297 lines
11 KiB
Go
297 lines
11 KiB
Go
package service
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"regexp"
|
|
"sort"
|
|
"strings"
|
|
|
|
"affiliate_dash/internal/model"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
"gorm.io/gorm"
|
|
"gorm.io/gorm/clause"
|
|
)
|
|
|
|
type AddMemberInput struct {
|
|
UserID uint
|
|
Username string
|
|
Password string
|
|
Nickname string
|
|
Role string
|
|
IsDefault bool
|
|
}
|
|
|
|
type UpdateMemberInput struct {
|
|
Role string
|
|
Status int
|
|
IsDefault bool
|
|
}
|
|
|
|
type MerchantRoleInput struct {
|
|
Code string
|
|
Name string
|
|
Permissions []string
|
|
}
|
|
|
|
var merchantRoleCodePattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{1,63}$`)
|
|
|
|
func merchantPermissionsText(permissions []string) (string, error) {
|
|
allowed := map[string]struct{}{
|
|
model.PermissionProductsManage: {}, model.PermissionOrdersManage: {}, model.PermissionWalletView: {},
|
|
model.PermissionWalletLedger: {}, model.PermissionRechargeManage: {}, model.PermissionAPIManage: {},
|
|
model.PermissionCallbacksManage: {}, model.PermissionMembersManage: {},
|
|
}
|
|
set := make(map[string]struct{}, len(permissions))
|
|
for _, permission := range permissions {
|
|
permission = strings.TrimSpace(permission)
|
|
if _, ok := allowed[permission]; !ok {
|
|
return "", errors.New("包含无效的角色权限")
|
|
}
|
|
set[permission] = struct{}{}
|
|
}
|
|
items := make([]string, 0, len(set))
|
|
for permission := range set {
|
|
items = append(items, permission)
|
|
}
|
|
sort.Strings(items)
|
|
return strings.Join(items, ","), nil
|
|
}
|
|
|
|
func (s *MerchantService) ListRoles(merchantID uint) ([]model.MerchantRole, error) {
|
|
roles := builtinMerchantRoles(merchantID)
|
|
var custom []model.MerchantRole
|
|
if err := s.db.Where("merchant_id = ?", merchantID).Order("id ASC").Find(&custom).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return append(roles, custom...), nil
|
|
}
|
|
|
|
func builtinMerchantRoles(merchantID uint) []model.MerchantRole {
|
|
permissions, _ := (&TenantService{}).MerchantRolePermissions(merchantID, model.MemberRoleOwner)
|
|
items := make([]string, 0, len(permissions))
|
|
for permission := range permissions {
|
|
items = append(items, permission)
|
|
}
|
|
sort.Strings(items)
|
|
return []model.MerchantRole{{MerchantID: merchantID, Code: model.MemberRoleOwner, Name: "负责人", Permissions: strings.Join(items, ","), Status: 1}}
|
|
}
|
|
|
|
func createDefaultMerchantRoles(tx *gorm.DB, merchantID uint) error {
|
|
roles := []model.MerchantRole{
|
|
{MerchantID: merchantID, Code: model.MemberRoleOperator, Name: "运营", Permissions: strings.Join([]string{model.PermissionAPIManage, model.PermissionCallbacksManage, model.PermissionOrdersManage, model.PermissionProductsManage, model.PermissionWalletView}, ","), Status: 1},
|
|
{MerchantID: merchantID, Code: model.MemberRoleFinance, Name: "财务", Permissions: strings.Join([]string{model.PermissionRechargeManage, model.PermissionWalletLedger, model.PermissionWalletView}, ","), Status: 1},
|
|
{MerchantID: merchantID, Code: "support", Name: "客服", Permissions: model.PermissionOrdersManage, Status: 1},
|
|
}
|
|
return tx.Clauses(clause.OnConflict{Columns: []clause.Column{{Name: "merchant_id"}, {Name: "code"}}, DoNothing: true}).Create(&roles).Error
|
|
}
|
|
|
|
func (s *MerchantService) CreateRole(merchantID uint, in MerchantRoleInput, actorUserID uint) (*model.MerchantRole, error) {
|
|
in.Code = strings.ToLower(strings.TrimSpace(in.Code))
|
|
in.Name = strings.TrimSpace(in.Name)
|
|
if !merchantRoleCodePattern.MatchString(in.Code) {
|
|
return nil, errors.New("角色编码需为 2-64 位小写字母、数字或连字符")
|
|
}
|
|
if isReservedMerchantRoleCode(in.Code) {
|
|
