chore(init): 初始化解忧商行项目并完成 Phase 0 基座

2026-10-30 11:46:10 +08:00
commit 8d9481c251
689 changed files with 138703 additions and 0 deletions
@@ -0,0 +1,37 @@
+package adminrole
+
+import "time"
+
+type RoleDTO struct {
+	ID          uint64          `json:"id"`
+	Code        string          `json:"code"`
+	Name        string          `json:"name"`
+	Description string          `json:"description"`
+	PermCount   int             `json:"perm_count"`
+	Permissions []PermissionDTO `json:"permissions,omitempty"`
+	CreatedAt   time.Time       `json:"created_at"`
+	UpdatedAt   time.Time       `json:"updated_at"`
+}
+
+type PermissionDTO struct {
+	ID       uint64 `json:"id"`
+	Code     string `json:"code"`
+	Name     string `json:"name"`
+	Resource string `json:"resource"`
+	Action   string `json:"action"`
+}
+
+type CreateRoleRequest struct {
+	Code        string `json:"code" binding:"required"`
+	Name        string `json:"name" binding:"required"`
+	Description string `json:"description"`
+}
+
+type UpdateRoleRequest struct {
+	Name        string `json:"name" binding:"required"`
+	Description string `json:"description"`
+}
+
+type AssignPermissionsRequest struct {
+	PermissionIDs []uint64 `json:"permission_ids"`
+}
@@ -0,0 +1,134 @@
+package adminrole
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) List(c *gin.Context) {
+	items, err := h.service.List(c.Request.Context())
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, items)
+}
+
+func (h *Handler) FindByID(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	item, err := h.service.FindByID(c.Request.Context(), id)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Create(c *gin.Context) {
+	var req CreateRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "角色编码和名称不能为空")
+		return
+	}
+	item, err := h.service.Create(c.Request.Context(), req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.Created(c, item)
+}
+
+func (h *Handler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req UpdateRoleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "角色名称不能为空")
+		return
+	}
+	item, err := h.service.Update(c.Request.Context(), id, req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.service.Delete(c.Request.Context(), id); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": true})
+}
+
+func (h *Handler) AssignPermissions(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req AssignPermissionsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	if err := h.service.AssignPermissions(c.Request.Context(), id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ListPermissions(c *gin.Context) {
+	items, err := h.service.ListPermissions(c.Request.Context())
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, items)
+}
+
+func parseID(c *gin.Context) (uint64, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		response.BadRequest(c, "ID 不正确")
+		return 0, false
+	}
+	return id, true
+}
+
+func writeError(c *gin.Context, err error) {
+	response.RecordError(c, err)
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库未连接")
+	case errors.Is(err, ErrProtectedRole):
+		response.BadRequest(c, "该角色为系统内置角色，不可删除")
+	case IsNotFound(err):
+		response.Error(c, http.StatusNotFound, "not_found", "角色不存在")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "角色管理服务暂时不可用")
+	}
+}
@@ -0,0 +1,267 @@
+package adminrole
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"hfb_sys/backend/internal/auditlog"
+	"hfb_sys/backend/internal/logging"
+	"hfb_sys/backend/internal/model"
+
+	"github.com/redis/go-redis/v9"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db    *gorm.DB
+	redis *redis.Client
+}
+
+func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
+	return &Repository{db: db, redis: redis}
+}
+
+func (r *Repository) List(ctx context.Context) ([]RoleDTO, error) {
+	db := r.db.WithContext(ctx)
+	var roles []model.Role
+	if err := db.Order("id ASC").Find(&roles).Error; err != nil {
+		return nil, err
+	}
+	result := make([]RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		var count int64
+		if role.Code == "super_admin" {
+			db.Model(&model.Permission{}).Count(&count)
+		} else {
+			db.Model(&model.RolePermission{}).Where("role_id = ?", role.ID).Count(&count)
+		}
+		result = append(result, RoleDTO{
+			ID:          role.ID,
+			Code:        role.Code,
+			Name:        role.Name,
+			Description: role.Description,
+			PermCount:   int(count),
+			CreatedAt:   role.CreatedAt,
+			UpdatedAt:   role.UpdatedAt,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uint64) (*RoleDTO, error) {
