收口审计治理与套餐任务进展
Constraint: 在线热修前必须保存当前迭代分支全部有效代码进展 Confidence: medium Scope-risk: broad Directive: 后续修改需保持审计事件与业务事务边界一致 Tested: git diff --cached --check Not-tested: 未运行全量测试，提交用于切换分支前保存既有工作
This commit is contained in:
189
internal/infrastructure/audit/approval.go
Normal file
189
internal/infrastructure/audit/approval.go
Normal file
@@ -0,0 +1,189 @@
|
||||
package audit
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/bytedance/sonic"
|
||||
"gorm.io/gorm"
|
||||
|
||||
approvalapp "github.com/break/junhong_cmp_fiber/internal/application/approval"
|
||||
"github.com/break/junhong_cmp_fiber/internal/model"
|
||||
"github.com/break/junhong_cmp_fiber/pkg/constants"
|
||||
"github.com/break/junhong_cmp_fiber/pkg/errors"
|
||||
)
|
||||
|
||||
// WriteApproval 将通用审批状态变化及其 Integration/Outbox 引用写入统一 Audit Event。
|
||||
func (w *Writer) WriteApproval(ctx context.Context, tx *gorm.DB, change approvalapp.AuditChange) error {
|
||||
if change.InstanceID == 0 || change.BusinessID == 0 || change.BusinessType == "" || change.SubmitterAccountID == 0 {
|
||||
return errors.New(errors.CodeInvalidParam, "通用审批审计资源不完整")
|
||||
}
|
||||
resources, err := approvalResources(ctx, tx, change)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
result := change.Result
|
||||
if result == "" {
|
||||
result = constants.AuditResultSuccess
|
||||
}
|
||||
return w.Append(ctx, tx, AppendInput{
|
||||
EventID: change.EventID, ActionCode: change.ActionCode, Summary: change.Summary,
|
||||
Actor: ActorInput{Kind: change.ActorKind, ID: change.ActorID, Name: change.ActorName}, Source: change.Source,
|
||||
ScopeType: constants.AuditScopePlatform, Result: result, ErrorSummary: change.ErrorSummary,
|
||||
CorrelationID: change.CorrelationID, ParentEventID: change.ParentEventID,
|
||||
Metadata: map[string]any{"provider": change.Provider, "decision": change.Decision}, Resources: resources,
|
||||
})
|
||||
}
|
||||
|
||||
func approvalResources(ctx context.Context, tx *gorm.DB, change approvalapp.AuditChange) ([]ResourceInput, error) {
|
||||
instanceID := strconv.FormatUint(uint64(change.InstanceID), 10)
|
||||
resources := []ResourceInput{{
|
||||
Type: constants.AuditResourceApprovalInstance, ID: &instanceID, Key: instanceID, DisplayName: "审批实例 " + instanceID,
|
||||
Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleApprovalTarget,
|
||||
IdentitySnapshot: map[string]any{
|
||||
"id": change.InstanceID, "business_type": change.BusinessType, "business_id": change.BusinessID,
|
||||
"submitter_account_id": change.SubmitterAccountID, "provider": change.Provider,
|
||||
"external_ref": change.AfterExternalRef, "correlation_id": change.CorrelationID,
|
||||
"status": statusValue(change.AfterStatus),
|
||||
},
|
||||
BeforeData: approvalState(change.BeforeStatus, change.BeforeExternalRef),
|
||||
AfterData: approvalState(change.AfterStatus, change.AfterExternalRef),
|
||||
}}
|
||||
business, err := approvalBusinessResource(ctx, tx, change.BusinessType, change.BusinessID, change.InstanceID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resources = append(resources, business)
|
||||
resources = append(resources, approvalSubmitterResource(change))
|
||||
seenIntegrationIDs := make(map[string]struct{}, len(change.IntegrationIDs))
|
||||
for _, integrationID := range change.IntegrationIDs {
|
||||
integrationID = strings.TrimSpace(integrationID)
|
||||
if integrationID == "" {
|
||||
continue
|
||||
}
|
||||
if _, exists := seenIntegrationIDs[integrationID]; exists {
|
||||
continue
|
||||
}
|
||||
seenIntegrationIDs[integrationID] = struct{}{}
|
||||
resource, err := approvalIntegrationResource(ctx, tx, integrationID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resources = append(resources, resource)
|
||||
}
|
||||
if strings.TrimSpace(change.OutboxEventID) != "" {
|
||||
resource, err := approvalOutboxResource(ctx, tx, change.OutboxEventID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resources = append(resources, resource)
|
||||
}
|
||||
return resources, nil
|
||||
}
|
||||
|
||||
func approvalBusinessResource(ctx context.Context, tx *gorm.DB, businessType string, businessID, instanceID uint) (ResourceInput, error) {
|
||||
id := strconv.FormatUint(uint64(businessID), 10)
|
||||
switch businessType {
|
||||
case constants.ApprovalBusinessTypeRefund:
|
||||
var refund model.RefundRequest
|
||||
if err := tx.WithContext(ctx).First(&refund, businessID).Error; err != nil {
|
||||
return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联退款单失败")
|
||||
}
|
||||
return ResourceInput{
|
||||
Type: constants.AuditResourceRefund, ID: &id, Key: refund.RefundNo, DisplayName: refund.RefundNo,
|
||||
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
|
||||
IdentitySnapshot: map[string]any{
