全局审计完成

2026-08-07 11:02:52 +08:00
parent 88cc5e96ec
commit c64f3d8b80
94 changed files with 8641 additions and 6714 deletions
--- a/internal/infrastructure/audit/batch.go
+++ b/internal/infrastructure/audit/batch.go
@@ -19,6 +19,11 @@ func (w *Writer) AppendBatch(ctx context.Context, tx *gorm.DB, input BatchInput)
 	if input.Root.EventID == "" {
 		return pkgerrors.New(pkgerrors.CodeInvalidParam, "批次根事件缺少稳定事件ID")
 	}
+	if input.Root.BatchTotal < 0 || input.Root.SuccessCount < 0 || input.Root.FailCount < 0 ||
+		input.Root.SuccessCount+input.Root.FailCount > input.Root.BatchTotal ||
+		len(input.Children) < input.Root.SuccessCount || len(input.Children) > input.Root.SuccessCount+input.Root.FailCount {
+		return pkgerrors.New(pkgerrors.CodeInvalidParam, "批次根子事件计数不一致")
+	}
 	if err := w.Append(ctx, tx, input.Root); err != nil {
 		return err
 	}
--- a/internal/infrastructure/audit/registry.go
+++ b/internal/infrastructure/audit/registry.go
@@ -84,6 +84,10 @@ func NewRegistry() *Registry {
 	iotCardCreated := iotCardAction(constants.AuditActionIotCardCreated, "创建 IoT 卡", constants.AuditActorSystemTask, constants.AuditSourceWorker)
 	iotCardDeleted := iotCardAction(constants.AuditActionIotCardDeleted, "删除 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
 	iotCardDeleted.Risk = constants.AuditRiskHigh
+	iotCardDeactivated := iotCardAction(constants.AuditActionIotCardDeactivated, "停用 IoT 卡资产", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	iotCardDeactivated.Risk = constants.AuditRiskHigh
+	iotCardPollingStatusUpdated := iotCardAction(constants.AuditActionIotCardPollingStatusUpdated, "更新 IoT 卡轮询开关", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	iotCardPollingStatusBatchUpdated := iotCardBatchAction(constants.AuditActionIotCardPollingStatusBatchUpdated, "批量更新 IoT 卡轮询开关")
 	iotCardBatchDeleted := ActionDefinition{
 		Code: constants.AuditActionIotCardBatchDeleted, Name: "批量删除 IoT 卡",
 		Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskHigh,
@@ -117,6 +121,9 @@ func NewRegistry() *Registry {
 	deviceCreated := deviceAction(constants.AuditActionDeviceCreated, "导入创建设备", constants.AuditActorSystemTask, constants.AuditSourceWorker)
 	deviceDeleted := deviceAction(constants.AuditActionDeviceDeleted, "删除设备", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
 	deviceDeleted.Risk = constants.AuditRiskHigh
+	deviceDeactivated := deviceAction(constants.AuditActionDeviceDeactivated, "停用设备资产", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
+	deviceDeactivated.Risk = constants.AuditRiskHigh
+	devicePollingStatusUpdated := deviceAction(constants.AuditActionDevicePollingStatusUpdated, "更新设备轮询开关", constants.AuditActorAccount, constants.AuditSourceAdminAPI)
 	deviceAllocationBatch := deviceMultiOriginBatchAction(constants.AuditActionDeviceAllocationBatch, "批量分配设备")
 	deviceAllocated := deviceMultiOriginAction(constants.AuditActionDeviceAllocated, "分配设备")
 	deviceRecallBatch := deviceMultiOriginBatchAction(constants.AuditActionDeviceRecallBatch, "批量回收设备")
@@ -180,17 +187,6 @@ func NewRegistry() *Registry {
 		constants.AuditActionOutboxExpiredLeaseReleased,
 		"人工释放 Outbox 过期租约",
 	)
-	deviceBatchCompleted := deviceBatchAction(
-		constants.AuditActionDeviceBatchAllocationCompleted,
-		"完成设备批量分配",
-		constants.AuditResourceDeviceBatchTask,
-	)
-	deviceBatchItem := deviceBatchAction(
-		constants.AuditActionDeviceBatchAllocationItem,
-		"处理设备批量分配项",
-		constants.AuditResourceDevice,
-	)
-	deviceBatchItem.AllowedVisibility = []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}