return nil, errors.New("角色编码不能使用系统保留角色")
|
|
}
|
|
if in.Name == "" {
|
|
return nil, errors.New("角色名称不能为空")
|
|
}
|
|
permissions, err := merchantPermissionsText(in.Permissions)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
role := &model.MerchantRole{MerchantID: merchantID, Code: in.Code, Name: in.Name, Permissions: permissions, Status: 1}
|
|
err = s.db.Transaction(func(tx *gorm.DB) error {
|
|
var merchant model.Merchant
|
|
if err := tx.Where("id = ? AND status = ?", merchantID, model.MerchantStatusActive).First(&merchant).Error; err != nil {
|
|
return errors.New("商户不存在或已禁用")
|
|
}
|
|
if err := tx.Create(role).Error; err != nil {
|
|
return err
|
|
}
|
|
return writeAudit(tx, &merchantID, &actorUserID, nil, "merchant.role.create", "merchant_role", fmt.Sprint(role.ID), map[string]string{"code": role.Code})
|
|
})
|
|
if err != nil {
|
|
if strings.Contains(err.Error(), "duplicate key") {
|
|
return nil, errors.New("角色编码已存在")
|
|
}
|
|
return nil, err
|
|
}
|
|
return role, nil
|
|
}
|
|
|
|
func isReservedMerchantRoleCode(code string) bool {
|
|
switch code {
|
|
case model.MemberRoleOwner, model.MemberRoleViewer, model.MemberRoleOperator, model.MemberRoleFinance, "support":
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
func (s *MerchantService) UpdateRole(merchantID, roleID uint, in MerchantRoleInput, actorUserID uint) (*model.MerchantRole, error) {
|
|
in.Name = strings.TrimSpace(in.Name)
|
|
if in.Name == "" {
|
|
return nil, errors.New("角色名称不能为空")
|
|
}
|
|
permissions, err := merchantPermissionsText(in.Permissions)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var role model.MerchantRole
|
|
err = s.db.Transaction(func(tx *gorm.DB) error {
|
|
if err := tx.Where("id = ? AND merchant_id = ?", roleID, merchantID).First(&role).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return errors.New("角色不存在")
|
|
}
|
|
return err
|
|
}
|
|
if err := tx.Model(&role).Updates(map[string]interface{}{"name": in.Name, "permissions": permissions}).Error; err != nil {
|
|
return err
|
|
}
|
|
return writeAudit(tx, &merchantID, &actorUserID, nil, "merchant.role.update", "merchant_role", fmt.Sprint(roleID), map[string]string{"code": role.Code})
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &role, nil
|
|
}
|
|
|
|
func (s *MerchantService) AddMember(merchantID uint, in AddMemberInput, actorUserID uint) (*model.MerchantMember, error) {
|
|
in.Role = strings.TrimSpace(in.Role)
|
|
if in.Role == "" {
|
|
return nil, errors.New("商户成员角色不能为空")
|
|
}
|
|
if in.UserID == 0 && strings.TrimSpace(in.Username) == "" {
|
|
return nil, errors.New("请选择已有账号或填写新员工账号")
|
|
}
|
|
member := &model.MerchantMember{MerchantID: merchantID, Role: in.Role, Status: 1, IsDefault: in.IsDefault}
|
|
err := s.db.Transaction(func(tx *gorm.DB) error {
|
|
var merchant model.Merchant
|
|
if err := tx.Where("id = ? AND status = ?", merchantID, model.MerchantStatusActive).First(&merchant).Error; err != nil {
|
|
return errors.New("商户不存在或已禁用")
|
|
}
|
|
var user model.User
|
|
createdUser := false
|
|
if in.UserID != 0 {
|
|
if err := tx.Where("id = ? AND status = ?", in.UserID, 1).First(&user).Error; err != nil {
|
|
return errors.New("用户不存在或已禁用")
|
|
}
|
|
} else {
|
|
username := strings.TrimSpace(in.Username)
|
|
if len(username) < 3 {
|
|
return errors.New("员工用户名至少 3 位")
|
|
}
|
|
if len(in.Password) < 6 {
|
|
return errors.New("员工密码至少 6 位")
|
|
}
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
user = model.User{Username: username, PasswordHash: string(hash), Nickname: fallbackName(in.Nickname, username), Role: model.RoleMerchant, Status: 1}
|
|
if err := tx.Create(&user).Error; err != nil {
|
|
return errors.New("员工用户名已存在")
|
|
}
|
|
createdUser = true
|
|
}
