Constraint: 在线热修前必须保存当前迭代分支全部有效代码进展 Confidence: medium Scope-risk: broad Directive: 后续修改需保持审计事件与业务事务边界一致 Tested: git diff --cached --check Not-tested: 未运行全量测试,提交用于切换分支前保存既有工作
129 lines
6.2 KiB
Go
129 lines
6.2 KiB
Go
package audit
|
|
|
|
import (
|
|
"context"
|
|
"strconv"
|
|
|
|
"gorm.io/gorm"
|
|
|
|
refundapprovalapp "github.com/break/junhong_cmp_fiber/internal/application/refundapproval"
|
|
"github.com/break/junhong_cmp_fiber/internal/model"
|
|
"github.com/break/junhong_cmp_fiber/pkg/constants"
|
|
pkgerrors "github.com/break/junhong_cmp_fiber/pkg/errors"
|
|
)
|
|
|
|
// WriteRefundApplication 将退款申请、审批和关联业务资源写入同一事务。
|
|
func (w *Writer) WriteRefundApplication(ctx context.Context, tx *gorm.DB, input refundapprovalapp.ApplicationAudit) error {
|
|
if input.Refund == nil || input.Order == nil || input.Approval == nil || input.Submitter == nil {
|
|
return pkgerrors.New(pkgerrors.CodeInvalidParam, "退款申请审计资源不完整")
|
|
}
|
|
primary := RefundResource(input.Refund, constants.AuditResourceRelationPrimary, constants.AuditResourceRoleRefundTarget)
|
|
primary.AfterData = refundStateData(input.Refund)
|
|
primary.SubjectVisibility = constants.AuditSubjectResult
|
|
primary.SubjectSummary = "退款申请已提交"
|
|
resources := []ResourceInput{
|
|
primary,
|
|
OrderResource(input.Order, constants.AuditResourceRelationReference, constants.AuditResourceRoleRefundOrder),
|
|
ApprovalInstanceResource(input.Approval, constants.AuditResourceRelationAffected, constants.AuditResourceRoleRefundApproval, nil, map[string]any{"status": input.Approval.Status}),
|
|
AccountResource(input.Submitter, constants.AuditResourceRelationReference, constants.AuditResourceRoleRefundSubmitter),
|
|
}
|
|
for index := 1; index < len(resources); index++ {
|
|
resources[index].SubjectVisibility = constants.AuditSubjectInternalOnly
|
|
}
|
|
asset, err := RefundAssetResource(ctx, tx, input.Order, "退款申请已提交")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if asset != nil {
|
|
resources = append(resources, *asset)
|
|
}
|
|
return w.Append(ctx, tx, AppendInput{
|
|
EventID: "refund:" + strconv.FormatUint(uint64(input.Refund.ID), 10) + ":created",
|
|
ActionCode: constants.AuditActionRefundCreated, Summary: "提交退款申请",
|
|
Actor: ActorInput{Kind: constants.AuditActorAccount, ID: strconv.FormatUint(uint64(input.Submitter.ID), 10), Name: input.Submitter.Username},
|
|
Source: constants.AuditSourceAdminAPI, ScopeType: constants.AuditScopePlatform,
|
|
Result: constants.AuditResultSuccess, CorrelationID: input.Refund.RefundNo,
|
|
Metadata: map[string]any{"requested_refund_amount": input.Refund.RequestedRefundAmount},
|
|
Resources: resources,
|
|
})
|
|
}
|
|
|
|
// ApprovalInstanceResource 构造审批实例审计资源。
|
|
func ApprovalInstanceResource(instance *model.ApprovalInstance, relation, role string, beforeData, afterData map[string]any) ResourceInput {
|
|
id := strconv.FormatUint(uint64(instance.ID), 10)
|
|
return ResourceInput{
|
|
Type: constants.AuditResourceApprovalInstance, ID: &id, Key: id, DisplayName: "审批实例 " + id,
|
|
Relation: relation, Role: role,
|
|
IdentitySnapshot: map[string]any{
|
|
"id": instance.ID, "business_type": instance.BusinessType, "business_id": instance.BusinessID,
|
|
"provider": instance.Provider, "external_ref": instance.ExternalRef, "status": instance.Status,
|
|
},
|
|
