fix version 1

module/social/relation/internal/logic/friend/apply_do_pass.go

@@ -25,12 +25,24 @@ func ApplyDoPass(ctx context.Context, in *pb.ApplyDoPassRequest) (reply *pb.Data
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 通过前先按 identity 查出属于当前调用者（被申请方）的申请记录
+	var apply models.FriendApply
+	err = impl.DBService.Where("identity=? and to_identity=?", in.ApplyIdentity, auth.Identity).First(&apply).Error
+	if err != nil {
+		printer.Error(err.Error())
+		return nil, errcode.ErrPermissionDenied
+	}
+	// 申请记录里的申请人必须与请求要加为好友的对象一致，否则视为无申请依据
+	if apply.FromIdentity != in.FriendRelationIdentity {
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	//写入好友表
-	friend := &models.RelationFriend{FriendrelationID: uint(in.FriendRelationId), FriendrelationIdentity: in.FriendRelationIdentity}
+	friend := &models.RelationFriend{FriendrelationID: apply.FromID, FriendrelationIdentity: apply.FromIdentity}
 	friend.Identity = utils.UUID()
 	friend.PassportID = auth.ID
 	friend.PassportIdentity = auth.Identity
-	friend.SessionID = common.UniqueSessionID(auth.Identity, in.FriendRelationIdentity)
+	friend.SessionID = common.UniqueSessionID(auth.Identity, apply.FromIdentity)
 
 	err = impl.DBService.Create(&friend).Error
 	if err != nil {
@@ -40,7 +52,7 @@ func ApplyDoPass(ctx context.Context, in *pb.ApplyDoPassRequest) (reply *pb.Data
 
 	//EventMQ：向mesh MQ中心发送报文，请求推送消息以及更新Cache.
 
-	err = impl.DBService.Model(models.FriendApply{}).Where("to_identity=? and identity=?", auth.Identity, in.ApplyIdentity).UpdateColumn("status", 1).Error
+	err = impl.DBService.Model(models.FriendApply{}).Where("to_identity=? and identity=?", auth.Identity, apply.Identity).UpdateColumn("status", 1).Error
 	if err != nil {
 		printer.Error(err.Error())
 		return nil, errcode.ErrDB