AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP/Service/S8/S8MasterDataAdapter.cs

using Admin.NET.Plugin.AiDOP.Entity.S0.Manufacturing;
using Admin.NET.Plugin.AiDOP.Entity.S0.Warehouse;
using Admin.NET.Plugin.AiDOP.Infrastructure;

namespace Admin.NET.Plugin.AiDOP.Service.S8;

/// <summary>
/// S8 主数据下拉：优先复用 S0 已落库主数据语义（部门等），无则返回空列表，不把「下拉查询」误建成独立业务表。
///
/// <para><b>S8-P0-3-MASTERDATA-TRUSTED-SCOPE-1 作用域合同</b>：三个入口的工厂边界
/// **一律由 <see cref="S8TrustedScopeResolver"/> 从认证身份解析**，
/// 客户端传入的 <c>factoryRefId</c> 只被视为筛选意图，**当前实现直接忽略、不承担授权作用**。</para>
///
/// <para>修复前（实测可被普通租户账号利用）：<c>GetEmployeesAsync</c> 是
/// <c>ClearFilter()</c> + <c>FactoryRefId == 客户端传入值</c>，
/// 于是 <c>GET /master-data/employees?factoryRefId=1000</c> 会返回 500 条**其它租户**员工的
/// 工号与真实姓名。</para>
/// </summary>
public class S8MasterDataAdapter : ITransient
{
    private readonly SqlSugarRepository<AdoS0DepartmentMaster> _deptRep;
    private readonly SqlSugarRepository<AdoS0EmployeeMaster> _empRep;
    private readonly SqlSugarRepository<AdoS0LineMaster> _lineRep;
    private readonly SqlSugarRepository<SysUser> _sysUserRep;

    public S8MasterDataAdapter(
        SqlSugarRepository<AdoS0DepartmentMaster> deptRep,
        SqlSugarRepository<AdoS0EmployeeMaster> empRep,
        SqlSugarRepository<AdoS0LineMaster> lineRep,
        SqlSugarRepository<SysUser> sysUserRep)
    {
        _deptRep = deptRep;
        _empRep = empRep;
        _lineRep = lineRep;
        _sysUserRep = sysUserRep;
    }

    /// <summary>
    /// S8-TENANT-ONLY-BATCH6：主数据下拉的边界由 <c>factory_ref_id</c> 改为 <c>tenant_id</c>。
    ///
    /// <para><b>这不是等价改写，是修一个真实越权。</b>真库取证（aidopdev，只读）：
    /// <c>factory_ref_id = 1000</c> 同时属于租户 <c>824585161322565</c> 与 <c>797403760988229</c>——
    /// 按工厂过滤会把另一租户的 613 名员工 / 210 个部门直接列进本租户的下拉框。
    /// 工厂号从来就不是隔离维度，之前只是没人对着数据看过。</para>
    ///
    /// <para>可用性同样已验证：三张表 <c>tenant_id</c> 100% 非空
    /// （EmployeeMaster 1105 行 / DepartmentMaster 239 行 / LineMaster 169 行，NULL 均为 0），
    /// 每个租户都有非空主数据，改判据不会把下拉打空。</para>
    /// </summary>
    public async Task<object> GetDepartmentsAsync(S8TrustedScope scope) =>
        await _deptRep.AsQueryable()
            .Where(x => x.TenantId == scope.TenantId)
            .Take(500)
            .Select(x => new { id = x.Id, code = x.Department, name = x.Descr ?? x.Department })
            .ToListAsync();

    public async Task<object> GetEmployeesAsync(S8TrustedScope scope)
    {
        // ClearFilter 保留：不依赖全局 multi-tenant AOP 的当前行为，边界改由本方法显式声明，
        // 结果与是否开启 AOP 过滤无关（两者判据同为 tenant_id == 可信租户）。
        // 边界**只能**来自可信作用域的 TenantId + IsActive，绝不接受调用方传入的 factoryRefId。
        var emps = await _empRep.AsQueryable().ClearFilter()
            .Where(x => x.TenantId == scope.TenantId && x.IsActive)
            .Take(500)
            .Select(x => new { x.Id, x.Name, x.Employee, x.SysUserId })
            .ToListAsync();

        var sysUserIds = emps.Where(e => e.SysUserId.HasValue && e.SysUserId.Value > 0)
            .Select(e => e.SysUserId!.Value).Distinct().ToList();

        Dictionary<long, (string? RealName, string? Account)> userMap = new();
        if (sysUserIds.Count > 0)
        {
            // 姓名水合：主键集合 + 可信租户双重边界（原实现只有主键集合）。
            var users = await _sysUserRep.AsQueryable().ClearFilter()
                .Where(u => sysUserIds.Contains(u.Id) && u.TenantId == scope.TenantId)
                .Select(u => new { u.Id, u.RealName, u.Account })
                .ToListAsync();
            userMap = users.ToDictionary(u => u.Id, u => ((string?)u.RealName, (string?)u.Account));
        }

        return emps.Select(e =>
        {
            var bound = e.SysUserId.HasValue && e.SysUserId.Value > 0 && userMap.ContainsKey(e.SysUserId.Value);
            string? sysUserName = null;
            if (bound)
            {
                var (realName, account) = userMap[e.SysUserId!.Value];
                sysUserName = !string.IsNullOrWhiteSpace(realName) ? realName : account;
            }
            return new
            {
                id = e.Id,
                name = e.Name ?? e.Employee,
                empCode = e.Employee,
                sysUserId = e.SysUserId,
                sysUserName,
                bindStatus = bound ? "BOUND" : "UNBOUND"
            };
        }).ToList();
    }

    /// <summary>产线下拉，边界同 <see cref="GetDepartmentsAsync"/>。</summary>
    public async Task<object> GetLinesAsync(S8TrustedScope scope) =>
        await _lineRep.AsQueryable()
            .Where(x => x.TenantId == scope.TenantId)
            .Take(500)
            .Select(x => new { id = x.Id, code = x.Line, name = x.Describe ?? x.Line })
            .ToListAsync();
}