bsm-infra/full
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix version 1

Browse Source
This commit is contained in:
yanweidong
2026-09-22 21:15:34 +08:00
parent 9f86366638
commit d63d7e8b3a
277 changed files with 9959 additions and 1514 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
module/ec/address/internal/logic/library/create.go
View File

@@ -12,6 +12,7 @@ import (
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"git.apinb.com/bsm-sdk/core/utils"
"gorm.io/gorm"
)
// 新增地址
@@ -38,11 +39,15 @@ func Create(ctx context.Context, in *pb.AddressCreateRequest) (reply *pb.StatusR
address.OwnerIdentity = auth.Identity
address.Status = int8(in.Status)
if address.Status == 2 {
impl.DBService.Model(&models.AddressLibrary{}).Where("owner_id = ? and status=2", auth.ID).UpdateColumn("status", "1")
}
err = impl.DBService.Create(address).Error
// 取消旧默认与写入新默认放在同一事务，保证任一时刻只有一个默认地址
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
if address.Status == 2 {
if err := tx.Model(&models.AddressLibrary{}).Where("owner_id = ? and status = 2", auth.ID).UpdateColumn("status", 1).Error; err != nil {
return err
}
}
return tx.Create(address).Error
})
if err != nil {
printer.Error(err.Error())

5
module/ec/address/internal/logic/library/delete.go
View File

@@ -16,12 +16,13 @@ import (
// 删除一个地址
func Delete(ctx context.Context, in *pb.AddressDeleteRequest) (reply *pb.StatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
err = impl.DBService.Delete(&models.AddressLibrary{}, "id in ?", in.Id).Error
// 删除必须限定归属，避免越权删除他人地址
err = impl.DBService.Where("id in ? and owner_identity = ?", in.Id, auth.Identity).Delete(&models.AddressLibrary{}).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB

4
module/ec/address/internal/logic/library/fetch.go
View File

@@ -35,9 +35,7 @@ func Fetch(ctx context.Context, in *pb.IdentRequest) (reply *pb.AddressListReply
result = append(result, ReflectProtoAddress(item))
}
// TODO: add your logic code & delete this line.
return
return &pb.AddressListReply{Data: result}, nil
}
func ReflectProtoAddress(v *models.AddressLibrary) *pb.AddressItem {

5
module/ec/address/internal/logic/library/get.go
View File

@@ -16,7 +16,7 @@ import (
// 获取一条地址
func Get(ctx context.Context, in *pb.IdentRequest) (reply *pb.AddressItem, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
@@ -26,7 +26,8 @@ func Get(ctx context.Context, in *pb.IdentRequest) (reply *pb.AddressItem, err e
}
address := new(models.AddressLibrary)
err = impl.DBService.Where("id=?", in.Id).First(&address).Error
// 查询必须限定归属，避免越权读取他人地址
err = impl.DBService.Where("id=? and owner_identity=?", in.Id, auth.Identity).First(&address).Error
if err != nil {
if errors.Is(err, models.ErrNotFound) {

24
module/ec/address/internal/logic/library/modify.go
View File

@@ -2,6 +2,7 @@ package library
import (
"context"
"errors"
"time"
"bsm/full/module/ec/address/internal/impl"
@@ -11,6 +12,7 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"gorm.io/gorm"
)
// 修改地址
@@ -32,12 +34,24 @@ func Modify(ctx context.Context, in *pb.AddressItem) (reply *pb.StatusReply, err
}
address.Status = int8(in.Status)
if address.Status == 2 {
impl.DBService.Model(&models.AddressLibrary{}).Where("owner_id = ? and status=2", auth.ID).UpdateColumn("status", "1")
}
err = impl.DBService.Where("id=?", in.Id).Updates(&address).Error
// 归属校验与默认地址重置放入同一事务：先按 id + owner 更新目标行，再取消该用户其它默认地址
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
res := tx.Model(&models.AddressLibrary{}).Where("id=? and owner_identity=?", in.Id, auth.Identity).Updates(&address)
if res.Error != nil {
return res.Error
}
if res.RowsAffected == 0 {
return models.ErrNotFound
}
if address.Status == 2 {
return tx.Model(&models.AddressLibrary{}).Where("owner_id = ? and status = 2 and id <> ?", auth.ID, in.Id).UpdateColumn("status", 1).Error
}
return nil
})
if err != nil {
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrRecordNotFound
}
printer.Error(err.Error())
return nil, errcode.ErrDB
}

16
module/ec/address/internal/server/new.go
View File

@@ -5,11 +5,25 @@ import (
pb "bsm/full/module/ec/address/pb"
"context"
"git.apinb.com/bsm-sdk/core/printer"
gwRuntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/reflection"
"google.golang.org/grpc/status"
)
// recoverUnaryInterceptor 捕获处理过程中的 panic，转为 Internal 错误返回，避免进程崩溃。
func recoverUnaryInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp any, err error) {
defer func() {
if r := recover(); r != nil {
printer.Error("grpc panic recovered: %v", r)
err = status.Error(codes.Internal, "internal server error")
}
}()
return handler(ctx, req)
}
type Server struct {
Grpc *grpc.Server
Ctx context.Context
@@ -20,7 +34,7 @@ type Server struct {
func New(grpcServ *grpc.Server) *Server {
standalone := grpcServ == nil
if standalone {
grpcServ = grpc.NewServer()
grpcServ = grpc.NewServer(grpc.UnaryInterceptor(recoverUnaryInterceptor))
}
srv := &Server{

2
module/ec/mall/go.mod
View File

@@ -15,6 +15,7 @@ require (
git.apinb.com/bsm-sdk/core v0.2.1
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
github.com/patrickmn/go-cache v2.1.0+incompatible
github.com/redis/go-redis/v9 v9.22.0
go.etcd.io/etcd/client/v3 v3.7.1
golang.org/x/crypto v0.57.0
google.golang.org/grpc v1.84.0
@@ -40,7 +41,6 @@ require (
github.com/jinzhu/inflection v1.0.0 // indirect
github.com/jinzhu/now v1.1.5 // indirect
github.com/oklog/ulid/v2 v2.1.2 // indirect
github.com/redis/go-redis/v9 v9.22.0 // indirect
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e // indirect
go.etcd.io/etcd/api/v3 v3.7.1 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.7.1 // indirect

19
module/ec/mall/internal/logic/ads/delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除广告
func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallAds{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的广告
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallAds{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/ads/modify.go
View File

@@ -16,7 +16,7 @@ import (
// 修改广告
func Modify(ctx context.Context, in *pb.AdsItem) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -26,6 +26,13 @@ func Modify(ctx context.Context, in *pb.AdsItem) (reply *pb.IdentityStatusReply,
return nil, errcode.ErrInvalidArgument
}
// 只能修改当前登录者所属店铺的广告
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
data := models.MallAds{
Title: in.Title,
PosKey: in.PosKey,
@@ -35,11 +42,15 @@ func Modify(ctx context.Context, in *pb.AdsItem) (reply *pb.IdentityStatusReply,
Std_IICUDS: types.Std_IICUDS{Status: int8(in.GetStatus())},
}
err = impl.DBService.Select("title", "pos_key", "content", "type", "to_url").Where("id=?", in.GetId()).Updates(&data).Error
if err != nil {
printer.Error(err.Error())
tx := impl.DBService.Select("title", "pos_key", "content", "type", "to_url").
Where("id=?", in.GetId()).Where("store_identity = ?", storeIdentity).Updates(&data)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/category/delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除分类
func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallCategory{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的分类
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallCategory{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/category/modify.go
View File

@@ -13,7 +13,7 @@ import (
// 修改分类
func Modify(ctx context.Context, in *pb.CategoryItem) (reply *pb.IdentityStatusReply, err error) {
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -22,16 +22,27 @@ func Modify(ctx context.Context, in *pb.CategoryItem) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
// 只能修改当前登录者所属店铺的分类
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
data, err := ref(in)
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrInternal
}
err = impl.DBService.Select("title", "en_title", "parent_id", "paths", "intro", "icon", "sort", "status", "keys").Where("identity=?", in.GetIdentity()).Updates(&data).Error
if err != nil {
printer.Error(err.Error())
tx := impl.DBService.Select("title", "en_title", "parent_id", "paths", "intro", "icon", "sort", "status", "keys").
Where("identity=?", in.GetIdentity()).Where("store_identity = ?", storeIdentity).Updates(&data)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Identity: in.Identity,

11
module/ec/mall/internal/logic/freight/create.go
View File

@@ -2,7 +2,6 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -21,12 +20,6 @@ func Create(ctx context.Context, in *pb.FreightItem) (reply *pb.IdentityStatusRe
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().Unix(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

11
module/ec/mall/internal/logic/freight/delete.go
View File

@@ -2,7 +2,6 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -22,12 +21,6 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().UnixNano(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

11
module/ec/mall/internal/logic/freight/deny_region_create.go
View File

@@ -2,7 +2,6 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -21,12 +20,6 @@ func DenyRegionCreate(ctx context.Context, in *pb.DenyRegionItem) (reply *pb.Ide
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().Unix(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

14
module/ec/mall/internal/logic/freight/deny_region_delete.go
View File

@@ -1,11 +1,11 @@
package freight
import (
pb "bsm/full/module/ec/mall/pb"
"context"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
"time"
)
// 移除限制区域
@@ -21,12 +21,6 @@ func DenyRegionDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.Ident
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().UnixNano(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

6
module/ec/mall/internal/logic/freight/deny_region_fetch.go
View File

@@ -4,6 +4,7 @@ import (
"context"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -22,7 +23,6 @@ func DenyRegionFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.De
in.PageSize = 50
}
// TODO: add your logic code & delete this line.
return
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

14
module/ec/mall/internal/logic/freight/deny_region_modify.go
View File

@@ -2,9 +2,9 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -16,14 +16,6 @@ func DenyRegionModify(ctx context.Context, in *pb.DenyRegionItem) (reply *pb.Ide
return nil, err
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().Unix(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

