AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP/Service/S8/S8RoleConfigService.cs

using Admin.NET.Plugin.AiDOP.Entity.S8;
using Admin.NET.Plugin.AiDOP.Infrastructure;

namespace Admin.NET.Plugin.AiDOP.Service.S8;

public class S8RoleConfigService : ITransient
{
    private readonly SqlSugarRepository<AdoS8RolePermissionConfig> _rep;
    private readonly SqlSugarRepository<SysRole> _sysRoleRep;

    public S8RoleConfigService(
        SqlSugarRepository<AdoS8RolePermissionConfig> rep,
        SqlSugarRepository<SysRole> sysRoleRep)
    {
        _rep = rep;
        _sysRoleRep = sysRoleRep;
    }

    public async Task<List<AdoS8RolePermissionConfig>> ListAsync(long tenantId, long factoryId) =>
        await _rep.AsQueryable()
            .Where(x => x.TenantId == tenantId && x.FactoryId == factoryId)
            .ToListAsync();

    // S8-TENANT-FACTORY-P0-CLOSURE-1：归属一律由服务端可信作用域盖章，忽略 body.TenantId / body.FactoryId。
    public async Task<AdoS8RolePermissionConfig> CreateAsync(AdoS8RolePermissionConfig body, S8TrustedScope scope)
    {
        if (string.IsNullOrWhiteSpace(body.RoleCode)) throw new S8BizException("角色编码必填");
        body.TenantId = scope.TenantId;
        body.FactoryId = scope.FactoryId;
        var exists = await _rep.AsQueryable()
            .AnyAsync(x => x.TenantId == body.TenantId && x.FactoryId == body.FactoryId && x.RoleCode == body.RoleCode);
        if (exists) throw new S8BizException("角色编码已存在");
        body.Id = 0;
        body.CreatedAt = DateTime.Now;
        await _rep.InsertAsync(body);
        return body;
    }

    // S8-TENANT-FACTORY-P0-CLOSURE-1：按 Id + 可信作用域绑行；越权 Id 视为不存在，归属不可被 body 改写。
    public async Task<AdoS8RolePermissionConfig> UpdateAsync(long id, AdoS8RolePermissionConfig body, S8TrustedScope scope)
    {
        var e = await LoadScopedAsync(id, scope);
        if (string.IsNullOrWhiteSpace(body.RoleCode)) throw new S8BizException("角色编码必填");
        var exists = await _rep.AsQueryable()
            .AnyAsync(x => x.Id != id && x.TenantId == e.TenantId && x.FactoryId == e.FactoryId && x.RoleCode == body.RoleCode);
        if (exists) throw new S8BizException("角色编码已存在");
        body.Id = id;
        body.TenantId = e.TenantId;
        body.FactoryId = e.FactoryId;
        body.CreatedAt = e.CreatedAt;
        body.UpdatedAt = DateTime.Now;
        await _rep.UpdateAsync(body);
        return body;
    }

    // S8-TENANT-FACTORY-P0-CLOSURE-1：删除必须先按可信作用域绑行，禁止裸 DeleteByIdAsync(id)。
    public async Task DeleteAsync(long id, S8TrustedScope scope)
    {
        var e = await LoadScopedAsync(id, scope);
        await _rep.DeleteByIdAsync(e.Id);
    }

    private async Task<AdoS8RolePermissionConfig> LoadScopedAsync(long id, S8TrustedScope scope) =>
        await _rep.AsQueryable()
            .Where(x => x.Id == id && x.TenantId == scope.TenantId && x.FactoryId == scope.FactoryId)
            .FirstAsync() ?? throw new S8NotFoundException();

    /// <summary>
    /// 从系统角色表一键导入，跳过已存在的角色编码，返回本次新增条数。
    /// </summary>
    public async Task<int> ImportFromSysRolesAsync(long tenantId, long factoryId)
    {
        var sysRoles = await _sysRoleRep.AsQueryable()
            .Where(r => r.TenantId == tenantId && r.Status == StatusEnum.Enable)
            .Where(r => !string.IsNullOrEmpty(r.Code))
            .Select(r => new { r.Code, r.Name })
            .ToListAsync();

        var existingCodes = (await _rep.AsQueryable()
            .Where(x => x.TenantId == tenantId && x.FactoryId == factoryId)
            .Select(x => x.RoleCode)
            .ToListAsync()).ToHashSet();

        var toInsert = sysRoles
            .Where(r => !existingCodes.Contains(r.Code!))
            .Select(r => new AdoS8RolePermissionConfig
            {
                TenantId = tenantId,
                FactoryId = factoryId,
                RoleCode = r.Code!,
                PermissionCodes = "[]",
                CreatedAt = DateTime.Now
            }).ToList();

        if (toInsert.Count > 0)
            await _rep.InsertRangeAsync(toInsert);

        return toInsert.Count;
    }
}