固化七月迭代审计治理进展以隔离线上热修

Constraint: 切换 main 前必须保存当前七月分支全部项目进展，套餐生效提案仅属于 Iteration/7-11。

Rejected: 将七月套餐修复直接移植到 main | 两个分支的可靠投递架构不同。

Confidence: medium

Scope-risk: broad

Directive: 不得将本提交整体 cherry-pick 到 main；main 套餐热修必须基于其纯 Asynq 代码独立实施。

Tested: git diff --check；openspec validate fix-package-activation-starvation --strict。

Not-tested: 按用户要求未运行自动化测试；go build ./... 因当前审计改造中的 Enterprise 模型字面量和 role.recordFailure 参数类型错误未通过。

internal/service/role/service.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	accessauditapp "github.com/break/junhong_cmp_fiber/internal/application/accessaudit"
 	"github.com/break/junhong_cmp_fiber/internal/model"
 	"github.com/break/junhong_cmp_fiber/internal/model/dto"
 	"github.com/break/junhong_cmp_fiber/internal/store"
@@ -15,11 +16,15 @@ import (
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
 	"github.com/break/junhong_cmp_fiber/pkg/middleware"
+	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
 )
 
 // Service 角色业务服务
 type Service struct {
+	db                  *gorm.DB
+	redisClient         *redis.Client
+	accessAudit         accessauditapp.Writer
 	roleStore           *postgres.RoleStore
 	permissionStore     *postgres.PermissionStore
 	rolePermissionStore *postgres.RolePermissionStore
@@ -27,6 +32,13 @@ type Service struct {
 	shopRoleStore       *postgres.ShopRoleStore
 }
 
+// SetAccessAudit 注入角色与权限配置的事务审计接缝。
+func (s *Service) SetAccessAudit(db *gorm.DB, redisClient *redis.Client, writer accessauditapp.Writer) {
+	s.db = db
+	s.redisClient = redisClient
+	s.accessAudit = writer
+}
+
 // New 创建角色服务
 func New(roleStore *postgres.RoleStore, permissionStore *postgres.PermissionStore, rolePermissionStore *postgres.RolePermissionStore, accountRoleStore *postgres.AccountRoleStore, shopRoleStore *postgres.ShopRoleStore) *Service {
 	return &Service{
@@ -46,24 +58,40 @@ func (s *Service) Create(ctx context.Context, req *dto.CreateRoleRequest) (*dto.
 		return nil, errors.New(errors.CodeUnauthorized, "未授权访问")
 	}
 
-	// 检查角色名是否已存在
-	exists, err := s.roleStore.ExistsByName(ctx, req.RoleName, 0)
-	if err != nil {
-		return nil, errors.Wrap(errors.CodeInternalError, err, "检查角色名失败")
-	}
-	if exists {
-		return nil, errors.New(errors.CodeRoleNameExists)
-	}
-
-	// 创建角色
 	role := &model.Role{
 		RoleName: req.RoleName,
 		RoleDesc: req.RoleDesc,
 		RoleType: req.RoleType,
 		Status:   constants.StatusEnabled,
+		BaseModel: model.BaseModel{
+			Creator: currentUserID,
+			Updater: currentUserID,
+		},
 	}
 
-	if err := s.roleStore.Create(ctx, role); err != nil {
+	// 检查角色名是否已存在
+	exists, err := s.roleStore.ExistsByName(ctx, req.RoleName, 0)
+	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleCreated, "创建角色失败", constants.AuditResultFailed, role, nil, nil, err)
+		return nil, errors.Wrap(errors.CodeInternalError, err, "检查角色名失败")
+	}
+	if exists {
+		appErr := errors.New(errors.CodeRoleNameExists)
+		s.recordFailure(ctx, constants.AuditActionRoleCreated, "拒绝创建重复角色", constants.AuditResultDenied, role, nil, nil, appErr)
+		return nil, appErr
+	}
+
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRoleStore(tx).Create(ctx, role); err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRoleCreated, Summary: "创建角色", Result: constants.AuditResultSuccess,
+			OperatorID: currentUserID, Role: role, AfterData: roleAuditData(role),
+		})
+	}); err != nil {
+		role.ID = 0
+		s.recordFailure(ctx, constants.AuditActionRoleCreated, "创建角色失败", constants.AuditResultFailed, role, nil, nil, err)
 		return nil, errors.Wrap(errors.CodeInternalError, err, "创建角色失败")
 	}
 
