fix(finance): 客服只能使用自己的备用金账户

apps/backend/src/services/admin/admin-fund-service.ts

@@ -1507,19 +1507,24 @@ export async function createAdminFundReturn(payload: JsonObject, session: AdminS
   })
 }
 
+export async function getOwnAgentAccountId(userId: number): Promise<number> {
+  const own = await query<FundAccountRow>(
+    "SELECT * FROM fund_accounts WHERE owner_admin_user_id = $1 AND account_type = 'agent' AND status <> 'closed' ORDER BY id LIMIT 1",
+    [userId],
+  )
+  return own.rows[0] ? Number(own.rows[0].id) : 0
+}
+
 async function resolveAgentAccountId(payload: JsonObject, session: AdminSession): Promise<number> {
   if (session.role === 'support') {
-    const own = await query<FundAccountRow>(
-      "SELECT * FROM fund_accounts WHERE owner_admin_user_id = $1 AND account_type = 'agent' LIMIT 1",
-      [session.userId],
-    )
-    if (!own.rows[0]) {
+    const ownAccountId = await getOwnAgentAccountId(session.userId)
+    if (!ownAccountId) {
       throw createHttpError('当前账号还没有备用金账户', {
         statusCode: 404,
         errorCode: 'fund_agent_account_not_found',
       })
     }
-    return Number(own.rows[0].id)
+    return ownAccountId
   }
 
   const accountId = toId(payload.agentAccountId)

apps/backend/src/services/finance/manual-expense-service.ts

@@ -7,7 +7,7 @@ import { resolveFinanceDateRange } from '../../utils/finance-date-range.js'
 import { generateManualExpenseNo } from '../../utils/random.js'
 import { nowIso } from '../../utils/time.js'
 import type { AdminSession } from '../admin/admin-auth-service.js'
-import { writeFundExpense } from '../admin/admin-fund-service.js'
+import { getOwnAgentAccountId, writeFundExpense } from '../admin/admin-fund-service.js'
 
 const EXPENSE_STATUSES = new Set([
   'draft',
@@ -372,9 +372,26 @@ export async function createManualExpense(payload: JsonObject, session: AdminSes
     inferExpenseCategory(costItem?.costType),
     '支出分类无效',
   )
-  const fundAccountId = normalizeOptionalId(
+  const requestedFundAccountId = normalizeOptionalId(
     payload.fundAccountId ?? payload.fund_account_id ?? payload.agentAccountId,
   )
+  let fundAccountId = requestedFundAccountId
+  if (session.role === 'support') {
+    const ownAccountId = await getOwnAgentAccountId(session.userId)
+    if (!ownAccountId) {
+      throw createHttpError('当前账号还没有备用金账户', {
+        statusCode: 404,
+        errorCode: 'fund_agent_account_not_found',
+      })
+    }
+    if (requestedFundAccountId && requestedFundAccountId !== ownAccountId) {
+      throw createHttpError('只能使用自己的备用金账户', {
+        statusCode: 403,
+        errorCode: 'manual_expense_fund_account_forbidden',
+      })
+    }
+    fundAccountId = ownAccountId
+  }
   if (!fundAccountId) {
     throw createHttpError('请选择备用金账户，人工支出必须从备用金扣款', {
       statusCode: 400,
@@ -462,10 +479,10 @@ export async function createManualExpense(payload: JsonObject, session: AdminSes
 export async function createManualOrderCost(payload: JsonObject, session: AdminSession) {
   const orderId = normalizeId(payload.orderId ?? payload.order_id)
   const requestedItemId = normalizeOptionalId(payload.orderItemId ?? payload.order_item_id)
-  const fundAccountId = normalizeOptionalId(
+  const requestedFundAccountId = normalizeOptionalId(
     payload.fundAccountId ?? payload.fund_account_id ?? payload.agentAccountId,
   )
-  if (!fundAccountId) {
+  if (!requestedFundAccountId && session.role !== 'support') {
     throw createHttpError('请选择备用金账户，人工录单必须从备用金扣款', {
       statusCode: 400,
       errorCode: 'manual_order_cost_fund_account_required',
@@ -535,7 +552,7 @@ export async function createManualOrderCost(payload: JsonObject, session: AdminS
       orderId,
       orderItemId,
       costItemId,
-      fundAccountId,
+      fundAccountId: requestedFundAccountId,
       amountFen,
       expenseCategory,
       payeeName,