fix(admin): 收紧 isSuper、plan-prices RBAC 与封禁状态机

避免 roles.write 绕过全部 can()；定价读写挂 membership.plans 权限；去掉快捷封禁双路径并让 ban/unban 走 lifecycle。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 01:56:00 +08:00
parent 62cd8c45dd
commit 0d50c0ee73
10 changed files with 44 additions and 64 deletions
@@ -234,10 +234,8 @@ func (s *Service) ListPlanPrices(ctx context.Context) ([]repository.PlanPrice, e
 }

 // UpsertPlanPrices updates display prices (not historical order amounts).
+// Caller must enforce admin.membership.plans.write.
 func (s *Service) UpsertPlanPrices(ctx context.Context, adminID uuid.UUID, items []repository.PlanPrice) error {
-	if err := s.RequireSuper(ctx, adminID); err != nil {
-		return err
-	}
 	if len(items) == 0 {
 		return ErrInvalidPlan
 	}