From dee392eb484b36f0b0a6a5cc25081789b017cbb4 Mon Sep 17 00:00:00 2001
From: b2894lxlx <517289602@qq.com>
Date: Wed, 14 Oct 2026 15:13:19 +0800
Subject: [PATCH 1/2] =?UTF-8?q?:bug:=20=E4=BF=AE=E5=A4=8D=20IAM=20?=
 =?UTF-8?q?=E5=90=8C=E6=AD=A5=20dept=5Fid=20=E8=B6=85=E9=95=BF=E4=B8=8E?=
 =?UTF-8?q?=E6=89=8B=E6=9C=BA=E5=8F=B7=E6=98=8E=E6=96=87=E8=A7=A3=E5=AF=86?=
 =?UTF-8?q?=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../system/mapper/UserDeptMapper.java         |  7 +++++
 .../system/mapper/UserDeptMapper.xml          |  4 +++
 .../service/impl/OaUserListSyncHelper.java    | 15 ++++++++-
 .../service/impl/UserDeptServiceImpl.java     |  7 +++++
 .../system/service/impl/UserServiceImpl.java  | 31 +++++++++++++++++--
 doc/sql/bladex/bladex.mysql.all.create.sql    |  2 +-
 .../blade_user_dept_id_expand_20261014.sql    |  9 ++++++
 doc/sql/transport/transport.sql               |  2 +-
 8 files changed, 72 insertions(+), 5 deletions(-)
 create mode 100644 doc/sql/transport/blade_user_dept_id_expand_20261014.sql

diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.java b/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.java
index 287c9e27..3d56d687 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.java
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.java
@@ -40,6 +40,13 @@ import java.util.List;
  */
 public interface UserDeptMapper extends BaseMapper<UserDept> {
 
+	/**
+	 * 提高当前会话 group_concat 上限，需与 queryUserDeptIds 在同一事务/连接中调用
+	 *
+	 * @param maxLen 最大长度
+	 */
+	void setGroupConcatMaxLen(@Param("maxLen") int maxLen);
+
 	/**
 	 *  根据用户id列表查询对应的部门id列表拼接的字符串
 	 * @param userIds
diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.xml b/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.xml
index 03182d8c..76c059bf 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.xml
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/mapper/UserDeptMapper.xml
@@ -2,6 +2,10 @@
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="org.springblade.system.mapper.UserDeptMapper">
 
+    <update id="setGroupConcatMaxLen">
+        SET SESSION group_concat_max_len = #{maxLen}
+    </update>
+
     <select id="queryUserDeptIds" resultType="org.springblade.system.pojo.vo.UserDeptIdsVO">
         select
         group_concat(distinct bd.id) deptIds,
diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/OaUserListSyncHelper.java b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/OaUserListSyncHelper.java
index a67f4ff8..9a6da9c0 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/OaUserListSyncHelper.java
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/OaUserListSyncHelper.java
@@ -350,7 +350,20 @@ public class OaUserListSyncHelper {
 		String defaultRoleId = getDefaultRoleId();
 		List<User> updateUserParams = list.stream()
 			.filter(userDeptIds -> !unchangedUserIds.contains(userDeptIds.getUserId()))
-			.filter(userDeptIds -> StringUtils.isNotBlank(userDeptIds.getDeptIds()) && userDeptIds.getDeptIds().length() <= MAX_DEPT_ID_LENGTH)
+			.filter(userDeptIds -> {
+				if (StringUtils.isBlank(userDeptIds.getDeptIds())) {
+					return false;
+				}
+				int deptIdLength = userDeptIds.getDeptIds().length();
+				int deptCodesLength = StringUtils.length(userDeptIds.getDeptCodes());
+				if (deptIdLength > MAX_DEPT_ID_LENGTH || deptCodesLength > MAX_DEPT_ID_LENGTH) {
+					ComposeLogUtil.getLastLog().warn(
+						"用户部门字段超长已跳过回写 userId={} deptIdLen={} deptCodesLen={} max={}",
+						userDeptIds.getUserId(), deptIdLength, deptCodesLength, MAX_DEPT_ID_LENGTH);
+					return false;
+				}
+				return true;
+			})
 			.map(userDeptIds -> {
 				User user = new User();
 				user.setId(userDeptIds.getUserId());
diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserDeptServiceImpl.java b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserDeptServiceImpl.java
index 88b17735..6fc40f70 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserDeptServiceImpl.java
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserDeptServiceImpl.java
@@ -46,11 +46,18 @@ import java.util.List;
 @Service
 public class UserDeptServiceImpl extends ServiceImpl<UserDeptMapper, UserDept> implements IUserDeptService {
 
