refactor platform logic modules

backend/api/internal/logic/platform/dashboard/dashboard.go

@@ -1,4 +1,4 @@
-package platform
+package dashboard
 
 import (
 	"git.apinb.com/bsm-sdk/core/infra"

backend/api/internal/logic/platform/dashboard/dashboard_test.go

@@ -1,4 +1,4 @@
-package platform
+package dashboard
 
 import (
 	"regexp"
@@ -9,7 +9,7 @@ import (
 )
 
 func TestDashboardOverviewReturnsZeroValuesForAnEmptyDatabase(t *testing.T) {
-	_, mock := setupPlatformRoleDatabase(t)
+	_, mock := setupDashboardDatabase(t)
 	for _, query := range []string{
 		`SELECT count\(\*\) FROM "gas_basic" WHERE status = \$1`,
 		`SELECT count\(\*\) FROM "delivery_basic" WHERE status = \$1`,
@@ -26,5 +26,5 @@ func TestDashboardOverviewReturnsZeroValuesForAnEmptyDatabase(t *testing.T) {
 	if overview != (models.DashboardOverview{}) {
 		t.Fatalf("empty dashboard = %#v, want zero values", overview)
 	}
-	assertMockExpectations(t, mock)
+	assertDashboardMockExpectations(t, mock)
 }

backend/api/internal/logic/platform/dashboard/test_helpers_test.go

@@ -1,4 +1,4 @@
-package platform
+package dashboard
 
 import (
 	"testing"
@@ -9,7 +9,7 @@ import (
 	"gorm.io/gorm"
 )
 
-func setupPlatformRoleDatabase(t *testing.T) (*gorm.DB, sqlmock.Sqlmock) {
+func setupDashboardDatabase(t *testing.T) (*gorm.DB, sqlmock.Sqlmock) {
 	t.Helper()
 	previous := impl.DBService
 	sqlDatabase, mock, err := sqlmock.New()
@@ -28,7 +28,7 @@ func setupPlatformRoleDatabase(t *testing.T) (*gorm.DB, sqlmock.Sqlmock) {
 	return database, mock
 }
 
-func assertMockExpectations(t *testing.T, mock sqlmock.Sqlmock) {
+func assertDashboardMockExpectations(t *testing.T, mock sqlmock.Sqlmock) {
 	t.Helper()
 	if err := mock.ExpectationsWereMet(); err != nil {
 		t.Fatal(err)

backend/api/internal/logic/platform/delivery/account.go

@@ -0,0 +1,65 @@
+package delivery
+
+import (
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+)
+
+type accountRequest struct {
+	Username              string `json:"username" binding:"required,max=64"`
+	Password              string `json:"password" binding:"required,min=8,max=128"`
+	DisplayName           string `json:"display_name" binding:"max=64"`
+	RoleCode              string `json:"role_code" binding:"max=64"`
+	DeliveryBasicIdentity string `json:"delivery_basic_identity"`
+}
+
+type accountUpdateRequest struct {
+	DisplayName           string `json:"display_name" binding:"max=64"`
+	RoleCode              string `json:"role_code" binding:"max=64"`
+	DeliveryBasicIdentity string `json:"delivery_basic_identity"`
+}
+
+func ListDeliveryAccount(ctx *gin.Context) { common.ListPage[models.DeliveryAccount](ctx) }
+func GetDeliveryAccount(ctx *gin.Context)  { common.GetByIdentity[models.DeliveryAccount](ctx) }
+
+func CreateDeliveryAccount(ctx *gin.Context) {
+	var request accountRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, true)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	hash, err := common.PasswordHash(request.Password)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	account := models.DeliveryAccount{Entity: common.NewEntity("enabled"), DeliveryBasicID: deliveryBasicID, Username: request.Username, DisplayName: request.DisplayName, PasswordHash: hash, RoleCode: request.RoleCode}
+	if err := impl.DBService.Create(&account).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	common.RespondCreatedResource(ctx, account)
+}
+
+func UpdateDeliveryAccount(ctx *gin.Context) {
+	var request accountUpdateRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, true)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.DeliveryAccount{}, gin.H{"delivery_basic_id": deliveryBasicID, "display_name": request.DisplayName, "role_code": request.RoleCode}, []string{"delivery_basic_id", "display_name", "role_code"})
+}

backend/api/internal/logic/platform/delivery/delivery.go

@@ -1,4 +1,4 @@
-package platform
+package delivery
 
 import (
 	"git.apinb.com/bsm-sdk/core/errcode"

backend/api/internal/logic/platform/ec/ec.go

@@ -1,4 +1,4 @@
-package platform
+package ec
 
 import (
 	"git.apinb.com/bsm-sdk/core/infra"

backend/api/internal/logic/platform/ec/order.go

@@ -1,4 +1,4 @@
-package platform
+package ec
 
 import (
 	"git.apinb.com/bsm-sdk/core/infra"

backend/api/internal/logic/platform/fin/fin.go

@@ -1,4 +1,4 @@
-package platform
+package fin
 
 import (
 	"bytes"

backend/api/internal/logic/platform/gas/account.go

@@ -1,4 +1,4 @@
-package platform
+package gas
 
 import (
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -7,7 +7,6 @@ import (
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
 	"github.com/gin-gonic/gin"
-	"golang.org/x/crypto/bcrypt"
 )
 
 type accountRequest struct {
@@ -26,11 +25,6 @@ type accountUpdateRequest struct {
 	DeliveryBasicIdentity string `json:"delivery_basic_identity"`
 }
 
-func passwordHash(password string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	return string(hash), err
-}
-
 func ListGasAccount(ctx *gin.Context) { common.ListPage[models.GasAccount](ctx) }
 func GetGasAccount(ctx *gin.Context)  { common.GetByIdentity[models.GasAccount](ctx) }
 
