diff --git a/app/controllers/bidding_users_controller.rb b/app/controllers/bidding_users_controller.rb
index ad0de6587..5fbecd885 100644
--- a/app/controllers/bidding_users_controller.rb
+++ b/app/controllers/bidding_users_controller.rb
@@ -9,8 +9,7 @@ class BiddingUsersController < ApplicationController
   end
 
   def win
-    package = current_user.project_packages.find(params[:project_package_id])
-    ProjectPackages::WinBiddingService.call(package, params)
+    ProjectPackages::WinBiddingService.call(current_package, current_user, params)
     render_ok
   rescue ProjectPackages::WinBiddingService::Error => ex
     render_error(ex.message)
diff --git a/app/services/project_packages/win_bidding_service.rb b/app/services/project_packages/win_bidding_service.rb
index 831c29449..54cb1e883 100644
--- a/app/services/project_packages/win_bidding_service.rb
+++ b/app/services/project_packages/win_bidding_service.rb
@@ -1,14 +1,16 @@
 class ProjectPackages::WinBiddingService < ApplicationService
   Error = Class.new(StandardError)
 
-  attr_reader :package, :params
+  attr_reader :package, :user, :params
 
-  def initialize(package, params)
+  def initialize(package, user, params)
     @package = package
+    @user    = user
     @params  = params
   end
 
   def call
+    raise Error, '没有权限' unless package.creator_id == user.id || user.admin_or_business?
     raise Error, '竞标报名还未结束' unless package.bidding_end?
     raise Error, '该状态下不能选择中标者' unless package.may_finish_bidding?