ow

CloudBuilder/CloudBuilder.Master.Service/FamilyGroupService.auto.cs

@@ -481,7 +481,7 @@ namespace CloudBuilder.Master.Service
 
                 dto.FolderName = familyGroupFolderEntity.FolderName;
 
-                
+
                 familyGroupPermission = new FamilyGroupPermissionEntity();
                 familyGroupPermission.FamilyName = familyName;
                 familyGroupPermission.FolderName = dto.FolderName;

CloudBuilder/CloudBuilder.Master.Service/PublishAudioService.auto.cs

@@ -53,21 +53,28 @@ namespace CloudBuilder.Master.Service
                                                                 };
 
             data.FamilyGroups = q.ToArray();
-            if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length == 0)
+
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            //归属与群组身份：所有者全权；群管理员可删/改信息；群成员仅可改明细
+            data.IsOwner = publish.OwnerName == service.UserId;
+            data.IsMember = data.IsOwner;
+            data.IsManager = data.IsOwner;
+            if (!data.IsOwner && data.FamilyGroups.Length > 0)
+            {
+                string[] familyNames = data.FamilyGroups.Select(x => x.FamilyName).ToArray();
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+
+                data.IsMember = mine.Length > 0;
+                data.IsManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+            }
+
+            if (!data.IsOwner && !YesNoPolicy.IsYes(publish.OpenIndc) && !data.IsMember)
             {
                 throw new ValidatedException("没有权限.");
             }
-            else if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length > 0)
-            {
-                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
-
-                IQueryable<string>? fgm = from e in repositoryFamilyGroupManager.DetachedEntities
-                                          where e.UserName == service.UserId && data.FamilyGroups.Where(x => x.FamilyName == e.FamilyName).Count() > 0
-                                          select e.UserName;
-
-                if (fgm.Count() == 0)
-                    throw new ValidatedException("没有权限.");
-            }
 
             data.PublishAudio = publish;
 
@@ -76,19 +83,47 @@ namespace CloudBuilder.Master.Service
 
             if (data.Details != null && data.Details.Length > 0)
             {
+                // 明细的文件可能由群成员（非专辑所有者）从自己的网盘里挑：目录与源文件名都要按 dms_file 的真实归属取，
+                // 否则拼出的地址会落到专辑所有者目录下，取不到文件（500）。
+                IRepository<DmsFileEntity> repositoryDmsFile = repository.GetRepository<IRepository<DmsFileEntity>>();
+                string[] orderKeys = data.Details
+                    .SelectMany(x => new[] { x.Pic, x.Url, x.Lrc })
+                    .Where(x => !string.IsNullOrEmpty(x))
+                    .Select(x => x!)
+                    .Distinct()
+                    .ToArray();
+                Dictionary<string, DmsFileEntity> files = new Dictionary<string, DmsFileEntity>();
+                if (orderKeys.Length > 0)
+                {
+                    DmsFileEntity[] found = repositoryDmsFile.DetachedEntities
+                        .Where(x => x.OrderKey != null && orderKeys.Contains(x.OrderKey))
+                        .ToArray();
+                    foreach (DmsFileEntity file in found)
+                    {
+                        if (!string.IsNullOrEmpty(file.OrderKey) && !files.ContainsKey(file.OrderKey))
+                        {
+                            files.Add(file.OrderKey, file);
+                        }
+                    }
+                }
+
                 foreach (var item in data.Details)
                 {
+                    item.PicName = DmsOrgName(files, item.Pic);
+                    item.UrlName = DmsOrgName(files, item.Url);
+                    item.LrcName = DmsOrgName(files, item.Lrc);
+
                     if (!string.IsNullOrEmpty(item.Pic) && FileTypePolicy.GetType(item.Pic!) == FileTypePolicy.PHOTO)
                     {
-                        item.FormattedPic = item.FormattedPic = FileTypePolicy.PackPicUrl(service, item.CreatedBy, item.Pic);
+                        item.FormattedPic = FileTypePolicy.PackPicUrl(service, DmsOwner(files, item.Pic, item.CreatedBy), item.Pic);
                     }
                     if (!string.IsNullOrEmpty(item.Url) && FileTypePolicy.GetType(item.Url!) == FileTypePolicy.AUDIO)
                     {
-                        item.FormattedUrl = FileTypePolicy.PackUrl(service, item.CreatedBy, item.Url);
+                        item.FormattedUrl = FileTypePolicy.PackUrl(service, DmsOwner(files, item.Url, item.CreatedBy), item.Url);
                     }
                     if (!string.IsNullOrEmpty(item.Lrc) && FileTypePolicy.GetType(item.Lrc!) == FileTypePolicy.LYRIC)
                     {
-                        item.FormattedLrc = FileTypePolicy.PackUrl(service, item.CreatedBy, item.Lrc);
+                        item.FormattedLrc = FileTypePolicy.PackUrl(service, DmsOwner(files, item.Lrc, item.CreatedBy), item.Lrc);
                     }
                 }
 
