platforms/backend/api/internal/initdb/platform.go

package initdb

import (
	"errors"
	"os"

	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

const (
	// PlatformRootUsername 是平台总后台的内置根账号名称。
	PlatformRootUsername = "root"
	// PlatformRootPassword 是仅用于首次启动的初始密码，首次登录后必须修改。
	PlatformRootPassword = "Heqi@Root2026"
	// PlatformRootRoleCode 表示根账号的平台角色。
	PlatformRootRoleCode = "root"
)

// InitPlatformAccess 幂等初始化 root 角色、菜单和 root 的全菜单授权。
func InitPlatformAccess(database *gorm.DB) error {
	rootRole := models.PlatformRole{
		Entity:    models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1},
		RoleCode:  PlatformRootRoleCode,
		Name:      "系统管理员",
		DataScope: "global",
		IsSystem:  true,
	}
	if err := database.Where("role_code = ?", rootRole.RoleCode).FirstOrCreate(&rootRole).Error; err != nil {
		return err
	}

	menus := []models.PlatformMenu{
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "dashboard", Name: "工作台", Icon: "icon-dashboard", Path: "/dashboard", SortNo: 10},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "gas", Name: "可燃气体站管理", Icon: "icon-fire", Path: "/gas/basic", SortNo: 20},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "delivery", Name: "配送管理", Icon: "icon-car", Path: "/delivery/basic", SortNo: 30},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "staff", Name: "服务人员", Icon: "icon-user", Path: "/staff/list", SortNo: 40},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "user", Name: "业主客户", Icon: "icon-user-group", Path: "/user/list", SortNo: 50},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "device", Name: "设备管理", Icon: "icon-storage", Path: "/device", SortNo: 60},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "ec", Name: "电商管理", Icon: "icon-shopping", Path: "/ec/product", SortNo: 80},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "finance", Name: "财务管理", Icon: "icon-safe", Path: "/finance/payment", SortNo: 90},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "wallet", Name: "钱包中心", Icon: "icon-wallet", Path: "/wallet/list", SortNo: 100},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "content", Name: "内容管理", Icon: "icon-file", Path: "/content", SortNo: 120},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "customer_service", Name: "客户服务", Icon: "icon-customer-service", Path: "/customer_service", SortNo: 140},
		{Entity: models.Entity{Identity: models.NewIdentity(), Status: "enabled", Version: 1}, MenuCode: "platform", Name: "平台配置", Icon: "icon-settings", Path: "/platform/account", SortNo: 160},
	}
	for index := range menus {
		menu := menus[index]
		if err := database.Where("menu_code = ?", menu.MenuCode).FirstOrCreate(&menu).Error; err != nil {
			return err
		}
		relation := models.PlatformRoleMenu{PlatformRoleID: rootRole.ID, PlatformMenuID: menu.ID}
		if err := database.Where("platform_role_id = ? AND platform_menu_id = ?", rootRole.ID, menu.ID).FirstOrCreate(&relation).Error; err != nil {
			return err
		}
	}
	return nil
}

// InitPlatformRoot 幂等创建平台总后台 root 账号。
func InitPlatformRoot(database *gorm.DB) error {
	var account models.PlatformAccount
	err := database.Where("username = ?", PlatformRootUsername).First(&account).Error
	if err == nil {
		return nil
	}
	if !errors.Is(err, gorm.ErrRecordNotFound) {
		return err
	}

	passwordHash, err := bcrypt.GenerateFromPassword([]byte(platformRootPassword()), bcrypt.DefaultCost)
	if err != nil {
		return err
	}

	account = models.PlatformAccount{
		Entity:           models.Entity{Identity: models.NewIdentity(), Status: "enabled"},
		Username:         PlatformRootUsername,
		DisplayName:      "平台根管理员",
		PasswordHash:     string(passwordHash),
		PlatformRoleCode: PlatformRootRoleCode,
		Phone:            "",
	}
	return database.Create(&account).Error
}

// platformRootPassword 优先读取部署环境传入的 root 初始密码。
func platformRootPassword() string {
	if password := os.Getenv("HEQI_PLATFORM_ROOT_PASSWORD"); len(password) >= 12 {
		return password
	}
	return PlatformRootPassword
}