csxj2026/junhong_cmp_fiber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

收口审计治理与套餐任务进展

Browse Source 
Constraint: 在线热修前必须保存当前迭代分支全部有效代码进展
Confidence: medium
Scope-risk: broad
Directive: 后续修改需保持审计事件与业务事务边界一致
Tested: git diff --cached --check
Not-tested: 未运行全量测试，提交用于切换分支前保存既有工作
This commit is contained in:
break
2026-08-05 14:30:54 +08:00
parent b3499adfca
commit 5e552d99bc
178 changed files with 16797 additions and 5674 deletions
Download Patch File Download Diff File Expand all files Collapse all files

174
internal/service/polling/manual_trigger_service.go
View File

@@ -7,7 +7,9 @@ import (
"github.com/redis/go-redis/v9"
"go.uber.org/zap"
"gorm.io/gorm"
auditinfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
"github.com/break/junhong_cmp_fiber/internal/model"
"github.com/break/junhong_cmp_fiber/internal/store/postgres"
"github.com/break/junhong_cmp_fiber/pkg/constants"
@@ -19,10 +21,18 @@ import (
type ManualTriggerService struct {
logStore *postgres.PollingManualTriggerLogStore
iotCardStore *postgres.IotCardStore
db *gorm.DB
auditWriter *auditinfra.Writer
redis *redis.Client
logger *zap.Logger
}
// SetAudit 注入手动轮询任务事务与统一审计 Writer。
func (s *ManualTriggerService) SetAudit(db *gorm.DB, writer *auditinfra.Writer) {
s.db = db
s.auditWriter = writer
}
// NewManualTriggerService 创建手动触发服务实例
func NewManualTriggerService(
logStore *postgres.PollingManualTriggerLogStore,
@@ -49,6 +59,10 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
if err := s.canManageCard(ctx, cardID); err != nil {
return err
}
cards, err := s.iotCardStore.GetByIDs(ctx, []uint{cardID})
if err != nil {
return errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
}
// 检查每日触发限制
todayCount, err := s.logStore.CountTodayTriggers(ctx, triggeredBy)
@@ -60,7 +74,15 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
return err
}
if todayCount >= 500 { // 每日最多触发500次
return errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "拒绝超过每日上限的单卡手动触发",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
OperatorID: triggeredBy, Result: constants.AuditResultDenied,
IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
}, appErr)
return appErr
}
// 检查去重
@@ -74,7 +96,15 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
return err
}
if added == 0 {
return errors.New(errors.CodeInvalidParam, "该卡已在手动触发队列中")
appErr := errors.New(errors.CodeInvalidParam, "该卡已在手动触发队列中")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "拒绝重复加入手动触发队列",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
OperatorID: triggeredBy, Result: constants.AuditResultDenied,
IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
}, appErr)
return appErr
}
// 设置去重 key 过期时间（24小时，与日限制周期对齐）
s.redis.Expire(ctx, dedupeKey, 24*time.Hour)
@@ -90,7 +120,27 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
TriggeredBy: triggeredBy,
TriggeredAt: time.Now(),
}
if err := s.logStore.Create(ctx, triggerLog); err != nil {
err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
return err
}
return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "单卡手动触发",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
Cards: cards,
})
})
if err != nil {
_ = s.redis.SRem(ctx, dedupeKey, cardID).Err()
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerSingle, Summary: "单卡手动触发失败",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "single", triggeredBy), DisplayName: "单卡手动触发",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "single", 1, triggeredBy), Cards: cards,
}, err)
s.logger.Error("创建触发日志失败",
zap.Uint("card_id", cardID),
zap.Uint("triggered_by", triggeredBy),
@@ -101,6 +151,7 @@ func (s *ManualTriggerService) TriggerSingle(ctx context.Context, cardID uint, t
// 加入手动触发队列（使用 List，优先级高于定时轮询）
queueKey := constants.RedisPollingManualQueueKey(taskType)
if err := s.redis.LPush(ctx, queueKey, cardID).Err(); err != nil {
_ = s.redis.SRem(ctx, dedupeKey, cardID).Err()
s.logger.Error("写入手动触发队列失败",
zap.Uint("card_id", cardID),
zap.String("task_type", taskType),
@@ -136,6 +187,10 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
if err := s.canManageCards(ctx, cardIDs); err != nil {
return nil, err
}
cards, err := s.iotCardStore.GetByIDs(ctx, cardIDs)
if err != nil {
return nil, errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
}
// 检查每日触发限制
todayCount, err := s.logStore.CountTodayTriggers(ctx, triggeredBy)
@@ -143,7 +198,15 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
return nil, err
}
if todayCount >= 500 { // 每日最多触发500次
return nil, errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "拒绝超过每日上限的批量手动触发",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "batch", triggeredBy), DisplayName: "批量手动触发",
OperatorID: triggeredBy, Result: constants.AuditResultDenied,
IdentitySnapshot: pollingManualAttemptIdentity(taskType, "batch", len(cardIDs), triggeredBy), Cards: cards,
}, appErr)
return nil, appErr
}
// 创建触发日志
@@ -157,7 +220,26 @@ func (s *ManualTriggerService) TriggerBatch(ctx context.Context, cardIDs []uint,
TriggeredBy: triggeredBy,
TriggeredAt: time.Now(),
}
if err := s.logStore.Create(ctx, triggerLog); err != nil {
err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
