feat(M08-C): 补管理员订单处置与代下单

backend/src/routes/order-management.ts

@@ -91,23 +91,25 @@ export async function registerOrderManagementRoutes(
   ] as const;
 
   for (const [path, schema, execute] of adminActions) {
-    app.post(`/admin-api/orders/:orderId/${path}`, async (request, reply) => {
-      const auth = await authenticate(request.headers.authorization, options);
-      const params = paramsSchema.safeParse(request.params);
-      const body = schema.safeParse(request.body);
-      if (!auth) return unauthorized(reply, request.traceId);
-      if (!params.success || !body.success) return invalid(reply, request.traceId);
-      const actor = {
-        tenantId: auth.tenantId, userId: auth.userId, actorType: 'USER' as const,
-        source: 'ADMIN' as const, traceId: request.traceId, ip: request.ip,
-        userAgent: request.headers['user-agent'] ?? '', access: auth.access
-      };
-      return handle(reply, request.traceId, async () => ({
-        code: 0,
-        data: await execute(actor, params.data.orderId, body.data as never),
-        traceId: request.traceId
-      }));
-    });
+    for (const prefix of ['/admin-api/orders', '/app-api/management/orders']) {
+      app.post(`${prefix}/:orderId/${path}`, async (request, reply) => {
+        const auth = await authenticate(request.headers.authorization, options);
+        const params = paramsSchema.safeParse(request.params);
+        const body = schema.safeParse(request.body);
+        if (!auth) return unauthorized(reply, request.traceId);
+        if (!params.success || !body.success) return invalid(reply, request.traceId);
+        const actor = {
+          tenantId: auth.tenantId, userId: auth.userId, actorType: 'USER' as const,
+          source: 'ADMIN' as const, traceId: request.traceId, ip: request.ip,
+          userAgent: request.headers['user-agent'] ?? '', access: auth.access
+        };
+        return handle(reply, request.traceId, async () => ({
+          code: 0,
+          data: await execute(actor, params.data.orderId, body.data as never),
+          traceId: request.traceId
+        }));
+      });
+    }
   }
 }