fix version 1

module/ec/order/internal/logic/summary/get.go

@@ -2,8 +2,11 @@ package summary
 
 import (
 	"context"
+	"errors"
 
+	"bsm/full/module/ec/order/internal/impl"
 	"bsm/full/module/ec/order/internal/logic/common"
+	"bsm/full/module/ec/order/internal/models"
 	pb "bsm/full/module/ec/order/pb"
 
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -14,7 +17,7 @@ import (
 // 获取一个订单的详情数据
 func Get(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.SummaryGetReply, err error) {
 	// parse authorization meta.
-	_, err = service.ParseMetaCtx(ctx, nil)
+	auth, err := service.ParseMetaCtx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -24,13 +27,30 @@ func Get(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.SummaryGetRep
 		return nil, errcode.ErrInvalidArgument
 	}
 
-	summary, err := common.GetOrderSummaryByIdentity(in.Identity)
+	order := new(models.OrderSummary)
+	err = impl.DBService.Preload("OrderDetails").Where("identity = ?", in.Identity).First(&order).Error
 	if err != nil {
 		printer.Error(err.Error())
+		if errors.Is(err, models.ErrNotFound) {
+			return nil, errcode.ErrRecordNotFound
+		}
 		return nil, errcode.ErrDB
 	}
 
+	// 归属校验：订单只能由下单人本人或订单所属店铺的管理员/员工查看，避免越权读取他人订单与收货信息。
+	if order.PassportIdentity != auth.Identity {
+		ownerStoreIdentity := ""
+		if owner, ok := auth.Owner.(map[string]any); ok {
+			if v, ok := owner["store_identity"].(string); ok {
+				ownerStoreIdentity = v
+			}
+		}
+		if ownerStoreIdentity == "" || ownerStoreIdentity != order.StoreIdentity {
+			return nil, errcode.ErrPermissionDenied
+		}
+	}
+
 	return &pb.SummaryGetReply{
-		Summary: summary,
+		Summary: common.ReflectProtoOrderSummary(order),
 	}, nil
 }