@@ -98,15 +126,19 @@ func (s *Service) Update(ctx context.Context, id uint, req *dto.UpdateRoleReques
 		}
 		return nil, errors.Wrap(errors.CodeInternalError, err, "获取角色失败")
 	}
+	beforeData := roleAuditData(role)
 
 	// 如果修改了角色名，检查是否与其他角色重复
 	if req.RoleName != nil && *req.RoleName != role.RoleName {
 		exists, err := s.roleStore.ExistsByName(ctx, *req.RoleName, id)
 		if err != nil {
+			s.recordFailure(ctx, constants.AuditActionRoleUpdated, "更新角色失败", constants.AuditResultFailed, role, beforeData, nil, err)
 			return nil, errors.Wrap(errors.CodeInternalError, err, "检查角色名失败")
 		}
 		if exists {
-			return nil, errors.New(errors.CodeRoleNameExists)
+			appErr := errors.New(errors.CodeRoleNameExists)
+			s.recordFailure(ctx, constants.AuditActionRoleUpdated, "拒绝更新重复角色名", constants.AuditResultDenied, role, beforeData, nil, appErr)
+			return nil, appErr
 		}
 		role.RoleName = *req.RoleName
 	}
@@ -121,7 +153,16 @@ func (s *Service) Update(ctx context.Context, id uint, req *dto.UpdateRoleReques
 
 	role.Updater = currentUserID
 
-	if err := s.roleStore.Update(ctx, role); err != nil {
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRoleStore(tx).Update(ctx, role); err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRoleUpdated, Summary: "更新角色", Result: constants.AuditResultSuccess,
+			OperatorID: currentUserID, Role: role, BeforeData: beforeData, AfterData: roleAuditData(role),
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleUpdated, "更新角色失败", constants.AuditResultFailed, role, beforeData, nil, err)
 		return nil, errors.Wrap(errors.CodeInternalError, err, "更新角色失败")
 	}
 
@@ -130,7 +171,7 @@ func (s *Service) Update(ctx context.Context, id uint, req *dto.UpdateRoleReques
 
 // Delete 软删除角色
 func (s *Service) Delete(ctx context.Context, id uint) error {
-	_, err := s.roleStore.GetByID(ctx, id)
+	role, err := s.roleStore.GetByID(ctx, id)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return errors.New(errors.CodeRoleNotFound, "角色不存在")
@@ -140,19 +181,34 @@ func (s *Service) Delete(ctx context.Context, id uint) error {
 
 	accountCount, err := s.accountRoleStore.CountByRoleID(ctx, id)
 	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleDeleted, "删除角色失败", constants.AuditResultFailed, role, roleAuditData(role), nil, err)
 		return errors.Wrap(errors.CodeInternalError, err, "检查角色分配情况失败")
 	}
 
 	shopCount, err := s.shopRoleStore.CountByRoleID(ctx, id)
 	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleDeleted, "删除角色失败", constants.AuditResultFailed, role, roleAuditData(role), nil, err)
 		return errors.Wrap(errors.CodeInternalError, err, "检查角色分配情况失败")
 	}
 
 	if accountCount > 0 || shopCount > 0 {
-		return errors.New(errors.CodeRoleInUse, fmt.Sprintf("该角色已分配给 %d 个账号、%d 个店铺，请先移除相关分配后再删除", accountCount, shopCount))
+		appErr := errors.New(errors.CodeRoleInUse, fmt.Sprintf("该角色已分配给 %d 个账号、%d 个店铺，请先移除相关分配后再删除", accountCount, shopCount))
+		s.recordFailure(ctx, constants.AuditActionRoleDeleted, "拒绝删除使用中的角色", constants.AuditResultDenied, role, roleAuditData(role), nil, appErr)
+		return appErr
 	}
 