13
module/ec/mall/internal/logic/freight/deny_region_remove.go
View File

@@ -2,14 +2,14 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
// RemoveRegion 移除限制区域
// DenyRegionRemove 移除禁运区域
// 说明：该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
func DenyRegionRemove(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
@@ -22,12 +22,5 @@ func DenyRegionRemove(ctx context.Context, in *pb.IdentRequest) (reply *pb.Ident
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().Unix(),
}, nil
return nil, errcode.ErrUnimplemented
}

5
module/ec/mall/internal/logic/freight/detail.go
View File

@@ -21,7 +21,6 @@ func Detail(ctx context.Context, in *pb.IdentRequest) (reply *pb.FreightItem, er
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

6
module/ec/mall/internal/logic/freight/fetch.go
View File

@@ -4,6 +4,7 @@ import (
"context"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -23,7 +24,6 @@ func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.FreightReply
in.PageSize = 50
}
// TODO: add your logic code & delete this line.
return
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

11
module/ec/mall/internal/logic/freight/modify.go
View File

@@ -2,7 +2,6 @@ package freight
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -21,12 +20,6 @@ func Modify(ctx context.Context, in *pb.FreightItem) (reply *pb.IdentityStatusRe
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().UnixMilli(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

19
module/ec/mall/internal/logic/freight/remove.go
View File

@@ -15,7 +15,7 @@ import (
// FreightRemove 运费模板删除
func Remove(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func Remove(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallFreight{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的运费模板（运费表归属字段为 owner_identity）
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("owner_identity = ?", storeIdentity).Delete(&models.MallFreight{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/notice/delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除公告
func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallNotice{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的公告
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallNotice{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

21
module/ec/mall/internal/logic/notice/modify.go
View File

@@ -16,7 +16,7 @@ import (
// 修改公告
func Modify(ctx context.Context, in *pb.NoticeItem) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -24,18 +24,29 @@ func Modify(ctx context.Context, in *pb.NoticeItem) (reply *pb.IdentityStatusRep
if in.GetTitle() == "" {
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
// 只能修改当前登录者所属店铺的公告
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
data := models.MallNotice{
Title: in.Title,
Author: in.Author,
Content: in.Content,
Std_IICUDS: types.Std_IICUDS{Status: int8(in.GetStatus())},
}
err = impl.DBService.Model(&models.MallNotice{}).Select("title", "author", "content").Where("identity = ?", in.Identity).Updates(&data).Error
if err != nil {
printer.Error(err.Error())
tx := impl.DBService.Model(&models.MallNotice{}).Select("title", "author", "content").
Where("identity = ?", in.Identity).Where("store_identity = ?", storeIdentity).Updates(&data)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

21
module/ec/mall/internal/logic/product/item_batch_op.go
View File

@@ -15,7 +15,7 @@ import (
// Forbidden 批量操作
func ItemBatchOp(ctx context.Context, in *pb.OpRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -23,12 +23,23 @@ func ItemBatchOp(ctx context.Context, in *pb.OpRequest) (reply *pb.IdentityStatu
if len(in.GetIdentity()) == 0 {
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
err = impl.DBService.Model(&models.MallProduct{}).Where("identity in ?", in.Identity).Update("status", in.Status).Error
if err != nil {
printer.Error(err.Error())
// 只能批量操作当前登录者所属店铺的商品
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Model(&models.MallProduct{}).Where("identity in ?", in.Identity).
Where("store_identity = ?", storeIdentity).Update("status", in.Status)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/product/item_delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除产品
func ItemDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func ItemDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentitySta
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallProduct{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的商品
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallProduct{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

15
module/ec/mall/internal/logic/product/item_detail.go
View File

@@ -8,6 +8,7 @@ import (
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// Detail 获取产品详情
@@ -42,5 +43,19 @@ func ItemDetail(ctx context.Context, in *pb.IdentRequest) (reply *pb.ProductItem
for _, v := range data.Specs {
reply.SpecId = append(reply.SpecId, int64(v.SpecId))
}
// 成本类价格（进货价/代理价）仅店铺内部可见：匿名或非本店调用者不下发。
callerStore := ""
if auth, e := service.ParseMetaCtx(ctx, nil); e == nil && auth != nil {
if owner, ok := auth.Owner.(map[string]any); ok {
callerStore, _ = owner["store_identity"].(string)
}
}
if callerStore == "" || callerStore != data.Store_Identity {
for _, s := range reply.Specification {
s.PurchasingPrice = 0
s.Wholesale = 0
}
}
return reply, nil
}

2
module/ec/mall/internal/logic/product/item_detail_by_serial.go
View File

@@ -19,7 +19,7 @@ func ItemDetailBySerial(ctx context.Context, in *pb.StoreSerialRequest) (reply *
}
data := make([]*models.MallProduct, 0)
err = impl.DBService.Preload("Spec").Preload("Images").Preload("Category").Where("store_identity=? and serial_id in ?", in.StoreIdentity, in.SerialId).Find(&data).Error
err = impl.DBService.Preload("Specs.Spec").Preload("Images").Preload("Categories.Category").Where("store_identity=? and serial_id in ?", in.StoreIdentity, in.SerialId).Find(&data).Error
if err != nil {
if errors.Is(err, gorm.ErrRecordNotFound) {

7
module/ec/mall/internal/logic/product/item_detail_by_spec.go
View File

@@ -13,9 +13,6 @@ func ItemDetailBySpec(ctx context.Context, in *pb.DetailBySpecRequest) (reply *p
return nil, errcode.ErrInvalidArgument
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

22
module/ec/mall/internal/logic/product/item_fetch.go
View File

@@ -25,7 +25,6 @@ func ItemFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.ListRepl
params = map[string]string{
"mall_product.store_identity": in.GetStoreIdentity(),
}
idList = make([]uint, 0)
product []*models.MallProduct
)
@@ -39,16 +38,10 @@ func ItemFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.ListRepl
offset = (pageNo - 1) * pageSize
}
if err := impl.DBService.Model(&models.MallProduct{}).Where(params).Preload("Images").Preload("Specs.Spec").Preload("Categories.Category").
Order("created_at desc").Count(&cnt).Offset(int(offset)).Limit(int(pageSize)).Find(&product).Error; err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
}
tx := impl.DBService.Model(&models.MallProduct{})
// 根据传入的分类id进行过滤
if len(in.GetCategoryId()) != 0 {
tx = tx.Where("product_category.category_id in ?", idList).
tx = tx.Where("product_category.category_id in ?", in.GetCategoryId()).
Joins("left join product_category on mall_product.id = product_category.product_id").
Joins("left join mall_category on mall_category.id = product_category.category_id")
}
@@ -56,11 +49,18 @@ func ItemFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.ListRepl
if in.GetKeyword() != "" {
tx = tx.Where("mall_product.title like ?", "%"+in.GetKeyword()+"%")
}
// 根据传入的价格区间进行价格过滤
// 根据传入的价格区间进行价格过滤（分别支持只传最小值、只传最大值与两者都传）
if in.GetMinPrice() != 0 || in.GetMaxPrice() != 0 {
tx = tx.Joins("left join product_spec on product_spec.product_id = mall_product.id").
Joins("left join mall_product_spec on mall_product_spec.id = product_spec.spec_id").
Where("mall_product_spec.price between ? and ?", in.GetMinPrice(), in.GetMaxPrice())
Joins("left join mall_product_spec on mall_product_spec.id = product_spec.spec_id")
switch {
case in.GetMinPrice() != 0 && in.GetMaxPrice() != 0:
tx = tx.Where("mall_product_spec.price between ? and ?", in.GetMinPrice(), in.GetMaxPrice())
case in.GetMinPrice() != 0:
tx = tx.Where("mall_product_spec.price >= ?", in.GetMinPrice())
default:
tx = tx.Where("mall_product_spec.price <= ?", in.GetMaxPrice())
}
}
// 根据传入sort排序

19
module/ec/mall/internal/logic/product/item_modify.go
View File

@@ -15,7 +15,7 @@ import (
// Modify 发布/取消发布 产品
func ItemModify(ctx context.Context, in *pb.ModifyRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func ItemModify(ctx context.Context, in *pb.ModifyRequest) (reply *pb.IdentitySt
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
if err := impl.DBService.Model(&models.MallProduct{}).Where("identity = ?", in.Identity).Update("status", in.Status).Error; err != nil {
printer.Error(err.Error())
// 只能修改当前登录者所属店铺的商品
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Model(&models.MallProduct{}).Where("identity = ?", in.Identity).
Where("store_identity = ?", storeIdentity).Update("status", in.Status)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",

9
module/ec/mall/internal/logic/product/photo_create.go
View File

@@ -33,9 +33,12 @@ func PhotoCreate(ctx context.Context, in *pb.PhotoItem) (reply *pb.IdentityStatu
}
photo.Identity = utils.UUID()
tx := impl.DBService.Create(&photo)
cnt, err := tx.RowsAffected, tx.Error
if cnt == 0 || err != nil {
printer.Error(err.Error())
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
printer.Error("添加产品图片失败: 未写入任何记录")
return nil, errcode.ErrDB
}

20
module/ec/mall/internal/logic/product/photo_delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除产品图片
func PhotoDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,23 @@ func PhotoDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentitySt
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallProductPhotos{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺商品的图片（图片表无店铺字段，按所属商品归属判定）
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("product_identity in (?)", impl.DBService.Model(&models.MallProduct{}).Select("identity").Where("store_identity = ?", storeIdentity)).
Delete(&models.MallProductPhotos{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
// TODO: add your logic code & delete this line.

