七月迭代短暂完结,还有很多后端的关键东西没有弄,这是一版赶时间做的东西

internal/application/wecom/connection.go

@@ -0,0 +1,303 @@
+// Package wecom 提供企业微信配置简单写与连接测试用例。
+package wecom
+
+import (
+	"context"
+	stdErrors "errors"
+	"fmt"
+	"time"
+
+	"gorm.io/gorm"
+
+	systemconfigapp "github.com/break/junhong_cmp_fiber/internal/application/systemconfig"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/internal/model/dto"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
+)
+
+// ApplicationRepository 定义企业微信应用配置持久化边界。
+type ApplicationRepository interface {
+	FindByIdentityForUpdate(ctx context.Context, tx *gorm.DB, corpID string, agentID int64) (*model.WeComApplication, error)
+	Create(ctx context.Context, tx *gorm.DB, application *model.WeComApplication) error
+	Update(ctx context.Context, tx *gorm.DB, application *model.WeComApplication) error
+	List(ctx context.Context, page, pageSize int) ([]model.WeComApplication, int64, error)
+	GetEnabled(ctx context.Context, applicationID uint) (*model.WeComApplication, error)
+	UpdateDefaultCreator(ctx context.Context, tx *gorm.DB, applicationID uint, userID, name string, operatorID uint, updatedAt time.Time) error
+}
+
+// DefaultCreatorMemberFinder 定义默认审批发起人的可见成员查询边界。
+type DefaultCreatorMemberFinder interface {
+	GetVisible(ctx context.Context, applicationID uint, userID string) (*model.WeComMember, error)
+}
+
+// CredentialCipher 定义企业微信敏感凭据加密边界。
+type CredentialCipher interface {
+	Encrypt(plaintext string) ([]byte, error)
+	Decrypt(ciphertext []byte) (string, error)
+}
+
+// AccessTokenProvider 定义按应用取得及失效 access_token 的边界。
+type AccessTokenProvider interface {
+	GetAccessToken(ctx context.Context, applicationID uint) (string, error)
+	Invalidate(ctx context.Context, applicationID uint)
+}
+
+// ConnectionService 保存加密配置并测试企业微信连接。
+type ConnectionService struct {
+	db      *gorm.DB
+	repo    ApplicationRepository
+	cipher  CredentialCipher
+	tokens  AccessTokenProvider
+	audit   systemconfigapp.AuditWriter
+	members DefaultCreatorMemberFinder
+	now     func() time.Time
+}
+
+// SetDefaultCreatorMemberFinder 注入默认审批发起人的可见成员查询边界。
+func (s *ConnectionService) SetDefaultCreatorMemberFinder(finder DefaultCreatorMemberFinder) {
+	s.members = finder
+}
+
+// NewConnectionService 创建企业微信连接用例。
+func NewConnectionService(db *gorm.DB, repo ApplicationRepository, cipher CredentialCipher, tokens AccessTokenProvider, audit systemconfigapp.AuditWriter) *ConnectionService {
+	return &ConnectionService{db: db, repo: repo, cipher: cipher, tokens: tokens, audit: audit, now: time.Now}
+}
+
+// Save 创建或更新企业微信应用，并保证数据库仅保存密文凭据。
+func (s *ConnectionService) Save(ctx context.Context, request dto.SaveWeComApplicationRequest) (*dto.WeComApplicationResponse, error) {
+	if s == nil || s.db == nil || s.repo == nil || s.cipher == nil {
+		return nil, errors.New(errors.CodeWeComCredentialInvalid)
+	}
+	if middleware.GetUserTypeFromContext(ctx) != constants.UserTypeSuperAdmin {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	secret, err := s.cipher.Encrypt(request.Secret)
+	if err != nil {
+		return nil, err
+	}
+	callbackToken, err := s.cipher.Encrypt(request.CallbackToken)
+	if err != nil {
+		return nil, err
+	}
+	encodingAESKey, err := s.cipher.Encrypt(request.EncodingAESKey)
+	if err != nil {
+		return nil, err
+	}
+	now := s.now().UTC()
+	var saved *model.WeComApplication
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec("SELECT pg_advisory_xact_lock(hashtext(?))", fmt.Sprintf("wecom:%s:%d", request.CorpID, request.AgentID)).Error; err != nil {
+			return err
+		}
