fix version 1

module/ec/market/internal/logic/agency/get.go

@@ -9,6 +9,7 @@ import (
 	"bsm/full/module/ec/market/internal/models"
 	pb "bsm/full/module/ec/market/pb"
 
+	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/service"
 )
 
@@ -22,8 +23,9 @@ func Get(ctx context.Context, in *pb.IdentRequest) (reply *pb.MarketAgenctyItem,
 		return nil, err
 	}
 	identity = auth.Identity
-	if in.GetIdentity() != "" {
-		identity = in.GetIdentity()
+	// 请求中的 identity 只能用于与 token 身份比对，不一致直接拒绝
+	if in.GetIdentity() != "" && in.GetIdentity() != auth.Identity {
+		return nil, errcode.ErrPermissionDenied
 	}
 	mktModel := models.MarketAgency{}
 	if err := impl.DBService.Where("identity=?", identity).First(&mktModel).Error; err != nil {