From 32defce50c8fce933ad5ef1fa5990c33487ebe9b Mon Sep 17 00:00:00 2001
From: xcbyy <2578898740@qq.com>
Date: Thu, 22 Oct 2026 11:33:47 +0800
Subject: [PATCH] =?UTF-8?q?fix(order):=20=E5=85=B3=E9=97=AD=E6=8C=89?=
 =?UTF-8?q?=E7=94=A8=E6=88=B7=20id=20=E6=92=9E=E5=BA=93=E6=A1=A3=E6=A1=88?=
 =?UTF-8?q?=20id=20=E7=9A=84=E8=AE=A2=E5=8D=95=E5=BD=92=E5=B1=9E=E5=85=9C?=
 =?UTF-8?q?=E5=BA=95=EF=BC=8C=E9=81=BF=E5=85=8D=E6=BD=9C=E5=9C=A8=E8=B6=8A?=
 =?UTF-8?q?=E6=9D=83=E8=AF=BB=E5=8F=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- getOrdersForUser/countOrdersForUser 仅按 companions.user_id 关联本人档案，不再使用 companions.id = 用户 id

- 补充回归断言；116 套件/758 用例全绿；线上已验证用户订单仍正常
---
 server/src/db/repository.ts     | 8 ++++----
 server/tests/read-scope.spec.ts | 2 ++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/server/src/db/repository.ts b/server/src/db/repository.ts
index b6db6a9..96f768b 100644
--- a/server/src/db/repository.ts
+++ b/server/src/db/repository.ts
@@ -1530,12 +1530,12 @@ export class MysqlRepository {
           buyer_id = ?
           OR expert_id = ?
           OR claimed_by = ?
-          OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)
+          OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)
         )
         AND ${statusWhere}
       ORDER BY created_at DESC
       ${limitSql}
-    `, [uid, uid, uid, uid, uid]);
+    `, [uid, uid, uid, uid]);
     return rows;
   }
 
@@ -1550,10 +1550,10 @@ export class MysqlRepository {
           buyer_id = ?
           OR expert_id = ?
           OR claimed_by = ?
-          OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)
+          OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)
         )
         AND ${statusWhere}
-    `, [uid, uid, uid, uid, uid]);
+    `, [uid, uid, uid, uid]);
     return Number((rows && rows[0] && rows[0].c) || 0);
   }
 
diff --git a/server/tests/read-scope.spec.ts b/server/tests/read-scope.spec.ts
index b6b7bcc..b4c73fa 100644
--- a/server/tests/read-scope.spec.ts
+++ b/server/tests/read-scope.spec.ts
@@ -25,6 +25,8 @@ describe('第十二批读接口数据隔离闸门 (订单 / 我的组局 / 分
       expect(block).toContain('buyer_id = ?');
       expect(block).toContain('claimed_by = ?');
       expect(block).toContain('companion_name IN (SELECT name FROM companions');
+      // 不得用「用户 id == 档案 id」做兜底归属，避免 id 撞号导致越权看到他人订单
+      expect(block).not.toContain('WHERE user_id = ? OR id = ?');
     });
 
     it('订单列表：管理端全量，普通用户仅本人相关', () => {