提交管理员操作一切

Modules/Store.Users/Commands/ShopRenewCommand.cs

@@ -18,7 +18,7 @@ namespace Store.Users.Commands;
 [MediatRBehavior(typeof(TransactionBehavior<,>))]
 [MediatRBehavior(typeof(AccountConsumptionBehavior<,>))]
 [MediatRBehavior(typeof(ShopOwnershipBehavior<,>))]
-public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewDuration, string? Remark = null)
+public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewDuration, string? Remark = null, string? OperatorName = null)
     : IRequest<ShopRenewResponse>, IValidatableRequest, IAccountConsumptionRequest, IShopOwnershipRequest
 {
     // 由消费管道建立，仅在当前事务执行期间有效。
@@ -29,6 +29,7 @@ public sealed record ShopRenewCommand(string UserName, string ShopId, int RenewD
     {
         RequestValidator.Validate(new UserNameRequest { UserName = UserName?.Trim()! });
         UserInputChecks.Length(UserName.Trim(), 20, "用户名");
+        UserInputChecks.Length(OperatorName, 20, "操作者");
         var request = new ShopRenewRequest { ShopId = ShopId, RenewDuration = RenewDuration, Remark = Remark };
         RequestValidator.Validate(request);
         UserInputChecks.Renew(request);
@@ -58,6 +59,12 @@ internal sealed class ShopRenewCommandHandler(UnitOfWorkExecutionContext executi
             ?? throw new InvalidOperationException("续费命令必须通过账户消费管道执行");
         var orm = executionContext.Orm;
         var user = context.User;
+        // 代操作权限在事务中再次确认，审计流水记录实际操作者而非被操作账户。
+        var operatorName = request.OperatorName ?? userName;
+        var actor = await orm.Select<UserEntity>().Where(u => u.UserName == operatorName).FirstAsync(cancellationToken)
+            ?? throw new AppException("操作者账户不存在");
+        if (!UserAccessPolicy.CanManage(actor, user) && actor.Id != user.Id)
+            throw new AppException("无权为该账户续费", 403);
         var shop = ((IShopOwnershipRequest)request).OwnedShop
             ?? throw new InvalidOperationException("续费命令必须通过商铺归属管道执行");
         decimal pointsPerMonth = context.Quote.UnitPrice;
@@ -87,8 +94,8 @@ internal sealed class ShopRenewCommandHandler(UnitOfWorkExecutionContext executi
             var record = new UserPointsRecordEntity
             {
                 OptionType = "续费",
-                OperatorType = "用户",
-                OperatorName = userName,
+                OperatorType = UserAccessPolicy.IsAdmin(actor) ? "管理员" : "用户",
+                OperatorName = actor.UserName,
                 UserName = userName,
                 UserNick = user.NickName,
                 DeltaPoints = pointsPerMonth,