366 lines
16 KiB
Go
366 lines
16 KiB
Go
|
// 功能：家庭成员邀请确认、按设备授权、撤销和审计；版本：1.0.0。
|
|||
|
|
package user
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"errors"
|
|||
|
|
"fmt"
|
|||
|
|
"strings"
|
|||
|
|
"time"
|
|||
|
|
"unicode/utf8"
|
|||
|
|
|
|||
|
|
"git.apinb.com/bsm-sdk/core/errcode"
|
|||
|
|
"git.apinb.com/bsm-sdk/core/infra"
|
|||
|
|
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
|
|||
|
|
"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
|
|||
|
|
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
|
|||
|
|
"github.com/gin-gonic/gin"
|
|||
|
|
"github.com/google/uuid"
|
|||
|
|
"gorm.io/gorm"
|
|||
|
|
"gorm.io/gorm/clause"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
const (
|
|||
|
|
familyInvitePending = 10
|
|||
|
|
familyInviteAccepted = 20
|
|||
|
|
familyInviteRejected = 30
|
|||
|
|
familyInviteRevoked = 40
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
var (
|
|||
|
|
errFamilySelf = errcode.NewError(2510, "不能邀请当前账号加入自己的家庭")
|
|||
|
|
errFamilyDuplicate = errcode.NewError(2511, "该手机号已有待确认或已加入的家庭成员")
|
|||
|
|
errFamilyExpired = errcode.NewError(2512, "邀请已失效，请联系房主重新邀请")
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
type familyDevicePermissionInput struct {
|
|||
|
|
DeviceIdentity string `json:"device_identity"`
|
|||
|
|
CanView bool `json:"can_view"`
|
|||
|
|
CanAlert bool `json:"can_alert"`
|
|||
|
|
CanControl bool `json:"can_control"`
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
type familyInviteInput struct {
|
|||
|
|
Name string `json:"name"`
|
|||
|
|
Phone string `json:"phone"`
|
|||
|
|
Relationship string `json:"relationship"`
|
|||
|
|
RequestNo string `json:"request_no"`
|
|||
|
|
Permissions []familyDevicePermissionInput `json:"device_permissions"`
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// validFamilyInvite 清理并校验邀请资料；设备授权必须至少包含查看权限。
|
|||
|
|
func validFamilyInvite(input *familyInviteInput) bool {
|
|||
|
|
input.Name, input.Phone, input.Relationship = strings.TrimSpace(input.Name), strings.TrimSpace(input.Phone), strings.TrimSpace(input.Relationship)
|
|||
|
|
parsed, err := uuid.Parse(input.RequestNo)
|
|||
|
|
if err != nil || parsed == uuid.Nil || parsed.String() != input.RequestNo || input.Name == "" || utf8.RuneCountInString(input.Name) > 64 || !common.ValidPhone(input.Phone) || utf8.RuneCountInString(input.Relationship) > 32 {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
for _, permission := range input.Permissions {
|
|||
|
|
if strings.TrimSpace(permission.DeviceIdentity) == "" || (permission.CanAlert || permission.CanControl) && !permission.CanView {
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return true
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func maskFamilyPhone(phone string) string {
|
|||
|
|
if len(phone) == 11 {
|
|||
|
|
return phone[:3] + "****" + phone[7:]
|
|||
|
|
}
|
|||
|
|
return "***"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// familyAudit 在业务事务内追加不可变审计记录。
|
|||
|
|
func familyAudit(tx *gorm.DB, ownerID, memberID, actorID uint64, action, summary string) error {
|
|||
|
|
return tx.Create(&models.UserFamilyAudit{Entity: models.Entity{Identity: models.NewIdentity(), Status: common.StatusEnable}, OwnerUserAccountID: ownerID, FamilyMemberID: memberID, ActorUserAccountID: actorID, Action: action, Summary: summary}).Error
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// familyMemberView 返回脱敏成员和当前设备授权，不暴露内部关联键。
|
|||
|
|
func familyMemberView(record models.UserFamilyMember, shares []models.UserDeviceShare, products map[uint64]models.ProductInfo) gin.H {
|
|||
|
|
permissions := make([]gin.H, 0, len(shares))
|
|||
|
|
for _, share := range shares {
|
|||
|
|
product, ok := products[share.ProductInfoID]
|
|||
|
|
if !ok || share.Status != common.StatusEnable {
|
|||
|
|
continue
|
|||
|
|
}
|
|||
|
|
permissions = append(permissions, gin.H{"device_identity": product.Identity, "device_name": product.Name, "device_kind": product.DeviceKind, "can_view": share.CanView, "can_alert": share.CanAlert, "can_control": share.CanControl})
|
|||
|
|
}
|
|||
|
|
return gin.H{"identity": record.Identity, "name": record.Name, "phone_masked": maskFamilyPhone(record.Phone), "relationship": record.Relationship, "invite_status": record.InviteStatus, "expires_at": record.ExpiresAt, "device_permissions": permissions}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// FamilyDashboard 返回本人作为房主的成员、设备和权限汇总。