@@ -97,6 +132,41 @@ namespace CloudBuilder.Master.Service
             return data;
         }
 
+        /// <summary>明细展示用的源文件名：查不到 dms_file 时回落物理名，界面不至于空白。</summary>
+        private static string DmsOrgName(Dictionary<string, DmsFileEntity> files, string? orderKey)
+        {
+            if (string.IsNullOrEmpty(orderKey))
+            {
+                return string.Empty;
+            }
+
+            if (files.TryGetValue(orderKey, out DmsFileEntity file) && !string.IsNullOrEmpty(file.OrgFileName))
+            {
+                return file.OrgFileName;
+            }
+
+            return orderKey;
+        }
+
+        /// <summary>文件真实归属目录（网盘按人分目录）：查不到就回落明细创建人，保持旧行为。</summary>
+        private static string DmsOwner(Dictionary<string, DmsFileEntity> files, string? orderKey, string fallback)
+        {
+            if (!string.IsNullOrEmpty(orderKey) && files.TryGetValue(orderKey, out DmsFileEntity file))
+            {
+                if (!string.IsNullOrEmpty(file.CreatedBy))
+                {
+                    return file.CreatedBy;
+                }
+
+                if (!string.IsNullOrEmpty(file.OwerId))
+                {
+                    return file.OwerId;
+                }
+            }
+
+            return fallback;
+        }
+
         [PermissionOperate(name: MasterPermissionPolicy.PublishAudio, operate: Operate.Find)]
         public PublishAudioResultData FindBySearchCriteria(PublishAudioSearchCriteria criteria)
         {
@@ -195,20 +265,68 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public PublishAudioData Update(PublishAudioData data)
         {
-            PublishAudioEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == data.PublishAudio.PublishName).FirstOrDefault();
-            if (publishEntity == null)
+            //归属校验：所有者可全改；公开群组管理员可改信息/群组；普通群成员只能改明细
+            PublishAudioEntity original = repository.DetachedEntities.Where(x => x.PublishName == data.PublishAudio.PublishName).FirstOrDefault();
+            if (original == null)
             {
-                throw new ValidatedException("你不是发布者无法修改.");
+                throw new ValidatedException("记录不存在.");
+            }
+
+            bool isOwner = original.OwnerName == service.UserId;
+            bool isManager = false;
+            bool isMember = false;
+            if (!isOwner)
+            {
+                IRepository<PublishAudioFamilyGroupEntity> repositoryPublishAudioFamilyGroup = repository.GetRepository<IRepository<PublishAudioFamilyGroupEntity>>();
+                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+                string[] familyNames = repositoryPublishAudioFamilyGroup.DetachedEntities
+                    .Where(x => x.PublishName == original.PublishName)
+                    .Select(x => x.FamilyName)
+                    .ToArray();
+                if (familyNames.Length == 0)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+                isMember = mine.Length > 0;
+                isManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+                if (!isMember)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+            }
+
+            //非所有者保留归属与建单信息，防客户端伪造
+            data.PublishAudio.OwnerName = original.OwnerName;
+            data.PublishAudio.CreatedBy = original.CreatedBy;
+            data.PublishAudio.CreatedDatetime = original.CreatedDatetime;
+            if (!isOwner && !isManager)
+            {
+                //非所有者且非管理员（普通群成员）只能改明细：专辑展示字段一律以库中为准
+                data.PublishAudio.PublishLocalName = original.PublishLocalName;
+                data.PublishAudio.Notice = original.Notice;
+                data.PublishAudio.OpenIndc = original.OpenIndc;
+                data.PublishAudio.ExpireDatetime = original.ExpireDatetime;
+                data.PublishAudio.OrderBy = original.OrderBy;
+            }
+            if (!isOwner)
+            {
+                //默认专辑是所有者个人偏好，群管理员也不能改
+                data.PublishAudio.DefaultIndc = original.DefaultIndc;
             }
 
