fix(系统设置): 修复checkOwner相关的问题

backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectMemberController.java

@@ -12,6 +12,7 @@ import io.metersphere.sdk.constants.PermissionConstants;
 import io.metersphere.system.dto.CommentUserInfo;
 import io.metersphere.system.dto.sdk.OptionDTO;
 import io.metersphere.system.dto.user.UserExtendDTO;
+import io.metersphere.system.security.CheckOwner;
 import io.metersphere.system.utils.PageUtils;
 import io.metersphere.system.utils.Pager;
 import io.metersphere.system.utils.SessionUtils;
@@ -41,6 +42,7 @@ public class ProjectMemberController {
     @PostMapping("/list")
     @Operation(summary = "项目管理-成员-列表查询")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
+    @CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
     public Pager<List<ProjectUserDTO>> listMember(@Validated @RequestBody ProjectMemberRequest request) {
         Page<Object> page = PageHelper.startPage(request.getCurrent(), request.getPageSize(), true);
         return PageUtils.setPageInfo(page, projectMemberService.listMember(request));
@@ -49,6 +51,7 @@ public class ProjectMemberController {
     @GetMapping("/get-member/option/{projectId}")
     @Operation(summary = "项目管理-成员-获取成员下拉选项")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
+    @CheckOwner(resourceId = "#projectId", resourceType = "project")
     public List<UserExtendDTO> getMemberOption(@PathVariable String projectId,
                                                @Schema(description = "查询关键字，根据邮箱和用户名查询")
                                             @RequestParam(value = "keyword", required = false) String keyword) {
@@ -58,6 +61,7 @@ public class ProjectMemberController {
     @GetMapping("/get-role/option/{projectId}")
     @Operation(summary = "项目管理-成员-获取用户组下拉选项")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_READ)
+    @CheckOwner(resourceId = "#projectId", resourceType = "project")
     public List<OptionDTO> getRoleOption(@PathVariable String projectId) {
         return projectMemberService.getRoleOption(projectId);
     }
@@ -65,6 +69,7 @@ public class ProjectMemberController {
     @PostMapping("/add")
     @Operation(summary = "项目管理-成员-添加成员")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_ADD)
+    @CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
     public void addMember(@RequestBody ProjectMemberAddRequest request) {
         projectMemberService.addMember(request, SessionUtils.getUserId());
     }
@@ -72,6 +77,7 @@ public class ProjectMemberController {
     @PostMapping("/update")
     @Operation(summary = "项目管理-成员-编辑成员")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_UPDATE)
+    @CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
     public void updateMember(@RequestBody ProjectMemberEditRequest request) {
         projectMemberService.updateMember(request, SessionUtils.getUserId());
     }
@@ -83,6 +89,7 @@ public class ProjectMemberController {
             @Parameter(name = "userId", description = "成员ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
     })
     @RequiresPermissions(PermissionConstants.PROJECT_USER_DELETE)
+    @CheckOwner(resourceId = "#projectId", resourceType = "project")
     public void removeMember(@PathVariable String projectId, @PathVariable String userId) {
         projectMemberService.removeMember(projectId, userId, SessionUtils.getUserId());
     }
@@ -90,6 +97,7 @@ public class ProjectMemberController {
     @PostMapping("/add-role")
     @Operation(summary = "项目管理-成员-批量添加至用户组")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_UPDATE)
+    @CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
     public void addMemberRole(@RequestBody ProjectMemberAddRequest request) {
         projectMemberService.addRole(request, SessionUtils.getUserId());
     }
@@ -97,6 +105,7 @@ public class ProjectMemberController {
     @PostMapping("/batch/remove")
     @Operation(summary = "项目管理-成员-批量从项目移除")
     @RequiresPermissions(PermissionConstants.PROJECT_USER_DELETE)
+    @CheckOwner(resourceId = "#request.getProjectId()", resourceType = "project")
     public void batchRemove(@RequestBody ProjectMemberBatchDeleteRequest request) {
         projectMemberService.batchRemove(request, SessionUtils.getUserId());
     }

backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectStatusFlowSettingController.java

