heqiapp/platforms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: heqiapp:642980960ef6e89634c51975620a89b9a20023a9
Branches Tags
heqiapp:main
...
compare: heqiapp:8387c617eab54315182fc7859a8a197be5e64d67
Branches Tags
heqiapp:main

8 Commits
642980960e ... 8387c617ea

Author SHA1 Message Date
yanweidong
8387c617ea fix gitignore 2026-07-27 02:25:01 +08:00
yanweidong
86958a197d chore: merge remaining platform audit workspace files 2026-07-27 02:21:53 +08:00
yanweidong
05e6f22f1d fix(platform): protect system role menus 2026-07-27 02:11:42 +08:00
yanweidong
8bd2be73f5 feat(platform): add organization account resources 2026-07-27 02:03:26 +08:00
yanweidong
4367da50fd fix(platform): protect role status updates 2026-07-27 01:49:02 +08:00
yanweidong
c5600cf1db feat(platform): add resource update safeguards 2026-07-27 01:32:44 +08:00
yanweidong
e730343093 feat: add platform resource audit baseline 2026-07-27 01:11:38 +08:00
yanweidong
7609d3234a docs: define platform admin audit design 2026-07-27 00:36:12 +08:00
22 changed files with 1729 additions and 322 deletions
Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -20,6 +20,7 @@ tmp/
*.secret.*
*.local.yaml
*.local.yml
*.exe
caddy/bin/
# apps-repository/
scripts/fixtures/platform-demo-seed-result.json

7
backend/api/go.mod
View File

@@ -4,9 +4,13 @@ go 1.26.1
require (
git.apinb.com/bsm-sdk/core v0.2.0
github.com/DATA-DOG/go-sqlmock v1.5.2
github.com/gin-gonic/gin v1.12.0
github.com/google/uuid v1.6.0
github.com/patrickmn/go-cache v2.1.0+incompatible
golang.org/x/crypto v0.49.0
google.golang.org/grpc v1.81.1
gorm.io/driver/postgres v1.6.0
gorm.io/gorm v1.31.1
)
@@ -60,16 +64,13 @@ require (
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/arch v0.23.0 // indirect
golang.org/x/crypto v0.49.0 // indirect
golang.org/x/net v0.52.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sys v0.44.0 // indirect
golang.org/x/text v0.36.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
google.golang.org/grpc v1.81.1 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gorm.io/driver/mysql v1.6.0 // indirect
gorm.io/driver/postgres v1.6.0 // indirect
)

3
backend/api/go.sum
View File

@@ -2,6 +2,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
git.apinb.com/bsm-sdk/core v0.2.0 h1:/e9yqpsbKBrRgMiGpS3KX2O4qDLxo5V5GpPSLNGxEKw=
git.apinb.com/bsm-sdk/core v0.2.0/go.mod h1:E9T6Eboo/0Zb36BjkKbIgvFzq4fQ2Q8P/7y5zmYTI6Y=
github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
@@ -79,6 +81,7 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

93
backend/api/internal/logic/platform/account.go Normal file
View File

@@ -0,0 +1,93 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
"golang.org/x/crypto/bcrypt"
)
type accountRequest struct {
Username string `json:"username" binding:"required,max=64"`
Password string `json:"password" binding:"required,min=8,max=128"`
DisplayName string `json:"display_name" binding:"max=64"`
RoleCode string `json:"role_code" binding:"max=64"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
}
type accountUpdateRequest struct {
DisplayName string `json:"display_name" binding:"max=64"`
RoleCode string `json:"role_code" binding:"max=64"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
}
func passwordHash(password string) (string, error) {
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
return string(hash), err
}
func ListGasAccount(ctx *gin.Context) { listPage[models.GasAccount](ctx) }
func GetGasAccount(ctx *gin.Context) { getByIdentity[models.GasAccount](ctx) }
func CreateGasAccount(ctx *gin.Context) {
var request accountRequest
if err := ctx.ShouldBindJSON(&request); err != nil || request.GasBasicID == 0 {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
hash, err := passwordHash(request.Password)
if err != nil {
infra.Response.Error(ctx, err)
return
}
account := models.GasAccount{Entity: newEntity("enabled"), GasBasicID: request.GasBasicID, Username: request.Username, DisplayName: request.DisplayName, PasswordHash: hash, RoleCode: request.RoleCode}
if err := impl.DBService.Create(&account).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, account)
}
func UpdateGasAccount(ctx *gin.Context) {
var request accountUpdateRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.GasAccount{}, gin.H{"gas_basic_id": request.GasBasicID, "display_name": request.DisplayName, "role_code": request.RoleCode}, []string{"gas_basic_id", "display_name", "role_code"})
}
func ListDeliveryAccount(ctx *gin.Context) { listPage[models.DeliveryAccount](ctx) }
func GetDeliveryAccount(ctx *gin.Context) { getByIdentity[models.DeliveryAccount](ctx) }
func CreateDeliveryAccount(ctx *gin.Context) {
var request accountRequest
if err := ctx.ShouldBindJSON(&request); err != nil || request.DeliveryBasicID == 0 {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
hash, err := passwordHash(request.Password)
if err != nil {
infra.Response.Error(ctx, err)
return
}
account := models.DeliveryAccount{Entity: newEntity("enabled"), DeliveryBasicID: request.DeliveryBasicID, Username: request.Username, DisplayName: request.DisplayName, PasswordHash: hash, RoleCode: request.RoleCode}
if err := impl.DBService.Create(&account).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, account)
}
func UpdateDeliveryAccount(ctx *gin.Context) {
var request accountUpdateRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.DeliveryAccount{}, gin.H{"delivery_basic_id": request.DeliveryBasicID, "display_name": request.DisplayName, "role_code": request.RoleCode}, []string{"delivery_basic_id", "display_name", "role_code"})
}

45
backend/api/internal/logic/platform/delivery.go Normal file
View File

@@ -0,0 +1,45 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
// ListDeliveryBasic 查询配送点分页列表。
func ListDeliveryBasic(ctx *gin.Context) { listPage[models.DeliveryBasic](ctx) }
// GetDeliveryBasic 查询一个配送点。
func GetDeliveryBasic(ctx *gin.Context) { getByIdentity[models.DeliveryBasic](ctx) }
// CreateDeliveryBasic 创建配送点档案。
func CreateDeliveryBasic(ctx *gin.Context) {
var request models.DeliveryBasic
if err := ctx.ShouldBindJSON(&request); err != nil || request.DeliveryCode == "" || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("draft")
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateDeliveryBasic 更新配送点基础资料。
func UpdateDeliveryBasic(ctx *gin.Context) {
var request struct {
GasBasicID uint64 `json:"gas_basic_id"`
Name string `json:"name" binding:"required,max=128"`
Principal string `json:"principal" binding:"max=64"`
Address string `json:"address" binding:"max=255"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.DeliveryBasic{}, gin.H{"gas_basic_id": request.GasBasicID, "name": request.Name, "principal": request.Principal, "address": request.Address}, []string{"gas_basic_id", "name", "principal", "address"})
}

47
backend/api/internal/logic/platform/gas.go Normal file
View File

@@ -0,0 +1,47 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
// ListGasBasic 查询可燃气体站分页列表。
func ListGasBasic(ctx *gin.Context) { listPage[models.GasBasic](ctx) }
// GetGasBasic 查询一个可燃气体站。
func GetGasBasic(ctx *gin.Context) { getByIdentity[models.GasBasic](ctx) }
// CreateGasBasic 创建可燃气体站档案。
func CreateGasBasic(ctx *gin.Context) {
var request models.GasBasic
if err := ctx.ShouldBindJSON(&request); err != nil || request.Code == "" || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("draft")
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateGasBasic 更新可燃气体站基础资料。
func UpdateGasBasic(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=128"`
CreditCode string `json:"credit_code" binding:"max=64"`
Principal string `json:"principal" binding:"max=64"`
Address string `json:"address" binding:"max=255"`
Longitude string `json:"longitude" binding:"max=32"`
Latitude string `json:"latitude" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.GasBasic{}, gin.H{"name": request.Name, "credit_code": request.CreditCode, "principal": request.Principal, "address": request.Address, "longitude": request.Longitude, "latitude": request.Latitude}, []string{"name", "credit_code", "principal", "address", "longitude", "latitude"})
}

22
backend/api/internal/logic/platform/health.go Normal file
View File

@@ -0,0 +1,22 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
// PingHello 返回匿名健康状态。
func PingHello(ctx *gin.Context) {
infra.Response.Success(ctx, gin.H{"service": "platform-api", "status": "ok"})
}
// DashboardOverview 返回平台总后台的运营概览数据。
func DashboardOverview(ctx *gin.Context) {
overview, err := models.GetDashboardOverview()
if err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, overview)
}

