AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP/Service/S6/S6LegacyFlowAuthorityMigrationService.cs

using System.Security.Cryptography;
using System.Text;
using System.Text.Json.Nodes;
using Admin.NET.Core;
using Admin.NET.Plugin.AiDOP.Entity.S6;
using Admin.NET.Plugin.ApprovalFlow;
using Microsoft.Extensions.Logging;

namespace Admin.NET.Plugin.AiDOP.Service.S6;

/// <summary>迁移结果。分项计数，运维要能看出「这次到底动了什么、什么被挡下了」。</summary>
public sealed class S6FlowAuthorityMigrationResult
{
    /// <summary>通过全部安全谓词、进入逐条处理的候选实例数。</summary>
    public int CandidatesSelected { get; set; }
    /// <summary>本次实际改写快照的实例数。</summary>
    public int Applied { get; set; }
    /// <summary>目标租户角色缺失 / 禁用 / 无同租户成员 / 角色不唯一 → 未改。</summary>
    public int BlockedByTargetAuthority { get; set; }
    /// <summary>回滚来源缺失或不唯一 → 未改。</summary>
    public int BlockedByRollbackSource { get; set; }
    /// <summary>UPDATE 影响行数 ≠ 1（期间被并发改动）→ 已回滚。</summary>
    public int BlockedByConcurrentModification { get; set; }
}

/// <summary>
/// S6-LEGACY-SNAPSHOT-MIGRATION-1：把**仍在运行**的 S6 流程实例快照里冻结的
/// 跨租户物理 RoleId 改写为 RoleCode，让它们能在租户本地化模型下继续流转。
///
/// <para><b>问题形态</b>（已取证，非推测）：<c>StartFlowCore</c> 落实例时把
/// <c>ApprovalFlow.FlowJson</c> 整体冻结进 <c>FlowJsonSnapshot</c>，此后**所有推进路径
/// 一律读快照、再不看定义**。因此 2026-09-14 的租户本地化迁移（把定义的 approverIds
/// 从默认租户物理 RoleId 改成 RoleCode）**只对新发起的实例生效**；此前发起且仍未走完的
/// 实例，快照里那个跨租户 RoleId 会被 <c>EnsureRoleAuthorityTenantScopedAsync</c>
/// 直接 fail-closed 拒绝，单据永久卡死。</para>
///
/// <para><b>为什么不做 runtime auto-heal</b>：引擎里「跨租户 RoleId 一律拒绝」是刚建立的
/// 门禁，放宽它会同时影响**新**实例，等于把门拆掉；而运行时隐式把 A 角色当 B 角色执行，
/// 会让「执行的」与「快照里展示的」永久分离，比显式改写更难解释。故本服务是
/// <b>显式、一次性、可审计的数据迁移</b>，不是 resolver 兼容层。</para>
///
/// <para><b>批次边界（关键）</b>：只处理 <see cref="BatchCutoff"/> 之前发起的实例。
/// 该时点之后发起的实例本就会拿到 RoleCode 快照 —— 若之后仍出现跨租户 RoleId，
/// 那是**新的 authority regression**，必须让它响亮地失败、被人看见，
/// 绝不能被本服务静默治好。这条边界是「一次性迁移」与「长期 auto-heal」的分界线。</para>
///
/// <para><b>只修坏的，不碰好的</b>：终态实例一律不动（对 runtime 已无影响，改了没用，
/// 却百分之百是纯历史记录）；同租户的物理 RoleId 也不动（numeric ≠ bad）。</para>
/// </summary>
public class S6LegacyFlowAuthorityMigrationService : ITransient
{
    /// <summary>与 <c>FlowEngineService.TenantStrictRoleBizTypes</c> 逐字一致：只有被严格守卫的链才需要迁。</summary>
    internal static IReadOnlyList<string> TargetBizTypes { get; } =
        new List<string> { "IPQC_INSPECTION", "S6_PROCESS_INSPECTION" };

    /// <summary>
    /// 批次边界。租户本地 RoleCode 定义于 2026-09-14 发布，此后发起的实例快照本就是 RoleCode。
    /// 之后再出现跨租户 RoleId = 新缺陷，不属本次迁移范围，必须 fail-closed 暴露。
    /// </summary>
    private static readonly DateTime BatchCutoff = new(2026, 9, 14, 0, 0, 0, DateTimeKind.Unspecified);

    private const string BatchPrefix = "S6-LEGACY-SNAPSHOT-MIGRATION-1";

    private readonly ISqlSugarClient _db;
    private readonly SqlSugarRepository<AdoS6FlowAuthorityMigrationLog> _logRep;
    private readonly ILogger<S6LegacyFlowAuthorityMigrationService> _logger;

    public S6LegacyFlowAuthorityMigrationService(
        ISqlSugarClient db,
        SqlSugarRepository<AdoS6FlowAuthorityMigrationLog> logRep,
        ILogger<S6LegacyFlowAuthorityMigrationService> logger)
    {
        _db = db;
        _logRep = logRep;
        _logger = logger;
    }

