ow

CloudBuilder/CloudBuilder.Master.Service/FamilyPersonService.auto.cs

@@ -116,6 +116,13 @@ namespace CloudBuilder.Master.Service
                 throw new ValidatedException("记录已存在.");
             }
 
+            // 新增人没有既有 PersonId 可查支系，最小闸门：管理员或本谱已生效成员才能往谱里造人（防普通用户直接调 API 污染族谱）
+            var helper = new FamilyTreePermissionHelper(service);
+            if (!helper.IsManager(data.FamilyPerson.TreeId) && !helper.IsMember(data.FamilyPerson.TreeId))
+            {
+                throw new ValidatedException("您没有新增权限.");
+            }
+
             ValidateHelper.Validate(service, data.FamilyPerson, FamilyPersonEntity.DB_NAME_FAMILY_PERSON);
 
             d = new FamilyPersonEntity();
@@ -163,7 +170,15 @@ namespace CloudBuilder.Master.Service
         public void Delete(string key)
         {
             var ent = repository.DetachedEntities.Where(x => x.PersonId == key).FirstOrDefault()!;
-            if (ent != null) { repository.DeleteNow(ent); }
+            if (ent == null) return;
+
+            // 删人与改人口径一致：需在该人所属支系内（管理员在 HasPermission 内短路为真）
+            if (!new FamilyTreePermissionHelper(service).HasPermission(ent.TreeId, ent.PersonId))
+            {
+                throw new ValidatedException("您没有删除权限.");
+            }
+
+            repository.DeleteNow(ent);
         }
 
         [PermissionOperate(name: MasterPermissionPolicy.FamilyPerson, operate: Operate.Delete)]