311
backend/api/internal/logic/platform/platform.go
View File

@@ -1,4 +1,4 @@
// Package platform 汇聚平台总后台的同步 HTTP 业务逻辑。
// Package platform 提供平台总后台的同步 HTTP 业务逻辑。
package platform
import (
@@ -13,277 +13,6 @@ import (
"gorm.io/gorm"
)
// PingHello 返回匿名健康状态。
func PingHello(ctx *gin.Context) {
infra.Response.Success(ctx, gin.H{"service": "platform-api", "status": "ok"})
}
// DashboardOverview 返回平台总后台的运营概览数据。
func DashboardOverview(ctx *gin.Context) {
overview, err := models.GetDashboardOverview()
if err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, overview)
}
// ListGasBasic 查询可燃气体站分页列表。
func ListGasBasic(ctx *gin.Context) { listPage[models.GasBasic](ctx) }
// GetGasBasic 查询一个可燃气体站。
func GetGasBasic(ctx *gin.Context) { getByIdentity[models.GasBasic](ctx) }
// CreateGasBasic 创建可燃气体站档案。
func CreateGasBasic(ctx *gin.Context) {
var request models.GasBasic
if err := ctx.ShouldBindJSON(&request); err != nil || request.Code == "" || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("draft")
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateGasBasic 更新可燃气体站基础资料。
func UpdateGasBasic(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=128"`
CreditCode string `json:"credit_code" binding:"max=64"`
Principal string `json:"principal" binding:"max=64"`
Address string `json:"address" binding:"max=255"`
Longitude string `json:"longitude" binding:"max=32"`
Latitude string `json:"latitude" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateByIdentity(ctx, &models.GasBasic{}, gin.H{"name": request.Name, "credit_code": request.CreditCode, "principal": request.Principal, "address": request.Address, "longitude": request.Longitude, "latitude": request.Latitude})
}
// ListDeliveryBasic 查询配送点分页列表。
func ListDeliveryBasic(ctx *gin.Context) { listPage[models.DeliveryBasic](ctx) }
// GetDeliveryBasic 查询一个配送点。
func GetDeliveryBasic(ctx *gin.Context) { getByIdentity[models.DeliveryBasic](ctx) }
// CreateDeliveryBasic 创建配送点档案。
func CreateDeliveryBasic(ctx *gin.Context) {
var request models.DeliveryBasic
if err := ctx.ShouldBindJSON(&request); err != nil || request.DeliveryCode == "" || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("draft")
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateDeliveryBasic 更新配送点基础资料。
func UpdateDeliveryBasic(ctx *gin.Context) {
var request struct {
GasBasicID uint64 `json:"gas_basic_id"`
Name string `json:"name" binding:"required,max=128"`
Principal string `json:"principal" binding:"max=64"`
Address string `json:"address" binding:"max=255"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateByIdentity(ctx, &models.DeliveryBasic{}, gin.H{"gas_basic_id": request.GasBasicID, "name": request.Name, "principal": request.Principal, "address": request.Address})
}
// ListStaff 查询服务人员分页列表。
func ListStaff(ctx *gin.Context) { listPage[models.StaffAccount](ctx) }
// GetStaff 查询一个服务人员档案。
func GetStaff(ctx *gin.Context) { getByIdentity[models.StaffAccount](ctx) }
// CreateStaff 创建服务人员档案。
func CreateStaff(ctx *gin.Context) {
var request models.StaffAccount
if err := ctx.ShouldBindJSON(&request); err != nil || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("draft")
if request.WorkStatus == "" {
request.WorkStatus = "off_duty"
}
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateStaff 更新服务人员档案。
func UpdateStaff(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RoleCode string `json:"role_code" binding:"max=64"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
WorkStatus string `json:"work_status" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateByIdentity(ctx, &models.StaffAccount{}, gin.H{"name": request.Name, "phone": request.Phone, "avatar": request.Avatar, "role_code": request.RoleCode, "gas_basic_id": request.GasBasicID, "delivery_basic_id": request.DeliveryBasicID, "work_status": request.WorkStatus})
}
// ListUser 查询业主客户分页列表。
func ListUser(ctx *gin.Context) { listPage[models.UserAccount](ctx) }
// GetUser 查询一个业主客户档案。
func GetUser(ctx *gin.Context) { getByIdentity[models.UserAccount](ctx) }
// CreateUser 创建业主客户档案。
func CreateUser(ctx *gin.Context) {
var request models.UserAccount
if err := ctx.ShouldBindJSON(&request); err != nil || request.Name == "" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("enabled")
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdateUser 更新业主客户档案。
func UpdateUser(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RealName string `json:"real_name" binding:"max=64"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateByIdentity(ctx, &models.UserAccount{}, gin.H{"name": request.Name, "phone": request.Phone, "avatar": request.Avatar, "real_name": request.RealName})
}
// ListPlatformRole 查询平台角色分页列表。
func ListPlatformRole(ctx *gin.Context) { listPage[models.PlatformRole](ctx) }
// GetPlatformRole 查询一个平台角色。
func GetPlatformRole(ctx *gin.Context) { getByIdentity[models.PlatformRole](ctx) }
// CreatePlatformRole 创建非内置平台角色。
func CreatePlatformRole(ctx *gin.Context) {
var request models.PlatformRole
if err := ctx.ShouldBindJSON(&request); err != nil || request.RoleCode == "" || request.Name == "" || request.RoleCode == "root" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("enabled")
request.IsSystem = false
if request.DataScope == "" {
request.DataScope = "global"
}
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdatePlatformRole 更新非内置平台角色。
func UpdatePlatformRole(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
DataScope string `json:"data_scope" binding:"required,max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
if err := impl.DBService.Model(&role).Updates(gin.H{"name": request.Name, "data_scope": request.DataScope}).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, role)
}
// UpdatePlatformRoleStatus 更新非内置平台角色状态，root 等系统角色始终受保护。
func UpdatePlatformRoleStatus(ctx *gin.Context) {
var request struct {
Status string `json:"status" binding:"required,max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
if err := impl.DBService.Model(&role).Update("status", request.Status).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, gin.H{"updated": true})
}
// ArchivePlatformRole 归档非内置平台角色，root 等系统角色始终受保护。
func ArchivePlatformRole(ctx *gin.Context) {
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
if err := impl.DBService.Model(&role).Update("status", "archived").Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, gin.H{"updated": true})
}
// ListPlatformMenu 返回菜单树构建所需的有序菜单列表。
func ListPlatformMenu(ctx *gin.Context) {
var list []models.PlatformMenu
if err := impl.DBService.Order("sort_no asc, id asc").Find(&list).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, gin.H{"total": len(list), "list": list})
}
// UpdateRecordStatus 更新主表状态，停用和归档均保留历史记录。
func UpdateRecordStatus(ctx *gin.Context, model any) {
var request struct {
@@ -293,27 +22,12 @@ func UpdateRecordStatus(ctx *gin.Context, model any) {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateByIdentity(ctx, model, gin.H{"status": request.Status})
updateAllowedByIdentity(ctx, model, gin.H{"status": request.Status}, []string{"status"})
}
// ArchiveRecord 通过 archived 状态实现逻辑删除，不物理删除主数据。
func ArchiveRecord(ctx *gin.Context, model any) {
updateByIdentity(ctx, model, gin.H{"status": "archived"})
}
// ListPlatfromAccount 查询平台账号列表，手机号在展示层脱敏。
func ListPlatfromAccount(ctx *gin.Context) {
page, size := pageSize(ctx)
list, total, err := models.ListPlatfromAccount(page, size)
if err != nil {
infra.Response.Error(ctx, err)
return
}
views := make([]gin.H, 0, len(list))
for _, item := range list {
views = append(views, gin.H{"identity": item.Identity, "username": item.Username, "display_name": item.DisplayName, "avatar": item.Avatar, "phone_masked": maskPhone(item.Phone), "platform_role_code": item.PlatformRoleCode, "status": item.Status})
}
infra.Response.Success(ctx, gin.H{"total": total, "list": views})
updateAllowedByIdentity(ctx, model, archiveValues(), []string{"status"})
}
func newEntity(status string) models.Entity {
@@ -345,6 +59,25 @@ func getByIdentity[T any](ctx *gin.Context) {
infra.Response.Success(ctx, data)
}
func updateAllowedByIdentity(ctx *gin.Context, model any, values map[string]any, allowedFields []string) {
values = filterFields(values, allowedFields)
if len(values) == 0 {
infra.Response.Success(ctx, gin.H{"updated": false})
return
}
result := impl.DBService.Model(model).Where("identity = ?", ctx.Param("identity")).Updates(values)
if result.Error != nil {
infra.Response.Error(ctx, result.Error)
return
}
if result.RowsAffected == 0 {
infra.Response.Error(ctx, errcode.ErrRecordNotFound)
return
}
infra.Response.Success(ctx, gin.H{"updated": true})
}
func updateByIdentity(ctx *gin.Context, model any, values map[string]any) {
result := impl.DBService.Model(model).Where("identity = ?", ctx.Param("identity")).Updates(values)
if result.Error != nil {

118
backend/api/internal/logic/platform/resource.go Normal file
View File

@@ -0,0 +1,118 @@
package platform
import (
"net/http"
"github.com/gin-gonic/gin"
)
// ResourceMode describes the operations a platform-admin resource supports.
type ResourceMode string
const (
Writable ResourceMode = "writable"
ReadOnly ResourceMode = "readonly"
AppendOnly ResourceMode = "append_only"
)
// ResourceContract is the expected cross-layer representation of one resource.
type ResourceContract struct {
Domain string
Name string
PageKind string
Mode ResourceMode
}
// ResourceDefinition describes a route resource and the fields it may change.
type ResourceDefinition struct {
Domain string
Name string
Model func() any
Mode ResourceMode
CreateFields []string
UpdateFields []string
}
// Allows reports whether a resource mode supports an HTTP method.
func (d ResourceDefinition) Allows(method string) bool {
switch d.Mode {
case ReadOnly:
return method == http.MethodGet
case AppendOnly:
return method == http.MethodGet || method == http.MethodPost
case Writable:
return method == http.MethodGet || method == http.MethodPost || method == http.MethodPut || method == http.MethodPatch || method == http.MethodDelete
default:
return false
}
}
func archiveValues() gin.H {
return gin.H{"status": "archived"}
}
func filterFields(values map[string]any, allowedFields []string) gin.H {
allowed := make(map[string]struct{}, len(allowedFields))
for _, field := range allowedFields {
allowed[field] = struct{}{}
}
filtered := make(gin.H, len(allowed))
for field, value := range values {
if _, ok := allowed[field]; ok {
filtered[field] = value
}
}
return filtered
}
// ExpectedResources returns the complete platform-admin resource catalogue.
func ExpectedResources() []ResourceContract {
return []ResourceContract{
{Domain: "gas", Name: "gas_basic", Mode: Writable, PageKind: "list"},
{Domain: "gas", Name: "gas_account", Mode: Writable, PageKind: "list"},
{Domain: "delivery", Name: "delivery_basic", Mode: Writable, PageKind: "list"},
{Domain: "delivery", Name: "delivery_account", Mode: Writable, PageKind: "list"},
{Domain: "staff", Name: "staff_account", Mode: Writable, PageKind: "list"},
{Domain: "staff", Name: "staff_credential", Mode: Writable, PageKind: "list"},
{Domain: "user", Name: "user_account", Mode: Writable, PageKind: "list"},
{Domain: "user", Name: "user_address", Mode: Writable, PageKind: "list"},
{Domain: "user", Name: "user_service_relation", Mode: Writable, PageKind: "list"},
{Domain: "device", Name: "dev_smart_cylinder_valve", Mode: Writable, PageKind: "list"},
{Domain: "device", Name: "dev_device_binding", Mode: Writable, PageKind: "list"},
{Domain: "device", Name: "saf_rule", Mode: Writable, PageKind: "list"},
{Domain: "device", Name: "saf_event", Mode: Writable, PageKind: "list"},
{Domain: "device", Name: "saf_inspection", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_category", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_product", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_product_attribute", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_product_image", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_cart", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_order", Mode: Writable, PageKind: "list"},
{Domain: "commerce", Name: "ec_review", Mode: Writable, PageKind: "list"},
{Domain: "delivery", Name: "delivery_task", Mode: Writable, PageKind: "list"},
{Domain: "delivery", Name: "delivery_track", Mode: Writable, PageKind: "list"},
{Domain: "delivery", Name: "delivery_track_point", Mode: Writable, PageKind: "list"},
{Domain: "finance", Name: "fin_payment", Mode: Writable, PageKind: "list"},
{Domain: "finance", Name: "fin_settlement", Mode: Writable, PageKind: "list"},
{Domain: "finance", Name: "fin_reconciliation", Mode: Writable, PageKind: "list"},
{Domain: "content", Name: "cnt_content", Mode: Writable, PageKind: "list"},
{Domain: "notification", Name: "ntf_template", Mode: Writable, PageKind: "list"},
{Domain: "customer_service", Name: "cs_ticket", Mode: Writable, PageKind: "list"},
{Domain: "platform", Name: "platfrom_account", Mode: Writable, PageKind: "list"},
{Domain: "platform", Name: "platform_role", Mode: Writable, PageKind: "list"},
{Domain: "platform", Name: "platform_menu", Mode: Writable, PageKind: "tree"},
{Domain: "device", Name: "dev_telemetry", Mode: ReadOnly, PageKind: "list"},
{Domain: "wallet", Name: "wallet", Mode: ReadOnly, PageKind: "list"},
{Domain: "wallet", Name: "wallet_ledger", Mode: ReadOnly, PageKind: "list"},
{Domain: "wallet", Name: "wallet_recharge", Mode: ReadOnly, PageKind: "list"},
{Domain: "wallet", Name: "wallet_withdrawal", Mode: ReadOnly, PageKind: "list"},
{Domain: "report", Name: "report", Mode: ReadOnly, PageKind: "list"},
{Domain: "report", Name: "report_item", Mode: ReadOnly, PageKind: "list"},
{Domain: "report", Name: "report_metric_snapshot", Mode: ReadOnly, PageKind: "list"},
{Domain: "audit", Name: "aud_operation_log", Mode: ReadOnly, PageKind: "list"},
{Domain: "audit", Name: "aud_export_log", Mode: ReadOnly, PageKind: "list"},
{Domain: "audit", Name: "aud_approval", Mode: ReadOnly, PageKind: "list"},
{Domain: "device", Name: "saf_event_disposal", Mode: AppendOnly, PageKind: "list"},
}
}

