收口审计治理与套餐任务进展

Constraint: 在线热修前必须保存当前迭代分支全部有效代码进展
Confidence: medium
Scope-risk: broad
Directive: 后续修改需保持审计事件与业务事务边界一致
Tested: git diff --cached --check
Not-tested: 未运行全量测试，提交用于切换分支前保存既有工作

internal/service/polling/alert_service.go

@@ -12,21 +12,32 @@ import (
 	"github.com/bytedance/sonic"
 	"github.com/redis/go-redis/v9"
 	"go.uber.org/zap"
+	"gorm.io/gorm"
 
+	auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/internal/store/postgres"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 )
 
 // AlertService 告警服务
 type AlertService struct {
 	ruleStore    *postgres.PollingAlertRuleStore
 	historyStore *postgres.PollingAlertHistoryStore
+	db           *gorm.DB
+	auditWriter  *auditinfra.Writer
 	redis        *redis.Client
 	logger       *zap.Logger
 }
 
+// SetAudit 注入轮询告警规则事务与统一审计 Writer。
+func (s *AlertService) SetAudit(db *gorm.DB, writer *auditinfra.Writer) {
+	s.db = db
+	s.auditWriter = writer
+}
+
 // NewAlertService 创建告警服务实例
 func NewAlertService(
 	ruleStore *postgres.PollingAlertRuleStore,
@@ -44,6 +55,10 @@ func NewAlertService(
 
 // CreateRule 创建告警规则
 func (s *AlertService) CreateRule(ctx context.Context, rule *model.PollingAlertRule) error {
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return errors.New(errors.CodeUnauthorized, "未授权访问")
+	}
 	// 验证参数
 	if rule.RuleName == "" {
 		return errors.New(errors.CodeInvalidParam, "规则名称不能为空")
@@ -62,7 +77,28 @@ func (s *AlertService) CreateRule(ctx context.Context, rule *model.PollingAlertR
 	if rule.Operator == "" {
 		rule.Operator = ">" // 默认大于
 	}
-	return s.ruleStore.Create(ctx, rule)
+	rule.CreatedBy = &operatorID
+	rule.UpdatedBy = &operatorID
+	err := runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.ruleStore.WithTx(tx).Create(ctx, rule); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleCreated, Summary: "创建轮询告警规则",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceID: rule.ID,
+			ResourceKey: pollingManualTriggerKey(rule.ID), DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule), AfterData: pollingAlertRuleState(rule),
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleCreated, Summary: "创建轮询告警规则失败",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceKey: rule.RuleName,
+			DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule), AfterData: pollingAlertRuleState(rule),
+		}, err)
+	}
+	return err
 }
 
 // GetRule 获取告警规则
@@ -81,10 +117,15 @@ func (s *AlertService) ListRules(ctx context.Context) ([]*model.PollingAlertRule
 
 // UpdateRule 更新告警规则
 func (s *AlertService) UpdateRule(ctx context.Context, id uint, updates map[string]interface{}) error {
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return errors.New(errors.CodeUnauthorized, "未授权访问")
+	}
 	rule, err := s.ruleStore.GetByID(ctx, id)
 	if err != nil {
 		return errors.Wrap(errors.CodeNotFound, err, "告警规则不存在")
 	}
+	before := *rule
 
 	if name, ok := updates["rule_name"].(string); ok && name != "" {
 		rule.RuleName = name
@@ -104,17 +145,60 @@ func (s *AlertService) UpdateRule(ctx context.Context, id uint, updates map[stri
 	if channels, ok := updates["notification_channels"].(string); ok {
 		rule.NotificationChannels = channels
 	}
-
-	return s.ruleStore.Update(ctx, rule)
+	rule.UpdatedBy = &operatorID
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.ruleStore.WithTx(tx).Update(ctx, rule); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleUpdated, Summary: "更新轮询告警规则",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceID: rule.ID,
+			ResourceKey: pollingManualTriggerKey(rule.ID), DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule),
+			BeforeData:       pollingAlertRuleState(&before), AfterData: pollingAlertRuleState(rule),
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleUpdated, Summary: "更新轮询告警规则失败",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceID: rule.ID,
+			ResourceKey: pollingManualTriggerKey(rule.ID), DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule), BeforeData: pollingAlertRuleState(&before),
+		}, err)
+	}
+	return err
 }
 
