fix platform workflow integrity and permissions

backend/api/internal/logic/common/base.go

@@ -42,7 +42,7 @@ func UpdateRecordStatus(ctx *gin.Context, model any) {
 	var request struct {
 		Status int `json:"status" binding:"required"`
 	}
-	if err := ctx.ShouldBindJSON(&request); err != nil {
+	if err := ctx.ShouldBindJSON(&request); err != nil || !IsGenericRecordStatus(request.Status) {
 		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
 		return
 	}
@@ -55,7 +55,22 @@ func ArchiveRecord(ctx *gin.Context, model any) {
 }
 
 func NewEntity(status int) models.Entity {
-	return models.Entity{Identity: models.NewIdentity(), Status: status, Version: 1}
+	return models.Entity{Identity: models.NewIdentity(), Status: status}
+}
+
+// IsGenericRecordStatus reports whether status belongs to the shared record lifecycle.
+func IsGenericRecordStatus(status int) bool {
+	switch status {
+	case StatusDraft, StatusEnable, StatusDisable, StatusArchived, StatusFrozen:
+		return true
+	default:
+		return false
+	}
+}
+
+// ActiveRecords excludes logically archived records from operational queries.
+func ActiveRecords(query *gorm.DB) *gorm.DB {
+	return query.Where("status <> ?", StatusArchived)
 }
 
 func ListPage[T any](ctx *gin.Context) {
@@ -63,7 +78,7 @@ func ListPage[T any](ctx *gin.Context) {
 	var list []T
 	var total int64
 	model := new(T)
-	databaseQuery := ApplyKeywordFilter(ctx, impl.DBService.Model(model), model)
+	databaseQuery := ApplyKeywordFilter(ctx, ActiveRecords(impl.DBService.Model(model)), model)
 	if err := databaseQuery.Count(&total).Error; err != nil {
 		infra.Response.Error(ctx, err)
 		return