From e595defaaf33bab581e89a777102ffdddf67ccc5 Mon Sep 17 00:00:00 2001
From: xcbyy <2578898740@qq.com>
Date: Thu, 22 Oct 2026 11:35:46 +0800
Subject: [PATCH] =?UTF-8?q?fix(admin):=20=E7=94=A8=E6=88=B7360=E7=94=BB?=
 =?UTF-8?q?=E5=83=8F=E8=AE=A2=E5=8D=95=E5=BD=92=E5=B1=9E=E6=94=B9=E7=94=A8?=
 =?UTF-8?q?=20expert=5Fid=20IN=20(=E6=9C=AC=E4=BA=BA=E6=A1=A3=E6=A1=88=20i?=
 =?UTF-8?q?d)=EF=BC=8C=E4=B8=8E=E5=88=97=E8=A1=A8=E5=8F=A3=E5=BE=84?=
 =?UTF-8?q?=E4=B8=80=E8=87=B4=E4=B8=94=E9=81=BF=E5=85=8D=20id=20=E6=92=9E?=
 =?UTF-8?q?=E5=8F=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/src/db/repository.ts            | 6 +++---
 server/tests/read-scope.spec.ts        | 4 ++++
 server/tests/user-detail-scope.spec.ts | 4 +++-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/server/src/db/repository.ts b/server/src/db/repository.ts
index 96f768b..6fdbb3a 100644
--- a/server/src/db/repository.ts
+++ b/server/src/db/repository.ts
@@ -4261,11 +4261,11 @@ export class MysqlRepository {
              duration_hours as durationHours, amount, location, status, created_at as createdAt
       FROM orders
       WHERE buyer_id = ?
-         OR expert_id = ?
          OR claimed_by = ?
-         OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)
+         OR expert_id IN (SELECT id FROM companions WHERE user_id = ?)
+         OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)
       ORDER BY created_at DESC
-    `, [id, id, id, id, id]);
+    `, [id, id, id, id]);
 
     // 资金流水（按 user_id 精确归属）
     const [financeRecords]: any = await pool.query(`
diff --git a/server/tests/read-scope.spec.ts b/server/tests/read-scope.spec.ts
index b4c73fa..03634c7 100644
--- a/server/tests/read-scope.spec.ts
+++ b/server/tests/read-scope.spec.ts
@@ -29,6 +29,10 @@ describe('第十二批读接口数据隔离闸门 (订单 / 我的组局 / 分
       expect(block).not.toContain('WHERE user_id = ? OR id = ?');
     });
 
+    it('订单归属不得把用户 id 当作大神档案 id 兜底（防 id 撞号越权）', () => {
+      expect(repoCode).not.toContain('user_id = ? OR id = ?');
+    });
+
     it('订单列表：管理端全量，普通用户仅本人相关', () => {
       const block = routeBlock("app.get('/api/orders',", 1800);
       expect(block).toContain('isVerifiedAdminRequest(req)');
diff --git a/server/tests/user-detail-scope.spec.ts b/server/tests/user-detail-scope.spec.ts
index 7c61d7e..266ba6e 100644
--- a/server/tests/user-detail-scope.spec.ts
+++ b/server/tests/user-detail-scope.spec.ts
@@ -13,7 +13,9 @@ describe('第五十一批用户360画像关联闸门', () => {
     const start = repoCode.indexOf('async getUserDetail(');
     expect(start).toBeGreaterThan(-1);
     const block = repoCode.slice(start, start + 3000);
-    expect(block).toContain('OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)');
+    expect(block).toContain('OR expert_id IN (SELECT id FROM companions WHERE user_id = ?)');
+    expect(block).toContain('OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)');
+    expect(block).not.toContain('user_id = ? OR id = ?');
     expect(block).not.toContain('WHERE client_name = ? OR companion_name = ?');
   });