+	var role model.Role
+	if err := r.db.WithContext(ctx).First(&role, id).Error; err != nil {
+		return nil, err
+	}
+	var perms []PermissionDTO
+	var err error
+	if role.Code == "super_admin" {
+		perms, err = r.ListPermissions(ctx)
+	} else {
+		perms, err = r.getRolePermissions(ctx, id)
+	}
+	if err != nil {
+		return nil, err
+	}
+	dto := RoleDTO{
+		ID:          role.ID,
+		Code:        role.Code,
+		Name:        role.Name,
+		Description: role.Description,
+		PermCount:   len(perms),
+		Permissions: perms,
+		CreatedAt:   role.CreatedAt,
+		UpdatedAt:   role.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(ctx context.Context, req CreateRoleRequest) (*RoleDTO, error) {
+	role := model.Role{
+		Code:        req.Code,
+		Name:        req.Name,
+		Description: req.Description,
+	}
+	if err := r.db.WithContext(ctx).Create(&role).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, role.ID)
+}
+
+func (r *Repository) Update(ctx context.Context, id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
+	db := r.db.WithContext(ctx)
+	var role model.Role
+	if err := db.First(&role, id).Error; err != nil {
+		return nil, err
+	}
+	role.Name = req.Name
+	role.Description = req.Description
+	if err := db.Save(&role).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, id)
+}
+
+func (r *Repository) Delete(ctx context.Context, id uint64) error {
+	db := r.db.WithContext(ctx)
+	var role model.Role
+	if err := db.First(&role, id).Error; err != nil {
+		return err
+	}
+	if role.Code == "super_admin" {
+		return ErrProtectedRole
+	}
+	adminIDs, err := r.adminIDsByRole(ctx, id)
+	if err != nil {
+		return err
+	}
+	err = db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("role_id = ?", id).Delete(&model.RolePermission{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("role_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(&model.Role{}, id).Error; err != nil {
+			return err
+		}
+		return r.bumpAdminTokenVersions(tx, ctx, adminIDs, "role_deleted")
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidateAdminPermCaches(ctx, adminIDs)
+	return nil
+}
+
+func (r *Repository) AssignPermissions(ctx context.Context, roleID uint64, permIDs []uint64) error {
+	db := r.db.WithContext(ctx)
+	var role model.Role
+	if err := db.First(&role, roleID).Error; err != nil {
+		return err
+	}
+	adminIDs, err := r.adminIDsByRole(ctx, roleID)
+	if err != nil {
+		return err
+	}
+	err = db.Transaction(func(tx *gorm.DB) error {
+		if role.Code == "super_admin" {
+			var allPermIDs []uint64
+			if err := tx.Model(&model.Permission{}).Pluck("id", &allPermIDs).Error; err != nil {
+				return err
+			}
+			permIDs = allPermIDs
+		}
+		if err := tx.Where("role_id = ?", roleID).Delete(&model.RolePermission{}).Error; err != nil {
+			return err
+		}
+		for _, pid := range permIDs {
+			rp := model.RolePermission{RoleID: roleID, PermissionID: pid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&rp).Error; err != nil {
+				return err
+			}
+		}
+		return r.bumpAdminTokenVersions(tx, ctx, adminIDs, "role_permissions_changed")
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidateAdminPermCaches(ctx, adminIDs)
+	return nil
+}
+
+func (r *Repository) ListPermissions(ctx context.Context) ([]PermissionDTO, error) {
+	var perms []model.Permission
+	if err := r.db.WithContext(ctx).Order("resource ASC, action ASC").Find(&perms).Error; err != nil {
+		return nil, err
+	}
+	result := make([]PermissionDTO, 0, len(perms))
+	for _, p := range perms {
+		result = append(result, PermissionDTO{
+			ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) getRolePermissions(ctx context.Context, roleID uint64) ([]PermissionDTO, error) {
+	db := r.db.WithContext(ctx)
+	var rps []model.RolePermission
+	if err := db.Where("role_id = ?", roleID).Find(&rps).Error; err != nil {
+		return nil, err
+	}
+	if len(rps) == 0 {
+		return nil, nil
+	}
+	ids := make([]uint64, 0, len(rps))
+	for _, rp := range rps {
+		ids = append(ids, rp.PermissionID)
+	}
+	var perms []model.Permission
+	if err := db.Where("id IN ?", ids).Find(&perms).Error; err != nil {
+		return nil, err
+	}
+	result := make([]PermissionDTO, 0, len(perms))
+	for _, p := range perms {
+		result = append(result, PermissionDTO{
+			ID: p.ID, Code: p.Code, Name: p.Name, Resource: p.Resource, Action: p.Action,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) adminIDsByRole(ctx context.Context, roleID uint64) ([]uint64, error) {
+	var ids []uint64
+	err := r.db.WithContext(ctx).Model(&model.AdminUserRole{}).
