越权

internal/query/agentrecharge/payment_status.go

@@ -10,6 +10,7 @@ import (
 	"github.com/break/junhong_cmp_fiber/internal/model/dto"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 )
 
 // PaymentStatusQuery 查询代理充值本地支付与到账事实。
@@ -28,7 +29,8 @@ func (q *PaymentStatusQuery) Get(ctx context.Context, rechargeID uint) (*dto.Age
 		return nil, errors.New(errors.CodeInvalidParam, "代理充值支付状态查询参数无效")
 	}
 	var recharge model.AgentRechargeRecord
-	if err := q.db.WithContext(ctx).Where("id = ?", rechargeID).First(&recharge).Error; err != nil {
+	rechargeQuery := middleware.ApplyShopFilter(ctx, q.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	if err := rechargeQuery.Where("id = ?", rechargeID).First(&recharge).Error; err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return nil, errors.New(errors.CodeForbidden, "无权限操作该资源或资源不存在")
 		}

internal/routes/agent_recharge.go

@@ -30,11 +30,12 @@ func registerAgentRechargeRoutes(router fiber.Router, handler *admin.AgentRechar
 	})
 
 	Register(group, doc, groupPath, "GET", "", handler.List, RouteSpec{
-		Summary: "查询代理充值订单列表",
-		Tags:    []string{"代理预充值"},
-		Input:   new(dto.AgentRechargeListRequest),
-		Output:  new(dto.AgentRechargeListResponse),
-		Auth:    true,
+		Summary:     "查询代理充值订单列表",
+		Description: "平台账号可查看全部；代理账号仅返回自己店铺及下级店铺的充值订单。",
+		Tags:        []string{"代理预充值"},
+		Input:       new(dto.AgentRechargeListRequest),
+		Output:      new(dto.AgentRechargeListResponse),
+		Auth:        true,
 	})
 
 	Register(group, doc, groupPath, "GET", "/payment-methods", handler.PaymentMethods, RouteSpec{

internal/service/agent_recharge/service.go

@@ -411,7 +411,7 @@ func (s *Service) GetByID(ctx context.Context, id uint) (*dto.AgentRechargeRespo
 	record, err := s.agentRechargeStore.GetByID(ctx, id)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
-			return nil, errors.New(errors.CodeNotFound, "充值记录不存在")
+			return nil, errors.New(errors.CodeForbidden, "无权限操作该资源或资源不存在")
 		}
 		return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询充值记录失败")
 	}
@@ -444,7 +444,7 @@ func (s *Service) List(ctx context.Context, req *dto.AgentRechargeListRequest) (
 		pageSize = constants.DefaultPageSize
 	}
 
-	query := s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{})
+	query := middleware.ApplyShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
 
 	if req.ShopID != nil {
 		query = query.Where("shop_id = ?", *req.ShopID)

internal/store/postgres/agent_recharge_store.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
@@ -48,7 +49,8 @@ func (s *AgentRechargeStore) GetByRechargeNo(ctx context.Context, rechargeNo str
 // GetByID 根据 ID 查询
 func (s *AgentRechargeStore) GetByID(ctx context.Context, id uint) (*model.AgentRechargeRecord, error) {
 	var record model.AgentRechargeRecord
-	if err := s.db.WithContext(ctx).First(&record, id).Error; err != nil {
+	query := middleware.ApplyShopFilter(ctx, s.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	if err := query.First(&record, id).Error; err != nil {
 		return nil, err
 	}
 	return &record, nil