v3.5.8和v3.5.9版本更新

server/dukang-api/src/modules/store/store-package.service.ts

@@ -15,6 +15,7 @@ import { PrismaService } from '../../common/prisma/prisma.module';
 import { serializeBigInt } from '../../common/decorators/current-user.decorator';
 import { StoreService } from './store.service';
 import { WecomMessagePushService } from '../../integrations/wecom/wecom-message-push.service';
+import { HqPermissionsResolver, hqStoreCityWhere } from '../../common/guards/hq-permission.guard';
 
 type PackageInput = Record<string, unknown>;
 
@@ -26,6 +27,7 @@ export class StorePackageService {
     private readonly prisma: PrismaService,
     private readonly storeService: StoreService,
     private readonly wecomPush: WecomMessagePushService,
+    private readonly hqPermissions: HqPermissionsResolver,
   ) {}
 
   normalizePackages(raw: unknown): StorePackageItemDto[] {
@@ -237,14 +239,16 @@ export class StorePackageService {
     );
   }
 
-  async adminGetPackages(storeId: bigint) {
+  async adminGetPackages(storeId: bigint, actorId: bigint) {
+    await this.hqPermissions.assertStoreIdInScope(actorId, storeId);
     const store = await this.prisma.store.findUnique({ where: { id: storeId } });
     if (!store) throw new NotFoundException('门店不存在');
     const live = await this.listLivePackages(storeId);
     return serializeBigInt({ live });
   }
 
-  async adminDirectSave(storeId: bigint, packages: StorePackageItemDto[]) {
+  async adminDirectSave(storeId: bigint, packages: StorePackageItemDto[], actorId: bigint) {
+    await this.hqPermissions.assertStoreIdInScope(actorId, storeId);
     const store = await this.prisma.store.findUnique({ where: { id: storeId } });
     if (!store) throw new NotFoundException('门店不存在');
     await this.replaceLivePackages(storeId, packages);
@@ -285,12 +289,13 @@ export class StorePackageService {
     ]);
   }
 
-  async adminGetAuditDetail(requestId: bigint) {
+  async adminGetAuditDetail(requestId: bigint, actorId: bigint) {
     const req = await this.prisma.storePackageChangeRequest.findUnique({
       where: { id: requestId },
-      include: { store: { select: { id: true, name: true } } },
+      include: { store: { select: { id: true, name: true, cityId: true } } },
     });
     if (!req) throw new NotFoundException('审核记录不存在');
+    await this.hqPermissions.assertStoreCityInScope(actorId, req.store.cityId);
     const livePackages = await this.listLivePackages(req.storeId);
     return serializeBigInt({
       id: req.id.toString(),
@@ -307,13 +312,19 @@ export class StorePackageService {
     });
   }
 
-  async adminListAudits(query: { status?: string; page?: number; pageSize?: number }) {
+  async adminListAudits(
+    query: { status?: string; page?: number; pageSize?: number },
+    actorId: bigint,
+  ) {
     const page = query.page ?? 1;
     const pageSize = query.pageSize ?? 20;
+    const scope = await this.hqPermissions.resolveCityScope(actorId);
+    const storeWhere = hqStoreCityWhere(scope);
     const where: Prisma.StorePackageChangeRequestWhereInput = {};
     if (query.status) {
       where.status = query.status as Prisma.EnumStorePackageChangeStatusFilter['equals'];
     }
+    if (storeWhere) where.store = storeWhere;
     const [items, total] = await Promise.all([
       this.prisma.storePackageChangeRequest.findMany({
         where,
@@ -350,8 +361,10 @@ export class StorePackageService {
   ) {
     const req = await this.prisma.storePackageChangeRequest.findUnique({
       where: { id: requestId },
+      include: { store: { select: { cityId: true } } },
     });
     if (!req) throw new NotFoundException('审核记录不存在');
+    await this.hqPermissions.assertStoreCityInScope(reviewerId, req.store.cityId);
     if (req.status !== 'PENDING') {
       throw new BadRequestException('该记录已处理');
     }
@@ -400,9 +413,11 @@ export class StorePackageService {
     return serializeBigInt({ id: requestId.toString(), status: 'APPROVED' });
   }
 
-  async adminAuditSummary() {
+  async adminAuditSummary(actorId: bigint) {
+    const scope = await this.hqPermissions.resolveCityScope(actorId);
+    const storeWhere = hqStoreCityWhere(scope);
     const pendingCount = await this.prisma.storePackageChangeRequest.count({
-      where: { status: 'PENDING' },
+      where: { status: 'PENDING', ...(storeWhere ? { store: storeWhere } : {}) },
     });
     return { pendingCount };
   }