             ValidateHelper.Validate(service, data.PublishAudio, PublishAudioEntity.DB_NAME_PUBLISH_AUDIO);
 
-            if (data.PublishAudio.DefaultIndc == YesNoPolicy.YES)
+            if (isOwner && data.PublishAudio.DefaultIndc == YesNoPolicy.YES)
             {
                 CancelDefaultIndc(data.PublishAudio.PublishName);
             }
 
-            publishEntity = new PublishAudioEntity();
+            PublishAudioEntity publishEntity = new PublishAudioEntity();
             ObjectCopyHelper.Copy(data.PublishAudio, publishEntity);
 
             repository.UpdateNow(publishEntity);
@@ -216,11 +334,34 @@ namespace CloudBuilder.Master.Service
             //只有删除和更新，没有插入
             SavePublishAudioDetails(publishEntity.PublishName, data.Details);
 
-            SavePublishAudioFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            //群组增删只对所有者/群管理员开放；普通成员提交的 FamilyGroups 不落库
+            if (isOwner || isManager)
+            {
+                SavePublishAudioFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            }
 
             return FindByKey(publishEntity.PublishName);
         }
 
+        /// <summary>当前登录人是否为该专辑任一公开群组的管理员（正式成员且 ManagerIndc=Y）</summary>
+        private bool IsGroupManagerOfPublish(string publishName)
+        {
+            IRepository<PublishAudioFamilyGroupEntity> repositoryFamilyGroup = repository.GetRepository<IRepository<PublishAudioFamilyGroupEntity>>();
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            string[] familyNames = repositoryFamilyGroup.DetachedEntities
+                .Where(x => x.PublishName == publishName)
+                .Select(x => x.FamilyName)
+                .ToArray();
+            if (familyNames.Length == 0)
+            {
+                return false;
+            }
+
+            return repositoryFamilyGroupManager.DetachedEntities
+                .Any(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && x.ManagerIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName));
+        }
+
         private void SavePublishAudioDetails(string publishName, PublishAudioDetailEntity[] details)
         {
             if (details != null && details.Length > 0)
@@ -320,10 +461,15 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public void Delete(string key)
         {
-            PublishAudioEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == key).FirstOrDefault();
+            PublishAudioEntity publishEntity = repository.DetachedEntities.Where(x => x.PublishName == key).FirstOrDefault();
             if (publishEntity == null)
             {
-                throw new ValidatedException("你不是发布者无法删除.");
+                throw new ValidatedException("记录不存在.");
+            }
+            //删除专辑：所有者或该专辑任一公开群组的管理员
+            if (publishEntity.OwnerName != service.UserId && !IsGroupManagerOfPublish(key))
+            {
+                throw new ValidatedException("没有权限.");
             }
 
             repository.DeleteNow(publishEntity);