+	/**
+	 * 与 blade_user.dept_id / dept_codes 扩容后的字段上限一致
+	 */
+	private static final int GROUP_CONCAT_MAX_LEN = 2000;
+
 	@Override
 	public List<UserDeptIdsVO> queryUserDeptIds(Collection<Long> userIds) {
 		if (CollectionUtil.isEmpty(userIds)) {
 			return Collections.emptyList();
 		}
+		// 需与后续查询在同一连接中生效（外层事务内调用）
+		baseMapper.setGroupConcatMaxLen(GROUP_CONCAT_MAX_LEN);
 		return baseMapper.queryUserDeptIds(userIds);
 	}
 
diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java
index 3a463c4d..055daa42 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java
@@ -1206,9 +1206,36 @@ public class UserServiceImpl extends BaseServiceImpl<UserMapper, User> implement
 		if (user == null) {
 			return;
 		}
-		if (user.getPhone() != null && user.getPhone().length() > 20) {
-			user.setPhone(SM2Util.decrypt(user.getPhone(), properties.getPublicKey(), properties.getPrivateKey()));
+		String phone = user.getPhone();
+		// 密文 Hex 通常远长于普通手机号；含 / 等非 Hex 字符的明文（如双号）直接跳过
+		if (StringUtil.isBlank(phone) || phone.length() <= 20 || !isSm2HexCipher(phone)) {
+			return;
 		}
+		try {
+			user.setPhone(SM2Util.decrypt(phone, properties.getPublicKey(), properties.getPrivateKey()));
+		} catch (Exception exception) {
+			log.warn("手机号 SM2 解密失败，保留原值 length={}", phone.length(), exception);
+		}
+	}
+
+	/**
+	 * 判断是否为 SM2 密文 Hex（仅 0-9a-f，且偶数长度）
+	 */
+	private boolean isSm2HexCipher(String value) {
+		int length = value.length();
+		if ((length & 1) != 0) {
+			return false;
+		}
+		for (int index = 0; index < length; index++) {
+			char character = value.charAt(index);
+			boolean isDigit = character >= '0' && character <= '9';
+			boolean isLowerHex = character >= 'a' && character <= 'f';
+			boolean isUpperHex = character >= 'A' && character <= 'F';
+			if (!isDigit && !isLowerHex && !isUpperHex) {
+				return false;
+			}
+		}
+		return true;
 	}
 
 	@Override
diff --git a/doc/sql/bladex/bladex.mysql.all.create.sql b/doc/sql/bladex/bladex.mysql.all.create.sql
index 8a7cb64e..741094ac 100644
--- a/doc/sql/bladex/bladex.mysql.all.create.sql
+++ b/doc/sql/bladex/bladex.mysql.all.create.sql
@@ -1265,7 +1265,7 @@ CREATE TABLE `blade_user`  (
   `birthday` datetime NULL DEFAULT NULL COMMENT '生日',
   `sex` int NULL DEFAULT NULL COMMENT '性别',
   `role_id` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '角色id',
-  `dept_id` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '部门id',
+  `dept_id` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '部门id',
   `post_id` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '岗位id',
   `leader_id` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '主管id',
   `is_leader` int NULL DEFAULT 0 COMMENT '是否主管',
diff --git a/doc/sql/transport/blade_user_dept_id_expand_20261014.sql b/doc/sql/transport/blade_user_dept_id_expand_20261014.sql
new file mode 100644
index 00000000..63d78877
--- /dev/null
+++ b/doc/sql/transport/blade_user_dept_id_expand_20261014.sql
@@ -0,0 +1,9 @@
+-- 用户多部门聚合字段扩容，避免 OA/IAM 同步时 dept_id 写入超长导致 Data truncation
+-- 部署前先执行本脚本，再发布后端
+
+ALTER TABLE `blade_user`
+  MODIFY COLUMN `dept_id` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '部门id';
+
+-- 若库中已有 dept_codes 列，请同步执行以下语句（无该列时可跳过）
+ALTER TABLE `blade_user`
+  MODIFY COLUMN `dept_codes` varchar(2000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '部门编码';
diff --git a/doc/sql/transport/transport.sql b/doc/sql/transport/transport.sql
index b2d174cd..db0b3b98 100644
--- a/doc/sql/transport/transport.sql
+++ b/doc/sql/transport/transport.sql
@@ -5426,7 +5426,7 @@ CREATE TABLE `blade_user` (
   `birthday` datetime DEFAULT NULL COMMENT '生日',
   `sex` int(11) DEFAULT NULL COMMENT '性别',
   `role_id` varchar(1000) DEFAULT NULL COMMENT '角色id',
-  `dept_id` varchar(1000) DEFAULT NULL COMMENT '部门id',
+  `dept_id` varchar(2000) DEFAULT NULL COMMENT '部门id',
   `post_id` varchar(1000) DEFAULT NULL COMMENT '岗位id',
   `leader_id` varchar(1000) DEFAULT NULL COMMENT '主管id',
   `is_leader` int(11) DEFAULT '0' COMMENT '是否主管',

