修改User模块

Modules/Store.Users/Behaviors/AccountConsumptionBehavior.cs

@@ -1,3 +1,5 @@
+using MAX.Framework.Security;
+using Store.Users.Services;
 using MAX.Framework.Commons;
 using MAX.Framework.Mediation;
 using MediatR;
@@ -5,9 +7,9 @@ using Store.Users.Entities;
 
 namespace Store.Users.Behaviors;
 
-/// <summary>锁定积分账户并检查消费额度，不依赖商铺信息。</summary>
+/// <summary>从登录上下文确认操作者，校验目标账户归属后锁定积分账户并检查消费额度。</summary>
 public sealed class AccountConsumptionBehavior<TRequest, TResponse>(
-    UnitOfWorkExecutionContext executionContext)
+    UnitOfWorkExecutionContext executionContext, ICurrentUser currentUser)
     : IPipelineBehavior<TRequest, TResponse>
     where TRequest : class, IRequest<TResponse>, IAccountConsumptionRequest
 {
@@ -15,22 +17,26 @@ public sealed class AccountConsumptionBehavior<TRequest, TResponse>(
         RequestHandlerDelegate<TResponse> next)
     {
         cancellationToken.ThrowIfCancellationRequested();
-        if (string.IsNullOrWhiteSpace(request.UserName))
-            throw new AppException("用户名不能为空");
-        var userName = request.UserName.Trim();
-        var user = await executionContext.Orm.Select<UserEntity>().Where(a => a.UserName == userName)
-            .ForUpdate().FirstAsync(cancellationToken)
-            ?? throw new AppException("不存在的用户");
+        if (!currentUser.IsAuthenticated || string.IsNullOrWhiteSpace(currentUser.UserName))
+            throw new UnauthorizedAccessException();
+        var orm = executionContext.Orm;
+        var actor = await orm.Select<UserEntity>().Where(u => u.UserName == currentUser.UserName)
+            .FirstAsync(cancellationToken) ?? throw new UnauthorizedAccessException("登录账户不存在");
+        var userName = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
+        var user = await orm.Select<UserEntity>().Where(u => u.UserName == userName)
+            .ForUpdate().FirstAsync(cancellationToken) ?? throw new AppException("用户不存在");
+        if (!UserAccessPolicy.CanUseSelfService(actor, user))
+            throw new AppException("无权为该账户续费", 403);
         var quote = request.CalculateConsumption(user);
         if (quote.Amount <= 0 || quote.UnitPrice <= 0)
             throw new AppException("消费金额必须大于0");
         if (user.Points < quote.Amount)
-            throw new AppException("余额不足");
+            throw new AppException("积分不足");
         lock (request)
         {
             if (request.ConsumptionContext != null)
                 throw new InvalidOperationException("同一个消费命令不能同时执行");
-            request.ConsumptionContext = new AccountConsumptionContext(user, quote);
+            request.ConsumptionContext = new AccountConsumptionContext(user, actor, quote);
         }
         try
         {