 // DeleteRule 删除告警规则
 func (s *AlertService) DeleteRule(ctx context.Context, id uint) error {
-	_, err := s.ruleStore.GetByID(ctx, id)
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return errors.New(errors.CodeUnauthorized, "未授权访问")
+	}
+	rule, err := s.ruleStore.GetByID(ctx, id)
 	if err != nil {
 		return errors.Wrap(errors.CodeNotFound, err, "告警规则不存在")
 	}
-	return s.ruleStore.Delete(ctx, id)
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.ruleStore.WithTx(tx).Delete(ctx, id); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleDeleted, Summary: "删除轮询告警规则",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceID: rule.ID,
+			ResourceKey: pollingManualTriggerKey(rule.ID), DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule), BeforeData: pollingAlertRuleState(rule),
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingAlertRuleDeleted, Summary: "删除轮询告警规则失败",
+			ResourceType: constants.AuditResourcePollingAlertRule, ResourceID: rule.ID,
+			ResourceKey: pollingManualTriggerKey(rule.ID), DisplayName: rule.RuleName, OperatorID: operatorID,
+			IdentitySnapshot: pollingAlertRuleIdentity(rule), BeforeData: pollingAlertRuleState(rule),
+		}, err)
+	}
+	return err
 }
 
 // ListHistory 获取告警历史

internal/service/polling/audit.go

@@ -0,0 +1,121 @@
+package polling
+
+import (
+	"context"
+	stderrors "errors"
+	"strconv"
+
+	"gorm.io/gorm"
+
+	auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/pkg/auditcontext"
+	"github.com/break/junhong_cmp_fiber/pkg/auditfailure"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	pkgerrors "github.com/break/junhong_cmp_fiber/pkg/errors"
+)
+
+func runPollingTransaction(ctx context.Context, db *gorm.DB, writer *auditinfra.Writer, fn func(*gorm.DB) error) error {
+	if db == nil || writer == nil {
+		return pkgerrors.New(pkgerrors.CodeInvalidStatus, "统一轮询审计接缝未配置")
+	}
+	return db.WithContext(ctx).Transaction(fn)
+}
+
+func writePollingAudit(ctx context.Context, tx *gorm.DB, writer *auditinfra.Writer, input auditinfra.PollingInput) error {
+	return writer.WritePolling(ctx, tx, input)
+}
+
+func recordPollingFailure(ctx context.Context, db *gorm.DB, writer *auditinfra.Writer, input auditinfra.PollingInput, originalErr error) {
+	if input.OperatorID == 0 || input.ResourceType == "" || input.ResourceKey == "" {
+		return
+	}
+	var appErr *pkgerrors.AppError
+	if !stderrors.As(originalErr, &appErr) {
+		appErr = pkgerrors.New(pkgerrors.CodeInternalError, "轮询操作失败")
+	}
+	if input.Result == "" {
+		input.Result = constants.AuditResultFailed
+	}
+	if input.ErrorCode == "" {
+		input.ErrorCode = strconv.Itoa(appErr.Code)
+	}
+	if input.ErrorSummary == "" {
+		input.ErrorSummary = appErr.Message
+	}
+	if db != nil && writer != nil {
+		if err := db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+			return writePollingAudit(ctx, tx, writer, input)
+		}); err == nil {
+			return
+		} else {
+			originalErr = err
+		}
+	}
+	linkage := auditcontext.From(ctx)
+	auditfailure.RecordSecondaryWriteFailure(
+		input.ActionCode, input.ResourceKey, linkage.RequestID, linkage.CorrelationID, input.ErrorCode, originalErr,
+	)
+}
+
+func pollingConfigIdentity(config *model.PollingConfig) map[string]any {
+	return map[string]any{
+		"id": config.ID, "config_name": config.ConfigName, "card_condition": config.CardCondition,
+		"card_category": config.CardCategory, "carrier_id": config.CarrierID, "priority": config.Priority,
+		"status": config.Status,
+	}
+}
+
+func pollingConfigState(config *model.PollingConfig) map[string]any {
+	return map[string]any{
+		"config_name": config.ConfigName, "card_condition": config.CardCondition,
+		"card_category": config.CardCategory, "carrier_id": config.CarrierID, "priority": config.Priority,
+		"realname_check_interval": config.RealnameCheckInterval, "carddata_check_interval": config.CarddataCheckInterval,
+		"package_check_interval": config.PackageCheckInterval, "protect_check_interval": config.ProtectCheckInterval,
+		"card_status_check_interval": config.CardStatusCheckInterval, "status": config.Status,
+		"description": config.Description,
+	}
+}
+
+func pollingConcurrencyIdentity(config *model.PollingConcurrencyConfig) map[string]any {
+	return map[string]any{"id": config.ID, "task_type": config.TaskType, "max_concurrency": config.MaxConcurrency}
+}
+
+func pollingAlertRuleIdentity(rule *model.PollingAlertRule) map[string]any {
+	return map[string]any{
+		"id": rule.ID, "rule_name": rule.RuleName, "task_type": rule.TaskType,
+		"metric_type": rule.MetricType, "operator": rule.Operator, "threshold": rule.Threshold,
+		"alert_level": rule.AlertLevel, "status": rule.Status,
+	}
+}
+
+func pollingAlertRuleState(rule *model.PollingAlertRule) map[string]any {
+	return map[string]any{
+		"rule_name": rule.RuleName, "task_type": rule.TaskType, "metric_type": rule.MetricType,
+		"operator": rule.Operator, "threshold": rule.Threshold, "duration_minutes": rule.DurationMinutes,
+		"alert_level": rule.AlertLevel, "status": rule.Status, "cooldown_minutes": rule.CooldownMinutes,
+		"notification_channels_configured": rule.NotificationChannels != "", "description": rule.Description,
+	}
+}
+
+func pollingManualTriggerIdentity(log *model.PollingManualTriggerLog) map[string]any {
+	return map[string]any{
+		"id": log.ID, "task_type": log.TaskType, "trigger_type": log.TriggerType,
+		"total_count": log.TotalCount, "status": log.Status, "triggered_by": log.TriggeredBy,
+	}
+}
+
+func pollingManualTriggerKey(id uint) string {
+	return strconv.FormatUint(uint64(id), 10)
+}
+
+func pollingManualAttemptKey(taskType, triggerType string, operatorID uint) string {
+	return triggerType + ":" + taskType + ":" + strconv.FormatUint(uint64(operatorID), 10)
+}
+
+func pollingManualAttemptIdentity(taskType, triggerType string, totalCount int, operatorID uint) map[string]any {
+	return map[string]any{
+		"task_type": taskType, "trigger_type": triggerType,
+		"total_count": totalCount, "triggered_by": operatorID,
+	}
+}

