// Package audit 实现统一 Audit Event 的注册表与持久化 Adapter。 package audit import "github.com/break/junhong_cmp_fiber/pkg/constants" // ActionDefinition 是受控审计动作的写入契约。 type ActionDefinition struct { Code string Name string Category string Risk string PrimaryResource string AllowedActor string Source string RequireTransaction bool DefaultVisibility string AllowedVisibility []string SubjectFields []string SensitiveRead bool AllowedOrigins []ActionOrigin } // ActionOrigin 定义动作允许的操作者与入口组合。 type ActionOrigin struct { Actor string Source string } // ResourceDefinition 是受控审计资源的快照契约。 type ResourceDefinition struct { Type string Name string IdentityFields []string } // Registry 保存首批已评审的动作与资源定义。 type Registry struct { actionsByOperation map[string]ActionDefinition actionsByCode map[string]ActionDefinition resources map[string]ResourceDefinition } // NewRegistry 创建首批统一审计注册表。 func NewRegistry() *Registry { accountCreated := accountLifecycleAction(constants.AuditActionAccountCreated, "创建账号", constants.AuditRiskNormal) accountUpdated := accountLifecycleAction(constants.AuditActionAccountUpdated, "更新账号", constants.AuditRiskNormal) accountDeleted := accountLifecycleAction(constants.AuditActionAccountDeleted, "删除账号", constants.AuditRiskHigh) accountPasswordReset := accountSecurityAction(constants.AuditActionAccountPasswordReset, "重置账号密码", constants.AuditRiskHigh) accountPasswordChanged := accountSecurityAction(constants.AuditActionAccountPasswordChanged, "修改账号密码", constants.AuditRiskHigh) accountWeComBound := accountSecurityAction(constants.AuditActionAccountWeComBound, "绑定账号企业微信身份", constants.AuditRiskNormal) authLogin := accountSecurityAction(constants.AuditActionAuthLogin, "后台账号登录", constants.AuditRiskNormal) authLogout := accountSecurityAction(constants.AuditActionAuthLogout, "后台账号退出登录", constants.AuditRiskNormal) authTokenRefreshed := accountSecurityAction(constants.AuditActionAuthTokenRefreshed, "刷新后台访问令牌", constants.AuditRiskNormal) accountRolesAssigned := accessAction(constants.AuditActionAccountRolesAssigned, "分配账号角色", constants.AuditResourceAccount) accountRoleRemoved := accessAction(constants.AuditActionAccountRoleRemoved, "移除账号角色", constants.AuditResourceAccount) shopRolesAssigned := accessAction(constants.AuditActionShopRolesAssigned, "分配店铺角色", constants.AuditResourceShop) shopRoleDeleted := accessAction(constants.AuditActionShopRoleDeleted, "移除店铺角色", constants.AuditResourceShop) shopRolesAssigned.Category = constants.AuditCategoryBusiness shopRoleDeleted.Category = constants.AuditCategoryBusiness shopCreated := shopIdentityAction(constants.AuditActionShopCreated, "创建店铺") shopUpdated := shopIdentityAction(constants.AuditActionShopUpdated, "更新店铺基础资料") shopEnabled := shopStateAction(constants.AuditActionShopEnabled, "启用店铺", constants.AuditRiskNormal) shopDisabled := shopStateAction(constants.AuditActionShopDisabled, "禁用店铺", constants.AuditRiskNormal) shopDeleted := shopStateAction(constants.AuditActionShopDeleted, "删除店铺", constants.AuditRiskHigh) shopBusinessOwnerUpdated := shopStateAction(constants.AuditActionShopBusinessOwnerUpdated, "更新店铺业务员归属", constants.AuditRiskNormal) shopClientLoginLimitUpdated := shopStateAction(constants.AuditActionShopClientLoginLimitUpdated, "更新店铺 C 端登录限制", constants.AuditRiskHigh) enterpriseCreated := enterpriseAction(constants.AuditActionEnterpriseCreated, "创建企业", constants.AuditCategoryBusiness, constants.AuditRiskNormal) enterpriseUpdated := enterpriseAction(constants.AuditActionEnterpriseUpdated, "更新企业基础资料", constants.AuditCategoryBusiness, constants.AuditRiskNormal) enterpriseStatusUpdated := enterpriseAction(constants.AuditActionEnterpriseStatusUpdated, "更新企业状态", constants.AuditCategoryBusiness, constants.AuditRiskNormal) enterprisePasswordUpdated := enterpriseAction(constants.AuditActionEnterprisePasswordUpdated, "更新企业账号密码", constants.AuditCategoryBusiness, constants.AuditRiskHigh) enterpriseCardsAllocated := enterpriseCardAction(constants.AuditActionEnterpriseCardsAllocated, "向企业授权卡") enterpriseCardsRecalled := enterpriseCardAction(constants.AuditActionEnterpriseCardsRecalled, "回收企业卡授权") enterpriseCardRemarkUpdated := enterpriseCardAction(constants.AuditActionEnterpriseCardRemarkUpdated, "更新企业卡授权备注") enterpriseDevicesAllocated := enterpriseCardAction(constants.AuditActionEnterpriseDevicesAllocated, "向企业授权设备") enterpriseDevicesRecalled := enterpriseCardAction(constants.AuditActionEnterpriseDevicesRecalled, "回收企业设备授权") personalProfileUpdated := personalAction(constants.AuditActionPersonalCustomerProfileUpdated, "更新个人资料", []string{"nickname", "avatar_url"}) personalPhoneBound := personalAction(constants.AuditActionPersonalCustomerPhoneBound, "绑定个人手机号", []string{"phone"}) personalPhoneChanged := personalAction(constants.AuditActionPersonalCustomerPhoneChanged, "更换个人手机号", []string{"phone"}) personalWechatIdentityUpdated := personalAction(constants.AuditActionPersonalCustomerWechatIdentityUpdated, "同步个人微信主体", []string{"app_id", "app_type"}) personalAssetBound := personalAction(constants.AuditActionPersonalCustomerAssetBound, "绑定个人客户资产", []string{"asset_type", "asset_id"}) personalAssetBound.Category = constants.AuditCategoryAsset personalAssetUnbound := customerAssetAdminAction(constants.AuditActionPersonalCustomerAssetUnbound, "解除个人客户资产绑定") personalAssetBindingMigrated := customerAssetAdminAction(constants.AuditActionPersonalCustomerAssetBindingMigrated, "迁移个人客户资产绑定") iotCardCreated := iotCardAction(constants.AuditActionIotCardCreated, "创建 IoT 卡", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardDeleted := iotCardAction(constants.AuditActionIotCardDeleted, "删除 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardDeleted.Risk = constants.AuditRiskHigh iotCardDeactivated := iotCardAction(constants.AuditActionIotCardDeactivated, "停用 IoT 卡资产", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardDeactivated.Risk = constants.AuditRiskHigh iotCardPollingStatusUpdated := iotCardAction(constants.AuditActionIotCardPollingStatusUpdated, "更新 IoT 卡轮询开关", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardPollingStatusBatchUpdated := iotCardBatchAction(constants.AuditActionIotCardPollingStatusBatchUpdated, "批量更新 IoT 卡轮询开关") iotCardBatchDeleted := ActionDefinition{ Code: constants.AuditActionIotCardBatchDeleted, Name: "批量删除 IoT 卡", Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceIotCardBatch, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } iotCardAllocationBatch := iotCardBatchAction(constants.AuditActionIotCardAllocationBatch, "批量分配 IoT 卡") iotCardAllocated := iotCardAction(constants.AuditActionIotCardAllocated, "分配 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardRecallBatch := iotCardBatchAction(constants.AuditActionIotCardRecallBatch, "批量回收 IoT 卡") iotCardRecalled := iotCardAction(constants.AuditActionIotCardRecalled, "回收 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardSeriesBindingBatch := iotCardBatchAction(constants.AuditActionIotCardSeriesBindingBatch, "批量设置 IoT 卡系列绑定") iotCardSeriesBound := iotCardAction(constants.AuditActionIotCardSeriesBound, "设置 IoT 卡系列绑定", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardSpeedTierSet := iotCardAction(constants.AuditActionIotCardSpeedTierSet, "设置 IoT 卡固定限速档位", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardRealnamePolicyBatchUpdated := iotCardBatchAction(constants.AuditActionIotCardRealnamePolicyBatchUpdated, "批量更新 IoT 卡实名策略") iotCardRealnamePolicyUpdated := iotCardAction(constants.AuditActionIotCardRealnamePolicyUpdated, "更新 IoT 卡实名策略", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardRealnameStatusUpdated := iotCardAction(constants.AuditActionIotCardRealnameStatusUpdated, "人工更新 IoT 卡实名状态", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardRealnameCallbackSynced := iotCardAction(constants.AuditActionIotCardRealnameCallbackSynced, "运营商回调同步 IoT 卡实名状态", constants.AuditActorExternalSystem, constants.AuditSourceCallback) iotCardManualRefreshed := iotCardAction(constants.AuditActionIotCardManualRefreshed, "人工刷新 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardPersonalRefreshed := iotCardAction(constants.AuditActionIotCardPersonalRefreshed, "个人客户刷新 IoT 卡", constants.AuditActorPersonalCustomer, constants.AuditSourcePersonalAPI) iotCardWorkerRealnameSynced := iotCardAction(constants.AuditActionIotCardWorkerRealnameSynced, "Worker 同步 IoT 卡实名事实", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardWorkerTrafficSynced := iotCardAction(constants.AuditActionIotCardWorkerTrafficSynced, "Worker 同步 IoT 卡流量事实", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardWorkerNetworkSynced := iotCardAction(constants.AuditActionIotCardWorkerNetworkSynced, "Worker 同步 IoT 卡网络事实", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardManualStopped := iotCardAction(constants.AuditActionIotCardManualStopped, "人工停用 IoT 卡网络", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardManualStarted := iotCardAction(constants.AuditActionIotCardManualStarted, "人工恢复 IoT 卡网络", constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardAutoStopped := iotCardAction(constants.AuditActionIotCardAutoStopped, "自动停用 IoT 卡网络", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardAutoStarted := iotCardAction(constants.AuditActionIotCardAutoStarted, "自动恢复 IoT 卡网络", constants.AuditActorSystemTask, constants.AuditSourceWorker) iotCardOpenAPIStarted := iotCardAction(constants.AuditActionIotCardOpenAPIStarted, "OpenAPI 恢复 IoT 卡网络", constants.AuditActorOpenAPI, constants.AuditSourceOpenAPI) iotCardAutoStopReasonUpdated := iotCardAction(constants.AuditActionIotCardAutoStopReasonUpdated, "自动更新 IoT 卡停机原因", constants.AuditActorSystemTask, constants.AuditSourceWorker) deviceCreated := deviceAction(constants.AuditActionDeviceCreated, "导入创建设备", constants.AuditActorSystemTask, constants.AuditSourceWorker) deviceDeleted := deviceAction(constants.AuditActionDeviceDeleted, "删除设备", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceDeleted.Risk = constants.AuditRiskHigh deviceDeactivated := deviceAction(constants.AuditActionDeviceDeactivated, "停用设备资产", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceDeactivated.Risk = constants.AuditRiskHigh devicePollingStatusUpdated := deviceAction(constants.AuditActionDevicePollingStatusUpdated, "更新设备轮询开关", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceAllocationBatch := deviceMultiOriginBatchAction(constants.AuditActionDeviceAllocationBatch, "批量分配设备") deviceAllocated := deviceMultiOriginAction(constants.AuditActionDeviceAllocated, "分配设备") deviceRecallBatch := deviceMultiOriginBatchAction(constants.AuditActionDeviceRecallBatch, "批量回收设备") deviceRecalled := deviceMultiOriginAction(constants.AuditActionDeviceRecalled, "回收设备") deviceSeriesBindingBatch := deviceMultiOriginBatchAction(constants.AuditActionDeviceSeriesBindingBatch, "批量设置设备系列绑定") deviceSeriesBound := deviceMultiOriginAction(constants.AuditActionDeviceSeriesBound, "设置设备系列绑定") deviceRealnamePolicyBatchUpdated := deviceAccountBatchAction(constants.AuditActionDeviceRealnamePolicyBatchUpdated, "批量更新设备实名策略") deviceRealnamePolicyUpdated := deviceAction(constants.AuditActionDeviceRealnamePolicyUpdated, "更新设备实名策略", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceStopped := deviceAction(constants.AuditActionDeviceStopped, "停用设备绑定卡网络", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceStarted := deviceAction(constants.AuditActionDeviceStarted, "恢复设备绑定卡网络", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceWiFiSet := deviceExternalAction(constants.AuditActionDeviceWiFiSet, "设置设备 Wi-Fi", false) deviceSwitchModeSet := deviceAction(constants.AuditActionDeviceSwitchModeSet, "设置设备切卡模式", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceRebooted := deviceExternalAction(constants.AuditActionDeviceRebooted, "重启设备", true) deviceReset := deviceExternalAction(constants.AuditActionDeviceReset, "恢复设备出厂设置", true) deviceCardBound := deviceAction(constants.AuditActionDeviceCardBound, "设备绑定 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceCardUnbound := deviceAction(constants.AuditActionDeviceCardUnbound, "设备解绑 IoT 卡", constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceCurrentCardSwitched := deviceExternalAction(constants.AuditActionDeviceCurrentCardSwitched, "切换设备当前卡", true) deviceWorkerObservationSynced := deviceAction(constants.AuditActionDeviceWorkerObservationSynced, "Worker 同步设备观测事实", constants.AuditActorSystemTask, constants.AuditSourceWorker) cardExchangeCreated := cardExchangeAction(constants.AuditActionCardExchangeCreated, "创建卡换货单", constants.AuditRiskNormal, false) cardExchangeShippingInfoSubmitted := cardExchangeAction(constants.AuditActionCardExchangeShippingInfoSubmitted, "提交卡换货收货信息", constants.AuditRiskHigh, true) cardExchangeShipped := cardExchangeAction(constants.AuditActionCardExchangeShipped, "卡换货发货", constants.AuditRiskNormal, false) cardExchangeCompleted := cardExchangeAction(constants.AuditActionCardExchangeCompleted, "完成卡换货", constants.AuditRiskHigh, false) cardExchangeCancelled := cardExchangeAction(constants.AuditActionCardExchangeCancelled, "取消卡换货", constants.AuditRiskNormal, false) cardExchangeRenewed := cardExchangeAction(constants.AuditActionCardExchangeRenewed, "换出旧卡转新", constants.AuditRiskHigh, false) cardExchangeRenewed.DefaultVisibility = constants.AuditSubjectInternalOnly cardExchangeRenewed.AllowedVisibility = []string{constants.AuditSubjectInternalOnly} deviceExchangeCreated := cardExchangeAction(constants.AuditActionDeviceExchangeCreated, "创建设备换货单", constants.AuditRiskNormal, false) deviceExchangeShippingInfoSubmitted := cardExchangeAction(constants.AuditActionDeviceExchangeShippingInfoSubmitted, "提交设备换货收货信息", constants.AuditRiskHigh, true) deviceExchangeShipped := cardExchangeAction(constants.AuditActionDeviceExchangeShipped, "设备换货发货", constants.AuditRiskNormal, false) deviceExchangeCompleted := cardExchangeAction(constants.AuditActionDeviceExchangeCompleted, "完成设备换货", constants.AuditRiskHigh, false) deviceExchangeCancelled := cardExchangeAction(constants.AuditActionDeviceExchangeCancelled, "取消设备换货", constants.AuditRiskNormal, false) deviceExchangeRenewed := cardExchangeAction(constants.AuditActionDeviceExchangeRenewed, "换出旧设备转新", constants.AuditRiskHigh, false) deviceExchangeRenewed.DefaultVisibility = constants.AuditSubjectInternalOnly deviceExchangeRenewed.AllowedVisibility = []string{constants.AuditSubjectInternalOnly} systemConfigUpdated := ActionDefinition{ Code: constants.AuditActionSystemConfigUpdated, Name: "更新受控系统配置", Category: constants.AuditCategoryConfiguration, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceSystemConfig, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } paymentConfigCreated := connectionConfigAction(constants.AuditActionPaymentConfigCreated, "创建支付连接配置", constants.AuditResourcePaymentConfig, constants.AuditRiskHigh) paymentConfigUpdated := connectionConfigAction(constants.AuditActionPaymentConfigUpdated, "更新支付连接配置", constants.AuditResourcePaymentConfig, constants.AuditRiskHigh) paymentConfigDeleted := connectionConfigAction(constants.AuditActionPaymentConfigDeleted, "删除支付连接配置", constants.AuditResourcePaymentConfig, constants.AuditRiskHigh) paymentConfigActivated := connectionConfigAction(constants.AuditActionPaymentConfigActivated, "激活支付连接配置", constants.AuditResourcePaymentConfig, constants.AuditRiskHigh) paymentConfigDeactivated := connectionConfigAction(constants.AuditActionPaymentConfigDeactivated, "停用支付连接配置", constants.AuditResourcePaymentConfig, constants.AuditRiskHigh) carrierCreated := connectionConfigAction(constants.AuditActionCarrierCreated, "创建运营商配置", constants.AuditResourceCarrier, constants.AuditRiskNormal) carrierUpdated := connectionConfigAction(constants.AuditActionCarrierUpdated, "更新运营商配置", constants.AuditResourceCarrier, constants.AuditRiskNormal) carrierDeleted := connectionConfigAction(constants.AuditActionCarrierDeleted, "删除运营商配置", constants.AuditResourceCarrier, constants.AuditRiskHigh) carrierStatusUpdated := connectionConfigAction(constants.AuditActionCarrierStatusUpdated, "更新运营商配置状态", constants.AuditResourceCarrier, constants.AuditRiskHigh) wecomApplicationSaved := connectionConfigAction(constants.AuditActionWeComApplicationSaved, "保存企业微信应用配置", constants.AuditResourceWeComApplication, constants.AuditRiskHigh) wecomDefaultCreatorSaved := connectionConfigAction(constants.AuditActionWeComDefaultCreatorSaved, "保存企业微信默认审批发起人", constants.AuditResourceWeComApplication, constants.AuditRiskHigh) wecomMembersSynced := connectionConfigAction(constants.AuditActionWeComMembersSynced, "同步企业微信应用可见成员", constants.AuditResourceWeComApplication, constants.AuditRiskNormal) wecomApprovalSceneSaved := connectionConfigAction(constants.AuditActionWeComApprovalSceneSaved, "保存企业微信审批场景配置", constants.AuditResourceWeComApprovalScene, constants.AuditRiskHigh) employeeCollectionPaymentMethodCreated := connectionConfigAction(constants.AuditActionEmployeeCollectionPaymentMethodCreated, "创建线下收款方式", constants.AuditResourceEmployeeCollectionPaymentMethod, constants.AuditRiskNormal) employeeCollectionPaymentMethodUpdated := connectionConfigAction(constants.AuditActionEmployeeCollectionPaymentMethodUpdated, "更新线下收款方式", constants.AuditResourceEmployeeCollectionPaymentMethod, constants.AuditRiskNormal) employeeCollectionPaymentMethodDeleted := connectionConfigAction(constants.AuditActionEmployeeCollectionPaymentMethodDeleted, "删除线下收款方式", constants.AuditResourceEmployeeCollectionPaymentMethod, constants.AuditRiskHigh) employeeCollectionBillCreated := employeeCollectionAction(constants.AuditActionEmployeeCollectionBillCreated, "创建员工代收款账单", constants.AuditResourceEmployeeCollectionBill) employeeCollectionBillClosed := employeeCollectionAction(constants.AuditActionEmployeeCollectionBillClosed, "关闭员工代收款账单", constants.AuditResourceEmployeeCollectionBill) employeeCollectionApplicationSubmitted := employeeCollectionAction(constants.AuditActionEmployeeCollectionApplicationSubmitted, "提交员工代收款核销申请", constants.AuditResourceEmployeeCollectionApplication) employeeCollectionApplicationApproved := employeeCollectionAction(constants.AuditActionEmployeeCollectionApplicationApproved, "员工代收款核销申请企业微信通过", constants.AuditResourceEmployeeCollectionApplication) employeeCollectionApplicationRejected := employeeCollectionAction(constants.AuditActionEmployeeCollectionApplicationRejected, "员工代收款核销申请企业微信驳回或撤销", constants.AuditResourceEmployeeCollectionApplication) employeeCollectionApplicationRevoked := employeeCollectionAction(constants.AuditActionEmployeeCollectionApplicationRevoked, "员工代收款核销申请通过后撤销", constants.AuditResourceEmployeeCollectionApplication) employeeCollectionBillRefundOffseted := employeeCollectionAction(constants.AuditActionEmployeeCollectionBillRefundOffseted, "来源订单退款冲销员工代收款账单", constants.AuditResourceEmployeeCollectionBill) outboxReplayed := outboxRecoveryAction( constants.AuditActionOutboxReplayed, "人工重放 Outbox 事件", ) outboxExpiredLeaseReleased := outboxRecoveryAction( constants.AuditActionOutboxExpiredLeaseReleased, "人工释放 Outbox 过期租约", ) integrationAttemptStarted := integrationAction(constants.AuditActionIntegrationAttemptStarted, "记录外部交互开始") integrationInboundReceived := integrationAction(constants.AuditActionIntegrationInboundReceived, "记录外部入站回调") iotCardImportTaskCreated := taskAction(constants.AuditActionIotCardImportTaskCreated, "创建 IoT 卡导入任务", constants.AuditResourceIotCardImportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) iotCardImportTaskCompleted := taskAction(constants.AuditActionIotCardImportTaskCompleted, "完成 IoT 卡导入任务", constants.AuditResourceIotCardImportTask, constants.AuditActorSystemTask, constants.AuditSourceWorker) deviceImportTaskCreated := taskAction(constants.AuditActionDeviceImportTaskCreated, "创建设备导入任务", constants.AuditResourceDeviceImportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) deviceImportTaskCompleted := taskAction(constants.AuditActionDeviceImportTaskCompleted, "完成设备导入任务", constants.AuditResourceDeviceImportTask, constants.AuditActorSystemTask, constants.AuditSourceWorker) assetPackageBatchOrderTaskCreated := taskAction(constants.AuditActionAssetPackageBatchOrderTaskCreated, "创建资产套餐批量订购任务", constants.AuditResourceAssetPackageBatchOrderTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) assetPackageBatchOrderTaskCompleted := taskAction(constants.AuditActionAssetPackageBatchOrderTaskCompleted, "完成资产套餐批量订购任务", constants.AuditResourceAssetPackageBatchOrderTask, constants.AuditActorSystemTask, constants.AuditSourceWorker) orderPackageInvalidateTaskCreated := taskAction(constants.AuditActionOrderPackageInvalidateTaskCreated, "创建订单套餐批量失效任务", constants.AuditResourceOrderPackageInvalidateTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) orderPackageInvalidateTaskCompleted := taskAction(constants.AuditActionOrderPackageInvalidateTaskCompleted, "完成订单套餐批量失效任务", constants.AuditResourceOrderPackageInvalidateTask, constants.AuditActorSystemTask, constants.AuditSourceWorker) orderPackageInvalidateItem := taskAction(constants.AuditActionOrderPackageInvalidateItem, "失效订单套餐权益", constants.AuditResourceOrder, constants.AuditActorSystemTask, constants.AuditSourceWorker) exportTaskCreated := taskAction(constants.AuditActionExportTaskCreated, "创建业务导出任务", constants.AuditResourceExportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) exportTaskCancelled := taskAction(constants.AuditActionExportTaskCancelled, "取消业务导出任务", constants.AuditResourceExportTask, constants.AuditActorAccount, constants.AuditSourceAdminAPI) notificationDelivered := notificationAction(constants.AuditActionNotificationDelivered, "生成站内通知", constants.AuditResourceNotification, constants.AuditActorSystemTask, constants.AuditSourceWorker) notificationRead := notificationAction(constants.AuditActionNotificationRead, "标记通知已读", constants.AuditResourceNotification, constants.AuditActorAccount, constants.AuditSourceAdminAPI) notificationRead.AllowedOrigins = []ActionOrigin{{Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}} notificationReadAll := notificationAction(constants.AuditActionNotificationReadAll, "批量标记通知已读", constants.AuditResourceNotificationReadBatch, constants.AuditActorAccount, constants.AuditSourceAdminAPI) notificationReadAll.AllowedOrigins = []ActionOrigin{{Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}} notificationCleanup := notificationAction(constants.AuditActionNotificationCleanup, "清理过期通知", constants.AuditResourceNotificationCleanupBatch, constants.AuditActorSystemTask, constants.AuditSourceWorker) notificationCleanupItem := notificationAction(constants.AuditActionNotificationCleanupItem, "清理单条过期通知", constants.AuditResourceNotification, constants.AuditActorSystemTask, constants.AuditSourceWorker) retentionCleanup := ActionDefinition{ Code: constants.AuditActionLogRetentionCleanup, Name: "清理已归档在线日志", Category: constants.AuditCategoryReliability, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceLogArchiveMonth, AllowedActor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } pollingConfigCreated := pollingAction(constants.AuditActionPollingConfigCreated, "创建轮询配置", constants.AuditResourcePollingConfig, constants.AuditRiskHigh) pollingConfigUpdated := pollingAction(constants.AuditActionPollingConfigUpdated, "更新轮询配置", constants.AuditResourcePollingConfig, constants.AuditRiskHigh) pollingConfigDeleted := pollingAction(constants.AuditActionPollingConfigDeleted, "删除轮询配置", constants.AuditResourcePollingConfig, constants.AuditRiskHigh) pollingConfigStatusUpdated := pollingAction(constants.AuditActionPollingConfigStatusUpdated, "更新轮询配置状态", constants.AuditResourcePollingConfig, constants.AuditRiskHigh) pollingConcurrencyUpdated := pollingAction(constants.AuditActionPollingConcurrencyUpdated, "更新轮询并发配置", constants.AuditResourcePollingConcurrencyConfig, constants.AuditRiskNormal) pollingConcurrencyReset := pollingAction(constants.AuditActionPollingConcurrencyReset, "重置轮询并发计数", constants.AuditResourcePollingConcurrencyConfig, constants.AuditRiskNormal) pollingAlertRuleCreated := pollingAction(constants.AuditActionPollingAlertRuleCreated, "创建轮询告警规则", constants.AuditResourcePollingAlertRule, constants.AuditRiskNormal) pollingAlertRuleUpdated := pollingAction(constants.AuditActionPollingAlertRuleUpdated, "更新轮询告警规则", constants.AuditResourcePollingAlertRule, constants.AuditRiskNormal) pollingAlertRuleDeleted := pollingAction(constants.AuditActionPollingAlertRuleDeleted, "删除轮询告警规则", constants.AuditResourcePollingAlertRule, constants.AuditRiskNormal) pollingManualTriggerSingle := pollingAction(constants.AuditActionPollingManualTriggerSingle, "单卡手动触发", constants.AuditResourcePollingManualTrigger, constants.AuditRiskNormal) pollingManualTriggerBatch := pollingAction(constants.AuditActionPollingManualTriggerBatch, "批量手动触发", constants.AuditResourcePollingManualTrigger, constants.AuditRiskNormal) pollingManualTriggerByCondition := pollingAction(constants.AuditActionPollingManualTriggerByCondition, "条件筛选触发", constants.AuditResourcePollingManualTrigger, constants.AuditRiskNormal) pollingManualCancelled := pollingAction(constants.AuditActionPollingManualCancelled, "取消手动触发任务", constants.AuditResourcePollingManualTrigger, constants.AuditRiskNormal) wecomCredentialsRead := ActionDefinition{ Code: constants.AuditActionWeComCredentialsRead, Name: "读取企业微信应用明文凭据", Category: constants.AuditCategorySecurity, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceWeComApplication, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, SensitiveRead: true, } roleCreated := accessAction(constants.AuditActionRoleCreated, "创建角色", constants.AuditResourceRole) roleUpdated := accessAction(constants.AuditActionRoleUpdated, "更新角色", constants.AuditResourceRole) roleStatusUpdated := accessAction(constants.AuditActionRoleStatusUpdated, "更新角色状态", constants.AuditResourceRole) roleDefaultCreditUpdated := accessAction(constants.AuditActionRoleDefaultCreditUpdated, "更新角色默认信用额度", constants.AuditResourceRole) roleDeleted := accessAction(constants.AuditActionRoleDeleted, "删除角色", constants.AuditResourceRole) rolePermissionsAssigned := accessAction(constants.AuditActionRolePermissionsAssigned, "配置角色权限", constants.AuditResourceRole) rolePermissionRemoved := accessAction(constants.AuditActionRolePermissionRemoved, "移除角色权限", constants.AuditResourceRole) rolePermissionsBatchRemoved := accessAction(constants.AuditActionRolePermissionsBatchRemoved, "批量移除角色权限", constants.AuditResourceRole) permissionCreated := accessAction(constants.AuditActionPermissionCreated, "创建权限", constants.AuditResourcePermission) permissionUpdated := accessAction(constants.AuditActionPermissionUpdated, "更新权限", constants.AuditResourcePermission) permissionDeleted := accessAction(constants.AuditActionPermissionDeleted, "删除权限", constants.AuditResourcePermission) packageSeriesCreated := packageConfigAction(constants.AuditActionPackageSeriesCreated, "创建套餐系列", constants.AuditResourcePackageSeries, constants.AuditRiskNormal) packageSeriesUpdated := packageConfigAction(constants.AuditActionPackageSeriesUpdated, "更新套餐系列", constants.AuditResourcePackageSeries, constants.AuditRiskNormal) packageSeriesDeleted := packageConfigAction(constants.AuditActionPackageSeriesDeleted, "删除套餐系列", constants.AuditResourcePackageSeries, constants.AuditRiskHigh) packageSeriesStatusUpdated := packageConfigAction(constants.AuditActionPackageSeriesStatusUpdated, "更新套餐系列状态", constants.AuditResourcePackageSeries, constants.AuditRiskNormal) packageCreated := packageConfigAction(constants.AuditActionPackageCreated, "创建套餐商品", constants.AuditResourcePackage, constants.AuditRiskNormal) packageUpdated := packageConfigAction(constants.AuditActionPackageUpdated, "更新套餐商品", constants.AuditResourcePackage, constants.AuditRiskNormal) packageDeleted := packageConfigAction(constants.AuditActionPackageDeleted, "删除套餐商品", constants.AuditResourcePackage, constants.AuditRiskHigh) packageStatusUpdated := packageConfigAction(constants.AuditActionPackageStatusUpdated, "更新套餐商品状态", constants.AuditResourcePackage, constants.AuditRiskNormal) packageShelfStatusUpdated := packageConfigAction(constants.AuditActionPackageShelfStatusUpdated, "更新套餐上架状态", constants.AuditResourcePackage, constants.AuditRiskNormal) shopPackageShelfStatusUpdated := packageConfigAction(constants.AuditActionShopPackageShelfStatusUpdated, "更新店铺套餐上架状态", constants.AuditResourceShopPackageAllocation, constants.AuditRiskNormal) packageRetailPriceUpdated := packageConfigAction(constants.AuditActionPackageRetailPriceUpdated, "更新店铺套餐零售价", constants.AuditResourceShopPackageAllocation, constants.AuditRiskNormal) shopSeriesGrantCreated := packageConfigAction(constants.AuditActionShopSeriesGrantCreated, "创建店铺套餐系列授权", constants.AuditResourceShopSeriesAllocation, constants.AuditRiskNormal) shopSeriesGrantUpdated := packageConfigAction(constants.AuditActionShopSeriesGrantUpdated, "更新店铺套餐系列授权", constants.AuditResourceShopSeriesAllocation, constants.AuditRiskNormal) shopSeriesGrantPackagesManaged := packageConfigAction(constants.AuditActionShopSeriesGrantPackagesManaged, "管理店铺系列套餐授权", constants.AuditResourceShopSeriesAllocation, constants.AuditRiskNormal) shopSeriesGrantDeleted := packageConfigAction(constants.AuditActionShopSeriesGrantDeleted, "删除店铺套餐系列授权", constants.AuditResourceShopSeriesAllocation, constants.AuditRiskHigh) shopPackageBatchAllocated := packageConfigAction(constants.AuditActionShopPackageBatchAllocated, "批量分配店铺套餐", constants.AuditResourcePackageConfigBatch, constants.AuditRiskNormal) shopPackageAllocated := packageConfigAction(constants.AuditActionShopPackageAllocated, "分配店铺套餐", constants.AuditResourceShopPackageAllocation, constants.AuditRiskNormal) shopPackageExpiryBaseUpdated := packageConfigAction(constants.AuditActionShopPackageExpiryBaseUpdated, "更新店铺套餐生效条件", constants.AuditResourceShopPackageAllocation, constants.AuditRiskNormal) shopPackageBatchPricingUpdated := packageConfigAction(constants.AuditActionShopPackageBatchPricingUpdated, "批量更新店铺套餐成本价", constants.AuditResourcePackageConfigBatch, constants.AuditRiskNormal) shopPackagePricingItemUpdated := packageConfigAction(constants.AuditActionShopPackagePricingItemUpdated, "更新店铺套餐成本价", constants.AuditResourceShopPackageAllocation, constants.AuditRiskNormal) packageUsageActivated := packageUsageAction(constants.AuditActionPackageUsageActivated, "激活套餐权益") packageUsageExpired := packageUsageAction(constants.AuditActionPackageUsageExpired, "套餐权益到期") packageUsageTrafficDeducted := packageUsageAction(constants.AuditActionPackageUsageTrafficDeducted, "扣减套餐权益流量") packageUsageTrafficReset := packageUsageAction(constants.AuditActionPackageUsageTrafficReset, "重置套餐权益流量") packageUsageRefundInvalidated := packageUsageAction(constants.AuditActionPackageUsageRefundInvalidated, "退款失效套餐权益") packageUsageAssetInvalidated := packageUsageAction(constants.AuditActionPackageUsageAssetInvalidated, "资产失效套餐权益") packageUsageExpiresAtUpdated := packageUsageAction(constants.AuditActionPackageUsageExpiresAtUpdated, "调整套餐权益过期时间") packageUsageTrafficAdjusted := packageUsageAction(constants.AuditActionPackageUsageTrafficAdjusted, "调整套餐权益已用量") orderCreated := orderAction(constants.AuditActionOrderCreated, "创建订单") orderCancelled := orderAction(constants.AuditActionOrderCancelled, "取消订单") orderWalletPaid := orderAction(constants.AuditActionOrderWalletPaid, "钱包支付订单") orderExpiredClosed := orderAction(constants.AuditActionOrderExpiredClosed, "关闭过期订单") orderOnlinePaid := orderAction(constants.AuditActionOrderOnlinePaid, "第三方支付订单") orderOnlinePaid.AllowedOrigins = append(orderOnlinePaid.AllowedOrigins, ActionOrigin{Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}) agentWalletOrderDebited := agentWalletOrderAction(constants.AuditActionAgentWalletOrderDebited, "代理主钱包订单扣款") agentWalletOrderReserved := agentWalletOrderAction(constants.AuditActionAgentWalletOrderReserved, "代理主钱包订单资金预占") agentWalletOrderReleased := agentWalletOrderAction(constants.AuditActionAgentWalletOrderReleased, "释放代理主钱包订单预占") agentWalletOrderCompleted := agentWalletOrderAction(constants.AuditActionAgentWalletOrderCompleted, "完成代理主钱包订单预占扣款") agentWalletBalanceAdjusted := agentWalletAction(constants.AuditActionAgentWalletBalanceAdjusted, "人工调整代理主钱包余额") agentWalletCreditChanged := agentWalletAction(constants.AuditActionAgentWalletCreditChanged, "调整代理主钱包信用额度") paymentCreated := paymentAction(constants.AuditActionPaymentCreated, "创建支付记录", false) paymentConfirmed := paymentAction(constants.AuditActionPaymentConfirmed, "确认支付成功", true) paymentFailed := paymentAction(constants.AuditActionPaymentFailed, "关闭失败支付记录", false) agentRechargeCreated := rechargeAction(constants.AuditActionAgentRechargeCreated, "创建代理充值申请", constants.AuditResourceAgentRecharge) agentRechargeCredited := rechargeAction(constants.AuditActionAgentRechargeCredited, "代理充值资金入账", constants.AuditResourceAgentRecharge) agentRechargeClosed := rechargeAction(constants.AuditActionAgentRechargeClosed, "关闭代理充值申请", constants.AuditResourceAgentRecharge) assetRechargeAutoPurchased := rechargeAction(constants.AuditActionAssetRechargeAutoPurchased, "充值后自动购包", constants.AuditResourceRechargeOrder) refundCreated := refundAction(constants.AuditActionRefundCreated, "提交退款申请", false) refundApproved := refundAction(constants.AuditActionRefundApproved, "通过退款审批", true) refundRejected := refundAction(constants.AuditActionRefundRejected, "拒绝退款审批", true) refundReturned := refundAction(constants.AuditActionRefundReturned, "退回退款申请", false) refundResubmitted := refundAction(constants.AuditActionRefundResubmitted, "重新提交退款申请", false) refundCommissionInvalidated := refundSystemAction(constants.AuditActionRefundCommissionInvalidated, "退款失效佣金") // 回溯明细与「无需回溯」都由退款佣金后处理任务在 Worker 内写入，与既有退款系统动作入口一致。 