-	if err := s.roleStore.Delete(ctx, id); err != nil {
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	beforeData := roleAuditData(role)
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRoleStore(tx).Delete(ctx, id); err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRoleDeleted, Summary: "删除角色", Result: constants.AuditResultSuccess,
+			OperatorID: operatorID, Role: role, BeforeData: beforeData, AfterData: map[string]any{"deleted": true},
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleDeleted, "删除角色失败", constants.AuditResultFailed, role, beforeData, nil, err)
 		return errors.Wrap(errors.CodeInternalError, err, "删除角色失败")
 	}
 
@@ -212,11 +268,14 @@ func (s *Service) AssignPermissions(ctx context.Context, roleID uint, permIDs []
 
 	permissions, err := s.permissionStore.GetByIDs(ctx, permIDs)
 	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsAssigned, "分配角色权限失败", constants.AuditResultFailed, role, nil, nil, err)
 		return nil, errors.Wrap(errors.CodeInternalError, err, "获取权限失败")
 	}
 
 	if len(permissions) != len(permIDs) {
-		return nil, errors.New(errors.CodePermissionNotFound, "部分权限不存在")
+		appErr := errors.New(errors.CodePermissionNotFound, "部分权限不存在")
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsAssigned, "拒绝分配不存在的权限", constants.AuditResultDenied, role, nil, nil, appErr)
+		return nil, appErr
 	}
 
 	roleTypeStr := fmt.Sprintf("%d", role.RoleType)
@@ -228,12 +287,15 @@ func (s *Service) AssignPermissions(ctx context.Context, roleID uint, permIDs []
 	}
 
 	if len(invalidPermIDs) > 0 {
-		return nil, errors.New(errors.CodeInvalidParam, fmt.Sprintf("权限 %v 不适用于此角色类型", invalidPermIDs))
+		appErr := errors.New(errors.CodeInvalidParam, fmt.Sprintf("权限 %v 不适用于此角色类型", invalidPermIDs))
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsAssigned, "拒绝分配不适用的权限", constants.AuditResultDenied, role, permissionAuditChanges(permissions, nil, nil), nil, appErr)
+		return nil, appErr
 	}
 
 	// 批量获取已有权限集合，避免逐条 Exists 查询
 	existingPermIDs, err := s.rolePermissionStore.GetPermIDsByRoleID(ctx, roleID)
 	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsAssigned, "分配角色权限失败", constants.AuditResultFailed, role, nil, nil, err)
 		return nil, errors.Wrap(errors.CodeInternalError, err, "获取已有权限失败")
 	}
 	existingSet := make(map[uint]bool, len(existingPermIDs))
@@ -242,6 +304,11 @@ func (s *Service) AssignPermissions(ctx context.Context, roleID uint, permIDs []
 	}
 
 	var rps []*model.RolePermission
+	changedPermissions := make([]*model.Permission, 0, len(permissions))
+	permissionByID := make(map[uint]*model.Permission, len(permissions))
+	for _, permission := range permissions {
+		permissionByID[permission.ID] = permission
+	}
 	for _, permID := range permIDs {
 		if existingSet[permID] {
 			continue
@@ -252,11 +319,37 @@ func (s *Service) AssignPermissions(ctx context.Context, roleID uint, permIDs []
 			PermID: permID,
 			Status: constants.StatusEnabled,
 		}
-		if err := s.rolePermissionStore.Create(ctx, rp); err != nil {
-			return nil, errors.Wrap(errors.CodeInternalError, err, "创建角色-权限关联失败")
-		}
 		rps = append(rps, rp)
+		changedPermissions = append(changedPermissions, permissionByID[permID])
 	}
+	beforeData := map[string]any{"permission_ids": existingPermIDs}
+	afterData := map[string]any{"permission_ids": appendPermissionIDs(existingPermIDs, rps)}
+	if len(rps) == 0 {
+		return rps, nil
+	}
+	var accountIDs []uint
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		store := postgres.NewRolePermissionStore(tx, nil)
+		for _, rp := range rps {
+			if err := store.Create(ctx, rp); err != nil {
+				return err
+			}
+		}
+		var err error
+		accountIDs, err = rolePermissionCacheAccountIDs(ctx, tx, role.ID)
+		if err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRolePermissionsAssigned, Summary: "分配角色权限", Result: constants.AuditResultSuccess,
+			OperatorID: currentUserID, Role: role, Permissions: permissionAuditChanges(changedPermissions, map[string]any{"assigned": false}, map[string]any{"assigned": true}),
+			BeforeData: beforeData, AfterData: afterData,
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsAssigned, "分配角色权限失败", constants.AuditResultFailed, role, permissionAuditChanges(changedPermissions, map[string]any{"assigned": false}, nil), beforeData, err)
+		return nil, errors.Wrap(errors.CodeInternalError, err, "创建角色-权限关联失败")
+	}
+	s.clearRolePermissionCaches(ctx, accountIDs)
 
