固化七月迭代审计治理进展以隔离线上热修

Constraint: 切换 main 前必须保存当前七月分支全部项目进展，套餐生效提案仅属于 Iteration/7-11。

Rejected: 将七月套餐修复直接移植到 main | 两个分支的可靠投递架构不同。

Confidence: medium

Scope-risk: broad

Directive: 不得将本提交整体 cherry-pick 到 main；main 套餐热修必须基于其纯 Asynq 代码独立实施。

Tested: git diff --check；openspec validate fix-package-activation-starvation --strict。

Not-tested: 按用户要求未运行自动化测试；go build ./... 因当前审计改造中的 Enterprise 模型字面量和 role.recordFailure 参数类型错误未通过。

internal/bootstrap/dependencies.go

@@ -28,5 +28,5 @@ type Dependencies struct {
 	GatewayClient        *gateway.Client                // Gateway API 客户端（可选，配置缺失时为 nil）
 	WechatPayment        wechat.PaymentServiceInterface // 微信支付服务（可选）
 	SystemConfigRegistry *systemConfigInfra.Registry    // 业务模块共享的受控配置注册表（可选）
-	SystemConfigAudit    systemConfigApp.AuditWriter    // 配置变更审计 Port（可选，装配后与配置同事务写入）
+	SystemConfigAudit    systemConfigApp.AuditWriter    // 配置变更审计 Port；生产为空时装配统一 Writer
 }

internal/bootstrap/handlers.go

@@ -12,6 +12,7 @@ import (
 	authHandler "github.com/break/junhong_cmp_fiber/internal/handler/auth"
 	"github.com/break/junhong_cmp_fiber/internal/handler/callback"
 	openapiHandler "github.com/break/junhong_cmp_fiber/internal/handler/openapi"
+	auditInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	"github.com/break/junhong_cmp_fiber/internal/infrastructure/carriercallback"
 	"github.com/break/junhong_cmp_fiber/internal/infrastructure/integrationlog"
 	systemConfigInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/systemconfig"
@@ -19,7 +20,9 @@ import (
 	pollingPkg "github.com/break/junhong_cmp_fiber/internal/polling"
 	agentRechargeQuery "github.com/break/junhong_cmp_fiber/internal/query/agentrecharge"
 	assetQuery "github.com/break/junhong_cmp_fiber/internal/query/asset"
+	auditQuery "github.com/break/junhong_cmp_fiber/internal/query/audit"
 	exchangeQuery "github.com/break/junhong_cmp_fiber/internal/query/exchange"
+	integrationQuery "github.com/break/junhong_cmp_fiber/internal/query/integration"
 	notificationQuery "github.com/break/junhong_cmp_fiber/internal/query/notification"
 	packageExpiryQuery "github.com/break/junhong_cmp_fiber/internal/query/packageexpiry"
 	shopQuery "github.com/break/junhong_cmp_fiber/internal/query/shop"
@@ -107,8 +110,12 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 	paymentMethodPolicy := paymentmethod.NewPolicy(systemConfigReader)
 	clientOrderService.SetPaymentMethodPolicy(paymentMethodPolicy)
 	systemConfigList := systemConfigQuery.NewListQuery(systemConfigReader)
+	systemConfigAudit := deps.SystemConfigAudit
+	if systemConfigAudit == nil {
+		systemConfigAudit = auditInfra.NewWriter(auditInfra.NewRegistry(), nil)
+	}
 	systemConfigUpdate := systemConfigApp.NewUpdateService(
-		deps.DB, systemConfigRegistry, systemConfigCache, deps.SystemConfigAudit, systemConfigAlerts, nil,
+		deps.DB, systemConfigRegistry, systemConfigCache, systemConfigAudit, systemConfigAlerts, nil,
 	)
 	wecomRepository := wecomInfra.NewApplicationRepository(deps.DB)
 	wecomBaseURL := ""
@@ -122,8 +129,11 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		wecomBaseURL, wecomTimeout, deps.Logger,
 	)
 	wecomConnections := wecomApp.NewConnectionService(
-		deps.DB, wecomRepository, wecomTokens, deps.SystemConfigAudit,
+		deps.DB, wecomRepository, wecomTokens, systemConfigAudit,
 	)
+	if sensitiveReadAudit, ok := systemConfigAudit.(wecomApp.SensitiveReadAuditWriter); ok {
+		wecomConnections.SetSensitiveReadAuditWriter(sensitiveReadAudit)
+	}
 	wecomMembers := wecomInfra.NewMemberRepository(deps.DB)
 	wecomConnections.SetDefaultCreatorMemberFinder(wecomMembers)
 	wecomDirectory := wecomApp.NewDirectoryService(
@@ -146,7 +156,7 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		Account: admin.NewAccountHandler(svc.Account),
 		Role: func() *admin.RoleHandler {
 			handler := admin.NewRoleHandler(svc.Role, validate)
-			handler.SetDefaultCreditService(roleApp.NewDefaultCreditService(deps.DB, svc.Permission))
+			handler.SetDefaultCreditService(roleApp.NewDefaultCreditService(deps.DB, svc.Permission, svc.AccessAudit))
 			return handler
 		}(),
 		Permission:       admin.NewPermissionHandler(svc.Permission),
@@ -180,8 +190,8 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		ClientNotification:  app.NewClientNotificationHandler(notificationQuery.NewQuery(deps.DB), notificationApp.NewReadService(deps.DB), validate),
 		Shop: func() *admin.ShopHandler {
 			handler := admin.NewShopHandler(svc.Shop, validate)
-			handler.SetCreateService(shopApp.NewCreateService(deps.DB))
-			handler.SetUpdateService(shopApp.NewUpdateService(deps.DB))
+			handler.SetCreateService(shopApp.NewCreateService(deps.DB, svc.AccessAudit))
+			handler.SetUpdateService(shopApp.NewUpdateService(deps.DB, svc.AccessAudit))
 			handler.SetBusinessOwnerQuery(shopQuery.NewBusinessOwnerQuery(deps.DB))
 			handler.SetChangeCreditService(walletApp.NewChangeCreditService(deps.DB))
 			return handler
@@ -280,6 +290,7 @@ func initHandlers(svc *services, deps *Dependencies) *Handlers {
 		ClientWechat:           app.NewClientWechatHandler(svc.WechatConfig, deps.Redis, deps.Logger),
 		SuperAdmin:             admin.NewSuperAdminHandler(svc.OperationPassword),
 		SystemConfig:           admin.NewSystemConfigHandler(systemConfigList, systemConfigUpdate),
+		Audit:                  admin.NewAuditHandler(auditQuery.New(deps.DB), integrationQuery.New(deps.DB)),
 		WeCom: func() *admin.WeComHandler {
 			handler := admin.NewWeComHandler(wecomConnections, validate)
 			handler.SetDirectoryService(wecomDirectory)