265
backend/api/internal/logic/platform/resource_test.go Normal file
View File

@@ -0,0 +1,265 @@
package platform
import (
"bytes"
"encoding/json"
"errors"
"net/http"
"net/http/httptest"
"regexp"
"testing"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/DATA-DOG/go-sqlmock"
"github.com/gin-gonic/gin"
"google.golang.org/grpc/status"
"gorm.io/driver/postgres"
"gorm.io/gorm"
)
func TestExpectedResources(t *testing.T) {
assertContract(t, ExpectedResources(), "gas", "gas_basic", Writable, "list")
assertContract(t, ExpectedResources(), "device", "saf_event", Writable, "list")
assertContract(t, ExpectedResources(), "wallet", "wallet_ledger", ReadOnly, "list")
}
func TestResourceDefinitionAllowsOnlySupportedMethods(t *testing.T) {
if (ResourceDefinition{Mode: ReadOnly}).Allows(http.MethodPost) {
t.Fatal("readonly allows POST")
}
if !(ResourceDefinition{Mode: AppendOnly}).Allows(http.MethodPost) {
t.Fatal("append-only rejects POST")
}
if (ResourceDefinition{Mode: AppendOnly}).Allows(http.MethodDelete) {
t.Fatal("append-only allows DELETE")
}
}
func TestArchiveValuesOnlyArchives(t *testing.T) {
got := archiveValues()
if len(got) != 1 || got["status"] != "archived" {
t.Fatalf("unexpected archive values: %#v", got)
}
}
func TestFilterFieldsKeepsOnlyAllowedKeys(t *testing.T) {
got := filterFields(map[string]any{"name": "n", "password_hash": "x"}, []string{"name"})
if len(got) != 1 || got["name"] != "n" {
t.Fatalf("unexpected filtered fields: %#v", got)
}
}
func TestResourceDefinitionAllowsOnlyMethodsForEachMode(t *testing.T) {
tests := []struct {
name string
mode ResourceMode
method string
want bool
}{
{"readonly GET", ReadOnly, http.MethodGet, true},
{"readonly POST", ReadOnly, http.MethodPost, false},
{"append-only GET", AppendOnly, http.MethodGet, true},
{"append-only POST", AppendOnly, http.MethodPost, true},
{"append-only PUT", AppendOnly, http.MethodPut, false},
{"writable GET", Writable, http.MethodGet, true},
{"writable POST", Writable, http.MethodPost, true},
{"writable PUT", Writable, http.MethodPut, true},
{"writable PATCH", Writable, http.MethodPatch, true},
{"writable DELETE", Writable, http.MethodDelete, true},
{"writable OPTIONS", Writable, http.MethodOptions, false},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
if got := (ResourceDefinition{Mode: test.mode}).Allows(test.method); got != test.want {
t.Fatalf("Allows(%s) = %t, want %t", test.method, got, test.want)
}
})
}
}
func TestUpdateAllowedByIdentityFiltersUnknownFieldsAndUsesIdentity(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectBegin()
mock.ExpectExec(regexp.QuoteMeta(`UPDATE "platform_role" SET "status"=$1,"updated_at"=$2 WHERE identity = $3`)).
WithArgs("disabled", sqlmock.AnyArg(), "role-a").
WillReturnResult(sqlmock.NewResult(0, 1))
mock.ExpectCommit()
ctx, recorder := updateContext(http.MethodPatch, "/roles/role-a", "role-a", nil)
updateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "disabled", "is_system": true}, []string{"status"})
assertResponseCode(t, recorder, 0)
assertMockExpectations(t, mock)
}
func TestUpdateAllowedByIdentityReturnsNotFoundForZeroRows(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectBegin()
mock.ExpectExec(regexp.QuoteMeta(`UPDATE "platform_role" SET "status"=$1,"updated_at"=$2 WHERE identity = $3`)).
WithArgs("disabled", sqlmock.AnyArg(), "missing").
WillReturnResult(sqlmock.NewResult(0, 0))
mock.ExpectCommit()
ctx, recorder := updateContext(http.MethodPatch, "/roles/missing", "missing", nil)
updateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "disabled"}, []string{"status"})
assertResponseCode(t, recorder, int32(status.Code(errcode.ErrRecordNotFound)))
assertMockExpectations(t, mock)
}
func TestUpdateAllowedByIdentityReturnsUniformResponseForDatabaseError(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectBegin()
mock.ExpectExec(regexp.QuoteMeta(`UPDATE "platform_role" SET "status"=$1,"updated_at"=$2 WHERE identity = $3`)).
WithArgs("disabled", sqlmock.AnyArg(), "role-a").
WillReturnError(errors.New("database unavailable"))
mock.ExpectRollback()
ctx, recorder := updateContext(http.MethodPatch, "/roles/role-a", "role-a", nil)
updateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": "disabled"}, []string{"status"})
var reply responseBody
if err := json.Unmarshal(recorder.Body.Bytes(), &reply); err != nil {
t.Fatal(err)
}
if reply.Code != 500 || reply.Message == "" || string(reply.Details) != `""` {
t.Fatalf("database error did not use uniform response: %s", recorder.Body.String())
}
}
func TestPlatformRoleStatusAndArchiveReturnNotFoundWhenUpdateAffectsZeroRows(t *testing.T) {
for _, test := range []struct {
name string
handler gin.HandlerFunc
method string
body string
status string
}{
{"status", UpdatePlatformRoleStatus, http.MethodPatch, `{"status":"disabled"}`, "disabled"},
{"archive", ArchivePlatformRole, http.MethodDelete, "", "archived"},
} {
t.Run(test.name, func(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectQuery(regexp.QuoteMeta(`SELECT * FROM "platform_role" WHERE identity = $1 ORDER BY "platform_role"."id" LIMIT $2`)).
WithArgs("role-a", 1).
WillReturnRows(platformRoleRows("role-a"))
mock.ExpectBegin()
mock.ExpectExec(regexp.QuoteMeta(`UPDATE "platform_role" SET "status"=$1,"updated_at"=$2 WHERE identity = $3`)).
WithArgs(test.status, sqlmock.AnyArg(), "role-a").
WillReturnResult(sqlmock.NewResult(0, 0))
mock.ExpectCommit()
ctx, recorder := updateContext(test.method, "/roles/role-a", "role-a", []byte(test.body))
test.handler(ctx)
assertResponseCode(t, recorder, int32(status.Code(errcode.ErrRecordNotFound)))
assertMockExpectations(t, mock)
})
}
}
func TestReplacePlatformRoleMenusAllowsAnEmptySetToClearAssignmentsTransactionally(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectBegin()
mock.ExpectQuery(regexp.QuoteMeta(`SELECT * FROM "platform_role" WHERE identity = $1 ORDER BY "platform_role"."id" LIMIT $2`)).
WithArgs("role-a", 1).
WillReturnRows(platformRoleRows("role-a"))
mock.ExpectExec(regexp.QuoteMeta(`DELETE FROM "platform_role_menu_relation" WHERE platform_role_id = $1`)).
WithArgs(uint64(1)).
WillReturnResult(sqlmock.NewResult(0, 2))
mock.ExpectCommit()
ctx, recorder := updateContext(http.MethodPut, "/roles/role-a/menus", "role-a", []byte(`{"menu_identities":[]}`))
ReplacePlatformRoleMenus(ctx)
assertResponseCode(t, recorder, 0)
assertMockExpectations(t, mock)
}
func TestReplacePlatformRoleMenusRejectsSystemRoleBeforeChangingRelations(t *testing.T) {
_, mock := setupPlatformRoleDatabase(t)
mock.ExpectBegin()
mock.ExpectQuery(regexp.QuoteMeta(`SELECT * FROM "platform_role" WHERE identity = $1 ORDER BY "platform_role"."id" LIMIT $2`)).
WithArgs("root-role", 1).
WillReturnRows(platformSystemRoleRows("root-role"))
mock.ExpectRollback()
ctx, recorder := updateContext(http.MethodPut, "/roles/root-role/menus", "root-role", []byte(`{"menu_identities":[]}`))
ReplacePlatformRoleMenus(ctx)
assertResponseCode(t, recorder, int32(status.Code(errcode.ErrInvalidArgument)))
assertMockExpectations(t, mock)
}
type responseBody struct {
Code int32 `json:"code"`
Message string `json:"message"`
Details json.RawMessage `json:"details"`
}
func setupPlatformRoleDatabase(t *testing.T) (*gorm.DB, sqlmock.Sqlmock) {
t.Helper()
previous := impl.DBService
sqlDatabase, mock, err := sqlmock.New()
if err != nil {
t.Fatal(err)
}
database, err := gorm.Open(postgres.New(postgres.Config{Conn: sqlDatabase}), &gorm.Config{})
if err != nil {
t.Fatal(err)
}
impl.DBService = database
t.Cleanup(func() {
impl.DBService = previous
_ = sqlDatabase.Close()
})
return database, mock
}
func platformRoleRows(identity string) *sqlmock.Rows {
return sqlmock.NewRows([]string{"id", "identity", "created_at", "updated_at", "status", "version", "role_code", "name", "data_scope", "is_system"}).
AddRow(uint64(1), identity, nil, nil, "enabled", 1, identity, identity, "global", false)
}
func platformSystemRoleRows(identity string) *sqlmock.Rows {
return sqlmock.NewRows([]string{"id", "identity", "created_at", "updated_at", "status", "version", "role_code", "name", "data_scope", "is_system"}).
AddRow(uint64(1), identity, nil, nil, "enabled", 1, identity, identity, "global", true)
}
func updateContext(method, target, identity string, body []byte) (*gin.Context, *httptest.ResponseRecorder) {
recorder := httptest.NewRecorder()
ctx, _ := gin.CreateTestContext(recorder)
ctx.Request = httptest.NewRequest(method, target, bytes.NewReader(body))
ctx.Request.Header.Set("Content-Type", "application/json")
ctx.Params = gin.Params{{Key: "identity", Value: identity}}
return ctx, recorder
}
func assertResponseCode(t *testing.T, recorder *httptest.ResponseRecorder, want int32) {
t.Helper()
var reply responseBody
if err := json.Unmarshal(recorder.Body.Bytes(), &reply); err != nil {
t.Fatal(err)
}
if reply.Code != want {
t.Fatalf("response code = %d, want %d: %s", reply.Code, want, recorder.Body.String())
}
}
func assertMockExpectations(t *testing.T, mock sqlmock.Sqlmock) {
t.Helper()
if err := mock.ExpectationsWereMet(); err != nil {
t.Fatal(err)
}
}
func assertContract(t *testing.T, contracts []ResourceContract, domain, name string, mode ResourceMode, pageKind string) {
t.Helper()
for _, contract := range contracts {
if contract.Domain == domain && contract.Name == name && contract.Mode == mode && contract.PageKind == pageKind {
return
}
}
t.Fatalf("missing resource contract %s/%s with mode %q and page kind %q", domain, name, mode, pageKind)
}

