From 301aca54f816bd4c0e7f3cbdd2904c73490eb892 Mon Sep 17 00:00:00 2001
From: leijiaping <leietal@163.com>
Date: Wed, 16 Sep 2026 17:18:51 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=87=8D=E7=BD=AE=E5=AF=86=E7=A0=81?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E8=A1=A5=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C?=
 =?UTF-8?q?(=E8=B6=85=E7=AE=A1=E5=85=A8=E9=83=A8/=E6=9C=BA=E6=9E=84?=
 =?UTF-8?q?=E7=AE=A1=E7=90=86=E5=91=98=E9=99=90=E6=9C=AC=E6=9C=BA=E6=9E=84?=
 =?UTF-8?q?),=E7=A6=81=E6=AD=A2=E9=87=8D=E7=BD=AE=E8=B6=85=E7=AE=A1?=
 =?UTF-8?q?=E4=B8=8E=E5=B7=B2=E6=B3=A8=E9=94=80=E8=B4=A6=E5=8F=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../usercenter/user/service/impl/UserServiceImpl.java | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java b/src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java
index 636393e..2234d7d 100644
--- a/src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java
+++ b/src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java
@@ -944,20 +944,27 @@ public class UserServiceImpl implements UserService {
 
   @Override
   public String resetOrgUserPassword(SuperResetPasswordDTO resetPasswordDTO) {
+    // 平台超管可重置全部用户,机构管理员仅可重置本机构用户
+    Assert.isTrue(UserContextHolder.isSuperior() || UserContextHolder.isAdministrator(),
+        "当前用户无操作权限");
+    Long userId = resetPasswordDTO.getUserId();
+    this.checkOrgScopeOfOperateUser(userId);
     Assert.isTrue(StringUtils
             .equals(resetPasswordDTO.getNewPassword(), resetPasswordDTO.getConfirmPassword())
         , "密码输入不一致");
     //更新操作
     String encodedPassword = PasswordUtils.encode(resetPasswordDTO.getNewPassword());
-    User user = userMapper.getById(resetPasswordDTO.getUserId());
+    User user = userMapper.getById(userId);
     Assert.notNull(user, "用户不存在");
+    Assert.isTrue(!Boolean.TRUE.equals(user.getSupeiror()), "不能重置超级管理员密码");
+    Assert.isTrue(!UserStatusEnum.CLOSED.getStatus().equals(user.getStatus()), "已注销账号无需重置密码");
     ExceptionUtils.throwBusinessException(
         PasswordUtils.match(resetPasswordDTO.getNewPassword(), user.getPassword()),
         "重置密码与原密码一致，无需重置！");
     // 上锁
     LockDTO lockDTO = UserServiceImpl.getUsernameLockDTO(user.getUsername());
     try {
-      Assert.isTrue(userMapper.updatePassword(resetPasswordDTO.getUserId(), encodedPassword,
+      Assert.isTrue(userMapper.updatePassword(userId, encodedPassword,
           UserContextHolder.getLoginUserId()) > 0, "数据更新失败");
     } finally {
       RedissonUtils.unlock(lockDTO);