@@ -45,7 +39,7 @@ func CreateGasAccount(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	hash, err := passwordHash(request.Password)
+	hash, err := common.PasswordHash(request.Password)
 	if err != nil {
 		infra.Response.Error(ctx, err)
 		return
@@ -71,44 +65,3 @@ func UpdateGasAccount(ctx *gin.Context) {
 	}
 	common.UpdateAllowedByIdentity(ctx, &models.GasAccount{}, gin.H{"gas_basic_id": gasBasicID, "display_name": request.DisplayName, "role_code": request.RoleCode}, []string{"gas_basic_id", "display_name", "role_code"})
 }
-
-func ListDeliveryAccount(ctx *gin.Context) { common.ListPage[models.DeliveryAccount](ctx) }
-func GetDeliveryAccount(ctx *gin.Context)  { common.GetByIdentity[models.DeliveryAccount](ctx) }
-
-func CreateDeliveryAccount(ctx *gin.Context) {
-	var request accountRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	hash, err := passwordHash(request.Password)
-	if err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	account := models.DeliveryAccount{Entity: common.NewEntity("enabled"), DeliveryBasicID: deliveryBasicID, Username: request.Username, DisplayName: request.DisplayName, PasswordHash: hash, RoleCode: request.RoleCode}
-	if err := impl.DBService.Create(&account).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	common.RespondCreatedResource(ctx, account)
-}
-
-func UpdateDeliveryAccount(ctx *gin.Context) {
-	var request accountUpdateRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.DeliveryAccount{}, gin.H{"delivery_basic_id": deliveryBasicID, "display_name": request.DisplayName, "role_code": request.RoleCode}, []string{"delivery_basic_id", "display_name", "role_code"})
-}

backend/api/internal/logic/platform/gas/gas.go

@@ -1,4 +1,4 @@
-package platform
+package gas
 
 import (
 	"git.apinb.com/bsm-sdk/core/errcode"

backend/api/internal/logic/platform/gasorder/gasorder.go

@@ -1,4 +1,4 @@
-package platform
+package gasorder
 
 import (
 	"errors"
@@ -212,7 +212,7 @@ func RenewGasorderContract(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var contract models.GasorderContract
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ?", ctx.Param("identity")).First(&contract).Error; err != nil {
@@ -242,7 +242,7 @@ func changeGasorderContract(ctx *gin.Context, action, target string) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var contract models.GasorderContract
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ?", ctx.Param("identity")).First(&contract).Error; err != nil {
@@ -363,7 +363,7 @@ func CreateGasorderBasic(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	var order models.GasorderBasic
 	err = impl.DBService.Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("request_no = ?", request.RequestNo).First(&order).Error; err == nil {
@@ -472,7 +472,7 @@ func AssignGasorderBasic(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var order models.GasorderBasic
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ?", ctx.Param("identity")).First(&order).Error; err != nil {
@@ -530,7 +530,7 @@ func GasorderRecover(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var order models.GasorderBasic
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ?", ctx.Param("identity")).First(&order).Error; err != nil {
@@ -560,7 +560,7 @@ func transitionGasorder(ctx *gin.Context, target string, allowed map[string]bool
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var order models.GasorderBasic
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("identity = ?", ctx.Param("identity")).First(&order).Error; err != nil {

backend/api/internal/logic/platform/gasorder/gasorder_test.go

@@ -1,4 +1,4 @@
-package platform
+package gasorder
 
 import (
 	"testing"