22
module/ec/mall/internal/logic/product/spec_create.go
View File

@@ -16,7 +16,7 @@ import (
// CreateSpec 添加产品规格
func SpecCreate(ctx context.Context, in *pb.SpecItem) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -27,16 +27,27 @@ func SpecCreate(ctx context.Context, in *pb.SpecItem) (reply *pb.IdentityStatusR
return nil, err
}
// 规格归属以 token 中的店铺为准，不采信请求参数
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
// 数据组装
data, err := requestToModelSpec(in)
if err != nil {
return nil, err
}
data.Identity = utils.UUID()
data.StoreIdentity = storeIdentity
tx := impl.DBService.Create(data)
cnt, err := tx.RowsAffected, tx.Error
if cnt == 0 || err != nil {
printer.Error(err.Error())
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
printer.Error("创建产品规格失败: 未写入任何记录")
return nil, errcode.ErrDB
}
@@ -93,9 +104,6 @@ func requestToModelSpec(in *pb.SpecItem) (*models.MallProductSpec, error) {
PurchasingPrice: in.PurchasingPrice,
Wholesale: in.Wholesale,
}
if in.StockType != 2 {
specification.Stock = int64(in.StockType)
}
if in.TpType != 2 {
specification.TpType = in.TpType
}

20
module/ec/mall/internal/logic/product/spec_delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除产品规格
func SpecDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,12 +25,22 @@ func SpecDelete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentitySta
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallProductSpec{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的规格
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallProductSpec{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
// TODO: add your logic code & delete this line.
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

18
module/ec/mall/internal/logic/product/spec_detail.go
View File

@@ -8,6 +8,7 @@ import (
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// DetailSpec 产品详情
@@ -23,7 +24,7 @@ func SpecDetail(ctx context.Context, in *pb.IdentRequest) (reply *pb.SpecItem, e
printer.Error(err.Error())
return nil, errcode.ErrDB
}
return &pb.SpecItem{
reply = &pb.SpecItem{
Id: int64(data.ID),
Identity: data.Identity,
SupplyId: data.SupplyId,
@@ -37,5 +38,18 @@ func SpecDetail(ctx context.Context, in *pb.IdentRequest) (reply *pb.SpecItem, e
Img: data.Img,
PurchasingPrice: data.PurchasingPrice,
Wholesale: data.Wholesale,
}, nil
}
// 成本类价格（进货价/代理价）仅店铺内部可见：匿名或非本店调用者不下发。
callerStore := ""
if auth, e := service.ParseMetaCtx(ctx, nil); e == nil && auth != nil {
if owner, ok := auth.Owner.(map[string]any); ok {
callerStore, _ = owner["store_identity"].(string)
}
}
if callerStore == "" || callerStore != data.StoreIdentity {
reply.PurchasingPrice = 0
reply.Wholesale = 0
}
return reply, nil
}

11
module/ec/mall/internal/logic/product/spec_fetch.go
View File

@@ -14,7 +14,7 @@ import (
// 产品规格列表
func SpecFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.SpecReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -23,8 +23,15 @@ func SpecFetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.SpecRepl
return nil, errcode.ErrInvalidArgument
}
// 只能查询当前登录者所属店铺的规格
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" || storeIdentity != in.StoreIdentity {
return nil, errcode.ErrPermissionDenied
}
spec := make([]*models.MallProductSpec, 0)
tx := impl.DBService.Model(&models.MallProductSpec{}).Where("store_identity = ?", in.StoreIdentity)
tx := impl.DBService.Model(&models.MallProductSpec{}).Where("store_identity = ?", storeIdentity)
if in.Keyword != "" {
tx = tx.Where("keyword like ?", "%"+in.Keyword+"%")
}

19
module/ec/mall/internal/logic/product/spec_modify.go
View File

@@ -14,7 +14,7 @@ import (
// ModifySpec 修改产品规格
func SpecModify(ctx context.Context, in *pb.SpecItem) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -26,16 +26,27 @@ func SpecModify(ctx context.Context, in *pb.SpecItem) (reply *pb.IdentityStatusR
}
// 只能修改当前登录者所属店铺的规格，规格归属以 token 中的店铺为准
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
// 数据组装
data, err := requestToModelSpec(in)
if err != nil {
return nil, err
}
err = impl.DBService.Where("identity=?", data.Identity).Updates(data).Error
if err != nil {
printer.Error(err.Error())
data.StoreIdentity = storeIdentity
tx := impl.DBService.Where("identity=?", data.Identity).Where("store_identity = ?", storeIdentity).Updates(data)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/staff/delete.go
View File

@@ -15,7 +15,7 @@ import (
// 删除工作人员
func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -25,11 +25,22 @@ func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusR
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Delete(&models.MallStaff{}).Error
if err != nil {
printer.Error(err.Error())
// 只能删除当前登录者所属店铺的员工
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("store_identity = ?", storeIdentity).Delete(&models.MallStaff{})
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

18
module/ec/mall/internal/logic/staff/fetch.go
View File

@@ -9,15 +9,23 @@ import (
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// 获取工作人员列表
func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListReply, err error) {
// parse authorization meta.
// _, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
// if err != nil {
// return nil, err
// }
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
// 仅可查询当前登录者所属店铺的员工，店铺取自 token，不采信请求参数
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" {
return nil, errcode.ErrPermissionDenied
}
var (
cnt int64 = 0
@@ -25,7 +33,7 @@ func Fetch(ctx context.Context, in *pb.MallFetchRequest) (reply *pb.StaffListRep
pageSize int64 = in.GetPageSize()
offset int64 = (pageNo - 1) * pageSize
params = map[string]string{
"store_identity": in.GetStoreIdentity(),
"store_identity": storeIdentity,
}
)

27
module/ec/mall/internal/logic/staff/login.go
View File

@@ -16,9 +16,13 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/vars"
"github.com/redis/go-redis/v9"
"gorm.io/gorm"
)
// 短信验证码在 Redis 中的 key 前缀，与 sender 模块保持一致：前缀 + 手机号
const smsCodeKeyPrefix = "/SMS/Code/"
// Login 员工登录验证
func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err error) {
var record models.MallStaff
@@ -47,7 +51,27 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
return nil, errcode.ErrInvalidArgument
}
err := impl.DBService.Where("phone = ?", in.Phone).First(&record).Error
// 校验短信验证码，key 规则与 sender 模块一致：/SMS/Code/ + 手机号
smsKey := smsCodeKeyPrefix + in.Phone
storedCode, codeErr := impl.RedisService.Client.Get(impl.RedisService.Ctx, smsKey).Result()
if codeErr != nil {
if errors.Is(codeErr, redis.Nil) {
printer.Error("验证码已过期或不存在: phone=%s", in.Phone)
return nil, errcode.ErrInvalidArgument
}
printer.Error(codeErr.Error())
return nil, errcode.ErrInternal
}
if storedCode != in.VerifyCode {
printer.Error("验证码不正确: phone=%s", in.Phone)
return nil, errcode.ErrInvalidArgument
}
// 校验成功后立即删除，避免同一验证码被重放
if err := impl.RedisService.Client.Del(impl.RedisService.Ctx, smsKey).Err(); err != nil {
printer.Error("清除验证码缓存异常: %v", err)
}
err = impl.DBService.Where("phone = ?", in.Phone).First(&record).Error
if err != nil {
if errors.Is(err, gorm.ErrRecordNotFound) {
return nil, errcode.ErrAccountNotFound
@@ -55,7 +79,6 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
printer.Error(err.Error())
return nil, errcode.ErrDB
}
// TODO: 添加验证码校验逻辑
default:
return nil, errcode.ErrUnimplemented

14
module/ec/mall/internal/logic/store/apply_join.go
View File

@@ -2,9 +2,9 @@ package store
import (
"context"
"time"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -16,14 +16,6 @@ func ApplyJoin(ctx context.Context, in *pb.ApplyJoinRequest) (reply *pb.Identity
return nil, err
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().UnixMilli(),
}, nil
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

16
module/ec/mall/internal/logic/store/get_email.go
View File

@@ -12,7 +12,7 @@ import (
// 获取邮件服务器配置
func GetEmail(ctx context.Context, in *pb.IdentRequest) (reply *pb.ConfigsReply, err error) {
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -21,11 +21,21 @@ func GetEmail(ctx context.Context, in *pb.IdentRequest) (reply *pb.ConfigsReply,
return nil, errcode.ErrInvalidArgument
}
// 只能读取当前登录者所属店铺的配置
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
sotre := models.MallStore{}
if err := impl.DBService.Model(&models.MallStore{}).Select("mail_configs").Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Find(&sotre).Error; err != nil {
print(err.Error())
tx := impl.DBService.Model(&models.MallStore{}).Select("mail_configs").
Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("identity = ?", storeIdentity).Find(&sotre)
if tx.Error != nil {
print(tx.Error.Error())
return nil, errcode.ErrDB
}
if storeIdentity == "" || tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.ConfigsReply{
Configs: sotre.MailConfigs,

16
module/ec/mall/internal/logic/store/get_payment.go
View File

@@ -13,7 +13,7 @@ import (
// 获取支付方式配置
func GetPayment(ctx context.Context, in *pb.IdentRequest) (reply *pb.ConfigsReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -22,11 +22,21 @@ func GetPayment(ctx context.Context, in *pb.IdentRequest) (reply *pb.ConfigsRepl
return nil, errcode.ErrInvalidArgument
}
// 只能读取当前登录者所属店铺的配置
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
sotre := models.MallStore{}
if err := impl.DBService.Model(&models.MallStore{}).Select("pay_configs").Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Find(&sotre).Error; err != nil {
print(err.Error())
tx := impl.DBService.Model(&models.MallStore{}).Select("pay_configs").
Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("identity = ?", storeIdentity).Find(&sotre)
if tx.Error != nil {
print(tx.Error.Error())
return nil, errcode.ErrDB
}
if storeIdentity == "" || tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.ConfigsReply{Configs: sotre.PayConfigs}, nil

