From 92a75a7b157e6fd6423df17cfd32015017bdb8c9 Mon Sep 17 00:00:00 2001
From: liujie <1793218484@qq.com>
Date: 星期五, 14 八月 2026 09:21:58 +0800
Subject: [PATCH] update
---
backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java | 10 +++++++++-
1 files changed, 9 insertions(+), 1 deletions(-)
diff --git a/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java b/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
index 58f8aaa..3e6bc55 100644
--- a/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
+++ b/backend/src/main/java/com/tourguide/api/admin/AdminFinanceController.java
@@ -2,6 +2,7 @@
import com.tourguide.common.api.ApiResponse;
import com.tourguide.common.api.PageResponse;
+import com.tourguide.common.exception.BusinessException;
import com.tourguide.modules.finance.dto.FinanceLedgerPageResponse;
import com.tourguide.modules.finance.dto.WithdrawalProcessRequest;
import com.tourguide.modules.finance.dto.WithdrawalResponse;
@@ -50,7 +51,14 @@
@RequestParam(required = false) String keyword,
@RequestParam(required = false) String paymentMethod,
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate startDate,
- @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate) {
+ @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate endDate,
+ Authentication authentication) {
+ String requiredAuthority = "REFUND".equalsIgnoreCase(direction)
+ ? "PERM_FINANCE_REFUND_VIEW" : "PERM_FINANCE_DETAIL_VIEW";
+ if (authentication.getAuthorities().stream()
+ .noneMatch(authority -> requiredAuthority.equals(authority.getAuthority()))) {
+ throw new BusinessException(403, "无权访问该财务流水");
+ }
return ApiResponse.success(financeService.ledger(page, size, direction, keyword, paymentMethod, startDate, endDate));
}
--
Gitblit v1.7.1