fix: 修复删除资源时未验证所有者的问题

api/account/account.go

@@ -218,6 +218,18 @@ func HandleDeleteAccount(c *gin.Context) {
 		return
 	}
 
+	// 检查账号是否归属请求用户
+	ownerUID, err := getAccountOwnerUID(accountID)
+	if err != nil {
+		response.ServerError(c, "获取账号所属用户失败")
+		return
+	}
+
+	if ownerUID != userInfo.ID {
+		response.Forbidden(c, "无权限操作该账号")
+		return
+	}
+
 	// 删除相关规则
 	rules, err := getRulesByAccountID(accountID, userInfo.ID)
 	if err != nil {

api/account/tool.go

@@ -59,3 +59,17 @@ func maskAccounts(accounts []model.Account) []model.Account {
 	}
 	return masked
 }
+
+// getAccountOwnerUID 获取账号所属用户的 UID
+func getAccountOwnerUID(accountID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var account model.Account
+	if err := gormDB.Select("uid").Where("id = ?", accountID).First(&account).Error; err != nil {
+		return 0, err
+	}
+	return account.UID, nil
+}