internal/service/polling/concurrency_service.go

@@ -5,17 +5,28 @@ import (
 	"time"
 
 	"github.com/redis/go-redis/v9"
+	"gorm.io/gorm"
 
+	auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/internal/store/postgres"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 )
 
 // ConcurrencyService 并发控制服务
 type ConcurrencyService struct {
-	store *postgres.PollingConcurrencyConfigStore
-	redis *redis.Client
+	store       *postgres.PollingConcurrencyConfigStore
+	db          *gorm.DB
+	auditWriter *auditinfra.Writer
+	redis       *redis.Client
+}
+
+// SetAudit 注入轮询并发配置事务与统一审计 Writer。
+func (s *ConcurrencyService) SetAudit(db *gorm.DB, writer *auditinfra.Writer) {
+	s.db = db
+	s.auditWriter = writer
 }
 
 // NewConcurrencyService 创建并发控制服务实例
@@ -113,14 +124,34 @@ func (s *ConcurrencyService) UpdateMaxConcurrency(ctx context.Context, taskType
 	}
 
 	// 验证任务类型存在
-	_, err := s.store.GetByTaskType(ctx, taskType)
+	config, err := s.store.GetByTaskType(ctx, taskType)
 	if err != nil {
 		return errors.Wrap(errors.CodeNotFound, err, "任务类型不存在")
 	}
 