+		existing, findErr := s.repo.FindByIdentityForUpdate(ctx, tx, request.CorpID, request.AgentID)
+		if findErr != nil {
+			return findErr
+		}
+		before := map[string]any{"configured": false}
+		if existing == nil {
+			existing = &model.WeComApplication{
+				Model:     gorm.Model{CreatedAt: now},
+				CorpID:    request.CorpID,
+				AgentID:   request.AgentID,
+				CreatedBy: operatorID,
+			}
+		} else {
+			before = applicationAuditSnapshot(existing)
+		}
+		existing.Name = request.Name
+		existing.SecretCiphertext = secret
+		existing.CallbackTokenCiphertext = callbackToken
+		existing.EncodingAESKeyCiphertext = encodingAESKey
+		existing.Status = request.Status
+		existing.UpdatedBy = operatorID
+		existing.UpdatedAt = now
+		if existing.ID == 0 {
+			if err := s.repo.Create(ctx, tx, existing); err != nil {
+				return err
+			}
+		} else if err := s.repo.Update(ctx, tx, existing); err != nil {
+			return err
+		}
+		if s.audit != nil {
+			requestID := ""
+			if value := middleware.GetRequestIDFromContext(ctx); value != nil {
+				requestID = *value
+			}
+			if err := s.audit.WriteConfigChange(ctx, tx, systemconfigapp.ChangeAudit{
+				OperatorID: operatorID, OperationType: "wecom_application_save", Description: "保存企业微信应用安全配置",
+				ConfigKey: fmt.Sprintf("wecom.application.%d", existing.ID), BeforeData: before,
+				AfterData: applicationAuditSnapshot(existing), RequestID: requestID, CorrelationID: requestID,
+			}); err != nil {
+				return err
+			}
+		}
+		saved = existing
+		return nil
+	})
+	if err != nil {
+		var appErr *errors.AppError
+		if stdErrors.As(err, &appErr) {
+			return nil, appErr
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "保存企业微信应用配置失败")
+	}
+	if s.tokens != nil {
+		s.tokens.Invalidate(ctx, saved.ID)
+	}
+	response := toApplicationResponse(*saved, request.Secret, request.CallbackToken, request.EncodingAESKey)
+	return &response, nil
+}
+
+// List 返回企业微信应用列表，并向超级管理员返回可直接编辑的明文凭据。
+func (s *ConnectionService) List(ctx context.Context, request dto.WeComApplicationListRequest) (*dto.WeComApplicationListResponse, error) {
+	if s == nil || s.repo == nil || s.cipher == nil {
+		return nil, errors.New(errors.CodeWeComCredentialInvalid)
+	}
+	if middleware.GetUserTypeFromContext(ctx) != constants.UserTypeSuperAdmin {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	if request.Page <= 0 {
+		request.Page = constants.DefaultPage
+	}
+	if request.PageSize <= 0 {
+		request.PageSize = constants.DefaultPageSize
+	}
+	if request.PageSize > constants.MaxPageSize {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	applications, total, err := s.repo.List(ctx, request.Page, request.PageSize)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]dto.WeComApplicationResponse, 0, len(applications))
+	for _, application := range applications {
+		secret, err := s.cipher.Decrypt(application.SecretCiphertext)
+		if err != nil {
+			return nil, err
+		}
+		callbackToken, err := s.cipher.Decrypt(application.CallbackTokenCiphertext)
+		if err != nil {
+			return nil, err
+		}
+		encodingAESKey, err := s.cipher.Decrypt(application.EncodingAESKeyCiphertext)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, toApplicationResponse(application, secret, callbackToken, encodingAESKey))
+	}
+	return &dto.WeComApplicationListResponse{
+		Items: result, Total: total, Page: request.Page, PageSize: request.PageSize,
+	}, nil
+}
+
+// Test 强制失效旧缓存后取得一次 access_token，但绝不向调用方返回 token。
+func (s *ConnectionService) Test(ctx context.Context, applicationID uint) error {
+	if s == nil {