return err
}
return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "批量手动触发",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
Cards: cards,
})
})
if err != nil {
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerBatch, Summary: "批量手动触发失败",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "batch", triggeredBy), DisplayName: "批量手动触发",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "batch", len(cardIDs), triggeredBy), Cards: cards,
}, err)
return nil, err
}
@@ -252,7 +334,16 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
return nil, err
}
if todayCount >= 500 { // 每日最多触发500次
return nil, errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
appErr := errors.New(errors.CodeInvalidParam, "已达到每日触发次数上限")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "拒绝超过每日上限的条件筛选触发",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "by_condition", triggeredBy), DisplayName: "条件筛选触发",
OperatorID: triggeredBy, Result: constants.AuditResultDenied,
IdentitySnapshot: pollingManualAttemptIdentity(taskType, "by_condition", 0, triggeredBy),
Metadata: map[string]any{"condition_filter_configured": true},
}, appErr)
return nil, appErr
}
// 查询符合条件的卡（已应用权限过滤）
@@ -264,6 +355,10 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
if len(cardIDs) == 0 {
return nil, errors.New(errors.CodeInvalidParam, "没有符合条件的卡")
}
cards, err := s.iotCardStore.GetByIDs(ctx, cardIDs)
if err != nil {
return nil, errors.Wrap(errors.CodeInternalError, err, "查询手动轮询卡失败")
}
// 创建触发日志
filterJSON, _ := json.Marshal(filter)
@@ -278,7 +373,27 @@ func (s *ManualTriggerService) TriggerByCondition(ctx context.Context, filter *C
TriggeredBy: triggeredBy,
TriggeredAt: time.Now(),
}
if err := s.logStore.Create(ctx, triggerLog); err != nil {
err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
if err := s.logStore.WithTx(tx).Create(ctx, triggerLog); err != nil {
return err
}
return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "条件筛选触发",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: triggerLog.ID,
ResourceKey: pollingManualTriggerKey(triggerLog.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(triggerLog),
AfterData: map[string]any{"status": triggerLog.Status, "task_type": taskType, "trigger_type": triggerLog.TriggerType},
Metadata: map[string]any{"condition_filter_configured": true}, Cards: cards,
})
})
if err != nil {
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualTriggerByCondition, Summary: "条件筛选触发失败",
ResourceType: constants.AuditResourcePollingManualTrigger,
ResourceKey: pollingManualAttemptKey(taskType, "by_condition", triggeredBy), DisplayName: "条件筛选触发",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualAttemptIdentity(taskType, "by_condition", len(cardIDs), triggeredBy),
Metadata: map[string]any{"condition_filter_configured": true}, Cards: cards,
}, err)
return nil, err
}
@@ -341,14 +456,53 @@ func (s *ManualTriggerService) CancelTrigger(ctx context.Context, logID uint, tr
}
if log.TriggeredBy != triggeredBy {
return errors.New(errors.CodeForbidden, "无权限取消该任务")
appErr := errors.New(errors.CodeForbidden, "无权限取消该任务")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualCancelled, Summary: "拒绝取消其他账号的手动触发任务",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, Result: constants.AuditResultDenied, IdentitySnapshot: pollingManualTriggerIdentity(log),
}, appErr)
return appErr
}
if log.Status != constants.PollingManualTriggerStatusPending && log.Status != constants.PollingManualTriggerStatusProcessing {
return errors.New(errors.CodeInvalidParam, "任务已完成或已取消")
appErr := errors.New(errors.CodeInvalidParam, "任务已完成或已取消")
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualCancelled, Summary: "拒绝取消已结束的手动触发任务",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, Result: constants.AuditResultDenied, IdentitySnapshot: pollingManualTriggerIdentity(log),
}, appErr)
return appErr
}
return s.logStore.UpdateStatus(ctx, logID, constants.PollingManualTriggerStatusCancelled)
var cardIDs []uint
_ = json.Unmarshal([]byte(log.CardIDs), &cardIDs)
cards, _ := s.iotCardStore.GetByIDs(ctx, cardIDs)
err = runPollingTransaction(ctx, s.db, s.auditWriter, func(tx *gorm.DB) error {
if err := s.logStore.WithTx(tx).UpdateStatus(ctx, logID, constants.PollingManualTriggerStatusCancelled); err != nil {
return err
}
before := log.Status
log.Status = constants.PollingManualTriggerStatusCancelled
return writePollingAudit(ctx, tx, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualCancelled, Summary: "人工取消轮询任务",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(log),
BeforeData: map[string]any{"status": before}, AfterData: map[string]any{"status": log.Status}, Cards: cards,
})
})
if err != nil {
recordPollingFailure(ctx, s.db, s.auditWriter, auditinfra.PollingInput{
ActionCode: constants.AuditActionPollingManualCancelled, Summary: "取消手动触发任务失败",
ResourceType: constants.AuditResourcePollingManualTrigger, ResourceID: log.ID,
ResourceKey: pollingManualTriggerKey(log.ID), DisplayName: "手动轮询任务",
OperatorID: triggeredBy, IdentitySnapshot: pollingManualTriggerIdentity(log), Cards: cards,
}, err)
}
return err
}
// GetRunningTasks 获取正在运行的任务