-	// 更新数据库
-	if err := s.store.UpdateMaxConcurrency(ctx, taskType, maxConcurrency, updatedBy); err != nil {
-		return errors.Wrap(errors.CodeInternalError, err, "更新并发配置失败")
+	before := config.MaxConcurrency
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.store.WithTx(tx).UpdateMaxConcurrency(ctx, taskType, maxConcurrency, updatedBy); err != nil {
+			return err
+		}
+		config.MaxConcurrency = maxConcurrency
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConcurrencyUpdated, Summary: "更新轮询并发配置",
+			ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+			ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: updatedBy,
+			IdentitySnapshot: pollingConcurrencyIdentity(config),
+			BeforeData:       map[string]any{"max_concurrency": before}, AfterData: map[string]any{"max_concurrency": maxConcurrency},
+		})
+	})
+	if err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "更新并发配置失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConcurrencyUpdated, Summary: "更新轮询并发配置失败",
+			ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+			ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: updatedBy,
+			IdentitySnapshot: pollingConcurrencyIdentity(config), BeforeData: map[string]any{"max_concurrency": before},
+		}, appErr)
+		return appErr
 	}
 
 	// 同步更新 Redis 配置缓存
@@ -134,19 +165,72 @@ func (s *ConcurrencyService) UpdateMaxConcurrency(ctx context.Context, taskType
 
 // ResetConcurrency 重置并发计数（用于信号量修复）
 func (s *ConcurrencyService) ResetConcurrency(ctx context.Context, taskType string) error {
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return errors.New(errors.CodeUnauthorized, "未授权访问")
+	}
 	// 验证任务类型存在
-	_, err := s.store.GetByTaskType(ctx, taskType)
+	config, err := s.store.GetByTaskType(ctx, taskType)
 	if err != nil {
 		return errors.Wrap(errors.CodeNotFound, err, "任务类型不存在")
 	}
 
 	// 重置 Redis 当前计数为 0
 	currentKey := constants.RedisPollingConcurrencyCurrentKey(taskType)
-	if err := s.redis.Set(ctx, currentKey, 0, 24*time.Hour).Err(); err != nil {
-		return errors.Wrap(errors.CodeInternalError, err, "重置并发计数失败")
+	before, getErr := s.redis.Get(ctx, currentKey).Int64()
+	beforeExists := getErr == nil
+	if getErr != nil && getErr != redis.Nil {
+		appErr := errors.Wrap(errors.CodeInternalError, getErr, "读取并发计数失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConcurrencyReset, Summary: "重置轮询并发计数失败",
+			ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+			ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: operatorID,
+			IdentitySnapshot: pollingConcurrencyIdentity(config),
+		}, appErr)
+		return appErr
 	}
-
-	return nil
+	beforeTTL := time.Duration(0)
+	if beforeExists {
+		beforeTTL, _ = s.redis.PTTL(ctx, currentKey).Result()
+		if beforeTTL < 0 {
+			beforeTTL = 0
+		}
+	}
+	if err := s.redis.Set(ctx, currentKey, 0, 24*time.Hour).Err(); err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "重置并发计数失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConcurrencyReset, Summary: "重置轮询并发计数失败",
+			ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+			ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: operatorID,
+			IdentitySnapshot: pollingConcurrencyIdentity(config), BeforeData: map[string]any{"current": before},
+		}, appErr)
+		return appErr
+	}
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConcurrencyReset, Summary: "重置轮询并发计数",
+			ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+			ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: operatorID,
+			IdentitySnapshot: pollingConcurrencyIdentity(config),
+			BeforeData:       map[string]any{"current": before}, AfterData: map[string]any{"current": int64(0)},
+		})
+	})
+	if err == nil {
+		return nil
+	}
+	if beforeExists {
+		_ = s.redis.Set(ctx, currentKey, before, beforeTTL).Err()
+	} else {
+		_ = s.redis.Del(ctx, currentKey).Err()
+	}
+	appErr := errors.Wrap(errors.CodeInternalError, err, "记录重置并发计数审计失败")
+	recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+		ActionCode: constants.AuditActionPollingConcurrencyReset, Summary: "重置轮询并发计数失败",
+		ResourceType: constants.AuditResourcePollingConcurrencyConfig, ResourceID: config.ID,
+		ResourceKey: config.TaskType, DisplayName: s.getTaskTypeName(config.TaskType), OperatorID: operatorID,
+		IdentitySnapshot: pollingConcurrencyIdentity(config), BeforeData: map[string]any{"current": before},
+	}, appErr)
+	return appErr
 }
 
