refactor(permission): 简化对象权限检查配置

- 移除产品需求查询权限常量定义 - 移除项目需求查询权限常量定义 - 将权限检查注解从具体权限改为通用可访问性检查 - 统一所有查询方法的权限验证方式 - 简化权限检查逻辑，提高代码可维护性 - 减少权限常量定义，降低配置复杂度
2026-06-30 15:57:54 +08:00
parent 79f48bd283
commit 671d43a3f8
10 changed files with 35 additions and 72 deletions
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/product/ProductRequirementServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/product/ProductRequirementServiceImpl.java
@@ -82,7 +82,6 @@ public class ProductRequirementServiceImpl implements ProductRequirementService

    // 权限常量
    private static final String PRODUCT_CREATE_PERMISSION = "project:product:requirement:create";
-    private static final String PRODUCT_QUERY_PERMISSION = "project:product:requirement:query";
    private static final String PRODUCT_UPDATE_PERMISSION = "project:product:requirement:update";
    private static final String PRODUCT_STATUS_PERMISSION = "project:product:requirement:status";
    private static final String PRODUCT_REVIEW_PERMISSION = "project:product:requirement:review";
@@ -243,16 +242,14 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId", accessible = true)
    public ProductRequirementRespVO getRequirement(Long id, Long productId) {
        ProductRequirementDO requirement = validateRequirementExists(id);
        return buildRequirementRespVO(requirement);
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#pageReqVO.productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#pageReqVO.productId", accessible = true)
    public PageResult<ProductRequirementRespVO> getRequirementPage(ProductRequirementPageReqVO pageReqVO) {
        // 处理模块ID条件：支持递归查询子模块
        if (pageReqVO.getModuleId() != null) {
@@ -275,8 +272,7 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#pageReqVO.productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#pageReqVO.productId", accessible = true)
    public PageResult<ProductRequirementRespVO> getRequirementTree(ProductRequirementPageReqVO pageReqVO) {
        Long moduleId = pageReqVO.getModuleId();
        Long productId = pageReqVO.getProductId();
@@ -340,8 +336,7 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId", accessible = true)
    public ProductRequirementDashboardRespVO getRequirementDashboard(Long productId) {
        List<ProductRequirementDO> requirements = requirementMapper.selectListByProductId(productId);
        Map<String, ObjectStatusModelDO> statusModelMap = getStatusModelMap();
@@ -1038,8 +1033,7 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId", accessible = true)
    public List<ProductRequirementStatusTransitionRespVO> getAllowedTransitions(Long requirementId, Long productId) {
        ProductRequirementDO requirement = validateRequirementExists(requirementId);
        // 当产品需求已指派并生成项目需求后，产品需求端不再返回动作按钮
@@ -1071,8 +1065,7 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#reqVO.productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#reqVO.productId", accessible = true)
    public List<ProductRequirementAllowedTransitionBatchRespVO> getAllowedTransitionsBatch(ProductRequirementBatchReqVO reqVO) {
        List<ProductRequirementDO> requirements = getBatchRequirements(reqVO.getRequirementIds(), reqVO.getProductId());
        Set<Long> dispatchedRequirementIds = getDispatchedProductRequirementIds(requirements);
@@ -1093,16 +1086,14 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId", accessible = true)
    public boolean hasDispatchedProjectRequirement(Long requirementId, Long productId) {
        ProductRequirementDO requirement = validateRequirementExists(requirementId);
        return hasDispatchedProjectRequirement(requirement);
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#reqVO.productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#reqVO.productId", accessible = true)
    public List<ProductRequirementHasDispatchedBatchRespVO> hasDispatchedProjectRequirementBatch(ProductRequirementBatchReqVO reqVO) {
        List<ProductRequirementDO> requirements = getBatchRequirements(reqVO.getRequirementIds(), reqVO.getProductId());
        Set<Long> dispatchedRequirementIds = getDispatchedProductRequirementIds(requirements);
@@ -1443,8 +1434,7 @@ public class ProductRequirementServiceImpl implements ProductRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId",
-            permission = PRODUCT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PRODUCT_OBJECT_TYPE, objectId = "#productId", accessible = true)
    public List<ProductRequirementModuleRespVO> getRequirementModuleTree(Long productId) {
        List<ProductRequirementModuleDO> modules = moduleMapper.selectListByProductId(productId);
        return buildModuleTree(modules, 0L);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/ProjectRequirementServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/ProjectRequirementServiceImpl.java
@@ -94,7 +94,6 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
            STATUS_REJECTED, STATUS_CANCELLED);

