fix: 充值订单列表按当前登录资产过滤，修复越权查看其他资产数据的漏洞

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

internal/handler/app/client_recharge_order.go

@@ -32,7 +32,7 @@ func NewClientRechargeOrderHandler(
 	return &ClientRechargeOrderHandler{
 		rechargeOrderStore: rechargeOrderStore,
 		paymentStore:       paymentStore,
-		logger:            logger,
+		logger:             logger,
 	}
 }
 
@@ -64,6 +64,10 @@ func (h *ClientRechargeOrderHandler) ListRechargeOrders(c *fiber.Ctx) error {
 		PageSize: req.PageSize,
 		UserID:   &customerID,
 	}
+	if assetType, assetID, ok := middleware.GetCurrentAsset(c); ok {
+		params.ResourceType = &assetType
+		params.ResourceID = &assetID
+	}
 	if req.Status > 0 {
 		params.Status = &req.Status
 	}

internal/store/postgres/recharge_order_store.go

@@ -131,14 +131,16 @@ func (s *RechargeOrderStore) ListByUserID(ctx context.Context, userID uint, offs
 }
 
 type ListRechargeOrderParams struct {
-	Page      int
+	Page         int
-	PageSize  int
+	PageSize     int
-	UserID    *uint
+	UserID       *uint
-	IotCardID *uint
+	IotCardID    *uint
-	DeviceID  *uint
+	DeviceID     *uint
-	Status    *int
+	Status       *int
-	StartTime interface{}
+	StartTime    interface{}
-	EndTime   interface{}
+	EndTime      interface{}
+	ResourceType *string
+	ResourceID   *uint
 }
 
 func (s *RechargeOrderStore) List(ctx context.Context, params *ListRechargeOrderParams) ([]*model.RechargeOrder, int64, error) {
@@ -159,6 +161,9 @@ func (s *RechargeOrderStore) List(ctx context.Context, params *ListRechargeOrder
 	if params.Status != nil {
 		query = query.Where("status = ?", *params.Status)
 	}
+	if params.ResourceType != nil && params.ResourceID != nil {
+		query = query.Where("resource_type = ? AND resource_id = ?", *params.ResourceType, *params.ResourceID)
+	}
 	if params.StartTime != nil {
 		query = query.Where("created_at >= ?", params.StartTime)
 	}