 // InitFromDB 从数据库初始化 Redis 并发配置

internal/service/polling/config_service.go

@@ -8,6 +8,7 @@ import (
 	"go.uber.org/zap"
 	"gorm.io/gorm"
 
+	auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/internal/model/dto"
 	"github.com/break/junhong_cmp_fiber/internal/store"
@@ -20,10 +21,18 @@ import (
 // ConfigService 轮询配置服务
 type ConfigService struct {
 	configStore *postgres.PollingConfigStore
+	db          *gorm.DB
+	auditWriter *auditinfra.Writer
 	redis       *redis.Client
 	logger      *zap.Logger
 }
 
+// SetAudit 注入轮询配置事务与统一审计 Writer。
+func (s *ConfigService) SetAudit(db *gorm.DB, writer *auditinfra.Writer) {
+	s.db = db
+	s.auditWriter = writer
+}
+
 // NewConfigService 创建轮询配置服务实例
 func NewConfigService(configStore *postgres.PollingConfigStore, redisClient *redis.Client, logger *zap.Logger) *ConfigService {
 	return &ConfigService{configStore: configStore, redis: redisClient, logger: logger}
@@ -48,7 +57,14 @@ func (s *ConfigService) Create(ctx context.Context, req *dto.CreatePollingConfig
 	// 验证配置名称唯一性
 	existing, _ := s.configStore.GetByName(ctx, req.ConfigName)
 	if existing != nil {
-		return nil, errors.New(errors.CodeInvalidParam, "配置名称已存在")
+		appErr := errors.New(errors.CodeInvalidParam, "配置名称已存在")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigCreated, Summary: "拒绝创建重复轮询配置",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceKey: req.ConfigName,
+			DisplayName: req.ConfigName, OperatorID: currentUserID, Result: constants.AuditResultDenied,
+			IdentitySnapshot: map[string]any{"config_name": req.ConfigName},
+		}, appErr)
+		return nil, appErr
 	}
 
 	// 验证检查间隔（至少一个不为空）
@@ -75,8 +91,26 @@ func (s *ConfigService) Create(ctx context.Context, req *dto.CreatePollingConfig
 		UpdatedBy:               &currentUserID,
 	}
 
-	if err := s.configStore.Create(ctx, config); err != nil {
-		return nil, errors.Wrap(errors.CodeInternalError, err, "创建轮询配置失败")
+	err := runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.configStore.WithTx(tx).Create(ctx, config); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigCreated, Summary: "创建轮询配置",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config), AfterData: pollingConfigState(config),
+		})
+	})
+	if err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "创建轮询配置失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigCreated, Summary: "创建轮询配置失败",
+			ResourceType: constants.AuditResourcePollingConfig,
+			ResourceKey:  config.ConfigName, DisplayName: config.ConfigName, OperatorID: currentUserID,
+			IdentitySnapshot: pollingConfigIdentity(config), AfterData: pollingConfigState(config),
+		}, appErr)
+		return nil, appErr
 	}
 
 	s.notifyConfigChanged(ctx, "created")
@@ -109,13 +143,22 @@ func (s *ConfigService) Update(ctx context.Context, id uint, req *dto.UpdatePoll
 		}
 		return nil, errors.Wrap(errors.CodeInternalError, err, "获取轮询配置失败")
 	}
+	before := *config
 
 	// 更新字段
 	if req.ConfigName != nil {
 		// 检查名称唯一性
 		existing, _ := s.configStore.GetByName(ctx, *req.ConfigName)
 		if existing != nil && existing.ID != id {
-			return nil, errors.New(errors.CodeInvalidParam, "配置名称已存在")
+			appErr := errors.New(errors.CodeInvalidParam, "配置名称已存在")
+			recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+				ActionCode: constants.AuditActionPollingConfigUpdated, Summary: "拒绝更新为重复轮询配置名称",
+				ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+				ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+				OperatorID: currentUserID, Result: constants.AuditResultDenied,
+				IdentitySnapshot: pollingConfigIdentity(config), BeforeData: pollingConfigState(config),
+			}, appErr)
+			return nil, appErr
 		}
 		config.ConfigName = *req.ConfigName
 	}
@@ -151,8 +194,28 @@ func (s *ConfigService) Update(ctx context.Context, id uint, req *dto.UpdatePoll
 	}
 	config.UpdatedBy = &currentUserID
 