    private static final String PROJECT_CREATE_PERMISSION = "project:project:requirement:create";
-    private static final String PROJECT_QUERY_PERMISSION = "project:project:requirement:query";
    private static final String PROJECT_UPDATE_PERMISSION = "project:project:requirement:update";
    private static final String PROJECT_STATUS_PERMISSION = "project:project:requirement:status";
    private static final String PROJECT_REVIEW_PERMISSION = "project:project:requirement:review";
@@ -245,8 +244,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectRequirementRespVO getRequirement(Long id, Long projectId) {
        ProjectRequirementDO requirement = validateRequirementExists(id);
        validateRequirementBelongsToProject(requirement, projectId);
@@ -255,8 +253,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#pageReqVO.projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#pageReqVO.projectId", accessible = true)
    public PageResult<ProjectRequirementRespVO> getRequirementPage(ProjectRequirementPageReqVO pageReqVO) {
        if (pageReqVO.getModuleId() != null) {
            if (isAllRequirementsModule(pageReqVO.getModuleId())) {
@@ -276,8 +273,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#pageReqVO.projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#pageReqVO.projectId", accessible = true)
    public PageResult<ProjectRequirementRespVO> getRequirementTree(ProjectRequirementPageReqVO pageReqVO) {
        Long moduleId = pageReqVO.getModuleId();
        Long projectId = pageReqVO.getProjectId();
@@ -542,8 +538,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public List<ProjectRequirementStatusTransitionRespVO> getAllowedTransitions(Long requirementId, Long projectId) {
        ProjectRequirementDO requirement = validateRequirementExists(requirementId);
        validateRequirementBelongsToProject(requirement, projectId);
@@ -569,8 +564,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#reqVO.projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#reqVO.projectId", accessible = true)
    public List<ProjectRequirementAllowedTransitionBatchRespVO> getAllowedTransitionsBatch(ProjectRequirementBatchReqVO reqVO) {
        List<ProjectRequirementDO> requirements = getBatchRequirements(reqVO.getRequirementIds(), reqVO.getProjectId());
        Map<String, List<ObjectStatusTransitionDO>> transitionsByStatus = getTransitionsByStatus(requirements);
@@ -644,8 +638,7 @@ public class ProjectRequirementServiceImpl implements ProjectRequirementService
    }

    @Override
-    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId",
-            permission = PROJECT_QUERY_PERMISSION)
+    @CheckObjectPermission(objectType = PROJECT_OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public List<ProjectRequirementModuleRespVO> getRequirementModuleTree(Long projectId) {
        List<ProjectRequirementModuleDO> modules = moduleMapper.selectListByProjectId(projectId);
        return buildModuleTree(modules, 0L);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/ProjectStatusBoardServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/ProjectStatusBoardServiceImpl.java
@@ -45,24 +45,21 @@ public class ProjectStatusBoardServiceImpl implements ProjectStatusBoardService
    private ProjectTaskService projectTaskService;

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectExecutionStatusBoardRespVO getExecutionStatusBoard(Long projectId, ProjectExecutionStatusBoardReqVO reqVO) {
        List<ObjectStatusModelDO> statusModels = objectStatusModelMapper.selectListByObjectTypeEnabled(ProjectExecutionConstants.OBJECT_TYPE);
        return buildExecutionStatusBoard(projectId, reqVO, statusModels);
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskStatusBoardRespVO getTaskStatusBoard(Long projectId, Long executionId, ProjectTaskStatusBoardReqVO reqVO) {
        List<ObjectStatusModelDO> statusModels = objectStatusModelMapper.selectListByObjectTypeEnabled(ProjectTaskConstants.OBJECT_TYPE);
        return buildTaskStatusBoard(projectId, executionId, reqVO, statusModels);
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskBoardPageRespVO getTaskBoardPage(Long projectId, Long executionId, ProjectTaskBoardPageReqVO reqVO) {
        List<ObjectStatusModelDO> statusModels = objectStatusModelMapper
                .selectListByObjectTypeEnabled(ProjectTaskConstants.OBJECT_TYPE);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/execution/ProjectExecutionAssigneeServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/execution/ProjectExecutionAssigneeServiceImpl.java
@@ -78,8 +78,7 @@ public class ProjectExecutionAssigneeServiceImpl implements ProjectExecutionAssi
    private AdminUserApi adminUserApi;

