fix(系统设置): 任务中心操作，资源权限校验有误

--bug=1044335 --user=陈建星 【系统设置】组织-用户所属自定义用户组只有查询权限，登录后在组织的任务中心-定时任务功能页面可以批量开启/关闭、删除定时任务 https://www.tapd.cn/55049933/s/1555411

backend/services/api-test/src/main/java/io/metersphere/api/controller/ApiTaskCenterController.java

@@ -31,9 +31,6 @@ public class ApiTaskCenterController {
     private ApiTaskCenterService apiTaskCenterService;
 
     private static final String PROJECT = "project";
-    private static final String ORG = "org";
-    private static final String SYSTEM = "system";
-
 
     @PostMapping("/api/project/real-time/page")
     @Operation(summary = "项目-任务中心-接口用例/场景-实时任务列表")
@@ -58,20 +55,12 @@ public class ApiTaskCenterController {
     @PostMapping("/api/system/stop")
     @Operation(summary = "系统-任务中心-接口用例/场景-停止任务")
     public void systemStop(@Validated @RequestBody TaskCenterBatchRequest request) {
-        apiTaskCenterService.hasPermission(SYSTEM, request.getModuleType(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-
         apiTaskCenterService.systemStop(request, SessionUtils.getUserId());
     }
 
     @PostMapping("/api/org/stop")
     @Operation(summary = "组织-任务中心-接口用例/场景-停止任务")
     public void orgStop(@Validated @RequestBody TaskCenterBatchRequest request) {
-        apiTaskCenterService.hasPermission(ORG, request.getModuleType(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-
         apiTaskCenterService.orgStop(request, SessionUtils.getCurrentOrganizationId(), SessionUtils.getUserId());
     }
 
@@ -91,16 +80,13 @@ public class ApiTaskCenterController {
                 SessionUtils.getCurrentOrganizationId(),
                 SessionUtils.getCurrentProjectId());
         apiTaskCenterService.stopById(moduleType, id, SessionUtils.getUserId(),
-                OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER);
+                OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER, null);
     }
 
     @GetMapping("/api/org/stop/{moduleType}/{id}")
     @Operation(summary = "组织-任务中心-接口用例/场景-停止任务")
     public void stopOrgById(@PathVariable String moduleType, @PathVariable String id) {
-        apiTaskCenterService.hasPermission(ORG, moduleType,
+        apiTaskCenterService.orgStopById(moduleType, id, SessionUtils.getUserId(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-        apiTaskCenterService.stopById(moduleType, id, SessionUtils.getUserId(),
                 OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
     }
 
@@ -108,10 +94,7 @@ public class ApiTaskCenterController {
     @Operation(summary = "系统-任务中心-接口用例/场景-停止任务")
     @RequiresPermissions(PermissionConstants.PROJECT_API_REPORT_READ)
     public void stopSystemById(@PathVariable String moduleType, @PathVariable String id) {
-        apiTaskCenterService.hasPermission(SYSTEM, moduleType,
+        apiTaskCenterService.systemStopById(moduleType, id, SessionUtils.getUserId(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-        apiTaskCenterService.stopById(moduleType, id, SessionUtils.getUserId(),
                 OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
     }
 }

backend/services/api-test/src/main/java/io/metersphere/api/service/ApiTaskCenterService.java

@@ -48,6 +48,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.*;
+import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -89,6 +90,8 @@ public class ApiTaskCenterService {
     @Resource
     private KafkaTemplate<String, String> kafkaTemplate;
     private static final String DEFAULT_SORT = "start_time desc";
+    private static final String ORG = "org";
+    private static final String SYSTEM = "system";
 
     /**
      * 任务中心实时任务列表-项目级
@@ -220,10 +223,11 @@ public class ApiTaskCenterService {
     }
 
     public void systemStop(TaskCenterBatchRequest request, String userId) {
-        stopApiTask(request, new ArrayList<>(), userId, OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
+        stopApiTask(request, new ArrayList<>(), userId, OperationLogModule.SETTING_SYSTEM_TASK_CENTER, getCheckPermissionFunc(SYSTEM, request.getModuleType()));
     }
 