22
module/ec/mall/internal/logic/store/get_setting.go
View File

@@ -8,20 +8,36 @@ import (
"bsm/full/module/ec/mall/internal/models"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
// 获取店铺基础配置
func GetSetting(ctx context.Context, in *pb.IdentRequest) (reply *pb.StoreBasic, err error) {
// parse authorization meta.
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
// valildate request id,identity.
if in.Id == 0 && in.Identity == "" {
return nil, errcode.ErrInvalidArgument
}
// 只能读取当前登录者所属店铺的配置
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
var data models.MallStore
if err := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).First(&data).Error; err != nil {
print(err.Error())
tx := impl.DBService.Where("id=? or identity=?", in.GetId(), in.GetIdentity()).
Where("identity = ?", storeIdentity).Find(&data)
if tx.Error != nil {
print(tx.Error.Error())
return nil, errcode.ErrDB
}
// TODO: add your logic code & delete this line.
if storeIdentity == "" || tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.StoreBasic{
Id: int64(data.ID),

16
module/ec/mall/internal/logic/store/licensing.go
View File

@@ -9,10 +9,17 @@ import (
"bsm/full/module/ec/mall/internal/models"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
// 店铺许可授权
func Licensing(ctx context.Context, in *pb.LicensingRequest) (reply *pb.IdentityStatusReply, err error) {
// 要求调用者已登录，避免仅凭子域名匿名枚举店铺标识。
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
var identity string
licenseType := strings.ToUpper(in.GetLicenseType())
@@ -22,12 +29,17 @@ func Licensing(ctx context.Context, in *pb.LicensingRequest) (reply *pb.Identity
default:
return nil, errcode.ErrInvalidArgument
}
// TODO: valid code
if identity == "" {
return nil, errcode.ErrNotFound(404, "store not found")
}
// TODO: add your logic code & delete this line.
// 归属校验：调用者只能是该店铺的成员，避免店铺标识被枚举获取。
// 说明：完整许可码校验（in.License/in.LicenseType）需要许可数据源，当前仓库内不存在，暂无法实现。
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" || storeIdentity != identity {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

8
module/ec/mall/internal/logic/store/mini_code.go
View File

@@ -4,6 +4,7 @@ import (
"context"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -15,9 +16,6 @@ func MiniCode(ctx context.Context, in *pb.MiniCodeRequest) (reply *pb.MiniCodeRe
return nil, err
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return
// 该接口尚未实现，显式返回未实现错误，避免调用方误判成功。
return nil, errcode.ErrUnimplemented
}

2
module/ec/mall/internal/logic/store/search.go
View File

@@ -36,7 +36,7 @@ func Search(ctx context.Context, in *pb.MallSearchRequest) (reply *pb.MallSearch
offset = (pageNo - 1) * pageSize
}
var data []*models.MallStore
if err := impl.DBService.Model(&models.MallStore{}).Where("keyword = ?", in.GetKeyword()).Order("created_at desc").Count(&cnt).
if err := impl.DBService.Model(&models.MallStore{}).Where("keywords like ?", "%"+in.GetKeyword()+"%").Order("created_at desc").Count(&cnt).
Offset(int(offset)).Limit(int(pageSize)).Find(&data).Error; err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB

17
module/ec/mall/internal/logic/store/set_email.go
View File

@@ -14,7 +14,7 @@ import (
// 设置邮件服务器配置
func SetEmail(ctx context.Context, in *pb.SettingRequest) (reply *pb.IdentityStatusReply, err error) {
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -23,10 +23,21 @@ func SetEmail(ctx context.Context, in *pb.SettingRequest) (reply *pb.IdentitySta
return nil, errcode.ErrInvalidArgument
}
if err := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", in.GetIdentity()).Update("mail_configs", in.GetConfigs()).Error; err != nil {
printer.Error(err.Error())
// 只能修改当前登录者所属店铺的配置
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" || in.GetIdentity() != storeIdentity {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", in.GetIdentity()).Update("mail_configs", in.GetConfigs())
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

17
module/ec/mall/internal/logic/store/set_payment.go
View File

@@ -14,7 +14,7 @@ import (
// 设置支付方式配置
func SetPayment(ctx context.Context, in *pb.SettingRequest) (reply *pb.IdentityStatusReply, err error) {
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -23,10 +23,21 @@ func SetPayment(ctx context.Context, in *pb.SettingRequest) (reply *pb.IdentityS
return nil, errcode.ErrInvalidArgument
}
if err := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", in.GetIdentity()).Update("pay_configs", in.GetConfigs()).Error; err != nil {
printer.Error(err.Error())
// 只能修改当前登录者所属店铺的配置
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" || in.GetIdentity() != storeIdentity {
return nil, errcode.ErrPermissionDenied
}
tx := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", in.GetIdentity()).Update("pay_configs", in.GetConfigs())
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
return &pb.IdentityStatusReply{
Code: 0,

19
module/ec/mall/internal/logic/store/set_setting.go
View File

@@ -8,13 +8,14 @@ import (
"bsm/full/module/ec/mall/internal/models"
pb "bsm/full/module/ec/mall/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// 设置店铺基础配置
func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
@@ -22,6 +23,13 @@ func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatu
return nil, errcode.ErrInvalidArgument
}
// 只能修改当前登录者所属店铺的配置，禁止凭请求参数改他人店铺
owner, _ := auth.Owner.(map[string]any)
storeIdentity, _ := owner["store_identity"].(string)
if storeIdentity == "" || in.GetIdentity() != storeIdentity {
return nil, errcode.ErrPermissionDenied
}
data := &models.MallStore{
Logo: in.Logo,
Title: in.Title,
@@ -31,12 +39,15 @@ func SetSetting(ctx context.Context, in *pb.StoreBasic) (reply *pb.IdentityStatu
Configs: in.Configs,
}
if err := impl.DBService.Model(&models.MallStore{}).Where("id=? or identity=?", in.GetId(), in.GetIdentity()).Updates(data).Error; err != nil {
print(err.Error())
tx := impl.DBService.Model(&models.MallStore{}).Where("identity = ?", storeIdentity).Updates(data)
if tx.Error != nil {
printer.Error(tx.Error.Error())
return nil, errcode.ErrDB
}
if tx.RowsAffected == 0 {
return nil, errcode.ErrPermissionDenied
}
// TODO: add your logic code & delete this line.
return &pb.IdentityStatusReply{
Code: 0,
Message: "OK",

7
module/ec/market/internal/logic/agency/approve.go
View File

@@ -9,10 +9,17 @@ import (
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
// 审核
func Approve(ctx context.Context, in *pb.ApproveRequest) (reply *pb.IdentityStatusReply, err error) {
// 解析授权信息，审核仅限有权限的角色
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
var data *models.MarketAgency
if in.GetIdentity() == "" {
return nil, errcode.ErrInvalidArgument

10
module/ec/market/internal/logic/agency/create.go
View File

@@ -11,16 +11,18 @@ import (
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
"git.apinb.com/bsm-sdk/core/types"
"git.apinb.com/bsm-sdk/core/utils"
)
// 新增代理商
func Create(ctx context.Context, in *pb.MarketAgenctyItem) (reply *pb.IdentityStatusReply, err error) {
// _, err = service.ParseMetaCtx(ctx, nil)
// if err != nil {
// return nil, err
// }
// 解析授权信息，开号仅限有权限的角色
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
if in.GetName() == "" || in.GetAccount() == "" || in.GetPassword() == "" {
return nil, errcode.ErrInvalidArgument
}

11
module/ec/market/internal/logic/agency/delete.go
View File

@@ -10,15 +10,16 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
)
// 删除一个代理商
func Delete(ctx context.Context, in *pb.IdentRequest) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
// _, err = service.ParseMetaCtx(ctx, nil)
// if err != nil {
// return nil, err
// }
// 解析授权信息，删号仅限有权限的角色
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
if in.Id == 0 && in.Identity == "" {
return nil, errcode.ErrInvalidArgument

12
module/ec/market/internal/logic/agency/fetch.go
View File

@@ -15,21 +15,25 @@ import (
// 代理商列表
func Fetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.AgencyReply, err error) {
var (
cnt int64 = 0
Offset int64 = (in.GetPageNo() - 1) * in.GetPageSize()
data = make([]*models.MarketAgency, 0)
cnt int64 = 0
data = make([]*models.MarketAgency, 0)
)
_, err = service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
// 先归一化分页参数，再计算偏移量
if in.GetPageNo() < 1 {
in.PageNo = 1
}
if in.GetPageSize() < 10 {
in.PageSize = 50
}
if in.GetPageSize() > 200 {
in.PageSize = 200
}
Offset := (in.GetPageNo() - 1) * in.GetPageSize()
tx := impl.DBService.Model(&models.MarketAgency{})
if in.GetIdentity() != "" {
tx.Where("identity = ?", in.GetIdentity())
@@ -47,6 +51,6 @@ func Fetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.AgencyRepl
return &pb.AgencyReply{
Data: ref(data),
Count: int64(len(data)),
Count: cnt,
}, nil
}

6
module/ec/market/internal/logic/agency/get.go
View File

@@ -9,6 +9,7 @@ import (
"bsm/full/module/ec/market/internal/models"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -22,8 +23,9 @@ func Get(ctx context.Context, in *pb.IdentRequest) (reply *pb.MarketAgenctyItem,
return nil, err
}
identity = auth.Identity
if in.GetIdentity() != "" {
identity = in.GetIdentity()
// 请求中的 identity 只能用于与 token 身份比对，不一致直接拒绝
if in.GetIdentity() != "" && in.GetIdentity() != auth.Identity {
return nil, errcode.ErrPermissionDenied
}
mktModel := models.MarketAgency{}
if err := impl.DBService.Where("identity=?", identity).First(&mktModel).Error; err != nil {