+		Where("role_id = ?", roleID).
+		Pluck("admin_user_id", &ids).Error
+	return ids, err
+}
+
+func (r *Repository) bumpAdminTokenVersions(tx *gorm.DB, ctx context.Context, adminIDs []uint64, reason string) error {
+	if len(adminIDs) == 0 {
+		return nil
+	}
+	if err := tx.Model(&model.AdminUser{}).
+		Where("id IN ?", adminIDs).
+		UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error; err != nil {
+		return err
+	}
+	for _, adminID := range adminIDs {
+		bizID := adminID
+		if err := auditlog.Append(tx, auditlog.Entry{
+			ActorType: "admin",
+			ActorID:   logging.AdminIDFromContext(ctx),
+			Action:    "auth.token_version.bump",
+			BizType:   "admin_user",
+			BizID:     &bizID,
+			Meta:      auditlog.Meta{RequestID: logging.RequestIDFromContext(ctx)},
+			Detail: map[string]any{
+				"target_admin_id": adminID,
+				"reason":          reason,
+			},
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *Repository) invalidateAdminPermCaches(ctx context.Context, adminIDs []uint64) {
+	if r.redis == nil || len(adminIDs) == 0 {
+		return
+	}
+	keys := make([]string, 0, len(adminIDs))
+	for _, id := range adminIDs {
+		keys = append(keys, fmt.Sprintf("admin:perms:%d", id))
+	}
+	_ = r.redis.Del(ctx, keys...).Err()
+}
+
+var ErrProtectedRole = errors.New("protected role")
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}
@@ -0,0 +1,68 @@
+package adminrole
+
+import (
+	"context"
+	"errors"
+)
+
+var ErrDependencyUnavailable = errors.New("dependency unavailable")
+
+type Service struct {
+	repo *Repository
+}
+
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+func (s *Service) List(ctx context.Context) ([]RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.List(ctx)
+}
+
+func (s *Service) FindByID(ctx context.Context, id uint64) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.FindByID(ctx, id)
+}
+
+func (s *Service) Create(ctx context.Context, req CreateRoleRequest) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if req.Code == "" || req.Name == "" {
+		return nil, errors.New("code and name are required")
+	}
+	return s.repo.Create(ctx, req)
+}
+
+func (s *Service) Update(ctx context.Context, id uint64, req UpdateRoleRequest) (*RoleDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.Update(ctx, id, req)
+}
+
+func (s *Service) Delete(ctx context.Context, id uint64) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.Delete(ctx, id)
+}
+
+func (s *Service) AssignPermissions(ctx context.Context, roleID uint64, req AssignPermissionsRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.AssignPermissions(ctx, roleID, req.PermissionIDs)
+}
+
+func (s *Service) ListPermissions(ctx context.Context) ([]PermissionDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.ListPermissions(ctx)
+}