-    private void stopApiTask(TaskCenterBatchRequest request, List<String> projectIds, String userId, String module) {
+    private void stopApiTask(TaskCenterBatchRequest request, List<String> projectIds, String userId, String module,
+                             Consumer<Map<String, List<String>>> checkPermissionFunc) {
         List<ReportDTO> reports = new ArrayList<>();
         if (request.getModuleType().equals(TaskCenterResourceType.API_CASE.toString())) {
             if (request.isSelectAll()) {
@@ -238,11 +242,31 @@ public class ApiTaskCenterService {
                 reports = extApiScenarioReportMapper.getReports(request, projectIds, request.getSelectIds(), DateUtils.getDailyStartTime(), DateUtils.getDailyEndTime());
             }
         }
+        checkBatchPermission(checkPermissionFunc, reports);
         if (CollectionUtils.isNotEmpty(reports)) {
             detailReport(request, reports, userId, module);
         }
     }
 
+    /**
+     * 校验权限
+     * @param checkPermissionFunc
+     * @param reports
+     */
+    public void checkBatchPermission(Consumer<Map<String, List<String>>> checkPermissionFunc, List<ReportDTO> reports) {
+        if (checkPermissionFunc != null && CollectionUtils.isNotEmpty(reports)) {
+            Map<String, List<String>> reportOrgProjectMap = new HashMap<>();
+            reports.forEach(report -> {
+                // 获取组织和项目信息，校验对应权限
+                List<String> reportIds = reportOrgProjectMap.getOrDefault(report.getOrganizationId(), new ArrayList<>());
+                reportIds.add(report.getProjectId());
+                reportOrgProjectMap.put(report.getOrganizationId(), reportIds);
+            });
+            // 校验权限
+            checkPermissionFunc.accept(reportOrgProjectMap);
+        }
+    }
+
     private void detailReport(TaskCenterBatchRequest request,
                               List<ReportDTO> reports,
                               String userId,
@@ -365,25 +389,31 @@ public class ApiTaskCenterService {
         checkOrganizationExist(orgId);
         List<OptionDTO> projectList = getOrgProjectList(orgId);
         List<String> projectIds = projectList.stream().map(OptionDTO::getId).toList();
-        stopApiTask(request, projectIds, userId, OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
+        stopApiTask(request, projectIds, userId, OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, getCheckPermissionFunc(ORG, request.getModuleType()));
-
     }
 
     public void projectStop(TaskCenterBatchRequest request, String currentProjectId, String userId) {
         checkProjectExist(currentProjectId);
-        stopApiTask(request, List.of(currentProjectId), userId, OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER);
+        stopApiTask(request, List.of(currentProjectId), userId, OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER, null);
     }
 
-    public void stopById(String moduleType, String id, String userId, String module) {
+    public void systemStopById(String moduleType, String id, String userId, String module) {
+        stopById(moduleType, id, userId, module, getCheckPermissionFunc(SYSTEM, moduleType));
+    }
+
+    public void orgStopById(String moduleType, String id, String userId, String module) {
+        stopById(moduleType, id, userId, module, getCheckPermissionFunc(ORG, moduleType));
+    }
+
+    public void stopById(String moduleType, String id, String userId, String module, Consumer<Map<String, List<String>>> checkPermissionFunc) {
         List<String> reportIds = new ArrayList<>();
         reportIds.add(id);
         TaskCenterBatchRequest request = new TaskCenterBatchRequest();
         request.setSelectIds(reportIds);
         request.setModuleType(moduleType);
-        stopApiTask(request, null, userId, module);
+        stopApiTask(request, null, userId, module, checkPermissionFunc);
     }
 
-
     public void hasPermission(String type, String moduleType, String orgId, String projectId) {
         Map<String, List<String>> orgPermission = Map.of(
                 TaskCenterResourceType.API_CASE.name(), List.of(PermissionConstants.ORGANIZATION_TASK_CENTER_READ_STOP, PermissionConstants.PROJECT_API_DEFINITION_CASE_EXECUTE),
@@ -415,4 +445,12 @@ public class ApiTaskCenterService {
         }
     }
 