BeforeData: beforeData, AfterData: afterData,
|
|
}
|
|
}
|
|
|
|
// AccountResource 构造退款链路中的后台账号资源。
|
|
func AccountResource(account *model.Account, relation, role string) ResourceInput {
|
|
id := strconv.FormatUint(uint64(account.ID), 10)
|
|
return ResourceInput{
|
|
Type: constants.AuditResourceAccount, ID: &id, Key: id, DisplayName: account.Username,
|
|
Relation: relation, Role: role, IdentitySnapshot: accountIdentity(account),
|
|
}
|
|
}
|
|
|
|
// RefundAssetResource 构造退款订单实际关联的卡或设备资源。
|
|
func RefundAssetResource(ctx context.Context, tx *gorm.DB, order *model.Order, subjectSummary string) (*ResourceInput, error) {
|
|
if order.IotCardID != nil {
|
|
var card model.IotCard
|
|
if err := tx.WithContext(ctx).First(&card, *order.IotCardID).Error; err != nil {
|
|
return nil, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, err, "查询退款关联卡审计快照失败")
|
|
}
|
|
id := strconv.FormatUint(uint64(card.ID), 10)
|
|
return &ResourceInput{
|
|
Type: constants.AuditResourceIotCard, ID: &id, Key: IotCardResourceKey(&card), DisplayName: card.ICCID,
|
|
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleRefundAsset,
|
|
IdentitySnapshot: IotCardIdentitySnapshot(&card), SubjectVisibility: constants.AuditSubjectResult,
|
|
SubjectSummary: subjectSummary,
|
|
}, nil
|
|
}
|
|
if order.DeviceID != nil {
|
|
var device model.Device
|
|
if err := tx.WithContext(ctx).First(&device, *order.DeviceID).Error; err != nil {
|
|
return nil, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, err, "查询退款关联设备审计快照失败")
|
|
}
|
|
id := strconv.FormatUint(uint64(device.ID), 10)
|
|
return &ResourceInput{
|
|
Type: constants.AuditResourceDevice, ID: &id, Key: DeviceResourceKey(&device), DisplayName: device.VirtualNo,
|
|
Relation: constants.AuditResourceRelationReference, Role: constants.AuditResourceRoleRefundAsset,
|
|
IdentitySnapshot: DeviceIdentitySnapshot(&device), SubjectVisibility: constants.AuditSubjectResult,
|
|
SubjectSummary: subjectSummary,
|
|
}, nil
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// CommissionRecordResource 构造退款失效的佣金记录资源。
|
|
func CommissionRecordResource(record *model.CommissionRecord, beforeData, afterData map[string]any) ResourceInput {
|
|
id := strconv.FormatUint(uint64(record.ID), 10)
|
|
return ResourceInput{
|
|
Type: constants.AuditResourceCommissionRecord, ID: &id, Key: id, DisplayName: "佣金记录 " + id,
|
|
Relation: constants.AuditResourceRelationAffected, Role: constants.AuditResourceRoleRefundCommission,
|
|
IdentitySnapshot: map[string]any{
|
|
"id": record.ID, "shop_id": record.ShopID, "order_id": record.OrderID,
|
|
"iot_card_id": record.IotCardID, "device_id": record.DeviceID,
|
|
"commission_source": record.CommissionSource, "amount": record.Amount,
|
|
"status": record.Status, "released_at": record.ReleasedAt,
|
|
},
|
|
BeforeData: beforeData, AfterData: afterData,
|
|
}
|
|
}
|
|
|
|
func refundStateData(refund *model.RefundRequest) map[string]any {
|
|
return map[string]any{
|
|
"status": refund.Status, "approved_refund_amount": refund.ApprovedRefundAmount,
|
|
"approval_instance_id": refund.ApprovalInstanceID, "processor_id": refund.ProcessorID,
|
|
"processed_at": refund.ProcessedAt, "commission_deducted": refund.CommissionDeducted,
|
|
"asset_reset": refund.AssetReset, "reject_reason": refund.RejectReason, "remark": refund.Remark,
|
|
}
|
|
}
|