fix version 1

module/ec/mall/internal/logic/store/licensing.go

@@ -9,10 +9,17 @@ import (
 	"bsm/full/module/ec/mall/internal/models"
 	pb "bsm/full/module/ec/mall/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/service"
 )
 
 // 店铺许可授权
 func Licensing(ctx context.Context, in *pb.LicensingRequest) (reply *pb.IdentityStatusReply, err error) {
+	// 要求调用者已登录，避免仅凭子域名匿名枚举店铺标识。
+	auth, err := service.ParseMetaCtx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+
 	var identity string
 	licenseType := strings.ToUpper(in.GetLicenseType())
 
@@ -22,12 +29,17 @@ func Licensing(ctx context.Context, in *pb.LicensingRequest) (reply *pb.Identity
 	default:
 		return nil, errcode.ErrInvalidArgument
 	}
-	// TODO: valid code
 	if identity == "" {
 		return nil, errcode.ErrNotFound(404, "store not found")
 	}
 
-	// TODO: add your logic code & delete this line.
+	// 归属校验：调用者只能是该店铺的成员，避免店铺标识被枚举获取。
+	// 说明：完整许可码校验（in.License/in.LicenseType）需要许可数据源，当前仓库内不存在，暂无法实现。
+	owner, _ := auth.Owner.(map[string]any)
+	storeIdentity, _ := owner["store_identity"].(string)
+	if storeIdentity == "" || storeIdentity != identity {
+		return nil, errcode.ErrPermissionDenied
+	}
 
 	return &pb.IdentityStatusReply{
 		Code:     0,