+    public Consumer<Map<String, List<String>>> getCheckPermissionFunc(String type, String moduleType) {
+        return (orgProjectMap) ->
+                orgProjectMap.keySet().forEach(orgId ->
+                        orgProjectMap.get(orgId).forEach(projectId ->
+                                hasPermission(type, moduleType, orgId, projectId)
+                        )
+                );
+    }
 }

backend/services/system-setting/src/main/java/io/metersphere/system/controller/TaskCenterController.java

@@ -31,9 +31,6 @@ public class TaskCenterController {
     @Resource
     private TaskCenterService taskCenterService;
     private static final String PROJECT = "project";
-    private static final String ORG = "org";
-    private static final String SYSTEM = "system";
-
 
     @PostMapping("/project/schedule/page")
     @Operation(summary = "项目-任务中心-定时任务列表")
@@ -57,18 +54,15 @@ public class TaskCenterController {
 
     @GetMapping("/system/schedule/delete/{moduleType}/{id}")
     @Operation(summary = "系统-任务中心-删除定时任务")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
     public void delete(@PathVariable String moduleType, @PathVariable String id) {
-        taskCenterService.hasPermission(SYSTEM, moduleType, SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
+        taskCenterService.checkSystemPermission(moduleType, id);
         taskCenterService.delete(id, moduleType, SessionUtils.getUserId(), "/task/center/system/schedule/delete/", OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
     }
 
     @GetMapping("/org/schedule/delete/{moduleType}/{id}")
     @Operation(summary = "组织-任务中心-删除定时任务")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
     public void deleteOrg(@PathVariable String moduleType, @PathVariable String id) {
-        taskCenterService.hasPermission(ORG, moduleType,
+        taskCenterService.checkOrgPermission(moduleType, id);
-                SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
         taskCenterService.delete(id, moduleType, SessionUtils.getUserId(), "/task/center/org/schedule/delete/", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
     }
 
@@ -83,20 +77,16 @@ public class TaskCenterController {
 
     @GetMapping("/system/schedule/switch/{moduleType}/{id}")
     @Operation(summary = "系统-任务中心-定时任务开启关闭")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
     public void enable(@PathVariable String moduleType, @PathVariable String id) {
-        taskCenterService.hasPermission(SYSTEM, moduleType,
+        taskCenterService.checkSystemPermission(moduleType, id);
-                SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
         taskCenterService.enable(id, moduleType, SessionUtils.getUserId(), "/task/center/system/schedule/switch/", OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
     }
 
 
     @GetMapping("/org/schedule/switch/{moduleType}/{id}")
     @Operation(summary = "组织-任务中心-定时任务开启关闭")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
     public void enableOrg(@PathVariable String moduleType, @PathVariable String id) {
-        taskCenterService.hasPermission(ORG, moduleType,
+        taskCenterService.checkOrgPermission(moduleType, id);
-                SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
         taskCenterService.enable(id, moduleType, SessionUtils.getUserId(), "/task/center/org/schedule/switch/", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
     }
 
@@ -111,19 +101,15 @@ public class TaskCenterController {
 
     @PostMapping("/system/schedule/update/{moduleType}/{id}")
     @Operation(summary = "系统-任务中心-修改定时任务")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
+    public void updateSystem(@PathVariable String moduleType, @PathVariable String id, @RequestBody Object cron) {
-    public void update(@PathVariable String moduleType, @PathVariable String id, @RequestBody Object cron) {
+        taskCenterService.checkSystemPermission(moduleType, id);
-        taskCenterService.hasPermission(SYSTEM, moduleType,
-                SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
         taskCenterService.update(id, moduleType, cron.toString(), SessionUtils.getUserId(), "/task/center/system/schedule/update/", OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
     }
 
     @PostMapping("/org/schedule/update/{moduleType}/{id}")
     @Operation(summary = "组织-任务中心-修改定时任务")
-    @CheckOwner(resourceId = "#id", resourceType = "schedule")
     public void updateOrg(@PathVariable String moduleType, @PathVariable String id, @RequestBody Object cron) {
-        taskCenterService.hasPermission(ORG, moduleType,
+        taskCenterService.checkOrgPermission(moduleType, id);
-                SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
         taskCenterService.update(id, moduleType, cron.toString(), SessionUtils.getUserId(), "/task/center/org/schedule/update/", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
     }
 
