新增

backend/payments/router.py

@@ -3,7 +3,8 @@ from fastapi.responses import PlainTextResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from auth.dependencies import get_current_user, require_permission
-from auth.permissions import PAYMENTS_MANAGE
+from auth.permissions import ORDERS_CREATE, ORDERS_READ, PAYMENTS_MANAGE
+from auth.roles import has_permission
 from auth.system_settings import load_settings
 from models.database import get_db
 from models.models import User
@@ -21,6 +22,18 @@ from .schemas import (
 router = APIRouter(prefix="/api/payments", tags=["payments"])
 
 
+def _require_orders_access(user: User) -> None:
+    if has_permission(user.role, ORDERS_READ) or has_permission(user.role, PAYMENTS_MANAGE):
+        return
+    raise HTTPException(status_code=403, detail="缺少权限：orders.read")
+
+
+def _require_orders_create(user: User) -> None:
+    if has_permission(user.role, ORDERS_CREATE) or has_permission(user.role, PAYMENTS_MANAGE):
+        return
+    raise HTTPException(status_code=403, detail="缺少权限：orders.create")
+
+
 @router.get("/config", response_model=PaymentConfigResponse)
 async def get_payment_config(
     db: AsyncSession = Depends(get_db),
@@ -36,6 +49,7 @@ async def create_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_create(user)
     order, demo_mode = await service.create_order(db, user, body.slots, body.channel)
     return PaymentOrderResponse(**service.order_to_dict(order, demo_mode=demo_mode))
 
@@ -49,6 +63,7 @@ async def list_payment_orders(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_access(user)
     if status and status not in service.ORDER_STATUSES:
         raise HTTPException(status_code=400, detail="无效的订单状态")
     data = await service.list_orders(
@@ -68,6 +83,7 @@ async def get_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_access(user)
     settings = await load_settings(db)
     order = await service.get_user_order(db, user, order_no)
     demo_mode = settings.payment_demo_mode and not settings.payment_channel_available(order.channel)
@@ -80,6 +96,7 @@ async def simulate_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_create(user)
     settings = await load_settings(db)
     order = await service.simulate_pay(db, user, order_no)
     return PaymentOrderResponse(**service.order_to_dict(order, demo_mode=settings.payment_demo_mode))

backend/payments/service.py

@@ -12,7 +12,8 @@ from sqlalchemy import func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from auth.account_quota import default_stop_worker, sync_user_account_quota
-from auth.roles import is_admin
+from auth.roles import has_global_scope, has_permission, is_admin
+from auth.permissions import ORDERS_READ, PAYMENTS_MANAGE
 from auth.system_settings import SystemSettingsData, load_settings
 from models.models import PaymentOrder, User
 from . import alipay, wechat
@@ -347,7 +348,12 @@ async def list_orders(
     page_size = max(1, min(100, page_size))
 
     filters = []
-    if not is_admin(current_user.role):
+    # Global order list for built-in admin, payments.manage, or data.scope_all.
+    if not (
+        is_admin(current_user.role)
+        or has_permission(current_user.role, PAYMENTS_MANAGE)
+        or has_global_scope(current_user.role)
+    ):
         filters.append(PaymentOrder.user_id == current_user.id)
     if status:
         filters.append(PaymentOrder.status == status)