@@ -11,6 +11,7 @@ import io.metersphere.system.dto.sdk.request.StatusItemAddRequest;
 import io.metersphere.system.dto.sdk.request.StatusItemUpdateRequest;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckProjectOwner;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.media.Schema;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -48,6 +49,7 @@ public class ProjectStatusFlowSettingController {
     @Operation(summary = "项目管理-模板-状态流设置-设置状态定义，即起始状态，结束状态")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusDefinitionLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getStatusId()", resourceType = "status_item", resourceCol = "scope_id")
     public void updateStatusDefinition(@Validated @RequestBody StatusDefinitionUpdateRequest request) {
         projectStatusFlowSettingService.updateStatusDefinition(request);
     }
@@ -55,6 +57,7 @@ public class ProjectStatusFlowSettingController {
     @PostMapping("/status/sort/{projectId}/{scene}")
     @Operation(summary = "系统设置-组织-状态流设置-状态项排序")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
+    @CheckProjectOwner(resourceId = "#statusIds", resourceType = "status_item", resourceCol = "scope_id")
     public void sortStatusItem(@PathVariable
                                String projectId,
                                @PathVariable
@@ -77,6 +80,7 @@ public class ProjectStatusFlowSettingController {
     @Operation(summary = "项目管理-模板-状态流设置-修改状态项")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusItemLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getId()", resourceType = "status_item", resourceCol = "scope_id")
     public StatusItem updateStatusItem(@Validated @RequestBody StatusItemUpdateRequest request) {
         return projectStatusFlowSettingService.updateStatusItem(request);
     }
@@ -85,6 +89,7 @@ public class ProjectStatusFlowSettingController {
     @Operation(summary = "项目管理-模板-状态流设置-删除状态项")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.deleteStatusItemLog(#id)", msClass = ProjectStatusFlowSettingLogService.class)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "status_item", resourceCol = "scope_id")
     public void deleteStatusItem(@PathVariable String id) {
         projectStatusFlowSettingService.deleteStatusItem(id);
     }
@@ -93,6 +98,7 @@ public class ProjectStatusFlowSettingController {
     @Operation(summary = "项目管理-模板-状态流设置-设置状态流转")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusFlowLog(#request)", msClass = ProjectStatusFlowSettingLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getFromId()", resourceType = "status_item", resourceCol = "scope_id")
     public void updateStatusFlow(@Validated @RequestBody StatusFlowUpdateRequest request) {
         projectStatusFlowSettingService.updateStatusFlow(request);
     }

backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectTemplateController.java

@@ -9,6 +9,7 @@ import io.metersphere.system.dto.sdk.TemplateDTO;
 import io.metersphere.system.dto.sdk.request.TemplateUpdateRequest;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckProjectOwner;
 import io.metersphere.system.utils.SessionUtils;
 import io.metersphere.validation.groups.Created;
 import io.metersphere.validation.groups.Updated;
@@ -48,6 +49,7 @@ public class ProjectTemplateController {
     @GetMapping("/get/{id}")
     @Operation(summary = "获取模版详情")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_READ)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
     public TemplateDTO get(@PathVariable String id) {
         return projectTemplateservice.getTemplateDTOWithCheck(id);
     }
@@ -64,6 +66,7 @@ public class ProjectTemplateController {
     @Operation(summary = "更新模版")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = ProjectTemplateLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getId()", resourceType = "template", resourceCol = "scope_id")
     public Template update(@Validated({Updated.class}) @RequestBody TemplateUpdateRequest request) {
         return projectTemplateservice.update(request);
     }
@@ -72,6 +75,7 @@ public class ProjectTemplateController {
     @Operation(summary = "删除模版")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_DELETE)
     @Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = ProjectTemplateLogService.class)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
     public void delete(@PathVariable String id) {
         projectTemplateservice.delete(id);
     }
@@ -80,6 +84,7 @@ public class ProjectTemplateController {
     @Operation(summary = "设置默认模板")
     @RequiresPermissions(PermissionConstants.PROJECT_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.setDefaultTemplateLog(#id)", msClass = ProjectTemplateLogService.class)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
     public void setDefaultTemplate(@PathVariable String projectId, @PathVariable String id) {
         projectTemplateservice.setDefaultTemplate(projectId, id);
     }

backend/services/project-management/src/main/java/io/metersphere/project/controller/ProjectUserRoleController.java

