push

server.js

@@ -13,7 +13,7 @@ const products = require('./routes/products')
 const suppliers = require('./routes/suppliers')
 
 // 导入中间件
-const { checkPermission, dataScope, validateContractType } = require('./middleware/permissions')
+const { checkPermission, dataScope, validateContractType, checkHierarchy } = require('./middleware/permissions')
 const { protectSelfUpdate, protectUserDelete } = require('./middleware/users')
 const { allowUserCreation } = require('./middleware/employees')
 
@@ -47,8 +47,8 @@ app.put('/api/user/password',      auth, users.changePassword)
 app.get('/api/users',              auth, checkPermission('user', 'manage'), users.list)
 app.get('/api/users/:id',          auth, checkPermission('user', 'manage'), users.detail)
 app.post('/api/users',             auth, checkPermission('user', 'manage'), users.create)
-app.put('/api/users/:id',          auth, checkPermission('user', 'manage'), protectSelfUpdate, users.update)
-app.delete('/api/users/:id',       auth, checkPermission('user', 'manage'), protectUserDelete, users.remove)
+app.put('/api/users/:id',          auth, checkPermission('user', 'manage'), checkHierarchy, protectSelfUpdate, users.update)
+app.delete('/api/users/:id',       auth, checkPermission('user', 'manage'), checkHierarchy, protectUserDelete, users.remove)
 
 // ============ 加盟商管理 /api/customers ============
 app.get('/api/customers/simple',    auth, checkPermission('customer', 'read'),                                       customers.simpleList)