允许代理看

internal/service/refund/service.go

@@ -193,6 +193,9 @@ func (s *Service) Approve(ctx context.Context, id uint, req *dto.ApproveRefundRe
 	if userID == 0 {
 		return errors.New(errors.CodeUnauthorized, "未授权访问")
 	}
+	if err := ensureRefundProcessor(ctx); err != nil {
+		return err
+	}
 
 	refund, err := s.refundStore.GetByID(ctx, id)
 	if err != nil {
@@ -267,6 +270,9 @@ func (s *Service) Reject(ctx context.Context, id uint, req *dto.RejectRefundRequ
 	if userID == 0 {
 		return errors.New(errors.CodeUnauthorized, "未授权访问")
 	}
+	if err := ensureRefundProcessor(ctx); err != nil {
+		return err
+	}
 
 	now := time.Now()
 	result := s.db.WithContext(ctx).
@@ -296,6 +302,9 @@ func (s *Service) Return(ctx context.Context, id uint, req *dto.ReturnRefundRequ
 	if userID == 0 {
 		return errors.New(errors.CodeUnauthorized, "未授权访问")
 	}
+	if err := ensureRefundProcessor(ctx); err != nil {
+		return err
+	}
 
 	now := time.Now()
 	result := s.db.WithContext(ctx).
@@ -318,6 +327,15 @@ func (s *Service) Return(ctx context.Context, id uint, req *dto.ReturnRefundRequ
 	return nil
 }
 
+// ensureRefundProcessor 确保只有平台侧账号可以处理审批类动作。
+func ensureRefundProcessor(ctx context.Context) error {
+	userType := middleware.GetUserTypeFromContext(ctx)
+	if userType == constants.UserTypeSuperAdmin || userType == constants.UserTypePlatform {
+		return nil
+	}
+	return errors.New(errors.CodeForbidden, "无权限处理退款申请")
+}
+
 // Resubmit 重新提交退款申请
 // 条件更新 WHERE status=4（已退回），修改部分字段后重新进入待审批状态
 func (s *Service) Resubmit(ctx context.Context, id uint, req *dto.ResubmitRefundRequest) error {