 	return rps, nil
 }
@@ -288,7 +381,7 @@ func (s *Service) GetPermissions(ctx context.Context, roleID uint) ([]*model.Per
 
 // RemovePermission 移除角色的权限
 func (s *Service) RemovePermission(ctx context.Context, roleID, permID uint) error {
-	_, err := s.roleStore.GetByID(ctx, roleID)
+	role, err := s.roleStore.GetByID(ctx, roleID)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return errors.New(errors.CodeRoleNotFound, "角色不存在")
@@ -296,16 +389,52 @@ func (s *Service) RemovePermission(ctx context.Context, roleID, permID uint) err
 		return errors.Wrap(errors.CodeInternalError, err, "获取角色失败")
 	}
 
-	if err := s.rolePermissionStore.Delete(ctx, roleID, permID); err != nil {
+	existingPermIDs, err := s.rolePermissionStore.GetPermIDsByRoleID(ctx, roleID)
+	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionRemoved, "移除角色权限失败", constants.AuditResultFailed, role, nil, nil, err)
+		return errors.Wrap(errors.CodeInternalError, err, "获取角色权限失败")
+	}
+	if !containsUint(existingPermIDs, permID) {
+		return nil
+	}
+	permission, permissionErr := s.permissionStore.GetByID(ctx, permID)
+	if permissionErr != nil && permissionErr != gorm.ErrRecordNotFound {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionRemoved, "移除角色权限失败", constants.AuditResultFailed, role, nil, map[string]any{"permission_ids": existingPermIDs}, permissionErr)
+		return errors.Wrap(errors.CodeInternalError, permissionErr, "获取待移除权限失败")
+	}
+	changes := []accessauditapp.PermissionChange(nil)
+	if permissionErr == nil {
+		changes = permissionAuditChanges([]*model.Permission{permission}, map[string]any{"assigned": true}, map[string]any{"assigned": false})
+	}
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	beforeData := map[string]any{"permission_ids": existingPermIDs}
+	afterData := map[string]any{"permission_ids": removePermissionIDs(existingPermIDs, map[uint]struct{}{permID: {}})}
+	var accountIDs []uint
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRolePermissionStore(tx, nil).Delete(ctx, roleID, permID); err != nil {
+			return err
+		}
+		var err error
+		accountIDs, err = rolePermissionCacheAccountIDs(ctx, tx, role.ID)
+		if err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRolePermissionRemoved, Summary: "移除角色权限", Result: constants.AuditResultSuccess,
+			OperatorID: operatorID, Role: role, Permissions: changes, BeforeData: beforeData, AfterData: afterData,
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionRemoved, "移除角色权限失败", constants.AuditResultFailed, role, changes, beforeData, err)
 		return errors.Wrap(errors.CodeInternalError, err, "删除角色-权限关联失败")
 	}
+	s.clearRolePermissionCaches(ctx, accountIDs)
 
 	return nil
 }
 
 // BatchRemovePermissions 批量移除角色的权限
 func (s *Service) BatchRemovePermissions(ctx context.Context, roleID uint, permIDs []uint) error {
-	_, err := s.roleStore.GetByID(ctx, roleID)
+	role, err := s.roleStore.GetByID(ctx, roleID)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
 			return errors.New(errors.CodeRoleNotFound, "角色不存在")
@@ -313,9 +442,50 @@ func (s *Service) BatchRemovePermissions(ctx context.Context, roleID uint, permI
 		return errors.Wrap(errors.CodeInternalError, err, "获取角色失败")
 	}
 
