fix: 重置密码接口补权限校验(超管全部/机构管理员限本机构),禁止重置超管与已注销账号

src/main/java/com/senmesh/usercenter/user/service/impl/UserServiceImpl.java

@@ -944,20 +944,27 @@ public class UserServiceImpl implements UserService {
 
   @Override
   public String resetOrgUserPassword(SuperResetPasswordDTO resetPasswordDTO) {
+    // 平台超管可重置全部用户,机构管理员仅可重置本机构用户
+    Assert.isTrue(UserContextHolder.isSuperior() || UserContextHolder.isAdministrator(),
+        "当前用户无操作权限");
+    Long userId = resetPasswordDTO.getUserId();
+    this.checkOrgScopeOfOperateUser(userId);
     Assert.isTrue(StringUtils
             .equals(resetPasswordDTO.getNewPassword(), resetPasswordDTO.getConfirmPassword())
         , "密码输入不一致");
     //更新操作
     String encodedPassword = PasswordUtils.encode(resetPasswordDTO.getNewPassword());
-    User user = userMapper.getById(resetPasswordDTO.getUserId());
+    User user = userMapper.getById(userId);
     Assert.notNull(user, "用户不存在");
+    Assert.isTrue(!Boolean.TRUE.equals(user.getSupeiror()), "不能重置超级管理员密码");
+    Assert.isTrue(!UserStatusEnum.CLOSED.getStatus().equals(user.getStatus()), "已注销账号无需重置密码");
     ExceptionUtils.throwBusinessException(
         PasswordUtils.match(resetPasswordDTO.getNewPassword(), user.getPassword()),
         "重置密码与原密码一致，无需重置！");
     // 上锁
     LockDTO lockDTO = UserServiceImpl.getUsernameLockDTO(user.getUsername());
     try {
-      Assert.isTrue(userMapper.updatePassword(resetPasswordDTO.getUserId(), encodedPassword,
+      Assert.isTrue(userMapper.updatePassword(userId, encodedPassword,
           UserContextHolder.getLoginUserId()) > 0, "数据更新失败");
     } finally {
       RedissonUtils.unlock(lockDTO);