perms-system-server/internal/logic/member/userProductsLogic.go

package member

import (
	"context"

	"perms-system-server/internal/middleware"
	"perms-system-server/internal/response"
	"perms-system-server/internal/svc"
	"perms-system-server/internal/types"

	"github.com/zeromicro/go-zero/core/logx"
)

type UserProductsLogic struct {
	logx.Logger
	ctx    context.Context
	svcCtx *svc.ServiceContext
}

func NewUserProductsLogic(ctx context.Context, svcCtx *svc.ServiceContext) *UserProductsLogic {
	return &UserProductsLogic{
		Logger: logx.WithContext(ctx),
		ctx:    ctx,
		svcCtx: svcCtx,
	}
}

// UserProducts 查询指定用户加入的产品列表。
// 访问控制：仅超管或本人可调用，防止普通用户枚举他人的产品归属（IDOR）。
func (l *UserProductsLogic) UserProducts(req *types.UserProductsReq) (resp *types.UserProductsResp, err error) {
	caller := middleware.GetUserDetails(l.ctx)
	if caller == nil {
		return nil, response.ErrUnauthorized("未登录")
	}
	if !caller.IsSuperAdmin && caller.UserId != req.UserId {
		return nil, response.ErrForbidden("无权查看他人的产品列表")
	}

	members, err := l.svcCtx.SysProductMemberModel.FindByUserId(l.ctx, req.UserId)
	if err != nil {
		return nil, err
	}

	items := make([]types.UserProductItem, 0, len(members))
	for _, m := range members {
		product, err := l.svcCtx.SysProductModel.FindOneByCode(l.ctx, m.ProductCode)
		if err != nil {
			continue
		}
		items = append(items, types.UserProductItem{
			ProductCode: m.ProductCode,
			ProductName: product.Name,
			MemberType:  m.MemberType,
			Status:      m.Status,
		})
	}

	return &types.UserProductsResp{List: items}, nil
}