|
|||
|
|
func FamilyDashboard(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var members []models.UserFamilyMember
|
|||
|
|
if err := impl.DBService.Where("owner_user_account_id = ? AND status = ? AND invite_status IN ?", account.ID, common.StatusEnable, []int{familyInvitePending, familyInviteAccepted}).Order("created_at, identity").Find(&members).Error; err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var devices []models.ProductInfo
|
|||
|
|
if err := ownedProductQuery(account.ID).Where("device_kind IN ? AND product_status <> ?", []string{"valve", "alarm"}, common.StatusScrapped).Order("created_at, identity").Find(&devices).Error; err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
memberIDs := make([]uint64, 0, len(members))
|
|||
|
|
for _, member := range members {
|
|||
|
|
memberIDs = append(memberIDs, member.ID)
|
|||
|
|
}
|
|||
|
|
var shares []models.UserDeviceShare
|
|||
|
|
if len(memberIDs) > 0 {
|
|||
|
|
if err := impl.DBService.Where("family_member_id IN ? AND status = ?", memberIDs, common.StatusEnable).Find(&shares).Error; err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
productMap := make(map[uint64]models.ProductInfo, len(devices))
|
|||
|
|
for _, device := range devices {
|
|||
|
|
productMap[device.ID] = device
|
|||
|
|
}
|
|||
|
|
sharesByMember := map[uint64][]models.UserDeviceShare{}
|
|||
|
|
shareCounts := map[uint64]int{}
|
|||
|
|
for _, share := range shares {
|
|||
|
|
sharesByMember[share.FamilyMemberID] = append(sharesByMember[share.FamilyMemberID], share)
|
|||
|
|
if share.CanView {
|
|||
|
|
shareCounts[share.ProductInfoID]++
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
memberViews := make([]gin.H, 0, len(members)+1)
|
|||
|
|
memberViews = append(memberViews, gin.H{"identity": account.Identity, "name": account.Name, "phone_masked": maskFamilyPhone(account.Phone), "relationship": "房主", "invite_status": familyInviteAccepted, "is_owner": true, "device_permissions": []gin.H{}})
|
|||
|
|
for _, member := range members {
|
|||
|
|
memberViews = append(memberViews, familyMemberView(member, sharesByMember[member.ID], productMap))
|
|||
|
|
}
|
|||
|
|
deviceViews := make([]gin.H, 0, len(devices))
|
|||
|
|
for _, device := range devices {
|
|||
|
|
deviceViews = append(deviceViews, gin.H{"identity": device.Identity, "name": device.Name, "kind": device.DeviceKind, "share_count": shareCounts[device.ID], "mapping_configured": device.VendorDeviceID != ""})
|
|||
|
|
}
|
|||
|
|
incoming, err := incomingFamilyInvitations(account)
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, gin.H{"household_name": account.Name + "的家", "owner_name": account.Name, "member_count": len(members), "device_count": len(deviceViews), "members": memberViews, "devices": deviceViews, "incoming_invitations": incoming})
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// incomingFamilyInvitations 读取当前手机号收到的有效邀请及房主名称。
|
|||
|
|
func incomingFamilyInvitations(account models.UserAccount) ([]gin.H, error) {
|
|||
|
|
var rows []models.UserFamilyMember
|
|||
|
|
if err := impl.DBService.Where("phone = ? AND status = ? AND invite_status = ? AND expires_at > ?", account.Phone, common.StatusEnable, familyInvitePending, time.Now()).Order("created_at desc").Find(&rows).Error; err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
ownerIDs := make([]uint64, 0, len(rows))
|
|||
|
|
for _, row := range rows {
|
|||
|
|
ownerIDs = append(ownerIDs, row.OwnerUserAccountID)
|
|||
|
|
}
|
|||
|
|
owners := map[uint64]string{}
|
|||
|
|
if len(ownerIDs) > 0 {
|
|||
|
|
var users []models.UserAccount
|
|||
|
|
if err := impl.DBService.Where("id IN ?", ownerIDs).Find(&users).Error; err != nil {
|
|||
|
|
return nil, err
|
|||
|
|
}
|
|||
|
|
for _, user := range users {
|
|||
|
|
owners[user.ID] = user.Name
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
items := make([]gin.H, 0, len(rows))
|
|||
|
|
for _, row := range rows {
|
|||
|
|
items = append(items, gin.H{"identity": row.Identity, "owner_name": owners[row.OwnerUserAccountID], "name": row.Name, "relationship": row.Relationship, "expires_at": row.ExpiresAt})
|
|||
|
|
}
|
|||
|
|
return items, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// InviteFamilyMember 创建七天有效邀请及预设权限；成员接受前不会获得访问权。
|
|||
|
|
func InviteFamilyMember(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var input familyInviteInput
