fix(admin): standardize resource initialization and lists

backend/api/internal/logic/common/resource.go

@@ -242,6 +242,7 @@ func PrepareResourceValues(ctx *gin.Context, model any, allowedFields []string,
 	if err := ctx.ShouldBindJSON(&input); err != nil || len(input) == 0 {
 		return nil, errors.New("invalid resource payload")
 	}
+	stripClientManagedCreateFields(input)
 	values, err := ResolveResourceRelations(input, allowedFields, relations, true)
 	if err != nil || len(values) == 0 {
 		return nil, errors.New("invalid resource payload")
@@ -249,6 +250,13 @@ func PrepareResourceValues(ctx *gin.Context, model any, allowedFields []string,
 	return values, nil
 }
 
+// stripClientManagedCreateFields ensures database IDs and public identities are
+// always generated by the logic layer for newly created records.
+func stripClientManagedCreateFields(input map[string]any) {
+	delete(input, "id")
+	delete(input, "identity")
+}
+
 // ValidateResourceValues enforces invariants that database nullability and
 // frontend form metadata cannot express.
 func ValidateResourceValues(model any, values map[string]any, creating bool) error {

backend/api/internal/logic/common/resource_test.go

@@ -7,6 +7,7 @@ import (
 
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
 	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
 	"gorm.io/gorm"
 )
@@ -18,6 +19,32 @@ func TestFilterFieldsKeepsOnlyAllowedKeys(t *testing.T) {
 	}
 }
 
+func TestStripClientManagedCreateFields(t *testing.T) {
+	input := map[string]any{"id": float64(99), "identity": "client-value", "name": "气站"}
+	stripClientManagedCreateFields(input)
+	if _, exists := input["id"]; exists {
+		t.Fatal("client supplied database ID was retained")
+	}
+	if _, exists := input["identity"]; exists {
+		t.Fatal("client supplied identity was retained")
+	}
+	if input["name"] != "气站" {
+		t.Fatalf("business fields changed: %#v", input)
+	}
+}
+
+func TestNewEntityGeneratesUUIDV7Identity(t *testing.T) {
+	first := NewEntity(StatusDraft)
+	second := NewEntity(StatusDraft)
+	if first.Identity == second.Identity {
+		t.Fatal("generated identities must be unique")
+	}
+	parsed, err := uuid.Parse(first.Identity)
+	if err != nil || parsed.Version() != 7 {
+		t.Fatalf("identity = %q, want UUID V7", first.Identity)
+	}
+}
+
 func TestOperationalQueriesExcludeArchivedRecords(t *testing.T) {
 	sqlDatabase, _, err := sqlmock.New()
 	if err != nil {