8
module/ec/market/internal/logic/agency/login.go
View File

@@ -10,7 +10,8 @@ import (
"bsm/full/module/ec/market/internal/password"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/crypto/encipher"
"git.apinb.com/bsm-sdk/core/crypto/token"
"git.apinb.com/bsm-sdk/core/env"
"git.apinb.com/bsm-sdk/core/errcode"
"gorm.io/gorm"
)
@@ -50,7 +51,8 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
Market_Identity: marketData.Identity,
}
token, err := encipher.GenerateTokenAes(marketData.ID, marketData.Identity, "", "", market, map[string]string{})
// 与接口侧 ParseMetaCtx 的 JWT 校验保持一致，使用 SDK 的签发函数
tokenStr, err := token.New(env.Runtime.JwtSecretKey).GenerateJwt(marketData.ID, marketData.Identity, "", "", market, map[string]string{})
if err != nil {
return nil, err
}
@@ -63,7 +65,7 @@ func Login(ctx context.Context, in *pb.LoginRequest) (reply *pb.LoginReply, err
}
return &pb.LoginReply{
Token: token,
Token: tokenStr,
Identity: marketData.Identity,
Name: marketData.Name,
Account: marketData.Account,

6
module/ec/market/internal/logic/agency/modify.go
View File

@@ -9,6 +9,7 @@ import (
"bsm/full/module/ec/market/internal/models"
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -22,8 +23,9 @@ func Modify(ctx context.Context, in *pb.MarketAgenctyItem) (reply *pb.IdentitySt
return nil, err
}
identity = auth.Identity
if in.GetIdentity() != "" {
identity = in.GetIdentity()
// 请求中的 identity 只能用于与 token 身份比对，不一致直接拒绝
if in.GetIdentity() != "" && in.GetIdentity() != auth.Identity {
return nil, errcode.ErrPermissionDenied
}
mktModel := &models.MarketAgency{
Name: in.GetName(),

14
module/ec/market/internal/logic/agency/pending.go
View File

@@ -20,17 +20,21 @@ func Pending(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.AgencyRe
}
var (
cnt int64 = 0
Offset int64 = (in.GetPageNo() - 1) * in.GetPageSize()
data = make([]*models.MarketAgency, 0)
cnt int64 = 0
data = make([]*models.MarketAgency, 0)
)
// 先归一化分页参数，再计算偏移量
if in.GetPageNo() < 1 {
in.PageNo = 1
}
if in.GetPageSize() < 0 {
if in.GetPageSize() < 10 {
in.PageSize = 50
}
if in.GetPageSize() > 200 {
in.PageSize = 200
}
Offset := (in.GetPageNo() - 1) * in.GetPageSize()
tx := impl.DBService.Model(&models.MarketAgency{}).Where("approve = 0").Order("created_at desc")
if in.GetIdentity() != "" {
tx.Where("identity = ?", in.GetIdentity())
@@ -42,6 +46,6 @@ func Pending(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.AgencyRe
return &pb.AgencyReply{
Data: ref(data),
Count: int64(len(data)),
Count: cnt,
}, nil
}

7
module/ec/market/internal/logic/agency/set_password.go
View File

@@ -21,10 +21,11 @@ func SetPassword(ctx context.Context, in *pb.SetPasswordRequest) (reply *pb.Iden
if err != nil {
return nil, err
}
identity := auth.Identity
if in.GetIdentity() != "" {
identity = in.GetIdentity()
// 请求中的 identity 只能用于与 token 身份比对，不一致直接拒绝
if in.GetIdentity() != "" && in.GetIdentity() != auth.Identity {
return nil, errcode.ErrPermissionDenied
}
identity := auth.Identity
if in.GetOldPassword() == "" || in.GetNewPassword() == "" {
return nil, errcode.ErrInvalidArgument
}

5
module/ec/market/internal/logic/data/member_details.go
View File

@@ -21,7 +21,6 @@ func MemberDetails(ctx context.Context, in *pb.IdentRequest) (reply *pb.KeyVal,
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return
// 尚未实现，显式返回未实现错误，避免调用方误判为“成功但无数据”
return nil, errcode.ErrUnimplemented
}

6
module/ec/market/internal/logic/data/member_fetch.go
View File

@@ -4,6 +4,7 @@ import (
pb "bsm/full/module/ec/market/pb"
"context"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -23,7 +24,6 @@ func MemberFetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.Data
in.PageSize = 50
}
// TODO: add your logic code & delete this line.
return
// 尚未实现，显式返回未实现错误，避免调用方误判为“成功但无数据”
return nil, errcode.ErrUnimplemented
}

5
module/ec/market/internal/logic/data/order_details.go
View File

@@ -21,7 +21,6 @@ func OrderDetails(ctx context.Context, in *pb.IdentRequest) (reply *pb.KeyVal, e
return nil, errcode.ErrInvalidArgument
}
// TODO: add your logic code & delete this line.
return
// 尚未实现，显式返回未实现错误，避免调用方误判为“成功但无数据”
return nil, errcode.ErrUnimplemented
}

6
module/ec/market/internal/logic/data/order_fetch.go
View File

@@ -4,6 +4,7 @@ import (
pb "bsm/full/module/ec/market/pb"
"context"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -23,7 +24,6 @@ func OrderFetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.DataR
in.PageSize = 50
}
// TODO: add your logic code & delete this line.
return
// 尚未实现，显式返回未实现错误，避免调用方误判为“成功但无数据”
return nil, errcode.ErrUnimplemented
}

8
module/ec/market/internal/logic/data/overview.go
View File

@@ -4,6 +4,7 @@ import (
pb "bsm/full/module/ec/market/pb"
"context"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
)
@@ -15,9 +16,6 @@ func Overview(ctx context.Context, in *pb.Empty) (reply *pb.OverviewReply, err e
return nil, err
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return
// 尚未实现，显式返回未实现错误，避免调用方误判为“成功但无数据”
return nil, errcode.ErrUnimplemented
}

11
module/ec/market/internal/logic/supply/create.go
View File

@@ -10,17 +10,18 @@ import (
pb "bsm/full/module/ec/market/pb"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/service"
"git.apinb.com/bsm-sdk/core/types"
"git.apinb.com/bsm-sdk/core/utils"
)
// 新增供应商
func Create(ctx context.Context, in *pb.MarketSupplyItem) (reply *pb.IdentityStatusReply, err error) {
// parse authorization meta.
// _, err = service.ParseMetaCtx(ctx, nil)
// if err != nil {
// return nil, err
// }
// 解析授权信息，开号仅限有权限的角色
_, err = service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
if in.GetName() == "" {
return nil, errcode.ErrInvalidArgument
}

12
module/ec/market/internal/logic/supply/fetch.go
View File

@@ -15,21 +15,25 @@ import (
// 供应商列表
func Fetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.SupplyReply, err error) {
var (
cnt int64 = 0
Offset int64 = (in.GetPageNo() - 1) * in.GetPageSize()
data = make([]*models.MarketSupply, 0)
cnt int64 = 0
data = make([]*models.MarketSupply, 0)
)
_, err = service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
// 先归一化分页参数，再计算偏移量
if in.GetPageNo() < 1 {
in.PageNo = 1
}
if in.GetPageSize() < 10 {
in.PageSize = 50
}
if in.GetPageSize() > 200 {
in.PageSize = 200
}
Offset := (in.GetPageNo() - 1) * in.GetPageSize()
tx := impl.DBService.Model(&models.MarketSupply{}).Where("status = ?", 1)
if in.GetIdentity() != "" {
tx.Where("identity = ?", in.GetIdentity())
@@ -40,6 +44,6 @@ func Fetch(ctx context.Context, in *pb.MarketFetchRequest) (reply *pb.SupplyRepl
}
return &pb.SupplyReply{
Data: ref(data),
Count: int64(len(data)),
Count: cnt,
}, nil
}

16
module/ec/market/internal/server/new.go
View File

@@ -5,11 +5,25 @@ import (
pb "bsm/full/module/ec/market/pb"
"context"
"git.apinb.com/bsm-sdk/core/printer"
gwRuntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/reflection"
"google.golang.org/grpc/status"
)
// recoverUnaryInterceptor 捕获处理过程中的 panic，转为 Internal 错误返回，避免进程崩溃。
func recoverUnaryInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp any, err error) {
defer func() {
if r := recover(); r != nil {
printer.Error("grpc panic recovered: %v", r)
err = status.Error(codes.Internal, "internal server error")
}
}()
return handler(ctx, req)
}
type Server struct {
Grpc *grpc.Server
Ctx context.Context
@@ -20,7 +34,7 @@ type Server struct {
func New(grpcServ *grpc.Server) *Server {
standalone := grpcServ == nil
if standalone {
grpcServ = grpc.NewServer()
grpcServ = grpc.NewServer(grpc.UnaryInterceptor(recoverUnaryInterceptor))
}
srv := &Server{

4
module/ec/order/internal/logic/cart/create.go
View File

@@ -24,7 +24,7 @@ func Create(ctx context.Context, in *pb.CartAddRequest) (reply *pb.OrderStatusRe
}
var cart *models.OrderCart
err = impl.DBService.Where("cart_identity=? and product_identity=? and spec_id = ? ", in.CartIdentity, in.ProductIdentity, in.SpecId).First(&cart).Error
err = impl.DBService.Where("passport_identity=? and cart_identity=? and product_identity=? and spec_id = ? ", auth.Identity, in.CartIdentity, in.ProductIdentity, in.SpecId).First(&cart).Error
if err != nil {
if !errors.Is(err, gorm.ErrRecordNotFound) {
printer.Error(err.Error())
@@ -46,7 +46,7 @@ func Create(ctx context.Context, in *pb.CartAddRequest) (reply *pb.OrderStatusRe
err = impl.DBService.Create(&data).Error
} else {
data.Number += cart.Number
err = impl.DBService.Where("cart_identity=? and product_identity=? and spec_id = ? ", in.CartIdentity, in.ProductIdentity, in.SpecId).Updates(&data).Error
err = impl.DBService.Where("passport_identity=? and cart_identity=? and product_identity=? and spec_id = ? ", auth.Identity, in.CartIdentity, in.ProductIdentity, in.SpecId).Updates(&data).Error
}
if err != nil {

4
module/ec/order/internal/logic/cart/delete.go
View File

@@ -14,12 +14,12 @@ import (
// 删除购物车中的商品
func Delete(ctx context.Context, in *pb.CartDelRequest) (reply *pb.OrderStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
err = impl.DBService.Where("id in ?", in.Id).Delete(&models.OrderCart{}).Error
err = impl.DBService.Where("id in ? and passport_identity = ?", in.Id, auth.Identity).Delete(&models.OrderCart{}).Error
if err != nil {
return nil, err
}