|
|||
|
|
if ctx.ShouldBindJSON(&input) != nil || !validFamilyInvite(&input) {
|
|||
|
|
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
if input.Phone == account.Phone {
|
|||
|
|
infra.Response.Error(ctx, errFamilySelf)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var record models.UserFamilyMember
|
|||
|
|
err := impl.DBService.Transaction(func(tx *gorm.DB) error {
|
|||
|
|
if err := lockAddressOwner(tx, account.ID); err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if err := tx.Where("owner_user_account_id = ? AND request_no = ?", account.ID, input.RequestNo).First(&record).Error; err == nil {
|
|||
|
|
return nil
|
|||
|
|
} else if !errors.Is(err, gorm.ErrRecordNotFound) {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
var duplicate int64
|
|||
|
|
if err := tx.Model(&models.UserFamilyMember{}).Where("owner_user_account_id = ? AND phone = ? AND status = ? AND invite_status IN ?", account.ID, input.Phone, common.StatusEnable, []int{familyInvitePending, familyInviteAccepted}).Count(&duplicate).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if duplicate > 0 {
|
|||
|
|
return errFamilyDuplicate
|
|||
|
|
}
|
|||
|
|
record = models.UserFamilyMember{Entity: models.Entity{Identity: models.NewIdentity(), Status: common.StatusEnable}, OwnerUserAccountID: account.ID, Name: input.Name, Phone: input.Phone, Relationship: input.Relationship, InviteStatus: familyInvitePending, RequestNo: input.RequestNo, ExpiresAt: time.Now().Add(7 * 24 * time.Hour)}
|
|||
|
|
if err := tx.Create(&record).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if err := replaceFamilyPermissions(tx, account.ID, record.ID, input.Permissions); err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
return familyAudit(tx, account.ID, record.ID, account.ID, "invite", fmt.Sprintf("邀请%s，预设%d台设备权限", record.Name, len(input.Permissions)))
|
|||
|
|
})
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, gin.H{"identity": record.Identity, "invite_status": record.InviteStatus, "expires_at": record.ExpiresAt})
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// replaceFamilyPermissions 仅允许房主名下设备，空列表表示撤销全部设备授权。
|
|||
|
|
func replaceFamilyPermissions(tx *gorm.DB, ownerID, memberID uint64, inputs []familyDevicePermissionInput) error {
|
|||
|
|
if err := tx.Model(&models.UserDeviceShare{}).Where("family_member_id = ? AND status = ?", memberID, common.StatusEnable).Update("status", common.StatusArchived).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
seen := map[string]bool{}
|
|||
|
|
for _, input := range inputs {
|
|||
|
|
identity := strings.TrimSpace(input.DeviceIdentity)
|
|||
|
|
if seen[identity] {
|
|||
|
|
return errcode.ErrInvalidArgument
|
|||
|
|
}
|
|||
|
|
seen[identity] = true
|
|||
|
|
var product models.ProductInfo
|
|||
|
|
if err := tx.Where("identity = ? AND user_account_id = ? AND status = ? AND device_kind IN ? AND product_status <> ?", identity, ownerID, common.StatusEnable, []string{"valve", "alarm"}, common.StatusScrapped).First(&product).Error; err != nil {
|
|||
|
|
return errcode.ErrPermissionDenied
|
|||
|
|
}
|
|||
|
|
share := models.UserDeviceShare{Entity: models.Entity{Identity: models.NewIdentity(), Status: common.StatusEnable}, FamilyMemberID: memberID, ProductInfoID: product.ID, CanView: input.CanView, CanAlert: input.CanAlert, CanControl: input.CanControl}
|
|||
|
|
if err := tx.Clauses(clause.OnConflict{Columns: []clause.Column{{Name: "family_member_id"}, {Name: "product_info_id"}}, DoUpdates: clause.Assignments(map[string]interface{}{"status": common.StatusEnable, "can_view": input.CanView, "can_alert": input.CanAlert, "can_control": input.CanControl, "updated_at": time.Now()})}).Create(&share).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// UpdateFamilyPermissions 调整成员设备范围，权限立即生效并写入审计。
|
|||
|
|
func UpdateFamilyPermissions(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var input struct {
|
|||
|
|
Permissions []familyDevicePermissionInput `json:"device_permissions"`
|
|||
|
|
}
|
|||
|
|
if ctx.ShouldBindJSON(&input) != nil {
|
|||
|
|
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
for _, permission := range input.Permissions {
|
|||
|
|
if strings.TrimSpace(permission.DeviceIdentity) == "" || (permission.CanAlert || permission.CanControl) && !permission.CanView {
|
|||
|
|
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