+		return errors.New(errors.CodeServiceUnavailable, "企业微信连接服务未配置")
+	}
+	if middleware.GetUserTypeFromContext(ctx) != constants.UserTypeSuperAdmin {
+		return errors.New(errors.CodeForbidden)
+	}
+	if s.tokens == nil {
+		return errors.New(errors.CodeServiceUnavailable, "企业微信连接服务未配置")
+	}
+	s.tokens.Invalidate(ctx, applicationID)
+	_, err := s.tokens.GetAccessToken(ctx, applicationID)
+	return err
+}
+
+// SaveDefaultCreator 从应用当前可见成员中保存代理等账号使用的默认审批发起人。
+func (s *ConnectionService) SaveDefaultCreator(ctx context.Context, applicationID uint, request dto.SaveWeComDefaultCreatorRequest) (*dto.WeComApplicationResponse, error) {
+	if s == nil || s.db == nil || s.repo == nil || s.cipher == nil || s.members == nil {
+		return nil, errors.New(errors.CodeServiceUnavailable, "企业微信默认审批发起人服务未配置")
+	}
+	if middleware.GetUserTypeFromContext(ctx) != constants.UserTypeSuperAdmin {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if applicationID == 0 || operatorID == 0 {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	application, err := s.repo.GetEnabled(ctx, applicationID)
+	if err != nil {
+		return nil, err
+	}
+	member, err := s.members.GetVisible(ctx, applicationID, request.UserID)
+	if err != nil {
+		return nil, err
+	}
+	now := s.now().UTC()
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		before := applicationAuditSnapshot(application)
+		if err := s.repo.UpdateDefaultCreator(ctx, tx, applicationID, member.UserID, member.Name, operatorID, now); err != nil {
+			return err
+		}
+		application.DefaultCreatorUserID = member.UserID
+		application.DefaultCreatorName = member.Name
+		application.UpdatedBy = operatorID
+		application.UpdatedAt = now
+		if s.audit != nil {
+			requestID := ""
+			if value := middleware.GetRequestIDFromContext(ctx); value != nil {
+				requestID = *value
+			}
+			return s.audit.WriteConfigChange(ctx, tx, systemconfigapp.ChangeAudit{
+				OperatorID: operatorID, OperationType: "wecom_default_creator_save", Description: "保存企业微信默认审批发起人",
+				ConfigKey: fmt.Sprintf("wecom.application.%d.default_creator", applicationID), BeforeData: before,
+				AfterData: applicationAuditSnapshot(application), RequestID: requestID, CorrelationID: requestID,
+			})
+		}
+		return nil
+	})
+	if err != nil {
+		var appErr *errors.AppError
+		if stdErrors.As(err, &appErr) {
+			return nil, appErr
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "保存企业微信默认审批发起人失败")
+	}
+	secret, err := s.cipher.Decrypt(application.SecretCiphertext)
+	if err != nil {
+		return nil, err
+	}
+	callbackToken, err := s.cipher.Decrypt(application.CallbackTokenCiphertext)
+	if err != nil {
+		return nil, err
+	}
+	encodingAESKey, err := s.cipher.Decrypt(application.EncodingAESKeyCiphertext)
+	if err != nil {
+		return nil, err
+	}
+	response := toApplicationResponse(*application, secret, callbackToken, encodingAESKey)
+	return &response, nil
+}
+
+func applicationAuditSnapshot(application *model.WeComApplication) map[string]any {
+	return map[string]any{
+		"id": application.ID, "corp_id": application.CorpID, "agent_id": application.AgentID,
+		"name": application.Name, "status": application.Status, "credentials_configured": true,
+		"default_creator_userid": application.DefaultCreatorUserID,
+		"default_creator_name":   application.DefaultCreatorName,
+	}
+}
+
+func toApplicationResponse(application model.WeComApplication, secret, callbackToken, encodingAESKey string) dto.WeComApplicationResponse {
+	statusName := "禁用"
+	if application.Status == constants.StatusEnabled {
+		statusName = "启用"
+	}
+	return dto.WeComApplicationResponse{
