fix version 1

module/base/cms/internal/logic/post/delete.go

@@ -13,7 +13,7 @@ import (
 // 删除文章
 func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.StatusReply, err error) {
 	// parse authorization meta.
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -26,7 +26,15 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.StatusReply, er
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
-	err = models.DeletePost(in.Identity, "") // Todo:
+	// 校验归属：仅文章作者/所有者可删除
+	post, err := models.GetPostForAuth(in.Identity)
+	if err != nil {
+		return nil, err
+	}
+	if post.AuthorIdentity != auth.Identity && post.OwnerIdentity != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
+	}
+	err = models.DeletePost(in.Identity, auth.Identity)
 	if err != nil {
 		return nil, errcode.ErrDB
 	}