43
module/ec/order/internal/logic/cart/fetch.go
View File

@@ -27,8 +27,12 @@ func Fetch(ctx context.Context, in *pb.CartGetRequest) (reply *pb.CartGetReply,
return nil, errcode.ErrInvalidArgument
}
}
// 查询购物车数据
err = impl.DBService.Where("cart_identity=? or passport_identity=?", in.GetCarIdentity(), auth.Identity).Find(&cart).Error
// 查询购物车数据：仅返回属于当前登录者的条目，cart_identity 只作附加过滤。
tx := impl.DBService.Where("passport_identity = ?", auth.Identity)
if in.GetCarIdentity() != "" {
tx = tx.Where("cart_identity = ?", in.GetCarIdentity())
}
err = tx.Find(&cart).Error
if err != nil {
printer.Error(err.Error())
@@ -39,29 +43,30 @@ func Fetch(ctx context.Context, in *pb.CartGetRequest) (reply *pb.CartGetReply,
product := models.Product{}
err := impl.DBService.Raw(`
SELECT
p.id, p.identity, p.title, p.cover_image, p.args, p.cost_price,
p.id, p.identity, p.title, p.cover_image, p.args,
( SELECT MIN(mps.price)
FROM product_spec ps
JOIN mall_product_spec mps ON ps.spec_id = mps.id
WHERE ps.product_identity = p.identity
) as sales_price FROM mall_product p WHERE p.identity = ?`, item.ProductIdentity).Scan(&product).Error
if err == nil {
da := &pb.CartItem{
Id: int64(item.ID),
ProductId: product.Id,
Title: product.Title,
ProductIdentity: product.Identity,
CoverImage: product.CoverImage,
SalesPrice: product.SalesPrice,
ProductArgs: item.ProductArgs,
UnitPrice: product.CostPrice,
TotalPrice: int64(item.Number) * product.SalesPrice,
Number: item.Number,
Identity: item.Identity,
}
result = append(result, da)
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
}
da := &pb.CartItem{
Id: int64(item.ID),
ProductId: product.Id,
Title: product.Title,
ProductIdentity: product.Identity,
CoverImage: product.CoverImage,
SalesPrice: product.SalesPrice,
ProductArgs: item.ProductArgs,
UnitPrice: product.SalesPrice,
TotalPrice: int64(item.Number) * product.SalesPrice,
Number: item.Number,
Identity: item.Identity,
}
result = append(result, da)
}
return &pb.CartGetReply{

6
module/ec/order/internal/logic/cart/modify.go
View File

@@ -16,14 +16,14 @@ import (
// 修改购物车中的商品数量
func Modify(ctx context.Context, in *pb.CartSetRequest) (reply *pb.OrderStatusReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
if len(in.GetUpdates()) > 0 {
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
for _, update := range in.Updates {
err := tx.Table("order_cart").Where("id = ?", update.Id).Update("number", update.Number).Error
err := tx.Table("order_cart").Where("id = ? and passport_identity = ?", update.Id, auth.Identity).Update("number", update.Number).Error
if err != nil {
printer.Error(err.Error())
return err
@@ -37,7 +37,7 @@ func Modify(ctx context.Context, in *pb.CartSetRequest) (reply *pb.OrderStatusRe
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Table("order_cart").Where("id = ?", in.Id).Update("number", in.Number).Error
err = impl.DBService.Table("order_cart").Where("id = ? and passport_identity = ?", in.Id, auth.Identity).Update("number", in.Number).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB

41
module/ec/order/internal/logic/mgt/order_approve.go
View File

@@ -10,21 +10,45 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"gorm.io/gorm"
)
// 订单审批
func OrderApprove(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.OrderStatusReply, err error) {
// parse authorization meta. 管理端接口，要求调用者为管理员。
auth, err := service.ParseMetaCtx(ctx, &service.ParseOptions{RoleValue: "Mall_Admin"})
if err != nil {
return nil, err
}
if auth.Owner == nil {
return nil, errcode.ErrPermissionDenied
}
// 验证输入参数是否有效。
if in.GetIdentity() == "" {
return nil, errcode.ErrInvalidArgument
}
// 审批动作只允许 4：申请通过，-2：未通过。
if in.GetApprove() != 4 && in.GetApprove() != -2 {
return nil, errcode.ErrInvalidArgument
}
// 获取当前订单信息。
var order models.OrderSummary
if err := impl.DBService.Preload("OrderDetails").Where("identity=?", in.Identity).First(&order).Error; err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
}
// 只有处于"申请中"（1:申请退款 2:申请退货 3:申请退款退货）的订单才允许审批，拒绝非法状态跃迁。
if order.Approve != 1 && order.Approve != 2 && order.Approve != 3 {
return nil, errcode.ErrUnavailable
}
// 归属校验：管理员只能审批本店订单，避免通过直连 mall_product_spec 回补他店商品库存。
if owner, ok := auth.Owner.(map[string]any); ok {
if storeIdentity, ok := owner["store_identity"].(string); ok && storeIdentity != "" && storeIdentity != order.StoreIdentity {
return nil, errcode.ErrPermissionDenied
}
}
// 根据订单审批状态更新订单状态：状态：-2：未通过，0：默认 1:申请退款 2:申请退货 3：申请退款退货 4：申请通过
switch order.Approve {
@@ -44,27 +68,30 @@ func OrderApprove(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.Orde
// 申请退货
case 2:
if in.GetApprove() == 4 {
impl.DBService.Transaction(func(tx *gorm.DB) error {
err = tx.Model(&models.OrderSummary{}).Where("identity=?", in.Identity).
// 事务错误需向上传递，避免回补库存失败却对外返回成功。
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
if err := tx.Model(&models.OrderSummary{}).Where("identity=?", in.Identity).
Updates(map[string]any{
"approve": in.GetApprove(),
"status": 8,
}).Error
if err != nil {
}).Error; err != nil {
printer.Error(err.Error())
return err
}
// 如果订单详情中的数量不为零，则更新产品规格的库存。
// 如果订单详情中的数量不为零，则按订单明细的规格回补库存。
for _, specs := range order.OrderDetails {
if specs.Number != 0 {
err = tx.Table("mall_product_spec").Where("product_identity = ?", specs.ProductIdentity).UpdateColumn("stock", gorm.Expr("stock + ?", specs.Number)).Error
if err != nil {
if err := tx.Table("mall_product_spec").Where("id = ?", specs.SpecID).UpdateColumn("stock", gorm.Expr("stock + ?", specs.Number)).Error; err != nil {
return err
}
}
}
return nil
})
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
}
}
// 申请退款退货
case 3:

51
module/ec/order/internal/logic/mgt/order_cancel.go
View File

@@ -2,6 +2,7 @@ package mgt
import (
"context"
"errors"
"time"
"bsm/full/module/ec/order/internal/impl"
@@ -11,6 +12,7 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"gorm.io/gorm"
)
// 取消订单
@@ -30,15 +32,54 @@ func OrderCancel(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.Order
return nil, errcode.ErrInvalidArgument
}
// 验证输入参数是否有效。
if in.GetIdentity() == "" {
return nil, errcode.ErrInvalidArgument
}
err = impl.DBService.Model(&models.OrderSummary{}).Where("identity=?", in.Identity).Update("status", -1).Error
order := new(models.OrderSummary)
err = impl.DBService.Where("identity = ?", in.Identity).First(order).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrRecordNotFound
}
return nil, errcode.ErrDB
}
// 状态机约束：只有"未支付"（status=1）的订单允许取消，其它状态拒绝，避免非法状态跃迁。
if order.Status != 1 {
return nil, errcode.ErrUnavailable
}
details := make([]*models.OrderDetails, 0)
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
// 以状态为条件更新，避免并发下重复取消导致库存重复回补。
result := tx.Model(&models.OrderSummary{}).Where("identity = ? AND status = ?", in.Identity, 1).Update("status", -1)
if result.Error != nil {
return result.Error
}
if result.RowsAffected == 0 {
return errcode.ErrUnavailable
}
// 按订单明细的规格回补库存，避免取消后库存丢失。
if err := tx.Where("summary_identity = ?", order.Identity).Find(&details).Error; err != nil {
return err
}
for _, d := range details {
if d.Number > 0 {
if err := tx.Table("mall_product_spec").Where("id = ?", d.SpecID).
UpdateColumn("stock", gorm.Expr("stock + ?", d.Number)).Error; err != nil {
return err
}
}
}
return nil
})
if err != nil {
printer.Error(err.Error())
if errors.Is(err, errcode.ErrUnavailable) {
return nil, errcode.ErrUnavailable
}
return nil, errcode.ErrDB
}
return &pb.OrderStatusReply{
Code: 0,
Message: "OK",

12
module/ec/order/internal/logic/mgt/order_create.go
View File

@@ -71,8 +71,9 @@ func OrderCreate(ctx context.Context, in *pb.CreateOrderRequest) (reply *pb.Orde
}
// 从产品信息中提取单价、ID等详情，并构建订单详情对象。
// 单价取实际的规格销售价 spec.price（商品的 sales_price 列从不被写入，取它会导致成交金额恒为 0）。
productID := product["id"].(int64)
unit_price := product["sales_price"].(int64)
unit_price := spec["price"].(int64)
// 计算交易价格并构建订单摘要对象。
itemTotal := int64(specs.Number) * unit_price
TotalPrice += itemTotal
@@ -85,7 +86,9 @@ func OrderCreate(ctx context.Context, in *pb.CreateOrderRequest) (reply *pb.Orde
Title: product["title"].(string),
CoverImage: product["cover_image"].(string),
UnitPrice: unit_price,
SalesPrice: unit_price,
Number: specs.Number,
TotalPrice: itemTotal,
ProductArgs: product["args"].(string),
SpecID: spec["id"].(int64),
SpecNo: spec["serial_number"].(string),
@@ -96,11 +99,14 @@ func OrderCreate(ctx context.Context, in *pb.CreateOrderRequest) (reply *pb.Orde
specList = append(specList, *details)
}
// 查询地址信息以确保其存在。
// 查询地址信息以确保其存在，并按归属过滤：只允许使用属于当前登录者的地址。
address := map[string]any{}
err = impl.DBService.Table("address_library").Take(&address, "identity=?", in.AddressIdentity).Error
err = impl.DBService.Table("address_library").Take(&address, "identity=? and owner_identity=?", in.AddressIdentity, auth.Identity).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrPermissionDenied
}
return nil, errcode.ErrDB
}

