affiliate_dash/backend/internal/service/user.go

package service

import (
	"errors"
	"fmt"
	"strings"
	"time"

	"affiliate_dash/internal/model"

	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
	"gorm.io/gorm/clause"
)

type UserService struct {
	db     *gorm.DB
	tenant *TenantService
}

func NewUserService(db *gorm.DB, tenant *TenantService) *UserService {
	return &UserService{db: db, tenant: tenant}
}

type UserListQuery struct {
	MerchantID uint
	Page       int
	Size       int
	Keyword    string
	Role       string
	Roles      []string
	Status     *int
}

// MerchantMemberGroup presents merchant accounts in their actual ownership
// hierarchy: one merchant and all of its employee accounts.
type MerchantMemberGroup struct {
	MerchantID uint                   `json:"merchant_id"`
	Merchant   *model.Merchant        `json:"merchant,omitempty"`
	Members    []model.MerchantMember `json:"members"`
}

func (s *UserService) List(q UserListQuery) ([]model.User, int64, error) {
	if q.Page < 1 {
		q.Page = 1
	}
	if q.Size < 1 || q.Size > 100 {
		q.Size = 20
	}
	tx := s.db.Model(&model.User{})
	if q.MerchantID != 0 {
		tx = tx.Joins("JOIN merchant_members ON merchant_members.user_id = users.id").
			Where("merchant_members.merchant_id = ?", q.MerchantID)
	}
	if q.Keyword != "" {
		like := "%" + q.Keyword + "%"
		tx = tx.Where("users.username LIKE ? OR users.nickname LIKE ?", like, like)
	}
	if len(q.Roles) > 0 {
		tx = tx.Where("users.role IN ?", q.Roles)
	} else if q.Role != "" {
		tx = tx.Where("users.role = ?", q.Role)
	}
	if q.Status != nil {
		tx = tx.Where("users.status = ?", *q.Status)
	}
	var total int64
	if err := tx.Count(&total).Error; err != nil {
		return nil, 0, err
	}
	var list []model.User
	err := tx.Order("users.id DESC").Offset((q.Page - 1) * q.Size).Limit(q.Size).Find(&list).Error
	return list, total, err
}

func (s *UserService) Create(username, password, nickname, role string, merchantID uint) (*model.User, error) {
	var count int64
	s.db.Model(&model.User{}).Where("username = ?", username).Count(&count)
	if count > 0 {
		return nil, errors.New("用户名已存在")
	}
	if role == "" {
		role = model.RoleMerchant
	}
	if role != model.RoleAdmin && role != model.RoleMerchant && role != model.RolePlatformSupport {
		return nil, errors.New("无效的账号角色")
	}
	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return nil, err
	}
	user := &model.User{
		Username:     username,
		PasswordHash: string(hash),
		Nickname:     nickname,
		Role:         role,
		Status:       1,
	}
	if user.Nickname == "" {
		user.Nickname = username
	}
	err = s.db.Transaction(func(tx *gorm.DB) error {
		if err := tx.Create(user).Error; err != nil {
			return err
		}
		if role == model.RoleAdmin && s.tenant != nil {
			var selfMerchant model.Merchant
			if err := tx.Where("code = ?", model.MerchantCodeSelfOperated).First(&selfMerchant).Error; err != nil {
				return err
			}
			member := model.MerchantMember{MerchantID: selfMerchant.ID, UserID: user.ID, Role: model.MemberRoleOwner, Status: user.Status, IsDefault: true}
			if err := tx.Clauses(clause.OnConflict{
				Columns: []clause.Column{{Name: "merchant_id"}, {Name: "user_id"}},
				DoUpdates: clause.Assignments(map[string]interface{}{
					"role": model.MemberRoleOwner, "status": user.Status, "is_default": true,
				}),
			}).Create(&member).Error; err != nil {
				return err
			}
			return nil
		}
		if s.tenant != nil && merchantID != 0 {
			memberRole := model.MemberRoleOperator
			member := model.MerchantMember{
				MerchantID: merchantID,
				UserID:     user.ID,
				Role:       memberRole,
				Status:     user.Status,
				IsDefault:  false,
			}
			if err := tx.Create(&member).Error; err != nil {
				return err
			}
		}
		return nil
	})
	if err != nil {
		return nil, err
	}
	return user, nil
}

type UpdatePlatformAdminInput struct {
	Username string
	Nickname string
	Password string
	Status   int
	Role     string
}

func (s *UserService) ListPlatformAdmins(page, size int) ([]model.User, int64, error) {
	list, total, err := s.List(UserListQuery{
		Page:  page,
		Size:  size,
		Roles: []string{model.RoleAdmin, model.RolePlatformSupport},
	})
	if err != nil {
		return nil, 0, err
	}
	pointers := make([]*model.User, 0, len(list))
	for i := range list {
		pointers = append(pointers, &list[i])
	}
	s.enrichLoginSecurity(pointers)
	return list, total, nil
}

