From abccecf8ed099a9858711ddefcd55f3f4460e70c Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sun, 13 Sep 2026 12:38:19 +0800
Subject: [PATCH] fix(worker-platform): restrict withdrawal blacklist actions
 to admin role only

---
 .../routes/admin/worker-platform/workers.ts    |  2 +-
 .../src/pages/admin/panels/WorkersPanel.tsx    | 18 +++++++++++-------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/apps/backend/src/routes/admin/worker-platform/workers.ts b/apps/backend/src/routes/admin/worker-platform/workers.ts
index 4f398c3f..b54fd0b1 100644
--- a/apps/backend/src/routes/admin/worker-platform/workers.ts
+++ b/apps/backend/src/routes/admin/worker-platform/workers.ts
@@ -123,7 +123,7 @@ router.post(
 
 router.post(
   '/worker-platform/workers/:workerId/withdrawal-blacklist',
-  requireAdminRoles(['admin', 'operator']),
+  requireAdminRoles(['admin']),
   createJsonHandler(
     (req) =>
       updateAdminWorkerWithdrawalBlacklist(String(req.params.workerId || ''), req.body || {}),
diff --git a/apps/frontend/src/pages/admin/panels/WorkersPanel.tsx b/apps/frontend/src/pages/admin/panels/WorkersPanel.tsx
index fa7caf6c..6e71fb42 100644
--- a/apps/frontend/src/pages/admin/panels/WorkersPanel.tsx
+++ b/apps/frontend/src/pages/admin/panels/WorkersPanel.tsx
@@ -39,6 +39,7 @@ import type {
   WorkerUserStatistics,
 } from '@/types/worker-platform'
 import { ADMIN_DEFAULT_PAGE_SIZE, buildAdminTablePagination } from '@/utils/admin-pagination'
+import { getAdminRole } from '@/utils/admin-auth'
 import WorkerDetailDrawer from './WorkerDetailDrawer'
 import { formatMoney, formatWorkerStatus } from './shared'
 
@@ -115,6 +116,7 @@ function WorkerStatisticsBar({ statistics }: { statistics?: WorkerUserStatistics
 }
 
 export default function WorkersPanel() {
+  const isAdmin = getAdminRole() === 'admin'
   const { message, modal } = App.useApp()
   const queryClient = useQueryClient()
   const [searchParams, setSearchParams] = useSearchParams()
@@ -612,13 +614,15 @@ export default function WorkersPanel() {
           <Button onClick={() => setCreditWorker(row)}>充值</Button>
           <Button onClick={() => setResetPasswordWorker(row)}>重置密码</Button>
           <Button onClick={() => void openWithdrawalAccountModal(row)}>提现信息</Button>
-          {row.isWithdrawalBlacklisted ? (
-            <Button onClick={() => handleRemoveFromBlacklist(row)}>移出提现黑名单</Button>
-          ) : (
-            <Button danger onClick={() => handleAddToBlacklist(row)}>
-              加入提现黑名单
-            </Button>
-          )}
+          {isAdmin ? (
+            row.isWithdrawalBlacklisted ? (
+              <Button onClick={() => handleRemoveFromBlacklist(row)}>移出提现黑名单</Button>
+            ) : (
+              <Button danger onClick={() => handleAddToBlacklist(row)}>
+                加入提现黑名单
+              </Button>
+            )
+          ) : null}
         </Space>
       ),
     },