+		ID: application.ID, CorpID: application.CorpID, AgentID: application.AgentID, Name: application.Name,
+		Secret: secret, CallbackToken: callbackToken, EncodingAESKey: encodingAESKey,
+		DefaultCreatorUserID: application.DefaultCreatorUserID, DefaultCreatorName: application.DefaultCreatorName,
+		Status: application.Status, StatusName: statusName,
+		CredentialsSet:  len(application.SecretCiphertext) > 0 && len(application.CallbackTokenCiphertext) > 0 && len(application.EncodingAESKeyCiphertext) > 0,
+		LastConnectedAt: application.LastConnectedAt, CreatedAt: application.CreatedAt, UpdatedAt: application.UpdatedAt,
+	}
+}

internal/application/wecom/directory.go

@@ -0,0 +1,129 @@
+package wecom
+
+import (
+	"context"
+	"time"
+
+	"github.com/bytedance/sonic"
+
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/internal/model/dto"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
+)
+
+// DirectoryMember 是企微 Adapter 交给 Application 的最小成员快照。
+type DirectoryMember struct {
+	UserID        string
+	Name          string
+	DepartmentIDs []int64
+}
+
+// DirectoryProvider 定义拉取应用可见成员的外部端口。
+type DirectoryProvider interface {
+	ListVisibleMembers(ctx context.Context, applicationID uint) ([]DirectoryMember, error)
+}
+
+// MemberRepository 定义可见成员快照同步和分页查询边界。
+type MemberRepository interface {
+	ReplaceVisible(ctx context.Context, applicationID uint, members []model.WeComMember, syncedAt time.Time) error
+	ListVisible(ctx context.Context, applicationID uint, page, pageSize int, keyword string) ([]model.WeComMember, int64, error)
+}
+
+// DirectoryService 同步并分页查询企业微信应用可见成员。
+type DirectoryService struct {
+	applications interface {
+		GetEnabled(ctx context.Context, applicationID uint) (*model.WeComApplication, error)
+	}
+	provider DirectoryProvider
+	members  MemberRepository
+	now      func() time.Time
+}
+
+// NewDirectoryService 创建企业微信通讯录同步用例。
+func NewDirectoryService(applications interface {
+	GetEnabled(ctx context.Context, applicationID uint) (*model.WeComApplication, error)
+}, provider DirectoryProvider, members MemberRepository) *DirectoryService {
+	return &DirectoryService{applications: applications, provider: provider, members: members, now: time.Now}
+}
+
+// Sync 拉取并替换指定应用当前可见成员快照。
+func (s *DirectoryService) Sync(ctx context.Context, applicationID uint) (*dto.WeComMemberSyncResponse, error) {
+	if s == nil || s.applications == nil || s.provider == nil || s.members == nil || applicationID == 0 {
+		return nil, errors.New(errors.CodeServiceUnavailable, "企业微信通讯录服务未配置")
+	}
+	if !canManageWeComDirectory(ctx) {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	application, err := s.applications.GetEnabled(ctx, applicationID)
+	if err != nil {
+		return nil, err
+	}
+	remoteMembers, err := s.provider.ListVisibleMembers(ctx, applicationID)
+	if err != nil {
+		return nil, err
+	}
+	syncedAt := s.now().UTC()
+	members := make([]model.WeComMember, 0, len(remoteMembers))
+	for _, member := range remoteMembers {
+		departments, err := sonic.Marshal(member.DepartmentIDs)
+		if err != nil {
+			return nil, errors.Wrap(errors.CodeInternalError, err, "序列化企业微信成员部门失败")
+		}
+		members = append(members, model.WeComMember{
+			ApplicationID: applicationID, CorpID: application.CorpID, UserID: member.UserID,
+			Name: member.Name, DepartmentIDs: departments, Visible: true, SyncedAt: syncedAt,
+			CreatedAt: syncedAt, UpdatedAt: syncedAt,
+		})
+	}
+	if err := s.members.ReplaceVisible(ctx, applicationID, members, syncedAt); err != nil {
+		return nil, err
+	}