@@ -139,15 +125,13 @@ public class TaskCenterController {
     @PostMapping("/system/schedule/batch-enable")
     @Operation(summary = "系统-任务中心-定时任务批量开启")
     public void batchEnable(@Validated @RequestBody TaskCenterScheduleBatchRequest request) {
-        taskCenterService.hasPermission(SYSTEM, request.getScheduleTagType(), SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
+        taskCenterService.systemBatchEnable(request, SessionUtils.getUserId(), "/task/center/system/schedule/batch-enable", OperationLogModule.SETTING_SYSTEM_TASK_CENTER, true, SessionUtils.getCurrentProjectId());
-        taskCenterService.batchEnable(request, SessionUtils.getUserId(), "/task/center/system/schedule/batch-enable", OperationLogModule.SETTING_SYSTEM_TASK_CENTER, true, SessionUtils.getCurrentProjectId());
     }
 
     @PostMapping("/org/schedule/batch-enable")
     @Operation(summary = "组织-任务中心-定时任务批量开启")
     public void batchOrgEnable(@Validated @RequestBody TaskCenterScheduleBatchRequest request) {
-        taskCenterService.hasPermission(ORG, request.getScheduleTagType(), SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
+        taskCenterService.orgBatchEnable(request, SessionUtils.getUserId(), SessionUtils.getCurrentOrganizationId(), "/task/center/org/schedule/batch-enable", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, true, SessionUtils.getCurrentProjectId());
-        taskCenterService.batchEnableOrg(request, SessionUtils.getUserId(), SessionUtils.getCurrentOrganizationId(), "/task/center/org/schedule/batch-enable", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, true, SessionUtils.getCurrentProjectId());
     }
 
     @PostMapping("/project/schedule/batch-enable")
@@ -160,15 +144,13 @@ public class TaskCenterController {
     @PostMapping("/system/schedule/batch-disable")
     @Operation(summary = "系统-任务中心-定时任务批量关闭")
     public void batchDisable(@Validated @RequestBody TaskCenterScheduleBatchRequest request) {
-        taskCenterService.hasPermission(SYSTEM, request.getScheduleTagType(), SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
+        taskCenterService.systemBatchEnable(request, SessionUtils.getUserId(), "/task/center/system/schedule/batch-disable", OperationLogModule.SETTING_SYSTEM_TASK_CENTER, false, SessionUtils.getCurrentProjectId());
-        taskCenterService.batchEnable(request, SessionUtils.getUserId(), "/task/center/system/schedule/batch-disable", OperationLogModule.SETTING_SYSTEM_TASK_CENTER, false, SessionUtils.getCurrentProjectId());
     }
 
     @PostMapping("/org/schedule/batch-disable")
     @Operation(summary = "组织-任务中心-定时任务批量关闭")
     public void batchOrgDisable(@Validated @RequestBody TaskCenterScheduleBatchRequest request) {
-        taskCenterService.hasPermission(ORG, request.getScheduleTagType(), SessionUtils.getCurrentOrganizationId(), SessionUtils.getCurrentProjectId());
+        taskCenterService.orgBatchEnable(request, SessionUtils.getUserId(), SessionUtils.getCurrentOrganizationId(), "/task/center/org/schedule/batch-disable", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, false, SessionUtils.getCurrentProjectId());
-        taskCenterService.batchEnableOrg(request, SessionUtils.getUserId(), SessionUtils.getCurrentOrganizationId(), "/task/center/org/schedule/batch-disable", OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, false, SessionUtils.getCurrentProjectId());
     }
 
     @PostMapping("/project/schedule/batch-disable")
@@ -214,6 +196,4 @@ public class TaskCenterController {
     public int projectRealTotal() {
         return taskCenterService.getProjectRealTotal(SessionUtils.getCurrentProjectId());
     }
-
-
 }

backend/services/system-setting/src/main/java/io/metersphere/system/service/TaskCenterService.java

