109 lines
6.4 KiB
Go
109 lines
6.4 KiB
Go
package audit
|
|
|
|
import (
|
|
"context"
|
|
"strconv"
|
|
|
|
"gorm.io/gorm"
|
|
|
|
employeecollection "github.com/break/junhong_cmp_fiber/internal/application/employeecollection"
|
|
employeecollectiondomain "github.com/break/junhong_cmp_fiber/internal/domain/employeecollection"
|
|
"github.com/break/junhong_cmp_fiber/internal/model"
|
|
"github.com/break/junhong_cmp_fiber/pkg/constants"
|
|
"github.com/break/junhong_cmp_fiber/pkg/errors"
|
|
)
|
|
|
|
// WriteEmployeeCollectionApplication 将核销申请、审批尝试记录与受影响账单写入统一 Audit Event。
|
|
// 申请与尝试的冻结快照含付款凭证对象键，审计只记录数量与外部流水号脱敏值，不复制敏感付款内容。
|
|
func (w *Writer) WriteEmployeeCollectionApplication(ctx context.Context, tx *gorm.DB, change employeecollection.ApplicationAudit) error {
|
|
if change.Application == nil || change.Application.ID == 0 {
|
|
return errors.New(errors.CodeInvalidParam, "核销申请审计资源不完整")
|
|
}
|
|
application := change.Application
|
|
applicationID := strconv.FormatUint(uint64(application.ID), 10)
|
|
resources := []ResourceInput{{
|
|
Type: constants.AuditResourceEmployeeCollectionApplication, ID: &applicationID,
|
|
Key: applicationID, DisplayName: "核销申请 " + applicationID,
|
|
Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleCollectionApplication,
|
|
IdentitySnapshot: map[string]any{
|
|
"id": application.ID, "applicant_account_id": application.ApplicantAccountID,
|
|
"acting_operator_id": application.ActingOperatorID,
|
|
"payment_method_id": application.PaymentMethodID, "paid_amount": application.PaidAmount,
|
|
"status": application.Status,
|
|
"latest_approval_instance_id": application.LatestApprovalInstanceID,
|
|
},
|
|
BeforeData: change.BeforeData, AfterData: change.AfterData,
|
|
SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
|
|
}}
|
|
if change.Attempt != nil && change.Attempt.ID != 0 {
|
|
attempt := change.Attempt
|
|
attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
|
|
instanceID := uint(0)
|
|
if attempt.ApprovalInstanceID != nil {
|
|
instanceID = *attempt.ApprovalInstanceID
|
|
}
|
|
resources = append(resources, ResourceInput{
|
|
Type: constants.AuditResourceEmployeeCollectionAttempt, ID: &attemptID,
|
|
Key: attemptID, DisplayName: "审批尝试 " + attemptID,
|
|
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleCollectionAttempt,
|
|
IdentitySnapshot: map[string]any{
|
|
"id": attempt.ID, "application_id": attempt.ApplicationID, "attempt_no": attempt.AttemptNo,
|
|
"paid_amount": attempt.PaidAmount, "approval_instance_id": instanceID,
|
|
},
|
|
SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
|
|
})
|
|
}
|
|
for _, bill := range change.Bills {
|
|
if bill == nil || bill.ID == 0 {
|
|
continue
|
|
}
|
|
billID := strconv.FormatUint(uint64(bill.ID), 10)
|
|
resources = append(resources, ResourceInput{
|
|
Type: constants.AuditResourceEmployeeCollectionBill, ID: &billID,
|
|
Key: bill.SourceKey, DisplayName: bill.SourceNo,
|
|
Relation: constants.AuditResourceRelationAffected, Role: constants.AuditResourceRoleCollectionBillAffected,
|
|
IdentitySnapshot: map[string]any{
|
|
"id": bill.ID, "source_type": bill.SourceType, "source_id": bill.SourceID,
|
|
"source_key": bill.SourceKey, "debtor_account_id": bill.DebtorAccountID, "status": bill.Status,
|
|
},
|
|
SubjectVisibility: constants.AuditSubjectResult, SubjectSummary: change.Summary,
|
|
})
|
|
}
|
|
return w.Append(ctx, tx, AppendInput{
|
|
EventID: change.EventID, ActionCode: change.ActionCode, Summary: change.Summary,
|
|
ScopeType: constants.AuditScopePlatform, Result: constants.AuditResultSuccess,
|
|
CorrelationID: change.CorrelationID,
|
|
Metadata: map[string]any{
|
|
"payment_method_code": application.PaymentMethodCode,
|
|
"payer_name": application.PayerName,
|
|
"external_transaction_no_masked": employeecollectiondomain.MaskExternalTransactionNo(
|
|
application.ExternalTransactionNo),
|
|
"voucher_count": len(application.PaymentVoucherKeys),
|
|
"bill_count": len(change.Bills),
|
|
},
|
|
Resources: resources,
|
|
})
|
|
}
|
|
|
|
// WriteEmployeeCollectionRecovery 记录人工恢复原审批的脱敏审计事实。
|
|
func (w *Writer) WriteEmployeeCollectionRecovery(ctx context.Context, tx *gorm.DB, application *model.EmployeeCollectionApplication, attempt *model.EmployeeCollectionApplicationAttempt, instance *model.ApprovalInstance, actorID uint, beforeStatus, action, result string) error {
|
|
if application == nil || application.ID == 0 || attempt == nil || attempt.ID == 0 || instance == nil || instance.ID == 0 || actorID == 0 {
|
|
return errors.New(errors.CodeInvalidParam, "核销审批恢复审计资源不完整")
|
|
}
|
|
applicationID := strconv.FormatUint(uint64(application.ID), 10)
|
|
attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
|
|
instanceID := strconv.FormatUint(uint64(instance.ID), 10)
|
|
return w.Append(ctx, tx, AppendInput{
|
|
EventID: "employee_collection:application:" + applicationID + ":recover:" + action,
|
|
ActionCode: constants.AuditActionApprovalSubmissionRecovered, Summary: "人工恢复员工核销原审批提交",
|
|
Actor: ActorInput{Kind: constants.AuditActorAccount, ID: strconv.FormatUint(uint64(actorID), 10)}, Source: constants.AuditSourceAdminAPI,
|
|
ScopeType: constants.AuditScopePlatform, Result: result,
|
|
Metadata: map[string]any{"before_submission_status": beforeStatus, "action": action, "result": result},
|
|
Resources: []ResourceInput{
|
|
{Type: constants.AuditResourceEmployeeCollectionApplication, ID: &applicationID, Key: applicationID, DisplayName: "核销申请 " + applicationID, Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleCollectionApplication, IdentitySnapshot: map[string]any{"id": application.ID, "applicant_account_id": application.ApplicantAccountID}},
|
|
{Type: constants.AuditResourceEmployeeCollectionAttempt, ID: &attemptID, Key: attemptID, DisplayName: "审批尝试 " + attemptID, Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleCollectionAttempt, IdentitySnapshot: map[string]any{"id": attempt.ID, "application_id": attempt.ApplicationID}},
|
|
{Type: constants.AuditResourceApprovalInstance, ID: &instanceID, Key: instanceID, DisplayName: "审批实例 " + instanceID, Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalTarget, IdentitySnapshot: map[string]any{"id": instance.ID, "business_type": instance.BusinessType, "business_id": instance.BusinessID}},
|
|
},
|
|
})
|
|
}
|