@@ -18,6 +18,7 @@ import io.metersphere.system.dto.sdk.request.PermissionSettingUpdateRequest;
 import io.metersphere.system.dto.user.UserExtendDTO;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckProjectOwner;
 import io.metersphere.system.service.UserRoleService;
 import io.metersphere.system.utils.PageUtils;
 import io.metersphere.system.utils.Pager;
@@ -50,6 +51,7 @@ public class ProjectUserRoleController {
     @PostMapping("/list")
     @Operation(summary = "项目管理-项目与权限-用户组-获取用户组列表")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_READ)
+    @CheckProjectOwner(resourceId = "#request.getProjectId()", resourceType = "user_role", resourceCol = "scope_id")
     public Pager<List<ProjectUserRoleDTO>> list(@Validated @RequestBody ProjectUserRoleRequest request) {
         Page<Object> page = PageHelper.startPage(request.getCurrent(), request.getPageSize());
         return PageUtils.setPageInfo(page, projectUserRoleService.list(request));
@@ -59,6 +61,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-添加用户组")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_ADD)
     @Log(type = OperationLogType.ADD, expression = "#msClass.addLog(#request)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getScopeId()", resourceType = "user_role", resourceCol = "scope_id")
     public UserRole add(@Validated({Created.class}) @RequestBody ProjectUserRoleEditRequest request) {
         UserRole userRole = new UserRole();
         userRole.setCreateUser(SessionUtils.getUserId());
@@ -70,6 +73,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-修改用户组")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getId()", resourceType = "user_role", resourceCol = "scope_id")
     public UserRole update(@Validated({Updated.class}) @RequestBody ProjectUserRoleEditRequest request) {
         UserRole userRole = new UserRole();
         BeanUtils.copyBean(userRole, request);
@@ -81,6 +85,7 @@ public class ProjectUserRoleController {
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_DELETE)
     @Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
     @Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
     public void delete(@PathVariable String id) {
         projectUserRoleService.delete(id, SessionUtils.getUserId());
     }
@@ -89,6 +94,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-获取用户组对应的权限配置")
     @Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_READ)
+    @CheckProjectOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
     public List<PermissionDefinitionItem> getPermissionSetting(@PathVariable String id) {
         return projectUserRoleService.getPermissionSetting(id);
     }
@@ -97,6 +103,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-修改用户组对应的权限配置")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updatePermissionSettingLog(#request)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void updatePermissionSetting(@Validated @RequestBody PermissionSettingUpdateRequest request) {
         projectUserRoleService.updatePermissionSetting(request);
     }
@@ -127,6 +134,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-添加用户组成员")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void addMember(@Validated @RequestBody ProjectUserRoleMemberEditRequest request) {
         projectUserRoleService.addMember(request, SessionUtils.getUserId());
     }
@@ -135,6 +143,7 @@ public class ProjectUserRoleController {
     @Operation(summary = "项目管理-项目与权限-用户组-删除用户组成员")
     @RequiresPermissions(PermissionConstants.PROJECT_GROUP_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = ProjectUserRoleLogService.class)
+    @CheckProjectOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void removeMember(@Validated @RequestBody ProjectUserRoleMemberEditRequest request) {
         projectUserRoleService.removeMember(request);
     }

backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationStatusFlowSettingController.java

