diff --git a/src/main/java/com/peanut/modules/book/controller/MyUserController.java b/src/main/java/com/peanut/modules/book/controller/MyUserController.java
index be5058c..db0fd8d 100644
--- a/src/main/java/com/peanut/modules/book/controller/MyUserController.java
+++ b/src/main/java/com/peanut/modules/book/controller/MyUserController.java
@@ -20,6 +20,8 @@ import com.peanut.modules.common.entity.*;
 import com.peanut.modules.common.service.UserContributionService;
 import com.peanut.modules.common.service.UserInviteRegisterService;
 import com.peanut.modules.common.service.UserVipService;
+import com.peanut.modules.sys.entity.SysUserTokenEntity;
+import com.peanut.modules.sys.service.ShiroService;
 import com.peanut.modules.sys.service.SysUserTokenService;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.extern.slf4j.Slf4j;
@@ -51,6 +53,8 @@ public class MyUserController {
     @Autowired
     private SysUserTokenService sysUserTokenService;
     @Autowired
+    private ShiroService shiroService;
+    @Autowired
     private TransactionDetailsService transactionDetailsService;
     @Autowired
     private UserInviteRegisterService inviteRegisterService;
@@ -126,15 +130,27 @@ public class MyUserController {
 
     /**
      * 信息
+     * 通过 token 获取当前用户：管理员可按 id 查询任意用户；其他角色仅可查询自身信息
+     * 说明：/book/user/** 为 anon，需手动解析 token，不能依赖 Shiro principal
      */
     @RequestMapping("/info/{id}")
 //    @RequiresPermissions("book:user:info")
-    public R info(@PathVariable("id") String id){
-		MyUserEntity user = userService.getById(id);
-//        List<CouponHistoryEntity> list = couponHistoryService.getBaseMapper().selectList(new QueryWrapper<CouponHistoryEntity>().eq("member_id", id)
-//                .eq("use_status", 0));
-//        user.setConponsCount(list.size());
-
+    public R info(@PathVariable("id") String id, HttpServletRequest request){
+        String token = request.getHeader("token");
+        if (StringUtils.isEmpty(token)) {
+            return R.error("无权限访问");
+        }
+        SysUserTokenEntity tokenEntity = shiroService.queryByToken(token);
+        if (tokenEntity == null || tokenEntity.getExpireTime() == null
+                || tokenEntity.getExpireTime().getTime() < System.currentTimeMillis()) {
+            return R.error("无权限访问");
+        }
+        Long tokenUserId = tokenEntity.getUserId();
+        // 与 OAuth2Realm 一致：userId < 10000 为后台管理员，可查任意用户；否则仅可查自身
+        if (tokenUserId >= 10000 && !String.valueOf(tokenUserId).equals(id)) {
+            return R.error("无权限访问");
+        }
+        MyUserEntity user = userService.getById(id);
         return R.ok().put("user", user);
     }
 
diff --git a/src/main/java/com/peanut/modules/master/service/impl/InventoryManagementServiceImpl.java b/src/main/java/com/peanut/modules/master/service/impl/InventoryManagementServiceImpl.java
index 3700866..fe6ff83 100644
--- a/src/main/java/com/peanut/modules/master/service/impl/InventoryManagementServiceImpl.java
+++ b/src/main/java/com/peanut/modules/master/service/impl/InventoryManagementServiceImpl.java
@@ -317,7 +317,6 @@ public class InventoryManagementServiceImpl extends ServiceImpl<InvStockRecordDa
         if (relations == null || relations.isEmpty()) {
             return null;
         }
-        Integer componentProductId = null;
         for (ShopProductBookEntity rel : relations) {
             Integer candidateId = rel.getProductId();
             if (candidateId == null) {
@@ -328,19 +327,20 @@ public class InventoryManagementServiceImpl extends ServiceImpl<InvStockRecordDa
                     new LambdaQueryWrapper<ShopProductBookEntity>()
                             .eq(ShopProductBookEntity::getProductId, candidateId)
             );
-            if (bookCount != null && bookCount == 1) {
-                componentProductId = candidateId;
-                break;
+            if (bookCount == null || bookCount != 1) {
+                continue;
+            }
+            ShopProduct product = shopProductDao.selectById(candidateId);
+            if (product == null || (product.getDelFlag() != null && product.getDelFlag() != 0)) {
+                continue;
+            }
+            // 只要纯书/预售书，排除书课组合(07)等
+            String goodsType = product.getGoodsType();
+            if ("02".equals(goodsType) || "03".equals(goodsType)) {
+                return product;
             }
         }
-        if (componentProductId == null) {
-            return null;
-        }
-        ShopProduct product = shopProductDao.selectById(componentProductId);
-        if (product == null || (product.getDelFlag() != null && product.getDelFlag() != 0)) {
-            return null;
-        }
-        return product;
+        return null;
     }
 
     private void validateSetBookComponentStock(List<Integer> bookIds, Integer merchantId, int quantity, Integer setProductId) {