提交管理员操作一切

Modules/Store.Users/Services/UserManagementService.TopUp.cs

@@ -6,40 +6,57 @@ namespace Store.Users.Services;
 
 public sealed partial class UserManagementService
 {
-    /// <summary>以本人身份提交充值备注，不能伪造提交账户或昵称。</summary>
+    /// <summary>为本人或授权账户提交充值备注，昵称从目标账户读取。</summary>
     public async Task<long> AddTopUpMessage(UserTopUpMessageRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Length(request.Message, 1000, "充值备注");
+        UserInputChecks.Length(request.UserName, 20, "用户名");
         var actor = await Actor(orm, ct);
+        var name = string.IsNullOrWhiteSpace(request.UserName) ? actor.UserName : request.UserName.Trim();
+        var target = await orm.Select<UserEntity>().Where(u => u.UserName == name).FirstAsync(ct)
+            ?? throw new AppException("用户不存在");
+        if (!UserAccessPolicy.CanManage(actor, target) && actor.Id != target.Id)
+            throw new AppException("无权为该账户提交充值备注", 403);
         return await orm.Insert(new UserTopUpMessageEntity
         {
-            UserName = actor.UserName, NickName = actor.NickName, Message = request.Message.Trim()
+            UserName = target.UserName, NickName = target.NickName, Message = request.Message.Trim()
         }).ExecuteIdentityAsync(ct);
     }
 
-    /// <summary>管理员记录人工处理结果。备注处理与实际充值是不同用例。</summary>
+    /// <summary>管理范围内记录人工处理结果。备注处理不会自动增加积分或余额。</summary>
     public async Task UpdateTopUpMessage(UserTopUpResultRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.PositiveId(request.Id);
         UserInputChecks.Length(request.Result, 1000, "处理结果");
         var actor = await Actor(orm, ct);
-        if (!IsAdmin(actor)) throw new AppException("仅管理员可以处理充值备注", 403);
-        if (!await orm.Select<UserTopUpMessageEntity>().Where(m => m.Id == request.Id).AnyAsync(ct))
-            throw new AppException("充值备注不存在");
+        var message = await orm.Select<UserTopUpMessageEntity>().Where(m => m.Id == request.Id).FirstAsync(ct)
+            ?? throw new AppException("充值备注不存在");
+        if (!IsAdmin(actor))
+        {
+            var target = await orm.Select<UserEntity>().Where(u => u.UserName == message.UserName).FirstAsync(ct);
+            if (target == null || !UserAccessPolicy.CanManage(actor, target))
+                throw new AppException("无权处理该账户的充值备注", 403);
+        }
         await orm.Update<UserTopUpMessageEntity>().Set(m => m.Result, request.Result.Trim())
             .Where(m => m.Id == request.Id).ExecuteAffrowsAsync(ct);
     }
 
-    /// <summary>普通用户仅查看自己提交的备注，管理员查看全部。</summary>
+    /// <summary>管理员查看全部，主账号查看本人和直属子账号，子账号仅查看本人备注。</summary>
     public async Task<UserPage<UserTopUpMessageEntity>> TopUpMessages(UserSearchRequest request, CancellationToken ct)
     {
         RequestValidator.Validate(request);
         UserInputChecks.Search(request);
         var actor = await Actor(orm, ct);
         var select = orm.Select<UserTopUpMessageEntity>();
-        if (!IsAdmin(actor)) select = select.Where(m => m.UserName == actor.UserName);
+        if (!IsAdmin(actor))
+        {
+            if (actor.IsMainUser)
+                select = select.Where(m => m.UserName == actor.UserName || orm.Select<UserEntity>()
+                    .Where(u => u.UserName == m.UserName && u.ParentUserName == actor.UserName).Any());
+            else select = select.Where(m => m.UserName == actor.UserName);
+        }
         var total = await select.CountAsync(ct);
         var rows = await select.OrderByDescending(m => m.Id).Page(request.Page, request.PageSize).ToListAsync(ct);
         return new(total, rows);