fix version 1

module/ec/mall/internal/logic/staff/delete.go

@@ -15,7 +15,7 @@ import (
 // 删除工作人员
 func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
 	// parse authorization meta.
-	_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
+	auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
 	if err != nil {
 		return nil, err
 	}
@@ -25,11 +25,22 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallStaff{}).Error
-	if err != nil {
-		printer.Error(err.Error())
+	// 只能删除当前登录者所属店铺的员工
+	owner, _ := auth.Owner.(map[string]any)
+	storeIdentity, _ := owner["store_identity"].(string)
+	if storeIdentity == "" {
+		return nil, errcode.ErrPermissionDenied
+	}
+
+	tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
+		Where("store_identity = ?", storeIdentity).Delete(&models.MallStaff{})
+	if tx.Error != nil {
+		printer.Error(tx.Error.Error())
 		return nil, errcode.ErrDB
 	}
+	if tx.RowsAffected == 0 {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	return &pb.IdentityStatusReply{
 		Code:    0,

module/ec/mall/internal/logic/staff/fetch.go

@@ -9,15 +9,23 @@ import (
 	pb "bsm/full/module/ec/mall/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
+	"git.apinb.com/bsm-sdk/core/service"
 )
 
 // 获取工作人员列表
 func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListReply, err error) {
 	// parse authorization meta.
-	// _, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
-	// if err != nil {
-	// 	return nil, err
-	// }
+	auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
+	if err != nil {
+		return nil, err
+	}
+
+	// 仅可查询当前登录者所属店铺的员工，店铺取自 token，不采信请求参数
+	owner, _ := auth.Owner.(map[string]any)
+	storeIdentity, _ := owner["store_identity"].(string)
+	if storeIdentity == "" {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	var (
 		cnt      int64 = 0
@@ -25,7 +33,7 @@ func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListRep
 		pageSize int64 = in.GetPageSize()
 		offset   int64 = (pageNo - 1) * pageSize
 		params         = map[string]string{
-			"store_identity": in.GetStoreIdentity(),
+			"store_identity": storeIdentity,
 		}
 	)
 

module/ec/mall/internal/logic/staff/login.go

@@ -16,9 +16,13 @@ import (
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/vars"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
+// 短信验证码在 Redis 中的 key 前缀，与 sender 模块保持一致：前缀 + 手机号
+const smsCodeKeyPrefix = "/SMS/Code/"
+
 // Login 员工登录验证
 func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err error) {
 	var record models.MallStaff
@@ -47,7 +51,27 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
 			return nil, errcode.ErrInvalidArgument
 		}
 
-		err := impl.DBService.Where("phone = ?", in.Phone).First(&record).Error
+		// 校验短信验证码，key 规则与 sender 模块一致：/SMS/Code/ + 手机号
+		smsKey := smsCodeKeyPrefix + in.Phone
+		storedCode, codeErr := impl.RedisService.Client.Get(impl.RedisService.Ctx, smsKey).Result()
+		if codeErr != nil {
+			if errors.Is(codeErr, redis.Nil) {
+				printer.Error("验证码已过期或不存在: phone=%s", in.Phone)
+				return nil, errcode.ErrInvalidArgument
+			}
+			printer.Error(codeErr.Error())
+			return nil, errcode.ErrInternal
+		}
+		if storedCode != in.VerifyCode {
+			printer.Error("验证码不正确: phone=%s", in.Phone)
+			return nil, errcode.ErrInvalidArgument
+		}
+		// 校验成功后立即删除，避免同一验证码被重放
+		if err := impl.RedisService.Client.Del(impl.RedisService.Ctx, smsKey).Err(); err != nil {
+			printer.Error("清除验证码缓存异常: %v", err)
+		}
+
+		err = impl.DBService.Where("phone = ?", in.Phone).First(&record).Error
 		if err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				return nil, errcode.ErrAccountNotFound
@@ -55,7 +79,6 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
 			printer.Error(err.Error())
 			return nil, errcode.ErrDB
 		}
-		// TODO: 添加验证码校验逻辑
 
 	default:
 		return nil, errcode.ErrUnimplemented