+	return &dto.WeComMemberSyncResponse{ApplicationID: applicationID, SyncedCount: len(members), SyncedAt: syncedAt}, nil
+}
+
+// List 分页返回本地最近一次同步的应用可见成员。
+func (s *DirectoryService) List(ctx context.Context, applicationID uint, request dto.WeComMemberListRequest) (*dto.WeComMemberListResponse, error) {
+	if s == nil || s.applications == nil || s.members == nil || applicationID == 0 {
+		return nil, errors.New(errors.CodeServiceUnavailable, "企业微信通讯录服务未配置")
+	}
+	if !canManageWeComDirectory(ctx) {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	if request.Page <= 0 {
+		request.Page = constants.DefaultPage
+	}
+	if request.PageSize <= 0 {
+		request.PageSize = constants.DefaultPageSize
+	}
+	if request.PageSize > constants.MaxPageSize {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	if _, err := s.applications.GetEnabled(ctx, applicationID); err != nil {
+		return nil, err
+	}
+	members, total, err := s.members.ListVisible(ctx, applicationID, request.Page, request.PageSize, request.Keyword)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]dto.WeComMemberResponse, 0, len(members))
+	for _, member := range members {
+		var departmentIDs []int64
+		if len(member.DepartmentIDs) > 0 {
+			if err := sonic.Unmarshal(member.DepartmentIDs, &departmentIDs); err != nil {
+				return nil, errors.Wrap(errors.CodeInternalError, err, "解析企业微信成员部门失败")
+			}
+		}
+		items = append(items, dto.WeComMemberResponse{
+			ApplicationID: member.ApplicationID, CorpID: member.CorpID, UserID: member.UserID,
+			Name: member.Name, DepartmentIDs: departmentIDs, SyncedAt: member.SyncedAt,
+		})
+	}
+	return &dto.WeComMemberListResponse{Items: items, Total: total, Page: request.Page, PageSize: request.PageSize}, nil
+}
+
+func canManageWeComDirectory(ctx context.Context) bool {
+	userType := middleware.GetUserTypeFromContext(ctx)
+	return userType == constants.UserTypeSuperAdmin || userType == constants.UserTypePlatform
+}

internal/application/wecom/scene.go

@@ -0,0 +1,322 @@
+package wecom
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	stdErrors "errors"
+	"strings"
+	"time"
+
+	"github.com/bytedance/sonic"
+	"gorm.io/gorm"
+
+	systemconfigapp "github.com/break/junhong_cmp_fiber/internal/application/systemconfig"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/internal/model/dto"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
+)
+
+// TemplateControl 是模板详情中可供业务映射的最小控件结构。
+type TemplateControl struct {
+	ID         string   `json:"id"`
+	Type       string   `json:"type"`
+	Title      string   `json:"title"`
+	Required   bool     `json:"required"`
+	OptionKeys []string `json:"option_keys"`
+}
+
+// TemplateDefinition 是企微 Adapter 返回的模板最小结构。
+type TemplateDefinition struct {
+	TemplateID string            `json:"template_id"`
+	Name       string            `json:"name"`
+	Controls   []TemplateControl `json:"controls"`
+}
+
+// TemplateProvider 定义审批模板详情外部端口。
+type TemplateProvider interface {
+	GetTemplateDetail(ctx context.Context, applicationID uint, templateID string) (TemplateDefinition, error)
+}
+
+// SceneRepository 定义审批场景当前配置持久化边界。
+type SceneRepository interface {
+	FindForUpdate(ctx context.Context, tx *gorm.DB, businessType string) (*model.WeComApprovalScene, error)
+	Create(ctx context.Context, tx *gorm.DB, scene *model.WeComApprovalScene) error
+	Update(ctx context.Context, tx *gorm.DB, scene *model.WeComApprovalScene) error
+	List(ctx context.Context, page, pageSize int) ([]model.WeComApprovalScene, int64, error)
+}
+
+// SceneService 保存经企微模板详情校验的业务场景当前映射。
+type SceneService struct {
+	db       *gorm.DB