13
module/ec/order/internal/logic/mgt/order_modify.go
View File

@@ -2,7 +2,6 @@ package mgt
import (
"context"
"time"
pb "bsm/full/module/ec/order/pb"
@@ -22,14 +21,6 @@ func OrderModify(ctx context.Context, in *pb.OrderSummaryItem) (reply *pb.OrderS
return nil, errcode.ErrPermissionDenied
}
// TODO: valid code
// TODO: add your logic code & delete this line.
return &pb.OrderStatusReply{
Code: 0,
Message: "OK",
Timeseq: time.Now().UnixNano(),
}, nil
// 该方法尚未实现，显式返回未实现错误，避免调用方误判改单成功。
return nil, errcode.ErrUnimplemented
}

62
module/ec/order/internal/logic/summary/cancel.go
View File

@@ -2,6 +2,7 @@ package summary
import (
"context"
"errors"
"time"
"bsm/full/module/ec/order/internal/impl"
@@ -11,6 +12,7 @@ import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"gorm.io/gorm"
)
// 取消订单
@@ -31,25 +33,55 @@ func Cancel(ctx context.Context, in *pb.CancelRequest) (reply *pb.OrderStatusRep
return nil, errcode.ErrDB
}
if summary.Status == 1 {
values := &models.OrderSummary{
CouponIdentity: "",
CouponAmount: 0.00,
// 状态机约束：只有"未支付"（status=1）的订单允许取消，其它状态拒绝，避免非法状态跃迁。
if summary.Status != 1 {
return nil, errcode.ErrUnavailable
}
details := make([]*models.OrderDetails, 0)
err = impl.DBService.Transaction(func(tx *gorm.DB) error {
// 1. 以状态为条件更新订单，避免并发下重复取消。
result := tx.Model(&models.OrderSummary{}).Where("order_no = ? AND status = ?", in.OrderNo, 1).
Updates(map[string]any{
"status": -1,
"coupon_identity": "",
"coupon_amount": 0,
})
if result.Error != nil {
return result.Error
}
values.Status = -1
err := impl.DBService.Where("order_no = ?", in.OrderNo).Updates(values).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
if result.RowsAffected == 0 {
return errcode.ErrUnavailable
}
err = impl.DBService.Model(&models.OrderCoupon{}).Where("identity=?", summary.CouponIdentity).Update("status", 2).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
// 2. 按订单明细的规格回补库存，避免取消后库存丢失。
if err := tx.Where("summary_identity = ?", summary.Identity).Find(&details).Error; err != nil {
return err
}
for _, d := range details {
if d.Number > 0 {
if err := tx.Table("mall_product_spec").Where("id = ?", d.SpecID).
UpdateColumn("stock", gorm.Expr("stock + ?", d.Number)).Error; err != nil {
return err
}
}
}
// 3. 退回已使用的优惠券，使其重新可用。
if summary.CouponIdentity != "" {
if err := tx.Model(&models.OrderCoupon{}).Where("identity = ?", summary.CouponIdentity).
Update("status", 2).Error; err != nil {
return err
}
}
return nil
})
if err != nil {
printer.Error(err.Error())
if errors.Is(err, errcode.ErrUnavailable) {
return nil, errcode.ErrUnavailable
}
return nil, errcode.ErrDB
}
return &pb.OrderStatusReply{

68
module/ec/order/internal/logic/summary/confirm.go
View File

@@ -2,6 +2,7 @@ package summary
import (
"context"
"time"
"bsm/full/module/ec/order/internal/impl"
"bsm/full/module/ec/order/internal/models"
@@ -15,7 +16,7 @@ import (
// 确认订单，物流，优惠卷等其它信息
func Confirm(ctx context.Context, in *pb.ConfirmRequest) (reply *pb.ConfirmReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
@@ -54,27 +55,56 @@ func Confirm(ctx context.Context, in *pb.ConfirmRequest) (reply *pb.ConfirmReply
if in.CouponIdentity != "" {
err = impl.DBService.Where("identity=?", in.CouponIdentity).First(&coupon).Error
if err == nil {
if coupon.Status == 2 {
impl.DBService.Model(&models.OrderCoupon{}).Where("identity=?", in.CouponIdentity).Update("status", 3)
couponAmount = coupon.Amount
} else {
printer.Error(err.Error())
return nil, errcode.ErrUnavailable
}
} else {
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrRecordNotFound
}
// 校验优惠券归属：passport_id 或 passport_identity 命中调用者才算本人所有。
if coupon.PassportIdentity != auth.Identity && coupon.PassportID != auth.ID {
return nil, errcode.ErrPermissionDenied
}
// 校验使用状态：仅可用的优惠券（status=2）可使用。
if coupon.Status != 2 {
return nil, errcode.ErrUnavailable
}
// 校验有效期：started/expired 为字符串，格式可解析时强制校验，无法解析时跳过。
now := time.Now()
if started, ok := parseCouponTime(coupon.Started); ok && now.Before(started) {
return nil, errcode.ErrUnavailable
}
if expired, ok := parseCouponTime(coupon.Expired); ok && now.After(expired) {
return nil, errcode.ErrUnavailable
}
// 核销优惠券：带状态条件更新并检查影响行数，避免重复使用同一张券。
result := impl.DBService.Model(&models.OrderCoupon{}).Where("identity = ? AND status = 2", in.CouponIdentity).Update("status", 3)
if result.Error != nil {
printer.Error(result.Error.Error())
return nil, errcode.ErrDB
}
if result.RowsAffected == 0 {
return nil, errcode.ErrUnavailable
}
couponAmount = coupon.Amount
}
if couponAmount > 0 {
summary.TotalPrice = summary.TotalPrice + couponAmount
// 优惠券为减免项，抵扣后总额不得为负：抵扣额不超过订单金额。
if couponAmount >= summary.TotalPrice {
summary.TotalPrice = 0
} else {
summary.TotalPrice = summary.TotalPrice - couponAmount
}
// 回写所用券与其抵扣额，供取消订单时退券使用。
summary.CouponIdentity = in.CouponIdentity
summary.CouponAmount = couponAmount
}
summary.Status = 1
err = impl.DBService.Where("order_no = ?", in.OrderNo).Updates(summary).Error
// 显式指定需落库的列，保证总额抵扣为 0 时也能写入。
err = impl.DBService.Where("order_no = ?", in.OrderNo).
Select("total_price", "coupon_identity", "coupon_amount", "status").
Updates(summary).Error
if err != nil {
printer.Error(err.Error())
return nil, errcode.ErrDB
@@ -84,3 +114,17 @@ func Confirm(ctx context.Context, in *pb.ConfirmRequest) (reply *pb.ConfirmReply
TotalPrice: summary.TotalPrice,
}, nil
}
// parseCouponTime 解析优惠券 started/expired 时间字段，兼容"2006-01-02 15:04:05"与"2006-01-02"两种格式；
// 无法解析时返回 ok=false，由调用方跳过该项校验。
func parseCouponTime(v string) (time.Time, bool) {
if v == "" {
return time.Time{}, false
}
for _, layout := range []string{"2006-01-02 15:04:05", "2006-01-02"} {
if t, err := time.ParseInLocation(layout, v, time.Local); err == nil {
return t, true
}
}
return time.Time{}, false
}

26
module/ec/order/internal/logic/summary/get.go
View File

@@ -2,8 +2,11 @@ package summary
import (
"context"
"errors"
"bsm/full/module/ec/order/internal/impl"
"bsm/full/module/ec/order/internal/logic/common"
"bsm/full/module/ec/order/internal/models"
pb "bsm/full/module/ec/order/pb"
"git.apinb.com/bsm-sdk/core/errcode"
@@ -14,7 +17,7 @@ import (
// 获取一个订单的详情数据
func Get(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.SummaryGetReply, err error) {
// parse authorization meta.
_, err = service.ParseMetaCtx(ctx, nil)
auth, err := service.ParseMetaCtx(ctx, nil)
if err != nil {
return nil, err
}
@@ -24,13 +27,30 @@ func Get(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb.SummaryGetRep
return nil, errcode.ErrInvalidArgument
}
summary, err := common.GetOrderSummaryByIdentity(in.Identity)
order := new(models.OrderSummary)
err = impl.DBService.Preload("OrderDetails").Where("identity = ?", in.Identity).First(&order).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrRecordNotFound
}
return nil, errcode.ErrDB
}
// 归属校验：订单只能由下单人本人或订单所属店铺的管理员/员工查看，避免越权读取他人订单与收货信息。
if order.PassportIdentity != auth.Identity {
ownerStoreIdentity := ""
if owner, ok := auth.Owner.(map[string]any); ok {
if v, ok := owner["store_identity"].(string); ok {
ownerStoreIdentity = v
}
}
if ownerStoreIdentity == "" || ownerStoreIdentity != order.StoreIdentity {
return nil, errcode.ErrPermissionDenied
}
}
return &pb.SummaryGetReply{
Summary: summary,
Summary: common.ReflectProtoOrderSummary(order),
}, nil
}

