修复气站与配送点支付记录数据范围

backend/api/internal/logic/common/payment_scope.go

@@ -0,0 +1,68 @@
+// 功能：统一气站与配送点管理端的支付记录数据范围过滤。
+// 版本：v1.0。
+package common
+
+import "gorm.io/gorm"
+
+const gasPaymentOrderScopeSQL = `
+(
+	(payment_order.business_type = 'gasorder' AND EXISTS (
+		SELECT 1 FROM gasorder_basic
+		WHERE gasorder_basic.identity = payment_order.business_identity
+			AND gasorder_basic.gas_basic_id = ?
+	))
+	OR (payment_order.business_type = 'ec_order' AND EXISTS (
+		SELECT 1 FROM ec_order
+		WHERE ec_order.identity = payment_order.business_identity
+			AND ec_order.gas_station_id = ?
+	))
+	OR (payment_order.business_type = 'recharge' AND EXISTS (
+		SELECT 1 FROM wallet_recharge_order
+		JOIN wallet_basic ON wallet_basic.id = wallet_recharge_order.wallet_basic_id
+		WHERE wallet_recharge_order.identity = payment_order.business_identity
+			AND wallet_recharge_order.owner_type = 'gas'
+			AND wallet_recharge_order.owner_identity = ?
+			AND wallet_basic.owner_type = 'gas'
+			AND wallet_basic.owner_id = ?
+			AND wallet_basic.owner_identity = ?
+	))
+)`
+
+const deliveryPaymentOrderScopeSQL = `
+(
+	(payment_order.business_type = 'gasorder' AND EXISTS (
+		SELECT 1 FROM gasorder_basic
+		WHERE gasorder_basic.identity = payment_order.business_identity
+			AND gasorder_basic.delivery_basic_id = ?
+	))
+	OR (payment_order.business_type = 'ec_order' AND EXISTS (
+		SELECT 1 FROM ec_order
+		WHERE ec_order.identity = payment_order.business_identity
+			AND ec_order.delivery_point_id = ?
+	))
+	OR (payment_order.business_type = 'recharge' AND EXISTS (
+		SELECT 1 FROM wallet_recharge_order
+		JOIN wallet_basic ON wallet_basic.id = wallet_recharge_order.wallet_basic_id
+		WHERE wallet_recharge_order.identity = payment_order.business_identity
+			AND wallet_recharge_order.owner_type = 'delivery'
+			AND wallet_recharge_order.owner_identity = ?
+			AND wallet_basic.owner_type = 'delivery'
+			AND wallet_basic.owner_id = ?
+			AND wallet_basic.owner_identity = ?
+	))
+)`
+
+// ScopePaymentOrdersByOwner 按业务对象验证统一支付单的组织归属。
+// ownerType 仅接受 gas 或 delivery；ownerID 为组织内部主键，ownerIdentity 为组织业务标识。
+// 返回值沿用传入查询并追加失败关闭的数据范围条件，未知类型和孤立业务对象不会被放行。
+func ScopePaymentOrdersByOwner(query *gorm.DB, ownerType string, ownerID uint64, ownerIdentity string) *gorm.DB {
+	switch ownerType {
+	case "gas":
+		return query.Where(gasPaymentOrderScopeSQL, ownerID, ownerID, ownerIdentity, ownerID, ownerIdentity)
+	case "delivery":
+		return query.Where(deliveryPaymentOrderScopeSQL, ownerID, ownerID, ownerIdentity, ownerID, ownerIdentity)
+	default:
+		// 未知组织类型没有可靠归属链路，必须按失败关闭处理。
+		return query.Where("1 = 0")
+	}
+}