From 8224e6380a5e0b4b12c1880d052db96deaeb6a8f Mon Sep 17 00:00:00 2001
From: weicw <594098497@qq.com>
Date: Fri, 30 Oct 2026 21:11:51 +0800
Subject: [PATCH] =?UTF-8?q?test(approval):=20=E8=A6=86=E7=9B=96=E5=8D=8F?=
 =?UTF-8?q?=E8=B0=83=E5=8D=95=E4=BC=AA=E9=80=A0=E6=8A=A5=E9=80=81=E9=83=A8?=
 =?UTF-8?q?=E9=97=A8=E5=AD=97=E6=AE=B5=E8=A2=AB=E5=BF=BD=E7=95=A5=20(#23)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../approval/ApprovalCoordinationIT.java        | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java b/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
index 4ffdf2a..867c788 100644
--- a/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
+++ b/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
@@ -129,6 +129,23 @@ class ApprovalCoordinationIT {
       .contains("confirm").contains("archive");
     assertThat(data.countMaster("SELECT COUNT(*) FROM approval_flow_definition "
       + "WHERE tenant_id = ? AND flow_code = 'coordination_external'", TENANT)).isZero();
+
+    // 报送部门与经办人只取登录态，客户端伪造字段被忽略
+    ApprovalTestData.TestUser other = data.createUser("他人" + data.uniqueSuffix(), acceptOrgId);
+    String forged = "{\"acceptOrgId\":" + acceptOrgId + ",\"title\":\"伪造部门\",\"content\":\"内容\","
+      + "\"reporterId\":" + other.userId + ",\"reportOrgId\":" + acceptOrgId + "}";
+    String forgedResponse = mockMvc.perform(authed(post("/api/approval/instance/coordination"),
+        reporter, reportOrgId, SUBMIT)
+        .contentType(MediaType.APPLICATION_JSON)
+        .content(forged))
+      .andExpect(jsonPath("$.code").value(0))
+      .andReturn().getResponse().getContentAsString(StandardCharsets.UTF_8);
+    long forgedId = objectMapper.readTree(forgedResponse).path("data").asLong();
+    data.trackInstance(forgedId);
+    assertThat(data.queryMaster("SELECT reporter_id FROM approval_instance WHERE id = ?",
+      Integer.class, forgedId)).isEqualTo(reporter.userId);
+    assertThat(data.queryMaster("SELECT report_org_id FROM approval_instance WHERE id = ?",
+      Integer.class, forgedId)).isEqualTo(reportOrgId);
   }
 
   @Test