From f0f8c92e67e77529c493f7fcfc5557f65b85a0ea Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 24 Oct 2026 13:47:53 +0800
Subject: [PATCH] =?UTF-8?q?fix(finance):=20=E5=AE=A2=E6=9C=8D=E5=8F=AF?=
 =?UTF-8?q?=E8=AF=BB=E5=8F=96=E8=87=AA=E5=B7=B1=E7=9A=84=E7=A7=AF=E5=88=86?=
 =?UTF-8?q?=E9=92=B1=E5=8C=85?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/backend/src/routes/admin/cost-center.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/backend/src/routes/admin/cost-center.ts b/apps/backend/src/routes/admin/cost-center.ts
index 3799a038..88bce1da 100644
--- a/apps/backend/src/routes/admin/cost-center.ts
+++ b/apps/backend/src/routes/admin/cost-center.ts
@@ -62,7 +62,12 @@ import {
   syncEstimatedOrderItemCostSnapshots,
 } from '../../services/cost-center/cost-snapshot-sync-service.js'
 import type { JsonObject } from '../../types/json.js'
-import { createJsonHandler, requireAdminPermission, requireAdminRoles } from './session.js'
+import {
+  createJsonHandler,
+  requireAdminPermission,
+  requireAdminRoles,
+  requireAnyAdminPermission,
+} from './session.js'
 
 const router = Router()
 
@@ -78,7 +83,7 @@ function bodyOf(req: Request): JsonObject {
   return req.body && typeof req.body === 'object' ? (req.body as JsonObject) : {}
 }
 
-router.use('/cost-center', requireAdminRoles(['admin', 'operator', 'finance']))
+router.use('/cost-center', requireAdminRoles(['admin', 'operator', 'finance', 'support']))
 
 router.get(
   '/cost-center/overview',
@@ -758,7 +763,7 @@ router.post(
 
 router.get(
   '/cost-center/platform-credits/accounts',
-  requireAdminPermission('finance.view'),
+  requireAnyAdminPermission(['fund.view', 'finance.view']),
   createJsonHandler((req) => listPlatformCreditAccounts(sessionOf(req)), {
     successMessage: 'ok',
     errorMessage: '读取积分钱包失败',
@@ -768,7 +773,7 @@ router.get(
 
 router.get(
   '/cost-center/platform-credits/entries',
-  requireAdminPermission('finance.view'),
+  requireAnyAdminPermission(['fund.view', 'finance.view']),
   createJsonHandler(
     (req) => listPlatformCreditEntries(req.query as Record<string, unknown>, sessionOf(req)),
     {