// ListMerchantAccountGroups returns merchant employee accounts grouped by
// merchant. Platform administrators are excluded from this independent view.
func (s *UserService) ListMerchantAccountGroups(page, size int) ([]MerchantMemberGroup, int64, error) {
	page, size = normalizePage(page, size)
	tx := s.db.Model(&model.MerchantMember{}).
		Joins("JOIN users ON users.id = merchant_members.user_id AND users.deleted_at IS NULL").
		Where("users.role = ?", model.RoleMerchant)

	var total int64
	if err := tx.Distinct("merchant_members.merchant_id").Count(&total).Error; err != nil {
		return nil, 0, err
	}
	var merchantIDs []uint
	if err := tx.Distinct("merchant_members.merchant_id").
		Order("merchant_members.merchant_id ASC").
		Offset((page-1)*size).Limit(size).
		Pluck("merchant_members.merchant_id", &merchantIDs).Error; err != nil {
		return nil, 0, err
	}
	if len(merchantIDs) == 0 {
		return []MerchantMemberGroup{}, total, nil
	}

	var members []model.MerchantMember
	if err := s.db.Model(&model.MerchantMember{}).
		Joins("JOIN users ON users.id = merchant_members.user_id AND users.deleted_at IS NULL").
		Where("users.role = ? AND merchant_members.merchant_id IN ?", model.RoleMerchant, merchantIDs).
		Preload("Merchant").Preload("User").
		Order("merchant_members.merchant_id ASC, merchant_members.id ASC").
		Find(&members).Error; err != nil {
		return nil, 0, err
	}

	groups := make([]MerchantMemberGroup, 0, len(merchantIDs))
	byMerchantID := make(map[uint]*MerchantMemberGroup, len(merchantIDs))
	for _, merchantID := range merchantIDs {
		groups = append(groups, MerchantMemberGroup{MerchantID: merchantID, Members: []model.MerchantMember{}})
		byMerchantID[merchantID] = &groups[len(groups)-1]
	}
	for _, member := range members {
		group := byMerchantID[member.MerchantID]
		if group.Merchant == nil {
			group.Merchant = member.Merchant
		}
		group.Members = append(group.Members, member)
	}
	pointers := make([]*model.User, 0, len(members))
	for i := range members {
		if members[i].User != nil {
			pointers = append(pointers, members[i].User)
		}
	}
	s.enrichLoginSecurity(pointers)
	return groups, total, nil
}

// CreatePlatformUser creates a platform-level account. Platform admins get the
// hidden self-operated owner membership; platform support accounts use the
// synthetic tenant context in middleware.Tenant and do not become merchant members.
func (s *UserService) CreatePlatformUser(username, password, nickname, role string) (*model.User, error) {
	if role == "" {
		role = model.RoleAdmin
	}
	if role != model.RoleAdmin && role != model.RolePlatformSupport {
		return nil, errors.New("无效的平台账号角色")
	}
	return s.Create(username, password, nickname, role, 0)
}

// CreatePlatformAdmin creates an account with platform privileges and the
// hidden self-operated merchant context required by merchant-side routes.
func (s *UserService) CreatePlatformAdmin(username, password, nickname string) (*model.User, error) {
	return s.CreatePlatformUser(username, password, nickname, model.RoleAdmin)
}