+	provider TemplateProvider
+	repo     SceneRepository
+	audit    systemconfigapp.AuditWriter
+	now      func() time.Time
+}
+
+// NewSceneService 创建企业微信审批场景配置用例。
+func NewSceneService(db *gorm.DB, provider TemplateProvider, repo SceneRepository, audit systemconfigapp.AuditWriter) *SceneService {
+	return &SceneService{db: db, provider: provider, repo: repo, audit: audit, now: time.Now}
+}
+
+// Save 校验模板控件后创建或替换指定稳定业务场景映射。
+func (s *SceneService) Save(ctx context.Context, businessType string, request dto.SaveWeComApprovalSceneRequest) (*dto.WeComApprovalSceneResponse, error) {
+	if s == nil || s.db == nil || s.provider == nil || s.repo == nil {
+		return nil, errors.New(errors.CodeServiceUnavailable, "企业微信审批场景服务未配置")
+	}
+	if middleware.GetUserTypeFromContext(ctx) != constants.UserTypeSuperAdmin {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	businessType = strings.TrimSpace(businessType)
+	if !validApprovalBusinessType(businessType) {
+		return nil, errors.New(errors.CodeInvalidParam, "不支持的审批业务类型")
+	}
+	if request.ApplicationID == 0 || strings.TrimSpace(request.TemplateID) == "" || len(request.ControlMapping) == 0 ||
+		(request.Status != constants.StatusDisabled && request.Status != constants.StatusEnabled) {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	definition, err := s.provider.GetTemplateDetail(ctx, request.ApplicationID, strings.TrimSpace(request.TemplateID))
+	if err != nil {
+		return nil, err
+	}
+	if err := validateSceneMapping(businessType, request.ControlMapping, definition.Controls); err != nil {
+		return nil, err
+	}
+	request.ControlMapping = normalizeSceneMapping(request.ControlMapping)
+	mappingJSON, err := sonic.Marshal(request.ControlMapping)
+	if err != nil {
+		return nil, errors.Wrap(errors.CodeInternalError, err, "编码企业微信控件映射失败")
+	}
+	snapshotJSON, err := sonic.Marshal(definition)
+	if err != nil {
+		return nil, errors.Wrap(errors.CodeInternalError, err, "编码企业微信模板快照失败")
+	}
+	fingerprintBytes := sha256.Sum256(snapshotJSON)
+	fingerprint := hex.EncodeToString(fingerprintBytes[:])
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return nil, errors.New(errors.CodeUnauthorized)
+	}
+	now := s.now().UTC()
+	var saved *model.WeComApprovalScene
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec("SELECT pg_advisory_xact_lock(hashtext(?))", "wecom-scene:"+businessType).Error; err != nil {
+			return err
+		}
+		existing, err := s.repo.FindForUpdate(ctx, tx, businessType)
+		if err != nil {
+			return err
+		}
+		before := map[string]any{"configured": false, "business_type": businessType}
+		if existing == nil {
+			existing = &model.WeComApprovalScene{BusinessType: businessType, CreatedBy: operatorID, CreatedAt: now}
+		} else {
+			before = sceneAuditSnapshot(existing)
+		}
+		existing.ApplicationID = request.ApplicationID
+		existing.TemplateID = definition.TemplateID
+		existing.TemplateName = definition.Name
+		existing.ControlMapping = mappingJSON
+		existing.TemplateSnapshot = snapshotJSON
+		existing.TemplateFingerprint = fingerprint
+		existing.Status = request.Status
+		existing.LastVerifiedAt = now
+		existing.UpdatedBy = operatorID
+		existing.UpdatedAt = now
+		if existing.ID == 0 {
+			if err := s.repo.Create(ctx, tx, existing); err != nil {
+				return err
+			}
+		} else if err := s.repo.Update(ctx, tx, existing); err != nil {
+			return err
+		}
+		if s.audit != nil {
+			requestID := ""
+			if value := middleware.GetRequestIDFromContext(ctx); value != nil {
+				requestID = *value
+			}