internal/bootstrap/services.go

@@ -5,6 +5,7 @@ import (
 
 	"go.uber.org/zap"
 
+	accessauditApp "github.com/break/junhong_cmp_fiber/internal/application/accessaudit"
 	agentrechargeApp "github.com/break/junhong_cmp_fiber/internal/application/agentrecharge"
 	approvalApp "github.com/break/junhong_cmp_fiber/internal/application/approval"
 	cardObservationApp "github.com/break/junhong_cmp_fiber/internal/application/cardobservation"
@@ -12,6 +13,7 @@ import (
 	refundapprovalApp "github.com/break/junhong_cmp_fiber/internal/application/refundapproval"
 	walletapp "github.com/break/junhong_cmp_fiber/internal/application/wallet"
 	approvalInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/approval"
+	auditInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
 	cardObservationInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/cardobservation"
 	exchangeInfra "github.com/break/junhong_cmp_fiber/internal/infrastructure/exchange"
 	"github.com/break/junhong_cmp_fiber/internal/infrastructure/integrationlog"
@@ -76,6 +78,7 @@ import (
 )
 
 type services struct {
+	AccessAudit                 accessauditApp.Writer
 	Approval                    *approvalApp.CreationService
 	Account                     *accountSvc.Service
 	AccountAudit                *accountAuditSvc.Service
@@ -147,7 +150,13 @@ func initServices(s *stores, deps *Dependencies) *services {
 	purchaseValidation := purchaseValidationSvc.New(deps.DB, s.IotCard, s.Device, s.Package, s.ShopPackageAllocation)
 	accountAudit := accountAuditSvc.NewService(s.AccountOperationLog)
 	assetAudit := assetAuditSvc.NewService(s.AssetOperationLog, deps.DB)
+	auditWriter := auditInfra.NewWriter(auditInfra.NewRegistry(), nil)
 	account := accountSvc.New(s.Account, s.Role, s.AccountRole, s.ShopRole, s.Shop, s.Enterprise, accountAudit)
+	account.SetLifecycleAudit(deps.DB, auditWriter)
+	account.SetAccessAudit(deps.DB, deps.Redis, auditWriter)
+	account.SetTokenManager(deps.TokenManager)
+	authService := authSvc.New(s.Account, s.AccountRole, s.RolePermission, s.Permission, s.Shop, deps.TokenManager, deps.Logger)
+	authService.SetSecurityAudit(deps.DB, auditWriter)
 
