fix platform workflow integrity and permissions

backend/api/internal/logic/platform/ec/ec.go

@@ -1,6 +1,7 @@
 package ec
 
 import (
+	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/infra"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
 	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
@@ -8,6 +9,12 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+type categoryRequest struct {
+	ParentIdentity string `json:"parent_identity"`
+	Name           string `json:"name" binding:"required,max=128"`
+	SortNo         int    `json:"sort_no"`
+}
+
 type ecCategoryView struct {
 	Identity       string `json:"identity"`
 	ParentIdentity string `json:"parent_identity,omitempty"`
@@ -50,11 +57,12 @@ func ListEcCategory(ctx *gin.Context) {
 	page, size := common.PageSize(ctx)
 	var list []models.EcCategory
 	var total int64
-	if err := impl.DBService.Model(&models.EcCategory{}).Count(&total).Error; err != nil {
+	query := common.ActiveRecords(impl.DBService.Model(&models.EcCategory{}))
+	if err := query.Count(&total).Error; err != nil {
 		infra.Response.Error(ctx, err)
 		return
 	}
-	if err := impl.DBService.Order("sort_no asc, id asc").Offset((page - 1) * size).Limit(size).Find(&list).Error; err != nil {
+	if err := query.Order("sort_no asc, id asc").Offset((page - 1) * size).Limit(size).Find(&list).Error; err != nil {
 		infra.Response.Error(ctx, err)
 		return
 	}
@@ -79,3 +87,66 @@ func GetEcCategory(ctx *gin.Context) {
 	}
 	infra.Response.Success(ctx, views[0])
 }
+
+func CreateEcCategory(ctx *gin.Context) {
+	var request categoryRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	parentID, err := common.ResolveIdentityID(&models.EcCategory{}, request.ParentIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	category := models.EcCategory{Entity: common.NewEntity(common.StatusDraft), ParentID: parentID, Name: request.Name, SortNo: request.SortNo}
+	if err := impl.DBService.Create(&category).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	common.RespondCreatedResource(ctx, category)
+}
+
+func UpdateEcCategory(ctx *gin.Context) {
+	var request categoryRequest
+	if err := ctx.ShouldBindJSON(&request); err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	var category models.EcCategory
+	if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&category).Error; err != nil {
+		common.RespondRecordError(ctx, err)
+		return
+	}
+	parentID, err := common.ResolveIdentityID(&models.EcCategory{}, request.ParentIdentity, false)
+	if err != nil {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	var rows []models.EcCategory
+	if err := impl.DBService.Select("id", "parent_id").Find(&rows).Error; err != nil {
+		infra.Response.Error(ctx, err)
+		return
+	}
+	parents := make(map[uint64]uint64, len(rows))
+	for _, row := range rows {
+		parents[row.ID] = row.ParentID
+	}
+	if wouldCreateCategoryCycle(category.ID, parentID, parents) {
+		infra.Response.Error(ctx, errcode.ErrInvalidArgument)
+		return
+	}
+	common.UpdateAllowedByIdentity(ctx, &models.EcCategory{}, gin.H{"parent_id": parentID, "name": request.Name, "sort_no": request.SortNo}, []string{"parent_id", "name", "sort_no"})
+}
+
+func wouldCreateCategoryCycle(categoryID, parentID uint64, parents map[uint64]uint64) bool {
+	seen := map[uint64]bool{}
+	for parentID != 0 {
+		if parentID == categoryID || seen[parentID] {
+			return true
+		}
+		seen[parentID] = true
+		parentID = parents[parentID]
+	}
+	return false
+}