junhong_cmp_fiber/internal/infrastructure/audit/approval.go

package audit

import (
	"context"
	"strconv"
	"strings"

	"github.com/bytedance/sonic"
	"gorm.io/gorm"

	approvalapp "github.com/break/junhong_cmp_fiber/internal/application/approval"
	"github.com/break/junhong_cmp_fiber/internal/model"
	"github.com/break/junhong_cmp_fiber/pkg/constants"
	"github.com/break/junhong_cmp_fiber/pkg/errors"
)

// WriteApproval 将通用审批状态变化及其 Integration/Outbox 引用写入统一 Audit Event。
func (w *Writer) WriteApproval(ctx context.Context, tx *gorm.DB, change approvalapp.AuditChange) error {
	if change.InstanceID == 0 || change.BusinessID == 0 || change.BusinessType == "" || change.SubmitterAccountID == 0 {
		return errors.New(errors.CodeInvalidParam, "通用审批审计资源不完整")
	}
	resources, err := approvalResources(ctx, tx, change)
	if err != nil {
		return err
	}
	result := change.Result
	if result == "" {
		result = constants.AuditResultSuccess
	}
	return w.Append(ctx, tx, AppendInput{
		EventID: change.EventID, ActionCode: change.ActionCode, Summary: change.Summary,
		Actor: ActorInput{Kind: change.ActorKind, ID: change.ActorID, Name: change.ActorName}, Source: change.Source,
		ScopeType: constants.AuditScopePlatform, Result: result, ErrorSummary: change.ErrorSummary,
		CorrelationID: change.CorrelationID, ParentEventID: change.ParentEventID,
		Metadata: map[string]any{"provider": change.Provider, "decision": change.Decision}, Resources: resources,
	})
}

func approvalResources(ctx context.Context, tx *gorm.DB, change approvalapp.AuditChange) ([]ResourceInput, error) {
	instanceID := strconv.FormatUint(uint64(change.InstanceID), 10)
	resources := []ResourceInput{{
		Type: constants.AuditResourceApprovalInstance, ID: &instanceID, Key: instanceID, DisplayName: "审批实例 " + instanceID,
		Relation: constants.AuditResourceRelationPrimary, Role: constants.AuditResourceRoleApprovalTarget,
		IdentitySnapshot: map[string]any{
			"id": change.InstanceID, "business_type": change.BusinessType, "business_id": change.BusinessID,
			"submitter_account_id": change.SubmitterAccountID, "provider": change.Provider,
			"external_ref": change.AfterExternalRef, "correlation_id": change.CorrelationID,
			"status": statusValue(change.AfterStatus),
		},
		BeforeData: approvalState(change.BeforeStatus, change.BeforeExternalRef),
		AfterData:  approvalState(change.AfterStatus, change.AfterExternalRef),
	}}
	business, err := approvalBusinessResource(ctx, tx, change.BusinessType, change.BusinessID, change.InstanceID)
	if err != nil {
		return nil, err
	}
	resources = append(resources, business)
	resources = append(resources, approvalSubmitterResource(change))
	seenIntegrationIDs := make(map[string]struct{}, len(change.IntegrationIDs))
	for _, integrationID := range change.IntegrationIDs {
		integrationID = strings.TrimSpace(integrationID)
		if integrationID == "" {
			continue
		}
		if _, exists := seenIntegrationIDs[integrationID]; exists {
			continue
		}
		seenIntegrationIDs[integrationID] = struct{}{}
		resource, err := approvalIntegrationResource(ctx, tx, integrationID)
		if err != nil {
			return nil, err
		}
		resources = append(resources, resource)
	}
	if strings.TrimSpace(change.OutboxEventID) != "" {
		resource, err := approvalOutboxResource(ctx, tx, change.OutboxEventID)
		if err != nil {
			return nil, err
		}
		resources = append(resources, resource)
	}
	return resources, nil
}