@@ -9,6 +9,7 @@ import io.metersphere.system.dto.sdk.request.StatusItemAddRequest;
 import io.metersphere.system.dto.sdk.request.StatusItemUpdateRequest;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckOrgOwner;
 import io.metersphere.system.service.OrganizationStatusFlowSettingLogService;
 import io.metersphere.system.service.OrganizationStatusFlowSettingService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -48,6 +49,7 @@ public class OrganizationStatusFlowSettingController {
     @Operation(summary = "系统设置-组织-状态流设置-设置状态定义，即起始状态，结束状态")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusDefinitionLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getStatusId()", resourceType = "status_item", resourceCol = "scope_id")
     public void updateStatusDefinition(@Validated @RequestBody StatusDefinitionUpdateRequest request) {
         organizationStatusFlowSettingService.updateStatusDefinition(request);
     }
@@ -64,6 +66,7 @@ public class OrganizationStatusFlowSettingController {
     @Operation(summary = "系统设置-组织-状态流设置-修改状态项")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusItemLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getId()", resourceType = "status_item", resourceCol = "scope_id")
     public StatusItem updateStatusItem(@Validated @RequestBody StatusItemUpdateRequest request) {
         return organizationStatusFlowSettingService.updateStatusItem(request);
     }
@@ -71,6 +74,7 @@ public class OrganizationStatusFlowSettingController {
     @PostMapping("/status/sort/{organizationId}/{scene}")
     @Operation(summary = "系统设置-组织-状态流设置-状态项排序")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
+    @CheckOrgOwner(resourceId = "#statusIds", resourceType = "status_item", resourceCol = "scope_id")
     public void sortStatusItem(@PathVariable
                                String organizationId, @PathVariable String scene,
                                @RequestBody
@@ -83,6 +87,7 @@ public class OrganizationStatusFlowSettingController {
     @Operation(summary = "系统设置-组织-状态流设置-删除状态项")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.deleteStatusItemLog(#id)", msClass = OrganizationStatusFlowSettingLogService.class)
+    @CheckOrgOwner(resourceId = "#id", resourceType = "status_item", resourceCol = "scope_id")
     public void deleteStatusItem(@PathVariable String id) {
         organizationStatusFlowSettingService.deleteStatusItem(id);
     }
@@ -91,6 +96,7 @@ public class OrganizationStatusFlowSettingController {
     @Operation(summary = "系统设置-组织-状态流设置-设置状态流转")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateStatusFlowLog(#request)", msClass = OrganizationStatusFlowSettingLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getFromId()", resourceType = "status_item", resourceCol = "scope_id")
     public void updateStatusFlow(@Validated @RequestBody StatusFlowUpdateRequest request) {
         organizationStatusFlowSettingService.updateStatusFlow(request);
     }

backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationTemplateController.java

@@ -6,6 +6,7 @@ import io.metersphere.system.dto.sdk.TemplateDTO;
 import io.metersphere.system.dto.sdk.request.TemplateUpdateRequest;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckOrgOwner;
 import io.metersphere.system.service.OrganizationTemplateLogService;
 import io.metersphere.system.service.OrganizationTemplateService;
 import io.metersphere.system.utils.SessionUtils;
@@ -47,6 +48,7 @@ public class OrganizationTemplateController {
     @GetMapping("/get/{id}")
     @Operation(summary = "获取模版详情")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_READ)
+    @CheckOrgOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
     public TemplateDTO get(@PathVariable String id) {
         return organizationTemplateService.geDTOWithCheck(id);
     }
@@ -63,6 +65,7 @@ public class OrganizationTemplateController {
     @Operation(summary = "更新模版")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_UPDATE)
     @Log(type = OperationLogType.ADD, expression = "#msClass.updateLog(#request)", msClass = OrganizationTemplateLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getId()", resourceType = "template", resourceCol = "scope_id")
     public Template update(@Validated({Updated.class}) @RequestBody TemplateUpdateRequest request) {
         return organizationTemplateService.update(request);
     }
@@ -71,6 +74,7 @@ public class OrganizationTemplateController {
     @Operation(summary = "删除模版")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_TEMPLATE_DELETE)
     @Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = OrganizationTemplateLogService.class)
+    @CheckOrgOwner(resourceId = "#id", resourceType = "template", resourceCol = "scope_id")
     public void delete(@PathVariable String id) {
         organizationTemplateService.delete(id);
     }

backend/services/system-setting/src/main/java/io/metersphere/system/controller/OrganizationUserRoleController.java