CloudBuilder/CloudBuilder.Master.Service/PublishPhotoService.auto.cs

@@ -56,21 +56,28 @@ namespace CloudBuilder.Master.Service
                                                                 };
 
             data.FamilyGroups = q.ToArray();
-            if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length == 0)
+
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            //归属与群组身份：所有者全权；群管理员可删/改信息；群成员仅可改明细
+            data.IsOwner = publish.OwnerName == service.UserId;
+            data.IsMember = data.IsOwner;
+            data.IsManager = data.IsOwner;
+            if (!data.IsOwner && data.FamilyGroups.Length > 0)
+            {
+                string[] familyNames = data.FamilyGroups.Select(x => x.FamilyName).ToArray();
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+
+                data.IsMember = mine.Length > 0;
+                data.IsManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+            }
+
+            if (!data.IsOwner && !YesNoPolicy.IsYes(publish.OpenIndc) && !data.IsMember)
             {
                 throw new ValidatedException("没有权限.");
             }
-            else if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length > 0)
-            {
-                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
-
-                IQueryable<string>? fgm = from e in repositoryFamilyGroupManager.DetachedEntities
-                                          where e.UserName == service.UserId && data.FamilyGroups.Where(x => x.FamilyName == e.FamilyName).Count() > 0
-                                          select e.UserName;
-
-                if (fgm.Count() == 0)
-                    throw new ValidatedException("没有权限.");
-            }
 
             data.PublishPhoto = publish;
 
@@ -215,21 +222,68 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public PublishPhotoData Update(PublishPhotoData data)
         {
-            //只有自己创建的才能修改
-            PublishPhotoEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == data.PublishPhoto.PublishName).FirstOrDefault();
-            if (publishEntity == null)
+            //归属校验：所有者可全改；公开群组管理员可改信息/群组；普通群成员只能改明细
+            PublishPhotoEntity original = repository.DetachedEntities.Where(x => x.PublishName == data.PublishPhoto.PublishName).FirstOrDefault();
+            if (original == null)
             {
                 throw new ValidatedException("记录不存在.");
             }
 
+            bool isOwner = original.OwnerName == service.UserId;
+            bool isManager = false;
+            bool isMember = false;
+            if (!isOwner)
+            {
+                IRepository<PublishPhotoFamilyGroupEntity> repositoryPublishPhotoFamilyGroup = repository.GetRepository<IRepository<PublishPhotoFamilyGroupEntity>>();
+                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+                string[] familyNames = repositoryPublishPhotoFamilyGroup.DetachedEntities
+                    .Where(x => x.PublishName == original.PublishName)
+                    .Select(x => x.FamilyName)
+                    .ToArray();
+                if (familyNames.Length == 0)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+                isMember = mine.Length > 0;
+                isManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+                if (!isMember)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+            }
+
+            //非所有者保留归属与建单信息，防客户端伪造
+            data.PublishPhoto.OwnerName = original.OwnerName;
+            data.PublishPhoto.CreatedBy = original.CreatedBy;
+            data.PublishPhoto.CreatedDatetime = original.CreatedDatetime;
+            if (!isOwner && !isManager)
+            {
+                //非所有者且非管理员（普通群成员）只能改明细：专辑展示字段一律以库中为准
+                data.PublishPhoto.PublishLocalName = original.PublishLocalName;
+                data.PublishPhoto.Notice = original.Notice;
+                data.PublishPhoto.OpenIndc = original.OpenIndc;
+                data.PublishPhoto.ExpireDatetime = original.ExpireDatetime;
+                data.PublishPhoto.OrderBy = original.OrderBy;
+            }
+            if (!isOwner)
+            {
+                //默认专辑是所有者个人偏好，群管理员也不能改
+                data.PublishPhoto.DefaultIndc = original.DefaultIndc;
+            }
+
             ValidateHelper.Validate(service, data.PublishPhoto, PublishPhotoEntity.DB_NAME_PUBLISH_PHOTO);
 