|
|
if _, err := (&TenantService{db: tx}).MerchantRolePermissions(merchantID, in.Role); err != nil {
|
|
return err
|
|
}
|
|
member.UserID = user.ID
|
|
// 新建员工仅属于当前商户，登录时应直接进入该商户。
|
|
member.IsDefault = in.IsDefault || createdUser
|
|
if err := tx.Clauses(clause.OnConflict{
|
|
Columns: []clause.Column{{Name: "merchant_id"}, {Name: "user_id"}},
|
|
DoUpdates: clause.Assignments(map[string]interface{}{
|
|
"role": in.Role,
|
|
"status": 1,
|
|
"is_default": in.IsDefault,
|
|
}),
|
|
}).Create(member).Error; err != nil {
|
|
return err
|
|
}
|
|
return writeAudit(tx, &merchantID, &actorUserID, nil, "merchant.member.upsert", "merchant_member", fmt.Sprintf("%d:%d", merchantID, user.ID), map[string]string{"role": in.Role})
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := s.db.Preload("User").Where("merchant_id = ? AND user_id = ?", merchantID, member.UserID).First(member).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return member, nil
|
|
}
|
|
|
|
func (s *MerchantService) ListMembers(merchantID uint) ([]model.MerchantMember, error) {
|
|
var members []model.MerchantMember
|
|
err := s.db.Preload("User").Where("merchant_id = ?", merchantID).Order("id ASC").Find(&members).Error
|
|
return members, err
|
|
}
|
|
|
|
// UpdateMember updates a member's relationship with one merchant without changing the login account.
|
|
func (s *MerchantService) UpdateMember(merchantID, memberID uint, in UpdateMemberInput, actorUserID uint) (*model.MerchantMember, error) {
|
|
in.Role = strings.TrimSpace(in.Role)
|
|
if in.Role == "" {
|
|
return nil, errors.New("商户成员角色不能为空")
|
|
}
|
|
if in.Status != 0 && in.Status != 1 {
|
|
return nil, errors.New("成员状态无效")
|
|
}
|
|
var member model.MerchantMember
|
|
err := s.db.Transaction(func(tx *gorm.DB) error {
|
|
if err := tx.Where("id = ? AND merchant_id = ?", memberID, merchantID).First(&member).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return errors.New("成员不存在")
|
|
}
|
|
return err
|
|
}
|
|
if member.Role == model.MemberRoleOwner {
|
|
return errors.New("负责人不能在成员管理中修改")
|
|
}
|
|
if member.UserID == actorUserID {
|
|
return errors.New("不能修改当前登录账号")
|
|
}
|
|
if _, err := (&TenantService{db: tx}).MerchantRolePermissions(merchantID, in.Role); err != nil {
|
|
return err
|
|
}
|
|
updates := map[string]interface{}{"role": in.Role, "status": in.Status, "is_default": in.IsDefault}
|
|
if err := tx.Model(&member).Updates(updates).Error; err != nil {
|
|
return err
|
|
}
|
|
return writeAudit(tx, &merchantID, &actorUserID, nil, "merchant.member.update", "merchant_member", fmt.Sprint(memberID), map[string]string{"role": in.Role, "status": fmt.Sprint(in.Status)})
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := s.db.Preload("User").First(&member, member.ID).Error; err != nil {
|
|
return nil, err
|
|
}
|
|
return &member, nil
|
|
}
|
|
|
|
// RemoveMember removes only the selected merchant relationship and retains the account for audit and other merchants.
|
|
func (s *MerchantService) RemoveMember(merchantID, memberID, actorUserID uint) error {
|
|
return s.db.Transaction(func(tx *gorm.DB) error {
|
|
var member model.MerchantMember
|
|
if err := tx.Where("id = ? AND merchant_id = ?", memberID, merchantID).First(&member).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return errors.New("成员不存在")
|
|
}
|
|
return err
|
|
}
|
|
if member.Role == model.MemberRoleOwner {
|
|
return errors.New("负责人不能移除")
|
|
}
|
|
if member.UserID == actorUserID {
|
|
return errors.New("不能移除当前登录账号")
|
|
}
|
|
if err := tx.Delete(&member).Error; err != nil {
|
|
return err
|
|
}
|
|
return writeAudit(tx, &merchantID, &actorUserID, nil, "merchant.member.remove", "merchant_member", fmt.Sprint(memberID), nil)
|
|
})
|
|
}
|