允许代理看

internal/store/postgres/refund_store.go

@@ -40,7 +40,7 @@ func (s *RefundStore) GetByID(ctx context.Context, id uint) (*model.RefundReques
 		Select("tb_refund_request.*, tb_shop.shop_name AS shop_name").
 		Joins("LEFT JOIN tb_shop ON tb_shop.id = tb_refund_request.shop_id AND tb_shop.deleted_at IS NULL").
 		Where("tb_refund_request.id = ?", id)
-	query = middleware.ApplyShopFilter(ctx, query)
+	query = applyRefundScope(ctx, query)
 	if err := query.First(&req).Error; err != nil {
 		return nil, err
 	}
@@ -69,7 +69,7 @@ func (s *RefundStore) List(ctx context.Context, opts *store.QueryOptions, filter
 		Model(&model.RefundRequest{}).
 		Select("tb_refund_request.*, tb_shop.shop_name AS shop_name").
 		Joins("LEFT JOIN tb_shop ON tb_shop.id = tb_refund_request.shop_id AND tb_shop.deleted_at IS NULL")
-	query = middleware.ApplyShopFilter(ctx, query)
+	query = applyRefundScope(ctx, query)
 
 	if filters != nil {
 		if filters.Status != nil {
@@ -109,6 +109,23 @@ func (s *RefundStore) List(ctx context.Context, opts *store.QueryOptions, filter
 	return requests, total, nil
 }
 
+// applyRefundScope 应用退款单专属数据权限。
+// 退款申请对代理按创建人隔离，避免上级代理通过店铺层级看到下级申请。
+func applyRefundScope(ctx context.Context, query *gorm.DB) *gorm.DB {
+	switch middleware.GetUserTypeFromContext(ctx) {
+	case constants.UserTypeSuperAdmin, constants.UserTypePlatform:
+		return query
+	case constants.UserTypeAgent:
+		userID := middleware.GetUserIDFromContext(ctx)
+		if userID == 0 {
+			return query.Where("1 = 0")
+		}
+		return query.Where("tb_refund_request.creator = ?", userID)
+	default:
+		return query.Where("1 = 0")
+	}
+}
+
 // FindActiveByOrderID 查找订单关联的活跃退款申请（状态为待审批、已通过）
 func (s *RefundStore) FindActiveByOrderID(ctx context.Context, orderID uint) (*model.RefundRequest, error) {
 	var req model.RefundRequest