fix: 修复删除资源时未验证所有者的问题

api/account/account.go

@@ -218,6 +218,18 @@ func HandleDeleteAccount(c *gin.Context) {
 		return
 	}
 
+	// 检查账号是否归属请求用户
+	ownerUID, err := getAccountOwnerUID(accountID)
+	if err != nil {
+		response.ServerError(c, "获取账号所属用户失败")
+		return
+	}
+
+	if ownerUID != userInfo.ID {
+		response.Forbidden(c, "无权限操作该账号")
+		return
+	}
+
 	// 删除相关规则
 	rules, err := getRulesByAccountID(accountID, userInfo.ID)
 	if err != nil {

api/account/tool.go

@@ -59,3 +59,17 @@ func maskAccounts(accounts []model.Account) []model.Account {
 	}
 	return masked
 }
+
+// getAccountOwnerUID 获取账号所属用户的 UID
+func getAccountOwnerUID(accountID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var account model.Account
+	if err := gormDB.Select("uid").Where("id = ?", accountID).First(&account).Error; err != nil {
+		return 0, err
+	}
+	return account.UID, nil
+}

api/response/response.go

@@ -40,6 +40,9 @@ func NotFound(c *gin.Context, msg string) { Fail(c, http.StatusNotFound, msg) }
 // ServerError 服务端错误
 func ServerError(c *gin.Context, msg string) { Fail(c, http.StatusInternalServerError, msg) }
 
+// Forbidden 无权限
+func Forbidden(c *gin.Context, msg string) { Fail(c, http.StatusForbidden, msg) }
+
 // FromError 按错误类型选择合适的状态码：
 // 参数校验错误返回 400，其余返回 500
 func FromError(c *gin.Context, err error, fallback string) {

api/rule/rule.go

@@ -162,6 +162,16 @@ func HandleDeleteRule(c *gin.Context) {
 		return
 	}
 
+	ownerUID, err := getRuleOwnerUID(ruleID)
+	if err != nil {
+		response.ServerError(c, "获取规则所属用户失败")
+		return
+	}
+	if ownerUID != userInfo.ID {
+		response.Forbidden(c, "无权限操作该规则")
+		return
+	}
+
 	if err := DeleteRuleByID(ruleID, userInfo.ID); err != nil {
 		response.ServerError(c, "删除规则失败")
 		return

api/rule/tool.go

@@ -103,3 +103,18 @@ func maskRules(rules []model.Rule) []model.Rule {
 	}
 	return masked
 }
+
+// getRuleOwnerUID 获取规则所属用户的 UID
+func getRuleOwnerUID(ruleID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var rule model.Rule
+	if err := gormDB.Select("uid").Where("id = ?", ruleID).First(&rule).Error; err != nil {
+		return 0, err
+	}
+
+	return rule.UID, nil
+}

api/timer/tool.go

@@ -70,3 +70,17 @@ func signTimer(timer *model.Timer) error {
 	timer.Triggered = false
 	return nil
 }
+
+// getTimerOwnerUID 获取 Timer 的所属用户 ID
+func getTimerOwnerUID(timerID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var timer model.Timer
+	if err := gormDB.Select("uid").Where("id = ?", timerID).First(&timer).Error; err != nil {
+		return 0, err
+	}
+	return timer.UID, nil
+}