提交管理员操作一切

Modules/Store.Users/Services/UserFundsService.cs

@@ -37,6 +37,8 @@ public sealed class UserFundsService(IFreeSql orm, ICurrentUser currentUser) : I
         var target = await db.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
             ?? throw new AppException("目标账户不存在");
         if (transfer && actor.Id == target.Id) throw new AppException("不能向自己转移积分");
+        if (transfer && !UserAccessPolicy.CanManage(actor, target))
+            throw new AppException("只能向管理范围内的账户转移积分", 403);
         // 双账户转移按相同主键顺序加锁，避免双方同时转账时产生反向锁顺序。
         var ids = transfer ? new[] { actor.Id, target.Id }.Order().ToArray() : new[] { target.Id };
         foreach (var id in ids)