@@ -14,6 +14,7 @@ import io.metersphere.system.dto.sdk.request.PermissionSettingUpdateRequest;
 import io.metersphere.system.dto.user.UserExtendDTO;
 import io.metersphere.system.log.annotation.Log;
 import io.metersphere.system.log.constants.OperationLogType;
+import io.metersphere.system.security.CheckOrgOwner;
 import io.metersphere.system.service.OrganizationUserRoleLogService;
 import io.metersphere.system.service.OrganizationUserRoleService;
 import io.metersphere.system.service.UserRoleService;
@@ -70,6 +71,7 @@ public class OrganizationUserRoleController {
     @Operation(summary = "系统设置-组织-用户组-修改用户组")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updateLog(#request)", msClass = OrganizationUserRoleLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getId()", resourceType = "user_role", resourceCol = "scope_id")
     public UserRole update(@Validated({Updated.class}) @RequestBody OrganizationUserRoleEditRequest request) {
         UserRole userRole = new UserRole();
         BeanUtils.copyBean(userRole, request);
@@ -81,6 +83,7 @@ public class OrganizationUserRoleController {
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_DELETE)
     @Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
     @Log(type = OperationLogType.DELETE, expression = "#msClass.deleteLog(#id)", msClass = OrganizationUserRoleLogService.class)
+    @CheckOrgOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
     public void delete(@PathVariable String id) {
         organizationUserRoleService.delete(id, SessionUtils.getUserId());
     }
@@ -89,6 +92,7 @@ public class OrganizationUserRoleController {
     @Operation(summary = "系统设置-组织-用户组-获取用户组对应的权限配置")
     @Parameter(name = "id", description = "用户组ID", schema = @Schema(requiredMode = Schema.RequiredMode.REQUIRED))
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ)
+    @CheckOrgOwner(resourceId = "#id", resourceType = "user_role", resourceCol = "scope_id")
     public List<PermissionDefinitionItem> getPermissionSetting(@PathVariable String id) {
         return organizationUserRoleService.getPermissionSetting(id);
     }
@@ -97,6 +101,7 @@ public class OrganizationUserRoleController {
     @Operation(summary = "系统设置-组织-用户组-修改用户组对应的权限配置")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.updatePermissionSettingLog(#request)", msClass = OrganizationUserRoleLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void updatePermissionSetting(@Validated @RequestBody PermissionSettingUpdateRequest request) {
         organizationUserRoleService.updatePermissionSetting(request);
     }
@@ -127,6 +132,7 @@ public class OrganizationUserRoleController {
     @Operation(summary = "系统设置-组织-用户组-添加用户组成员")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = OrganizationUserRoleLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void addMember(@Validated @RequestBody OrganizationUserRoleMemberEditRequest request) {
         organizationUserRoleService.addMember(request, SessionUtils.getUserId());
     }
@@ -135,6 +141,7 @@ public class OrganizationUserRoleController {
     @Operation(summary = "系统设置-组织-用户组-删除用户组成员")
     @RequiresPermissions(PermissionConstants.ORGANIZATION_USER_ROLE_READ_UPDATE)
     @Log(type = OperationLogType.UPDATE, expression = "#msClass.editMemberLog(#request)", msClass = OrganizationUserRoleLogService.class)
+    @CheckOrgOwner(resourceId = "#request.getUserRoleId()", resourceType = "user_role", resourceCol = "scope_id")
     public void removeMember(@Validated @RequestBody OrganizationUserRoleMemberEditRequest request) {
         organizationUserRoleService.removeMember(request);
     }

backend/services/system-setting/src/main/java/io/metersphere/system/mapper/ExtCheckOwnerMapper.java

@@ -10,4 +10,8 @@ public interface ExtCheckOwnerMapper {
     boolean checkoutOrganizationOwner(@Param("table") String resourceType, @Param("userId") String userId, @Param("ids") List<String> ids);
 
     boolean checkoutOrganization(@Param("userId") String userId, @Param("ids") List<String> ids);
+
+    boolean checkoutOrganizationOwnerByScope(@Param("table") String resourceType, @Param("column") String resourceColumn, @Param("userId") String userId, @Param("ids") List<String> ids);
+
+    boolean checkoutProjectOwnerByScope(@Param("table") String resourceType, @Param("column") String resourceColumn, @Param("userId") String userId, @Param("ids") List<String> ids);
 }

backend/services/system-setting/src/main/java/io/metersphere/system/mapper/ExtCheckOwnerMapper.xml