func approvalBusinessResource(ctx context.Context, tx *gorm.DB, businessType string, businessID, instanceID uint) (ResourceInput, error) {
	id := strconv.FormatUint(uint64(businessID), 10)
	switch businessType {
	case constants.ApprovalBusinessTypeRefund:
		var refund model.RefundRequest
		if err := tx.WithContext(ctx).First(&refund, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联退款单失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceRefund, ID: &id, Key: refund.RefundNo, DisplayName: refund.RefundNo,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": refund.ID, "refund_no": refund.RefundNo, "order_id": refund.OrderID, "order_no": refund.OrderNo,
				"order_type": refund.OrderType, "asset_identifier": refund.AssetIdentifier, "shop_id": refund.ShopID,
				"requested_refund_amount": refund.RequestedRefundAmount, "actual_received_amount": refund.ActualReceivedAmount,
				"approval_instance_id": instanceID, "status": refund.Status,
			},
		}, nil
	case constants.ApprovalBusinessTypeOfflineRecharge:
		var recharge model.AgentRechargeRecord
		if err := tx.WithContext(ctx).First(&recharge, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联充值单失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceAgentRecharge, ID: &id, Key: recharge.RechargeNo, DisplayName: recharge.RechargeNo,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": recharge.ID, "recharge_no": recharge.RechargeNo, "user_id": recharge.UserID,
				"shop_id": recharge.ShopID, "agent_wallet_id": recharge.AgentWalletID, "amount": recharge.Amount,
				"payment_method": recharge.PaymentMethod, "payment_channel": recharge.PaymentChannel,
				"approval_instance_id": instanceID, "status": recharge.Status,
			},
		}, nil
	case constants.ApprovalBusinessTypeEmployeeCollection:
		var attempt model.EmployeeCollectionApplicationAttempt
		if err := tx.WithContext(ctx).First(&attempt, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联核销审批尝试记录失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceEmployeeCollectionAttempt, ID: &id,
			Key: id, DisplayName: "审批尝试 " + id,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": attempt.ID, "application_id": attempt.ApplicationID, "attempt_no": attempt.AttemptNo,
				"paid_amount": attempt.PaidAmount, "approval_instance_id": instanceID,
			},
		}, nil
	case constants.ApprovalBusinessTypeAgentDistribution:
		var registration model.AgentDistributionRegistration
		if err := tx.WithContext(ctx).First(&registration, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联扫码注册记录失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceAgentDistributionRegistration, ID: &id,
			Key: id, DisplayName: "扫码注册记录 " + id,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": registration.ID, "parent_shop_id": registration.ParentShopID,
				"status": registration.Status, "approval_instance_id": instanceID,
			},
		}, nil
	case constants.ApprovalBusinessTypeWithdrawalQualification:
		var qualification model.WithdrawalQualification
		if err := tx.WithContext(ctx).First(&qualification, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联提现资料资格版本失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceWithdrawalQualification, ID: &id,
			Key: id, DisplayName: "提现资料资格版本 " + id,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": qualification.ID, "shop_id": qualification.ShopID,
				"subject_type": qualification.SubjectType, "status": qualification.Status,
				"approval_instance_id": instanceID,
			},
		}, nil
	case constants.ApprovalBusinessTypeCommissionWithdrawal:
		var attempt model.CommissionWithdrawalRequestAttempt
		if err := tx.WithContext(ctx).First(&attempt, businessID).Error; err != nil {
			return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联提现审批尝试记录失败")
		}
		return ResourceInput{
			Type: constants.AuditResourceCommissionWithdrawalAttempt, ID: &id,
			Key: id, DisplayName: "提现审批尝试 " + id,
			Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalBusiness,
			IdentitySnapshot: map[string]any{
				"id": attempt.ID, "request_id": attempt.RequestID, "attempt_no": attempt.AttemptNo,
				"amount": attempt.Amount, "approval_instance_id": instanceID,
			},
		}, nil
	default:
		return ResourceInput{}, errors.New(errors.CodeInvalidParam, "审批业务类型尚未注册审计资源")
	}
}

func approvalSubmitterResource(change approvalapp.AuditChange) ResourceInput {
	accountID := strconv.FormatUint(uint64(change.SubmitterAccountID), 10)
	identity := map[string]any{"id": change.SubmitterAccountID}
	var snapshot map[string]any
	if sonic.Unmarshal(change.SubmitterSnapshot, &snapshot) == nil {
		identity["username"] = snapshot["account_name"]
		identity["user_type"] = snapshot["user_type"]
	}
	displayName, _ := identity["username"].(string)
	if displayName == "" {
		displayName = "账号 " + accountID
	}
	return ResourceInput{
		Type: constants.AuditResourceAccount, ID: &accountID, Key: accountID, DisplayName: displayName,
		Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalSubmitter,
		IdentitySnapshot: identity,
	}
}

func approvalIntegrationResource(ctx context.Context, tx *gorm.DB, integrationID string) (ResourceInput, error) {
	var record model.IntegrationLog
	if err := tx.WithContext(ctx).Where("integration_id = ?", integrationID).First(&record).Error; err != nil {
		return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联 Integration Log 失败")
	}
	id := strconv.FormatUint(uint64(record.ID), 10)
	return ResourceInput{
		Type: constants.AuditResourceIntegrationLog, ID: &id, Key: record.IntegrationID, DisplayName: record.IntegrationID,
		Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalIntegration,
		IdentitySnapshot: map[string]any{
			"integration_id": record.IntegrationID, "provider": record.Provider, "direction": record.Direction,
			"operation": record.Operation, "external_id": record.ExternalID,
			"resource_type": record.ResourceType, "resource_id": record.ResourceID, "resource_key": record.ResourceKey,
			"correlation_id": record.CorrelationID,
		},
	}, nil
}

func approvalOutboxResource(ctx context.Context, tx *gorm.DB, eventID string) (ResourceInput, error) {
	var event model.OutboxEvent
	if err := tx.WithContext(ctx).Where("event_id = ?", eventID).First(&event).Error; err != nil {
		return ResourceInput{}, errors.Wrap(errors.CodeDatabaseError, err, "查询审批关联 Outbox 事件失败")
	}
	id := strconv.FormatUint(uint64(event.ID), 10)
	return ResourceInput{
		Type: constants.AuditResourceOutboxEvent, ID: &id, Key: event.EventID, DisplayName: event.EventID,
		Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleApprovalOutbox,
		IdentitySnapshot: map[string]any{
			"event_id": event.EventID, "event_type": event.EventType, "aggregate_type": event.AggregateType,
			"aggregate_id": event.AggregateID, "resource_type": event.ResourceType,
			"resource_id": event.ResourceID, "business_key": event.BusinessKey,
		},
	}, nil
}

func approvalState(status *int, externalRef string) map[string]any {
	if status == nil {
		return nil
	}
	return map[string]any{"status": *status, "external_ref": externalRef}
}

func statusValue(status *int) any {
	if status == nil {
		return nil
	}
	return *status
}