276
backend/api/internal/logic/platform/role.go Normal file
View File

@@ -0,0 +1,276 @@
package platform
import (
"errors"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
"gorm.io/gorm"
)
var errSystemPlatformRole = errors.New("system platform roles cannot be modified")
// ListPlatformRole 查询平台角色分页列表。
func ListPlatformRole(ctx *gin.Context) { listPage[models.PlatformRole](ctx) }
// GetPlatformRole 查询一个平台角色。
func GetPlatformRole(ctx *gin.Context) { getByIdentity[models.PlatformRole](ctx) }
// CreatePlatformRole 创建非内置平台角色。
func CreatePlatformRole(ctx *gin.Context) {
var request models.PlatformRole
if err := ctx.ShouldBindJSON(&request); err != nil || request.RoleCode == "" || request.Name == "" || request.RoleCode == "root" {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
request.Entity = newEntity("enabled")
request.IsSystem = false
if request.DataScope == "" {
request.DataScope = "global"
}
if err := impl.DBService.Create(&request).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, request)
}
// UpdatePlatformRole 更新非内置平台角色。
func UpdatePlatformRole(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
DataScope string `json:"data_scope" binding:"required,max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"name": request.Name, "data_scope": request.DataScope}, []string{"name", "data_scope"})
}
type platformMenuRequest struct {
ParentID uint64 `json:"parent_id"`
MenuCode string `json:"menu_code" binding:"required,max=64"`
Name string `json:"name" binding:"required,max=64"`
Icon string `json:"icon" binding:"max=64"`
Path string `json:"path" binding:"max=255"`
SortNo int `json:"sort_no"`
}
func GetPlatformMenu(ctx *gin.Context) { getByIdentity[models.PlatformMenu](ctx) }
func CreatePlatformMenu(ctx *gin.Context) {
var request platformMenuRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
menu := models.PlatformMenu{Entity: newEntity("enabled"), ParentID: request.ParentID, MenuCode: request.MenuCode, Name: request.Name, Icon: request.Icon, Path: request.Path, SortNo: request.SortNo}
if err := impl.DBService.Create(&menu).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, menu)
}
func UpdatePlatformMenu(ctx *gin.Context) {
var request platformMenuRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.PlatformMenu{}, gin.H{"parent_id": request.ParentID, "name": request.Name, "icon": request.Icon, "path": request.Path, "sort_no": request.SortNo}, []string{"parent_id", "name", "icon", "path", "sort_no"})
}
type platformRoleMenusRequest struct {
MenuIdentities []string `json:"menu_identities" binding:"required"`
}
// ReplacePlatformRoleMenus replaces every menu assignment for a role atomically.
func ReplacePlatformRoleMenus(ctx *gin.Context) {
var request platformRoleMenusRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
if err := impl.DBService.Transaction(func(transaction *gorm.DB) error {
var role models.PlatformRole
if err := transaction.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
return err
}
if role.IsSystem {
return errSystemPlatformRole
}
var menus []models.PlatformMenu
if len(request.MenuIdentities) > 0 {
if err := transaction.Where("identity IN ?", request.MenuIdentities).Find(&menus).Error; err != nil {
return err
}
if len(menus) != len(request.MenuIdentities) {
return gorm.ErrRecordNotFound
}
}
if err := transaction.Where("platform_role_id = ?", role.ID).Delete(&models.PlatformRoleMenuRelation{}).Error; err != nil {
return err
}
for _, menu := range menus {
relation := models.PlatformRoleMenuRelation{PlatformRoleID: role.ID, PlatformMenuID: menu.ID}
if err := transaction.Create(&relation).Error; err != nil {
return err
}
}
return nil
}); err != nil {
if errors.Is(err, gorm.ErrRecordNotFound) {
infra.Response.Error(ctx, errcode.ErrRecordNotFound)
return
}
if errors.Is(err, errSystemPlatformRole) {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, gin.H{"updated": true})
}
// UpdatePlatformRoleStatus 更新非内置平台角色状态，系统角色始终受保护。
func UpdatePlatformRoleStatus(ctx *gin.Context) {
var request struct {
Status string `json:"status" binding:"required,max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.PlatformRole{}, gin.H{"status": request.Status}, []string{"status"})
}
// ArchivePlatformRole 归档非内置平台角色，系统角色始终受保护。
func ArchivePlatformRole(ctx *gin.Context) {
var role models.PlatformRole
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&role).Error; err != nil {
respondRecordError(ctx, err)
return
}
if role.IsSystem {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.PlatformRole{}, archiveValues(), []string{"status"})
}
// ListPlatformMenu 返回菜单树构建所需的有序菜单列表。
func ListPlatformMenu(ctx *gin.Context) {
var list []models.PlatformMenu
if err := impl.DBService.Order("sort_no asc, id asc").Find(&list).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, gin.H{"total": len(list), "list": list})
}
// ListPlatfromAccount 查询平台账号列表，手机号在展示层脱敏。
func ListPlatfromAccount(ctx *gin.Context) {
page, size := pageSize(ctx)
list, total, err := models.ListPlatfromAccount(page, size)
if err != nil {
infra.Response.Error(ctx, err)
return
}
views := make([]gin.H, 0, len(list))
for _, item := range list {
views = append(views, gin.H{"identity": item.Identity, "username": item.Username, "display_name": item.DisplayName, "avatar": item.Avatar, "phone_masked": maskPhone(item.Phone), "platform_role_code": item.PlatformRoleCode, "status": item.Status})
}
infra.Response.Success(ctx, gin.H{"total": total, "list": views})
}
type platfromAccountRequest struct {
Username string `json:"username" binding:"required,max=64"`
Password string `json:"password" binding:"required,min=8,max=128"`
DisplayName string `json:"display_name" binding:"max=64"`
Avatar string `json:"avatar" binding:"max=512"`
PlatformRoleCode string `json:"platform_role_code" binding:"max=64"`
Phone string `json:"phone" binding:"max=32"`
}
type platfromAccountView struct {
Identity string `json:"identity"`
Username string `json:"username"`
DisplayName string `json:"display_name"`
Avatar string `json:"avatar"`
PhoneMasked string `json:"phone_masked"`
PlatformRoleCode string `json:"platform_role_code"`
Status string `json:"status"`
}
func platformAccountView(account models.PlatfromAccount) platfromAccountView {
return platfromAccountView{Identity: account.Identity, Username: account.Username, DisplayName: account.DisplayName, Avatar: account.Avatar, PhoneMasked: maskPhone(account.Phone), PlatformRoleCode: account.PlatformRoleCode, Status: account.Status}
}
func GetPlatfromAccount(ctx *gin.Context) {
var account models.PlatfromAccount
if err := impl.DBService.Where("identity = ?", ctx.Param("identity")).First(&account).Error; err != nil {
respondRecordError(ctx, err)
return
}
infra.Response.Success(ctx, platformAccountView(account))
}
func CreatePlatfromAccount(ctx *gin.Context) {
var request platfromAccountRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
hash, err := passwordHash(request.Password)
if err != nil {
infra.Response.Error(ctx, err)
return
}
account := models.PlatfromAccount{Entity: newEntity("enabled"), Username: request.Username, DisplayName: request.DisplayName, Avatar: request.Avatar, PasswordHash: hash, PlatformRoleCode: request.PlatformRoleCode, Phone: request.Phone}
if account.PlatformRoleCode == "" {
account.PlatformRoleCode = "root"
}
if err := impl.DBService.Create(&account).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, platformAccountView(account))
}
func UpdatePlatfromAccount(ctx *gin.Context) {
var request struct {
DisplayName string `json:"display_name" binding:"max=64"`
Avatar string `json:"avatar" binding:"max=512"`
PlatformRoleCode string `json:"platform_role_code" binding:"max=64"`
Phone string `json:"phone" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.PlatfromAccount{}, gin.H{"display_name": request.DisplayName, "avatar": request.Avatar, "platform_role_code": request.PlatformRoleCode, "phone": request.Phone}, []string{"display_name", "avatar", "platform_role_code", "phone"})
}

105
backend/api/internal/logic/platform/secondary_resource.go Normal file
View File