@@ -3,6 +3,7 @@ package io.metersphere.system.service;
 import com.github.pagehelper.Page;
 import com.github.pagehelper.page.PageMethod;
 import io.metersphere.project.domain.Project;
+import io.metersphere.project.domain.ProjectExample;
 import io.metersphere.project.mapper.ProjectMapper;
 import io.metersphere.sdk.constants.HttpMethodConstants;
 import io.metersphere.sdk.constants.PermissionConstants;
@@ -45,10 +46,8 @@ import org.quartz.TriggerKey;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-import java.util.ArrayList;
+import java.util.*;
-import java.util.List;
+import java.util.function.Consumer;
-import java.util.Map;
-import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
@@ -100,6 +99,8 @@ public class TaskCenterService {
 
 
     private static final String CREATE_TIME_SORT = "create_time desc";
+    private static final String ORG = "org";
+    private static final String SYSTEM = "system";
 
 
     public Pager<List<TaskCenterScheduleDTO>> getProjectSchedulePage(TaskCenterSchedulePageRequest request, String projectId) {
@@ -216,7 +217,7 @@ public class TaskCenterService {
         };
     }
 
-    private Schedule checkScheduleExit(String id) {
+    public Schedule checkScheduleExit(String id) {
         Schedule schedule = scheduleMapper.selectByPrimaryKey(id);
         if (schedule == null) {
             throw new MSException(Translator.get("schedule_not_exist"));
@@ -278,17 +279,24 @@ public class TaskCenterService {
         operationLogService.batchAdd(logs);
     }
 
-    public void batchEnable(TaskCenterScheduleBatchRequest request, String userId, String path, String module, boolean enable, String projectId) {
+    public void batchEnable(TaskCenterScheduleBatchRequest request, String userId, String path, String module,
-        batchOperation(request, userId, path, module, new ArrayList<>(), enable, projectId);
+                            boolean enable, String projectId, Consumer<Map<String, List<String>>> checkPermissionFunc) {
+        batchOperation(request, userId, path, module, new ArrayList<>(), enable, projectId, checkPermissionFunc);
     }
 
-    public void batchEnableOrg(TaskCenterScheduleBatchRequest request, String userId, String orgId, String path, String module, boolean enable, String projectId) {
+    public void systemBatchEnable(TaskCenterScheduleBatchRequest request, String userId, String path, String module,
+                                  boolean enable, String projectId) {
+        batchEnable(request, userId, path, module, enable, projectId, getCheckPermissionFunc(SYSTEM, request.getScheduleTagType()));
+    }
+
+    public void orgBatchEnable(TaskCenterScheduleBatchRequest request, String userId, String orgId, String path, String module,
+                               boolean enable, String projectId) {
         List<OptionDTO> projectList = getOrgProjectList(orgId);
-        batchOperation(request, userId, path, module, projectList, enable, projectId);
+        batchOperation(request, userId, path, module, projectList, enable, projectId, getCheckPermissionFunc(ORG, request.getScheduleTagType()));
-
     }
 
-    private void batchOperation(TaskCenterScheduleBatchRequest request, String userId, String path, String module, List<OptionDTO> projectList, boolean enable, String projectId) {
+    private void batchOperation(TaskCenterScheduleBatchRequest request, String userId, String path, String module,
+                                List<OptionDTO> projectList, boolean enable, String projectId, Consumer<Map<String, List<String>>> checkPermissionFunc) {
         List<Schedule> scheduleList;
         if (request.isSelectAll()) {
             List<String> projectIds = projectList.stream().map(OptionDTO::getId).toList();
@@ -304,6 +312,9 @@ public class TaskCenterService {
             scheduleList.removeAll(request.getExcludeIds());
         }
 
+        // 校验权限
+        checkBatchPermission(checkPermissionFunc, scheduleList);
+
         SqlSession sqlSession = sqlSessionFactory.openSession(ExecutorType.BATCH);
         ScheduleMapper batchMapper = sqlSession.getMapper(ScheduleMapper.class);
         SubListUtils.dealForSubList(scheduleList, 100, list -> {
@@ -326,9 +337,36 @@ public class TaskCenterService {
         saveLog(scheduleList, userId, path, HttpMethodConstants.POST.name(), logModule, OperationLogType.UPDATE.name());
     }
 
