Merge remote-tracking branch 'origin/master'

# Conflicts:
#	storlead-api/src/main/java/com/storlead/mail/common/SmtpPopSettingsApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/EmailFolderRuleApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/MaiAttachmentApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/MailApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/MailBlacklistRecordApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/MailTemplatesApiController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/MailboxAutoReplySetController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/ThumbnailPreviewController.java
#	storlead-api/src/main/java/com/storlead/mail/crm/UserEmailFolderApiController.java
#	storlead-mail/storlead-mail-crm/src/main/java/com/storlead/sales/mail/crm/support/MailOwnershipGuard.java
#	storlead-mail/storlead-mail-crm/src/main/java/com/storlead/sales/mail/crm/util/SafeFilePathResolver.java
#	storlead-mail/storlead-mail-crm/src/main/java/com/storlead/sales/mail/crm/util/ZipUtility.java

storlead-mail/storlead-mail-crm/src/main/java/com/storlead/sales/mail/crm/support/MailOwnershipGuard.java

@@ -1,156 +0,0 @@
-package com.storlead.sales.mail.crm.support;
-
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
-import com.baomidou.mybatisplus.extension.service.IService;
-import com.storlead.framework.common.constant.CommonConstant;
-import com.storlead.framework.mybatis.entity.SysBaseField;
-import com.storlead.sales.mail.crm.entity.EmailsEntity;
-import com.storlead.sales.mail.crm.entity.MailAttachmentEntity;
-import com.storlead.sales.mail.crm.entity.MailTempAttachmentEntity;
-import com.storlead.sales.mail.common.entity.SmtpPopSettingsEntity;
-import com.storlead.sales.mail.crm.entity.UserEmailFolderEntity;
-import com.storlead.sales.mail.crm.service.EmailsService;
-import com.storlead.sales.mail.crm.service.MailAttachmentService;
-import com.storlead.sales.mail.crm.service.MailTempAttachmentService;
-import com.storlead.sales.mail.common.service.SmtpPopSettingsService;
-import com.storlead.sales.mail.crm.service.UserEmailFolderService;
-import org.springframework.stereotype.Component;
-import org.springframework.util.CollectionUtils;
-
-import javax.annotation.Resource;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Objects;
-
-/**
- * 邮件模块资源归属校验，防止水平越权（IDOR）。
- */
-@Component
-public class MailOwnershipGuard {
-
-    @Resource
-    private EmailsService emailsService;
-    @Resource
-    private SmtpPopSettingsService smtpPopSettingsService;
-    @Resource
-    private MailAttachmentService mailAttachmentService;
-    @Resource
-    private MailTempAttachmentService tempAttachmentService;
-    @Resource
-    private UserEmailFolderService userEmailFolderService;
-
-    public boolean isOwnedBy(Long ownerBy, Long userId) {
-        return ownerBy != null && userId != null && ownerBy.equals(userId);
-    }
-
-    public EmailsEntity getOwnedEmail(Long mailId, Long userId) {
-        if (mailId == null || userId == null) {
-            return null;
-        }
-        EmailsEntity email = emailsService.getById(mailId);
-        return isOwnedBy(email != null ? email.getOwnerBy() : null, userId) ? email : null;
-    }
-
-    public List<EmailsEntity> listOwnedEmails(Collection<Long> mailIds, Long userId) {
-        if (CollectionUtils.isEmpty(mailIds) || userId == null) {
-            return Collections.emptyList();
-        }
-        return emailsService.list(new LambdaQueryWrapper<EmailsEntity>()
-                .in(EmailsEntity::getId, mailIds)
-                .eq(EmailsEntity::getOwnerBy, userId));
-    }
-
-    public boolean ownsAllEmails(Collection<Long> mailIds, Long userId) {
-        if (CollectionUtils.isEmpty(mailIds) || userId == null) {
-            return false;
-        }
-        long owned = emailsService.count(new LambdaQueryWrapper<EmailsEntity>()
-                .in(EmailsEntity::getId, mailIds)
-                .eq(EmailsEntity::getOwnerBy, userId));
-        return owned == mailIds.size();
-    }
-
-    public SmtpPopSettingsEntity getOwnedSmtpPop(Long smtpPopId, Long userId) {
-        if (smtpPopId == null || userId == null) {
-            return null;
-        }
-        SmtpPopSettingsEntity smtpPop = smtpPopSettingsService.getById(smtpPopId);
-        if (smtpPop == null || !Integer.valueOf(0).equals(smtpPop.getIsDelete())) {
-            return null;
-        }
-        return isOwnedBy(smtpPop.getOwnerBy(), userId) ? smtpPop : null;
-    }
-
-    public UserEmailFolderEntity getOwnedFolder(Long folderId, Long userId) {
-        if (folderId == null || userId == null) {
-            return null;
-        }
-        UserEmailFolderEntity folder = userEmailFolderService.getById(folderId);
-        if (folder == null || !Integer.valueOf(0).equals(folder.getIsDelete())) {
-            return null;
-        }
-        return isOwnedBy(folder.getOwnerBy(), userId) ? folder : null;
-    }
-
-    public MailAttachmentEntity getOwnedAttachment(Long attachmentId, Long userId) {
-        if (attachmentId == null || userId == null) {
-            return null;
-        }
-        MailAttachmentEntity attachment = mailAttachmentService.getById(attachmentId);
-        if (attachment == null) {
-            return null;
-        }
-        EmailsEntity email = emailsService.getById(attachment.getEmailId());
-        return email != null && isOwnedBy(email.getOwnerBy(), userId) ? attachment : null;
-    }
-
-    public MailTempAttachmentEntity getOwnedTempAttachment(Long attachmentId, Long userId) {
-        if (attachmentId == null || userId == null) {
-            return null;
-        }
-        MailTempAttachmentEntity attachment = tempAttachmentService.getById(attachmentId);
-        if (attachment == null) {
-            return null;
-        }
-        if (attachment.getEmailId() != null) {
-            EmailsEntity email = emailsService.getById(attachment.getEmailId());
-            return email != null && isOwnedBy(email.getOwnerBy(), userId) ? attachment : null;
-        }
-        return isOwnedBy(attachment.getOwnerBy(), userId) ? attachment : null;
-    }
-
-    public <T extends SysBaseField> T getOwnedEntity(IService<T> service, Long id, Long userId) {
-        if (id == null || userId == null) {
-            return null;
-        }
-        T entity = service.getById(id);
-        if (entity == null || !Objects.equals(entity.getIsDelete(), CommonConstant.DEL_FLAG_0)) {
-            return null;
-        }
-        return isOwnedBy(entity.getOwnerBy(), userId) ? entity : null;
-    }
-
-    public <T extends SysBaseField> boolean softDeleteOwned(IService<T> service, Collection<Long> ids, Long userId) {
-        if (CollectionUtils.isEmpty(ids) || userId == null) {
-            return false;
-        }
-        UpdateWrapper<T> wrapper = new UpdateWrapper<>();
-        wrapper.in("id", ids);
-        wrapper.eq("owner_by", userId);
-        wrapper.set("is_delete", CommonConstant.DEL_FLAG_1);
-        return service.update(wrapper);
-    }
-
-    public <T extends SysBaseField> boolean updateEnabledOwned(IService<T> service, Long id, Boolean enabled, Long userId) {
-        if (id == null || userId == null) {
-            return false;
-        }
-        UpdateWrapper<T> wrapper = new UpdateWrapper<>();
-        wrapper.eq("id", id);
-        wrapper.eq("owner_by", userId);
-        wrapper.set("enabled", enabled);
-        return service.update(wrapper);
-    }
-}