heqiapp/platforms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复气站合同用户权限与服务关系边界

Browse Source
This commit is contained in:
czl231
2026-08-18 22:49:14 +08:00
parent 61a61f916b
commit 9a31cadf5f
27 changed files with 635 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
backend/api/internal/logic/gas/scope.go
View File

@@ -58,22 +58,56 @@ func requireStaff(ctx *gin.Context, identity string, gasID uint64) (models.Staff
}
func requireUser(ctx *gin.Context, identity string, gasID uint64) (models.UserAccount, models.UserServiceRelation, bool) {
user, relation, err := findCurrentGasUser(impl.DBService, identity, gasID)
if err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return models.UserAccount{}, models.UserServiceRelation{}, false
}
return user, relation, true
}
// findCurrentGasUser 查询当前气站有效服务关系内的用户，不直接写入 HTTP 响应，供只读合同兜底复用。
func findCurrentGasUser(databaseService *gorm.DB, identity string, gasID uint64) (models.UserAccount, models.UserServiceRelation, error) {
var user models.UserAccount
var relation models.UserServiceRelation
err := common.ActiveRecords(impl.DBService.Model(&models.UserAccount{})).
err := common.ActiveRecords(databaseService.Model(&models.UserAccount{})).
Select("user_account.*").
Joins("JOIN user_service_relation ON user_service_relation.user_account_id = user_account.id AND user_service_relation.status <> ?",
common.StatusArchived).
Where("user_account.identity = ? AND user_service_relation.gas_basic_id = ?", identity, gasID).
First(&user).Error
if err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return models.UserAccount{}, models.UserServiceRelation{}, false
return models.UserAccount{}, models.UserServiceRelation{}, err
}
if err := common.ActiveRecords(impl.DBService).
if err := common.ActiveRecords(databaseService).
Where("user_account_id = ? AND gas_basic_id = ?", user.ID, gasID).First(&relation).Error; err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return models.UserAccount{}, models.UserServiceRelation{}, false
return models.UserAccount{}, models.UserServiceRelation{}, err
}
return user, relation, true
return user, relation, nil
}
// contractScopedUserRecord 带出合同保存的默认配送点，供无服务关系用户只读展示本站合同上下文。
type contractScopedUserRecord struct {
models.UserAccount
ContractDeliveryBasicID uint64 `gorm:"column:contract_delivery_basic_id"`
}
// findContractScopedUser 仅查询当前气站合同中实际引用的用户，禁止借详情接口枚举全局用户。
func findContractScopedUser(databaseService *gorm.DB, identity string, gasID uint64, contractIdentity string) (contractScopedUserRecord, error) {
var record contractScopedUserRecord
err := contractScopedUserQuery(databaseService, identity, gasID, contractIdentity).
First(&record).Error
return record, err
}
// contractScopedUserQuery 统一合同用户只读详情与头像的气站范围查询条件。
func contractScopedUserQuery(databaseService *gorm.DB, identity string, gasID uint64, contractIdentity string) *gorm.DB {
query := common.ActiveRecords(databaseService.Model(&models.UserAccount{})).
Select("user_account.*, gasorder_contract.delivery_basic_id AS contract_delivery_basic_id").
Joins("JOIN gasorder_contract ON gasorder_contract.user_account_id = user_account.id AND gasorder_contract.status <> ?", common.StatusArchived).
Where("user_account.identity = ? AND gasorder_contract.gas_basic_id = ?", identity, gasID)
if contractIdentity != "" {
query = query.Where("gasorder_contract.identity = ?", contractIdentity)
}
return query.Order("gasorder_contract.created_at DESC")
}