    /// <summary>
    /// 选出候选（只读，不写任何东西）。Apply 与 dry-run 共用同一段谓词，
    /// 避免「预演看到的」和「实际改的」是两套逻辑。
    /// </summary>
    public async Task<List<S6MigrationCandidate>> SelectCandidatesAsync()
    {
        var candidates = new List<S6MigrationCandidate>();

        // ① 运行中 + 批次边界内。ApprovalFlowInstance 无 TenantId 列，租户后面由业务实体反查。
        // bizTypes / cutoff 取局部变量：SqlSugar 的表达式解析器无法把静态成员翻成 SQL 参数。
        var bizTypes = TargetBizTypes.ToList();
        var cutoff = BatchCutoff;
        var instances = await _db.Queryable<ApprovalFlowInstance>().ClearFilter()
            .Where(x => bizTypes.Contains(x.BizType)
                        && x.Status == FlowInstanceStatusEnum.Running
                        && x.StartTime < cutoff)
            .ToListAsync();

        foreach (var inst in instances)
        {
            // ② ACTIVE 的完整判据：不能只看 Status —— 终态实例的 CurrentNodeId 可能仍停在
            //    N3_* 而非 end（CompleteInstance 不重写该字段），只看状态字段会误判。
            var hasPending = await _db.Queryable<ApprovalFlowTask>().ClearFilter()
                .AnyAsync(t => t.InstanceId == inst.Id && t.Status == FlowTaskStatusEnum.Pending);
            if (!hasPending) continue;

            // ③ Effective Tenant 必须由业务实体反查，禁止取登录用户租户 —— 迁移的租户判定
            //    绝不能复制「推进时按登录租户解析」那个既有结构缺陷。
            var tenantId = await ResolveEffectiveTenantAsync(inst.BizType, inst.BizId);
            if (tenantId is not > 0) continue;

            // ④ 快照里是否还存在「Role 节点 + 纯数字 token」。这同时就是幂等判据的补集：
            //    迁完之后本条恒为 false，第二次运行自然选不中。
            var refs = ParseNumericRoleRefs(inst.FlowJsonSnapshot);
            if (refs.Count == 0) continue;

            candidates.Add(new S6MigrationCandidate
            {
                Instance = inst,
                EffectiveTenantId = tenantId.Value,
                NumericRefs = refs,
            });
        }

        return candidates;
    }

    /// <summary>执行迁移。每个候选独立事务：留证 INSERT 与快照 UPDATE 原子提交，任一失败整条回滚。</summary>
    public async Task<S6FlowAuthorityMigrationResult> MigrateAsync(CancellationToken ct = default)
    {
        var result = new S6FlowAuthorityMigrationResult();
        var batch = $"{BatchPrefix}@{DateTime.Now:yyyyMMddHHmmss}";

        List<S6MigrationCandidate> candidates;
        try
        {
            candidates = await SelectCandidatesAsync();
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "S6 legacy flow authority migration: 候选选取失败，本次跳过");
            return result;
        }

        result.CandidatesSelected = candidates.Count;
        foreach (var c in candidates)
        {
            if (ct.IsCancellationRequested) break;
            await MigrateOneAsync(c, batch, result);
        }

        // 无条件记一行汇总 —— 「本次 0 候选 0 改动」本身就是要被看见的结论：
        // 迁移已收敛的证据，以及「未来若冒出新候选会被立刻发现」的可观测性基础。
        _logger.LogInformation(
            "S6LegacyFlowAuthorityMigration batch={Batch} selected={Selected} applied={Applied} "
            + "blockedTargetAuthority={BlockedTarget} blockedRollbackSource={BlockedRollback} blockedConcurrent={BlockedConcurrent}",
            batch, result.CandidatesSelected, result.Applied,
            result.BlockedByTargetAuthority, result.BlockedByRollbackSource, result.BlockedByConcurrentModification);

        return result;
    }

    private async Task MigrateOneAsync(S6MigrationCandidate c, string batch, S6FlowAuthorityMigrationResult result)
    {
        var inst = c.Instance;
        var before = inst.FlowJsonSnapshot ?? string.Empty;
        var beforeMd5 = Md5(before);