-	if err := s.rolePermissionStore.BatchDelete(ctx, roleID, permIDs); err != nil {
+	existingPermIDs, err := s.rolePermissionStore.GetPermIDsByRoleID(ctx, roleID)
+	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsBatchRemoved, "批量移除角色权限失败", constants.AuditResultFailed, role, nil, nil, err)
+		return errors.Wrap(errors.CodeInternalError, err, "获取角色权限失败")
+	}
+	removeSet := make(map[uint]struct{}, len(permIDs))
+	actualIDs := make([]uint, 0, len(permIDs))
+	for _, permID := range permIDs {
+		removeSet[permID] = struct{}{}
+		if containsUint(existingPermIDs, permID) {
+			actualIDs = append(actualIDs, permID)
+		}
+	}
+	if len(actualIDs) == 0 {
+		return nil
+	}
+	permissions, err := s.permissionStore.GetByIDs(ctx, actualIDs)
+	if err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsBatchRemoved, "批量移除角色权限失败", constants.AuditResultFailed, role, nil, map[string]any{"permission_ids": existingPermIDs}, err)
+		return errors.Wrap(errors.CodeInternalError, err, "获取待移除权限失败")
+	}
+	changes := permissionAuditChanges(permissions, map[string]any{"assigned": true}, map[string]any{"assigned": false})
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	beforeData := map[string]any{"permission_ids": existingPermIDs}
+	afterData := map[string]any{"permission_ids": removePermissionIDs(existingPermIDs, removeSet)}
+	var accountIDs []uint
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRolePermissionStore(tx, nil).BatchDelete(ctx, roleID, permIDs); err != nil {
+			return err
+		}
+		var err error
+		accountIDs, err = rolePermissionCacheAccountIDs(ctx, tx, role.ID)
+		if err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRolePermissionsBatchRemoved, Summary: "批量移除角色权限", Result: constants.AuditResultSuccess,
+			OperatorID: operatorID, Role: role, Permissions: changes, BeforeData: beforeData, AfterData: afterData,
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRolePermissionsBatchRemoved, "批量移除角色权限失败", constants.AuditResultFailed, role, changes, beforeData, err)
 		return errors.Wrap(errors.CodeInternalError, err, "批量删除角色-权限关联失败")
 	}
+	s.clearRolePermissionCaches(ctx, accountIDs)
 
 	return nil
 }
@@ -340,23 +510,37 @@ func (s *Service) UpdateStatus(ctx context.Context, id uint, status int) error {
 	if status == constants.StatusDisabled {
 		accountCount, err := s.accountRoleStore.CountByRoleID(ctx, id)
 		if err != nil {
+			s.recordFailure(ctx, constants.AuditActionRoleStatusUpdated, "更新角色状态失败", constants.AuditResultFailed, role, roleAuditData(role), nil, err)
 			return errors.Wrap(errors.CodeInternalError, err, "检查角色分配情况失败")
 		}
 
 		shopCount, err := s.shopRoleStore.CountByRoleID(ctx, id)
 		if err != nil {
+			s.recordFailure(ctx, constants.AuditActionRoleStatusUpdated, "更新角色状态失败", constants.AuditResultFailed, role, roleAuditData(role), nil, err)
 			return errors.Wrap(errors.CodeInternalError, err, "检查角色分配情况失败")
 		}
 
 		if accountCount > 0 || shopCount > 0 {
-			return errors.New(errors.CodeRoleInUse, fmt.Sprintf("该角色已分配给 %d 个账号、%d 个店铺，请先移除相关分配后再禁用", accountCount, shopCount))
+			appErr := errors.New(errors.CodeRoleInUse, fmt.Sprintf("该角色已分配给 %d 个账号、%d 个店铺，请先移除相关分配后再禁用", accountCount, shopCount))
+			s.recordFailure(ctx, constants.AuditActionRoleStatusUpdated, "拒绝禁用使用中的角色", constants.AuditResultDenied, role, roleAuditData(role), nil, appErr)
+			return appErr
 		}
 	}
 
+	beforeData := roleAuditData(role)
 	role.Status = status
 	role.Updater = currentUserID
 