+			if err := s.audit.WriteConfigChange(ctx, tx, systemconfigapp.ChangeAudit{
+				OperatorID: operatorID, OperationType: "wecom_approval_scene_save", Description: "保存企业微信审批模板映射",
+				ConfigKey: "wecom.approval_scene." + businessType, BeforeData: before,
+				AfterData: sceneAuditSnapshot(existing), RequestID: requestID, CorrelationID: requestID,
+			}); err != nil {
+				return err
+			}
+		}
+		saved = existing
+		return nil
+	})
+	if err != nil {
+		var appErr *errors.AppError
+		if stdErrors.As(err, &appErr) {
+			return nil, appErr
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "保存企业微信审批场景失败")
+	}
+	return sceneResponse(*saved)
+}
+
+// List 分页查询企业微信审批场景当前配置。
+func (s *SceneService) List(ctx context.Context, request dto.WeComApprovalSceneListRequest) (*dto.WeComApprovalSceneListResponse, error) {
+	if s == nil || s.repo == nil {
+		return nil, errors.New(errors.CodeServiceUnavailable, "企业微信审批场景服务未配置")
+	}
+	userType := middleware.GetUserTypeFromContext(ctx)
+	if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
+		return nil, errors.New(errors.CodeForbidden)
+	}
+	if request.Page <= 0 {
+		request.Page = constants.DefaultPage
+	}
+	if request.PageSize <= 0 {
+		request.PageSize = constants.DefaultPageSize
+	}
+	if request.PageSize > constants.MaxPageSize {
+		return nil, errors.New(errors.CodeInvalidParam)
+	}
+	scenes, total, err := s.repo.List(ctx, request.Page, request.PageSize)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]dto.WeComApprovalSceneResponse, 0, len(scenes))
+	for _, scene := range scenes {
+		item, err := sceneResponse(scene)
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, *item)
+	}
+	return &dto.WeComApprovalSceneListResponse{Items: items, Total: total, Page: request.Page, PageSize: request.PageSize}, nil
+}
+
+func validateSceneMapping(businessType string, mapping []dto.WeComControlMappingItem, controls []TemplateControl) error {
+	controlByID := make(map[string]TemplateControl, len(controls))
+	for _, control := range controls {
+		controlByID[control.ID] = control
+	}
+	mappedControls := make(map[string]struct{}, len(mapping))
+	businessFields := make(map[string]struct{}, len(mapping))
+	for _, item := range mapping {
+		item.BusinessField = strings.TrimSpace(item.BusinessField)
+		item.ControlID = strings.TrimSpace(item.ControlID)
+		if item.BusinessField == "" || item.ControlID == "" {
+			return errors.New(errors.CodeInvalidParam, "企业微信控件映射字段不能为空")
+		}
+		if !allowedSceneBusinessField(businessType, item.BusinessField) {
+			return errors.New(errors.CodeInvalidParam, "企业微信控件映射包含当前业务不支持的字段")
+		}
+		if _, exists := businessFields[item.BusinessField]; exists {
+			return errors.New(errors.CodeInvalidParam, "企业微信业务字段映射重复")
+		}
+		if _, exists := mappedControls[item.ControlID]; exists {
+			return errors.New(errors.CodeInvalidParam, "企业微信模板控件不能重复映射")
+		}
+		control, exists := controlByID[item.ControlID]
+		if !exists || !strings.EqualFold(control.Type, strings.TrimSpace(item.ControlType)) {
+			return errors.New(errors.CodeInvalidParam, "企业微信模板控件 ID 或类型已失效")
+		}
+		validOptions := make(map[string]struct{}, len(control.OptionKeys))
+		for _, key := range control.OptionKeys {
+			validOptions[key] = struct{}{}
+		}
+		for _, key := range item.OptionMapping {
+			if _, exists := validOptions[key]; !exists {
+				return errors.New(errors.CodeInvalidParam, "企业微信模板选择项 key 已失效")
+			}
+		}
+		businessFields[item.BusinessField] = struct{}{}
+		mappedControls[item.ControlID] = struct{}{}
+	}
+	for _, control := range controls {
+		if control.Required {