backend/api/internal/logic/platform/platform.go

@@ -1,509 +0,0 @@
-package platform
-
-import (
-	"errors"
-	"strings"
-
-	"git.apinb.com/bsm-sdk/core/errcode"
-	"git.apinb.com/bsm-sdk/core/infra"
-	"git.apinb.com/bsm-sdk/core/middleware"
-	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
-	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
-	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
-	"github.com/gin-gonic/gin"
-	"golang.org/x/crypto/bcrypt"
-	"gorm.io/gorm"
-)
-
-var errSystemPlatformRole = errors.New("system platform roles cannot be modified")
-
-const platformMenusContextKey = "platform_authorized_menus"
-
-func platformMenuAllowsPath(menus []models.PlatformMenu, requestPath string) bool {
-	marker := "/platform/v1/"
-	index := strings.Index(requestPath, marker)
-	if index < 0 {
-		return false
-	}
-	relative := strings.Trim(requestPath[index+len(marker):], "/")
-	resource := strings.Split(relative, "/")[0]
-	domain := platformRouteDomain(resource)
-	for _, menu := range menus {
-		if menu.MenuCode == domain {
-			return true
-		}
-		menuPath := strings.Trim(menu.Path, "/")
-		if menuPath != "" && strings.Split(menuPath, "/")[0] == domain {
-			return true
-		}
-	}
-	return false
-}
-
-func platformRouteDomain(resource string) string {
-	prefix := strings.Split(resource, "_")[0]
-	switch prefix {
-	case "product":
-		return "device"
-	case "gasorder":
-		return "delivery"
-	case "fin":
-		return "finance"
-	case "cms":
-		return "content"
-	case "cs":
-		return "customer_service"
-	case "platform":
-		return "platform"
-	default:
-		return prefix
-	}
-}
-
-// RequirePlatformMenuAccess enforces role-menu authorization after JWT authentication.
-func RequirePlatformMenuAccess() gin.HandlerFunc {
-	return func(ctx *gin.Context) {
-		if strings.Contains(ctx.Request.URL.Path, "/platform/v1/auth/") {
-			ctx.Next()
-			return
-		}
-		claims, err := middleware.ParseAuth(ctx)
-		if err != nil {
-			infra.Response.Error(ctx, err)
-			ctx.Abort()
-			return
-		}
-		if claims.Role == "root" {
-			ctx.Next()
-			return
-		}
-		menus, err := common.LoadPlatformMenus(claims.Role)
-		if err != nil || !platformMenuAllowsPath(menus, ctx.Request.URL.Path) {
-			infra.Response.Error(ctx, errcode.ErrPermissionDenied)
-			ctx.Abort()
-			return
-		}
-		ctx.Set(platformMenusContextKey, menus)
-		ctx.Next()
-	}
-}
-
-// ListPlatformRole 查询平台角色分页列表。
-func ListPlatformRole(ctx *gin.Context) { common.ListPage[models.PlatformRole](ctx) }
-
-// GetPlatformRole 查询一个平台角色。
-func GetPlatformRole(ctx *gin.Context) { common.GetByIdentity[models.PlatformRole](ctx) }
-
-// CreatePlatformRole 创建非内置平台角色。
-func CreatePlatformRole(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request models.PlatformRole
-	if err := ctx.ShouldBindJSON(&request); err != nil || request.RoleCode == "" || request.Name == "" || request.RoleCode == "root" {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	request.Entity = common.NewEntity("enabled")
-	request.IsSystem = false
-	if request.DataScope == "" {
-		request.DataScope = "global"
-	}
-	if err := impl.DBService.Create(&request).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	common.RespondCreatedResource(ctx, request)
-}
-
-// UpdatePlatformRole 更新非内置平台角色。
-func UpdatePlatformRole(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request struct {
-		Name      string `json:"name" binding:"required,max=64"`
-		DataScope string `json:"data_scope" binding:"required,max=32"`
-	}
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	var role models.PlatformRole
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	if role.IsSystem {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"name": request.Name, "data_scope": request.DataScope}, []string{"name", "data_scope"})
-}
-
-type platformMenuRequest struct {
-	ParentIdentity string `json:"parent_identity"`
-	MenuCode       string `json:"menu_code" binding:"required,max=64"`
-	Name           string `json:"name" binding:"required,max=64"`
-	Icon           string `json:"icon" binding:"max=64"`
-	Path           string `json:"path" binding:"max=255"`
-	SortNo         int    `json:"sort_no"`
-}
-
-type platformMenuView struct {
-	Identity       string `json:"identity"`
-	ParentIdentity string `json:"parent_identity,omitempty"`
-	MenuCode       string `json:"menu_code"`
-	Name           string `json:"name"`
-	Icon           string `json:"icon"`
-	Path           string `json:"path"`
-	SortNo         int    `json:"sort_no"`
-	Status         string `json:"status"`
-}
-
-func platformMenuViews(list []models.PlatformMenu) []platformMenuView {
-	identities := make(map[uint64]string, len(list))
-	for _, item := range list {
-		identities[item.ID] = item.Identity
-	}
-	views := make([]platformMenuView, 0, len(list))
-	for _, item := range list {
-		views = append(views, platformMenuView{Identity: item.Identity, ParentIdentity: identities[item.ParentID], MenuCode: item.MenuCode, Name: item.Name, Icon: item.Icon, Path: item.Path, SortNo: item.SortNo, Status: item.Status})
-	}
-	return views
-}
-
-func GetPlatformMenu(ctx *gin.Context) {
-	var menu models.PlatformMenu
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&menu).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	list := []models.PlatformMenu{menu}
-	if menu.ParentID != 0 {
-		var parent models.PlatformMenu
-		if err := impl.DBService.Select("id", "identity").First(&parent, menu.ParentID).Error; err == nil {
-			list = append(list, parent)
-		}
-	}
-	views := platformMenuViews(list)
-	infra.Response.Success(ctx, views[0])
-}
-
-func CreatePlatformMenu(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request platformMenuRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	menu := models.PlatformMenu{Entity: common.NewEntity("enabled"), ParentID: parentID, MenuCode: request.MenuCode, Name: request.Name, Icon: request.Icon, Path: request.Path, SortNo: request.SortNo}
-	if err := impl.DBService.Create(&menu).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	common.RespondCreatedResource(ctx, menu)
-}
-
-func UpdatePlatformMenu(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request platformMenuRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.PlatformMenu{}, gin.H{"parent_id": parentID, "name": request.Name, "icon": request.Icon, "path": request.Path, "sort_no": request.SortNo}, []string{"parent_id", "name", "icon", "path", "sort_no"})
-}
-
-func UpdatePlatformMenuStatus(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	common.UpdateRecordStatus(ctx, &models.PlatformMenu{})
-}
-
-func ArchivePlatformMenu(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	common.ArchiveRecord(ctx, &models.PlatformMenu{})
-}
-
-type platformRoleMenusRequest struct {
-	MenuIdentities []string `json:"menu_identities"`
-}
-
-// ReplacePlatformRoleMenus replaces every menu assignment for a role atomically.
-func ReplacePlatformRoleMenus(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request platformRoleMenusRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	if err := impl.DBService.Transaction(func(transaction *gorm.DB) error {
-		var role models.PlatformRole
-		if err := transaction.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
-			return err
-		}
-		if role.IsSystem {
-			return errSystemPlatformRole
-		}
-		var menus []models.PlatformMenu
-		if len(request.MenuIdentities) > 0 {