        // ── Gate 1：逐 token 解析目标角色。任一 token 映射不出来 → 整条实例不迁（禁止部分迁移，
        //    否则会留下半新半旧的快照，比全旧更难排查）。
        var mappings = new List<string>();
        var tokenMap = new Dictionary<string, string>(StringComparer.Ordinal);
        foreach (var r in c.NumericRefs)
        {
            foreach (var token in r.NumericTokens)
            {
                if (tokenMap.ContainsKey(token)) continue;

                var legacyRole = await _db.Queryable<SysRole>().ClearFilter()
                    .Where(x => x.Id == long.Parse(token)).FirstAsync();
                if (legacyRole == null)
                {
                    await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                        $"legacy RoleId {token} 在 SysRole 中不存在", result, r => result.BlockedByTargetAuthority++);
                    return;
                }

                // 同租户的物理 RoleId 是合法引用，不是缺陷 —— 不得因为「是数字」就改它。
                if (legacyRole.TenantId == c.EffectiveTenantId)
                {
                    await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                        $"RoleId {token} 属于本租户 {c.EffectiveTenantId}，非跨租户引用，不在迁移范围",
                        result, _ => result.BlockedByTargetAuthority++);
                    return;
                }

                var code = legacyRole.Code;
                if (string.IsNullOrWhiteSpace(code))
                {
                    await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                        $"legacy RoleId {token} 无 Code，无法映射", result, _ => result.BlockedByTargetAuthority++);
                    return;
                }

                // Gate 2：目标租户下该 Code 必须**恰好一个**启用角色。不得 First() 随便挑。
                var targets = await _db.Queryable<SysRole>().ClearFilter()
                    .Where(x => x.TenantId == c.EffectiveTenantId && x.Code == code && x.Status == StatusEnum.Enable)
                    .ToListAsync();
                if (targets.Count != 1)
                {
                    await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                        targets.Count == 0
                            ? $"目标租户 {c.EffectiveTenantId} 下不存在启用的 {code}"
                            : $"目标租户 {c.EffectiveTenantId} 下 {code} 有 {targets.Count} 个，AMBIGUOUS TARGET ROLE",
                        result, _ => result.BlockedByTargetAuthority++);
                    return;
                }
                var target = targets[0];

                // Gate 3：目标角色必须至少有一个**同租户**成员，否则迁完仍旧解析 0 人。
                var memberIds = await _db.Queryable<SysUserRole>().ClearFilter()
                    .Where(x => x.RoleId == target.Id).Select(x => x.UserId).ToListAsync();
                var sameTenantMembers = memberIds.Count == 0 ? 0
                    : await _db.Queryable<SysUser>().ClearFilter()
                        .CountAsync(u => memberIds.Contains(u.Id) && u.TenantId == c.EffectiveTenantId);
                if (sameTenantMembers == 0)
                {
                    await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                        $"目标角色 {code}@{c.EffectiveTenantId}（RoleId {target.Id}）无同租户成员",
                        result, _ => result.BlockedByTargetAuthority++);
                    return;
                }

                tokenMap[token] = code;
                mappings.Add($"node={r.NodeId};{token}=>{code}@{target.Id};members={sameTenantMembers}");
            }
        }

        // ── Gate 4：回滚来源必须唯一且与当前快照逐字节一致。ApprovalFlowVersion 全库存在
        //    (FlowId,Version) 重复行，该表也没有唯一约束 —— 这道门禁不是形式主义。
        var versionRows = await _db.Queryable<ApprovalFlowVersion>().ClearFilter()
            .Where(v => v.FlowId == inst.FlowId && v.Version == inst.FlowVersion).ToListAsync();
        var usable = versionRows.Where(v => Md5(v.FlowJson ?? string.Empty) == beforeMd5).ToList();
        if (versionRows.Count != 1 || usable.Count != 1)
        {
            await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_ROLLBACK_SOURCE",
                $"ApprovalFlowVersion(FlowId={inst.FlowId},Version={inst.FlowVersion}) 命中 {versionRows.Count} 行、"
                + $"其中与当前快照 MD5 一致 {usable.Count} 行；要求恰好 1/1",
                result, _ => result.BlockedByRollbackSource++);
            return;
        }
        var rollbackSource = $"ApprovalFlowVersion#{usable[0].Id}";

        // ── 结构化改写：只动 Role 节点的 approverIds，其余一律不碰。禁止字符串替换。
        var after = RewriteAuthority(before, tokenMap);
        if (after == null || after == before)
        {
            await BlockAsync(c, batch, beforeMd5, mappings, "BLOCKED_TARGET_AUTHORITY",
                "结构化改写未产生变化或解析失败", result, _ => result.BlockedByTargetAuthority++);
            return;
        }
        var afterMd5 = Md5(after);

