【安全加密】接口越权：横向越权的 ID 校验清单

---危险写法：只验登录不验归属
-- function Mail.open(actor, mailId)
--     local mail = MailRepo.find(mailId)
--     return mail            -- 任何登录用户可翻任何邮件
-- end

---正确写法：资源归属二次校验
function Mail.open(actor, mailId)
    local mail = MailRepo.find(mailId)
    if not mail then
        return nil, "邮件不存在"
    end
    if mail.userId ~= actor:GetUserId() then
        Ops.alert("越权尝试", actor:GetUserId(), mailId)
        return nil, "无权访问该邮件"
    end
    return mail
end

---归属校验的白名单化封装
local OWNED = {
    mail = function(repo, id, uid)
        local m = repo.find(id)
        return m and m.userId == uid, m
    end,
    order = function(repo, id, uid)
        local o = repo.find(id)
        return o and o.userId == uid, o
    end,
}

function Guard.own(kind, id, actor)
    local ok, res = OWNED[kind](Repo.of(kind), id, actor:GetUserId())
    if not ok then
        Ops.alert("归属校验失败", kind, id, actor:GetUserId())
    end
    return ok, res
end