fix 泄露账号信息

netflix-service/src/main/java/com/cyksj/service/order/impl/OrderDonServiceImpl.java

@@ -1701,6 +1701,11 @@ public class OrderDonServiceImpl extends ServiceImpl<OrderDonMapper, OrderDon> i
 				? Collections.emptyList()
 				: (multiQuantity ? List.of(orderDon.getUserId())
 				: userBindRelationService.getRelationUserIdList(userId, null));
+		// 下单锁位即绑定用户，不能把车票归属当作已付款凭证。
+		// 在任何交付信息查询之前拦截，同时覆盖多件订单的 tickets 返回路径。
+		if (!canExposeOrderCredentials(orderDon.getStatus())) {
+			return detail;
+		}
 		if (multiQuantity) {
 			List<MultiQuantityOrderTicketView> tickets = orderDonTicketQueryMapper.selectOrderTicketViews(orderId, userIdList);
 			if (CollUtil.isNotEmpty(tickets)) {
@@ -1733,6 +1738,13 @@ public class OrderDonServiceImpl extends ServiceImpl<OrderDonMapper, OrderDon> i
 		return detail;
 	}
 
+	static boolean canExposeOrderCredentials(OrderDon.Status status) {
+		return status == OrderDon.Status.hasPayment
+				|| status == OrderDon.Status.transport
+				|| status == OrderDon.Status.received
+				|| status == OrderDon.Status.complete;
+	}
+
 	static boolean isMultiQuantityOrderOwner(OrderDon orderDon, Long userId) {
 		return orderDon != null && userId != null && userId.equals(orderDon.getUserId());
 	}