feat(ops): partner proxy order list and HQ order delete

Add partner-facing proxy order list/detail; unlock SUPER_ADMIN order delete with cascade cleanup and type filter.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/ops/admin-hq-permissions.service.ts

@@ -1,5 +1,6 @@
 import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
 import {
+  HQ_DANGEROUS_PERMISSION_KEYS,
   HQ_PERMISSION_CATALOG,
   HQ_ROLE_DEFAULT_PERMISSIONS,
   LEGACY_SYSTEM_SETTINGS_KEY,
@@ -82,7 +83,10 @@ export class AdminHqPermissionsService {
     const userPermissionKeys = expandHqPermissionKeys(userPerms.map((p) => p.permissionKey));
 
     if (account.adminRole === 'SUPER_ADMIN') {
-      const rolePermissionKeys = hqBasePermissionKeys();
+      const rolePermissionKeys = [
+        ...hqBasePermissionKeys(),
+        ...HQ_DANGEROUS_PERMISSION_KEYS,
+      ] as HqPermissionKey[];
       const effectivePermissionKeys = [
         ...new Set([...rolePermissionKeys, ...userPermissionKeys]),
       ] as HqPermissionKey[];

server/dukang-api/src/modules/ops/admin-orders.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
 import {
   HqPermissionGuard,
@@ -43,6 +43,18 @@ export class AdminOrdersController {
     return this.ordersService.detail(BigInt(id));
   }
 
+  @Delete(':id')
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('orders_delete')
+  @HqOperation({
+    action: HqOperationAction.ORDER_DELETE,
+    refType: 'ORDER',
+    refIdParam: 'id',
+  })
+  remove(@Param('id') id: string) {
+    return this.ordersService.deleteOrder(BigInt(id));
+  }
+
   /** HQ 发货：调用小飞侠创建运单并更新配送信息 */
   @Post(':id/ship')
   @HqOperation({

server/dukang-api/src/modules/ops/admin-orders.service.ts

@@ -31,6 +31,7 @@ export class AdminOrdersService {
 
     if (query.orderNo) where.orderNo = { contains: query.orderNo };
     if (query.status) where.status = query.status as Prisma.EnumOrderStatusFilter['equals'];
+    if (query.orderType) where.orderType = query.orderType as Prisma.EnumOrderTypeFilter['equals'];
     if (query.userId) where.userId = BigInt(query.userId);
     if (query.cityId) where.cityId = BigInt(query.cityId);
     if (query.receiverPhone) where.receiverPhone = { contains: query.receiverPhone };
@@ -335,6 +336,25 @@ export class AdminOrdersService {
     };
   }
 
+  async deleteOrder(id: bigint) {
+    const order = await this.prisma.order.findUnique({
+      where: { id },
+      select: { id: true, orderNo: true },
+    });
+    if (!order) throw new NotFoundException('订单不存在');
+
+    await this.prisma.$transaction(async (tx) => {
+      await this.deleteOrdersInTx(tx, [id]);
+    });
+
+    return {
+      ok: true,
+      deleted: 1,
+      orderNo: order.orderNo,
+      message: `订单 ${order.orderNo} 及关联业务数据已删除`,
+    };
+  }
+
   private async deleteOrdersInTx(tx: Prisma.TransactionClient, orderIds: bigint[]) {
     if (!orderIds.length) return;
 
@@ -368,6 +388,10 @@ export class AdminOrdersService {
       await tx.benefitCoupon.deleteMany({ where: { id: { in: couponIds } } });
     }
 
+    await tx.userInvoice.deleteMany({ where: { orderId: { in: orderIds } } });
+    await tx.wineryBillItem.deleteMany({ where: { orderId: { in: orderIds } } });
+    await tx.logisticsBillItem.deleteMany({ where: { orderId: { in: orderIds } } });
+
     await tx.order.updateMany({
       where: { originOrderId: { in: orderIds } },
       data: { originOrderId: null },

server/dukang-api/src/modules/ops/dto/admin-query.dto.ts

@@ -48,6 +48,10 @@ export class AdminOrdersQueryDto extends PaginationQueryDto {
   @IsString()
   status?: string;
 
+  @IsOptional()
+  @IsIn(['NORMAL', 'PROXY'])
+  orderType?: string;
+
   @IsOptional()
   @IsString()
   userId?: string;