fix version 1

module/base/cms/internal/logic/post/add_comment.go

@@ -7,7 +7,6 @@ import (
 	"bsm/full/module/base/cms/internal/impl"
 	"bsm/full/module/base/cms/internal/models"
 	pb "bsm/full/module/base/cms/pb"
-	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/service"
 	"git.apinb.com/bsm-sdk/core/types"
@@ -32,12 +31,16 @@ func AddComment(ctx context.Context, in *pb.CommentItem) (*pb.StatusReply, error
 		Cms:           in.Cms,
 	}
 	authName := map[string]any{}
-	err = impl.DBService.Table("mall_staff").Take(&authName, "identity=?", auth.Identity).Error
-	if err != nil {
+	if err = impl.DBService.Table("mall_staff").Take(&authName, "identity=?", auth.Identity).Error; err != nil {
+		// 非 mall_staff 用户（普通会员等）查不到记录时不阻断评论，仅记录日志
 		printer.Error(err.Error())
-		return nil, errcode.ErrDB
 	}
-	data.OwnerName = authName["name"].(string)
+	// 安全类型断言：未命中或 name 为 NULL 时取不到名字，避免 panic
+	if v, ok := authName["name"].(string); ok {
+		data.OwnerName = v
+	} else {
+		data.OwnerName = auth.Identity
+	}
 	err = models.AddComment(&data, auth.Identity)
 	if err != nil {
 		return nil, err

module/base/cms/internal/logic/post/delete.go

@@ -13,7 +13,7 @@ import (
 // 删除文章
 func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.StatusReply, err error) {
 	// parse authorization meta.
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -26,7 +26,15 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.StatusReply, er
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	err = models.DeletePost(in.Identity, "") // Todo:
+	// 校验归属：仅文章作者/所有者可删除
+	post, err := models.GetPostForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if post.AuthorIdentity != auth.Identity && post.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
+	err = models.DeletePost(in.Identity, auth.Identity)
 	if err != nil {
 		return nil, errcode.ErrDB
 	}

module/base/cms/internal/logic/post/delete_comment.go

@@ -13,7 +13,7 @@ import (
 
 // DeleteComment 删除评论
 func DeleteComment(ctx context.Context, in *pb.DeleteCommentRequest) (*pb.StatusReply, error) {
-	_, err := service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -21,6 +21,14 @@ func DeleteComment(ctx context.Context, in *pb.DeleteCommentRequest) (*pb.Status
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 校验归属：仅评论作者可删除
+	comment, err := models.GetCommentForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if comment.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
 	err = models.DeleteComment(in.Identity)
 	if err != nil {
 		fmt.Println()

module/base/cms/internal/logic/post/modify.go

@@ -13,13 +13,21 @@ import (
 
 // 修改文章
 func Modify(ctx context.Context, in *pb.PostItem) (reply *pb.StatusReply, err error) {
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
 	if in.GetSiteIdentity() == "" || in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 校验归属：仅文章作者/所有者可修改
+	post, err := models.GetPostForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if post.AuthorIdentity != auth.Identity && post.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
 	var data = &models.CmsPost{
 		SiteIdentity: in.SiteIdentity,
 		Title:        in.Title,

module/base/cms/internal/logic/post/modify_comment.go

@@ -14,13 +14,21 @@ import (
 
 // 修改评论
 func ModifyComment(ctx context.Context, in *pb.CommentItem) (*pb.StatusReply, error) {
-	_, err := service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
+	// 校验归属：仅评论作者可修改
+	comment, err := models.GetCommentForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if comment.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	var data = models.CmsComment{
 		Std_Identity:  types.Std_Identity{Identity: in.Identity},

module/base/cms/internal/logic/post/search.go

@@ -26,12 +26,15 @@ func Search(ctx context.Context, in *pb.CmsSearchRequest) (reply *pb.PostListRep
 	// vlidate request page_no,page_size.
 	if pageNo < 1 {
 		pageNo = 1
-		offset = 0
 	}
-	if pageSize < 50 {
-		pageSize = 50
-		offset = (pageNo - 1) * pageSize
+	// 归一化分页：默认 20 条，最大 100 条，避免一次拉取全表
+	if pageSize < 20 {
+		pageSize = 20
 	}
+	if pageSize > 100 {
+		pageSize = 100
+	}
+	offset = (pageNo - 1) * pageSize
 
 	var data []*models.CmsPost
 	tx := impl.DBService.Model(&models.CmsPost{}).Where("title like ? or Cms like ?", "%"+in.Keyword+"%", "%"+in.Keyword+"%")