@@ -0,0 +1,105 @@
package platform
import (
"time"
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
type staffCredentialRequest struct {
StaffAccountID uint64 `json:"staff_account_id" binding:"required"`
CredentialType string `json:"credential_type" binding:"required,max=64"`
CredentialNo string `json:"credential_no" binding:"max=128"`
ExpiredAt *time.Time `json:"expired_at"`
}
func ListStaffCredential(ctx *gin.Context) { listPage[models.StaffCredential](ctx) }
func GetStaffCredential(ctx *gin.Context) { getByIdentity[models.StaffCredential](ctx) }
func CreateStaffCredential(ctx *gin.Context) {
var request staffCredentialRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
credential := models.StaffCredential{Entity: newEntity("enabled"), StaffAccountID: request.StaffAccountID, CredentialType: request.CredentialType, CredentialNo: request.CredentialNo, ExpiredAt: request.ExpiredAt}
if err := impl.DBService.Create(&credential).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, credential)
}
func UpdateStaffCredential(ctx *gin.Context) {
var request staffCredentialRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.StaffCredential{}, gin.H{"staff_account_id": request.StaffAccountID, "credential_type": request.CredentialType, "credential_no": request.CredentialNo, "expired_at": request.ExpiredAt}, []string{"staff_account_id", "credential_type", "credential_no", "expired_at"})
}
type userAddressRequest struct {
UserAccountID uint64 `json:"user_account_id" binding:"required"`
Address string `json:"address" binding:"required,max=255"`
Longitude string `json:"longitude" binding:"max=32"`
Latitude string `json:"latitude" binding:"max=32"`
IsDefault bool `json:"is_default"`
}
func ListUserAddress(ctx *gin.Context) { listPage[models.UserAddress](ctx) }
func GetUserAddress(ctx *gin.Context) { getByIdentity[models.UserAddress](ctx) }
func CreateUserAddress(ctx *gin.Context) {
var request userAddressRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
address := models.UserAddress{Entity: newEntity("enabled"), UserAccountID: request.UserAccountID, Address: request.Address, Longitude: request.Longitude, Latitude: request.Latitude, IsDefault: request.IsDefault}
if err := impl.DBService.Create(&address).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, address)
}
func UpdateUserAddress(ctx *gin.Context) {
var request userAddressRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.UserAddress{}, gin.H{"user_account_id": request.UserAccountID, "address": request.Address, "longitude": request.Longitude, "latitude": request.Latitude, "is_default": request.IsDefault}, []string{"user_account_id", "address", "longitude", "latitude", "is_default"})
}
type userServiceRelationRequest struct {
UserAccountID uint64 `json:"user_account_id" binding:"required"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
StaffAccountID uint64 `json:"staff_account_id"`
}
func ListUserServiceRelation(ctx *gin.Context) { listPage[models.UserServiceRelation](ctx) }
func GetUserServiceRelation(ctx *gin.Context) { getByIdentity[models.UserServiceRelation](ctx) }
func CreateUserServiceRelation(ctx *gin.Context) {
var request userServiceRelationRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
relation := models.UserServiceRelation{Entity: newEntity("enabled"), UserAccountID: request.UserAccountID, GasBasicID: request.GasBasicID, DeliveryBasicID: request.DeliveryBasicID, StaffAccountID: request.StaffAccountID}
if err := impl.DBService.Create(&relation).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, relation)
}
func UpdateUserServiceRelation(ctx *gin.Context) {
var request userServiceRelationRequest
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.UserServiceRelation{}, gin.H{"user_account_id": request.UserAccountID, "gas_basic_id": request.GasBasicID, "delivery_basic_id": request.DeliveryBasicID, "staff_account_id": request.StaffAccountID}, []string{"user_account_id", "gas_basic_id", "delivery_basic_id", "staff_account_id"})
}

66
backend/api/internal/logic/platform/staff.go Normal file
View File

@@ -0,0 +1,66 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
// ListStaff 查询服务人员分页列表。
func ListStaff(ctx *gin.Context) { listPage[models.StaffAccount](ctx) }
// GetStaff 查询一个服务人员档案。
func GetStaff(ctx *gin.Context) { getByIdentity[models.StaffAccount](ctx) }
// CreateStaff 创建服务人员档案。
func CreateStaff(ctx *gin.Context) {
var request struct {
Username string `json:"username" binding:"required,max=64"`
Password string `json:"password" binding:"required,min=8,max=128"`
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RoleCode string `json:"role_code" binding:"max=64"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
WorkStatus string `json:"work_status" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
hash, err := passwordHash(request.Password)
if err != nil {
infra.Response.Error(ctx, err)
return
}
staff := models.StaffAccount{Entity: newEntity("draft"), Username: request.Username, PasswordHash: hash, Name: request.Name, Phone: request.Phone, Avatar: request.Avatar, RoleCode: request.RoleCode, GasBasicID: request.GasBasicID, DeliveryBasicID: request.DeliveryBasicID, WorkStatus: request.WorkStatus}
if staff.WorkStatus == "" {
staff.WorkStatus = "off_duty"
}
if err := impl.DBService.Create(&staff).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, staff)
}
// UpdateStaff 更新服务人员档案。
func UpdateStaff(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RoleCode string `json:"role_code" binding:"max=64"`
GasBasicID uint64 `json:"gas_basic_id"`
DeliveryBasicID uint64 `json:"delivery_basic_id"`
WorkStatus string `json:"work_status" binding:"max=32"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.StaffAccount{}, gin.H{"name": request.Name, "phone": request.Phone, "avatar": request.Avatar, "role_code": request.RoleCode, "gas_basic_id": request.GasBasicID, "delivery_basic_id": request.DeliveryBasicID, "work_status": request.WorkStatus}, []string{"name", "phone", "avatar", "role_code", "gas_basic_id", "delivery_basic_id", "work_status"})
}

57
backend/api/internal/logic/platform/user.go Normal file
View File

@@ -0,0 +1,57 @@
package platform
import (
"git.apinb.com/bsm-sdk/core/errcode"
"git.apinb.com/bsm-sdk/core/infra"
"git.apinb.com/heqiapp/platforms/backend/api/internal/impl"
"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
"github.com/gin-gonic/gin"
)
// ListUser 查询业主客户分页列表。
func ListUser(ctx *gin.Context) { listPage[models.UserAccount](ctx) }
// GetUser 查询一个业主客户档案。
func GetUser(ctx *gin.Context) { getByIdentity[models.UserAccount](ctx) }
// CreateUser 创建业主客户档案。
func CreateUser(ctx *gin.Context) {
var request struct {
Username string `json:"username" binding:"required,max=64"`
Password string `json:"password" binding:"required,min=8,max=128"`
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RealName string `json:"real_name" binding:"max=64"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
hash, err := passwordHash(request.Password)
if err != nil {
infra.Response.Error(ctx, err)
return
}
user := models.UserAccount{Entity: newEntity("enabled"), Username: request.Username, PasswordHash: hash, Name: request.Name, Phone: request.Phone, Avatar: request.Avatar, RealName: request.RealName}
if err := impl.DBService.Create(&user).Error; err != nil {
infra.Response.Error(ctx, err)
return
}
infra.Response.Success(ctx, user)
}
// UpdateUser 更新业主客户档案。
func UpdateUser(ctx *gin.Context) {
var request struct {
Name string `json:"name" binding:"required,max=64"`
Phone string `json:"phone" binding:"max=32"`
Avatar string `json:"avatar" binding:"max=512"`
RealName string `json:"real_name" binding:"max=64"`
}
if err := ctx.ShouldBindJSON(&request); err != nil {
infra.Response.Error(ctx, errcode.ErrInvalidArgument)
return
}
updateAllowedByIdentity(ctx, &models.UserAccount{}, gin.H{"name": request.Name, "phone": request.Phone, "avatar": request.Avatar, "real_name": request.RealName}, []string{"name", "phone", "avatar", "real_name"})
}

52
backend/api/internal/routers/platform.go
View File

@@ -30,47 +30,28 @@ func RegisterPlatform(serviceKey string, engine *gin.Engine) {
}
func registerGasRoute(group *gin.RouterGroup) {
resource := group.Group("/gas/gas_basic")
resource.GET("", platform.ListGasBasic)
resource.POST("", platform.CreateGasBasic)
resource.GET("/:identity", platform.GetGasBasic)
resource.PUT("/:identity", platform.UpdateGasBasic)
resource.PATCH("/:identity/status", func(ctx *gin.Context) { platform.UpdateRecordStatus(ctx, &models.GasBasic{}) })
resource.DELETE("/:identity", func(ctx *gin.Context) { platform.ArchiveRecord(ctx, &models.GasBasic{}) })
registerWritableResource(group, "/gas/gas_basic", platform.ListGasBasic, platform.CreateGasBasic, platform.GetGasBasic, platform.UpdateGasBasic, &models.GasBasic{})
registerWritableResource(group, "/gas/gas_account", platform.ListGasAccount, platform.CreateGasAccount, platform.GetGasAccount, platform.UpdateGasAccount, &models.GasAccount{})
}
func registerDeliveryRoute(group *gin.RouterGroup) {
resource := group.Group("/delivery/delivery_basic")
resource.GET("", platform.ListDeliveryBasic)
resource.POST("", platform.CreateDeliveryBasic)
resource.GET("/:identity", platform.GetDeliveryBasic)
resource.PUT("/:identity", platform.UpdateDeliveryBasic)
resource.PATCH("/:identity/status", func(ctx *gin.Context) { platform.UpdateRecordStatus(ctx, &models.DeliveryBasic{}) })
resource.DELETE("/:identity", func(ctx *gin.Context) { platform.ArchiveRecord(ctx, &models.DeliveryBasic{}) })
registerWritableResource(group, "/delivery/delivery_basic", platform.ListDeliveryBasic, platform.CreateDeliveryBasic, platform.GetDeliveryBasic, platform.UpdateDeliveryBasic, &models.DeliveryBasic{})
registerWritableResource(group, "/delivery/delivery_account", platform.ListDeliveryAccount, platform.CreateDeliveryAccount, platform.GetDeliveryAccount, platform.UpdateDeliveryAccount, &models.DeliveryAccount{})
}
func registerStaffRoute(group *gin.RouterGroup) {
resource := group.Group("/staff")
resource.GET("/account", platform.ListStaff)
resource.POST("/account", platform.CreateStaff)
resource.GET("/:identity", platform.GetStaff)
resource.PUT("/:identity", platform.UpdateStaff)
resource.PATCH("/:identity/status", func(ctx *gin.Context) { platform.UpdateRecordStatus(ctx, &models.StaffAccount{}) })
resource.DELETE("/:identity", func(ctx *gin.Context) { platform.ArchiveRecord(ctx, &models.StaffAccount{}) })
registerWritableResource(group, "/staff/account", platform.ListStaff, platform.CreateStaff, platform.GetStaff, platform.UpdateStaff, &models.StaffAccount{})
registerWritableResource(group, "/staff/credential", platform.ListStaffCredential, platform.CreateStaffCredential, platform.GetStaffCredential, platform.UpdateStaffCredential, &models.StaffCredential{})
}
func registerUserRoute(group *gin.RouterGroup) {
resource := group.Group("/user")
resource.GET("/account", platform.ListUser)
resource.POST("/account", platform.CreateUser)
resource.GET("/:identity", platform.GetUser)
resource.PUT("/:identity", platform.UpdateUser)
resource.PATCH("/:identity/status", func(ctx *gin.Context) { platform.UpdateRecordStatus(ctx, &models.UserAccount{}) })
resource.DELETE("/:identity", func(ctx *gin.Context) { platform.ArchiveRecord(ctx, &models.UserAccount{}) })
registerWritableResource(group, "/user/account", platform.ListUser, platform.CreateUser, platform.GetUser, platform.UpdateUser, &models.UserAccount{})
registerWritableResource(group, "/user/address", platform.ListUserAddress, platform.CreateUserAddress, platform.GetUserAddress, platform.UpdateUserAddress, &models.UserAddress{})
registerWritableResource(group, "/user/service_relation", platform.ListUserServiceRelation, platform.CreateUserServiceRelation, platform.GetUserServiceRelation, platform.UpdateUserServiceRelation, &models.UserServiceRelation{})
}
func registerPlatformRoute(group *gin.RouterGroup) {
group.GET("/platform/platfrom_account", platform.ListPlatfromAccount)
registerWritableResource(group, "/platform/platfrom_account", platform.ListPlatfromAccount, platform.CreatePlatfromAccount, platform.GetPlatfromAccount, platform.UpdatePlatfromAccount, &models.PlatfromAccount{})
role := group.Group("/platform/platform_role")
role.GET("", platform.ListPlatformRole)
role.POST("", platform.CreatePlatformRole)
@@ -78,5 +59,16 @@ func registerPlatformRoute(group *gin.RouterGroup) {
role.PUT("/:identity", platform.UpdatePlatformRole)
role.PATCH("/:identity/status", platform.UpdatePlatformRoleStatus)
role.DELETE("/:identity", platform.ArchivePlatformRole)
group.GET("/platform/platform_menu", platform.ListPlatformMenu)
role.PUT("/:identity/menus", platform.ReplacePlatformRoleMenus)
registerWritableResource(group, "/platform/platform_menu", platform.ListPlatformMenu, platform.CreatePlatformMenu, platform.GetPlatformMenu, platform.UpdatePlatformMenu, &models.PlatformMenu{})
}
func registerWritableResource(group *gin.RouterGroup, path string, list, create, get, update gin.HandlerFunc, model any) {
resource := group.Group(path)
resource.GET("", list)
resource.POST("", create)
resource.GET("/:identity", get)
resource.PUT("/:identity", update)
resource.PATCH("/:identity/status", func(ctx *gin.Context) { platform.UpdateRecordStatus(ctx, model) })
resource.DELETE("/:identity", func(ctx *gin.Context) { platform.ArchiveRecord(ctx, model) })
}