@@ -37,4 +37,28 @@
         </foreach>)
         AND user_id = #{userId}
     </select>
+
+    <select id="checkoutOrganizationOwnerByScope" resultType="boolean">
+        SELECT count(1) > 0
+        FROM user_role_relation
+        WHERE source_id IN (SELECT ${column}
+        FROM ${table} JOIN organization ON ${table}.${column} = organization.id AND organization.enable = TRUE
+        WHERE ${table}.id IN
+        <foreach collection="ids" item="id" separator="," open="(" close=")">
+            #{id}
+        </foreach>)
+        AND user_id = #{userId}
+    </select>
+
+    <select id="checkoutProjectOwnerByScope" resultType="boolean">
+        SELECT count(1) > 0
+        FROM user_role_relation
+        WHERE source_id IN (SELECT ${column}
+        FROM ${table} JOIN project ON ${table}.${column} = project.id AND project.enable = TRUE
+        WHERE ${table}.id IN
+        <foreach collection="ids" item="id" separator="," open="(" close=")">
+            #{id}
+        </foreach>)
+        AND user_id = #{userId}
+    </select>
 </mapper>

backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckOrgOwner.java

@@ -0,0 +1,15 @@
+package io.metersphere.system.security;
+
+import java.lang.annotation.*;
+
+@Target({ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface CheckOrgOwner {
+
+    String resourceId();
+
+    String resourceType();
+
+    String resourceCol() default "organization_id";
+}

backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckOrgOwnerAspect.java

@@ -0,0 +1,89 @@
+package io.metersphere.system.security;
+
+
+import io.metersphere.sdk.constants.InternalUserRole;
+import io.metersphere.sdk.exception.MSException;
+import io.metersphere.sdk.util.Translator;
+import io.metersphere.system.mapper.ExtCheckOwnerMapper;
+import io.metersphere.system.utils.SessionUtils;
+import jakarta.annotation.Resource;
+import org.apache.commons.lang3.StringUtils;
+import org.aspectj.lang.JoinPoint;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.aspectj.lang.annotation.Pointcut;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.core.StandardReflectionParameterNameDiscoverer;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.expression.ExpressionParser;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.Method;
+import java.util.List;
+
+
+@Aspect
+@Component
+public class CheckOrgOwnerAspect {
+
+    private ExpressionParser parser = new SpelExpressionParser();
+    private StandardReflectionParameterNameDiscoverer discoverer = new StandardReflectionParameterNameDiscoverer();
+
+    @Resource
+    private ExtCheckOwnerMapper extCheckOwnerMapper;
+
+    @Pointcut("@annotation(io.metersphere.system.security.CheckOrgOwner)")
+    public void pointcut() {
+    }
+
+    @Before("pointcut()")
+    public void before(JoinPoint joinPoint) {
+        //从切面织入点处通过反射机制获取织入点处的方法
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        //获取切入点所在的方法
+        Method method = signature.getMethod();
+        //获取参数对象数组
+        Object[] args = joinPoint.getArgs();
+        CheckOrgOwner checkOwner = method.getAnnotation(CheckOrgOwner.class);
+        long count = SessionUtils.getUser().getUserRoles()
+                .stream()
+                .filter(g -> StringUtils.equalsIgnoreCase(g.getId(), InternalUserRole.ADMIN.getValue()))
+                .count();
+        if (count > 0) {
+            return;
+        }
+        // 操作内容
+        //获取方法参数名
+        String[] params = discoverer.getParameterNames(method);
+        //将参数纳入Spring管理
+        EvaluationContext context = new StandardEvaluationContext();
+        for (int len = 0; len < params.length; len++) {
+            context.setVariable(params[len], args[len]);
+        }
+
+        String resourceId = checkOwner.resourceId();
+        String resourceType = checkOwner.resourceType();
+        String resourceCol = checkOwner.resourceCol();
+        Expression titleExp = parser.parseExpression(resourceId);
+        Object v = titleExp.getValue(context, Object.class);
+        handleOrganizationResource(v, resourceType, resourceCol);
+    }
+
+    private void handleOrganizationResource(Object v, String resourceType, String resourceCol) {
+        if (v instanceof String id) {
+            if (!extCheckOwnerMapper.checkoutOrganizationOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), List.of(id))) {
+                throw new MSException(Translator.get("check_owner_case"));
+            }
+        }
+        if (v instanceof List<?> ids) {
+            // noinspection unchecked
+            if (!extCheckOwnerMapper.checkoutOrganizationOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), (List<String>) ids)) {
+                throw new MSException(Translator.get("check_owner_case"));
+            }
+        }
+    }
+
+}

backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckProjectOwner.java

@@ -0,0 +1,15 @@
+package io.metersphere.system.security;
+
+import java.lang.annotation.*;
+
+@Target({ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface CheckProjectOwner {
+
+    String resourceId();
+
+    String resourceType();
+
+    String resourceCol() default "project_id";
+}

backend/services/system-setting/src/main/java/io/metersphere/system/security/CheckProjectOwnerAspect.java