-	if err := s.configStore.Update(ctx, config); err != nil {
-		return nil, errors.Wrap(errors.CodeInternalError, err, "更新轮询配置失败")
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.configStore.WithTx(tx).Update(ctx, config); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigUpdated, Summary: "更新轮询配置",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config),
+			BeforeData: pollingConfigState(&before), AfterData: pollingConfigState(config),
+		})
+	})
+	if err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "更新轮询配置失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigUpdated, Summary: "更新轮询配置失败",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config),
+			BeforeData: pollingConfigState(&before), AfterData: pollingConfigState(config),
+		}, appErr)
+		return nil, appErr
 	}
 
 	s.notifyConfigChanged(ctx, "updated")
@@ -161,7 +224,11 @@ func (s *ConfigService) Update(ctx context.Context, id uint, req *dto.UpdatePoll
 
 // Delete 删除轮询配置
 func (s *ConfigService) Delete(ctx context.Context, id uint) error {
-	_, err := s.configStore.GetByID(ctx, id)
+	currentUserID := middleware.GetUserIDFromContext(ctx)
+	if currentUserID == 0 {
+		return errors.New(errors.CodeUnauthorized, "未授权访问")
+	}
+	config, err := s.configStore.GetByID(ctx, id)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return errors.New(errors.CodePollingConfigNotFound, "轮询配置不存在")
@@ -169,8 +236,26 @@ func (s *ConfigService) Delete(ctx context.Context, id uint) error {
 		return errors.Wrap(errors.CodeInternalError, err, "获取轮询配置失败")
 	}
 
-	if err := s.configStore.Delete(ctx, id); err != nil {
-		return errors.Wrap(errors.CodeInternalError, err, "删除轮询配置失败")
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.configStore.WithTx(tx).Delete(ctx, id); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigDeleted, Summary: "删除轮询配置",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config), BeforeData: pollingConfigState(config),
+		})
+	})
+	if err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "删除轮询配置失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigDeleted, Summary: "删除轮询配置失败",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config), BeforeData: pollingConfigState(config),
+		}, appErr)
+		return appErr
 	}
 
 	s.notifyConfigChanged(ctx, "deleted")
@@ -228,7 +313,7 @@ func (s *ConfigService) UpdateStatus(ctx context.Context, id uint, status int16)
 		return errors.New(errors.CodeUnauthorized, "未授权访问")
 	}
 
-	_, err := s.configStore.GetByID(ctx, id)
+	config, err := s.configStore.GetByID(ctx, id)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return errors.New(errors.CodePollingConfigNotFound, "轮询配置不存在")
@@ -236,8 +321,29 @@ func (s *ConfigService) UpdateStatus(ctx context.Context, id uint, status int16)
 		return errors.Wrap(errors.CodeInternalError, err, "获取轮询配置失败")
 	}
 
-	if err := s.configStore.UpdateStatus(ctx, id, status, currentUserID); err != nil {
-		return errors.Wrap(errors.CodeInternalError, err, "更新轮询配置状态失败")
+	before := pollingConfigState(config)
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.configStore.WithTx(tx).UpdateStatus(ctx, id, status, currentUserID); err != nil {
+			return err
+		}
+		config.Status = status
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigStatusUpdated, Summary: "更新轮询配置状态",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config),
+			BeforeData: before, AfterData: pollingConfigState(config),
+		})
+	})
+	if err != nil {
+		appErr := errors.Wrap(errors.CodeInternalError, err, "更新轮询配置状态失败")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingConfigStatusUpdated, Summary: "更新轮询配置状态失败",
+			ResourceType: constants.AuditResourcePollingConfig, ResourceID: config.ID,
+			ResourceKey: pollingManualTriggerKey(config.ID), DisplayName: config.ConfigName,
+			OperatorID: currentUserID, IdentitySnapshot: pollingConfigIdentity(config), BeforeData: before,
+		}, appErr)
+		return appErr
 	}
 
 	s.notifyConfigChanged(ctx, "updated")

internal/service/polling/manual_trigger_service.go

@@ -7,7 +7,9 @@ import (
 
 	"github.com/redis/go-redis/v9"
 	"go.uber.org/zap"
+	"gorm.io/gorm"
 