-            if (data.PublishPhoto.DefaultIndc == YesNoPolicy.YES)
+            if (isOwner && data.PublishPhoto.DefaultIndc == YesNoPolicy.YES)
             {
                 CancelDefaultIndc(data.PublishPhoto.PublishName);
             }
 
-            publishEntity = new PublishPhotoEntity();
+            PublishPhotoEntity publishEntity = new PublishPhotoEntity();
             ObjectCopyHelper.Copy(data.PublishPhoto, publishEntity);
 
             repository.UpdateNow(publishEntity);
@@ -237,11 +291,34 @@ namespace CloudBuilder.Master.Service
             //只有删除和更新，没有插入
             SavePublishPhotoDetails(publishEntity.PublishName, data.Details);
 
-            SavePublishPhotoFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            //群组增删只对所有者/群管理员开放；普通成员提交的 FamilyGroups 不落库
+            if (isOwner || isManager)
+            {
+                SavePublishPhotoFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            }
 
             return FindByKey(publishEntity.PublishName);
         }
 
+        /// <summary>当前登录人是否为该相册任一公开群组的管理员（正式成员且 ManagerIndc=Y）</summary>
+        private bool IsGroupManagerOfPublish(string publishName)
+        {
+            IRepository<PublishPhotoFamilyGroupEntity> repositoryFamilyGroup = repository.GetRepository<IRepository<PublishPhotoFamilyGroupEntity>>();
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            string[] familyNames = repositoryFamilyGroup.DetachedEntities
+                .Where(x => x.PublishName == publishName)
+                .Select(x => x.FamilyName)
+                .ToArray();
+            if (familyNames.Length == 0)
+            {
+                return false;
+            }
+
+            return repositoryFamilyGroupManager.DetachedEntities
+                .Any(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && x.ManagerIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName));
+        }
+
         private void SavePublishPhotoFamilyGroup(string publishName, PublishPhotoFamilyGroupEntity[] familyGroups)
         {
             IRepository<PublishPhotoFamilyGroupEntity> repositoryPublishPhotoFamilyGroup = repository.GetRepository<IRepository<PublishPhotoFamilyGroupEntity>>();
@@ -317,11 +394,16 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public void Delete(string key)
         {
-            PublishPhotoEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == key).FirstOrDefault();
+            PublishPhotoEntity publishEntity = repository.DetachedEntities.Where(x => x.PublishName == key).FirstOrDefault();
             if (publishEntity == null)
             {
                 throw new ValidatedException("记录不存在.");
             }
+            //删除相册：所有者或该相册任一公开群组的管理员
+            if (publishEntity.OwnerName != service.UserId && !IsGroupManagerOfPublish(key))
+            {
+                throw new ValidatedException("没有权限.");
+            }
 
             repository.DeleteNow(publishEntity);
 

CloudBuilder/CloudBuilder.Master.Service/PublishVideoService.auto.cs

@@ -53,21 +53,28 @@ namespace CloudBuilder.Master.Service
                                                                 };
 
             data.FamilyGroups = q.ToArray();
-            if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length == 0)
+
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            //归属与群组身份：所有者全权；群管理员可删/改信息；群成员仅可改明细
+            data.IsOwner = publish.OwnerName == service.UserId;
+            data.IsMember = data.IsOwner;
+            data.IsManager = data.IsOwner;
+            if (!data.IsOwner && data.FamilyGroups.Length > 0)
+            {
+                string[] familyNames = data.FamilyGroups.Select(x => x.FamilyName).ToArray();
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+
+                data.IsMember = mine.Length > 0;
+                data.IsManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+            }
+
+            if (!data.IsOwner && !YesNoPolicy.IsYes(publish.OpenIndc) && !data.IsMember)
             {
                 throw new ValidatedException("没有权限.");
             }
-            else if (publish.OwnerName != service.UserId && !YesNoPolicy.IsYes(publish.OpenIndc) && data.FamilyGroups.Length > 0)
-            {
-                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
-
-                IQueryable<string>? fgm = from e in repositoryFamilyGroupManager.DetachedEntities
-                                          where e.UserName == service.UserId && data.FamilyGroups.Where(x => x.FamilyName == e.FamilyName).Count() > 0
-                                          select e.UserName;
-
-                if (fgm.Count() == 0)
-                    throw new ValidatedException("没有权限.");
-            }
 
