full/module/ec/order/internal/logic/summary/get.go

package summary

import (
	"context"
	"errors"

	"bsm/full/module/ec/order/internal/impl"
	"bsm/full/module/ec/order/internal/logic/common"
	"bsm/full/module/ec/order/internal/models"
	pb "bsm/full/module/ec/order/pb"

	"git.apinb.com/bsm-sdk/core/errcode"
	"git.apinb.com/bsm-sdk/core/printer"
	"git.apinb.com/bsm-sdk/core/service"
)

// 获取一个订单的详情数据
func Get(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.SummaryGetReply, err error) {
	// parse authorization meta.
	auth, err := service.ParseMetaCtx(ctx, nil)
	if err != nil {
		return nil, err
	}

	// valildate request id,identity.
	if in.Identity == "" {
		return nil, errcode.ErrInvalidArgument
	}

	order := new(models.OrderSummary)
	err = impl.DBService.Preload("OrderDetails").Where("identity = ?", in.Identity).First(&order).Error
	if err != nil {
		printer.Error(err.Error())
		if errors.Is(err, models.ErrNotFound) {
			return nil, errcode.ErrRecordNotFound
		}
		return nil, errcode.ErrDB
	}

	// 归属校验：订单只能由下单人本人或订单所属店铺的管理员/员工查看，避免越权读取他人订单与收货信息。
	if order.PassportIdentity != auth.Identity {
		ownerStoreIdentity := ""
		if owner, ok := auth.Owner.(map[string]any); ok {
			if v, ok := owner["store_identity"].(string); ok {
				ownerStoreIdentity = v
			}
		}
		if ownerStoreIdentity == "" || ownerStoreIdentity != order.StoreIdentity {
			return nil, errcode.ErrPermissionDenied
		}
	}

	return &pb.SummaryGetReply{
		Summary: common.ReflectProtoOrderSummary(order),
	}, nil
}