fix: admin cant view admin_complaint/result_appeal via URL, appeal close also closes parent

backend/routes/tickets.js

@@ -90,6 +90,7 @@ router.get('/:id', authenticate, async (req, res) => {
     FROM tickets t LEFT JOIN users u ON t.user_id = u.id LEFT JOIN users a ON t.assigned_to = a.id WHERE t.id = ?`, [req.params.id]);
   if (!t) return res.status(404).json({ error: '工单不存在' });
   if (req.user.role === 'player' && t.user_id !== req.user.id) return res.status(403).json({ error: '无权查看' });
+  if (req.user.role === 'admin' && (t.is_admin_complaint || t.type === 'result_appeal' || t.type === 'suggestion')) return res.status(403).json({ error: '无权查看' });
   t.responses = await query(`SELECT r.*, u.username, u.role FROM responses r LEFT JOIN users u ON r.user_id = u.id WHERE r.ticket_id = ? ORDER BY r.created_at ASC`, [req.params.id]);
   t.attachments = await query('SELECT * FROM attachments WHERE ticket_id = ?', [req.params.id]);
   t.transfers = await query(`SELECT tf.*, fu.username as from_username, fu.game_name as from_game_name, tu.username as to_username, tu.game_name as to_game_name
@@ -192,7 +193,7 @@ router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res)
   if (req.body.status && req.body.status !== t.status) {
     await query("INSERT INTO responses(ticket_id, user_id, content, is_staff) VALUES (?,?,?,1)", [req.params.id, req.user.id, `状态变更为: ${SL[req.body.status]||req.body.status}`]);
 
-    if (t.type === 'result_appeal' && (req.body.status === 'resolved' || req.body.status === 'rejected')) {
+    if (t.type === 'result_appeal' && (req.body.status === 'resolved' || req.body.status === 'rejected' || req.body.status === 'closed')) {
       await query(`UPDATE tickets SET status = 'closed' WHERE id = ?`, [t.parent_ticket_id]);
       await query("INSERT INTO responses(ticket_id, user_id, content, is_staff) VALUES (?,?,?,1)", [t.parent_ticket_id, req.user.id, `【系统】申诉已处理，原工单已关闭`]);
     }