|
||||
"id": refund.ID, "refund_no": refund.RefundNo, "order_id": refund.OrderID, "order_no": refund.OrderNo,
|
||||
"order_type": refund.OrderType, "asset_identifier": refund.AssetIdentifier, "shop_id": refund.ShopID,
|
||||
"requested_refund_amount": refund.RequestedRefundAmount, "actual_received_amount": refund.ActualReceivedAmount,
|
||||
"approval_instance_id": instanceID, "status": refund.Status,
|
||||
},
|
||||
}, nil
|
||||
case constants.ApprovalBusinessTypeOfflineRecharge:
|
||||
var recharge model.AgentRechargeRecord
|
||||
if err := tx.WithContext(ctx).First(&recharge, businessID).Error; err != nil {
|
||||
return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联充值单失败")
|
||||
}
|
||||
return ResourceInput{
|
||||
Type: constants.AuditResourceAgentRecharge, ID: &id, Key: recharge.RechargeNo, DisplayName: recharge.RechargeNo,
|
||||
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
|
||||
IdentitySnapshot: map[string]any{
|
||||
"id": recharge.ID, "recharge_no": recharge.RechargeNo, "user_id": recharge.UserID,
|
||||
"shop_id": recharge.ShopID, "agent_wallet_id": recharge.AgentWalletID, "amount": recharge.Amount,
|
||||
"payment_method": recharge.PaymentMethod, "payment_channel": recharge.PaymentChannel,
|
||||
"approval_instance_id": instanceID, "status": recharge.Status,
|
||||
},
|
||||
}, nil
|
||||
default:
|
||||
return ResourceInput{}, errors.New(errors.CodeInvalidParam, "审批业务类型尚未注册审计资源")
|
||||
}
|
||||
}
|
||||
|
||||
func approvalSubmitterResource(change approvalapp.AuditChange) ResourceInput {
|
||||
accountID := strconv.FormatUint(uint64(change.SubmitterAccountID), 10)
|
||||
identity := map[string]any{"id": change.SubmitterAccountID}
|
||||
var snapshot map[string]any
|
||||
if sonic.Unmarshal(change.SubmitterSnapshot, &snapshot) == nil {
|
||||
identity["username"] = snapshot["account_name"]
|
||||
identity["user_type"] = snapshot["user_type"]
|
||||
}
|
||||
displayName, _ := identity["username"].(string)
|
||||
if displayName == "" {
|
||||
displayName = "账号 " + accountID
|
||||
}
|
||||
return ResourceInput{
|
||||
Type: constants.AuditResourceAccount, ID: &accountID, Key: accountID, DisplayName: displayName,
|
||||
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalSubmitter,
|
||||
IdentitySnapshot: identity,
|
||||
}
|
||||
}
|
||||
|
||||
func approvalIntegrationResource(ctx context.Context, tx *gorm.DB, integrationID string) (ResourceInput, error) {
|
||||
var record model.IntegrationLog
|
||||
if err := tx.WithContext(ctx).Where("integration_id = ?", integrationID).First(&record).Error; err != nil {
|
||||
return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联 Integration Log 失败")
|
||||
}
|
||||
id := strconv.FormatUint(uint64(record.ID), 10)
|
||||
return ResourceInput{
|
||||
Type: constants.AuditResourceIntegrationLog, ID: &id, Key: record.IntegrationID, DisplayName: record.IntegrationID,
|
||||
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalIntegration,
|
||||
IdentitySnapshot: map[string]any{
|
||||
"integration_id": record.IntegrationID, "provider": record.Provider, "direction": record.Direction,
|
||||
"operation": record.Operation, "external_id": record.ExternalID,
|
||||
"resource_type": record.ResourceType, "resource_id": record.ResourceID, "resource_key": record.ResourceKey,
|
||||
"correlation_id": record.CorrelationID,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func approvalOutboxResource(ctx context.Context, tx *gorm.DB, eventID string) (ResourceInput, error) {
|
||||
var event model.OutboxEvent
|
||||
if err := tx.WithContext(ctx).Where("event_id = ?", eventID).First(&event).Error; err != nil {
|
||||
return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联 Outbox 事件失败")
|
||||
}
|
||||
id := strconv.FormatUint(uint64(event.ID), 10)
|
||||
return ResourceInput{
|
||||
Type: constants.AuditResourceOutboxEvent, ID: &id, Key: event.EventID, DisplayName: event.EventID,
|
||||
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalOutbox,
|
||||
IdentitySnapshot: map[string]any{
|
||||
"event_id": event.EventID, "event_type": event.EventType, "aggregate_type": event.AggregateType,
|
||||
"aggregate_id": event.AggregateID, "resource_type": event.ResourceType,
|
||||
"resource_id": event.ResourceID, "business_key": event.BusinessKey,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func approvalState(status *int, externalRef string) map[string]any {
|
||||
if status == nil {
|
||||
return nil
|
||||
}
|
||||
return map[string]any{"status": *status, "external_ref": externalRef}
|
||||
}
|
||||
|
||||
func statusValue(status *int) any {
|
||||
if status == nil {
|
||||
return nil
|
||||
}
|
||||
return *status
|
||||
}
|
||||
Reference in New Issue
Block a user