 	iotCardImportTaskCreated := taskAction(constants.AuditActionIotCardImportTaskCreated, "创建 IoT 卡导入任务", constants.AuditResourceIotCardImportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
 	iotCardImportTaskCompleted := taskAction(constants.AuditActionIotCardImportTaskCompleted, "完成 IoT 卡导入任务", constants.AuditResourceIotCardImportTask, constants.AuditActorSystemTask, constants.AuditSourceWorker)
 	deviceImportTaskCreated := taskAction(constants.AuditActionDeviceImportTaskCreated, "创建设备导入任务", constants.AuditResourceDeviceImportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI)
@@ -274,6 +270,8 @@ func NewRegistry() *Registry {
 	packageUsageTrafficReset := packageUsageAction(constants.AuditActionPackageUsageTrafficReset, "重置套餐权益流量")
 	packageUsageRefundInvalidated := packageUsageAction(constants.AuditActionPackageUsageRefundInvalidated, "退款失效套餐权益")
 	packageUsageAssetInvalidated := packageUsageAction(constants.AuditActionPackageUsageAssetInvalidated, "资产失效套餐权益")
+	packageUsageExpiresAtUpdated := packageUsageAction(constants.AuditActionPackageUsageExpiresAtUpdated, "调整套餐权益过期时间")
+	packageUsageTrafficAdjusted := packageUsageAction(constants.AuditActionPackageUsageTrafficAdjusted, "调整套餐权益已用量")
 	orderCreated := orderAction(constants.AuditActionOrderCreated, "创建订单")
 	orderCancelled := orderAction(constants.AuditActionOrderCancelled, "取消订单")
 	orderWalletPaid := orderAction(constants.AuditActionOrderWalletPaid, "钱包支付订单")
@@ -405,6 +403,9 @@ func NewRegistry() *Registry {
 			constants.AuditActionPersonalCustomerAssetBindingMigrated:  personalAssetBindingMigrated,
 			constants.AuditActionIotCardCreated:                        iotCardCreated,
 			constants.AuditActionIotCardDeleted:                        iotCardDeleted,
+			constants.AuditActionIotCardDeactivated:                    iotCardDeactivated,
+			constants.AuditActionIotCardPollingStatusUpdated:           iotCardPollingStatusUpdated,
+			constants.AuditActionIotCardPollingStatusBatchUpdated:      iotCardPollingStatusBatchUpdated,
 			constants.AuditActionIotCardBatchDeleted:                   iotCardBatchDeleted,
 			constants.AuditActionIotCardAllocationBatch:                iotCardAllocationBatch,
 			constants.AuditActionIotCardAllocated:                      iotCardAllocated,
@@ -430,6 +431,8 @@ func NewRegistry() *Registry {
 			constants.AuditActionIotCardAutoStopReasonUpdated:          iotCardAutoStopReasonUpdated,
 			constants.AuditActionDeviceCreated:                         deviceCreated,
 			constants.AuditActionDeviceDeleted:                         deviceDeleted,
+			constants.AuditActionDeviceDeactivated:                     deviceDeactivated,
+			constants.AuditActionDevicePollingStatusUpdated:            devicePollingStatusUpdated,
 			constants.AuditActionDeviceAllocationBatch:                 deviceAllocationBatch,
 			constants.AuditActionDeviceAllocated:                       deviceAllocated,
 			constants.AuditActionDeviceRecallBatch:                     deviceRecallBatch,
@@ -476,8 +479,6 @@ func NewRegistry() *Registry {
 			constants.AuditActionWeComApprovalSceneSaved:               wecomApprovalSceneSaved,
 			constants.AuditActionOutboxReplayed:                        outboxReplayed,
 			constants.AuditActionOutboxExpiredLeaseReleased:            outboxExpiredLeaseReleased,
-			constants.AuditActionDeviceBatchAllocationCompleted:        deviceBatchCompleted,
-			constants.AuditActionDeviceBatchAllocationItem:             deviceBatchItem,
 			constants.AuditActionIotCardImportTaskCreated:              iotCardImportTaskCreated,
 			constants.AuditActionIotCardImportTaskCompleted:            iotCardImportTaskCompleted,