             data.PublishVideo = publish;
 
@@ -90,9 +97,11 @@ namespace CloudBuilder.Master.Service
 
                         //暂时不支持转码
                         DmsFileEntity dmsFileEntity = repositoryDmsFile.DetachedEntities.Where(x => x.OrderKey == item.Url).FirstOrDefault();
-                        item.FormattedPic = FileTypePolicy.PackPicUrl(service, item.CreatedBy, item.Url);
-                        item.FormattedUrl = FileTypePolicy.PackUrl(service, item.CreatedBy, item.Url);
-                        item.FormattedM3u8 = FileTypePolicy.PackM3u8Url(service, item.CreatedBy, item.Url);
+                        // 文件可能由群成员从自己的网盘里挑：按 dms_file 的真实归属目录拼，查不到才回落明细创建人
+                        string owner = !string.IsNullOrEmpty(dmsFileEntity?.CreatedBy) ? dmsFileEntity.CreatedBy : item.CreatedBy;
+                        item.FormattedPic = FileTypePolicy.PackPicUrl(service, owner, item.Url);
+                        item.FormattedUrl = FileTypePolicy.PackUrl(service, owner, item.Url);
+                        item.FormattedM3u8 = FileTypePolicy.PackM3u8Url(service, owner, item.Url);
                     }
                 }
             }
@@ -198,20 +207,68 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public PublishVideoData Update(PublishVideoData data)
         {
-            PublishVideoEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == data.PublishVideo.PublishName).FirstOrDefault();
-            if (publishEntity == null)
+            //归属校验：所有者可全改；公开群组管理员可改信息/群组；普通群成员只能改明细
+            PublishVideoEntity original = repository.DetachedEntities.Where(x => x.PublishName == data.PublishVideo.PublishName).FirstOrDefault();
+            if (original == null)
             {
                 throw new ValidatedException("记录不存在.");
             }
 
+            bool isOwner = original.OwnerName == service.UserId;
+            bool isManager = false;
+            bool isMember = false;
+            if (!isOwner)
+            {
+                IRepository<PublishVideoFamilyGroupEntity> repositoryPublishVideoFamilyGroup = repository.GetRepository<IRepository<PublishVideoFamilyGroupEntity>>();
+                IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+                string[] familyNames = repositoryPublishVideoFamilyGroup.DetachedEntities
+                    .Where(x => x.PublishName == original.PublishName)
+                    .Select(x => x.FamilyName)
+                    .ToArray();
+                if (familyNames.Length == 0)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+
+                FamilyGroupManagerEntity[] mine = repositoryFamilyGroupManager.DetachedEntities
+                    .Where(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName))
+                    .ToArray();
+                isMember = mine.Length > 0;
+                isManager = mine.Any(x => x.ManagerIndc == YesNoPolicy.YES);
+                if (!isMember)
+                {
+                    throw new ValidatedException("没有权限.");
+                }
+            }
+
+            //非所有者保留归属与建单信息，防客户端伪造
+            data.PublishVideo.OwnerName = original.OwnerName;
+            data.PublishVideo.CreatedBy = original.CreatedBy;
+            data.PublishVideo.CreatedDatetime = original.CreatedDatetime;
+            if (!isOwner && !isManager)
+            {
+                //非所有者且非管理员（普通群成员）只能改明细：专辑展示字段一律以库中为准
+                data.PublishVideo.PublishLocalName = original.PublishLocalName;
+                data.PublishVideo.Notice = original.Notice;
+                data.PublishVideo.OpenIndc = original.OpenIndc;
+                data.PublishVideo.ExpireDatetime = original.ExpireDatetime;
+                data.PublishVideo.OrderBy = original.OrderBy;
+            }
+            if (!isOwner)
+            {
+                //默认专辑是所有者个人偏好，群管理员也不能改
+                data.PublishVideo.DefaultIndc = original.DefaultIndc;
+            }
+
             ValidateHelper.Validate(service, data.PublishVideo, PublishVideoEntity.DB_NAME_PUBLISH_VIDEO);
 
