完善配送端资源搜索与资质导航

backend/api/internal/logic/delivery/staff.go

@@ -1,6 +1,7 @@
 package delivery
 
 import (
+	"strings"
 	"time"
 
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -187,17 +188,38 @@ func ArchiveStaff(ctx *gin.Context) {
 }
 
 func credentialQuery(point models.DeliveryBasic) *gorm.DB {
-	return common.ActiveRecords(db().Model(&models.StaffCredential{})).
+	return credentialQueryWithDB(db(), point)
+}
+
+// credentialQueryWithDB 固定资质所属配送点、气站和配送角色范围。
+func credentialQueryWithDB(databaseService *gorm.DB, point models.DeliveryBasic) *gorm.DB {
+	return common.ActiveRecords(databaseService.Model(&models.StaffCredential{})).
 		Joins("JOIN staff_account ON staff_account.id = staff_credential.staff_account_id").
 		Where("staff_account.delivery_basic_id = ? AND staff_account.gas_basic_id = ? AND staff_account.role_code = ?",
 			point.ID, point.GasBasicID, "delivery")
 }
 
+// scopedCredentialQuery 将资质列表进一步锁定到已验证的配送人员。
+func scopedCredentialQuery(databaseService *gorm.DB, point models.DeliveryBasic, staffID uint64) *gorm.DB {
+	return credentialQueryWithDB(databaseService, point).
+		Where("staff_credential.staff_account_id = ?", staffID)
+}
+
 func ListCredential(ctx *gin.Context) {
 	point, _, ok := currentScope(ctx)
-	if ok {
-		listScoped(ctx, &models.StaffCredential{}, credentialQuery(point), "staff_credential.created_at desc")
+	if !ok {
+		return
 	}
+	staffIdentity := strings.TrimSpace(ctx.Query("staff_account_identity"))
+	if staffIdentity == "" {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	staff, found := scopedStaff(ctx, staffIdentity, point)
+	if !found {
+		return
+	}
+	listScoped(ctx, &models.StaffCredential{}, scopedCredentialQuery(db(), point, staff.ID), "staff_credential.created_at desc")
 }
 
 func GetCredential(ctx *gin.Context) {
@@ -260,9 +282,13 @@ func UpdateCredential(ctx *gin.Context) {
 	if !ok {
 		return
 	}
+	if staff.ID != existing.StaffAccountID {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
 	if err := db().Model(&existing).Updates(map[string]any{
-		"staff_account_id": staff.ID, "credential_type": request.CredentialType,
-		"credential_no": request.CredentialNo, "expired_at": request.ExpiredAt,
+		"credential_type": request.CredentialType, "credential_no": request.CredentialNo,
+		"expired_at": request.ExpiredAt,
 	}).Error; err != nil {
 		infra.Response.Error(ctx, err)
 		return