-			if err := transaction.Where("identity IN ?", request.MenuIdentities).Find(&menus).Error; err != nil {
-				return err
-			}
-			if len(menus) != len(request.MenuIdentities) {
-				return gorm.ErrRecordNotFound
-			}
-		}
-		if err := transaction.Where("platform_role_id = ?", role.ID).Delete(&models.PlatformRoleMenu{}).Error; err != nil {
-			return err
-		}
-		for _, menu := range menus {
-			relation := models.PlatformRoleMenu{PlatformRoleID: role.ID, PlatformMenuID: menu.ID}
-			if err := transaction.Create(&relation).Error; err != nil {
-				return err
-			}
-		}
-		return nil
-	}); err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			infra.Response.Error(ctx, errcode.ErrRecordNotFound)
-			return
-		}
-		if errors.Is(err, errSystemPlatformRole) {
-			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-			return
-		}
-		infra.Response.Error(ctx, err)
-		return
-	}
-	infra.Response.Success(ctx, gin.H{"updated": true})
-}
-
-// ListPlatformRoleMenuIdentities returns the current assignment for the role editor.
-func ListPlatformRoleMenuIdentities(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var role models.PlatformRole
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	var identities []string
-	if err := impl.DBService.Model(&models.PlatformMenu{}).
-		Joins("JOIN platform_role_menu ON platform_role_menu.platform_menu_id = platform_menu.id").
-		Where("platform_role_menu.platform_role_id = ?", role.ID).
-		Order("platform_menu.sort_no asc, platform_menu.id asc").
-		Pluck("platform_menu.identity", &identities).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	infra.Response.Success(ctx, gin.H{"menu_identities": identities})
-}
-
-// UpdatePlatformRoleStatus 更新非内置平台角色状态，系统角色始终受保护。
-func UpdatePlatformRoleStatus(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request struct {
-		Status string `json:"status" binding:"required,max=32"`
-	}
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	var role models.PlatformRole
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	if role.IsSystem {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": request.Status}, []string{"status"})
-}
-
-// ArchivePlatformRole 归档非内置平台角色，系统角色始终受保护。
-func ArchivePlatformRole(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var role models.PlatformRole
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	if role.IsSystem {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "archived"}, []string{"status"})
-}
-
-// ListPlatformMenu 返回菜单树构建所需的有序菜单列表。
-func ListPlatformMenu(ctx *gin.Context) {
-	claims, err := middleware.ParseAuth(ctx)
-	if err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	list, err := common.LoadPlatformMenus(claims.Role)
-	if err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	infra.Response.Success(ctx, gin.H{"total": len(list), "list": platformMenuViews(list)})
-}
-
-// ListPlatformAccount 查询平台账号列表，手机号在展示层脱敏。
-func ListPlatformAccount(ctx *gin.Context) {
-	page, size := common.PageSize(ctx)
-	var list []models.PlatformAccount
-	var total int64
-	query := common.ApplyKeywordFilter(ctx, impl.DBService.Model(&models.PlatformAccount{}), &models.PlatformAccount{})
-	if err := query.Count(&total).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	if err := query.Order("created_at desc").Offset((page - 1) * size).Limit(size).Find(&list).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	views := make([]map[string]any, 0, len(list))
-	for _, item := range list {
-		view := platformAccountView(item)
-		common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view)
-		views = append(views, view)
-	}
-	infra.Response.Success(ctx, gin.H{"total": total, "list": views})
-}
-
-type platformAccountRequest struct {
-	Username         string `json:"username" binding:"required,max=64"`
-	Password         string `json:"password" binding:"required,min=8,max=128"`
-	DisplayName      string `json:"display_name" binding:"max=64"`
-	Avatar           string `json:"avatar" binding:"max=512"`
-	PlatformRoleCode string `json:"platform_role_code" binding:"required,max=64"`
-	Phone            string `json:"phone" binding:"max=32"`
-}
-
-func platformAccountView(account models.PlatformAccount) map[string]any {
-	return map[string]any{
-		"identity": account.Identity, "username": account.Username,
-		"display_name": account.DisplayName, "avatar": account.Avatar, "phone": account.Phone,
-		"platform_role_code": account.PlatformRoleCode, "status": account.Status,
-	}
-}
-
-func GetPlatformAccount(ctx *gin.Context) {
-	var account models.PlatformAccount
-	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&account).Error; err != nil {
-		common.RespondRecordError(ctx, err)
-		return
-	}
-	view := platformAccountView(account)
-	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
-}
-
-func CreatePlatformAccount(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	var request platformAccountRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	if !isAssignablePlatformRole(request.PlatformRoleCode) {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	hash, err := platformPasswordHash(request.Password)
-	if err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	account := models.PlatformAccount{Entity: common.NewEntity("enabled"), Username: request.Username, DisplayName: request.DisplayName, Avatar: request.Avatar, PasswordHash: hash, PlatformRoleCode: request.PlatformRoleCode, Phone: request.Phone}
-	if err := impl.DBService.Create(&account).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	view := platformAccountView(account)
-	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
-}
-
-func UpdatePlatformAccount(ctx *gin.Context) {
-	var request struct {
-		DisplayName      string  `json:"display_name" binding:"max=64"`
-		Avatar           string  `json:"avatar" binding:"max=512"`
-		PlatformRoleCode *string `json:"platform_role_code" binding:"omitempty,max=64"`
-		Phone            string  `json:"phone" binding:"max=32"`
-	}
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	values := gin.H{"display_name": request.DisplayName, "avatar": request.Avatar, "phone": request.Phone}
-	if request.PlatformRoleCode != nil {
-		if !common.RequirePlatformRoot(ctx) {
-			return
-		}
-		if !isAssignablePlatformRole(*request.PlatformRoleCode) {
-			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-			return
-		}
-		values["platform_role_code"] = *request.PlatformRoleCode
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.PlatformAccount{}, values, []string{"display_name", "avatar", "platform_role_code", "phone"})
-}
-
-// UpdatePlatformAccountStatus updates a platform account lifecycle state.
-func UpdatePlatformAccountStatus(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	common.UpdateRecordStatus(ctx, &models.PlatformAccount{})
-}
-
-// ArchivePlatformAccount archives a platform account without deleting audit history.
-func ArchivePlatformAccount(ctx *gin.Context) {
-	if !common.RequirePlatformRoot(ctx) {
-		return
-	}
-	common.ArchiveRecord(ctx, &models.PlatformAccount{})
-}
-
-func platformPasswordHash(password string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	return string(hash), err
-}
-
-func isAssignablePlatformRole(roleCode string) bool {
-	if roleCode == "" || roleCode == "root" {
-		return false
-	}
-	var role models.PlatformRole
-	return impl.DBService.Where("role_code = ? AND status = ? AND is_system = ?", roleCode, "enabled", false).First(&role).Error == nil
-}

