fix(finance): 客服只能使用自己的备用金账户

apps/backend/src/services/finance/manual-expense-service.ts

@@ -7,7 +7,7 @@ import { resolveFinanceDateRange } from '../../utils/finance-date-range.js'
 import { generateManualExpenseNo } from '../../utils/random.js'
 import { nowIso } from '../../utils/time.js'
 import type { AdminSession } from '../admin/admin-auth-service.js'
-import { writeFundExpense } from '../admin/admin-fund-service.js'
+import { getOwnAgentAccountId, writeFundExpense } from '../admin/admin-fund-service.js'
 
 const EXPENSE_STATUSES = new Set([
   'draft',
@@ -372,9 +372,26 @@ export async function createManualExpense(payload: JsonObject, session: AdminSes
     inferExpenseCategory(costItem?.costType),
     '支出分类无效',
   )
-  const fundAccountId = normalizeOptionalId(
+  const requestedFundAccountId = normalizeOptionalId(
     payload.fundAccountId ?? payload.fund_account_id ?? payload.agentAccountId,
   )
+  let fundAccountId = requestedFundAccountId
+  if (session.role === 'support') {
+    const ownAccountId = await getOwnAgentAccountId(session.userId)
+    if (!ownAccountId) {
+      throw createHttpError('当前账号还没有备用金账户', {
+        statusCode: 404,
+        errorCode: 'fund_agent_account_not_found',
+      })
+    }
+    if (requestedFundAccountId && requestedFundAccountId !== ownAccountId) {
+      throw createHttpError('只能使用自己的备用金账户', {
+        statusCode: 403,
+        errorCode: 'manual_expense_fund_account_forbidden',
+      })
+    }
+    fundAccountId = ownAccountId
+  }
   if (!fundAccountId) {
     throw createHttpError('请选择备用金账户，人工支出必须从备用金扣款', {
       statusCode: 400,
@@ -462,10 +479,10 @@ export async function createManualExpense(payload: JsonObject, session: AdminSes
 export async function createManualOrderCost(payload: JsonObject, session: AdminSession) {
   const orderId = normalizeId(payload.orderId ?? payload.order_id)
   const requestedItemId = normalizeOptionalId(payload.orderItemId ?? payload.order_item_id)
-  const fundAccountId = normalizeOptionalId(
+  const requestedFundAccountId = normalizeOptionalId(
     payload.fundAccountId ?? payload.fund_account_id ?? payload.agentAccountId,
   )
-  if (!fundAccountId) {
+  if (!requestedFundAccountId && session.role !== 'support') {
     throw createHttpError('请选择备用金账户，人工录单必须从备用金扣款', {
       statusCode: 400,
       errorCode: 'manual_order_cost_fund_account_required',
@@ -535,7 +552,7 @@ export async function createManualOrderCost(payload: JsonObject, session: AdminS
       orderId,
       orderItemId,
       costItemId,
-      fundAccountId,
+      fundAccountId: requestedFundAccountId,
       amountFen,
       expenseCategory,
       payeeName,