From 8a431550112a0e757f04cbdb1f872b4086b86ba1 Mon Sep 17 00:00:00 2001
From: dsx137 <70027572+dsx137@users.noreply.github.com>
Date: Tue, 4 Aug 2026 14:23:32 +0800
Subject: [PATCH] fix(core): enforce admin access for queries

---
 internal/rpc/group/group.go | 6 +++++-
 internal/rpc/user/user.go   | 9 ++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/internal/rpc/group/group.go b/internal/rpc/group/group.go
index cc51fdf18..46bd59867 100644
--- a/internal/rpc/group/group.go
+++ b/internal/rpc/group/group.go
@@ -23,9 +23,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/openimsdk/tools/utils/stringutil"
 	"google.golang.org/grpc"
 
+	"github.com/openimsdk/tools/utils/stringutil"
+
 	"github.com/openimsdk/open-im-server/v3/pkg/dbbuild"
 	"github.com/openimsdk/open-im-server/v3/pkg/rpcli"
 
@@ -1315,6 +1316,9 @@ func (g *groupServer) TransferGroupOwner(ctx context.Context, req *pbgroup.Trans
 }
 
 func (g *groupServer) GetGroups(ctx context.Context, req *pbgroup.GetGroupsReq) (*pbgroup.GetGroupsResp, error) {
+	if err := authverify.CheckAdmin(ctx); err != nil {
+		return nil, err
+	}
 	var (
 		group []*model.Group
 		err   error
diff --git a/internal/rpc/user/user.go b/internal/rpc/user/user.go
index 91dfe736e..82a8212bb 100644
--- a/internal/rpc/user/user.go
+++ b/internal/rpc/user/user.go
@@ -22,6 +22,8 @@ import (
 	"sync"
 	"time"
 
+	"google.golang.org/grpc"
+
 	"github.com/openimsdk/open-im-server/v3/internal/rpc/relation"
 	"github.com/openimsdk/open-im-server/v3/pkg/authverify"
 	"github.com/openimsdk/open-im-server/v3/pkg/common/config"
@@ -46,7 +48,6 @@ import (
 	"github.com/openimsdk/tools/discovery"
 	"github.com/openimsdk/tools/errs"
 	"github.com/openimsdk/tools/utils/datautil"
-	"google.golang.org/grpc"
 )
 
 const (
@@ -268,6 +269,9 @@ func (s *userServer) AccountCheck(ctx context.Context, req *pbuser.AccountCheckR
 }
 
 func (s *userServer) GetPaginationUsers(ctx context.Context, req *pbuser.GetPaginationUsersReq) (resp *pbuser.GetPaginationUsersResp, err error) {
+	if err = authverify.CheckAdmin(ctx); err != nil {
+		return nil, err
+	}
 	if req.UserID == "" && req.NickName == "" {
 		total, users, err := s.db.PageFindUser(ctx, constant.IMOrdinaryUser, constant.AppOrdinaryUsers, req.Pagination)
 		if err != nil {
@@ -353,6 +357,9 @@ func (s *userServer) GetGlobalRecvMessageOpt(ctx context.Context, req *pbuser.Ge
 
 // GetAllUserID Get user account by page.
 func (s *userServer) GetAllUserID(ctx context.Context, req *pbuser.GetAllUserIDReq) (resp *pbuser.GetAllUserIDResp, err error) {
+	if err = authverify.CheckAdmin(ctx); err != nil {
+		return nil, err
+	}
 	total, userIDs, err := s.db.GetAllUserID(ctx, req.Pagination)
 	if err != nil {
 		return nil, err