66
backend/api/internal/routers/platform_test.go Normal file
View File

@@ -0,0 +1,66 @@
package routers
import (
"net/http"
"testing"
"github.com/gin-gonic/gin"
)
func TestPlatformGasRouteUsesGasBasic(t *testing.T) {
engine := gin.New()
RegisterPlatform("heqi", engine)
for _, route := range engine.Routes() {
if route.Path == "/heqi/platform/v1/gas/gas_station" {
t.Fatal("gas station route must use gas_basic as its resource name")
}
if route.Method == "GET" && route.Path == "/heqi/platform/v1/gas/gas_basic" {
return
}
}
t.Fatal("gas_basic list route is not registered")
}
func TestPlatformOrganizationAndAccountRoutesExposeResourceCRUD(t *testing.T) {
engine := gin.New()
RegisterPlatform("heqi", engine)
routes := make(map[string]map[string]bool)
for _, route := range engine.Routes() {
if routes[route.Path] == nil {
routes[route.Path] = make(map[string]bool)
}
routes[route.Path][route.Method] = true
}
for _, resource := range []string{
"/gas/gas_basic",
"/gas/gas_account",
"/delivery/delivery_basic",
"/delivery/delivery_account",
"/staff/account",
"/staff/credential",
"/user/account",
"/user/address",
"/user/service_relation",
"/platform/platfrom_account",
"/platform/platform_role",
"/platform/platform_menu",
} {
assertRouteMethods(t, routes, "/heqi/platform/v1"+resource, http.MethodGet, http.MethodPost)
assertRouteMethods(t, routes, "/heqi/platform/v1"+resource+"/:identity", http.MethodGet, http.MethodPut, http.MethodDelete)
assertRouteMethods(t, routes, "/heqi/platform/v1"+resource+"/:identity/status", http.MethodPatch)
}
assertRouteMethods(t, routes, "/heqi/platform/v1/platform/platform_role/:identity/menus", http.MethodPut)
}
func assertRouteMethods(t *testing.T, routes map[string]map[string]bool, path string, methods ...string) {
t.Helper()
for _, method := range methods {
if !routes[path][method] {
t.Errorf("route %s %s is not registered", method, path)
}
}
}

BIN
backend/api/main.exe Normal file
View File

Binary file not shown.

57
backend/go.work.sum
View File

@@ -1,49 +1,106 @@
cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
github.com/elastic/elastic-transport-go/v8 v8.9.0 h1:KeT/2P54F0xS0S8Y3Pf+tFDg4HmBgReQMB+BMz8dDAs=
github.com/elastic/elastic-transport-go/v8 v8.9.0/go.mod h1:ssMTvNS2hwf7CaiGsRRsx4gQHFZ/jS/DkLcISxekWzc=
github.com/elastic/go-elasticsearch/v9 v9.4.1 h1:pEF8xlnL8D2WdVp4HRHhGNUwC5QHdgk0DZKrJY0WCNs=
github.com/elastic/go-elasticsearch/v9 v9.4.1/go.mod h1:IKW8WkW++PW8If95XqfMffGjoFrzHCpsKmWgYk5j3fQ=
github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I=
github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1/go.mod h1:lXGCsh6c22WGtjr+qGHj1otzZpV/1kwTMAqkwZsnWRU=
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 h1:pRhl55Yx1eC7BZ1N+BBWwnKaMyD8uC+34TLdndZMAKk=
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0/go.mod h1:XKMd7iuf/RGPSMJ/U4HP0zS2Z9Fh8Ps9a+6X26m/tmI=
github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e h1:a+PGEeXb+exwBS3NboqXHyxarD9kaboBbrSp+7GuBuc=
github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e/go.mod h1:ZybsQk6DWyN5t7An1MuPm1gtSZ1xDaTXS9ZjIOxvQrk=
github.com/kisielk/errcheck v1.5.0 h1:e8esj/e4R+SAOwFwN+n3zr0nYeCyeweozKfO23MvHzY=
github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc=
github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
github.com/nats-io/nkeys v0.4.15 h1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=
github.com/nats-io/nkeys v0.4.15/go.mod h1:CpMchTXC9fxA5zrMo4KpySxNjiDVvr8ANOSZdiNfUrs=
github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30 h1:BHT1/DKsYDGkUgQ2jmMaozVcdk+sVfz0+1ZJq4zkWgw=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
github.com/xdg-go/scram v1.2.0 h1:bYKF2AEwG5rqd1BumT4gAnvwU/M9nBp2pTSxeZw7Wvs=
github.com/xdg-go/scram v1.2.0/go.mod h1:3dlrS0iBaWKYVt2ZfA4cj48umJZ+cAEbR6/SjLA88I8=
github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
github.com/yuin/goldmark v1.2.1 h1:ruQGxdhGHe7FWOJPT0mKs5+pD2Xs1Bm/kdGlHO04FmM=
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
rsc.io/pdf v0.1.1 h1:k1MczvYDUvJBe93bYd7wrZLLUEcLZAuF824/I4e5Xr4=
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=

365
docs/superpowers/plans/2026-07-27-platform-admin-full-audit.md Normal file
View File