        // ── 留证 + 改写同一事务。任一失败整条回滚：不接受「改了但没留证」，
        //    也不接受「留证说改了但实际没改」。
        var tran = await _db.AsTenant().UseTranAsync(async () =>
        {
            await _logRep.AsInsertable(new AdoS6FlowAuthorityMigrationLog
            {
                MigrationBatch = batch,
                InstanceId = inst.Id,
                BizType = inst.BizType,
                BizId = inst.BizId,
                EffectiveTenantId = c.EffectiveTenantId,
                BeforeSnapshot = before,
                AfterSnapshot = after,
                BeforeMd5 = beforeMd5,
                AfterMd5 = afterMd5,
                AuthorityMapping = string.Join(" | ", mappings),
                RollbackSource = rollbackSource,
                Reason = "运行中实例的快照冻结了跨租户物理 RoleId，被 TenantStrictRoleBizTypes 守卫 fail-closed；"
                         + "改写为 RoleCode 后由引擎在本租户内重新解析",
                Outcome = "APPLIED",
            }).ExecuteCommandAsync();

            // 并发守卫：实例表无 version/checksum，只能用「改前 MD5 + 状态」作乐观锁。
            // 用裸 SQL 精确只改这一列，避免整实体 Updateable 把过期读到的其它列一并回写。
            var affected = await _db.Ado.ExecuteCommandAsync(
                """
                UPDATE ApprovalFlowInstance
                SET FlowJsonSnapshot=@after
                WHERE Id=@id AND Status=@running AND MD5(FlowJsonSnapshot)=@beforeMd5
                """,
                new List<SugarParameter>
                {
                    new("@after", after), new("@id", inst.Id),
                    new("@running", (int)FlowInstanceStatusEnum.Running), new("@beforeMd5", beforeMd5),
                });
            if (affected != 1)
                throw Oops.Oh($"CONCURRENT MODIFICATION：实例 {inst.Id} 期间被改动，affected={affected}");
        });

        if (!tran.IsSuccess)
        {
            result.BlockedByConcurrentModification++;
            _logger.LogWarning(tran.ErrorException,
                "S6LegacyFlowAuthorityMigration: 实例 {InstanceId} 迁移失败已整体回滚", inst.Id);
            return;
        }

        result.Applied++;
        _logger.LogInformation(
            "S6LegacyFlowAuthorityMigration APPLIED instance={InstanceId} bizType={BizType} bizId={BizId} "
            + "tenant={Tenant} beforeMd5={BeforeMd5} afterMd5={AfterMd5} mapping={Mapping}",
            inst.Id, inst.BizType, inst.BizId, c.EffectiveTenantId, beforeMd5, afterMd5, string.Join(" | ", mappings));
    }

    /// <summary>挡下的候选同样留证 —— 「为什么没迁」和「为什么迁了」一样需要能回答。</summary>
    private async Task BlockAsync(S6MigrationCandidate c, string batch, string beforeMd5,
        List<string> mappings, string outcome, string reason,
        S6FlowAuthorityMigrationResult result, Action<S6FlowAuthorityMigrationResult> bump)
    {
        bump(result);
        await _logRep.AsInsertable(new AdoS6FlowAuthorityMigrationLog
        {
            MigrationBatch = batch,
            InstanceId = c.Instance.Id,
            BizType = c.Instance.BizType,
            BizId = c.Instance.BizId,
            EffectiveTenantId = c.EffectiveTenantId,
            BeforeSnapshot = c.Instance.FlowJsonSnapshot,
            BeforeMd5 = beforeMd5,
            AuthorityMapping = mappings.Count == 0 ? null : string.Join(" | ", mappings),
            Reason = reason,
            Outcome = outcome,
        }).ExecuteCommandAsync();
        _logger.LogWarning("S6LegacyFlowAuthorityMigration {Outcome} instance={InstanceId} reason={Reason}",
            outcome, c.Instance.Id, reason);
    }

    /// <summary>
    /// Effective Tenant 由业务实体反查。<c>ApprovalFlowInstance</c> 自身没有 TenantId 列，
    /// 而推进时引擎用的是登录租户 —— 迁移绝不能沿用那条路径，否则会把租户判定建立在
    /// 「谁在执行迁移」而不是「这条单据属于谁」之上。
    /// </summary>
    private async Task<long?> ResolveEffectiveTenantAsync(string bizType, long bizId) => bizType switch
    {
        "S6_PROCESS_INSPECTION" => await _db.Ado.SqlQuerySingleAsync<long?>(
            "SELECT tenant_id FROM ado_s6_process_inspection_bill WHERE id=@id LIMIT 1",
            new List<SugarParameter> { new("@id", bizId) }),
        "IPQC_INSPECTION" => await _db.Ado.SqlQuerySingleAsync<long?>(
            "SELECT tenant_id FROM qms_gcjyd WHERE id=@id LIMIT 1",
            new List<SugarParameter> { new("@id", bizId) }),
        _ => null,
    };

