fix(backend): applyPrivacyMask 同步裁剪 items + WorkspaceService 风险按用户过滤

backend/src/main/java/com/yimeng/okr/service/PerformanceService.java

@@ -182,6 +182,9 @@ public class PerformanceService {
             dto.setSuperiorItems(queryScoreItems(dto.getSuperiorScore().getId()));
         }
         if (dto.getFinalScore() != null) {
+            dto.setFinalItems(null);
+        dto.setSelfItems(null);
+        dto.setSuperiorItems(null);
             dto.setFinalItems(queryScoreItems(dto.getFinalScore().getId()));
         }
 
@@ -210,7 +213,13 @@ public class PerformanceService {
 
         if (isSelf || isHrOrAbove) {
             if (isSelf && dto.getFinalScore() != null && !isPublished(dto.getFinalScore())) {
+            dto.setFinalItems(null);
+        dto.setSelfItems(null);
+        dto.setSuperiorItems(null);
                 dto.setFinalScore(null);
+                dto.setFinalItems(null);
+        dto.setSelfItems(null);
+        dto.setSuperiorItems(null);
             }
             return; // 全量可见
         }
@@ -219,6 +228,7 @@ public class PerformanceService {
             // 上级可见总分，但屏蔽自评的详细评分明细
             if (dto.getSelfScore() != null) {
                 dto.getSelfScore().setCommentsJson(null);
+                dto.setSelfItems(null);
             }
             return;
         }
@@ -227,6 +237,7 @@ public class PerformanceService {
         // 但作为纵深防御，仅保留最终评分的总分和等级
         if (dto.getSelfScore() != null) {
             dto.getSelfScore().setCommentsJson(null);
+            dto.setSelfItems(null);
             dto.getSelfScore().setOkrScore(null);
             dto.getSelfScore().setKpiScore(null);
         }
@@ -236,6 +247,9 @@ public class PerformanceService {
             dto.getSuperiorScore().setKpiScore(null);
         }
         if (dto.getFinalScore() != null) {
+            dto.setFinalItems(null);
+        dto.setSelfItems(null);
+        dto.setSuperiorItems(null);
             dto.getFinalScore().setCommentsJson(null);
         }
         dto.setFeedback(null); // 面谈记录不可见

backend/src/main/java/com/yimeng/okr/service/WorkspaceService.java

@@ -170,12 +170,14 @@ public class WorkspaceService {
 
     private List<WorkspaceOverviewDto.RiskItem> buildRisks(Long periodId, Long userId) {
         List<WorkspaceOverviewDto.RiskItem> risks = new ArrayList<>();
+        // Only show blocked KRs that belong to the user or their direct subordinates
         List<Map<String, Object>> blocked = jdbcTemplate.queryForList(
                 "SELECT k.title, u.real_name FROM kr_key_result k " +
                 "JOIN okr_objective o ON k.objective_id = o.id " +
                 "JOIN sys_user u ON o.user_id = u.id " +
-                "WHERE o.period_id = ? AND k.status = 'BLOCKED' LIMIT 5",
-                periodId);
+                "WHERE o.period_id = ? AND k.status = 'BLOCKED' " +
+                "AND (o.user_id = ? OR u.superior_id = ?) LIMIT 5",
+                periodId, userId, userId);
         for (Map<String, Object> row : blocked) {
             WorkspaceOverviewDto.RiskItem risk = new WorkspaceOverviewDto.RiskItem();
             risk.setType("BLOCKED_KR");