越权

internal/query/agentrecharge/payment_status.go

@@ -10,6 +10,7 @@ import (
 	"github.com/break/junhong_cmp_fiber/internal/model/dto"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 )
 
 // PaymentStatusQuery 查询代理充值本地支付与到账事实。
@@ -28,7 +29,8 @@ func (q *PaymentStatusQuery) Get(ctx context.Context, rechargeID uint) (*dto.Age
 		return nil, errors.New(errors.CodeInvalidParam, "代理充值支付状态查询参数无效")
 	}
 	var recharge model.AgentRechargeRecord
-	if err := q.db.WithContext(ctx).Where("id = ?", rechargeID).First(&recharge).Error; err != nil {
+	rechargeQuery := middleware.ApplyShopFilter(ctx, q.db.WithContext(ctx).Model(&model.AgentRechargeRecord{}))
+	if err := rechargeQuery.Where("id = ?", rechargeID).First(&recharge).Error; err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return nil, errors.New(errors.CodeForbidden, "无权限操作该资源或资源不存在")
 		}