-            if (data.PublishVideo.DefaultIndc == YesNoPolicy.YES)
+            if (isOwner && data.PublishVideo.DefaultIndc == YesNoPolicy.YES)
             {
                 CancelDefaultIndc(data.PublishVideo.PublishName);
             }
 
-            publishEntity = new PublishVideoEntity();
+            PublishVideoEntity publishEntity = new PublishVideoEntity();
             ObjectCopyHelper.Copy(data.PublishVideo, publishEntity);
 
             repository.UpdateNow(publishEntity);
@@ -219,11 +276,34 @@ namespace CloudBuilder.Master.Service
             //只有删除和更新，没有插入
             SavePublishVideoDetails(publishEntity.PublishName, data.Details);
 
-            SavePublishVideoFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            //群组增删只对所有者/群管理员开放；普通成员提交的 FamilyGroups 不落库
+            if (isOwner || isManager)
+            {
+                SavePublishVideoFamilyGroup(publishEntity.PublishName, data.FamilyGroups);
+            }
 
             return FindByKey(publishEntity.PublishName);
         }
 
+        /// <summary>当前登录人是否为该专辑任一公开群组的管理员（正式成员且 ManagerIndc=Y）</summary>
+        private bool IsGroupManagerOfPublish(string publishName)
+        {
+            IRepository<PublishVideoFamilyGroupEntity> repositoryFamilyGroup = repository.GetRepository<IRepository<PublishVideoFamilyGroupEntity>>();
+            IRepository<FamilyGroupManagerEntity> repositoryFamilyGroupManager = repository.GetRepository<IRepository<FamilyGroupManagerEntity>>();
+
+            string[] familyNames = repositoryFamilyGroup.DetachedEntities
+                .Where(x => x.PublishName == publishName)
+                .Select(x => x.FamilyName)
+                .ToArray();
+            if (familyNames.Length == 0)
+            {
+                return false;
+            }
+
+            return repositoryFamilyGroupManager.DetachedEntities
+                .Any(x => x.UserName == service.UserId && x.ValidIndc == YesNoPolicy.YES && x.ManagerIndc == YesNoPolicy.YES && familyNames.Contains(x.FamilyName));
+        }
+
         private void SavePublishVideoDetails(string publishName, PublishVideoDetailEntity[] details)
         {
             if (details != null && details.Length > 0)
@@ -323,11 +403,16 @@ namespace CloudBuilder.Master.Service
         [UnitOfWork]
         public void Delete(string key)
         {
-            PublishVideoEntity publishEntity = repository.DetachedEntities.Where(x => x.OwnerName == service.UserId && x.PublishName == key).FirstOrDefault();
+            PublishVideoEntity publishEntity = repository.DetachedEntities.Where(x => x.PublishName == key).FirstOrDefault();
             if (publishEntity == null)
             {
                 throw new ValidatedException("记录不存在.");
             }
+            //删除专辑：所有者或该专辑任一公开群组的管理员
+            if (publishEntity.OwnerName != service.UserId && !IsGroupManagerOfPublish(key))
+            {
+                throw new ValidatedException("没有权限.");
+            }
 
             repository.DeleteNow(publishEntity);