refundClawbackCommission := refundSystemAction(constants.AuditActionRefundClawbackCommission, "生成退款佣金回溯明细") refundClawbackNotRequired := refundSystemAction(constants.AuditActionRefundClawbackNotRequired, "退款无需回溯佣金") refundAssetProcessed := refundSystemAction(constants.AuditActionRefundAssetProcessed, "完成退款资产后处理") // 退款审批尝试由后台账号提交与重提；终态与异常标记由企业微信审批消费任务写入（复用 refundAction 的 Worker 入口）。 refundAttemptSubmitted := refundAction(constants.AuditActionRefundAttemptSubmitted, "提交退款审批尝试", false) refundAttemptApproved := refundAction(constants.AuditActionRefundAttemptApproved, "通过退款审批尝试", true) refundAttemptClosed := refundAction(constants.AuditActionRefundAttemptClosed, "关闭退款审批尝试", true) refundAnomalyFlagged := refundAction(constants.AuditActionRefundAnomalyFlagged, "标记退款审批异常", true) // 渠道原路退款的调用与恢复都由 Worker 触发，与既有的退款系统动作入口一致。 refundChannelCalled := refundSystemAction(constants.AuditActionRefundChannelCalled, "发起渠道原路退款") refundChannelRecovered := refundSystemAction(constants.AuditActionRefundChannelRecovered, "恢复渠道原路退款结果") approvalRequested := approvalAction(constants.AuditActionApprovalRequested, "提交通用审批申请", []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, }) approvalSubmissionSynced := approvalAction(constants.AuditActionApprovalSubmissionSynced, "同步审批提交结果", []ActionOrigin{ {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }) approvalSubmissionRecovered := approvalAction(constants.AuditActionApprovalSubmissionRecovered, "恢复审批提交结果", []ActionOrigin{ {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, }) approvalDecisionSynced := approvalAction(constants.AuditActionApprovalDecisionSynced, "同步审批权威终态", []ActionOrigin{ {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, }) approvalDecisionSynced.Risk = constants.AuditRiskHigh commissionCalculated := ActionDefinition{ Code: constants.AuditActionCommissionCalculated, Name: "计算订单佣金", Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceOrder, AllowedActor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } commissionCredited := ActionDefinition{ Code: constants.AuditActionCommissionCredited, Name: "佣金入账", Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceCommissionRecord, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, }, } commissionInvalidated := ActionDefinition{ Code: constants.AuditActionCommissionInvalidated, Name: "失效待审佣金", Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceCommissionRecord, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } withdrawalRequested := commissionWithdrawalAction(constants.AuditActionCommissionWithdrawalRequested, "提交佣金提现申请") withdrawalApproved := commissionWithdrawalAction(constants.AuditActionCommissionWithdrawalApproved, "通过佣金提现申请") withdrawalRejected := commissionWithdrawalAction(constants.AuditActionCommissionWithdrawalRejected, "驳回佣金提现申请") // 提现审批尝试的提交由代理后台入口触发（account/admin_api）， // 终态由 Outbox 消费任务触发（system_task/worker），因此必须使用含两类入口的 distributionAction， // 而不是仅允许后台账号入口的 commissionWithdrawalAction。 withdrawalAttemptSubmitted := distributionAction( constants.AuditActionCommissionWithdrawalAttemptSubmitted, "提交佣金提现审批尝试", constants.AuditResourceCommissionWithdrawal) withdrawalAttemptApproved := distributionAction( constants.AuditActionCommissionWithdrawalAttemptApproved, "企业微信通过佣金提现", constants.AuditResourceCommissionWithdrawal) withdrawalAttemptClosed := distributionAction( constants.AuditActionCommissionWithdrawalAttemptClosed, "企业微信驳回或撤销佣金提现", constants.AuditResourceCommissionWithdrawal) withdrawalAnomalyFlagged := distributionAction( constants.AuditActionCommissionWithdrawalAnomalyFlagged, "企微通过后撤销提现异常标记", constants.AuditResourceCommissionWithdrawal) distributionRegistrationApproved := distributionAction( constants.AuditActionAgentDistributionRegistrationApproved, "企业微信通过代理扫码注册", constants.AuditResourceAgentDistributionRegistration) distributionRegistrationRejected := distributionAction( constants.AuditActionAgentDistributionRegistrationRejected, "企业微信驳回代理扫码注册", constants.AuditResourceAgentDistributionRegistration) qualificationSubmitted := distributionAction( constants.AuditActionWithdrawalQualificationSubmitted, "提交提现资料资格", constants.AuditResourceWithdrawalQualification) qualificationApproved := distributionAction( constants.AuditActionWithdrawalQualificationApproved, "提现资料资格企业微信通过", constants.AuditResourceWithdrawalQualification) qualificationRejected := distributionAction( constants.AuditActionWithdrawalQualificationRejected, "提现资料资格企业微信驳回", constants.AuditResourceWithdrawalQualification) qualificationVoided := distributionAction( constants.AuditActionWithdrawalQualificationVoided, "作废提现资料资格", constants.AuditResourceWithdrawalQualification) qualificationInvalidated := distributionAction( constants.AuditActionWithdrawalQualificationInvalidated, "代理停用联动失效提现资料资格", constants.AuditResourceWithdrawalQualification) // 创建前拒绝：没有业务实体可作主要资源，以店铺为主要资源，保证拒绝事实可追溯且主资源唯一。 withdrawalAttemptRejected := distributionAction( constants.AuditActionCommissionWithdrawalAttemptRejected, "提现提交被拒绝", constants.AuditResourceShop) qualificationSubmitRejected := distributionAction( constants.AuditActionWithdrawalQualificationSubmitRejected, "资格提交被拒绝", constants.AuditResourceShop) return &Registry{ actionsByOperation: map[string]ActionDefinition{ constants.AuditOperationSystemConfigUpdate: systemConfigUpdated, constants.AuditOperationPaymentConfigCreate: paymentConfigCreated, constants.AuditOperationPaymentConfigUpdate: paymentConfigUpdated, constants.AuditOperationPaymentConfigDelete: paymentConfigDeleted, constants.AuditOperationPaymentConfigActivate: paymentConfigActivated, constants.AuditOperationPaymentConfigDeactivate: paymentConfigDeactivated, constants.AuditOperationCarrierCreate: carrierCreated, constants.AuditOperationCarrierUpdate: carrierUpdated, constants.AuditOperationCarrierDelete: carrierDeleted, constants.AuditOperationCarrierStatusUpdate: carrierStatusUpdated, constants.AuditOperationWeComApplicationSave: wecomApplicationSaved, constants.AuditOperationWeComDefaultCreatorSave: wecomDefaultCreatorSaved, constants.AuditOperationWeComMembersSync: wecomMembersSynced, constants.AuditOperationWeComApprovalSceneSave: wecomApprovalSceneSaved, constants.AuditOperationEmployeeCollectionPaymentMethodCreate: employeeCollectionPaymentMethodCreated, constants.AuditOperationEmployeeCollectionPaymentMethodUpdate: employeeCollectionPaymentMethodUpdated, constants.AuditOperationEmployeeCollectionPaymentMethodDelete: employeeCollectionPaymentMethodDeleted, constants.AuditOperationOutboxReplay: outboxReplayed, constants.AuditOperationOutboxReleaseExpiredLease: outboxExpiredLeaseReleased, }, actionsByCode: map[string]ActionDefinition{ constants.AuditActionAccountCreated: accountCreated, constants.AuditActionAccountUpdated: accountUpdated, constants.AuditActionAccountDeleted: accountDeleted, constants.AuditActionAccountPasswordReset: accountPasswordReset, constants.AuditActionAccountPasswordChanged: accountPasswordChanged, constants.AuditActionAccountWeComBound: accountWeComBound, constants.AuditActionAuthLogin: authLogin, constants.AuditActionAuthLogout: authLogout, constants.AuditActionAuthTokenRefreshed: authTokenRefreshed, constants.AuditActionAccountRolesAssigned: accountRolesAssigned, constants.AuditActionAccountRoleRemoved: accountRoleRemoved, constants.AuditActionShopRolesAssigned: shopRolesAssigned, constants.AuditActionShopRoleDeleted: shopRoleDeleted, constants.AuditActionShopCreated: shopCreated, constants.AuditActionShopUpdated: shopUpdated, constants.AuditActionShopEnabled: shopEnabled, constants.AuditActionShopDisabled: shopDisabled, constants.AuditActionShopDeleted: shopDeleted, constants.AuditActionShopBusinessOwnerUpdated: shopBusinessOwnerUpdated, constants.AuditActionShopClientLoginLimitUpdated: shopClientLoginLimitUpdated, constants.AuditActionEnterpriseCreated: enterpriseCreated, constants.AuditActionEnterpriseUpdated: enterpriseUpdated, constants.AuditActionEnterpriseStatusUpdated: enterpriseStatusUpdated, constants.AuditActionEnterprisePasswordUpdated: enterprisePasswordUpdated, constants.AuditActionEnterpriseCardsAllocated: enterpriseCardsAllocated, constants.AuditActionEnterpriseCardsRecalled: enterpriseCardsRecalled, constants.AuditActionEnterpriseCardRemarkUpdated: enterpriseCardRemarkUpdated, constants.AuditActionEnterpriseDevicesAllocated: enterpriseDevicesAllocated, constants.AuditActionEnterpriseDevicesRecalled: enterpriseDevicesRecalled, constants.AuditActionPersonalCustomerProfileUpdated: personalProfileUpdated, constants.AuditActionPersonalCustomerPhoneBound: personalPhoneBound, constants.AuditActionPersonalCustomerPhoneChanged: personalPhoneChanged, constants.AuditActionPersonalCustomerWechatIdentityUpdated: personalWechatIdentityUpdated, constants.AuditActionPersonalCustomerAssetBound: personalAssetBound, constants.AuditActionPersonalCustomerAssetUnbound: personalAssetUnbound, constants.AuditActionPersonalCustomerAssetBindingMigrated: personalAssetBindingMigrated, constants.AuditActionIotCardCreated: iotCardCreated, constants.AuditActionIotCardDeleted: iotCardDeleted, constants.AuditActionIotCardDeactivated: iotCardDeactivated, constants.AuditActionIotCardPollingStatusUpdated: iotCardPollingStatusUpdated, constants.AuditActionIotCardPollingStatusBatchUpdated: iotCardPollingStatusBatchUpdated, constants.AuditActionIotCardBatchDeleted: iotCardBatchDeleted, constants.AuditActionIotCardAllocationBatch: iotCardAllocationBatch, constants.AuditActionIotCardAllocated: iotCardAllocated, constants.AuditActionIotCardRecallBatch: iotCardRecallBatch, constants.AuditActionIotCardRecalled: iotCardRecalled, constants.AuditActionIotCardSeriesBindingBatch: iotCardSeriesBindingBatch, constants.AuditActionIotCardSeriesBound: iotCardSeriesBound, constants.AuditActionIotCardSpeedTierSet: iotCardSpeedTierSet, constants.AuditActionIotCardRealnamePolicyBatchUpdated: iotCardRealnamePolicyBatchUpdated, constants.AuditActionIotCardRealnamePolicyUpdated: iotCardRealnamePolicyUpdated, constants.AuditActionIotCardRealnameStatusUpdated: iotCardRealnameStatusUpdated, constants.AuditActionIotCardRealnameCallbackSynced: iotCardRealnameCallbackSynced, constants.AuditActionIotCardManualRefreshed: iotCardManualRefreshed, constants.AuditActionIotCardPersonalRefreshed: iotCardPersonalRefreshed, constants.AuditActionIotCardWorkerRealnameSynced: iotCardWorkerRealnameSynced, constants.AuditActionIotCardWorkerTrafficSynced: iotCardWorkerTrafficSynced, constants.AuditActionIotCardWorkerNetworkSynced: iotCardWorkerNetworkSynced, constants.AuditActionIotCardManualStopped: iotCardManualStopped, constants.AuditActionIotCardManualStarted: iotCardManualStarted, constants.AuditActionIotCardAutoStopped: iotCardAutoStopped, constants.AuditActionIotCardAutoStarted: iotCardAutoStarted, constants.AuditActionIotCardOpenAPIStarted: iotCardOpenAPIStarted, constants.AuditActionIotCardAutoStopReasonUpdated: iotCardAutoStopReasonUpdated, constants.AuditActionDeviceCreated: deviceCreated, constants.AuditActionDeviceDeleted: deviceDeleted, constants.AuditActionDeviceDeactivated: deviceDeactivated, constants.AuditActionDevicePollingStatusUpdated: devicePollingStatusUpdated, constants.AuditActionDeviceAllocationBatch: deviceAllocationBatch, constants.AuditActionDeviceAllocated: deviceAllocated, constants.AuditActionDeviceRecallBatch: deviceRecallBatch, constants.AuditActionDeviceRecalled: deviceRecalled, constants.AuditActionDeviceSeriesBindingBatch: deviceSeriesBindingBatch, constants.AuditActionDeviceSeriesBound: deviceSeriesBound, constants.AuditActionDeviceRealnamePolicyBatchUpdated: deviceRealnamePolicyBatchUpdated, constants.AuditActionDeviceRealnamePolicyUpdated: deviceRealnamePolicyUpdated, constants.AuditActionDeviceStopped: deviceStopped, constants.AuditActionDeviceStarted: deviceStarted, constants.AuditActionDeviceWiFiSet: deviceWiFiSet, constants.AuditActionDeviceSwitchModeSet: deviceSwitchModeSet, constants.AuditActionDeviceRebooted: deviceRebooted, constants.AuditActionDeviceReset: deviceReset, constants.AuditActionDeviceCardBound: deviceCardBound, constants.AuditActionDeviceCardUnbound: deviceCardUnbound, constants.AuditActionDeviceCurrentCardSwitched: deviceCurrentCardSwitched, constants.AuditActionDeviceWorkerObservationSynced: deviceWorkerObservationSynced, constants.AuditActionCardExchangeCreated: cardExchangeCreated, constants.AuditActionCardExchangeShippingInfoSubmitted: cardExchangeShippingInfoSubmitted, constants.AuditActionCardExchangeShipped: cardExchangeShipped, constants.AuditActionCardExchangeCompleted: cardExchangeCompleted, constants.AuditActionCardExchangeCancelled: cardExchangeCancelled, constants.AuditActionCardExchangeRenewed: cardExchangeRenewed, constants.AuditActionDeviceExchangeCreated: deviceExchangeCreated, constants.AuditActionDeviceExchangeShippingInfoSubmitted: deviceExchangeShippingInfoSubmitted, constants.AuditActionDeviceExchangeShipped: deviceExchangeShipped, constants.AuditActionDeviceExchangeCompleted: deviceExchangeCompleted, constants.AuditActionDeviceExchangeCancelled: deviceExchangeCancelled, constants.AuditActionDeviceExchangeRenewed: deviceExchangeRenewed, constants.AuditActionSystemConfigUpdated: systemConfigUpdated, constants.AuditActionPaymentConfigCreated: paymentConfigCreated, constants.AuditActionPaymentConfigUpdated: paymentConfigUpdated, constants.AuditActionPaymentConfigDeleted: paymentConfigDeleted, constants.AuditActionPaymentConfigActivated: paymentConfigActivated, constants.AuditActionPaymentConfigDeactivated: paymentConfigDeactivated, constants.AuditActionCarrierCreated: carrierCreated, constants.AuditActionCarrierUpdated: carrierUpdated, constants.AuditActionCarrierDeleted: carrierDeleted, constants.AuditActionCarrierStatusUpdated: carrierStatusUpdated, constants.AuditActionEmployeeCollectionPaymentMethodCreated: employeeCollectionPaymentMethodCreated, constants.AuditActionEmployeeCollectionPaymentMethodUpdated: employeeCollectionPaymentMethodUpdated, constants.AuditActionEmployeeCollectionPaymentMethodDeleted: employeeCollectionPaymentMethodDeleted, constants.AuditActionEmployeeCollectionBillCreated: employeeCollectionBillCreated, constants.AuditActionEmployeeCollectionBillClosed: employeeCollectionBillClosed, constants.AuditActionEmployeeCollectionApplicationSubmitted: employeeCollectionApplicationSubmitted, constants.AuditActionEmployeeCollectionApplicationApproved: employeeCollectionApplicationApproved, constants.AuditActionEmployeeCollectionApplicationRejected: employeeCollectionApplicationRejected, constants.AuditActionEmployeeCollectionApplicationRevoked: employeeCollectionApplicationRevoked, constants.AuditActionEmployeeCollectionBillRefundOffseted: employeeCollectionBillRefundOffseted, constants.AuditActionWeComApplicationSaved: wecomApplicationSaved, constants.AuditActionWeComDefaultCreatorSaved: wecomDefaultCreatorSaved, constants.AuditActionWeComMembersSynced: wecomMembersSynced, constants.AuditActionWeComApprovalSceneSaved: wecomApprovalSceneSaved, constants.AuditActionOutboxReplayed: outboxReplayed, constants.AuditActionOutboxExpiredLeaseReleased: outboxExpiredLeaseReleased, constants.AuditActionIotCardImportTaskCreated: iotCardImportTaskCreated, constants.AuditActionIotCardImportTaskCompleted: iotCardImportTaskCompleted, constants.AuditActionDeviceImportTaskCreated: deviceImportTaskCreated, constants.AuditActionDeviceImportTaskCompleted: deviceImportTaskCompleted, constants.AuditActionAssetPackageBatchOrderTaskCreated: assetPackageBatchOrderTaskCreated, constants.AuditActionAssetPackageBatchOrderTaskCompleted: assetPackageBatchOrderTaskCompleted, constants.AuditActionOrderPackageInvalidateTaskCreated: orderPackageInvalidateTaskCreated, constants.AuditActionOrderPackageInvalidateTaskCompleted: orderPackageInvalidateTaskCompleted, constants.AuditActionOrderPackageInvalidateItem: orderPackageInvalidateItem, constants.AuditActionExportTaskCreated: exportTaskCreated, constants.AuditActionExportTaskCancelled: exportTaskCancelled, constants.AuditActionNotificationDelivered: notificationDelivered, constants.AuditActionNotificationRead: notificationRead, constants.AuditActionNotificationReadAll: notificationReadAll, constants.AuditActionNotificationCleanup: notificationCleanup, constants.AuditActionNotificationCleanupItem: notificationCleanupItem, constants.AuditActionLogRetentionCleanup: retentionCleanup, constants.AuditActionPollingConfigCreated: pollingConfigCreated, constants.AuditActionPollingConfigUpdated: pollingConfigUpdated, constants.AuditActionPollingConfigDeleted: pollingConfigDeleted, constants.AuditActionPollingConfigStatusUpdated: pollingConfigStatusUpdated, constants.AuditActionPollingConcurrencyUpdated: pollingConcurrencyUpdated, constants.AuditActionPollingConcurrencyReset: pollingConcurrencyReset, constants.AuditActionPollingAlertRuleCreated: pollingAlertRuleCreated, constants.AuditActionPollingAlertRuleUpdated: pollingAlertRuleUpdated, constants.AuditActionPollingAlertRuleDeleted: pollingAlertRuleDeleted, constants.AuditActionPollingManualTriggerSingle: pollingManualTriggerSingle, constants.AuditActionPollingManualTriggerBatch: pollingManualTriggerBatch, constants.AuditActionPollingManualTriggerByCondition: pollingManualTriggerByCondition, constants.AuditActionPollingManualCancelled: pollingManualCancelled, constants.AuditActionWeComCredentialsRead: wecomCredentialsRead, constants.AuditActionRoleCreated: roleCreated, constants.AuditActionRoleUpdated: roleUpdated, constants.AuditActionRoleStatusUpdated: roleStatusUpdated, constants.AuditActionRoleDefaultCreditUpdated: roleDefaultCreditUpdated, constants.AuditActionRoleDeleted: roleDeleted, constants.AuditActionRolePermissionsAssigned: rolePermissionsAssigned, constants.AuditActionRolePermissionRemoved: rolePermissionRemoved, constants.AuditActionRolePermissionsBatchRemoved: rolePermissionsBatchRemoved, constants.AuditActionPermissionCreated: permissionCreated, constants.AuditActionPermissionUpdated: permissionUpdated, constants.AuditActionPermissionDeleted: permissionDeleted, constants.AuditActionPackageSeriesCreated: packageSeriesCreated, constants.AuditActionPackageSeriesUpdated: packageSeriesUpdated, constants.AuditActionPackageSeriesDeleted: packageSeriesDeleted, constants.AuditActionPackageSeriesStatusUpdated: packageSeriesStatusUpdated, constants.AuditActionPackageCreated: packageCreated, constants.AuditActionPackageUpdated: packageUpdated, constants.AuditActionPackageDeleted: packageDeleted, constants.AuditActionPackageStatusUpdated: packageStatusUpdated, constants.AuditActionPackageShelfStatusUpdated: packageShelfStatusUpdated, constants.AuditActionShopPackageShelfStatusUpdated: shopPackageShelfStatusUpdated, constants.AuditActionPackageRetailPriceUpdated: packageRetailPriceUpdated, constants.AuditActionShopSeriesGrantCreated: shopSeriesGrantCreated, constants.AuditActionShopSeriesGrantUpdated: shopSeriesGrantUpdated, constants.AuditActionShopSeriesGrantPackagesManaged: shopSeriesGrantPackagesManaged, constants.AuditActionShopSeriesGrantDeleted: shopSeriesGrantDeleted, constants.AuditActionShopPackageBatchAllocated: shopPackageBatchAllocated, constants.AuditActionShopPackageAllocated: shopPackageAllocated, constants.AuditActionShopPackageExpiryBaseUpdated: shopPackageExpiryBaseUpdated, constants.AuditActionShopPackageBatchPricingUpdated: shopPackageBatchPricingUpdated, constants.AuditActionShopPackagePricingItemUpdated: shopPackagePricingItemUpdated, constants.AuditActionPackageUsageActivated: packageUsageActivated, constants.AuditActionPackageUsageExpired: packageUsageExpired, constants.AuditActionPackageUsageTrafficDeducted: packageUsageTrafficDeducted, constants.AuditActionPackageUsageTrafficReset: packageUsageTrafficReset, constants.AuditActionPackageUsageRefundInvalidated: packageUsageRefundInvalidated, constants.AuditActionPackageUsageAssetInvalidated: packageUsageAssetInvalidated, constants.AuditActionPackageUsageExpiresAtUpdated: packageUsageExpiresAtUpdated, constants.AuditActionPackageUsageTrafficAdjusted: packageUsageTrafficAdjusted, constants.AuditActionOrderCreated: orderCreated, constants.AuditActionOrderCancelled: orderCancelled, constants.AuditActionOrderWalletPaid: orderWalletPaid, constants.AuditActionOrderExpiredClosed: orderExpiredClosed, constants.AuditActionOrderOnlinePaid: orderOnlinePaid, constants.AuditActionAgentWalletOrderDebited: agentWalletOrderDebited, constants.AuditActionAgentWalletOrderReserved: agentWalletOrderReserved, constants.AuditActionAgentWalletOrderReleased: agentWalletOrderReleased, constants.AuditActionAgentWalletOrderCompleted: agentWalletOrderCompleted, constants.AuditActionAgentWalletBalanceAdjusted: agentWalletBalanceAdjusted, constants.AuditActionAgentWalletCreditChanged: agentWalletCreditChanged, constants.AuditActionPaymentCreated: paymentCreated, constants.AuditActionPaymentConfirmed: paymentConfirmed, constants.AuditActionPaymentFailed: paymentFailed, constants.AuditActionIntegrationAttemptStarted: integrationAttemptStarted, constants.AuditActionIntegrationInboundReceived: integrationInboundReceived, constants.AuditActionAgentRechargeCreated: agentRechargeCreated, constants.AuditActionAgentRechargeCredited: agentRechargeCredited, constants.AuditActionAgentRechargeClosed: agentRechargeClosed, constants.AuditActionAssetRechargeAutoPurchased: assetRechargeAutoPurchased, constants.AuditActionRefundCreated: refundCreated, constants.AuditActionRefundApproved: refundApproved, constants.AuditActionRefundRejected: refundRejected, constants.AuditActionRefundReturned: refundReturned, constants.AuditActionRefundResubmitted: refundResubmitted, constants.AuditActionRefundCommissionInvalidated: refundCommissionInvalidated, constants.AuditActionRefundClawbackCommission: refundClawbackCommission, constants.AuditActionRefundClawbackNotRequired: refundClawbackNotRequired, constants.AuditActionRefundAssetProcessed: refundAssetProcessed, constants.AuditActionRefundAttemptSubmitted: refundAttemptSubmitted, constants.AuditActionRefundAttemptApproved: refundAttemptApproved, constants.AuditActionRefundAttemptClosed: refundAttemptClosed, constants.AuditActionRefundAnomalyFlagged: refundAnomalyFlagged, constants.AuditActionRefundChannelCalled: refundChannelCalled, constants.AuditActionRefundChannelRecovered: refundChannelRecovered, constants.AuditActionApprovalRequested: approvalRequested, constants.AuditActionApprovalSubmissionSynced: approvalSubmissionSynced, constants.AuditActionApprovalSubmissionRecovered: approvalSubmissionRecovered, constants.AuditActionApprovalDecisionSynced: approvalDecisionSynced, constants.AuditActionCommissionCalculated: commissionCalculated, constants.AuditActionCommissionCredited: commissionCredited, constants.AuditActionCommissionInvalidated: commissionInvalidated, constants.AuditActionCommissionWithdrawalRequested: withdrawalRequested, constants.AuditActionCommissionWithdrawalApproved: withdrawalApproved, constants.AuditActionCommissionWithdrawalRejected: withdrawalRejected, constants.AuditActionCommissionWithdrawalAttemptSubmitted: withdrawalAttemptSubmitted, constants.AuditActionCommissionWithdrawalAttemptApproved: withdrawalAttemptApproved, constants.AuditActionCommissionWithdrawalAttemptClosed: withdrawalAttemptClosed, constants.AuditActionCommissionWithdrawalAnomalyFlagged: withdrawalAnomalyFlagged, constants.AuditActionAgentDistributionRegistrationApproved: distributionRegistrationApproved, constants.AuditActionAgentDistributionRegistrationRejected: distributionRegistrationRejected, constants.AuditActionWithdrawalQualificationSubmitted: qualificationSubmitted, constants.AuditActionWithdrawalQualificationApproved: qualificationApproved, constants.AuditActionWithdrawalQualificationRejected: qualificationRejected, constants.AuditActionWithdrawalQualificationVoided: qualificationVoided, constants.AuditActionWithdrawalQualificationInvalidated: qualificationInvalidated, constants.AuditActionCommissionWithdrawalAttemptRejected: withdrawalAttemptRejected, constants.AuditActionWithdrawalQualificationSubmitRejected: qualificationSubmitRejected, }, resources: map[string]ResourceDefinition{ constants.AuditResourceAccount: { Type: constants.AuditResourceAccount, Name: "账号", IdentityFields: []string{"id", "username", "phone", "user_type", "shop_id", "enterprise_id", "wecom_userid", "wecom_name"}, }, constants.AuditResourceRole: { Type: constants.AuditResourceRole, Name: "角色", IdentityFields: []string{"id", "role_name", "role_type", "status", "default_credit_enabled", "default_credit_limit"}, }, constants.AuditResourcePermission: { Type: constants.AuditResourcePermission, Name: "权限", IdentityFields: []string{"id", "perm_name", "perm_code", "perm_type", "platform", "available_for_role_types", "parent_id", "status"}, }, constants.AuditResourceSystemConfig: { Type: constants.AuditResourceSystemConfig, Name: "受控系统配置", IdentityFields: []string{"config_key", "module"}, }, constants.AuditResourcePaymentConfig: { Type: constants.AuditResourcePaymentConfig, Name: "支付连接配置", IdentityFields: []string{"id", "name", "provider_type", "is_active", "credentials_configured"}, }, constants.AuditResourceCarrier: { Type: constants.AuditResourceCarrier, Name: "运营商配置", IdentityFields: []string{"id", "carrier_code", "carrier_name", "carrier_type", "status"}, }, constants.AuditResourceEmployeeCollectionPaymentMethod: { Type: constants.AuditResourceEmployeeCollectionPaymentMethod, Name: "线下收款方式", IdentityFields: []string{"id", "code", "name", "status", "sort"}, }, constants.AuditResourceEmployeeCollectionBill: { Type: constants.AuditResourceEmployeeCollectionBill, Name: "员工代收款账单", IdentityFields: []string{"id", "source_type", "source_id", "source_key", "debtor_account_id", "status"}, }, constants.AuditResourceEmployeeCollectionApplication: { Type: constants.AuditResourceEmployeeCollectionApplication, Name: "员工代收款核销申请", IdentityFields: []string{ "id", "applicant_account_id", "acting_operator_id", "payment_method_id", "paid_amount", "status", "latest_approval_instance_id", }, }, constants.AuditResourceEmployeeCollectionAttempt: { Type: constants.AuditResourceEmployeeCollectionAttempt, Name: "员工代收款核销审批尝试记录", IdentityFields: []string{"id", "application_id", "attempt_no", "paid_amount", "approval_instance_id"}, }, constants.AuditResourceWeComApprovalScene: { Type: constants.AuditResourceWeComApprovalScene, Name: "企业微信审批场景配置", IdentityFields: []string{"id", "business_type", "application_id", "template_id", "template_name", "status"}, }, constants.AuditResourceOutboxEvent: { Type: constants.AuditResourceOutboxEvent, Name: "Outbox 事件", IdentityFields: []string{ "event_id", "event_type", "aggregate_type", "aggregate_id", "resource_type", "resource_id", "business_key", }, }, constants.AuditResourceIntegrationLog: { Type: constants.AuditResourceIntegrationLog, Name: "外部集成日志", IdentityFields: []string{ "integration_id", "provider", "direction", "operation", "result", "external_id", "resource_type", "resource_id", "resource_key", "correlation_id", }, }, constants.AuditResourceLogArchiveMonth: { Type: constants.AuditResourceLogArchiveMonth, Name: "日志归档自然月", IdentityFields: []string{"month", "timezone", "range_start", "range_end"}, }, constants.AuditResourceDeviceBatchTask: { Type: constants.AuditResourceDeviceBatchTask, Name: "设备批量分配任务", IdentityFields: []string{"task_no", "operation_type"}, }, constants.AuditResourceIotCardImportTask: { Type: constants.AuditResourceIotCardImportTask, Name: "IoT 卡导入任务", IdentityFields: []string{"id", "task_no", "file_name", "carrier_id", "carrier_name", "batch_no", "card_category", "realname_policy"}, }, constants.AuditResourceDeviceImportTask: { Type: constants.AuditResourceDeviceImportTask, Name: "设备导入任务", IdentityFields: []string{"id", "task_no", "file_name", "operation_type", "target_id", "batch_no", "realname_policy"}, }, constants.AuditResourceAssetPackageBatchOrderTask: { Type: constants.AuditResourceAssetPackageBatchOrderTask, Name: "资产套餐批量订购任务", IdentityFields: []string{"id", "task_no", "file_name", "package_id", "package_code", "package_name", "payment_method"}, }, constants.AuditResourceOrderPackageInvalidateTask: { Type: constants.AuditResourceOrderPackageInvalidateTask, Name: "订单套餐批量失效任务", IdentityFields: []string{"id", "task_no", "file_name"}, }, constants.AuditResourceExportTask: { Type: constants.AuditResourceExportTask, Name: "业务导出任务", IdentityFields: []string{"id", "task_no", "scene", "format", "creator_user_id", "creator_user_type", "creator_shop_id", "creator_enterprise_id", "scope_shop_ids"}, }, constants.AuditResourceNotification: { Type: constants.AuditResourceNotification, Name: "站内通知", IdentityFields: []string{"id", "event_id", "recipient_kind", "recipient_id", "category", "type", "severity", "ref_type", "ref_id", "ref_key"}, }, constants.AuditResourceNotificationReadBatch: { Type: constants.AuditResourceNotificationReadBatch, Name: "通知批量已读", IdentityFields: []string{"recipient_kind", "recipient_id", "category", "updated_count"}, }, constants.AuditResourceNotificationCleanupBatch: { Type: constants.AuditResourceNotificationCleanupBatch, Name: "通知清理批次", IdentityFields: []string{"category", "cutoff", "deleted_count", "first_id", "last_id"}, }, constants.AuditResourcePollingConfig: { Type: constants.AuditResourcePollingConfig, Name: "轮询配置", IdentityFields: []string{"id", "config_name", "card_condition", "card_category", "carrier_id", "priority", "status"}, }, constants.AuditResourcePollingConcurrencyConfig: { Type: constants.AuditResourcePollingConcurrencyConfig, Name: "轮询并发配置", IdentityFields: []string{"id", "task_type", "max_concurrency"}, }, constants.AuditResourcePollingAlertRule: { Type: constants.AuditResourcePollingAlertRule, Name: "轮询告警规则", IdentityFields: []string{"id", "rule_name", "task_type", "metric_type", "operator", "threshold", "alert_level", "status"}, }, constants.AuditResourcePollingManualTrigger: { Type: constants.AuditResourcePollingManualTrigger, Name: "手动轮询任务", IdentityFields: []string{"id", "task_type", "trigger_type", "total_count", "status", "triggered_by"}, }, constants.AuditResourceDevice: { Type: constants.AuditResourceDevice, Name: "设备", IdentityFields: []string{"id", "virtual_no", "imei", "sn", "device_name", "device_model", "device_type", "manufacturer", "shop_id", "series_id", "generation"}, }, constants.AuditResourceIotCard: { Type: constants.AuditResourceIotCard, Name: "IoT卡", IdentityFields: []string{"id", "iccid", "iccid_19", "iccid_20", "virtual_no", "msisdn", "carrier_type", "shop_id", "series_id", "generation"}, }, constants.AuditResourceShop: { Type: constants.AuditResourceShop, Name: "店铺", IdentityFields: []string{"id", "shop_code", "shop_name", "parent_id", "level"}, }, constants.AuditResourceOrder: { Type: constants.AuditResourceOrder, Name: "订单", IdentityFields: []string{"id", "order_no", "order_type", "buyer_type", "buyer_id", "iot_card_id", "device_id", "asset_identifier", "total_amount", "actual_paid_amount", "payment_method", "payment_status", "purchase_role", "source", "operator_account_id", "operator_account_type", "operator_account_name", "seller_shop_id", "expires_at"}, }, constants.AuditResourceRefund: { Type: constants.AuditResourceRefund, Name: "退款单", IdentityFields: []string{"id", "refund_no", "order_id", "order_no", "order_type", "package_usage_id", "asset_identifier", "shop_id", "requested_refund_amount", "actual_received_amount", "refund_reason", "approved_refund_amount", "method", "frozen_actual_received_amount", "latest_attempt_id", "channel_refund_status", "channel_refund_no", "channel_refund_request_no", "channel_refund_amount", "failure_reason", "anomaly_flag", "approval_instance_id", "status", "commission_deducted", "asset_reset"}, }, // 退款审批尝试记录只登记冻结金额、方式与凭证数量，客户收款信息原文与凭证内容不进审计快照。 