更新

backend/payments/router.py

@@ -2,7 +2,8 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import PlainTextResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from auth.dependencies import get_current_user, require_admin
+from auth.dependencies import get_current_user, require_permission
+from auth.permissions import PAYMENTS_MANAGE
 from auth.system_settings import load_settings
 from models.database import get_db
 from models.models import User
@@ -89,7 +90,7 @@ async def admin_update_payment_order_status(
     order_no: str,
     body: AdminUpdateOrderStatusRequest,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_admin),
+    _: User = Depends(require_permission(PAYMENTS_MANAGE)),
 ):
     order = await service.admin_update_order_status(db, order_no, body.status)
     return PaymentOrderListItem(**order)
@@ -99,7 +100,7 @@ async def admin_update_payment_order_status(
 async def admin_delete_payment_order(
     order_no: str,
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(require_admin),
+    _: User = Depends(require_permission(PAYMENTS_MANAGE)),
 ):
     await service.admin_delete_order(db, order_no)
     return MessageResponse(message="订单已删除")