越权问题

internal/query/agentrecharge/payment_status.go

@@ -29,7 +29,7 @@ func (q *PaymentStatusQuery) Get(ctx context.Context, rechargeID uint) (*dto.Age
 		return nil, errors.New(errors.CodeInvalidParam, "代理充值支付状态查询参数无效")
 	}
 	var recharge model.AgentRechargeRecord
-	rechargeQuery := middleware.ApplyShopFilter(ctx, q.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	rechargeQuery := middleware.ApplyStrictShopFilter(ctx, q.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
 	if err := rechargeQuery.Where("id = ?", rechargeID).First(&recharge).Error; err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return nil, errors.New(errors.CodeForbidden, "无权限操作该资源或资源不存在")

internal/service/agent_recharge/service.go

@@ -444,7 +444,7 @@ func (s *Service) List(ctx context.Context, req *dto.AgentRechargeListRequest) (
 		pageSize = constants.DefaultPageSize
 	}
 
-	query := middleware.ApplyShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	query := middleware.ApplyStrictShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
 
 	if req.ShopID != nil {
 		query = query.Where("shop_id = ?", *req.ShopID)

internal/store/postgres/agent_recharge_store.go

@@ -49,7 +49,7 @@ func (s *AgentRechargeStore) GetByRechargeNo(ctx context.Context, rechargeNo str
 // GetByID 根据 ID 查询
 func (s *AgentRechargeStore) GetByID(ctx context.Context, id uint) (*model.AgentRechargeRecord, error) {
 	var record model.AgentRechargeRecord
-	query := middleware.ApplyShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	query := middleware.ApplyStrictShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
 	if err := query.First(&record, id).Error; err != nil {
 		return nil, err
 	}