-    public void batchEnableProject(TaskCenterScheduleBatchRequest request, String userId, String projectId, String path, String module, boolean enable) {
+    /**
+     * 校验权限
+     *
+     * @param checkPermissionFunc
+     * @param schedules
+     */
+    public void checkBatchPermission(Consumer<Map<String, List<String>>> checkPermissionFunc, List<Schedule> schedules) {
+        if (checkPermissionFunc != null && CollectionUtils.isNotEmpty(schedules)) {
+            List<String> projectIds = schedules.stream().map(Schedule::getProjectId).distinct().toList();
+            ProjectExample example = new ProjectExample();
+            example.createCriteria().andIdIn(projectIds);
+            Map<String, String> projectOrgMap = projectMapper.selectByExample(example)
+                    .stream()
+                    .collect(Collectors.toMap(Project::getId, Project::getOrganizationId));
+            Map<String, List<String>> reportOrgProjectMap = new HashMap<>();
+            schedules.forEach(schedule -> {
+                // 获取组织和项目信息，校验对应权限
+                List<String> reportIds = reportOrgProjectMap.getOrDefault(projectOrgMap.get(schedule.getProjectId()), new ArrayList<>());
+                reportIds.add(schedule.getProjectId());
+                reportOrgProjectMap.put(projectOrgMap.get(schedule.getProjectId()), reportIds);
+            });
+            // 校验权限
+            checkPermissionFunc.accept(reportOrgProjectMap);
+        }
+    }
+
+    public void batchEnableProject(TaskCenterScheduleBatchRequest request, String userId, String projectId, String path,
+                                   String module, boolean enable) {
         List<OptionDTO> projectList = getProjectOption(projectId);
-        batchOperation(request, userId, path, module, projectList, enable, projectId);
+        batchOperation(request, userId, path, module, projectList, enable, projectId, null);
     }
 
     public void hasPermission(String type, String moduleType, String orgId, String projectId) {
@@ -407,4 +445,26 @@ public class TaskCenterService {
         int testPlanTotal = extRealMapper.testPlanReportCountByProjectIds(List.of(currentProjectId), DateUtils.getDailyStartTime(), DateUtils.getDailyEndTime());
         return apiTestCaseTotal + apiScenarioTotal + testPlanTotal;
     }
+
+    private Consumer<Map<String, List<String>>> getCheckPermissionFunc(String type, String moduleType) {
+        return (orgProjectMap) ->
+                orgProjectMap.keySet().forEach(orgId ->
+                        orgProjectMap.get(orgId).forEach(projectId ->
+                                hasPermission(type, moduleType, orgId, projectId)
+                        )
+                );
+    }
+
+    public void checkSystemPermission(String moduleType, String id) {
+        Schedule schedule = checkScheduleExit(id);
+        Project project = projectMapper.selectByPrimaryKey(schedule.getProjectId());
+        hasPermission(SYSTEM, moduleType,
+                project.getOrganizationId(), schedule.getProjectId());
+    }
+
+    public void checkOrgPermission(String moduleType, String id) {
+        Schedule schedule = checkScheduleExit(id);
+        hasPermission(ORG, moduleType,
+                SessionUtils.getCurrentOrganizationId(), schedule.getProjectId());
+    }
 }

backend/services/test-plan/src/main/java/io/metersphere/plan/controller/TestPlanTaskCenterController.java

@@ -26,9 +26,6 @@ public class TestPlanTaskCenterController {
     private TestPlanTaskCenterService testPlanTaskCenterService;
 
     private static final String PROJECT = "project";
-    private static final String ORG = "org";
-    private static final String SYSTEM = "system";
-
 
