From aefd80599ea0068aaefb3d75257692b9db00c73e Mon Sep 17 00:00:00 2001 From: czl231 <3286836406@qq.com> Date: Wed, 19 Aug 2026 00:14:42 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=B0=94=E7=AB=99=E8=AE=A2?= =?UTF-8?q?=E5=8D=95=E7=94=A8=E6=88=B7=E5=90=8D=E7=A7=B0=E4=B8=8E=E5=90=88?= =?UTF-8?q?=E5=90=8C=E4=B8=8A=E4=B8=8B=E6=96=87=E5=B1=95=E7=A4=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/api/internal/logic/gas/gasorder.go | 32 ++++++++++++++-- .../api/internal/logic/gas/gasorder_test.go | 37 +++++++++++++++++++ .../操作日志_气站合同用户权限修复_20260818.md | 1 + .../scripts/check-resource-pages.mjs | 2 +- .../src/views/shared/CrudListPage.vue | 21 ++++++----- 5 files changed, 80 insertions(+), 13 deletions(-) create mode 100644 backend/api/internal/logic/gas/gasorder_test.go diff --git a/backend/api/internal/logic/gas/gasorder.go b/backend/api/internal/logic/gas/gasorder.go index d5da62a..4d3edb6 100644 --- a/backend/api/internal/logic/gas/gasorder.go +++ b/backend/api/internal/logic/gas/gasorder.go @@ -1,5 +1,5 @@ // 功能描述：实现气站范围内的配送合同、合同气瓶和燃气配送订单接口。 -// 版本：v1.1.0 +// 版本：v1.2.0 package gas import ( @@ -288,8 +288,34 @@ func ListGasorderBasic(ctx *gin.Context) { if !ok { return } - listScoped(ctx, &models.GasorderBasic{}, common.ActiveRecords(impl.DBService.Model(&models.GasorderBasic{})). - Where("gas_basic_id = ?", station.ID), "gasorder_basic.created_at desc") + page, size := common.PageSize(ctx) + query := common.ApplyKeywordFilter(ctx, scopedOrderDisplayQuery(impl.DBService, station.ID), &models.GasorderBasic{}) + var total int64 + if err := query.Count(&total).Error; err != nil { + infra.Response.Error(ctx, err) + return + } + var list []gasOrderListDisplay + if err := query.Order("gasorder_basic.created_at desc").Offset((page - 1) * size).Limit(size).Scan(&list).Error; err != nil { + infra.Response.Error(ctx, err) + return + } + respondList(ctx, list, total) +} + +// gasOrderListDisplay 在订单主档上附加订单权限范围内的用户可读名称。 +type gasOrderListDisplay struct { + models.GasorderBasic + UserAccountDisplayName string `gorm:"column:user_account_display_name" json:"user_account_display_name"` +} + +// scopedOrderDisplayQuery 通过订单保存的用户主键读取名称，并始终限制在当前气站订单范围。 +func scopedOrderDisplayQuery(databaseService *gorm.DB, gasBasicID uint64) *gorm.DB { + return common.ActiveRecords(databaseService.Model(&models.GasorderBasic{})). + Select(`gasorder_basic.*, + COALESCE(NULLIF(order_user.name, ''), NULLIF(order_user.real_name, ''), NULLIF(order_user.username, ''), '用户记录已失效') AS user_account_display_name`). + Joins("LEFT JOIN user_account AS order_user ON order_user.id = gasorder_basic.user_account_id"). + Where("gasorder_basic.gas_basic_id = ?", gasBasicID) } func GetGasorderBasic(ctx *gin.Context) { diff --git a/backend/api/internal/logic/gas/gasorder_test.go b/backend/api/internal/logic/gas/gasorder_test.go new file mode 100644 index 0000000..82dc996 --- /dev/null +++ b/backend/api/internal/logic/gas/gasorder_test.go @@ -0,0 +1,37 @@ +// 功能描述：验证气站合同与配送订单展示查询的对象权限范围。 +// 版本：v1.0.0 +package gas + +import ( + "strings" + "testing" + + "github.com/DATA-DOG/go-sqlmock" + "gorm.io/driver/postgres" + "gorm.io/gorm" +) + +// TestScopedOrderDisplayQuery 验证订单用户名称直接按订单主键读取且查询受当前气站约束。 +func TestScopedOrderDisplayQuery(t *testing.T) { + connection, _, err := sqlmock.New() + if err != nil { + t.Fatalf("create SQL mock: %v", err) + } + t.Cleanup(func() { _ = connection.Close() }) + databaseService, err := gorm.Open(postgres.New(postgres.Config{Conn: connection}), &gorm.Config{DryRun: true}) + if err != nil { + t.Fatalf("open GORM database: %v", err) + } + + statement := scopedOrderDisplayQuery(databaseService, 42). + Find(&[]gasOrderListDisplay{}).Statement.SQL.String() + for _, fragment := range []string{ + "LEFT JOIN user_account AS order_user", + "user_account_display_name", + "gasorder_basic.gas_basic_id =", + } { + if !strings.Contains(statement, fragment) { + t.Fatalf("scoped order display SQL must include %q, got: %s", fragment, statement) + } + } +} diff --git a/docs/操作日志_气站合同用户权限修复_20260818.md b/docs/操作日志_气站合同用户权限修复_20260818.md index 187a3bd..8590d90 100644 --- a/docs/操作日志_气站合同用户权限修复_20260818.md +++ b/docs/操作日志_气站合同用户权限修复_20260818.md @@ -64,3 +64,4 @@ - 新增阻断只影响跨气站转移或解除关系，不影响同一气站内调整配送点和服务人员。 - 合同范围详情仅扩展按合同可达的只读路径，不改变用户列表范围；地址、钱包和所有写操作继续要求当前有效服务关系。 - 用户只读详情不展示合同履约内部字段“签约用户仍属当前气站”，统一以“账户权限：仅查看当前合同关联资料”说明访问边界，避免与合同、配送点的气站归属混淆。 +- 气站订单列表由订单接口按订单保存的用户主键直接返回用户名称；从订单进入用户详情时携带订单关联合同上下文，不再依赖聚合用户详情补载名称。 diff --git a/frontend/gas_admin/scripts/check-resource-pages.mjs b/frontend/gas_admin/scripts/check-resource-pages.mjs index ab0e50e..7cf2318 100644 --- a/frontend/gas_admin/scripts/check-resource-pages.mjs +++ b/frontend/gas_admin/scripts/check-resource-pages.mjs @@ -116,7 +116,7 @@ if ( !recordSource.includes('record.value.contract_readonly === true') || !recordSource.includes('record.contract_readonly !== true') || !recordSource.includes("definition.value.name === 'user_account'") || - !listSource.includes("contract_identity: String(row.identity ?? '')") || + !listSource.includes("String(row.gasorder_contract_identity ?? '')") || !displaySource.includes("contract_readonly: '账户权限'") || !displaySource.includes("return '仅查看当前合同关联资料'") ) { diff --git a/frontend/gas_admin/src/views/shared/CrudListPage.vue b/frontend/gas_admin/src/views/shared/CrudListPage.vue index ca3f5a8..4f19f83 100644 --- a/frontend/gas_admin/src/views/shared/CrudListPage.vue +++ b/frontend/gas_admin/src/views/shared/CrudListPage.vue @@ -1,6 +1,6 @@