : notificationTypes) {
JiuzhentongzhiEntity notification = new JiuzhentongzhiEntity();
notification.setTongzhibianhao(notificationNo + "-" + type);
notification.setYishengzhanghao(yishengyuyue.getYishengzhanghao());
notification.setDianhua(yishengyuyue.getDianhua());
notification.setJiuzhenshijian(yishengyuyue.getYuyueshijian());
notification.setTongzhishijian(new Date());
notification.setZhanghao(yishengyuyue.getZhanghao());
notification.setShouji(yishengyuyue.getShouji());
notification.setTongzhibeizhu(type);
jiuzhentongzhiService.insert(notification);

TongzhifasongEntity sendRecord = new TongzhifasongEntity();
sendRecord.setTongzhibianhao(notification.getTongzhibianhao());
sendRecord.setZhanghao(yishengyuyue.getZhanghao());
sendRecord.setShouji(yishengyuyue.getShouji());
sendRecord.setTongzhileixing(type);
sendRecord.setFasongzhuangtai("发送成功");
sendRecord.setChongshicishu(0);
sendRecord.setAddtime(new Date());
tongzhifasongService.insert(sendRecord);
}
}



Expand Down
23 changes: 23 additions & 0 deletions server_code/src/main/java/com/cl/dao/TongzhifasongDao.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package com.cl.dao;

import com.cl.entity.TongzhifasongEntity;
import com.baomidou.mybatisplus.mapper.BaseMapper;
import java.util.List;
import java.util.Map;
import com.baomidou.mybatisplus.mapper.Wrapper;
import com.baomidou.mybatisplus.plugins.pagination.Pagination;

import org.apache.ibatis.annotations.Param;
import com.cl.entity.view.TongzhifasongView;


public interface TongzhifasongDao extends BaseMapper<TongzhifasongEntity> {

List<TongzhifasongView> selectListView(@Param("ew") Wrapper<TongzhifasongEntity> wrapper);

List<TongzhifasongView> selectListView(Pagination page,@Param("ew") Wrapper<TongzhifasongEntity> wrapper);

TongzhifasongView selectView(@Param("ew") Wrapper<TongzhifasongEntity> wrapper);


}
Loading