func (s *UserService) UpdatePlatformAdmin(id uint, in UpdatePlatformAdminInput, actorUserID uint) (*model.User, error) {
	if id == 0 {
		return nil, errors.New("用户不存在")
	}
	if id == actorUserID {
		return nil, errors.New("当前账号请通过右上角账户菜单修改密码")
	}
	if in.Status != 0 && in.Status != 1 {
		return nil, errors.New("用户状态无效")
	}
	returnUser := &model.User{}
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if user.Role != model.RoleAdmin && user.Role != model.RolePlatformSupport {
			return errors.New("只能管理平台账号")
		}
		targetRole := user.Role
		if in.Role != "" {
			targetRole = in.Role
		}
		if targetRole != model.RoleAdmin && targetRole != model.RolePlatformSupport {
			return errors.New("无效的平台账号角色")
		}
		// 降级或停用最后一个启用的平台管理员会导致平台无法登录。
		if user.Role == model.RoleAdmin && user.Status == 1 && (targetRole != model.RoleAdmin || in.Status == 0) {
			var admins int64
			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
				return err
			}
			if admins <= 1 {
				return errors.New("至少保留一个启用的平台管理员")
			}
		}
		if in.Username != user.Username {
			var count int64
			if err := tx.Model(&model.User{}).Where("username = ? AND id <> ?", in.Username, user.ID).Count(&count).Error; err != nil {
				return err
			}
			if count > 0 {
				return errors.New("用户名已存在")
			}
		}
		if targetRole != user.Role {
			// 管理员需要自营商户负责人成员关系；平台客服使用 Tenant 合成上下文，
			// 不写入 merchant_members，避免出现在商户成员列表里。
			if err := tx.Where("user_id = ?", user.ID).Delete(&model.MerchantMember{}).Error; err != nil {
				return err
			}
			if targetRole == model.RoleAdmin {
				var selfMerchant model.Merchant
				if err := tx.Where("code = ?", model.MerchantCodeSelfOperated).First(&selfMerchant).Error; err != nil {
					return err
				}
				member := model.MerchantMember{
					MerchantID: selfMerchant.ID,
					UserID:     user.ID,
					Role:       model.MemberRoleOwner,
					Status:     1,
					IsDefault:  true,
				}
				if err := tx.Clauses(clause.OnConflict{
					Columns: []clause.Column{{Name: "merchant_id"}, {Name: "user_id"}},
					DoUpdates: clause.Assignments(map[string]interface{}{
						"role": model.MemberRoleOwner, "status": 1, "is_default": true,
					}),
				}).Create(&member).Error; err != nil {
					return err
				}
			}
		}
		updates := map[string]interface{}{
			"username": in.Username,
			"nickname": in.Nickname,
			"status":   in.Status,
			"role":     targetRole,
		}
		if in.Password != "" {
			hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)
			if err != nil {
				return err
			}
			updates["password_hash"] = string(hash)
		}
		if err := tx.Model(&user).Updates(updates).Error; err != nil {
			return err
		}
		return tx.First(returnUser, user.ID).Error
	})
	if err != nil {
		return nil, err
	}
	return returnUser, nil
}

func (s *UserService) UpdateStatus(id uint, status int) error {
	if status != 0 && status != 1 {
		return errors.New("用户状态无效")
	}
	return s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if user.Role == model.RoleAdmin && user.Status == 1 && status == 0 {
			var admins int64
			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
				return err
			}
			if admins <= 1 {
				return errors.New("至少保留一个启用的平台管理员")
			}
		}
		return tx.Model(&user).Update("status", status).Error
	})
}

// DeletePlatformAdmin removes a platform account (admin or support). It protects
// the current account and the final enabled platform administrator so the platform
// cannot be locked out.
func (s *UserService) DeletePlatformAdmin(id, actorUserID uint) error {
	if id == 0 {
		return errors.New("用户不存在")
	}
	if id == actorUserID {
		return errors.New("不能删除当前登录账号")
	}
	return s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if user.Role != model.RoleAdmin && user.Role != model.RolePlatformSupport {
			return errors.New("只能删除平台账号")
		}
		if user.Role == model.RoleAdmin && user.Status == 1 {
			var admins int64
			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
				return err
			}
			if admins <= 1 {
				return errors.New("至少保留一个启用的平台管理员")
			}
		}
		if err := tx.Where("user_id = ?", user.ID).Delete(&model.MerchantMember{}).Error; err != nil {
			return err
		}
		return tx.Delete(&user).Error
	})
}

// releaseUserIdentity 在账号软删除前释放手机号与设备绑定。
// users.phone 的唯一索引不区分软删除，不清理会让该手机号永远无法再绑定。
func releaseUserIdentity(tx *gorm.DB, userID uint) error {
	now := time.Now()
	if err := tx.Model(&model.UserDevice{}).
		Where("user_id = ? AND status = ?", userID, model.UserDeviceStatusActive).
		Updates(map[string]interface{}{
			"status":     model.UserDeviceStatusRevoked,
			"revoked_at": now,
			"updated_at": now,
		}).Error; err != nil {
		return err
	}
	return tx.Model(&model.User{}).Where("id = ?", userID).Update("phone", "").Error
}

// DeleteMerchantAccount permanently removes a merchant login account and all
// of its merchant memberships. Platform administrators must be managed from
// the dedicated platform administrator view instead.
func (s *UserService) DeleteMerchantAccount(id, actorUserID uint) error {
	if id == 0 {
		return errors.New("用户不存在")
	}
	if id == actorUserID {
		return errors.New("不能删除当前登录账号")
	}
	return s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return errors.New("用户不存在")
			}
			return err
		}
		if user.Role != model.RoleMerchant {
			return errors.New("平台账号请在平台账号列表中管理")
		}
		if err := tx.Where("user_id = ?", user.ID).Delete(&model.MerchantMember{}).Error; err != nil {
			return err
		}
		if err := releaseUserIdentity(tx, user.ID); err != nil {
			return err
		}
		return tx.Delete(&user).Error
	})
}