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public List<ExecutionAssigneeRespVO> getExecutionAssigneeList(Long projectId, Long executionId) {
        validateProjectExists(projectId);
        validateExecutionExists(projectId, executionId);
@@ -152,8 +151,7 @@ public class ProjectExecutionAssigneeServiceImpl implements ProjectExecutionAssi
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ExecutionAssigneeLogRespVO> getExecutionAssigneeLogPage(Long projectId, Long executionId,
                                                                              ExecutionAssigneeLogPageReqVO reqVO) {
        validateProjectExists(projectId);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/execution/ProjectExecutionServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/execution/ProjectExecutionServiceImpl.java
@@ -239,8 +239,7 @@ public class ProjectExecutionServiceImpl implements ProjectExecutionService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ProjectExecutionDO> getExecutionPage(Long projectId, ProjectExecutionPageReqVO reqVO) {
        validateProjectExists(projectId);
        // "我参与 / 所有"视角完全由前端发不发 reqVO.involveUserId 决定。
@@ -254,8 +253,7 @@ public class ProjectExecutionServiceImpl implements ProjectExecutionService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectExecutionRespVO getExecutionRespVO(Long projectId, Long executionId) {
        ProjectExecutionDO execution = getExecution(projectId, executionId);
        ProjectExecutionRespVO respVO = BeanUtils.toBean(execution, ProjectExecutionRespVO.class);
@@ -268,8 +266,7 @@ public class ProjectExecutionServiceImpl implements ProjectExecutionService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectExecutionConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ProjectExecutionRespVO> getExecutionRespVOPage(Long projectId, ProjectExecutionPageReqVO reqVO) {
        PageResult<ProjectExecutionDO> pageResult = getExecutionPage(projectId, reqVO);
        PageResult<ProjectExecutionRespVO> voPageResult = BeanUtils.toBean(pageResult, ProjectExecutionRespVO.class);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/ProjectTaskAggregateServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/ProjectTaskAggregateServiceImpl.java
@@ -67,8 +67,7 @@ public class ProjectTaskAggregateServiceImpl implements ProjectTaskAggregateServ
    // ========= page =========

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ProjectTaskRespVO> getAggregateTaskPage(Long projectId, ProjectTaskAggregatePageReqVO reqVO) {
        // 空数组语义短路:前端明确"按 0 个执行状态/执行 id 过滤" → 返空集合,不让 MyBatis 退化成"不过滤"
        if ((reqVO.getExecutionStatusCodes() != null && reqVO.getExecutionStatusCodes().isEmpty())
@@ -90,8 +89,7 @@ public class ProjectTaskAggregateServiceImpl implements ProjectTaskAggregateServ
    // ========= status-board =========

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskStatusBoardRespVO getAggregateTaskStatusBoard(Long projectId, ProjectTaskAggregateStatusBoardReqVO reqVO) {
        // 空数组语义短路:跳过 SQL,但保留状态列骨架(前端看板依赖全列表渲染),count 全部 0
        if ((reqVO.getExecutionStatusCodes() != null && reqVO.getExecutionStatusCodes().isEmpty())
@@ -147,8 +145,7 @@ public class ProjectTaskAggregateServiceImpl implements ProjectTaskAggregateServ
    // ========= board-page =========

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskBoardPageRespVO getAggregateTaskBoardPage(Long projectId, ProjectTaskAggregateBoardPageReqVO reqVO) {
        // 空数组语义短路:executionStatusCodes 或 executionIds 为空数组 → 该范围明确为空,跳过 SQL,保留列骨架(每列 list=[] / total=0)
        boolean emptyExecScope = (reqVO.getExecutionStatusCodes() != null && reqVO.getExecutionStatusCodes().isEmpty())
@@ -237,8 +234,7 @@ public class ProjectTaskAggregateServiceImpl implements ProjectTaskAggregateServ
    // ========= summary =========

