优化，排查项目问题

internal/handler/playback.go

@@ -2,9 +2,11 @@
 package handler
 
 import (
+	"errors"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 
 	"github.com/truewhile/MeBox/internal/middleware"
 	"github.com/truewhile/MeBox/internal/service"
@@ -157,6 +159,25 @@ type playlistItemReq struct {
 	MediaID string `json:"media_id" binding:"required"`
 }
 
+// playlistWriteGuard 校验当前用户对播放列表的写权限（属主或 admin）。
+// 校验失败时已写入错误响应，调用方直接 return。
+func playlistWriteGuard(c *gin.Context, svc *service.Container, playlistID string) (string, bool, bool) {
+	uid, _ := c.Get(middleware.CtxUserID)
+	role, _ := c.Get(middleware.CtxUserRole)
+	isAdmin := role == "admin"
+	if err := svc.Playback.EnsurePlaylistOwner(c.Request.Context(), playlistID, uid.(string), isAdmin); err != nil {
+		if errors.Is(err, service.ErrPlaylistForbidden) {
+			c.JSON(http.StatusForbidden, gin.H{"error": "forbidden"})
+		} else if errors.Is(err, gorm.ErrRecordNotFound) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "playlist not found"})
+		} else {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		}
+		return "", isAdmin, false
+	}
+	return uid.(string), isAdmin, true
+}
+
 func addPlaylistItemHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var req playlistItemReq
@@ -164,8 +185,12 @@ func addPlaylistItemHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		uid, isAdmin, ok := playlistWriteGuard(c, svc, c.Param("id"))
+		if !ok {
+			return
+		}
 		if err := svc.Playback.AddToPlaylist(
-			c.Request.Context(), c.Param("id"), req.MediaID,
+			c.Request.Context(), c.Param("id"), uid, req.MediaID, isAdmin,
 		); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
@@ -176,8 +201,12 @@ func addPlaylistItemHandler(svc *service.Container) gin.HandlerFunc {
 
 func removePlaylistItemHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		uid, isAdmin, ok := playlistWriteGuard(c, svc, c.Param("id"))
+		if !ok {
+			return
+		}
 		if err := svc.Playback.RemoveFromPlaylist(
-			c.Request.Context(), c.Param("id"), c.Param("media_id"),
+			c.Request.Context(), c.Param("id"), uid, c.Param("media_id"), isAdmin,
 		); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
@@ -188,8 +217,12 @@ func removePlaylistItemHandler(svc *service.Container) gin.HandlerFunc {
 
 func deletePlaylistHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		uid, isAdmin, ok := playlistWriteGuard(c, svc, c.Param("id"))
+		if !ok {
+			return
+		}
 		if err := svc.Playback.DeletePlaylist(
-			c.Request.Context(), c.Param("id"),
+			c.Request.Context(), c.Param("id"), uid, isAdmin,
 		); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return