权限相关调整

SimpleAdmin.Application/Services/Onboarding/Audit/OnboardingAuditService.cs

@@ -9,16 +9,19 @@ public class OnboardingAuditService : IOnboardingAuditService
     private readonly IConfigService _config;
     private readonly IOnboardingContractSnapshotService _snapshotService;
     private readonly IOnboardingEmployeeContractSnapshotService _employeeContractSnapshotService;
+    private readonly IOnboardingDataPermissionService _dataPermission;
 
     public OnboardingAuditService(
         IConfigService config,
         IOnboardingContractSnapshotService snapshotService,
-        IOnboardingEmployeeContractSnapshotService employeeContractSnapshotService)
+        IOnboardingEmployeeContractSnapshotService employeeContractSnapshotService,
+        IOnboardingDataPermissionService dataPermission)
     {
         _db = DbContext.DB;
         _config = config;
         _snapshotService = snapshotService;
         _employeeContractSnapshotService = employeeContractSnapshotService;
+        _dataPermission = dataPermission;
     }
 
     /// <summary>
@@ -79,8 +82,9 @@ public class OnboardingAuditService : IOnboardingAuditService
         employee.ExtraInfoJson = global::System.Text.Json.JsonSerializer.Serialize(employeeInfo);
         employee.Status = CommonStatusConst.ENABLE;
         employee.CreateTime = DateTime.Now;
-        employee.CreateUserId = UserManager.UserId;
-        employee.CreateUser = UserManager.Name;
+        // 员工档案归属于原任务创建人，而不是执行审核的人。
+        employee.CreateUserId = task.CreateUserId;
+        employee.CreateUser = task.CreateUser;
         employee.UpdateTime = null;
         employee.UpdateUserId = null;
         employee.UpdateUser = null;
@@ -106,6 +110,27 @@ public class OnboardingAuditService : IOnboardingAuditService
 
             await _snapshotService.Build(task.Id, employeeInfo);
             await _db.Insertable(employee).ExecuteCommandAsync();
+
+            // 全局插入审计会把 CreateUserId 设置为当前审核人。管理员代审核他人任务时，
+            // 员工档案仍应归属于原任务创建人，否则普通人事将无法继续维护自己发起的员工。
+            if (task.CreateUserId.HasValue && task.CreateUserId != UserManager.UserId)
+            {
+                await _db.Updateable<ObEmployee>()
+                    .SetColumns(item => new ObEmployee
+                    {
+                        CreateUserId = task.CreateUserId,
+                        CreateUser = task.CreateUser
+                    })
+                    .Where(item => item.Id == employee.Id)
+                    .ExecuteCommandAsync();
+
+                var ownerPersisted = await _db.Queryable<ObEmployee>()
+                    .AnyAsync(item => item.Id == employee.Id
+                                      && item.CreateUserId == task.CreateUserId);
+                if (!ownerPersisted)
+                    throw Oops.Bah("员工档案创建人归属保存失败，请稍后重试");
+            }
+
             await _employeeContractSnapshotService.Build(employee.Id, task.Id);
 
             task.EmployeeId = employee.Id;
@@ -171,6 +196,15 @@ public class OnboardingAuditService : IOnboardingAuditService
             throw Oops.Bah("当前任务不在审核中");
         }
 
+        await _dataPermission.EnsureCanManage(
+            task.CreateUserId,
+            OnboardingPermissionCodes.TaskManageAll,
+            "入职任务");
+
+        // 人事管理员/超级管理员可处理全部任务；普通人事还必须属于配置的审核人。
+        if (await _dataPermission.CanManage(null, OnboardingPermissionCodes.TaskManageAll))
+            return task;
+
         var config = await _config.GetByConfigKey(CateGoryConst.CONFIG_BIZ_DEFINE, "onboard.reviewer.userIds")
             ?? throw Oops.Bah("请配置入职审核人");
         // 审核人由全局配置与公司专属配置合并得出，不依赖独立业务表。