From b791401620ad29cfa3631d52cf262c9b3475edbb Mon Sep 17 00:00:00 2001
From: b2894lxlx <517289602@qq.com>
Date: Wed, 14 Oct 2026 15:15:53 +0800
Subject: [PATCH 2/2] =?UTF-8?q?:bug:=20=E6=89=A9=E5=AE=B9=E7=94=A8?=
 =?UTF-8?q?=E6=88=B7=E6=89=8B=E6=9C=BA=E5=8F=B7=E5=AD=97=E6=AE=B5=E5=B9=B6?=
 =?UTF-8?q?=E8=A7=84=E8=8C=83=E5=8C=96=20OA=20=E5=A4=9A=E5=8F=B7=E7=A0=81?=
 =?UTF-8?q?=E5=90=8C=E6=AD=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../system/convert/UserConvert.java           | 19 +++++++++++++++++++
 doc/sql/bladex/bladex.mysql.all.create.sql    |  2 +-
 .../blade_user_phone_expand_20261014.sql      |  5 +++++
 doc/sql/transport/transport.sql               |  2 +-
 4 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 doc/sql/transport/blade_user_phone_expand_20261014.sql

diff --git a/blade-service/blade-system/src/main/java/org/springblade/system/convert/UserConvert.java b/blade-service/blade-system/src/main/java/org/springblade/system/convert/UserConvert.java
index 6decb305..00b2e576 100644
--- a/blade-service/blade-system/src/main/java/org/springblade/system/convert/UserConvert.java
+++ b/blade-service/blade-system/src/main/java/org/springblade/system/convert/UserConvert.java
@@ -88,6 +88,8 @@ public interface UserConvert {
     default User person2user(OAPersonResponse person, String defaultPassword) {
         User user = baseConvert(person);
         user.setAccount(resolveAccount(person));
+        // OA 可能返回多号（如 133.../137...），只保留首个号码再入库加密
+        user.setPhone(normalizeMobile(user.getPhone()));
         // 密码
         user.setPassword(defaultPassword);
         // 性别
@@ -103,6 +105,23 @@ public interface UserConvert {
         return user;
     }
 
+    /**
+     * 规范化手机号：去空白，多号时取第一个
+     */
+    default String normalizeMobile(String mobile) {
+        if (StringUtils.isBlank(mobile)) {
+            return null;
+        }
+        String trimmed = mobile.trim();
+        String[] parts = trimmed.split("[/|,;；，\\s]+");
+        for (String part : parts) {
+            if (StringUtils.isNotBlank(part)) {
+                return part.trim();
+            }
+        }
+        return null;
+    }
+
     /**
      * 解析本系统登录账号：优先 OA loginid，其次工号，最后手机号
      *
diff --git a/doc/sql/bladex/bladex.mysql.all.create.sql b/doc/sql/bladex/bladex.mysql.all.create.sql
index 741094ac..67ea9959 100644
--- a/doc/sql/bladex/bladex.mysql.all.create.sql
+++ b/doc/sql/bladex/bladex.mysql.all.create.sql
@@ -1261,7 +1261,7 @@ CREATE TABLE `blade_user`  (
   `real_name` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '真名',
   `avatar` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '头像',
   `email` varchar(45) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '邮箱',
-  `phone` varchar(45) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '手机',
+  `phone` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '手机',
   `birthday` datetime NULL DEFAULT NULL COMMENT '生日',
   `sex` int NULL DEFAULT NULL COMMENT '性别',
   `role_id` varchar(1000) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '角色id',
diff --git a/doc/sql/transport/blade_user_phone_expand_20261014.sql b/doc/sql/transport/blade_user_phone_expand_20261014.sql
new file mode 100644
index 00000000..a0d376d0
--- /dev/null
+++ b/doc/sql/transport/blade_user_phone_expand_20261014.sql
@@ -0,0 +1,5 @@
+-- 用户手机号字段扩容：SM2 加密后 Hex 远超 varchar(45)，避免 IAM/OA 同步插入失败
+-- 部署前先执行本脚本，再发布后端
+
+ALTER TABLE `blade_user`
+  MODIFY COLUMN `phone` varchar(500) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL COMMENT '手机';
diff --git a/doc/sql/transport/transport.sql b/doc/sql/transport/transport.sql
index db0b3b98..c2bc3826 100644
--- a/doc/sql/transport/transport.sql
+++ b/doc/sql/transport/transport.sql
@@ -5422,7 +5422,7 @@ CREATE TABLE `blade_user` (
   `real_name` varchar(10) DEFAULT NULL COMMENT '真名',
   `avatar` varchar(500) DEFAULT NULL COMMENT '头像',
   `email` varchar(45) DEFAULT NULL COMMENT '邮箱',
-  `phone` varchar(45) DEFAULT NULL COMMENT '手机',
+  `phone` varchar(500) DEFAULT NULL COMMENT '手机',
   `birthday` datetime DEFAULT NULL COMMENT '生日',
   `sex` int(11) DEFAULT NULL COMMENT '性别',
   `role_id` varchar(1000) DEFAULT NULL COMMENT '角色id',