// BindUserPhone 由管理员为账号绑定/修改登录手机号（手机号全平台唯一）。
func (s *UserService) BindUserPhone(id uint, phoneValue string, actorUserID uint) (*model.User, error) {
	if id == 0 {
		return nil, newAuthError(404, "user_not_found", "用户不存在")
	}
	phone, err := NormalizePhone(phoneValue)
	if err != nil {
		return nil, err
	}
	updated := &model.User{}
	err = s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return newAuthError(404, "user_not_found", "用户不存在")
			}
			return err
		}
		if user.Phone == phone {
			updated = &user
			return nil
		}
		var count int64
		if err := tx.Model(&model.User{}).
			Where("phone = ? AND id <> ?", phone, user.ID).
			Count(&count).Error; err != nil {
			return err
		}
		if count > 0 {
			return newAuthError(409, "phone_exists", "该手机号已绑定其他账号")
		}
		now := time.Now()
		if err := tx.Model(&user).Updates(map[string]interface{}{
			"phone":          phone,
			"phone_bound_at": now,
			"phone_bound_by": actorUserID,
		}).Error; err != nil {
			return err
		}
		if err := writeAudit(tx, nil, &actorUserID, nil, "user.phone.bind", "user", fmt.Sprint(user.ID), map[string]interface{}{
			"phone": MaskPhone(phone),
		}); err != nil {
			return err
		}
		return tx.First(updated, user.ID).Error
	})
	if err != nil {
		return nil, err
	}
	s.enrichLoginSecurity([]*model.User{updated})
	return updated, nil
}

// ResetUserDevice 由管理员撤销账号当前 active 的 DCAuth 设备绑定。
func (s *UserService) ResetUserDevice(id uint, actorUserID uint) (bool, error) {
	if id == 0 {
		return false, newAuthError(404, "user_not_found", "用户不存在")
	}
	var reset bool
	err := s.db.Transaction(func(tx *gorm.DB) error {
		var user model.User
		if err := tx.First(&user, id).Error; err != nil {
			if errors.Is(err, gorm.ErrRecordNotFound) {
				return newAuthError(404, "user_not_found", "用户不存在")
			}
			return err
		}
		now := time.Now()
		result := tx.Model(&model.UserDevice{}).
			Where("user_id = ? AND status = ?", user.ID, model.UserDeviceStatusActive).
			Updates(map[string]interface{}{
				"status":     model.UserDeviceStatusRevoked,
				"revoked_at": now,
				"revoked_by": actorUserID,
				"updated_at": now,
			})
		if result.Error != nil {
			return result.Error
		}
		reset = result.RowsAffected > 0
		return writeAudit(tx, nil, &actorUserID, nil, "user.device.reset", "user", fmt.Sprint(user.ID), map[string]interface{}{
			"revoked_devices": result.RowsAffected,
		})
	})
	if err != nil {
		return false, err
	}
	return reset, nil
}

// enrichLoginSecurity 批量补充手机号掩码与 active 设备信息，避免列表 N+1 查询。
func (s *UserService) enrichLoginSecurity(users []*model.User) {
	if len(users) == 0 {
		return
	}
	ids := make([]uint, 0, len(users))
	for _, user := range users {
		if user == nil {
			continue
		}
		user.PhoneMasked = MaskPhone(user.Phone)
		ids = append(ids, user.ID)
	}
	if len(ids) == 0 {
		return
	}
	var devices []model.UserDevice
	if err := s.db.Where("user_id IN ? AND status = ?", ids, model.UserDeviceStatusActive).Find(&devices).Error; err != nil {
		return
	}
	byUser := make(map[uint]model.UserDevice, len(devices))
	for _, device := range devices {
		byUser[device.UserID] = device
	}
	for _, user := range users {
		if user == nil {
			continue
		}
		device, ok := byUser[user.ID]
		if !ok {
			continue
		}
		user.DeviceBound = true
		user.DeviceID = device.DeviceID
		user.DeviceIDMasked = MaskDeviceID(device.DeviceID)
	}
}

// MaskDeviceID 返回 D1-ABC-****-1234 形式的设备码。
func MaskDeviceID(value string) string {
	deviceID := strings.ToUpper(strings.TrimSpace(value))
	if len(deviceID) <= 8 {
		return deviceID
	}
	return deviceID[:6] + "-****-" + deviceID[len(deviceID)-4:]
}