fix version 1

module/ec/mall/internal/logic/staff/fetch.go

@@ -9,15 +9,23 @@ import (
 	pb "bsm/full/module/ec/mall/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
+	"git.apinb.com/bsm-sdk/core/service"
 )
 
 // 获取工作人员列表
 func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListReply, err error) {
 	// parse authorization meta.
-	// _, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
-	// if err != nil {
-	// 	return nil, err
-	// }
+	auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
+	if err != nil {
+		return nil, err
+	}
+
+	// 仅可查询当前登录者所属店铺的员工，店铺取自 token，不采信请求参数
+	owner, _ := auth.Owner.(map[string]any)
+	storeIdentity, _ := owner["store_identity"].(string)
+	if storeIdentity == "" {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	var (
 		cnt      int64 = 0
@@ -25,7 +33,7 @@ func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListRep
 		pageSize int64 = in.GetPageSize()
 		offset   int64 = (pageNo - 1) * pageSize
 		params         = map[string]string{
-			"store_identity": in.GetStoreIdentity(),
+			"store_identity": storeIdentity,
 		}
 	)