@@ -0,0 +1,365 @@
# 平台总后台全量审计与修复 Implementation Plan
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
**Goal:** 让后台模型、API、菜单、路由和 Vue 页面完整符合需求分析，并以自动检查证明逐资源连通。
**Architecture:** 后端以受约束的资源定义复用分页、按 `identity` 查询、状态更新和归档；账户、角色、菜单、事件处置与审批保留专用处理器。前端通过同一资源声明驱动标准 CRUD、只读和树页面，专用看板与轨迹页面独立实现。
**Tech Stack:** Go 1.26、Gin、GORM、Vue 3、TypeScript、Arco Design Vue、Vite、Biome、pnpm。
## Global Constraints
- 将未提交的 `backend/api/internal/logic/platform` 文件视为本次可修改的审计基线。
- 气站名称和路由固定为 `gas_basic`，不得改用 `gas_station`。
- 设备管理是一级领域，涵盖瓶阀、绑定、遥测、安全规则、事件、处置和安检。
- 所有模型和字段均保留准确的中文注释。
- HTTP 只传 UUID V7 `identity`，字段使用 `snake_case`，金额使用最小货币单位整数。
- 主数据以 `status=archived` 归档；钱包、流水、充值、提现、报表和审计只读。
- 每项功能先写失败测试或审计断言，再写最小实现；每领域独立验证并提交。
## File Structure
- `backend/api/internal/logic/platform/resource.go`：资源定义、通用 CRUD、只读限制和字段白名单。
- `backend/api/internal/logic/platform/{organization,device,commerce,finance,content,audit}.go`：领域资源和专用动作。
- `backend/api/internal/routers/platform.go`：领域 API 注册。
- `backend/api/internal/models/*.go`：模型字段、关联、索引和中文注释修订。
- `backend/api/internal/{logic/platform,routers}/*_test.go`：资源契约、路由、只读和角色保护测试。
- `frontend/platform_admin/src/api/resources.ts`：资源键、路径、页面类型和表单字段的唯一声明。
- `frontend/platform_admin/src/views/shared/{CrudListPage,ReadOnlyListPage,TreePage}.vue`：三类可复用页面。
- `frontend/platform_admin/src/views/**/ListPage.vue`：资源声明页面；看板和轨迹使用专用组件。
- `frontend/platform_admin/src/router/routes/modules/platform.ts`：完整菜单和路由树。
- `frontend/platform_admin/scripts/audit-check.mjs`：模型、路由、前端 API、页面的静态一致性检查。
## Resource Contract
可写资源：`gas_basic`、`gas_account`、`delivery_basic`、`delivery_account`、`staff_account`、`staff_credential`、`user_account`、`user_address`、`user_service_relation`、`dev_smart_cylinder_valve`、`dev_device_binding`、`saf_rule`、`saf_event`、`saf_inspection`、`ec_category`、`ec_product`、`ec_product_attribute`、`ec_product_image`、`ec_cart`、`ec_order`、`ec_review`、`delivery_task`、`delivery_track`、`delivery_track_point`、`fin_payment`、`fin_settlement`、`fin_reconciliation`、`cnt_content`、`ntf_template`、`cs_ticket`、`platfrom_account`、`platform_role`、`platform_menu`。
只读资源：`dev_telemetry`、`wallet`、`wallet_ledger`、`wallet_recharge`、`wallet_withdrawal`、`report`、`report_item`、`report_metric_snapshot`、`aud_operation_log`、`aud_export_log`、`aud_approval`。`saf_event_disposal` 是仅追加的事件动作记录。
### Task 1: 建立资源契约和审计基线
**Files:**
- Create: `backend/api/internal/logic/platform/resource.go`
- Create: `backend/api/internal/logic/platform/resource_test.go`
- Create: `backend/api/internal/routers/platform_test.go`
- Modify: `frontend/platform_admin/scripts/audit-check.mjs`
- Modify: `frontend/platform_admin/package.json`
**Interfaces:** `ExpectedResources() []ResourceContract` 返回领域、资源名、读写模式和页面类型；`pnpm audit:platform` 缺层时输出 `domain/name: missing <layer>`。
- [ ] **Step 1: 写失败的资源契约测试。**
```go
func TestExpectedResources(t *testing.T) {
assertContract(t, ExpectedResources(), "gas", "gas_basic", Writable, "list")
assertContract(t, ExpectedResources(), "device", "saf_event", Writable, "list")
assertContract(t, ExpectedResources(), "wallet", "wallet_ledger", ReadOnly, "list")
}
```
- [ ] **Step 2: 运行失败测试。**
Run: `go test ./internal/logic/platform ./internal/routers -run TestExpectedResources -v`
Expected: FAIL，提示 `ExpectedResources`、`ResourceContract` 或资源模式尚未定义。
- [ ] **Step 3: 实现完整资源清单和审计命令。**
```go
type ResourceMode string
const ( Writable ResourceMode = "writable"; ReadOnly ResourceMode = "readonly" )
type ResourceContract struct { Domain, Name, PageKind string; Mode ResourceMode }
func ExpectedResources() []ResourceContract { return []ResourceContract{{"gas", "gas_basic", "list", Writable}} }
```
将完整 `Resource Contract` 清单写入函数和 JSON 可读清单；脚本核对 `resources.ts`、路由模块及页面路径。
- [ ] **Step 4: 运行资源测试和审计命令。**
Run: `go test ./internal/logic/platform ./internal/routers -run TestExpectedResources -v; pnpm audit:platform`
Expected: 测试 PASS；审计命令列出当前缺失层，作为后续任务的失败清单。
- [ ] **Step 5: 提交基线。**
```powershell
git add backend/api/internal/logic/platform/resource.go backend/api/internal/logic/platform/resource_test.go backend/api/internal/routers/platform_test.go frontend/platform_admin/scripts/audit-check.mjs frontend/platform_admin/package.json
git commit -m "test: add platform resource contract audit"
```
### Task 2: 修订模型和通用后端资源处理器
**Files:**
- Modify: `backend/api/internal/logic/platform/platform.go`
- Modify: `backend/api/internal/logic/platform/resource.go`
- Modify: `backend/api/internal/models/entity.go`
- Modify: `backend/api/internal/models/*.go`
- Test: `backend/api/internal/logic/platform/resource_test.go`
**Interfaces:** `ResourceDefinition{Domain, Name, Model, Mode, CreateFields, UpdateFields}`；`RegisterResource(*gin.RouterGroup, ResourceDefinition)`；通用列表、详情、创建、更新、状态和归档处理器。
- [ ] **Step 1: 写失败的只读、字段白名单和归档测试。**
```go
func TestReadOnlyResourceRejectsWrite(t *testing.T) {
if (ResourceDefinition{Mode: ReadOnly}).Allows(http.MethodPost) { t.Fatal("readonly POST") }
}
func TestArchiveUsesStatus(t *testing.T) {
if archiveValues()["status"] != "archived" { t.Fatal("must archive") }
}
```
- [ ] **Step 2: 运行失败测试。**
Run: `go test ./internal/logic/platform -run 'Test(ReadOnly|Archive)' -v`
Expected: FAIL，因为 `Allows` 和 `archiveValues` 不存在。
- [ ] **Step 3: 实现最小通用处理器和模型审计。**
```go
func (d ResourceDefinition) Allows(method string) bool { return d.Mode == Writable || method == http.MethodGet }
func archiveValues() gin.H { return gin.H{"status": "archived"} }
```
逐模型核对 `Entity`、业务编码唯一索引、关联字段和中文注释。仅当字段不在需求、无 GORM 关联或索引、无 HTTP 和前端消费者时才删除，并将理由写入最终报告。
- [ ] **Step 4: 验证通用层。**
Run: `gofmt -w internal/logic/platform internal/models; go test ./...; go build ./cmd/main`
Expected: PASS。
- [ ] **Step 5: 提交通用层。**
```powershell
git add backend/api/internal/logic/platform backend/api/internal/models
git commit -m "feat: add audited platform resource foundation"
```
### Task 3: 完成组织、账户、人员和用户领域
**Files:**
- Create: `backend/api/internal/logic/platform/organization.go`
- Modify: `backend/api/internal/logic/platform/{gas,delivery,staff,user,role}.go`
- Modify: `backend/api/internal/routers/platform.go`
- Test: `backend/api/internal/logic/platform/organization_test.go`
**Interfaces:** 注册 `/gas/gas_basic`、`/gas/gas_account`、`/delivery/delivery_basic`、`/delivery/delivery_account`、`/staff/account`、`/staff/credential`、`/user/account`、`/user/address`、`/user/service_relation`、`/platform/platfrom_account`、`/platform/platform_role`、`/platform/platform_menu`。
- [ ] **Step 1: 写失败的名称和角色保护测试。**
```go
func TestOrganizationRoutesKeepGasBasic(t *testing.T) { assertRoute(t, routes, http.MethodGet, "/gas/gas_basic") }
func TestSystemRoleCannotMutate(t *testing.T) { if mayMutateRole(models.PlatformRole{IsSystem: true}) { t.Fatal("system role") } }
func TestAccountMasksPhone(t *testing.T) { if maskPhone("13812345678") != "138****5678" { t.Fatal("mask") } }
```
- [ ] **Step 2: 运行失败测试。**
Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Organization|SystemRole|Account)' -v`
Expected: FAIL，直至路由、系统角色保护和账户视图完成。
- [ ] **Step 3: 实现领域资源和专用动作。**
账户创建及角色菜单覆盖使用事务；更新只接受字段白名单；系统角色拒绝更新、状态变更与归档；平台账户只返回脱敏电话和非密码字段。
- [ ] **Step 4: 验证领域。**
Run: `go test ./internal/logic/platform ./internal/routers -v; go build ./cmd/main`
Expected: PASS。
- [ ] **Step 5: 提交领域。**
```powershell
git add backend/api/internal/logic/platform backend/api/internal/routers/platform.go
git commit -m "feat: complete organization account APIs"
```
### Task 4: 完成设备管理、电商和配送领域
**Files:**
- Create: `backend/api/internal/logic/platform/{device,commerce}.go`
- Modify: `backend/api/internal/logic/platform/delivery.go`
- Modify: `backend/api/internal/routers/platform.go`
- Test: `backend/api/internal/logic/platform/{device,commerce}_test.go`
**Interfaces:** 注册 `/device/*`、`/safety/*`、`/ec/*`、`/delivery/delivery_task`、`/delivery/delivery_track` 和 `/delivery/delivery_track_point`。
- [ ] **Step 1: 写失败的安全和订单轨迹测试。**
```go
func TestDeviceManagementIncludesSafety(t *testing.T) { assertContract(t, ExpectedResources(), "safety", "saf_event", Writable, "list") }
func TestSafetyDisposalIsAppendOnly(t *testing.T) { if disposalDefinition.Allows(http.MethodDelete) { t.Fatal("disposal delete") } }
func TestTrackPointRoute(t *testing.T) { assertRoute(t, routes, http.MethodPost, "/delivery/delivery_track_point") }
```
- [ ] **Step 2: 运行失败测试。**
Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Device|Safety|Track)' -v`
Expected: FAIL，直至领域资源与事件动作完成。
- [ ] **Step 3: 实现资源。**
设备、绑定、规则、事件和安检采用可写资源，遥测只读；事件处置在事务中更新事件并追加含 `operator_identity`、`action`、`reason` 的记录。商品、属性、图片、购物车、订单、订单项、评论、配送任务、轨迹和轨迹点全部注册；订单详情包含订单项，轨迹详情按时间包含轨迹点。
- [ ] **Step 4: 验证领域。**
Run: `go test ./...; go build ./cmd/main`
Expected: PASS。
- [ ] **Step 5: 提交领域。**
```powershell
git add backend/api/internal/logic/platform backend/api/internal/routers/platform.go
git commit -m "feat: complete device commerce delivery APIs"
```
### Task 5: 完成财务、钱包、报表、内容和审计领域
**Files:**
- Create: `backend/api/internal/logic/platform/{finance,content,audit}.go`
- Modify: `backend/api/internal/logic/platform/health.go`
- Modify: `backend/api/internal/models/query.go`
- Modify: `backend/api/internal/routers/platform.go`
- Test: `backend/api/internal/logic/platform/{finance,content,audit}_test.go`
**Interfaces:** 注册 `/finance/*`、`/wallet/*`、`/report/*`、`/content/*`、`/customer_service/*`、`/audit/*` 与扩展的 `/dashboard/overview`。
- [ ] **Step 1: 写失败的只读与审批审计测试。**
```go
func TestWalletAndReportAreReadOnly(t *testing.T) { assertNoRoute(t, routes, http.MethodPost, "/wallet/wallet") }
func TestApprovalStoresOperator(t *testing.T) { if approvalValues("approved", "op-1")["operator_identity"] != "op-1" { t.Fatal("operator") } }
```
- [ ] **Step 2: 运行失败测试。**
Run: `go test ./internal/logic/platform ./internal/routers -run 'Test(Wallet|Approval)' -v`
Expected: FAIL，直至只读路由和审批动作存在。
- [ ] **Step 3: 实现资源和看板聚合。**
支付、结算、对账、内容、模板和工单可写；钱包、资金流水、充值、提现、报表、指标快照与审计仅注册 GET。审批仅更新状态、意见、处理人和时间，并追加操作审计；空数据看板返回零值。
- [ ] **Step 4: 验证领域。**
Run: `go test ./...; go build ./cmd/main`
Expected: PASS。
- [ ] **Step 5: 提交领域。**
```powershell
git add backend/api/internal/logic/platform backend/api/internal/models/query.go backend/api/internal/routers/platform.go
git commit -m "feat: complete finance content audit APIs"
```
### Task 6: 建立前端资源契约并补齐页面
**Files:**
- Create: `frontend/platform_admin/src/api/resources.ts`
- Create: `frontend/platform_admin/src/views/shared/{ReadOnlyListPage,TreePage}.vue`
- Create: `frontend/platform_admin/src/views/{gas,delivery,staff,user,device,ec,finance,wallet,report,content,audit}/**/ListPage.vue`
- Modify: `frontend/platform_admin/src/views/shared/CrudListPage.vue`
- Modify: `frontend/platform_admin/src/api/{resource,platform,gas,delivery,staff,user}.ts`
- Modify: `frontend/platform_admin/src/router/routes/modules/platform.ts`
- Test: `frontend/platform_admin/scripts/audit-check.mjs`
**Interfaces:** `ResourceUiDefinition { key, resource, title, mode, pageKind, fields }`；每个后端契约对应一个前端资源、菜单路由和页面。
- [ ] **Step 1: 写失败的前端资源断言。**
```js
assertResource(resources, { key: 'gas-basic', resource: '/gas/gas_basic', mode: 'writable', pageKind: 'list' });
assertResource(resources, { key: 'wallet-ledger', resource: '/wallet/wallet_ledger', mode: 'readonly', pageKind: 'list' });
assertRouteFile('src/views/device/safety-event/ListPage.vue');
```
- [ ] **Step 2: 运行失败断言。**
Run: `pnpm audit:platform`
Expected: FAIL，列出缺失资源、页面或菜单路由。
- [ ] **Step 3: 实现资源声明、共享组件和页面。**
```ts
export type ResourceUiDefinition = { key: string; resource: string; title: string; mode: 'writable' | 'readonly'; pageKind: 'list' | 'tree' | 'dashboard'; fields: Array<{ key: string; label: string; required?: boolean }> };
export const resources: ResourceUiDefinition[] = [{ key: 'gas-basic', resource: '/gas/gas_basic', title: '气站管理', mode: 'writable', pageKind: 'list', fields: [{ key: 'code', label: '气站编码', required: true }, { key: 'name', label: '气站名称', required: true }] }];
```
`CrudListPage` 增加详情请求、归档二次确认、服务端筛选和类型化字段；`ReadOnlyListPage` 不渲染写操作；`TreePage` 支持父子节点、新增、编辑、排序和归档。每个页面只传资源声明，禁止复制 HTTP 调用。
- [ ] **Step 4: 验证前端。**
Run: `pnpm type:check; pnpm audit:platform; pnpm build`
Expected: PASS，且审计报告每个契约都有页面和菜单路由。
- [ ] **Step 5: 提交前端。**
```powershell
git add frontend/platform_admin/src frontend/platform_admin/scripts/audit-check.mjs frontend/platform_admin/package.json
git commit -m "feat: complete platform administration pages"
```
### Task 7: 全量映射、冗余清理和最终验收
**Files:**
- Modify: `backend/api/internal/logic/platform/*`
- Modify: `backend/api/internal/models/*`
- Modify: `backend/api/internal/routers/platform.go`
- Modify: `frontend/platform_admin/src/{api,router,views}/**/*`
- Modify: `frontend/platform_admin/scripts/audit-check.mjs`
- Create: `docs/平台总后台审计报告-2026-07-27.md`
**Interfaces:** 完整资源清单、后端注册路由、前端资源、页面与菜单必须一一对应。
- [ ] **Step 1: 写失败的全量映射测试。**
```go
func TestEveryContractHasRegisteredRoute(t *testing.T) {
for _, contract := range ExpectedResources() { assertResourceRoutes(t, registeredRoutes, contract) }
}
```
```js
for (const contract of expectedContracts) { assertBackendRoute(contract); assertFrontendResource(contract); assertPage(contract); assertMenuRoute(contract); }
```
- [ ] **Step 2: 运行全量映射测试。**
Run: `go test ./...; pnpm audit:platform`
Expected: 任一遗漏失败为 `domain/name: missing <layer>`。
- [ ] **Step 3: 修复遗漏并清理可证明冗余。**
仅删除同时满足“不在需求、无后端调用、无前端消费者、无测试或迁移依赖”的代码或字段；对保留的快照、审计和授权字段在报告说明用途。
- [ ] **Step 4: 运行最终验证。**
Run: `go test ./...; go build ./cmd/main; pnpm type:check; pnpm lint; pnpm audit:platform; pnpm build`
Expected: 全部 PASS，报告记录命令退出码及资源数量。
- [ ] **Step 5: 提交最终修复和审计报告。**
```powershell
git add backend/api frontend/platform_admin docs/平台总后台审计报告-2026-07-27.md
git commit -m "fix: complete platform admin audit remediation"
```
## Plan Self-Review
- 需求覆盖：Task 2 审计模型与基础语义；Task 3 至 5 覆盖所有后端领域；Task 6 覆盖菜单、路由和页面；Task 7 验证端到端映射并产出审计报告。
- 命名一致：后端和前端共享同一资源契约，气站唯一资源为 `/gas/gas_basic`。
- 非目标：不实现需求明确后置的双人复核、资金审批、敏感导出审批和精确轨迹回放；保留相关模型和扩展边界。
- 无占位项：资源、路径、命令、测试与提交范围均已给出。