backend/api/internal/logic/platform/platform/access.go

@@ -0,0 +1,82 @@
+package platform
+
+import (
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/middleware"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+	"strings"
+)
+
+const platformMenusContextKey = "platform_authorized_menus"
+
+func platformMenuAllowsPath(menus []models.PlatformMenu, requestPath string) bool {
+	marker := "/platform/v1/"
+	index := strings.Index(requestPath, marker)
+	if index < 0 {
+		return false
+	}
+	relative := strings.Trim(requestPath[index+len(marker):], "/")
+	resource := strings.Split(relative, "/")[0]
+	domain := platformRouteDomain(resource)
+	for _, menu := range menus {
+		if menu.MenuCode == domain {
+			return true
+		}
+		menuPath := strings.Trim(menu.Path, "/")
+		if menuPath != "" && strings.Split(menuPath, "/")[0] == domain {
+			return true
+		}
+	}
+	return false
+}
+
+func platformRouteDomain(resource string) string {
+	prefix := strings.Split(resource, "_")[0]
+	switch prefix {
+	case "product":
+		return "device"
+	case "gasorder":
+		return "delivery"
+	case "fin":
+		return "finance"
+	case "cms":
+		return "content"
+	case "cs":
+		return "customer_service"
+	case "platform":
+		return "platform"
+	default:
+		return prefix
+	}
+}
+
+// RequirePlatformMenuAccess enforces role-menu authorization after JWT authentication.
+func RequirePlatformMenuAccess() gin.HandlerFunc {
+	return func(ctx *gin.Context) {
+		if strings.Contains(ctx.Request.URL.Path, "/platform/v1/auth/") {
+			ctx.Next()
+			return
+		}
+		claims, err := middleware.ParseAuth(ctx)
+		if err != nil {
+			infra.Response.Error(ctx, err)
+			ctx.Abort()
+			return
+		}
+		if claims.Role == "root" {
+			ctx.Next()
+			return
+		}
+		menus, err := common.LoadPlatformMenus(claims.Role)
+		if err != nil || !platformMenuAllowsPath(menus, ctx.Request.URL.Path) {
+			infra.Response.Error(ctx, errcode.ErrPermissionDenied)
+			ctx.Abort()
+			return
+		}
+		ctx.Set(platformMenusContextKey, menus)
+		ctx.Next()
+	}
+}

backend/api/internal/logic/platform/platform/account.go

@@ -0,0 +1,142 @@
+package platform
+
+import (
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// ListPlatformAccount 查询平台账号列表，手机号在展示层脱敏。
+func ListPlatformAccount(ctx *gin.Context) {
+	page, size := common.PageSize(ctx)
+	var list []models.PlatformAccount
+	var total int64
+	query := common.ApplyKeywordFilter(ctx, impl.DBService.Model(&models.PlatformAccount{}), &models.PlatformAccount{})
+	if err := query.Count(&total).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	if err := query.Order("created_at desc").Offset((page - 1) * size).Limit(size).Find(&list).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	views := make([]map[string]any, 0, len(list))
+	for _, item := range list {
+		view := platformAccountView(item)
+		common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view)
+		views = append(views, view)
+	}
+	infra.Response.Success(ctx, gin.H{"total": total, "list": views})
+}
+
+type platformAccountRequest struct {
+	Username         string `json:"username" binding:"required,max=64"`
+	Password         string `json:"password" binding:"required,min=8,max=128"`
+	DisplayName      string `json:"display_name" binding:"max=64"`
+	Avatar           string `json:"avatar" binding:"max=512"`
+	PlatformRoleCode string `json:"platform_role_code" binding:"required,max=64"`
+	Phone            string `json:"phone" binding:"max=32"`
+}
+
+func platformAccountView(account models.PlatformAccount) map[string]any {
+	return map[string]any{
+		"identity": account.Identity, "username": account.Username,
+		"display_name": account.DisplayName, "avatar": account.Avatar, "phone": account.Phone,
+		"platform_role_code": account.PlatformRoleCode, "status": account.Status,
+	}
+}
+
+func GetPlatformAccount(ctx *gin.Context) {
+	var account models.PlatformAccount
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&account).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	view := platformAccountView(account)
+	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
+}
+
+func CreatePlatformAccount(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request platformAccountRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	if !isAssignablePlatformRole(request.PlatformRoleCode) {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	hash, err := platformPasswordHash(request.Password)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	account := models.PlatformAccount{Entity: common.NewEntity("enabled"), Username: request.Username, DisplayName: request.DisplayName, Avatar: request.Avatar, PasswordHash: hash, PlatformRoleCode: request.PlatformRoleCode, Phone: request.Phone}
+	if err := impl.DBService.Create(&account).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	view := platformAccountView(account)
+	infra.Response.Success(ctx, common.ProtectPreciseLocation(ctx, &models.PlatformAccount{}, view))
+}
+
+func UpdatePlatformAccount(ctx *gin.Context) {
+	var request struct {
+		DisplayName      string  `json:"display_name" binding:"max=64"`
+		Avatar           string  `json:"avatar" binding:"max=512"`
+		PlatformRoleCode *string `json:"platform_role_code" binding:"omitempty,max=64"`
+		Phone            string  `json:"phone" binding:"max=32"`
+	}
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	values := gin.H{"display_name": request.DisplayName, "avatar": request.Avatar, "phone": request.Phone}
+	if request.PlatformRoleCode != nil {
+		if !common.RequirePlatformRoot(ctx) {
+			return
+		}
+		if !isAssignablePlatformRole(*request.PlatformRoleCode) {
+			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+			return
+		}
+		values["platform_role_code"] = *request.PlatformRoleCode
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.PlatformAccount{}, values, []string{"display_name", "avatar", "platform_role_code", "phone"})
+}
+
+// UpdatePlatformAccountStatus updates a platform account lifecycle state.
+func UpdatePlatformAccountStatus(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	common.UpdateRecordStatus(ctx, &models.PlatformAccount{})
+}
+
+// ArchivePlatformAccount archives a platform account without deleting audit history.
+func ArchivePlatformAccount(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	common.ArchiveRecord(ctx, &models.PlatformAccount{})
+}
+
+func platformPasswordHash(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(hash), err
+}
+
+func isAssignablePlatformRole(roleCode string) bool {
+	if roleCode == "" || roleCode == "root" {
+		return false
+	}
+	var role models.PlatformRole
+	return impl.DBService.Where("role_code = ? AND status = ? AND is_system = ?", roleCode, "enabled", false).First(&role).Error == nil
+}

