From 34b0f65d531ed0f4a4206e74a16de3d20876f702 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E6=98=8A=E5=A4=A9?= <442384644@qq.com>
Date: Fri, 9 Oct 2026 09:47:11 +0800
Subject: [PATCH] =?UTF-8?q?fix(=E8=AE=A2=E5=8D=95=E4=B8=AD=E5=8F=B0):=20?=
 =?UTF-8?q?=E7=AE=A1=E7=90=86=E7=AB=AF=E5=88=A0=E9=99=A4=E8=AE=A2=E5=8D=95?=
 =?UTF-8?q?=E9=A1=BB=E4=BB=A5=E7=94=A8=E6=88=B7=E5=B7=B2=E5=88=A0=E9=99=A4?=
 =?UTF-8?q?=E4=B8=BA=E5=89=8D=E6=8F=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

后台 center/delete 此前对任意订单直接置 is_del=1，用户未删除的
有效订单可被后台直接删除。现删除前校验中台记录 is_del 标记：
仅允许处理用户端已删除（回收站）的订单，未删除时抛出
「订单未被用户删除，不能删除」，订单不存在单独提示。
---
 backend/app/services/order/OrderCenterServices.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/backend/app/services/order/OrderCenterServices.php b/backend/app/services/order/OrderCenterServices.php
index 252e47367..ee1d62968 100644
--- a/backend/app/services/order/OrderCenterServices.php
+++ b/backend/app/services/order/OrderCenterServices.php
@@ -20,6 +20,7 @@ use crmeb\trade\order\type\OrderCenterSyncInterface;
 use crmeb\trade\mode\TradeModeRegistry;
 use crmeb\trade\product\ProductTypeRegistry;
 use crmeb\utils\SnowflakeIdGenerator;
+use crmeb\exceptions\ApiException;
 use app\dao\driver\pay\PayChannelDao;
 use app\dao\user\UserBillDao;
 use think\facade\Log;
@@ -2610,12 +2611,21 @@ class OrderCenterServices extends BaseService implements OrderCenterSyncInterfac
     }
 
     /**
-     * 软删除订单
+     * 软删除订单（管理端）
+     * 仅允许删除用户端已删除的订单，用户未删除的订单不能直接删除
      * @param int $id 订单中台记录ID
      * @return bool 返回是否删除成功
+     * @throws ApiException 订单不存在或用户未删除时抛出
      */
     public function delete(int $id): bool
     {
+        $orderInfo = $this->dao->get(['id' => $id]);
+        if (!$orderInfo) {
+            throw new ApiException('订单不存在');
+        }
+        if (!(int)($orderInfo['is_del'] ?? 0)) {
+            throw new ApiException('订单未被用户删除，不能删除');
+        }
         return $this->dao->update(['id' => $id], ['is_del' => 1]) !== false;
     }