fix: 收紧智能体聊天历史访问范围

- 普通账号仅可访问本人 Agent 会话

- 超级管理员保留全量查询并限制筛选入口

easyflow-modules/easyflow-module-chatlog/src/test/java/tech/easyflow/chatlog/service/impl/ChatHistoryManageServiceImplTest.java

@@ -110,12 +110,29 @@ public class ChatHistoryManageServiceImplTest {
         ChatSessionFilterQuery query = new ChatSessionFilterQuery();
         query.setAssistantCode("BOT");
 
-        service.queryAdminSessions(query);
+        service.queryAdminSessions(BigInteger.ONE, true, query);
 
         Assert.assertEquals("AGENT", query.getAssistantCode());
         Assert.assertSame(query, chatAnalyticalDBRepository.lastPageQuery);
     }
 
+    /**
+     * 验证普通账号列表由服务端强制限定为本人，并忽略用户账号筛选。
+     */
+    @Test
+    public void queryAdminSessionsShouldForceCurrentUserForRegularAccount() {
+        BigInteger requesterId = BigInteger.valueOf(2004);
+        ChatSessionFilterQuery query = new ChatSessionFilterQuery();
+        query.setUserId(BigInteger.valueOf(9999));
+        query.setUserAccount("other-user");
+
+        service.queryAdminSessions(requesterId, false, query);
+
+        Assert.assertEquals(requesterId, query.getUserId());
+        Assert.assertNull(query.getUserAccount());
+        Assert.assertEquals("AGENT", query.getAssistantCode());
+    }
+
     /**
      * 验证管理端可以读取正式 Agent 会话。
      */
@@ -125,11 +142,31 @@ public class ChatHistoryManageServiceImplTest {
         ChatSessionSummary summary = session(sessionId, "AGENT", 0);
         chatAnalyticalDBRepository.sessionResult = summary;
 
-        ChatSessionSummary result = service.getAdminSession(sessionId);
+        ChatSessionSummary result = service.getAdminSession(BigInteger.ONE, true, sessionId);
 
         Assert.assertSame(summary, result);
     }
 
+    /**
+     * 验证普通账号只能读取归属于本人的 Agent 会话。
+     */
+    @Test
+    public void getAdminSessionShouldRejectForeignSessionForRegularAccount() {
+        BigInteger requesterId = BigInteger.valueOf(2005);
+        BigInteger sessionId = BigInteger.valueOf(3005);
+        ChatSessionSummary summary = session(sessionId, "AGENT", 0);
+        summary.setUserId(BigInteger.valueOf(9999));
+        chatAnalyticalDBRepository.sessionResult = summary;
+
+        BusinessException exception = Assert.assertThrows(
+                BusinessException.class,
+                () -> service.getAdminSession(requesterId, false, sessionId)
+        );
+
+        Assert.assertEquals(403, exception.getHttpStatus());
+        Assert.assertEquals("无权访问该会话", exception.getMessage());
+    }
+
     /**
      * 验证正式 Agent 会话可以继续读取历史消息。
      */
@@ -148,7 +185,7 @@ public class ChatHistoryManageServiceImplTest {
         ChatPageQuery query = new ChatPageQuery();
         query.setPageNumber(2);
 
-        ChatHistoryPage result = service.queryAdminMessages(sessionId, query);
+        ChatHistoryPage result = service.queryAdminMessages(BigInteger.ONE, true, sessionId, query);
 
         Assert.assertSame(expectedPage, result);
     }
@@ -163,7 +200,7 @@ public class ChatHistoryManageServiceImplTest {
 
         BusinessException exception = Assert.assertThrows(
                 BusinessException.class,
-                () -> service.getAdminSession(sessionId)
+                () -> service.getAdminSession(BigInteger.ONE, true, sessionId)
         );
 
         Assert.assertEquals("Agent 会话不存在", exception.getMessage());
@@ -179,7 +216,12 @@ public class ChatHistoryManageServiceImplTest {
 
         Assert.assertThrows(
                 BusinessException.class,
-                () -> service.queryAdminMessages(sessionId, new ChatPageQuery())
+                () -> service.queryAdminMessages(
+                        BigInteger.ONE,
+                        true,
+                        sessionId,
+                        new ChatPageQuery()
+                )
         );
     }
 
@@ -193,7 +235,12 @@ public class ChatHistoryManageServiceImplTest {
 
         Assert.assertThrows(
                 BusinessException.class,
-                () -> service.listAdminRoundVariants(sessionId, BigInteger.ONE)
+                () -> service.listAdminRoundVariants(
+                        BigInteger.ONE,
+                        true,
+                        sessionId,
+                        BigInteger.ONE
+                )
         );
     }
 
@@ -208,10 +255,11 @@ public class ChatHistoryManageServiceImplTest {
         Assert.assertThrows(
                 BusinessException.class,
                 () -> service.selectAdminRoundVariant(
+                        BigInteger.TEN,
+                        true,
                         sessionId,
                         BigInteger.ONE,
-                        1,
-                        BigInteger.TEN
+                        1
                 )
         );
     }