     @PostMapping("/project/real-time/page")
     @Operation(summary = "项目-任务中心-测试计划-实时任务列表")
@@ -57,16 +54,13 @@ public class TestPlanTaskCenterController {
                 SessionUtils.getCurrentOrganizationId(),
                 SessionUtils.getCurrentProjectId());
         testPlanTaskCenterService.stopById(id, SessionUtils.getUserId(),
-                OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER);
+                OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER, null);
     }
 
     @GetMapping("/org/stop/{id}")
     @Operation(summary = "组织-任务中心-接口用例/场景-停止任务")
     public void stopOrgById(@PathVariable String id) {
-        testPlanTaskCenterService.hasPermission(ORG,
+        testPlanTaskCenterService.orgStopById(id, SessionUtils.getUserId(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-        testPlanTaskCenterService.stopById(id, SessionUtils.getUserId(),
                 OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
     }
 
@@ -74,29 +68,19 @@ public class TestPlanTaskCenterController {
     @Operation(summary = "系统-任务中心-接口用例/场景-停止任务")
     @RequiresPermissions(PermissionConstants.PROJECT_API_REPORT_READ)
     public void stopSystemById(@PathVariable String id) {
-        testPlanTaskCenterService.hasPermission(SYSTEM,
+        testPlanTaskCenterService.systemStopById(id, SessionUtils.getUserId(),
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-        testPlanTaskCenterService.stopById(id, SessionUtils.getUserId(),
                 OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
     }
 
     @PostMapping("/system/stop")
     @Operation(summary = "系统-任务中心-接口用例/场景-停止任务")
     public void systemStop(@Validated @RequestBody TaskCenterBatchRequest request) {
-        testPlanTaskCenterService.hasPermission(SYSTEM,
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
         testPlanTaskCenterService.systemStop(request, SessionUtils.getUserId());
     }
 
     @PostMapping("/org/stop")
     @Operation(summary = "组织-任务中心-接口用例/场景-停止任务")
     public void orgStop(@Validated @RequestBody TaskCenterBatchRequest request) {
-        testPlanTaskCenterService.hasPermission(ORG,
-                SessionUtils.getCurrentOrganizationId(),
-                SessionUtils.getCurrentProjectId());
-
         testPlanTaskCenterService.orgStop(request, SessionUtils.getCurrentOrganizationId(), SessionUtils.getUserId());
     }
 
@@ -108,6 +92,4 @@ public class TestPlanTaskCenterController {
                 SessionUtils.getCurrentProjectId());
         testPlanTaskCenterService.projectStop(request, SessionUtils.getCurrentProjectId(), SessionUtils.getUserId());
     }
-
-
 }

backend/services/test-plan/src/main/java/io/metersphere/plan/service/TestPlanTaskCenterService.java

@@ -5,6 +5,7 @@ import com.github.pagehelper.page.PageMethod;
 import io.metersphere.api.dto.definition.ExecuteReportDTO;
 import io.metersphere.api.dto.report.ReportDTO;
 import io.metersphere.api.mapper.ExtApiScenarioReportMapper;
+import io.metersphere.api.service.ApiTaskCenterService;
 import io.metersphere.engine.MsHttpClient;
 import io.metersphere.plan.mapper.ExtTestPlanReportMapper;
 import io.metersphere.project.domain.Project;
@@ -46,6 +47,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.*;
+import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -80,7 +82,11 @@ public class TestPlanTaskCenterService {
     ExtApiScenarioReportMapper extApiScenarioReportMapper;
     @Resource
     TestPlanExecuteService testPlanExecuteService;
+    @Resource
+    ApiTaskCenterService apiTaskCenterService;
     private static final String DEFAULT_SORT = "start_time desc";
+    private static final String ORG = "org";
+    private static final String SYSTEM = "system";
 