11
module/ec/order/internal/logic/summary/quick_create_by_product.go
View File

@@ -74,13 +74,13 @@ func QuickCreateByProduct(ctx context.Context, in *pb.QuickCreateByProductReques
return nil, errcode.ErrDB
}
// 查询地址信息以确保其存在。
// 查询地址信息以确保其存在，并按归属过滤：只允许使用属于当前登录者的地址。
address := map[string]any{}
err = impl.DBService.Table("address_library").Take(&address, "identity=?", in.AddressIdentity).Error
err = impl.DBService.Table("address_library").Take(&address, "identity=? and owner_identity=?", in.AddressIdentity, auth.Identity).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrRecordNotFound
return nil, errcode.ErrPermissionDenied
}
return nil, errcode.ErrDB
}
@@ -125,7 +125,8 @@ func QuickCreateByProduct(ctx context.Context, in *pb.QuickCreateByProductReques
summary.Status = 1
// 从产品信息中提取单价、ID等详情，并构建订单详情对象。
unit_price := product["sales_price"].(int64)
// 单价取实际的规格销售价 spec.price（商品的 sales_price 列从不被写入，取它会导致成交金额恒为 0）。
unit_price := spec["price"].(int64)
productID := product["id"].(int64)
details := &models.OrderDetails{
Type: 1,
@@ -136,7 +137,9 @@ func QuickCreateByProduct(ctx context.Context, in *pb.QuickCreateByProductReques
Title: product["title"].(string),
CoverImage: product["cover_image"].(string),
UnitPrice: unit_price,
SalesPrice: unit_price,
Number: in.Number,
TotalPrice: int64(in.Number) * unit_price,
ProductArgs: product["args"].(string),
SummaryIdentity: summary.Identity,
SpecTitle: spec["title"].(string),

17
module/ec/order/internal/logic/summary/simulate_pay.go
View File

@@ -9,9 +9,11 @@ import (
"bsm/full/module/ec/order/internal/models"
pb "bsm/full/module/ec/order/pb"
"git.apinb.com/bsm-sdk/core/env"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
"gorm.io/gorm"
)
// 模拟支付
@@ -22,7 +24,20 @@ func SimulatePay(ctx context.Context, in *pb.SimulatePayRequest) (reply *pb.Orde
return nil, err
}
err = impl.DBService.Model(&models.OrderSummary{}).Where("identity in ?", in.Identity).Updates(models.OrderSummary{Status: 2, PayTime: time.Now(), PayType: 4, PayRemark: "支付备注", PayTradeNo: "Pay12371937812897", PayAmount: 10000000}).Error
// 模拟接口仅允许在 dev 模式使用，其它模式默认关闭，避免生产环境被用于伪造支付、推进订单状态。
if env.Runtime == nil || env.Runtime.Mode != "dev" {
return nil, errcode.ErrPermissionDenied
}
// 支付金额取订单实际应付金额，交易号与备注从环境变量读取，避免硬编码的固定金额导致账实不符。
err = impl.DBService.Model(&models.OrderSummary{}).Where("identity in ?", in.Identity).Updates(map[string]any{
"status": 2,
"pay_time": time.Now(),
"pay_type": 4,
"pay_trade_no": env.GetEnvDefault("BSM_SimulatePayTradeNo", "SIMULATE"),
"pay_remark": env.GetEnvDefault("BSM_SimulatePayRemark", "模拟支付"),
"pay_amount": gorm.Expr("trans_price"),
}).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {

6
module/ec/order/internal/logic/summary/simulate_receiving.go
View File

@@ -9,6 +9,7 @@ import (
"bsm/full/module/ec/order/internal/models"
pb "bsm/full/module/ec/order/pb"
"git.apinb.com/bsm-sdk/core/env"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
@@ -21,6 +22,11 @@ func SimulateReceiving(ctx context.Context, in *pb.OrderIdentRequest) (reply *pb
if err != nil {
return nil, err
}
// 模拟接口仅允许在 dev 模式使用，其它模式默认关闭，避免生产环境被用于伪造收货、推进订单状态。
if env.Runtime == nil || env.Runtime.Mode != "dev" {
return nil, errcode.ErrPermissionDenied
}
// valildate request id,identity.
if in.Id == 0 && in.Identity == "" {
return nil, errcode.ErrInvalidArgument

6
module/ec/order/internal/logic/summary/simulate_shipments.go
View File

@@ -9,6 +9,7 @@ import (
"bsm/full/module/ec/order/internal/models"
pb "bsm/full/module/ec/order/pb"
"git.apinb.com/bsm-sdk/core/env"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/printer"
"git.apinb.com/bsm-sdk/core/service"
@@ -22,6 +23,11 @@ func SimulateShipments(ctx context.Context, in *pb.SimulateShipmentsRequest) (re
return nil, err
}
// 模拟接口仅允许在 dev 模式使用，其它模式默认关闭，避免生产环境被用于伪造发货、推进订单状态。
if env.Runtime == nil || env.Runtime.Mode != "dev" {
return nil, errcode.ErrPermissionDenied
}
if in.GetMemberIdentity() == "" {
return nil, errcode.ErrInvalidArgument
}

84
module/ec/order/internal/logic/summary/submit.go
View File

@@ -3,7 +3,7 @@ package summary
import (
"context"
"errors"
"log"
"strconv"
"strings"
"time"
@@ -33,12 +33,11 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
}
var (
cart = make([]*models.OrderCart, 0)
details = make([]*models.OrderDetails, 0)
summary = make([]*models.OrderSummary, 0)
keys = make([]string, 0)
address = models.OrderAddress{}
StoreId uint = 0
cart = make([]*models.OrderCart, 0)
details = make([]*models.OrderDetails, 0)
summary = make([]*models.OrderSummary, 0)
keys = make([]string, 0)
address = models.OrderAddress{}
)
// 获取购物车内数据信息
@@ -51,6 +50,26 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
return nil, errcode.ErrDB
}
// 只处理请求中选中的购物车条目；未指定 id 时按整车处理，兼容旧调用方。
if ids := in.GetId(); len(ids) > 0 {
wanted := make(map[uint]struct{}, len(ids))
for _, id := range ids {
if v, e := strconv.ParseUint(id, 10, 64); e == nil {
wanted[uint(v)] = struct{}{}
}
}
selected := make([]*models.OrderCart, 0, len(ids))
for _, item := range cart {
if _, ok := wanted[item.ID]; ok {
selected = append(selected, item)
}
}
cart = selected
}
if len(cart) == 0 {
return nil, errcode.ErrInvalidArgument
}
// 获取地址信息
if in.GetAddress() != nil {
address = models.OrderAddress{
@@ -65,21 +84,25 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
ZipCode: in.Address.ZipCode,
}
} else {
err = impl.DBService.Table("address_library").Where("identity = ?", in.AddressIdentity).Find(&address).Error
// 地址库按归属过滤：仅允许使用属于当前登录者的收货地址，避免盗用他人地址下单。
err = impl.DBService.Table("address_library").
Where("identity = ? and owner_identity = ?", in.AddressIdentity, auth.Identity).
Take(&address).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
return nil, errcode.ErrRecordNotFound
return nil, errcode.ErrPermissionDenied
}
return nil, errcode.ErrDB
}
}
// 按店铺分组购物车商品
// 按店铺分组购物车商品，并记录每个店铺对应的 store_id。
storeGroups := make(map[string][]*models.OrderCart)
for k, item := range cart {
storeIDs := make(map[string]uint)
for _, item := range cart {
product := models.Product{}
err = impl.DBService.Select("store_identity").Table("mall_product").Where("id = ?", item.ProductID).First(&product).Error
err = impl.DBService.Select("store_id,store_identity").Table("mall_product").Where("id = ?", item.ProductID).First(&product).Error
if err != nil {
printer.Error(err.Error())
if errors.Is(err, models.ErrNotFound) {
@@ -88,9 +111,7 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
return nil, errcode.ErrDB
}
if k == 0 {
StoreId = product.StoreId
}
storeIDs[product.StoreIdentity] = product.StoreId
storeGroups[product.StoreIdentity] = append(storeGroups[product.StoreIdentity], item)
}
@@ -163,7 +184,7 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
PartnerID: in.PartnerId,
TransPrice: storeTotal,
TotalPrice: storeTotal,
StoreID: StoreId,
StoreID: storeIDs[StoreIdentity],
StoreIdentity: StoreIdentity,
LogisticsFee: 0,
Remark: "",
@@ -197,28 +218,29 @@ func Submit(ctx context.Context, in *pb.SubmitRequest) (reply *pb.OrderStatusRep
return err
}
// 3. 扣减库存
// 3. 扣减库存：按规格做原子条件更新，影响行数为 0 即视为库存不足并回滚整个下单事务，避免超卖。
for _, detail := range details {
if detail.Number > 0 {
var stock int32
result := tx.Table("mall_product_spec").Select("stock").Where("id = ?", detail.SpecID).Scan(&stock)
if result.Error != nil || stock < detail.Number {
log.Printf("Insufficient stock or spec does not exist: %v", result.Error)
return errors.New("库存不足或规格不存在")
}
updateErr := tx.Table("mall_product_spec").
result := tx.Table("mall_product_spec").
Where("id = ? AND stock >= ?", detail.SpecID, detail.Number).
UpdateColumn("stock", gorm.Expr("stock - ?", detail.Number)).
Error
if updateErr != nil {
printer.Error(updateErr.Error())
return updateErr
UpdateColumn("stock", gorm.Expr("stock - ?", detail.Number))
if result.Error != nil {
printer.Error(result.Error.Error())
return result.Error
}
if result.RowsAffected == 0 {
printer.Error("库存不足或规格不存在")
return errors.New("库存不足或规格不存在")
}
}
}
// 4. 清空购物车
if err := tx.Where("passport_identity = ?", auth.Identity).
// 4. 只删除本次已下单的购物车条目，保留用户未结算的其它条目。
cartIDs := make([]uint, 0, len(cart))
for _, item := range cart {
cartIDs = append(cartIDs, item.ID)
}
if err := tx.Where("id in ?", cartIDs).
Delete(&models.OrderCart{}).Error; err != nil {
printer.Error(err.Error())
return err