新增

backend/payments/router.py

@@ -3,7 +3,8 @@ from fastapi.responses import PlainTextResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from auth.dependencies import get_current_user, require_permission
-from auth.permissions import PAYMENTS_MANAGE
+from auth.permissions import ORDERS_CREATE, ORDERS_READ, PAYMENTS_MANAGE
+from auth.roles import has_permission
 from auth.system_settings import load_settings
 from models.database import get_db
 from models.models import User
@@ -21,6 +22,18 @@ from .schemas import (
 router = APIRouter(prefix="/api/payments", tags=["payments"])
 
 
+def _require_orders_access(user: User) -> None:
+    if has_permission(user.role, ORDERS_READ) or has_permission(user.role, PAYMENTS_MANAGE):
+        return
+    raise HTTPException(status_code=403, detail="缺少权限：orders.read")
+
+
+def _require_orders_create(user: User) -> None:
+    if has_permission(user.role, ORDERS_CREATE) or has_permission(user.role, PAYMENTS_MANAGE):
+        return
+    raise HTTPException(status_code=403, detail="缺少权限：orders.create")
+
+
 @router.get("/config", response_model=PaymentConfigResponse)
 async def get_payment_config(
     db: AsyncSession = Depends(get_db),
@@ -36,6 +49,7 @@ async def create_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_create(user)
     order, demo_mode = await service.create_order(db, user, body.slots, body.channel)
     return PaymentOrderResponse(**service.order_to_dict(order, demo_mode=demo_mode))
 
@@ -49,6 +63,7 @@ async def list_payment_orders(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_access(user)
     if status and status not in service.ORDER_STATUSES:
         raise HTTPException(status_code=400, detail="无效的订单状态")
     data = await service.list_orders(
@@ -68,6 +83,7 @@ async def get_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_access(user)
     settings = await load_settings(db)
     order = await service.get_user_order(db, user, order_no)
     demo_mode = settings.payment_demo_mode and not settings.payment_channel_available(order.channel)
@@ -80,6 +96,7 @@ async def simulate_payment_order(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
+    _require_orders_create(user)
     settings = await load_settings(db)
     order = await service.simulate_pay(db, user, order_no)
     return PaymentOrderResponse(**service.order_to_dict(order, demo_mode=settings.payment_demo_mode))