From 4f5fbcdc8f5dab868fbbb9fd7d223c61460500e1 Mon Sep 17 00:00:00 2001
From: Agent <agent@openclaw.ai>
Date: Sun, 29 Mar 2026 07:18:26 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=AC=E5=BC=80=E8=AE=A2=E5=8D=95?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E5=A2=9E=E5=8A=A0customerId=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C=EF=BC=8C=E9=98=B2=E6=AD=A2=E7=9B=97=E6=9F=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../building/controller/PublicOrderController.java | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/main/java/com/example/building/controller/PublicOrderController.java b/src/main/java/com/example/building/controller/PublicOrderController.java
index 7d558d7..2aad1de 100644
--- a/src/main/java/com/example/building/controller/PublicOrderController.java
+++ b/src/main/java/com/example/building/controller/PublicOrderController.java
@@ -14,7 +14,7 @@ import java.util.Map;
 
 /**
  * 公开订单查看控制器
- * 无需认证，用于客户通过分享链接查看订单
+ * 无需权限认证，用于客户通过分享链接查看订单
  */
 @RestController
 @RequestMapping("/api/v1/public")
@@ -27,19 +27,23 @@ public class PublicOrderController {
     private OrderItemMapper orderItemMapper;
 
     /**
-     * 通过订单号查询订单详情
-     * 公开接口，无需认证
+     * 通过订单号和客户ID查询订单详情
+     * 公开接口，需同时提供订单号和客户ID才能查看
      */
     @GetMapping("/orders/{orderNo}")
-    public Result<Map<String, Object>> getOrderByNo(@PathVariable String orderNo) {
+    public Result<Map<String, Object>> getOrderByNo(
+            @PathVariable String orderNo,
+            @RequestParam String customerId) {
+
         // 查询订单
         Order order = orderMapper.selectOne(
             new com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper<Order>()
                 .eq(Order::getOrderNo, orderNo)
+                .eq(Order::getCustomerId, customerId)
         );
 
         if (order == null) {
-            return Result.error("订单不存在");
+            return Result.error("订单不存在或客户信息不匹配");
         }
 
         // 查询订单明细