constants.AuditResourceRefundAttempt: { Type: constants.AuditResourceRefundAttempt, Name: "退款审批尝试记录", IdentityFields: []string{"id", "refund_id", "attempt_no", "method", "refund_amount", "frozen_actual_received_amount", "approval_instance_id", "channel_refund_request_no", "submitted_by_account_id", "customer_account_info_present", "customer_voucher_count", "created_at"}, }, constants.AuditResourceRefundChannelRefund: { Type: constants.AuditResourceRefundChannelRefund, Name: "渠道原路退款事实", IdentityFields: []string{"id", "refund_no", "channel_refund_status", "channel_refund_no", "channel_refund_request_no", "channel_refund_amount", "failure_reason", "anomaly_flag"}, }, constants.AuditResourceCommissionClawback: { Type: constants.AuditResourceCommissionClawback, Name: "佣金回溯明细", IdentityFields: []string{"id", "refund_id", "refund_no", "original_commission_id", "order_id", "order_no", "shop_id", "commission_source", "amount", "balance_after", "withdrawable", "status", "created_at"}, }, constants.AuditResourceEnterprise: { Type: constants.AuditResourceEnterprise, Name: "企业", IdentityFields: []string{"id", "enterprise_code", "enterprise_name", "owner_shop_id"}, }, constants.AuditResourceDeviceSIMBinding: { Type: constants.AuditResourceDeviceSIMBinding, Name: "设备卡槽绑定", IdentityFields: []string{"id", "device_id", "device_virtual_no", "slot_position", "iot_card_id", "iccid", "virtual_no", "is_current"}, }, constants.AuditResourceAssetAllocationRecord: { Type: constants.AuditResourceAssetAllocationRecord, Name: "资产分配记录", IdentityFields: []string{"id", "allocation_no", "asset_type", "asset_id", "asset_identifier", "from_owner_type", "from_owner_id", "to_owner_type", "to_owner_id"}, }, constants.AuditResourcePackageSeries: { Type: constants.AuditResourcePackageSeries, Name: "套餐系列", IdentityFields: []string{"id", "series_code", "series_name", "status", "enable_one_time_commission"}, }, constants.AuditResourcePackage: { Type: constants.AuditResourcePackage, Name: "套餐商品", IdentityFields: []string{"id", "package_code", "package_name", "series_id", "package_type", "duration_months", "duration_days", "price_config_status", "is_gift", "status", "shelf_status"}, }, constants.AuditResourceShopSeriesAllocation: { Type: constants.AuditResourceShopSeriesAllocation, Name: "店铺套餐系列授权", IdentityFields: []string{"id", "shop_id", "series_id", "allocator_shop_id", "status"}, }, constants.AuditResourceShopPackageAllocation: { Type: constants.AuditResourceShopPackageAllocation, Name: "店铺套餐授权", IdentityFields: []string{"id", "shop_id", "package_id", "allocator_shop_id", "series_allocation_id", "status", "shelf_status", "retail_price_config_status"}, }, constants.AuditResourceShopPackagePriceHistory: { Type: constants.AuditResourceShopPackagePriceHistory, Name: "店铺套餐价格历史", IdentityFields: []string{"id", "allocation_id", "changed_by", "effective_from"}, }, constants.AuditResourcePackageConfigBatch: { Type: constants.AuditResourcePackageConfigBatch, Name: "套餐配置批次", IdentityFields: []string{"batch_key", "operation", "shop_id", "series_id"}, }, constants.AuditResourceExchangeOrder: { Type: constants.AuditResourceExchangeOrder, Name: "换货单", IdentityFields: []string{"id", "exchange_no", "flow_type", "old_asset_type", "old_asset_id", "old_asset_identifier", "new_asset_type", "new_asset_id", "new_asset_identifier", "shop_id", "status"}, }, constants.AuditResourceAgentRecharge: { Type: constants.AuditResourceAgentRecharge, Name: "代理充值单", IdentityFields: []string{"id", "recharge_no", "user_id", "shop_id", "agent_wallet_id", "amount", "payment_method", "payment_channel", "payment_transaction_id", "approval_instance_id", "status"}, }, constants.AuditResourceRechargeOrder: { Type: constants.AuditResourceRechargeOrder, Name: "资产充值单", IdentityFields: []string{"id", "recharge_order_no", "user_id", "asset_wallet_id", "resource_type", "resource_id", "amount", "status"}, }, constants.AuditResourceAssetWallet: { Type: constants.AuditResourceAssetWallet, Name: "资产钱包", IdentityFields: []string{"id", "resource_type", "resource_id", "currency", "shop_id_tag", "enterprise_id_tag"}, }, constants.AuditResourceAssetWalletTransaction: { Type: constants.AuditResourceAssetWalletTransaction, Name: "资产钱包流水", IdentityFields: []string{"id", "asset_wallet_id", "resource_type", "resource_id", "transaction_type", "reference_type", "reference_no", "status"}, }, constants.AuditResourceAgentWallet: { Type: constants.AuditResourceAgentWallet, Name: "代理主钱包", IdentityFields: []string{"id", "shop_id", "wallet_type", "currency", "status", "credit_enabled", "credit_limit"}, }, constants.AuditResourceAgentWalletTransaction: { Type: constants.AuditResourceAgentWalletTransaction, Name: "代理主钱包流水", IdentityFields: []string{"id", "agent_wallet_id", "shop_id", "transaction_type", "transaction_subtype", "reference_type", "reference_id", "status"}, }, constants.AuditResourceAgentWalletReservation: { Type: constants.AuditResourceAgentWalletReservation, Name: "代理主钱包预占", IdentityFields: []string{"id", "agent_wallet_id", "shop_id", "amount", "status", "reference_type", "reference_id"}, }, constants.AuditResourcePayment: { Type: constants.AuditResourcePayment, Name: "支付记录", IdentityFields: []string{"id", "payment_no", "order_id", "order_type", "payment_method", "amount", "status", "third_party_trade_no", "payment_config_id"}, }, constants.AuditResourcePackageUsage: { Type: constants.AuditResourcePackageUsage, Name: "套餐权益", IdentityFields: []string{"id", "order_id", "order_no", "refund_id", "refund_no", "package_id", "package_name", "usage_type", "iot_card_id", "device_id", "data_limit_mb", "data_usage_mb", "activated_at", "expires_at", "status", "pending_realname_activation", "last_reset_at", "next_reset_at", "generation"}, }, constants.AuditResourceApprovalInstance: { Type: constants.AuditResourceApprovalInstance, Name: "审批实例", IdentityFields: []string{"id", "business_type", "business_id", "submitter_account_id", "provider", "external_ref", "correlation_id", "status"}, }, constants.AuditResourceCommissionRecord: { Type: constants.AuditResourceCommissionRecord, Name: "佣金记录", IdentityFields: []string{"id", "shop_id", "order_id", "iot_card_id", "device_id", "commission_source", "amount", "status", "released_at"}, }, constants.AuditResourceCommissionWithdrawal: { Type: constants.AuditResourceCommissionWithdrawal, Name: "佣金提现单", IdentityFields: []string{"id", "withdrawal_no", "shop_id", "applicant_id", "amount", "fee", "fee_rate", "actual_amount", "withdrawal_method", "payment_type", "status", "processor_id", "processed_at", "paid_at"}, }, constants.AuditResourceCommissionWithdrawalAttempt: { Type: constants.AuditResourceCommissionWithdrawalAttempt, Name: "提现审批尝试记录", IdentityFields: []string{"id", "request_id", "attempt_no", "amount", "fee", "actual_amount", "approval_instance_id", "released_at"}, }, constants.AuditResourceAgentDistributionRegistration: { Type: constants.AuditResourceAgentDistributionRegistration, Name: "代理扫码注册记录", IdentityFields: []string{"id", "parent_shop_id", "distribution_code_masked", "phone_masked", "username", "shop_code", "status", "approval_instance_id", "reject_reason"}, }, constants.AuditResourceWithdrawalQualification: { Type: constants.AuditResourceWithdrawalQualification, Name: "提现资料资格版本", IdentityFields: []string{"id", "shop_id", "subject_type", "subject_code_masked", "status", "approval_instance_id", "invalid_reason"}, }, constants.AuditResourceWeComApplication: { Type: constants.AuditResourceWeComApplication, Name: "企业微信应用配置", IdentityFields: []string{"id", "corp_id", "agent_id", "name", "status", "credentials_configured"}, }, constants.AuditResourceAuthentication: { Type: constants.AuditResourceAuthentication, Name: "认证状态", IdentityFields: []string{"account_id", "device", "auth_method", "state", "wecom_corp_id", "wecom_userid", "wecom_name"}, }, constants.AuditResourceEnterpriseCardAuthorization: { Type: constants.AuditResourceEnterpriseCardAuthorization, Name: "企业卡授权记录", IdentityFields: []string{"id", "enterprise_id", "card_id", "authorized_by", "authorizer_type", "authorized_at", "revoked_by", "revoked_at", "device_auth_id"}, }, constants.AuditResourceEnterpriseDeviceAuthorization: { Type: constants.AuditResourceEnterpriseDeviceAuthorization, Name: "企业设备授权记录", IdentityFields: []string{"id", "enterprise_id", "device_id", "authorized_by", "authorizer_type", "authorized_at", "revoked_by", "revoked_at"}, }, constants.AuditResourcePersonalCustomer: { Type: constants.AuditResourcePersonalCustomer, Name: "个人客户", IdentityFields: []string{"id", "nickname", "wx_open_id", "wx_union_id", "status"}, }, constants.AuditResourcePersonalCustomerPhone: { Type: constants.AuditResourcePersonalCustomerPhone, Name: "个人客户手机号", IdentityFields: []string{"id", "customer_id", "phone", "is_primary", "verified_at", "status"}, }, constants.AuditResourcePersonalCustomerOpenID: { Type: constants.AuditResourcePersonalCustomerOpenID, Name: "个人客户微信主体", IdentityFields: []string{"id", "customer_id", "app_id", "open_id", "union_id", "app_type"}, }, constants.AuditResourcePersonalCustomerDevice: { Type: constants.AuditResourcePersonalCustomerDevice, Name: "个人客户设备号绑定", IdentityFields: []string{"id", "customer_id", "virtual_no", "bind_at", "last_used_at", "status"}, }, constants.AuditResourcePersonalCustomerICCID: { Type: constants.AuditResourcePersonalCustomerICCID, Name: "个人客户 ICCID 绑定", IdentityFields: []string{"id", "customer_id", "iccid", "iccid_19", "bind_at", "last_used_at", "status"}, }, constants.AuditResourceIotCardBatch: { Type: constants.AuditResourceIotCardBatch, Name: "IoT 卡批量操作", IdentityFields: []string{"request_id", "card_count"}, }, constants.AuditResourceDeviceBatch: { Type: constants.AuditResourceDeviceBatch, Name: "设备批量操作", IdentityFields: []string{"request_id", "correlation_id", "device_count", "operation_type"}, }, }, } } func