     /**
      * 任务中心实时任务列表-项目级
@@ -239,15 +245,14 @@ public class TestPlanTaskCenterService {
     }
 
     public void systemStop(TaskCenterBatchRequest request, String userId) {
-        stopApiTask(request, new ArrayList<>(), userId, OperationLogModule.SETTING_SYSTEM_TASK_CENTER);
+        stopApiTask(request, new ArrayList<>(), userId, OperationLogModule.SETTING_SYSTEM_TASK_CENTER, getCheckPermissionFunc(SYSTEM));
     }
 
     public void orgStop(TaskCenterBatchRequest request, String orgId, String userId) {
         checkOrganizationExist(orgId);
         List<OptionDTO> projectList = getOrgProjectList(orgId);
         List<String> projectIds = projectList.stream().map(OptionDTO::getId).toList();
-        stopApiTask(request, projectIds, userId, OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER);
+        stopApiTask(request, projectIds, userId, OperationLogModule.SETTING_ORGANIZATION_TASK_CENTER, getCheckPermissionFunc(ORG));
-
     }
 
     public void projectStop(TaskCenterBatchRequest request, String currentProjectId, String userId) {
@@ -255,23 +260,38 @@ public class TestPlanTaskCenterService {
         stopApiTask(request, List.of(currentProjectId), userId, OperationLogModule.PROJECT_MANAGEMENT_TASK_CENTER);
     }
 
+    public void systemStopById(String id, String userId, String logModule) {
+        stopById(id, userId, logModule, getCheckPermissionFunc(SYSTEM));
+    }
 
-    public void stopById(String id, String userId, String logModule) {
+    public void orgStopById(String id, String userId, String logModule) {
+        stopById(id, userId, logModule, getCheckPermissionFunc(ORG));
+    }
+
+    public void stopById(String id, String userId, String logModule, Consumer<Map<String, List<String>>> checkPermissionFunc) {
         List<String> reportIds = new ArrayList<>();
         reportIds.add(id);
         TaskCenterBatchRequest request = new TaskCenterBatchRequest();
         request.setSelectIds(reportIds);
         request.setModuleType(TaskCenterResourceType.TEST_PLAN.name());
-        stopApiTask(request, null, userId, logModule);
+        stopApiTask(request, null, userId, logModule, checkPermissionFunc);
     }
 
     private void stopApiTask(TaskCenterBatchRequest request, List<String> projectIds, String userId, String module) {
+        stopApiTask(request, projectIds, userId, module, null);
+    }
+
+    private void stopApiTask(TaskCenterBatchRequest request, List<String> projectIds, String userId, String module,
+                             Consumer<Map<String, List<String>>> checkPermissionFunc) {
         List<ReportDTO> reports;
         if (request.isSelectAll()) {
             reports = extTestPlanReportMapper.getReports(request, projectIds, null, DateUtils.getDailyStartTime(), DateUtils.getDailyEndTime());
         } else {
             reports = extTestPlanReportMapper.getReports(request, projectIds, request.getSelectIds(), DateUtils.getDailyStartTime(), DateUtils.getDailyEndTime());
         }
+
+        apiTaskCenterService.checkBatchPermission(checkPermissionFunc, reports);
+
         // 需要处理  如果是集成报告， 需要找到计划组下面的所有的测试计划 然后全部停掉
         if (CollectionUtils.isNotEmpty(reports)) {
             //过滤所有为集合的报告，取测试计划ID
@@ -369,4 +389,12 @@ public class TestPlanTaskCenterService {
         operationLogService.batchAdd(logs);
     }
 
+    public Consumer<Map<String, List<String>>> getCheckPermissionFunc(String type) {
+        return (orgProjectMap) ->
+                orgProjectMap.keySet().forEach(orgId ->
+                        orgProjectMap.get(orgId).forEach(projectId ->
+                                hasPermission(type, orgId, projectId)
+                        )
+                );
+    }
 }

frontend/src/api/requrls/project-management/taskCenter.ts

@@ -81,6 +81,6 @@ export const taskSysPlanRealCenterListUrl = '/task/center/plan/system/real-time/
 export const taskOrgPlanRealCenterListUrl = '/task/center/plan/org/real-time/page';
 export const taskProPlanRealCenterListUrl = '/task/center/plan/project/real-time/page';
 
-export const stopRealSysPlanUrl = '/task/center/plan/project/stop';
+export const stopRealSysPlanUrl = '/task/center/plan/system/stop';
 export const stopRealOrgPlanUrl = '/task/center/plan/org/stop';
 export const stopRealProjectPlanUrl = '/task/center/plan/project/stop';