backend/api/internal/logic/platform/platform/menu.go

@@ -0,0 +1,128 @@
+package platform
+
+import (
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/bsm-sdk/core/middleware"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+)
+
+type platformMenuRequest struct {
+	ParentIdentity string `json:"parent_identity"`
+	MenuCode       string `json:"menu_code" binding:"required,max=64"`
+	Name           string `json:"name" binding:"required,max=64"`
+	Icon           string `json:"icon" binding:"max=64"`
+	Path           string `json:"path" binding:"max=255"`
+	SortNo         int    `json:"sort_no"`
+}
+
+type platformMenuView struct {
+	Identity       string `json:"identity"`
+	ParentIdentity string `json:"parent_identity,omitempty"`
+	MenuCode       string `json:"menu_code"`
+	Name           string `json:"name"`
+	Icon           string `json:"icon"`
+	Path           string `json:"path"`
+	SortNo         int    `json:"sort_no"`
+	Status         string `json:"status"`
+}
+
+func platformMenuViews(list []models.PlatformMenu) []platformMenuView {
+	identities := make(map[uint64]string, len(list))
+	for _, item := range list {
+		identities[item.ID] = item.Identity
+	}
+	views := make([]platformMenuView, 0, len(list))
+	for _, item := range list {
+		views = append(views, platformMenuView{Identity: item.Identity, ParentIdentity: identities[item.ParentID], MenuCode: item.MenuCode, Name: item.Name, Icon: item.Icon, Path: item.Path, SortNo: item.SortNo, Status: item.Status})
+	}
+	return views
+}
+
+func GetPlatformMenu(ctx *gin.Context) {
+	var menu models.PlatformMenu
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&menu).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	list := []models.PlatformMenu{menu}
+	if menu.ParentID != 0 {
+		var parent models.PlatformMenu
+		if err := impl.DBService.Select("id", "identity").First(&parent, menu.ParentID).Error; err == nil {
+			list = append(list, parent)
+		}
+	}
+	views := platformMenuViews(list)
+	infra.Response.Success(ctx, views[0])
+}
+
+func CreatePlatformMenu(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request platformMenuRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	menu := models.PlatformMenu{Entity: common.NewEntity("enabled"), ParentID: parentID, MenuCode: request.MenuCode, Name: request.Name, Icon: request.Icon, Path: request.Path, SortNo: request.SortNo}
+	if err := impl.DBService.Create(&menu).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	common.RespondCreatedResource(ctx, menu)
+}
+
+func UpdatePlatformMenu(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request platformMenuRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	parentID, err := common.ResolveIdentityID(&models.PlatformMenu{}, request.ParentIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.PlatformMenu{}, gin.H{"parent_id": parentID, "name": request.Name, "icon": request.Icon, "path": request.Path, "sort_no": request.SortNo}, []string{"parent_id", "name", "icon", "path", "sort_no"})
+}
+
+func UpdatePlatformMenuStatus(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	common.UpdateRecordStatus(ctx, &models.PlatformMenu{})
+}
+
+func ArchivePlatformMenu(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	common.ArchiveRecord(ctx, &models.PlatformMenu{})
+}
+
+// ListPlatformMenu 返回菜单树构建所需的有序菜单列表。
+func ListPlatformMenu(ctx *gin.Context) {
+	claims, err := middleware.ParseAuth(ctx)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	list, err := common.LoadPlatformMenus(claims.Role)
+	if err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"total": len(list), "list": platformMenuViews(list)})
+}

backend/api/internal/logic/platform/platform/role.go

@@ -0,0 +1,104 @@
+package platform
+
+import (
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+)
+
+// ListPlatformRole 查询平台角色分页列表。
+func ListPlatformRole(ctx *gin.Context) { common.ListPage[models.PlatformRole](ctx) }
+
+// GetPlatformRole 查询一个平台角色。
+func GetPlatformRole(ctx *gin.Context) { common.GetByIdentity[models.PlatformRole](ctx) }
+
+// CreatePlatformRole 创建非内置平台角色。
+func CreatePlatformRole(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request models.PlatformRole
+	if err := ctx.ShouldBindJSON(&request); err != nil || request.RoleCode == "" || request.Name == "" || request.RoleCode == "root" {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	request.Entity = common.NewEntity("enabled")
+	request.IsSystem = false
+	if request.DataScope == "" {
+		request.DataScope = "global"
+	}
+	if err := impl.DBService.Create(&request).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	common.RespondCreatedResource(ctx, request)
+}
+
+// UpdatePlatformRole 更新非内置平台角色。
+func UpdatePlatformRole(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request struct {
+		Name      string `json:"name" binding:"required,max=64"`
+		DataScope string `json:"data_scope" binding:"required,max=32"`
+	}
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	var role models.PlatformRole
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	if role.IsSystem {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"name": request.Name, "data_scope": request.DataScope}, []string{"name", "data_scope"})
+}
+
+// UpdatePlatformRoleStatus 更新非内置平台角色状态，系统角色始终受保护。
+func UpdatePlatformRoleStatus(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request struct {
+		Status string `json:"status" binding:"required,max=32"`
+	}
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	var role models.PlatformRole
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	if role.IsSystem {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": request.Status}, []string{"status"})
+}
+
+// ArchivePlatformRole 归档非内置平台角色，系统角色始终受保护。
+func ArchivePlatformRole(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var role models.PlatformRole
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	if role.IsSystem {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "archived"}, []string{"status"})
+}

backend/api/internal/logic/platform/platform/role_menu.go

@@ -0,0 +1,92 @@
+package platform
+
+import (
+	"errors"
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+var errSystemPlatformRole = errors.New("system platform roles cannot be modified")
+
+type platformRoleMenusRequest struct {
+	MenuIdentities []string `json:"menu_identities"`
+}
+
+// ReplacePlatformRoleMenus replaces every menu assignment for a role atomically.
+func ReplacePlatformRoleMenus(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var request platformRoleMenusRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	if err := impl.DBService.Transaction(func(transaction *gorm.DB) error {
+		var role models.PlatformRole
+		if err := transaction.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
+			return err
+		}
+		if role.IsSystem {
+			return errSystemPlatformRole
+		}
+		var menus []models.PlatformMenu
+		if len(request.MenuIdentities) > 0 {
+			if err := transaction.Where("identity IN ?", request.MenuIdentities).Find(&menus).Error; err != nil {
+				return err
+			}
+			if len(menus) != len(request.MenuIdentities) {
+				return gorm.ErrRecordNotFound
+			}
+		}
+		if err := transaction.Where("platform_role_id = ?", role.ID).Delete(&models.PlatformRoleMenu{}).Error; err != nil {
+			return err
+		}
+		for _, menu := range menus {
+			relation := models.PlatformRoleMenu{PlatformRoleID: role.ID, PlatformMenuID: menu.ID}
+			if err := transaction.Create(&relation).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			infra.Response.Error(ctx, errcode.ErrRecordNotFound)
+			return
+		}
+		if errors.Is(err, errSystemPlatformRole) {
+			infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+			return
+		}
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"updated": true})
+}
+
+// ListPlatformRoleMenuIdentities returns the current assignment for the role editor.
+func ListPlatformRoleMenuIdentities(ctx *gin.Context) {
+	if !common.RequirePlatformRoot(ctx) {
+		return
+	}
+	var role models.PlatformRole
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	var identities []string
+	if err := impl.DBService.Model(&models.PlatformMenu{}).
+		Joins("JOIN platform_role_menu ON platform_role_menu.platform_menu_id = platform_menu.id").
+		Where("platform_role_menu.platform_role_id = ?", role.ID).
+		Order("platform_menu.sort_no asc, platform_menu.id asc").
+		Pluck("platform_menu.identity", &identities).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	infra.Response.Success(ctx, gin.H{"menu_identities": identities})
+}

