feat(auth): use Wayne native role APIs

server/internal/handler/user.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"net/http"
+	"strconv"
 
 	"github.com/1024XEngineer/xinfra/server/internal/model"
 
@@ -32,8 +33,33 @@ func (h *UserHandler) Me(c *gin.Context) {
 }
 
 func (h *UserHandler) List(c *gin.Context) {
+	claims, ok := CurrentClaims(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
+
+	query := h.db.Model(&model.User{}).Where("users.deleted_at IS NULL")
+	if businessLineID := c.Query("business_line_id"); businessLineID != "" {
+		if !claims.IsAdmin {
+			id, err := strconv.ParseUint(businessLineID, 10, 64)
+			if err != nil || id == 0 {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "invalid business line id"})
+				return
+			}
+			var binding model.BusinessLineUser
+			if err := h.db.Where("business_line_id = ? AND user_id = ?", id, claims.UserID).First(&binding).Error; err != nil {
+				c.JSON(http.StatusForbidden, gin.H{"error": "current user is not in business line"})
+				return
+			}
+		}
+		query = query.
+			Joins("JOIN business_line_users ON business_line_users.user_id = users.id").
+			Where("business_line_users.business_line_id = ?", businessLineID)
+	}
+
 	var users []model.User
-	if err := h.db.Where("deleted_at IS NULL").Order("id ASC").Find(&users).Error; err != nil {
+	if err := query.Order("users.id ASC").Find(&users).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}