 	// 创建 IotCard service 并设置回调
 	iotCard := iotCardSvc.New(
@@ -330,15 +339,22 @@ func initServices(s *stores, deps *Dependencies) *services {
 	refundService.SetRefundApprovalCreationService(
 		refundapprovalApp.NewCreationService(deps.DB, approvalCreationService),
 	)
+	roleService := roleSvc.New(s.Role, s.Permission, s.RolePermission, s.AccountRole, s.ShopRole)
+	roleService.SetAccessAudit(deps.DB, deps.Redis, auditWriter)
+	permissionService := permissionSvc.New(s.Permission, s.AccountRole, s.RolePermission, account, deps.Redis)
+	permissionService.SetAccessAudit(deps.DB, auditWriter)
+	shopService := shopSvc.New(s.Shop, s.Account, s.ShopRole, s.Role)
+	shopService.SetAccessAudit(deps.DB, deps.Redis, auditWriter)
 
 	return &services{
+		AccessAudit:      auditWriter,
 		Approval:         approvalCreationService,
 		Account:          account,
 		AccountAudit:     accountAudit,
 		AssetAudit:       assetAudit,
-		Role:             roleSvc.New(s.Role, s.Permission, s.RolePermission, s.AccountRole, s.ShopRole),
-		Permission:       permissionSvc.New(s.Permission, s.AccountRole, s.RolePermission, account, deps.Redis),
-		PersonalCustomer: personalCustomerSvc.NewService(s.PersonalCustomer, s.PersonalCustomerPhone, deps.Logger),
+		Role:             roleService,
+		Permission:       permissionService,
+		PersonalCustomer: personalCustomerSvc.NewService(deps.DB, s.PersonalCustomer, s.PersonalCustomerPhone, deps.Logger, auditWriter),
 		ClientAuth: clientAuthSvc.New(
 			deps.DB,
 			s.PersonalCustomerOpenID,
@@ -352,9 +368,10 @@ func initServices(s *stores, deps *Dependencies) *services {
 			deps.Redis,
 			deps.Logger,
 			customerBinding,
+			auditWriter,
 		),
-		Shop:                        shopSvc.New(s.Shop, s.Account, s.ShopRole, s.Role),
-		Auth:                        authSvc.New(s.Account, s.AccountRole, s.RolePermission, s.Permission, s.Shop, deps.TokenManager, deps.Logger),
+		Shop:                        shopService,
+		Auth:                        authService,
 		ShopCommission:              shopCommission,
 		CommissionWithdrawal:        commissionWithdrawalSvc.New(deps.DB, s.Shop, s.Account, s.AgentWallet, s.AgentWalletTransaction, s.CommissionWithdrawalRequest),
 		CommissionWithdrawalSetting: commissionWithdrawalSettingSvc.New(deps.DB, s.Account, s.CommissionWithdrawalSetting),
@@ -376,10 +393,10 @@ func initServices(s *stores, deps *Dependencies) *services {
 			commissionStatsSvc.New(s.ShopSeriesCommissionStats),
 			deps.Logger,
 		),
-		Enterprise:                  enterpriseSvc.New(deps.DB, s.Enterprise, s.Shop, s.Account),
-		EnterpriseCard:              enterpriseCardSvc.New(deps.DB, s.Enterprise, s.EnterpriseCardAuthorization, s.IotCard),
-		EnterpriseDevice:            enterpriseDeviceSvc.New(deps.DB, s.Enterprise, s.Device, s.DeviceSimBinding, s.EnterpriseDeviceAuthorization, s.EnterpriseCardAuthorization, deps.Logger),
-		Authorization:               enterpriseCardSvc.NewAuthorizationService(s.Enterprise, s.IotCard, s.EnterpriseCardAuthorization, deps.Logger),
+		Enterprise:                  enterpriseSvc.New(deps.DB, s.Enterprise, s.Shop, s.Account, auditWriter),
+		EnterpriseCard:              enterpriseCardSvc.New(deps.DB, s.Enterprise, s.EnterpriseCardAuthorization, s.IotCard, auditWriter),
+		EnterpriseDevice:            enterpriseDeviceSvc.New(deps.DB, s.Enterprise, s.Device, s.DeviceSimBinding, s.EnterpriseDeviceAuthorization, s.EnterpriseCardAuthorization, deps.Logger, auditWriter),
+		Authorization:               enterpriseCardSvc.NewAuthorizationService(deps.DB, s.Enterprise, s.IotCard, s.EnterpriseCardAuthorization, deps.Logger, auditWriter),
 		IotCard:                     iotCard,
 		IotCardImport:               iotCardImportSvc.New(deps.DB, s.IotCardImportTask, deps.QueueClient, assetAudit),
 		ExportTask:                  exportTaskSvc.New(deps.DB, s.ExportTask, deps.QueueClient, deps.StorageService),

internal/bootstrap/types.go

@@ -75,6 +75,7 @@ type Handlers struct {
 	ClientWechat                *app.ClientWechatHandler
 	SuperAdmin                  *admin.SuperAdminHandler
 	SystemConfig                *admin.SystemConfigHandler
+	Audit                       *admin.AuditHandler
 	WeCom                       *admin.WeComHandler
 	AgentOpenAPI                *openapiHandler.Handler
 }