backend/api/internal/logic/platform/product/product.go

@@ -1,4 +1,4 @@
-package platform
+package product
 
 import (
 	"encoding/json"

backend/api/internal/logic/platform/product/product_test.go

@@ -1,4 +1,4 @@
-package platform
+package product
 
 import (
 	"testing"

backend/api/internal/logic/platform/staff/credential.go

@@ -0,0 +1,53 @@
+package staff
+
+import (
+	"time"
+
+	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/infra"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
+	"github.com/gin-gonic/gin"
+)
+
+type staffCredentialRequest struct {
+	StaffAccountIdentity string     `json:"staff_account_identity" binding:"required"`
+	CredentialType       string     `json:"credential_type" binding:"required,max=64"`
+	CredentialNo         string     `json:"credential_no" binding:"max=128"`
+	ExpiredAt            *time.Time `json:"expired_at"`
+}
+
+func ListStaffCredential(ctx *gin.Context) { common.ListPage[models.StaffCredential](ctx) }
+func GetStaffCredential(ctx *gin.Context)  { common.GetByIdentity[models.StaffCredential](ctx) }
+func CreateStaffCredential(ctx *gin.Context) {
+	var request staffCredentialRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, true)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	credential := models.StaffCredential{Entity: common.NewEntity("enabled"), StaffAccountID: staffAccountID, CredentialType: request.CredentialType, CredentialNo: request.CredentialNo, ExpiredAt: request.ExpiredAt}
+	if err := impl.DBService.Create(&credential).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	common.RespondCreatedResource(ctx, credential)
+}
+func UpdateStaffCredential(ctx *gin.Context) {
+	var request staffCredentialRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, true)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.StaffCredential{}, gin.H{"staff_account_id": staffAccountID, "credential_type": request.CredentialType, "credential_no": request.CredentialNo, "expired_at": request.ExpiredAt}, []string{"staff_account_id", "credential_type", "credential_no", "expired_at"})
+}

backend/api/internal/logic/platform/staff/staff.go

@@ -1,4 +1,4 @@
-package platform
+package staff
 
 import (
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -32,7 +32,7 @@ func CreateStaff(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	hash, err := passwordHash(request.Password)
+	hash, err := common.PasswordHash(request.Password)
 	if err != nil {
 		infra.Response.Error(ctx, err)
 		return

backend/api/internal/logic/platform/user/relation.go

@@ -1,8 +1,6 @@
-package platform
+package user
 
 import (
-	"time"
-
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/infra"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
@@ -11,48 +9,7 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-type staffCredentialRequest struct {
-	StaffAccountIdentity string     `json:"staff_account_identity" binding:"required"`
-	CredentialType       string     `json:"credential_type" binding:"required,max=64"`
-	CredentialNo         string     `json:"credential_no" binding:"max=128"`
-	ExpiredAt            *time.Time `json:"expired_at"`
-}
-
-func ListStaffCredential(ctx *gin.Context) { common.ListPage[models.StaffCredential](ctx) }
-func GetStaffCredential(ctx *gin.Context)  { common.GetByIdentity[models.StaffCredential](ctx) }
-func CreateStaffCredential(ctx *gin.Context) {
-	var request staffCredentialRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	credential := models.StaffCredential{Entity: common.NewEntity("enabled"), StaffAccountID: staffAccountID, CredentialType: request.CredentialType, CredentialNo: request.CredentialNo, ExpiredAt: request.ExpiredAt}
-	if err := impl.DBService.Create(&credential).Error; err != nil {
-		infra.Response.Error(ctx, err)
-		return
-	}
-	common.RespondCreatedResource(ctx, credential)
-}
-func UpdateStaffCredential(ctx *gin.Context) {
-	var request staffCredentialRequest
-	if err := ctx.ShouldBindJSON(&request); err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	common.UpdateAllowedByIdentity(ctx, &models.StaffCredential{}, gin.H{"staff_account_id": staffAccountID, "credential_type": request.CredentialType, "credential_no": request.CredentialNo, "expired_at": request.ExpiredAt}, []string{"staff_account_id", "credential_type", "credential_no", "expired_at"})
-}
-
-type userAddressRequest struct {
+type addressRequest struct {
 	UserAccountIdentity string `json:"user_account_identity" binding:"required"`
 	Address             string `json:"address" binding:"required,max=255"`
 	Longitude           string `json:"longitude" binding:"max=32"`
@@ -63,7 +20,7 @@ type userAddressRequest struct {
 func ListUserAddress(ctx *gin.Context) { common.ListPage[models.UserAddress](ctx) }
 func GetUserAddress(ctx *gin.Context)  { common.GetByIdentity[models.UserAddress](ctx) }
 func CreateUserAddress(ctx *gin.Context) {
-	var request userAddressRequest
+	var request addressRequest
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
@@ -81,7 +38,7 @@ func CreateUserAddress(ctx *gin.Context) {
 	common.RespondCreatedResource(ctx, address)
 }
 func UpdateUserAddress(ctx *gin.Context) {
-	var request userAddressRequest
+	var request addressRequest
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
@@ -94,7 +51,7 @@ func UpdateUserAddress(ctx *gin.Context) {
 	common.UpdateAllowedByIdentity(ctx, &models.UserAddress{}, gin.H{"user_account_id": userAccountID, "address": request.Address, "longitude": request.Longitude, "latitude": request.Latitude, "is_default": request.IsDefault}, []string{"user_account_id", "address", "longitude", "latitude", "is_default"})
 }
 