err := impl.DBService.Transaction(func(tx *gorm.DB) error {
|
|||
|
|
var member models.UserFamilyMember
|
|||
|
|
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ? AND owner_user_account_id = ? AND status = ? AND invite_status IN ?", ctx.Param("identity"), account.ID, common.StatusEnable, []int{familyInvitePending, familyInviteAccepted}).First(&member).Error; err != nil {
|
|||
|
|
return errcode.ErrRecordNotFound
|
|||
|
|
}
|
|||
|
|
if err := replaceFamilyPermissions(tx, account.ID, member.ID, input.Permissions); err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
return familyAudit(tx, account.ID, member.ID, account.ID, "update_permissions", fmt.Sprintf("调整%s的设备权限，共%d台", member.Name, len(input.Permissions)))
|
|||
|
|
})
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, gin.H{"updated": true})
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// RevokeFamilyMember 撤销邀请或移除成员，同时停用其全部设备授权。
|
|||
|
|
func RevokeFamilyMember(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
err := impl.DBService.Transaction(func(tx *gorm.DB) error {
|
|||
|
|
var member models.UserFamilyMember
|
|||
|
|
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ? AND owner_user_account_id = ? AND status = ? AND invite_status IN ?", ctx.Param("identity"), account.ID, common.StatusEnable, []int{familyInvitePending, familyInviteAccepted}).First(&member).Error; err != nil {
|
|||
|
|
return errcode.ErrRecordNotFound
|
|||
|
|
}
|
|||
|
|
now := time.Now()
|
|||
|
|
if err := tx.Model(&member).Updates(map[string]interface{}{"invite_status": familyInviteRevoked, "revoked_at": now, "status": common.StatusArchived}).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if err := tx.Model(&models.UserDeviceShare{}).Where("family_member_id = ? AND status = ?", member.ID, common.StatusEnable).Update("status", common.StatusArchived).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
return familyAudit(tx, account.ID, member.ID, account.ID, "revoke", "撤销成员"+member.Name)
|
|||
|
|
})
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, gin.H{"revoked": true})
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ListFamilyInvitations 返回当前手机号尚未过期的邀请。
|
|||
|
|
func ListFamilyInvitations(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
items, err := incomingFamilyInvitations(account)
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, items)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// RespondFamilyInvitation 仅受邀手机号本人可接受或拒绝邀请。
|
|||
|
|
func RespondFamilyInvitation(ctx *gin.Context) {
|
|||
|
|
account, ok := common.UserAccount(ctx)
|
|||
|
|
if !ok {
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
var input struct {
|
|||
|
|
Accept bool `json:"accept"`
|
|||
|
|
}
|
|||
|
|
if ctx.ShouldBindJSON(&input) != nil {
|
|||
|
|
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
err := impl.DBService.Transaction(func(tx *gorm.DB) error {
|
|||
|
|
var member models.UserFamilyMember
|
|||
|
|
if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ? AND phone = ? AND status = ? AND invite_status = ?", ctx.Param("identity"), account.Phone, common.StatusEnable, familyInvitePending).First(&member).Error; err != nil {
|
|||
|
|
return errcode.ErrRecordNotFound
|
|||
|
|
}
|
|||
|
|
if time.Now().After(member.ExpiresAt) {
|
|||
|
|
return errFamilyExpired
|
|||
|
|
}
|
|||
|
|
status, action := familyInviteRejected, "reject"
|
|||
|
|
updates := map[string]interface{}{"invite_status": status, "status": common.StatusArchived}
|
|||
|
|
if input.Accept {
|
|||
|
|
status, action = familyInviteAccepted, "accept"
|
|||
|
|
now := time.Now()
|
|||
|
|
updates = map[string]interface{}{"invite_status": status, "member_user_account_id": account.ID, "accepted_at": now}
|
|||
|
|
}
|
|||
|
|
if err := tx.Model(&member).Updates(updates).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
if !input.Accept {
|
|||
|
|
if err := tx.Model(&models.UserDeviceShare{}).Where("family_member_id = ?", member.ID).Update("status", common.StatusArchived).Error; err != nil {
|
|||
|
|
return err
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
return familyAudit(tx, member.OwnerUserAccountID, member.ID, account.ID, action, "成员响应家庭邀请")
|
|||
|
|
})
|
|||
|
|
if err != nil {
|
|||
|
|
infra.Response.Error(ctx, err)
|
|||
|
|
return
|
|||
|
|
}
|
|||
|
|
infra.Response.Success(ctx, gin.H{"accepted": input.Accept})
|
|||
|
|
}
|