chore: release server-v1.0.73

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

backend/internal/handler/stock_in.go

@@ -257,16 +257,29 @@ func (h *StockInHandler) Reject(c *gin.Context) {
 }
 
 // Withdraw PUT /api/v1/stock-in/orders/:id/withdraw
-// 审核中(pending)撤回为草稿(draft)，供管理员修改后重新提交。仅 pending 可撤回；
+// 审核中(pending)撤回为草稿(draft)，修改后可重新提交。仅 pending 可撤回；
 // 已审核(approved)单据只读、库存已变动，不可撤回。
+// 权限：管理员/超管可撤回任意单；普通操作员只能撤回本人提交的单（operator_id 为本人）。
 func (h *StockInHandler) Withdraw(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
-	result := h.db.Model(&model.StockInOrder{}).
-		Where("id = ? AND shop_id = ? AND status = 'pending'", c.Param("id"), shopID).
-		Update("status", "draft")
-	if result.RowsAffected == 0 {
+	userID := middleware.GetUserID(c)
+	role := middleware.GetRole(c)
+
+	var order model.StockInOrder
+	if err := h.db.Where("id = ? AND shop_id = ? AND status = 'pending'", c.Param("id"), shopID).
+		First(&order).Error; err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "order not found or not in pending status"})
 		return
 	}
+
+	isAdmin := role == "admin" || role == "superadmin"
+	if !isAdmin && order.OperatorID != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "只能撤回本人提交的单据"})
+		return
+	}
+
+	h.db.Model(&model.StockInOrder{}).
+		Where("id = ? AND shop_id = ?", order.ID, shopID).
+		Update("status", "draft")
 	c.JSON(http.StatusOK, gin.H{"message": "withdrawn"})
 }