+			if _, exists := mappedControls[control.ID]; !exists {
+				return errors.New(errors.CodeInvalidParam, "企业微信模板存在未映射的必填控件: "+control.Title)
+			}
+		}
+	}
+	return nil
+}
+
+func allowedSceneBusinessField(businessType, businessField string) bool {
+	allowed := map[string]struct{}{}
+	switch businessType {
+	case constants.ApprovalBusinessTypeOfflineRecharge:
+		allowed = map[string]struct{}{
+			constants.ApprovalFieldRechargeNo:        {},
+			constants.ApprovalFieldShopID:            {},
+			constants.ApprovalFieldShopName:          {},
+			constants.ApprovalFieldAmount:            {},
+			constants.ApprovalFieldAmountCent:        {},
+			constants.ApprovalFieldPaymentVoucherKey: {},
+			constants.ApprovalFieldRemark:            {},
+			constants.ApprovalFieldSubmitterID:       {},
+			constants.ApprovalFieldSubmitterName:     {},
+		}
+	case constants.ApprovalBusinessTypeRefund:
+		allowed = map[string]struct{}{
+			constants.ApprovalFieldRefundNo:              {},
+			constants.ApprovalFieldOrderID:               {},
+			constants.ApprovalFieldOrderNo:               {},
+			constants.ApprovalFieldAssetIdentifier:       {},
+			constants.ApprovalFieldAssetType:             {},
+			constants.ApprovalFieldActualReceivedAmount:  {},
+			constants.ApprovalFieldRequestedRefundAmount: {},
+			constants.ApprovalFieldRefundVoucherKey:      {},
+			constants.ApprovalFieldRefundReason:          {},
+			constants.ApprovalFieldPackageUsageID:        {},
+			constants.ApprovalFieldSubmitterID:           {},
+			constants.ApprovalFieldSubmitterName:         {},
+		}
+	default:
+		return false
+	}
+	_, exists := allowed[businessField]
+	return exists
+}
+
+func normalizeSceneMapping(mapping []dto.WeComControlMappingItem) []dto.WeComControlMappingItem {
+	result := make([]dto.WeComControlMappingItem, 0, len(mapping))
+	for _, item := range mapping {
+		item.BusinessField = strings.TrimSpace(item.BusinessField)
+		item.ControlID = strings.TrimSpace(item.ControlID)
+		item.ControlType = strings.TrimSpace(item.ControlType)
+		if item.OptionMapping == nil {
+			item.OptionMapping = map[string]string{}
+		}
+		result = append(result, item)
+	}
+	return result
+}
+
+func validApprovalBusinessType(businessType string) bool {
+	return businessType == constants.ApprovalBusinessTypeRefund || businessType == constants.ApprovalBusinessTypeOfflineRecharge
+}
+
+func sceneAuditSnapshot(scene *model.WeComApprovalScene) map[string]any {
+	return map[string]any{
+		"business_type": scene.BusinessType, "application_id": scene.ApplicationID,
+		"template_id": scene.TemplateID, "status": scene.Status, "last_verified_at": scene.LastVerifiedAt,
+		"template_fingerprint": scene.TemplateFingerprint,
+	}
+}
+
+func sceneResponse(scene model.WeComApprovalScene) (*dto.WeComApprovalSceneResponse, error) {
+	var mapping []dto.WeComControlMappingItem
+	if err := sonic.Unmarshal(scene.ControlMapping, &mapping); err != nil {
+		return nil, errors.Wrap(errors.CodeInternalError, err, "解析企业微信控件映射失败")
+	}
+	name := "员工线下代充值审批"
+	if scene.BusinessType == constants.ApprovalBusinessTypeRefund {
+		name = "退款审批"
+	}
+	return &dto.WeComApprovalSceneResponse{
+		ID: scene.ID, BusinessType: scene.BusinessType, BusinessTypeName: name,
+		ApplicationID: scene.ApplicationID, TemplateID: scene.TemplateID, TemplateName: scene.TemplateName,
+		TemplateFingerprint: scene.TemplateFingerprint,
+		ControlMapping:      mapping, Status: scene.Status, StatusName: constants.GetStatusName(scene.Status),
+		LastVerifiedAt: scene.LastVerifiedAt, UpdatedAt: scene.UpdatedAt,
+	}, nil
+}