+	auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/internal/store/postgres"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
@@ -19,10 +21,18 @@ import (
 type ManualTriggerService struct {
 	logStore     *postgres.PollingManualTriggerLogStore
 	iotCardStore *postgres.IotCardStore
+	db           *gorm.DB
+	auditWriter  *auditinfra.Writer
 	redis        *redis.Client
 	logger       *zap.Logger
 }
 
+// SetAudit 注入手动轮询任务事务与统一审计 Writer。
+func (s *ManualTriggerService) SetAudit(db *gorm.DB, writer *auditinfra.Writer) {
+	s.db = db
+	s.auditWriter = writer
+}
+
 // NewManualTriggerService 创建手动触发服务实例
 func NewManualTriggerService(
 	logStore *postgres.PollingManualTriggerLogStore,
@@ -49,6 +59,10 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
 	if err := s.canManageCard(ctx, cardID); err != nil {
 		return err
 	}
+	cards, err := s.iotCardStore.GetByIDs(ctx, []uint{cardID})
+	if err != nil {
+		return errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
+	}
 
 	// 检查每日触发限制
 	todayCount, err := s.logStore.CountTodayTriggers(ctx, triggeredBy)
@@ -60,7 +74,15 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
 		return err
 	}
 	if todayCount >= 500 { // 每日最多触发500次
-		return errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "拒绝超过每日上限的单卡手动触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied,
+			IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
+		}, appErr)
+		return appErr
 	}
 
 	// 检查去重
@@ -74,7 +96,15 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
 		return err
 	}
 	if added == 0 {
-		return errors.New(errors.CodeInvalidParam, "该卡已在手动触发队列中")
+		appErr := errors.New(errors.CodeInvalidParam, "该卡已在手动触发队列中")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "拒绝重复加入手动触发队列",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied,
+			IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
+		}, appErr)
+		return appErr
 	}
 	// 设置去重 key 过期时间（24小时，与日限制周期对齐）
 	s.redis.Expire(ctx, dedupeKey, 24*time.Hour)
@@ -90,7 +120,27 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
 		TriggeredBy: triggeredBy,
 		TriggeredAt: time.Now(),
 	}
-	if err := s.logStore.Create(ctx, triggerLog); err != nil {
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "单卡手动触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
+			ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
+			AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
+			Cards:     cards,
+		})
+	})
+	if err != nil {
+		_ = s.redis.SRem(ctx, dedupeKey, cardID).Err()
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "单卡手动触发失败",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
+		}, err)
 		s.logger.Error("创建触发日志失败",
 			zap.Uint("card_id", cardID),
 			zap.Uint("triggered_by", triggeredBy),
@@ -101,6 +151,7 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
 	// 加入手动触发队列（使用 List，优先级高于定时轮询）
 	queueKey := constants.RedisPollingManualQueueKey(taskType)
 	if err := s.redis.LPush(ctx, queueKey, cardID).Err(); err != nil {
+		_ = s.redis.SRem(ctx, dedupeKey, cardID).Err()
 		s.logger.Error("写入手动触发队列失败",
 			zap.Uint("card_id", cardID),
 			zap.String("task_type", taskType),
@@ -136,6 +187,10 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
 	if err := s.canManageCards(ctx, cardIDs); err != nil {
 		return nil, err
 	}
+	cards, err := s.iotCardStore.GetByIDs(ctx, cardIDs)
+	if err != nil {
+		return nil, errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
+	}
 
 	// 检查每日触发限制
 	todayCount, err := s.logStore.CountTodayTriggers(ctx, triggeredBy)
@@ -143,7 +198,15 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
 		return nil, err
 	}
 	if todayCount >= 500 { // 每日最多触发500次
-		return nil, errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "拒绝超过每日上限的批量手动触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "batch", triggeredBy), DisplayName: "批量手动触发",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied,
+			IdentitySnapshot: pollingManualAttemptIdentity(taskType, "batch", len(cardIDs), triggeredBy), Cards: cards,
+		}, appErr)
+		return nil, appErr
 	}
 
 	// 创建触发日志
@@ -157,7 +220,26 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
 		TriggeredBy: triggeredBy,
 		TriggeredAt: time.Now(),
 	}
-	if err := s.logStore.Create(ctx, triggerLog); err != nil {
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "批量手动触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
+			ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
+			AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
+			Cards:     cards,
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "批量手动触发失败",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "batch", triggeredBy), DisplayName: "批量手动触发",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "batch", len(cardIDs), triggeredBy), Cards: cards,
+		}, err)
 		return nil, err
 	}
 