55
docs/superpowers/specs/2026-07-27-platform-admin-full-audit-design.md Normal file
View File

@@ -0,0 +1,55 @@
# 平台总后台全量审计与修复设计
## 目标
依据 `docs/05-平台总后台需求-分析.md`，对 `backend/api` 与
`frontend/platform_admin` 进行一次性全量审计和修复。范围包括业务逻辑、功能与页面
缺失、冗余代码和模型字段、前后端接口连通性，以及模型的中文注释。
## 已确认约定
- 现有未提交的后端平台逻辑文件是本次审计基线，可以修改。
- 采用一次性全量铺开，而不是按领域分批交付。
- 气站资源、模型和页面继续使用既有的 `gas_basic` 命名；不得改回
`gas_station`。
- 设备管理是一级业务领域，涵盖智能瓶阀、绑定、遥测、安全规则、安全事件、
安全处置和安检记录。
- 数据模型必须保留中文注释。
## 架构与领域边界
后端以模型和需求领域划分路由及业务逻辑：认证与平台配置、组织和账户、人员与
用户、设备管理、电商与配送、财务与钱包报表、内容与审计。各领域使用统一的
分页、筛选、UUID `identity`、状态变更和逻辑归档约定。
前端根据需求表一次性补齐菜单、路由、页面及必要的抽屉组件。标准实体复用共享
CRUD 页面；分类和菜单使用树页面；钱包、流水、充值、提现、报表和审计使用只读
页面；工作台和指标快照使用看板页面。共享组件接收资源定义，而不复制页面逻辑。
## 数据与 API
逐一核对模型字段、中文注释、唯一索引和关联。仅删除确实没有业务语义、没有接口
或页面消费者、且与其他字段重复的字段；审计、快照和关联字段均视为业务字段而
保留。
普通资源提供列表、详情、创建、更新、状态更新和逻辑归档；钱包、资金流水、充值、
提现、报表及审计记录仅提供查询和详情。角色菜单授权、平台账户 CRUD、配送轨迹点、
安全事件处置和审批按需求补齐。所有 HTTP 请求与响应字段均为 `snake_case`，前端
类型和表单字段与 API 定义直接对应；敏感字段按权限和用途控制返回。
## 质量与验收
审计将验证：模型、路由、后端处理器、前端 API、页面和菜单的映射完整；只读资源
没有写操作；角色菜单授权与路由守卫一致；前端不存在未调用 API 或孤立页面；后端
不存在未注册资源。交付前运行后端测试和构建、前端类型检查与生产构建，并执行
接口和页面映射检查。
## 错误处理
无效输入、重复业务编码、找不到记录、禁止修改系统角色和不允许的只读资源写入，
均返回既有统一错误响应。失败操作不得部分写入关联数据；涉及多表写入时使用事务。
## 非目标
本次不实现需求文档明确留待后续迭代的双人复核、资金审批、敏感导出审批、地图精确
轨迹回放等复杂流程；但会保留其模型、审计字段和可扩展接口边界。

1
frontend/platform_admin/package.json
View File

@@ -11,6 +11,7 @@
"report": "vite build --config ./config/vite.config.ts --mode report",
"preview": "pnpm run build && vite preview --host",
"type:check": "vue-tsc -p tsconfig.build.json --noEmit --skipLibCheck",
"audit:platform": "node scripts/audit-check.mjs",
"lint": "biome check .",
"lint:fix": "biome check --write .",
"format": "biome format --write ."

39
frontend/platform_admin/scripts/audit-check.mjs
View File

@@ -1,6 +1,38 @@
import fs from 'node:fs';
import path from 'node:path';
const baseline = process.argv.includes('--baseline');
const expectedResources = [
['gas', 'gas_basic', 'list'], ['gas', 'gas_account', 'list'],
['delivery', 'delivery_basic', 'list'], ['delivery', 'delivery_account', 'list'], ['delivery', 'delivery_task', 'list'], ['delivery', 'delivery_track', 'list'], ['delivery', 'delivery_track_point', 'list'],
['staff', 'staff_account', 'list'], ['staff', 'staff_credential', 'list'],
['user', 'user_account', 'list'], ['user', 'user_address', 'list'], ['user', 'user_service_relation', 'list'],
['device', 'dev_smart_cylinder_valve', 'list'], ['device', 'dev_device_binding', 'list'], ['device', 'dev_telemetry', 'list'], ['device', 'saf_rule', 'list'], ['device', 'saf_event', 'list'], ['device', 'saf_event_disposal', 'list'], ['device', 'saf_inspection', 'list'],
['commerce', 'ec_category', 'list'], ['commerce', 'ec_product', 'list'], ['commerce', 'ec_product_attribute', 'list'], ['commerce', 'ec_product_image', 'list'], ['commerce', 'ec_cart', 'list'], ['commerce', 'ec_order', 'list'], ['commerce', 'ec_review', 'list'],
['finance', 'fin_payment', 'list'], ['finance', 'fin_settlement', 'list'], ['finance', 'fin_reconciliation', 'list'],
['content', 'cnt_content', 'list'], ['notification', 'ntf_template', 'list'], ['customer_service', 'cs_ticket', 'list'],
['platform', 'platfrom_account', 'list'], ['platform', 'platform_role', 'list'], ['platform', 'platform_menu', 'tree'],
['wallet', 'wallet', 'list'], ['wallet', 'wallet_ledger', 'list'], ['wallet', 'wallet_recharge', 'list'], ['wallet', 'wallet_withdrawal', 'list'],
['report', 'report', 'list'], ['report', 'report_item', 'list'], ['report', 'report_metric_snapshot', 'list'],
['audit', 'aud_operation_log', 'list'], ['audit', 'aud_export_log', 'list'], ['audit', 'aud_approval', 'list'],
];
function fileIncludes(file, value) {
return fs.existsSync(file) && fs.readFileSync(file, 'utf8').includes(value);
}
function checkResourceLayers() {
const missing = [];
for (const [domain, name, pageKind] of expectedResources) {
if (!fileIncludes('src/api/resources.ts', name)) missing.push(`${domain}/${name}: missing api`);
if (!fileIncludes(path.join('src/router/routes/modules', `${domain}.ts`), name)) missing.push(`${domain}/${name}: missing route`);
const page = pageKind === 'tree' ? 'TreePage.vue' : 'ListPage.vue';
if (!fs.existsSync(path.join('src/views', domain, name, page))) missing.push(`${domain}/${name}: missing view`);
}
return missing;
}
function walk(dir, acc = []) {
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
const full = path.join(dir, entry.name);
@@ -49,3 +81,10 @@ console.log(JSON.stringify({
settingsHttp: fs.readFileSync('src/locale/zh-CN/settings.ts', 'utf8').includes('http.logout.title'),
rootMenu: fs.readFileSync('src/locale/zh-CN.ts', 'utf8').includes('仪表盘'),
}, null, 2));
const missingLayers = checkResourceLayers();
for (const missing of missingLayers) console.log(missing);
if (missingLayers.length > 0 && !baseline) {
process.exitCode = 1;
}