Преглед изворни кода

为鱼类和鱼友控制器添加权限检查,确保非管理员用户只能查询自己的记录。同时,移除不必要的日志输出。

wuyi пре 4 месеци
родитељ
комит
512736345b

+ 5 - 0
src/controllers/fish-friends.controller.ts

@@ -76,6 +76,11 @@ export class FishFriendsController {
   async list(request: FastifyRequest<{ Querystring: ListFishFriendsQuery }>, reply: FastifyReply) {
     try {
       const query = request.query
+      
+      if (request.user.role !== 'admin') {
+        query.ownerId = request.user.id
+      }
+      
       const result = await this.fishFriendsService.list(query)
 
       return reply.send(result)

+ 5 - 0
src/controllers/fish.controller.ts

@@ -80,6 +80,11 @@ export class FishController {
   async list(request: FastifyRequest<{ Querystring: ListFishQuery }>, reply: FastifyReply) {
     try {
       const query = request.query
+      
+      if (request.user.role !== 'admin') {
+        query.ownerId = request.user.id
+      }
+      
       const result = await this.fishService.list(query)
 
       return reply.send(result)

+ 0 - 1
src/services/fish-friends.service.ts

@@ -35,7 +35,6 @@ export class FishFriendsService {
 
   async list(query: ListFishFriendsQuery): Promise<PaginationResponse<Partial<FishFriends>>> {
     const { page, size, id, fishId, ownerId, tgName, tgUsername, tgRemarkName, tgPhone, remark, createdAt } = query
-    console.log('query: ', query)
 
     const whereConditions: any = {}