-type userServiceRelationRequest struct {
+type serviceRelationRequest struct {
 	UserAccountIdentity   string `json:"user_account_identity" binding:"required"`
 	GasBasicIdentity      string `json:"gas_basic_identity"`
 	DeliveryBasicIdentity string `json:"delivery_basic_identity"`
@@ -104,29 +61,13 @@ type userServiceRelationRequest struct {
 func ListUserServiceRelation(ctx *gin.Context) { common.ListPage[models.UserServiceRelation](ctx) }
 func GetUserServiceRelation(ctx *gin.Context)  { common.GetByIdentity[models.UserServiceRelation](ctx) }
 func CreateUserServiceRelation(ctx *gin.Context) {
-	var request userServiceRelationRequest
+	var request serviceRelationRequest
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	userAccountID, err := common.ResolveIdentityID(&models.UserAccount{}, request.UserAccountIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	gasBasicID, err := common.ResolveIdentityID(&models.GasBasic{}, request.GasBasicIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+	userAccountID, gasBasicID, deliveryBasicID, staffAccountID, ok := resolveServiceRelation(ctx, request)
+	if !ok {
 		return
 	}
 	relation := models.UserServiceRelation{Entity: common.NewEntity("enabled"), UserAccountID: userAccountID, GasBasicID: gasBasicID, DeliveryBasicID: deliveryBasicID, StaffAccountID: staffAccountID}
@@ -137,30 +78,38 @@ func CreateUserServiceRelation(ctx *gin.Context) {
 	common.RespondCreatedResource(ctx, relation)
 }
 func UpdateUserServiceRelation(ctx *gin.Context) {
-	var request userServiceRelationRequest
+	var request serviceRelationRequest
 	if err := ctx.ShouldBindJSON(&request); err != nil {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	userAccountID, err := common.ResolveIdentityID(&models.UserAccount{}, request.UserAccountIdentity, true)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	gasBasicID, err := common.ResolveIdentityID(&models.GasBasic{}, request.GasBasicIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
-		return
-	}
-	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, false)
-	if err != nil {
-		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+	userAccountID, gasBasicID, deliveryBasicID, staffAccountID, ok := resolveServiceRelation(ctx, request)
+	if !ok {
 		return
 	}
 	common.UpdateAllowedByIdentity(ctx, &models.UserServiceRelation{}, gin.H{"user_account_id": userAccountID, "gas_basic_id": gasBasicID, "delivery_basic_id": deliveryBasicID, "staff_account_id": staffAccountID}, []string{"user_account_id", "gas_basic_id", "delivery_basic_id", "staff_account_id"})
 }
+
+func resolveServiceRelation(ctx *gin.Context, request serviceRelationRequest) (uint64, uint64, uint64, uint64, bool) {
+	userAccountID, err := common.ResolveIdentityID(&models.UserAccount{}, request.UserAccountIdentity, true)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return 0, 0, 0, 0, false
+	}
+	gasBasicID, err := common.ResolveIdentityID(&models.GasBasic{}, request.GasBasicIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return 0, 0, 0, 0, false
+	}
+	deliveryBasicID, err := common.ResolveIdentityID(&models.DeliveryBasic{}, request.DeliveryBasicIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return 0, 0, 0, 0, false
+	}
+	staffAccountID, err := common.ResolveIdentityID(&models.StaffAccount{}, request.StaffAccountIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return 0, 0, 0, 0, false
+	}
+	return userAccountID, gasBasicID, deliveryBasicID, staffAccountID, true
+}

backend/api/internal/logic/platform/user/user.go

@@ -1,4 +1,4 @@
-package platform
+package user
 
 import (
 	"git.apinb.com/bsm-sdk/core/errcode"
@@ -29,7 +29,7 @@ func CreateUser(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	hash, err := passwordHash(request.Password)
+	hash, err := common.PasswordHash(request.Password)
 	if err != nil {
 		infra.Response.Error(ctx, err)
 		return

backend/api/internal/logic/platform/wallet/wallet.go

@@ -1,4 +1,4 @@
-package platform
+package wallet
 
 import (
 	"errors"
@@ -9,7 +9,6 @@ import (
 
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/infra"
-	"git.apinb.com/bsm-sdk/core/middleware"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/config"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
@@ -196,7 +195,7 @@ func RechargeWalletBasic(ctx *gin.Context) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	var record models.WalletRecord
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("request_no = ?", request.RequestNo).First(&record).Error; err == nil {
@@ -269,7 +268,7 @@ func reviewWalletApplyCash(ctx *gin.Context, targetStatus string) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
-	operatorIdentity, operatorName := walletOperator(ctx)
+	operatorIdentity, operatorName := common.PlatformOperator(ctx)
 	err := impl.DBService.Transaction(func(tx *gorm.DB) error {
 		var application models.WalletApplyCash
 		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
@@ -306,18 +305,6 @@ func reviewWalletApplyCash(ctx *gin.Context, targetStatus string) {
 	infra.Response.Success(ctx, gin.H{"updated": true, "status": targetStatus})
 }
 
-func walletOperator(ctx *gin.Context) (string, string) {
-	claims, err := middleware.ParseAuth(ctx)
-	if err != nil {
-		return "", ""
-	}
-	var account models.PlatformAccount
-	if err := impl.DBService.Select("display_name").Where("identity = ?", claims.Identity).First(&account).Error; err != nil {
-		return claims.Identity, ""
-	}
-	return claims.Identity, account.DisplayName
-}
-
 func dateNumber(value time.Time, layout string) int32 {
 	number, _ := strconv.ParseInt(value.Format(layout), 10, 32)
 	return int32(number)

backend/api/internal/logic/platform/wallet/wallet_test.go

@@ -1,4 +1,4 @@
-package platform
+package wallet
 
 import (
 	"testing"