11

app/services/admin_user.py

@@ -82,7 +82,7 @@ async def _validate_owner_ids(
             raise AdminUserError("所选代理不存在")
 
 
-async def create_user(db: AsyncSession, body: AdminUserCreate) -> User:
+async def create_user(db: AsyncSession, body: AdminUserCreate,oem: User) -> User:
     existing = await db.scalar(select(User).where(User.username == body.username))
     if existing is not None:
         raise AdminUserError("用户名已存在")
@@ -92,14 +92,14 @@ async def create_user(db: AsyncSession, body: AdminUserCreate) -> User:
         if phone_taken is not None:
             raise AdminUserError("手机号已被使用")
 
-    await _validate_owner_ids(db, oem_id=body.oem_id, agent_id=body.agent_id)
+    await _validate_owner_ids(db, oem_id=oem.id, agent_id=body.agent_id)
 
     user = User(
         username=body.username,
         password_hash=hash_password(body.password),
         phone=body.phone,
         role_id=body.role_id,
-        oem_id=body.oem_id,
+        oem_id=oem.id,
         agent_id=body.agent_id,
         vip_end_time=body.vip_end_time,
     )
@@ -111,6 +111,7 @@ async def create_user(db: AsyncSession, body: AdminUserCreate) -> User:
 
 async def update_user(
     db: AsyncSession,
+    oem: User,
     user_id: int,
     body: AdminUserUpdate,
     *,
@@ -119,7 +120,7 @@ async def update_user(
     user = await db.get(User, user_id)
     if user is None:
         raise AdminUserError("用户不存在")
-
+    body.oem_id=oem.id
     if body.username is not None and body.username != user.username:
         taken = await db.scalar(select(User).where(User.username == body.username))
         if taken is not None:
@@ -162,12 +163,13 @@ async def update_user(
     return user
 
 
-async def delete_user(db: AsyncSession, user_id: int, *, actor_id: int) -> None:
+async def delete_user(db: AsyncSession, oem: User, user_id: int, *, actor_id: int) -> None:
     if user_id == actor_id:
         raise AdminUserError("不能删除当前登录账号")
 
     user = await db.get(User, user_id)
     if user is None:
         raise AdminUserError("用户不存在")
-
+    if user.oem_id != oem.id:
+        raise AdminUserError("无权限删除该用户")
     await db.delete(user)