fix(finance): 客服可读取自己的积分钱包

apps/backend/src/routes/admin/cost-center.ts

@@ -62,7 +62,12 @@ import {
   syncEstimatedOrderItemCostSnapshots,
 } from '../../services/cost-center/cost-snapshot-sync-service.js'
 import type { JsonObject } from '../../types/json.js'
-import { createJsonHandler, requireAdminPermission, requireAdminRoles } from './session.js'
+import {
+  createJsonHandler,
+  requireAdminPermission,
+  requireAdminRoles,
+  requireAnyAdminPermission,
+} from './session.js'
 
 const router = Router()
 
@@ -78,7 +83,7 @@ function bodyOf(req: Request): JsonObject {
   return req.body && typeof req.body === 'object' ? (req.body as JsonObject) : {}
 }
 
-router.use('/cost-center', requireAdminRoles(['admin', 'operator', 'finance']))
+router.use('/cost-center', requireAdminRoles(['admin', 'operator', 'finance', 'support']))
 
 router.get(
   '/cost-center/overview',
@@ -758,7 +763,7 @@ router.post(
 
 router.get(
   '/cost-center/platform-credits/accounts',
-  requireAdminPermission('finance.view'),
+  requireAnyAdminPermission(['fund.view', 'finance.view']),
   createJsonHandler((req) => listPlatformCreditAccounts(sessionOf(req)), {
     successMessage: 'ok',
     errorMessage: '读取积分钱包失败',
@@ -768,7 +773,7 @@ router.get(
 
 router.get(
   '/cost-center/platform-credits/entries',
-  requireAdminPermission('finance.view'),
+  requireAnyAdminPermission(['fund.view', 'finance.view']),
   createJsonHandler(
     (req) => listPlatformCreditEntries(req.query as Record<string, unknown>, sessionOf(req)),
     {