fix version 1

module/base/feedback/internal/logic/method/remark.go

@@ -3,13 +3,16 @@ package method
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"bsm/full/module/base/feedback/internal/impl"
 	"bsm/full/module/base/feedback/internal/models"
 	pb "bsm/full/module/base/feedback/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/service"
 	"git.apinb.com/bsm-sdk/core/vars"
+	"gorm.io/gorm"
 )
 
 // Remark 添加或更新反馈记录的备注和状态
@@ -17,11 +20,29 @@ import (
 // in: 备注请求参数，包含记录ID、备注内容和状态
 // 返回: 操作结果
 func Remark(ctx context.Context, in *pb.RemarkRequest) (reply *pb.StatusReply, err error) {
+	// 解析用户认证信息
+	auth, err := service.ParseMetaCtx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+
 	// 验证请求参数
 	if in.GetIdentity() == "" {
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 归属校验：仅本人或管理端可修改备注与状态
+	exist := new(models.FeedbackItem)
+	if err = impl.DBService.Where("identity = ?", in.GetIdentity()).First(exist).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, errcode.ErrPermissionDenied
+		}
+		return nil, err
+	}
+	if !canAccess(auth, exist.PassportIdentity) {
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	// 构建更新记录
 	record := &models.FeedbackItem{
 		Remark: in.GetRemark(), // 备注内容