@@ -0,0 +1,89 @@
+package io.metersphere.system.security;
+
+
+import io.metersphere.sdk.constants.InternalUserRole;
+import io.metersphere.sdk.exception.MSException;
+import io.metersphere.sdk.util.Translator;
+import io.metersphere.system.mapper.ExtCheckOwnerMapper;
+import io.metersphere.system.utils.SessionUtils;
+import jakarta.annotation.Resource;
+import org.apache.commons.lang3.StringUtils;
+import org.aspectj.lang.JoinPoint;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.aspectj.lang.annotation.Pointcut;
+import org.aspectj.lang.reflect.MethodSignature;
+import org.springframework.core.StandardReflectionParameterNameDiscoverer;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.expression.ExpressionParser;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.stereotype.Component;
+
+import java.lang.reflect.Method;
+import java.util.List;
+
+
+@Aspect
+@Component
+public class CheckProjectOwnerAspect {
+
+    private ExpressionParser parser = new SpelExpressionParser();
+    private StandardReflectionParameterNameDiscoverer discoverer = new StandardReflectionParameterNameDiscoverer();
+
+    @Resource
+    private ExtCheckOwnerMapper extCheckOwnerMapper;
+
+    @Pointcut("@annotation(io.metersphere.system.security.CheckProjectOwner)")
+    public void pointcut() {
+    }
+
+    @Before("pointcut()")
+    public void before(JoinPoint joinPoint) {
+        //从切面织入点处通过反射机制获取织入点处的方法
+        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
+        //获取切入点所在的方法
+        Method method = signature.getMethod();
+        //获取参数对象数组
+        Object[] args = joinPoint.getArgs();
+        CheckProjectOwner checkOwner = method.getAnnotation(CheckProjectOwner.class);
+        long count = SessionUtils.getUser().getUserRoles()
+                .stream()
+                .filter(g -> StringUtils.equalsIgnoreCase(g.getId(), InternalUserRole.ADMIN.getValue()))
+                .count();
+        if (count > 0) {
+            return;
+        }
+        // 操作内容
+        //获取方法参数名
+        String[] params = discoverer.getParameterNames(method);
+        //将参数纳入Spring管理
+        EvaluationContext context = new StandardEvaluationContext();
+        for (int len = 0; len < params.length; len++) {
+            context.setVariable(params[len], args[len]);
+        }
+
+        String resourceId = checkOwner.resourceId();
+        String resourceType = checkOwner.resourceType();
+        String resourceCol = checkOwner.resourceCol();
+        Expression titleExp = parser.parseExpression(resourceId);
+        Object v = titleExp.getValue(context, Object.class);
+        handleProjectResource(v, resourceType, resourceCol);
+    }
+
+    private void handleProjectResource(Object v, String resourceType, String resourceCol) {
+        if (v instanceof String id) {
+            if (!extCheckOwnerMapper.checkoutProjectOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), List.of(id))) {
+                throw new MSException(Translator.get("check_owner_case"));
+            }
+        }
+        if (v instanceof List<?> ids) {
+            // noinspection unchecked
+            if (!extCheckOwnerMapper.checkoutProjectOwnerByScope(resourceType, resourceCol, SessionUtils.getUserId(), (List<String>) ids)) {
+                throw new MSException(Translator.get("check_owner_case"));
+            }
+        }
+    }
+
+}

frontend/src/views/bug-management/components/bugCaseTab.vue

@@ -301,6 +301,7 @@
   }
 
   onMounted(async () => {
+    getEnabledModules();
     getFetch();
   });
 

