fix version 1

module/base/feedback/internal/logic/method/delete.go

@@ -3,13 +3,16 @@ package method
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"bsm/full/module/base/feedback/internal/impl"
 	"bsm/full/module/base/feedback/internal/models"
 	pb "bsm/full/module/base/feedback/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/service"
 	"git.apinb.com/bsm-sdk/core/vars"
+	"gorm.io/gorm"
 )
 
 // Delete 删除反馈记录
@@ -17,12 +20,30 @@ import (
 // in: 删除请求参数，包含记录ID
 // 返回: 删除操作结果
 func Delete(ctx context.Context, in *pb.DeleteRequest) (reply *pb.StatusReply, err error) {
+	// 解析用户认证信息
+	auth, err := service.ParseMetaCtx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+
 	// 验证请求参数
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	// 删除记录（GORM会自动处理关联的图片和附件删除）
+	// 归属校验：仅本人或管理端可删除
+	record := new(models.FeedbackItem)
+	if err = impl.DBService.Where("identity = ?", in.GetIdentity()).First(record).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, errcode.ErrPermissionDenied
+		}
+		return nil, err
+	}
+	if !canAccess(auth, record.PassportIdentity) {
+		return nil, errcode.ErrPermissionDenied
+	}
+
+	// 删除反馈主记录
 	err = impl.DBService.Where("identity = ?", in.GetIdentity()).Delete(new(models.FeedbackItem)).Error
 	if err != nil {
 		return nil, err