fix version 1

module/base/cloud/internal/logic/share/create_share.go

@@ -35,6 +35,16 @@ func CreateShare(ctx context.Context, in *pb.CreateShareRequest) (reply *pb.Stat
 	}
 
 	// logic code
+	// 校验目标资源确实属于当前用户，禁止对他人资源创建分享
+	owned, err := checkResourceOwner(auth.ID, in.ShareType, uint(in.ResourceId))
+	if err != nil {
+		printer.Error("Check share resource owner error: %v", err)
+		return nil, errcode.ErrDB
+	}
+	if !owned {
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	// 生成分享令牌（如果未提供）
 	shareToken := in.ShareToken
 	if shareToken == "" {
@@ -85,3 +95,49 @@ func CreateShare(ctx context.Context, in *pb.CreateShareRequest) (reply *pb.Stat
 		Timeseq: time.Now().UnixMilli(),
 	}, nil
 }
+
+// checkResourceOwner 校验分享目标资源属于当前用户
+func checkResourceOwner(passportID uint, shareType string, resourceID uint) (bool, error) {
+	var (
+		count int64
+		err   error
+	)
+
+	switch strings.ToLower(strings.TrimSpace(shareType)) {
+	case "file":
+		err = impl.DBService.Model(&models.CloudDiskFile{}).
+			Joins("JOIN cloud_disk_dirs ON cloud_disk_files.directory_id = cloud_disk_dirs.id").
+			Where("cloud_disk_files.id = ? AND cloud_disk_dirs.passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "photo":
+		err = impl.DBService.Model(&models.CloudPhoto{}).
+			Joins("JOIN cloud_albums ON cloud_photos.album_id = cloud_albums.id").
+			Where("cloud_photos.id = ? AND cloud_albums.passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "album":
+		err = impl.DBService.Model(&models.CloudAlbum{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "note":
+		err = impl.DBService.Model(&models.CloudNote{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "bookmark":
+		err = impl.DBService.Model(&models.CloudBookmark{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "private":
+		err = impl.DBService.Model(&models.CloudPrivate{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	default:
+		// 未知的分享类型无法确认资源归属，直接拒绝
+		return false, nil
+	}
+
+	if err != nil {
+		return false, err
+	}
+
+	return count > 0, nil
+}

module/base/cloud/internal/logic/share/get_share.go

@@ -36,8 +36,15 @@ func GetShare(ctx context.Context, in *pb.IdentRequest) (reply *pb.CloudShareIte
 	}
 
 	if err := query.First(&share).Error; err != nil {
-		printer.Error("Share not found: %v", err)
-		return nil, errcode.ErrInvalidArgument
+		// 非创建者：凭分享 identity 可读取公开分享，使收件人能够取到分享指向的资源
+		if in.Id > 0 || in.Identity == "" {
+			printer.Error("Share not found: %v", err)
+			return nil, errcode.ErrInvalidArgument
+		}
+		if err := impl.DBService.Where("identity = ? AND is_public = ?", in.Identity, true).First(&share).Error; err != nil {
+			printer.Error("Share not found: %v", err)
+			return nil, errcode.ErrInvalidArgument
+		}
 	}
 
 	// 检查是否过期
@@ -45,13 +52,19 @@ func GetShare(ctx context.Context, in *pb.IdentRequest) (reply *pb.CloudShareIte
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 非创建者读取分享时不回传分享密码
+	password := share.Password
+	if share.PassportID != auth.ID {
+		password = ""
+	}
+
 	reply = &pb.CloudShareItem{
 		Id:            uint64(share.ID),
 		Identity:      share.Identity,
 		ShareType:     share.ShareType,
 		ResourceId:    uint64(share.ResourceID),
 		ShareToken:    share.ShareToken,
-		Password:      share.Password,
+		Password:      password,
 		ExpiresAt:     share.ExpiresAt.Format(time.RFC3339),
 		ViewCount:     int32(share.ViewCount),
 		DownloadCount: int32(share.DownloadCount),