frontend/src/views/bug-management/locale/en-US.ts

@@ -25,7 +25,7 @@ export default {
     syncBugTipRowTwo: 'Create bug and sync bug？',
     bugAutoSync: 'System will auto sync by the project application setting frequency',
     syncTime: 'Sync time',
-    deleteLabel: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
+    deleteLabel: 'Local bug will in recycle bin and third plant bug will be deleted',
     nameIsIncorrect: 'Bug name error',
     selectedCount: '( {count} selected)',
     batchEdit: 'Batch edit',
@@ -35,7 +35,7 @@ export default {
     deleteCount: 'delete {count} bugs？',
     deleteTipInternal: ' {count} numbers of bug witch created by MeterSphere will in recycle bin',
     deleteTipExternal: '{count} numbers of bug will be deleted',
-    deleteTip: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
+    deleteTip: 'Local bug will in recycle bin and third plant bug will be deleted',
     edit: {
       defaultSystemTemplate: 'System template is defaulted',
       content: 'Bug content',
@@ -80,7 +80,7 @@ export default {
       comment: 'Comment',
       shareTip: 'Share link has been copied to clipboard',
       deleteTitle: 'Delete {name} ？',
-      deleteContent: 'Bug witch created by MeterSphere will in recycle bin and third plant bug will be deleted',
+      deleteContent: 'Local bug will in recycle bin and third plant bug will be deleted',
       platform_no_active: 'The bug platform has not been integrated, can not preview and edit details normally',
     },
     batchUpdate: {

frontend/src/views/bug-management/locale/zh-CN.ts

@@ -25,7 +25,7 @@ export default {
     syncBugTipRowTwo: '新增缺陷和更新已有的缺陷？',
     bugAutoSync: '系统将按照项目应用设置频率自动同步',
     syncTime: '同步时间',
-    deleteLabel: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
+    deleteLabel: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
     nameIsIncorrect: '缺陷名称不正确',
     selectedCount: '(已选 {count} 条缺陷)',
     batchEdit: '批量编辑',
@@ -35,7 +35,7 @@ export default {
     deleteCount: '确认删除 {count} 个缺陷吗？',
     deleteTipInternal: '删除后，{count} 条 MeterSphere 创建的缺陷进入回收站',
     deleteTipExternal: '{count} 条第三方平台同步的缺陷将不做回收',
-    deleteTip: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
+    deleteTip: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
     edit: {
       defaultSystemTemplate: '默认为系统模板',
       content: '缺陷内容',
@@ -80,7 +80,7 @@ export default {
       comment: '评论',
       shareTip: '分享链接已复制到剪贴板',
       deleteTitle: '确认删除 {name} 吗？',
-      deleteContent: '删除后，MeterSphere 创建的缺陷进入回收站；第三方平台同步的缺陷将不做回收',
+      deleteContent: '删除后, Local 的缺陷进入回收站; 第三方平台同步的缺陷将不做回收',
       platform_no_active: '该缺陷平台未对接, 无法正常预览及编辑详情相关内容',
     },
     batchUpdate: {

frontend/src/views/project-management/projectAndPermission/menuManagement/menuManagement.vue

@@ -268,7 +268,7 @@
             v-model="allValueMap['BUG_SYNC_SYNC_ENABLE']"
             checked-value="true"
             unchecked-value="false"
-            :disabled="!hasAnyPermission(['PROJECT_APPLICATION_BUG:UPDATE'])"
+            :disabled="!hasAnyPermission(['PROJECT_APPLICATION_BUG:UPDATE']) || !allValueMap['BUG_SYNC_SYNC_ENABLE']"
             :value="allValueMap['BUG_SYNC_SYNC_ENABLE']"
             size="small"
             type="line"
@@ -302,7 +302,9 @@
           <a-switch
             checked-value="true"
             unchecked-value="false"
-            :disabled="!hasAnyPermission(['PROJECT_APPLICATION_CASE:UPDATE'])"
+            :disabled="
+              !hasAnyPermission(['PROJECT_APPLICATION_CASE:UPDATE']) || !allValueMap['CASE_RELATED_CASE_ENABLE']
+            "
             :value="allValueMap['CASE_RELATED_CASE_ENABLE']"
             size="small"
             type="line"