 			constants.AuditActionDeviceImportTaskCreated:               deviceImportTaskCreated,
@@ -546,6 +547,8 @@ func NewRegistry() *Registry {
 			constants.AuditActionPackageUsageTrafficReset:              packageUsageTrafficReset,
 			constants.AuditActionPackageUsageRefundInvalidated:         packageUsageRefundInvalidated,
 			constants.AuditActionPackageUsageAssetInvalidated:          packageUsageAssetInvalidated,
+			constants.AuditActionPackageUsageExpiresAtUpdated:          packageUsageExpiresAtUpdated,
+			constants.AuditActionPackageUsageTrafficAdjusted:           packageUsageTrafficAdjusted,
 			constants.AuditActionOrderCreated:                          orderCreated,
 			constants.AuditActionOrderCancelled:                        orderCancelled,
 			constants.AuditActionOrderWalletPaid:                       orderWalletPaid,
--- a/internal/infrastructure/audit/writer.go
+++ b/internal/infrastructure/audit/writer.go
@@ -900,14 +900,14 @@ func (w *Writer) Append(ctx context.Context, tx *gorm.DB, input AppendInput) err
 	}
 	event := model.AuditEvent{
 		OccurredAt: occurredAt, Category: action.Category, ActionCode: action.Code, ActionName: action.Name,
-		Summary: input.Summary, ActorKind: input.Actor.Kind, ActorID: input.Actor.ID, ActorName: input.Actor.Name,
-		ActorShopID: input.Actor.ShopID, ActorShopName: input.Actor.ShopName,
-		ActorEnterpriseID: input.Actor.EnterpriseID, ActorEnterpriseName: input.Actor.EnterpriseName,
-		Source: input.Source, RequestPath: input.RequestPath, RequestMethod: input.RequestMethod,
-		IPAddress: input.IPAddress, UserAgent: input.UserAgent,
-		ScopeType: input.ScopeType, ScopeID: input.ScopeID, ScopeName: input.ScopeName,
+		Summary: sanitizer.SanitizeText(input.Summary), ActorKind: input.Actor.Kind, ActorID: input.Actor.ID, ActorName: sanitizer.SanitizeText(input.Actor.Name),
+		ActorShopID: input.Actor.ShopID, ActorShopName: sanitizer.SanitizeText(input.Actor.ShopName),
+		ActorEnterpriseID: input.Actor.EnterpriseID, ActorEnterpriseName: sanitizer.SanitizeText(input.Actor.EnterpriseName),
+		Source: input.Source, RequestPath: sanitizer.SanitizeText(input.RequestPath), RequestMethod: input.RequestMethod,
+		IPAddress: input.IPAddress, UserAgent: sanitizer.SanitizeText(input.UserAgent),
+		ScopeType: input.ScopeType, ScopeID: input.ScopeID, ScopeName: sanitizer.SanitizeText(input.ScopeName),
 		Result: input.Result, RiskLevel: action.Risk, RequestID: input.RequestID,
-		ErrorCode: input.ErrorCode, ErrorSummary: input.ErrorSummary,
+		ErrorCode: input.ErrorCode, ErrorSummary: sanitizer.SanitizeText(input.ErrorSummary),
 		CorrelationID: input.CorrelationID, ParentEventID: input.ParentEventID, Metadata: metadata,
 		BatchTotal: input.BatchTotal, SuccessCount: input.SuccessCount, FailCount: input.FailCount,
 	}
@@ -1036,10 +1036,10 @@ func (w *Writer) buildResources(inputs []ResourceInput, action ActionDefinition)
 			return nil, err
 		}
 		resources = append(resources, model.AuditEventResource{
-			ResourceType: input.Type, ResourceID: input.ID, ResourceKey: input.Key, DisplayName: input.DisplayName,
+			ResourceType: input.Type, ResourceID: input.ID, ResourceKey: sanitizer.SanitizeText(input.Key), DisplayName: sanitizer.SanitizeText(input.DisplayName),
 			Relation: input.Relation, Role: input.Role, IdentitySnapshot: identity,
 			BeforeData: before, AfterData: after, SubjectVisibility: visibility,
-			SubjectSummary: input.SubjectSummary, SubjectData: subjectData, SortOrder: input.SortOrder,
+			SubjectSummary: sanitizer.SanitizeText(input.SubjectSummary), SubjectData: subjectData, SortOrder: input.SortOrder,
 		})
 	}
 	if primaryCount != 1 {