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskSummaryRespVO getAggregateTaskSummary(Long projectId, ProjectTaskSummaryReqVO reqVO) {
        LocalDate today = today();
        LocalDate weekStart = weekStart(today);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/ProjectTaskServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/ProjectTaskServiceImpl.java
@@ -475,8 +475,7 @@ public class ProjectTaskServiceImpl implements ProjectTaskService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ProjectTaskDO> getTaskPage(Long projectId, Long executionId, ProjectTaskPageReqVO reqVO) {
        validateExecutionExists(projectId, executionId);
        // 进得来 = 看执行下全部任务，"我参与 / 所有"由前端发不发 reqVO.ownerId / involveUserId 决定。
@@ -486,8 +485,7 @@ public class ProjectTaskServiceImpl implements ProjectTaskService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public ProjectTaskRespVO getTaskRespVO(Long projectId, Long executionId, Long taskId) {
        // 内联 validate，便于接住 execution 供前端 executionOwnerId 字段使用
        ProjectExecutionDO execution = validateExecutionExists(projectId, executionId);
@@ -510,8 +508,7 @@ public class ProjectTaskServiceImpl implements ProjectTaskService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<ProjectTaskRespVO> getTaskRespVOPage(Long projectId, Long executionId, ProjectTaskPageReqVO reqVO) {
        PageResult<ProjectTaskDO> pageResult = getTaskPage(projectId, executionId, reqVO);
        return assembleTaskRespVOPage(projectId, executionId, pageResult);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/assignee/TaskAssigneeServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/assignee/TaskAssigneeServiceImpl.java
@@ -69,8 +69,7 @@ public class TaskAssigneeServiceImpl implements TaskAssigneeService {
    private AdminUserApi adminUserApi;

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public List<TaskAssigneeRespVO> getAssigneeList(Long projectId, Long executionId, Long taskId) {
        validateExecutionAndTaskExists(projectId, executionId, taskId);
        List<TaskAssigneeDO> activeList = taskAssigneeMapper.selectActiveListByTaskId(taskId);
@@ -123,8 +122,7 @@ public class TaskAssigneeServiceImpl implements TaskAssigneeService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<TaskAssigneeLogRespVO> getAssigneeLogPage(Long projectId, Long executionId, Long taskId,
                                                                 TaskAssigneeLogPageReqVO reqVO) {
        validateExecutionAndTaskExists(projectId, executionId, taskId);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/worklog/TaskWorklogServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/project/task/worklog/TaskWorklogServiceImpl.java
@@ -79,8 +79,7 @@ public class TaskWorklogServiceImpl implements TaskWorklogService {
    private ProjectTaskService projectTaskService;

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectTaskConstants.PERMISSION_QUERY, visibilityFallback = true)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public PageResult<TaskWorklogRespVO> getWorklogPage(Long projectId, Long executionId, Long taskId,
                                                        TaskWorklogPageReqVO reqVO) {
        validateExecutionAndTaskExists(projectId, executionId, taskId);
--- a/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/review/RequirementReviewServiceImpl.java
+++ b/rdms-project/rdms-project-boot/src/main/java/com/njcn/rdms/module/project/service/review/RequirementReviewServiceImpl.java
@@ -78,8 +78,7 @@ public class RequirementReviewServiceImpl implements RequirementReviewService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProductObjectConstants.OBJECT_TYPE, objectId = "#productId",
-            permission = ProductObjectConstants.PERMISSION_QUERY)
+    @CheckObjectPermission(objectType = ProductObjectConstants.OBJECT_TYPE, objectId = "#productId", accessible = true)
    public RequirementReviewRespVO getProductRequirementReview(Long productId, Long requirementId) {
        ProductRequirementDO requirement = productRequirementMapper.selectById(requirementId);
        if (requirement == null || !Objects.equals(requirement.getProductId(), productId)) {
@@ -116,8 +115,7 @@ public class RequirementReviewServiceImpl implements RequirementReviewService {
    }

    @Override
-    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId",
-            permission = ProjectObjectConstants.PERMISSION_QUERY)
+    @CheckObjectPermission(objectType = ProjectObjectConstants.OBJECT_TYPE, objectId = "#projectId", accessible = true)
    public RequirementReviewRespVO getProjectRequirementReview(Long projectId, Long requirementId) {
        ProjectRequirementDO requirement = projectRequirementMapper.selectById(requirementId);
        if (requirement == null || !Objects.equals(requirement.getProjectId(), projectId)) {