v1.0.0

internal/infrastructure/http/handlers/product_handler.go

@@ -415,7 +415,10 @@ func (h *ProductHandler) GetCategoryDetail(c *gin.Context) {
 // @Security Bearer
 // @Param page query int false "页码" default(1)
 // @Param page_size query int false "每页数量" default(10)
-// @Param status query string false "订阅状态"
+// @Param keyword query string false "搜索关键词"
+// @Param product_name query string false "产品名称"
+// @Param start_time query string false "订阅开始时间" format(date-time)
+// @Param end_time query string false "订阅结束时间" format(date-time)
 // @Param sort_by query string false "排序字段"
 // @Param sort_order query string false "排序方向" Enums(asc, desc)
 // @Success 200 {object} responses.SubscriptionListResponse "获取订阅列表成功"
@@ -432,7 +435,7 @@ func (h *ProductHandler) ListMySubscriptions(c *gin.Context) {
 
 	var query queries.ListSubscriptionsQuery
 	if err := h.validator.ValidateQuery(c, &query); err != nil {
-	return
+		return
 	}
 
 	// 设置默认值
@@ -446,6 +449,17 @@ func (h *ProductHandler) ListMySubscriptions(c *gin.Context) {
 		query.PageSize = 100
 	}
 
+	// 设置默认排序
+	if query.SortBy == "" {
+		query.SortBy = "created_at"
+	}
+	if query.SortOrder == "" {
+		query.SortOrder = "desc"
+	}
+
+	// 用户端不支持企业名称筛选，清空该字段
+	query.CompanyName = ""
+
 	result, err := h.subAppService.ListMySubscriptions(c.Request.Context(), userID, &query)
 	if err != nil {
 		h.logger.Error("获取我的订阅列表失败", zap.Error(err), zap.String("user_id", userID))
@@ -521,6 +535,13 @@ func (h *ProductHandler) GetMySubscriptionDetail(c *gin.Context) {
 		return
 	}
 
+	// 验证订阅是否属于当前用户
+	if result.UserID != userID {
+		h.logger.Error("用户尝试访问不属于自己的订阅", zap.String("user_id", userID), zap.String("subscription_user_id", result.UserID), zap.String("subscription_id", subscriptionID))
+		h.responseBuilder.Forbidden(c, "无权访问此订阅")
+		return
+	}
+
 	h.responseBuilder.Success(c, result, "获取我的订阅详情成功")
 }
 
@@ -539,16 +560,33 @@ func (h *ProductHandler) GetMySubscriptionDetail(c *gin.Context) {
 // @Failure 500 {object} map[string]interface{} "服务器内部错误"
 // @Router /api/v1/my/subscriptions/{id}/usage [get]
 func (h *ProductHandler) GetMySubscriptionUsage(c *gin.Context) {
+	userID := c.GetString("user_id")
+	if userID == "" {
+		h.responseBuilder.Unauthorized(c, "用户未登录")
+		return
+	}
+
 	subscriptionID := c.Param("id")
 	if subscriptionID == "" {
 		h.responseBuilder.BadRequest(c, "订阅ID不能为空")
 		return
 	}
 
-	// 获取当前用户ID
-	userID := h.getCurrentUserID(c)
-	if userID == "" {
-		h.responseBuilder.Unauthorized(c, "用户未认证")
+	// 先获取订阅信息以验证权限
+	var query queries.GetSubscriptionQuery
+	query.ID = subscriptionID
+
+	subscription, err := h.subAppService.GetSubscriptionByID(c.Request.Context(), &query)
+	if err != nil {
+		h.logger.Error("获取订阅信息失败", zap.Error(err), zap.String("user_id", userID), zap.String("subscription_id", subscriptionID))
+		h.responseBuilder.NotFound(c, "订阅不存在")
+		return
+	}
+
+	// 验证订阅是否属于当前用户
+	if subscription.UserID != userID {
+		h.logger.Error("用户尝试访问不属于自己的订阅使用情况", zap.String("user_id", userID), zap.String("subscription_user_id", subscription.UserID), zap.String("subscription_id", subscriptionID))
+		h.responseBuilder.Forbidden(c, "无权访问此订阅")
 		return
 	}