diff --git a/internal/store/postgres/shop_package_allocation_store.go b/internal/store/postgres/shop_package_allocation_store.go index 682f541..01f4f63 100644 --- a/internal/store/postgres/shop_package_allocation_store.go +++ b/internal/store/postgres/shop_package_allocation_store.go @@ -24,8 +24,8 @@ func (s *ShopPackageAllocationStore) Create(ctx context.Context, allocation *mod func (s *ShopPackageAllocationStore) GetByID(ctx context.Context, id uint) (*model.ShopPackageAllocation, error) { var allocation model.ShopPackageAllocation query := s.db.WithContext(ctx).Where("id = ?", id) - // 应用数据权限过滤 - query = middleware.ApplyShopFilter(ctx, query) + // 应用数据权限过滤:代理只能访问自己分配出去的记录 + query = middleware.ApplyAllocatorShopFilter(ctx, query) if err := query.First(&allocation).Error; err != nil { return nil, err } @@ -56,8 +56,8 @@ func (s *ShopPackageAllocationStore) List(ctx context.Context, opts *store.Query var total int64 query := s.db.WithContext(ctx).Model(&model.ShopPackageAllocation{}) - // 应用数据权限过滤 - query = middleware.ApplyShopFilter(ctx, query) + // 应用数据权限过滤:代理只能看到自己分配出去的记录 + query = middleware.ApplyAllocatorShopFilter(ctx, query) if shopID, ok := filters["shop_id"].(uint); ok && shopID > 0 { query = query.Where("shop_id = ?", shopID) diff --git a/internal/store/postgres/shop_series_allocation_store.go b/internal/store/postgres/shop_series_allocation_store.go index 491a255..f933ba4 100644 --- a/internal/store/postgres/shop_series_allocation_store.go +++ b/internal/store/postgres/shop_series_allocation_store.go @@ -24,8 +24,8 @@ func (s *ShopSeriesAllocationStore) Create(ctx context.Context, allocation *mode func (s *ShopSeriesAllocationStore) GetByID(ctx context.Context, id uint) (*model.ShopSeriesAllocation, error) { var allocation model.ShopSeriesAllocation query := s.db.WithContext(ctx).Where("id = ?", id) - // 应用数据权限过滤 - query = middleware.ApplyShopFilter(ctx, query) + // 应用数据权限过滤:代理只能访问自己分配出去的记录 + query = middleware.ApplyAllocatorShopFilter(ctx, query) if err := query.First(&allocation).Error; err != nil { return nil, err } @@ -57,8 +57,8 @@ func (s *ShopSeriesAllocationStore) List(ctx context.Context, opts *store.QueryO var total int64 query := s.db.WithContext(ctx).Model(&model.ShopSeriesAllocation{}) - // 应用数据权限过滤 - query = middleware.ApplyShopFilter(ctx, query) + // 应用数据权限过滤:代理只能看到自己分配出去的记录 + query = middleware.ApplyAllocatorShopFilter(ctx, query) if shopID, ok := filters["shop_id"].(uint); ok && shopID > 0 { query = query.Where("shop_id = ?", shopID) diff --git a/pkg/middleware/data_scope.go b/pkg/middleware/data_scope.go index c79ed9a..ca0a840 100644 --- a/pkg/middleware/data_scope.go +++ b/pkg/middleware/data_scope.go @@ -101,3 +101,23 @@ func ApplyShopIDFilter(ctx context.Context, query *gorm.DB) *gorm.DB { } return query.Where("id IN ?", shopIDs) } + +// ApplyAllocatorShopFilter 应用分配者店铺数据权限过滤 +// 用于 ShopSeriesAllocation、ShopPackageAllocation 等使用 allocator_shop_id 字段的表 +// 代理用户只能看到自己作为分配者的记录 +// 平台用户/超管:不添加条件(allocator_shop_id=0 表示平台分配) +// 代理用户:WHERE allocator_shop_id = 当前用户店铺ID +func ApplyAllocatorShopFilter(ctx context.Context, query *gorm.DB) *gorm.DB { + userType := GetUserTypeFromContext(ctx) + // 平台用户和超管不限制 + if userType == constants.UserTypeSuperAdmin || userType == constants.UserTypePlatform { + return query + } + // 代理用户只能看到自己分配出去的记录 + shopID := GetShopIDFromContext(ctx) + if shopID == 0 { + // 代理用户但无店铺ID,返回空结果 + return query.Where("1 = 0") + } + return query.Where("allocator_shop_id = ?", shopID) +}