@@ -252,7 +334,16 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
 		return nil, err
 	}
 	if todayCount >= 500 { // 每日最多触发500次
-		return nil, errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "拒绝超过每日上限的条件筛选触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "by_condition", triggeredBy), DisplayName: "条件筛选触发",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied,
+			IdentitySnapshot: pollingManualAttemptIdentity(taskType, "by_condition", 0, triggeredBy),
+			Metadata:         map[string]any{"condition_filter_configured": true},
+		}, appErr)
+		return nil, appErr
 	}
 
 	// 查询符合条件的卡（已应用权限过滤）
@@ -264,6 +355,10 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
 	if len(cardIDs) == 0 {
 		return nil, errors.New(errors.CodeInvalidParam, "没有符合条件的卡")
 	}
+	cards, err := s.iotCardStore.GetByIDs(ctx, cardIDs)
+	if err != nil {
+		return nil, errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
+	}
 
 	// 创建触发日志
 	filterJSON, _ := json.Marshal(filter)
@@ -278,7 +373,27 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
 		TriggeredBy:     triggeredBy,
 		TriggeredAt:     time.Now(),
 	}
-	if err := s.logStore.Create(ctx, triggerLog); err != nil {
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
+			return err
+		}
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "条件筛选触发",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
+			ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
+			AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
+			Metadata:  map[string]any{"condition_filter_configured": true}, Cards: cards,
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "条件筛选触发失败",
+			ResourceType: constants.AuditResourcePollingManualTrigger,
+			ResourceKey:  pollingManualAttemptKey(taskType, "by_condition", triggeredBy), DisplayName: "条件筛选触发",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "by_condition", len(cardIDs), triggeredBy),
+			Metadata: map[string]any{"condition_filter_configured": true}, Cards: cards,
+		}, err)
 		return nil, err
 	}
 
@@ -341,14 +456,53 @@ func (s *ManualTriggerService) CancelTrigger(ctx context.Context, logID uint, tr
 	}
 
 	if log.TriggeredBy != triggeredBy {
-		return errors.New(errors.CodeForbidden, "无权限取消该任务")
+		appErr := errors.New(errors.CodeForbidden, "无权限取消该任务")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualCancelled, Summary: "拒绝取消其他账号的手动触发任务",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
+			ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied, IdentitySnapshot: pollingManualTriggerIdentity(log),
+		}, appErr)
+		return appErr
 	}
 
 	if log.Status != constants.PollingManualTriggerStatusPending && log.Status != constants.PollingManualTriggerStatusProcessing {
-		return errors.New(errors.CodeInvalidParam, "任务已完成或已取消")
+		appErr := errors.New(errors.CodeInvalidParam, "任务已完成或已取消")
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualCancelled, Summary: "拒绝取消已结束的手动触发任务",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
+			ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, Result: constants.AuditResultDenied, IdentitySnapshot: pollingManualTriggerIdentity(log),
+		}, appErr)
+		return appErr
 	}
 
-	return s.logStore.UpdateStatus(ctx, logID, constants.PollingManualTriggerStatusCancelled)
+	var cardIDs []uint
+	_ = json.Unmarshal([]byte(log.CardIDs), &cardIDs)
+	cards, _ := s.iotCardStore.GetByIDs(ctx, cardIDs)
+	err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
+		if err := s.logStore.WithTx(tx).UpdateStatus(ctx, logID, constants.PollingManualTriggerStatusCancelled); err != nil {
+			return err
+		}
+		before := log.Status
+		log.Status = constants.PollingManualTriggerStatusCancelled
+		return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualCancelled, Summary: "人工取消轮询任务",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
+			ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(log),
+			BeforeData: map[string]any{"status": before}, AfterData: map[string]any{"status": log.Status}, Cards: cards,
+		})
+	})
+	if err != nil {
+		recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
+			ActionCode: constants.AuditActionPollingManualCancelled, Summary: "取消手动触发任务失败",
+			ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
+			ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
+			OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(log), Cards: cards,
+		}, err)
+	}
+	return err
 }
 
 // GetRunningTasks 获取正在运行的任务