-	if err := s.roleStore.Update(ctx, role); err != nil {
+	if err := s.runAccessTransaction(ctx, func(tx *gorm.DB) error {
+		if err := postgres.NewRoleStore(tx).Update(ctx, role); err != nil {
+			return err
+		}
+		return s.accessAudit.WriteAccessChange(ctx, tx, accessauditapp.ChangeAudit{
+			ActionCode: constants.AuditActionRoleStatusUpdated, Summary: "更新角色状态", Result: constants.AuditResultSuccess,
+			OperatorID: currentUserID, Role: role, BeforeData: beforeData, AfterData: roleAuditData(role),
+		})
+	}); err != nil {
+		s.recordFailure(ctx, constants.AuditActionRoleStatusUpdated, "更新角色状态失败", constants.AuditResultFailed, role, beforeData, nil, err)
 		return errors.Wrap(errors.CodeInternalError, err, "更新角色状态失败")
 	}
 
@@ -390,3 +574,95 @@ func contains(availableForRoleTypes, roleTypeStr string) bool {
 	}
 	return false
 }
+
+func (s *Service) runAccessTransaction(ctx context.Context, fn func(tx *gorm.DB) error) error {
+	if s.db == nil || s.accessAudit == nil {
+		return errors.New(errors.CodeInvalidStatus, "角色权限审计接缝未配置")
+	}
+	return s.db.WithContext(ctx).Transaction(fn)
+}
+
+func (s *Service) recordFailure(
+	ctx context.Context,
+	actionCode, summary, result string,
+	role *model.Role,
+	permissions []accessauditapp.PermissionChange,
+	beforeData map[string]any,
+	originalErr error,
+) {
+	accessauditapp.RecordFailure(ctx, s.db, s.accessAudit, accessauditapp.ChangeAudit{
+		ActionCode: actionCode, Summary: summary, Result: result,
+		OperatorID: middleware.GetUserIDFromContext(ctx), Role: role, Permissions: permissions,
+		BeforeData: beforeData,
+	}, originalErr)
+}
+
+func roleAuditData(role *model.Role) map[string]any {
+	if role == nil {
+		return nil
+	}
+	return map[string]any{
+		"role_name": role.RoleName, "role_desc": role.RoleDesc, "role_type": role.RoleType, "status": role.Status,
+		"default_credit_enabled": role.DefaultCreditEnabled, "default_credit_limit": role.DefaultCreditLimit,
+	}
+}
+
+func permissionAuditChanges(permissions []*model.Permission, beforeData, afterData map[string]any) []accessauditapp.PermissionChange {
+	changes := make([]accessauditapp.PermissionChange, 0, len(permissions))
+	for _, permission := range permissions {
+		if permission == nil {
+			continue
+		}
+		changes = append(changes, accessauditapp.PermissionChange{
+			Permission: permission, BeforeData: beforeData, AfterData: afterData,
+		})
+	}
+	return changes
+}
+
+func appendPermissionIDs(existing []uint, additions []*model.RolePermission) []uint {
+	result := append([]uint(nil), existing...)
+	for _, addition := range additions {
+		result = append(result, addition.PermID)
+	}
+	return result
+}
+
+func removePermissionIDs(existing []uint, removeSet map[uint]struct{}) []uint {
+	result := make([]uint, 0, len(existing))
+	for _, permissionID := range existing {
+		if _, removed := removeSet[permissionID]; !removed {
+			result = append(result, permissionID)
+		}
+	}
+	return result
+}
+
+func containsUint(values []uint, target uint) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
+func rolePermissionCacheAccountIDs(ctx context.Context, tx *gorm.DB, roleID uint) ([]uint, error) {
+	var accountIDs []uint
+	if err := tx.WithContext(ctx).Model(&model.AccountRole{}).
+		Where("role_id = ?", roleID).Distinct().Pluck("account_id", &accountIDs).Error; err != nil {
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询角色关联账号失败")
+	}
+	return accountIDs, nil
+}
+
+func (s *Service) clearRolePermissionCaches(ctx context.Context, accountIDs []uint) {
+	if len(accountIDs) == 0 || s.redisClient == nil {
+		return
+	}
+	pipe := s.redisClient.Pipeline()
+	for _, accountID := range accountIDs {
+		pipe.Del(ctx, constants.RedisUserPermissionsKey(accountID))
+	}
+	_, _ = pipe.Exec(ctx)
+}