accountSecurityAction(code, name, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategorySecurity, Risk: risk, PrimaryResource: constants.AuditResourceAccount, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func accessAction(code, name, primaryResource string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategorySecurity, Risk: constants.AuditRiskHigh, PrimaryResource: primaryResource, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func shopIdentityAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceShop, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func shopStateAction(code, name, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: risk, PrimaryResource: constants.AuditResourceShop, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func enterpriseAction(code, name, category, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: category, Risk: risk, PrimaryResource: constants.AuditResourceEnterprise, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func enterpriseCardAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceEnterprise, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func personalAction(code, name string, subjectFields []string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryIdentity, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourcePersonalCustomer, AllowedActor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectDetail, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectDetail}, SubjectFields: subjectFields, } } func customerAssetAdminAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourcePersonalCustomer, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func packageConfigAction(code, name, primaryResource, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryConfiguration, Risk: risk, PrimaryResource: primaryResource, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func packageUsageAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourcePackageUsage, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } func orderAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceOrder, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult, constants.AuditSubjectDetail}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}, {Actor: constants.AuditActorOpenAPI, Source: constants.AuditSourceOpenAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } func agentWalletOrderAction(code, name string) ActionDefinition { action := orderAction(code, name) action.Risk = constants.AuditRiskHigh return action } func agentWalletAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceAgentWallet, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func paymentAction(code, name string, confirmation bool) ActionDefinition { origins := []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, } if confirmation { origins = append(origins, ActionOrigin{Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}) } return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourcePayment, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: origins, } } func rechargeAction(code, name, primaryResource string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: primaryResource, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult, constants.AuditSubjectDetail}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}, {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } func refundAction(code, name string, allowWorker bool) ActionDefinition { origins := []ActionOrigin{{Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}} if allowWorker { origins = append(origins, ActionOrigin{Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}) } return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceRefund, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: origins, } } func refundSystemAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceRefund, AllowedActor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func approvalAction(code, name string, origins []ActionOrigin) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceApprovalInstance, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, AllowedOrigins: origins, } } func commissionWithdrawalAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceCommissionWithdrawal, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult, constants.AuditSubjectDetail}, SubjectFields: []string{"amount", "fee", "actual_amount", "withdrawal_method", "payment_type", "status"}, // 同一动作还由退款佣金回扣的自动拒绝提现路径发出（Worker 消费任务，system_task/worker）， // 因此必须同时允许该入口，否则该审计会以「操作者或入口不符合动作注册规则」被丢弃。 AllowedOrigins: []ActionOrigin{{Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}}, } } func iotCardAction(code, name, actorKind, source string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceIotCard, AllowedActor: actorKind, Source: source, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func deviceAction(code, name, actorKind, source string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceDevice, AllowedActor: actorKind, Source: source, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } } func deviceMultiOriginAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceDevice, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, }, } } func deviceExternalAction(code, name string, allowOpenAPI bool) ActionDefinition { action := deviceAction(code, name, constants.AuditActorAccount, constants.AuditSourceAdminAPI) action.AllowedOrigins = []ActionOrigin{{Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}} if allowOpenAPI { action.AllowedOrigins = append(action.AllowedOrigins, ActionOrigin{Actor: constants.AuditActorOpenAPI, Source: constants.AuditSourceOpenAPI}) } return action } func cardExchangeAction(code, name, risk string, personal bool) ActionDefinition { action := ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: risk, PrimaryResource: constants.AuditResourceExchangeOrder, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, } if personal { action.AllowedOrigins = []ActionOrigin{{Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}} } return action } func deviceMultiOriginBatchAction(code, name string) ActionDefinition { action := deviceMultiOriginAction(code, name) action.PrimaryResource = constants.AuditResourceDeviceBatch action.DefaultVisibility = constants.AuditSubjectInternalOnly action.AllowedVisibility = []string{constants.AuditSubjectInternalOnly} return action } func deviceAccountBatchAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceDeviceBatch, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func iotCardBatchAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceIotCardBatch, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func accountLifecycleAction(code, name, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryIdentity, Risk: risk, PrimaryResource: constants.AuditResourceAccount, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func deviceBatchAction(code, name, primaryResource string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: constants.AuditRiskNormal, PrimaryResource: primaryResource, AllowedActor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func taskAction(code, name, primaryResource, actor, source string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskNormal, PrimaryResource: primaryResource, AllowedActor: actor, Source: source, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func notificationAction(code, name, primaryResource, actor, source string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskLow, PrimaryResource: primaryResource, AllowedActor: actor, Source: source, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func pollingAction(code, name, primaryResource, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryAsset, Risk: risk, PrimaryResource: primaryResource, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func outboxRecoveryAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryReliability, Risk: constants.AuditRiskHigh, PrimaryResource: constants.AuditResourceOutboxEvent, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } func integrationAction(code, name string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryReliability, Risk: constants.AuditRiskNormal, PrimaryResource: constants.AuditResourceIntegrationLog, AllowedActor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker, RequireTransaction: false, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorPersonalCustomer, Source: constants.AuditSourcePersonalAPI}, {Actor: constants.AuditActorOpenAPI, Source: constants.AuditSourceOpenAPI}, {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } func connectionConfigAction(code, name, resourceType, risk string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryConfiguration, Risk: risk, PrimaryResource: resourceType, AllowedActor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectInternalOnly, AllowedVisibility: []string{constants.AuditSubjectInternalOnly}, } } // employeeCollectionAction 定义员工代收款账单与核销申请动作；建账发生在来源成功事务内， // 订单来源由后台账号触发，充值入账与审批终态由 Outbox 消费、渠道回调或恢复任务触发。 func employeeCollectionAction(code, name, primaryResource string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: primaryResource, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } // distributionAction 定义分销注册、提现资格与提现终审动作；提交由后台账号或公开个人接口触发， // 终态由 Outbox 消费、渠道回调或恢复任务触发，均要求与业务事实同事务。 func distributionAction(code, name, primaryResource string) ActionDefinition { return ActionDefinition{ Code: code, Name: name, Category: constants.AuditCategoryBusiness, Risk: constants.AuditRiskHigh, PrimaryResource: primaryResource, RequireTransaction: true, DefaultVisibility: constants.AuditSubjectResult, AllowedVisibility: []string{constants.AuditSubjectInternalOnly, constants.AuditSubjectResult}, AllowedOrigins: []ActionOrigin{ {Actor: constants.AuditActorAccount, Source: constants.AuditSourceAdminAPI}, {Actor: constants.AuditActorSystemTask, Source: constants.AuditSourceWorker}, {Actor: constants.AuditActorExternalSystem, Source: constants.AuditSourceCallback}, {Actor: constants.AuditActorScheduledJob, Source: constants.AuditSourceScheduler}, }, } } // Action 返回已注册动作定义。 func (r *Registry) Action(code string) (ActionDefinition, bool) { if r == nil { return ActionDefinition{}, false } action, ok := r.actionsByCode[code] return action, ok } // ActionByOperation 返回旧应用接缝操作类型对应的受控动作。 func (r *Registry) ActionByOperation(operation string) (ActionDefinition, bool) { if r == nil { return ActionDefinition{}, false } action, ok := r.actionsByOperation[operation] return action, ok } // Resource 返回已注册资源定义。 func (r *Registry) Resource(resourceType string) (ResourceDefinition, bool) { if r == nil { return ResourceDefinition{}, false } resource, ok := r.resources[resourceType] return resource, ok }