fix version 1

module/base/feedback/internal/logic/method/list.go

@@ -7,6 +7,7 @@ import (
 	"bsm/full/module/base/feedback/internal/impl"
 	"bsm/full/module/base/feedback/internal/models"
 	pb "bsm/full/module/base/feedback/pb"
+	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/service"
 )
 
@@ -34,14 +35,16 @@ func List(ctx context.Context, in *pb.ListRequest) (reply *pb.ListReply, err err
 	// 构建查询会话，预加载图片信息
 	sess := impl.DBService.Preload("Images")
 
-	// 根据机构筛选或用户身份筛选
-	if in.GetAgency() != "" {
-		sess = sess.Where("agency = ?", in.GetAgency())
-	} else {
-		userIdentity := auth.Identity
-		if userIdentity != "" {
-			sess = sess.Where("passport_identity = ?", userIdentity)
+	// 权限收敛：仅管理端可按机构跨用户查询，普通用户只能查看本人反馈
+	if isAdmin(auth) {
+		if in.GetAgency() != "" {
+			sess = sess.Where("agency = ?", in.GetAgency())
 		}
+	} else {
+		if auth.Identity == "" {
+			return nil, errcode.ErrPermissionDenied
+		}
+		sess = sess.Where("passport_identity = ?", auth.Identity)
 	}
 
 	// 用户名筛选
@@ -80,7 +83,7 @@ func List(ctx context.Context, in *pb.ListRequest) (reply *pb.ListReply, err err
 
 	// 转换数据格式
 	for _, v := range list {
-		item := convert(v)
+		item := convert(v, !canAccess(auth, v.PassportIdentity))
 		out.List = append(out.List, item)
 	}
 	return out, nil