修复会话安全与实时消息

server/internal/handler/customer.go

@@ -12,6 +12,20 @@ type CustomerHandler struct{}
 
 func NewCustomerHandler() *CustomerHandler { return &CustomerHandler{} }
 
+func canAccessCustomer(c *gin.Context, customerID uint) bool {
+	if middleware.HasAnyRole(c, "admin", "supervisor") {
+		return true
+	}
+	if middleware.GetRole(c) != "agent" {
+		return false
+	}
+	var count int64
+	model.DB.Model(&model.Session{}).
+		Where("tenant_id = ? AND customer_id = ? AND agent_id = ?", middleware.GetTenantID(c), customerID, middleware.GetUserID(c)).
+		Count(&count)
+	return count > 0
+}
+
 func (h *CustomerHandler) List(c *gin.Context) {
 	tenantID := middleware.GetTenantID(c)
 	page, pageSize := middleware.GetPageParams(c)
@@ -23,6 +37,12 @@ func (h *CustomerHandler) List(c *gin.Context) {
 	var total int64
 
 	query := model.DB.Where("tenant_id = ?", tenantID)
+	if middleware.GetRole(c) == "agent" {
+		assignedCustomers := model.DB.Model(&model.Session{}).
+			Select("customer_id").
+			Where("tenant_id = ? AND agent_id = ?", tenantID, middleware.GetUserID(c))
+		query = query.Where("id IN (?)", assignedCustomers)
+	}
 	if search != "" {
 		query = query.Where("name LIKE ? OR phone LIKE ? OR email LIKE ?", "%"+search+"%", "%"+search+"%", "%"+search+"%")
 	}
@@ -48,10 +68,17 @@ func (h *CustomerHandler) Get(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "客户不存在"})
 		return
 	}
+	if !canAccessCustomer(c, customer.ID) {
+		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权查看该客户"})
+		return
+	}
 
 	var sessions []model.Session
-	model.DB.Where("customer_id = ? AND tenant_id = ?", customer.ID, tenantID).
-		Order("created_at desc").Limit(20).Find(&sessions)
+	sessionQuery := model.DB.Where("customer_id = ? AND tenant_id = ?", customer.ID, tenantID)
+	if middleware.GetRole(c) == "agent" {
+		sessionQuery = sessionQuery.Where("agent_id = ?", middleware.GetUserID(c))
+	}
+	sessionQuery.Order("created_at desc").Limit(20).Find(&sessions)
 
 	middleware.JSON(c, gin.H{"customer": customer, "sessions": sessions})
 }
@@ -82,6 +109,10 @@ func (h *CustomerHandler) Update(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"code": 404, "message": "客户不存在"})
 		return
 	}
+	if !canAccessCustomer(c, customer.ID) {
+		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "无权编辑该客户"})
+		return
+	}
 
 	var updates map[string]interface{}
 	if err := c.ShouldBindJSON(&updates); err != nil {
@@ -89,15 +120,30 @@ func (h *CustomerHandler) Update(c *gin.Context) {
 		return
 	}
 
-	// 不允许修改 tenant_id
-	delete(updates, "tenant_id")
-	delete(updates, "id")
+	allowed := map[string]bool{"name": true, "phone": true, "email": true, "tags": true, "source": true, "status": true}
+	for key := range updates {
+		if !allowed[key] {
+			delete(updates, key)
+		}
+	}
+	if len(updates) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "没有可更新字段"})
+		return
+	}
 
-	model.DB.Model(&customer).Updates(updates)
+	if err := model.DB.Model(&customer).Updates(updates).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"code": 500, "message": "更新失败"})
+		return
+	}
+	model.DB.First(&customer, customer.ID)
 	middleware.JSON(c, customer)
 }
 
 func (h *CustomerHandler) Delete(c *gin.Context) {
+	if !middleware.HasAnyRole(c, "admin", "supervisor") {
+		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "仅主管或管理员可删除客户"})
+		return
+	}
 	tenantID := middleware.GetTenantID(c)
 	id := c.Param("id")