    /// <summary>
    /// 解析快照中「approverType==Role 且 approverIds 含纯数字 token」的节点。
    ///
    /// <para>必须按 JSON 结构解析、结合 approverType 判断语义，<b>不能只 grep 数字</b>：
    /// 实测同一个 Id 既可能是合法 SysRole.Id 又是合法 SysUser.Id，而
    /// <c>SpecificUser</c> / <c>Department</c> 节点里的数字分别是 UserId / OrgId，
    /// 纯数字匹配会把它们误判成 RoleId。</para>
    /// </summary>
    internal static List<S6NumericRoleRef> ParseNumericRoleRefs(string? snapshot)
    {
        var refs = new List<S6NumericRoleRef>();
        if (string.IsNullOrWhiteSpace(snapshot)) return refs;

        JsonNode? root;
        try { root = JsonNode.Parse(snapshot); }
        catch { return refs; }

        if (root?["nodes"] is not JsonArray nodes) return refs;

        foreach (var node in nodes)
        {
            var props = node?["properties"];
            if (props == null) continue;
            if (props["approverType"]?.GetValue<string>() != nameof(ApproverTypeEnum.Role)) continue;

            var ids = props["approverIds"]?.GetValue<string>();
            if (string.IsNullOrWhiteSpace(ids)) continue;

            var numeric = ids.Split(',', StringSplitOptions.RemoveEmptyEntries)
                .Select(s => s.Trim())
                .Where(s => s.Length > 0 && long.TryParse(s, out var v) && v > 0)
                .Distinct(StringComparer.Ordinal)
                .ToList();
            if (numeric.Count == 0) continue;

            refs.Add(new S6NumericRoleRef
            {
                NodeId = node?["id"]?.GetValue<string>() ?? string.Empty,
                ApproverIds = ids,
                NumericTokens = numeric,
            });
        }

        return refs;
    }

    /// <summary>
    /// 结构化改写：只把 Role 节点 approverIds 里的数字 token 换成对应 RoleCode，
    /// 保持 token 原顺序与原数量。节点 id / 名称 / edges / 网关条件 / approverNames 一概不动。
    /// </summary>
    internal static string? RewriteAuthority(string snapshot, IReadOnlyDictionary<string, string> tokenMap)
    {
        JsonNode? root;
        try { root = JsonNode.Parse(snapshot); }
        catch { return null; }

        if (root?["nodes"] is not JsonArray nodes) return null;

        var changed = false;
        foreach (var node in nodes)
        {
            var props = node?["properties"];
            if (props == null) continue;
            if (props["approverType"]?.GetValue<string>() != nameof(ApproverTypeEnum.Role)) continue;

            var ids = props["approverIds"]?.GetValue<string>();
            if (string.IsNullOrWhiteSpace(ids)) continue;

            var tokens = ids.Split(',', StringSplitOptions.RemoveEmptyEntries).Select(s => s.Trim()).ToList();
            if (tokens.Count == 0) continue;

            var rewritten = tokens.Select(t => tokenMap.TryGetValue(t, out var code) ? code : t).ToList();
            var joined = string.Join(",", rewritten);
            if (joined == ids) continue;

            props["approverIds"] = joined;
            changed = true;
        }

        return changed ? root!.ToJsonString() : null;
    }

    private static string Md5(string s)
    {
        var bytes = MD5.HashData(Encoding.UTF8.GetBytes(s));
        return Convert.ToHexString(bytes).ToLowerInvariant();
    }
}

/// <summary>候选实例 + 其反查出的租户 + 快照中待迁的数字角色引用。</summary>
public sealed class S6MigrationCandidate
{
    public ApprovalFlowInstance Instance { get; set; } = null!;
    public long EffectiveTenantId { get; set; }
    public List<S6NumericRoleRef> NumericRefs { get; set; } = new();
}

/// <summary>快照中一个 Role 节点里的数字角色引用。</summary>
public sealed class S6NumericRoleRef
{
    public string NodeId { get; set; } = string.Empty;
    public string ApproverIds { get; set; } = string.Empty;
    public List<string> NumericTokens { get; set; } = new();
}