AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP/Manufacturing/IpqcInspectionService.cs

using Admin.NET.Plugin.AiDOP.Manufacturing.Dto;

namespace Admin.NET.Plugin.AiDOP.Manufacturing;

/// <summary>
/// S6 过程检验单（IPQC）只读 list 服务。
///
/// 数据源：DOP 数据中台标准层 mdp_std_ipqc_inspection（头）。
/// 由 IpqcInspectionMdpSyncService 从归口后的 aidopdev.qms_gcjyd（过程检验单头）同步标准化而来。
///
/// 本服务仅 SELECT：无新增/编辑/删除/写入。
/// 当前上游尚未抽数，归口源表 qms_gcjyd 为空 → 标准层为空 → list 返回空数组（前端空态）。
/// 明细（qms_gcjydzb）与详情不在本批范围，留待 IPQC-INSPECTION-DETAIL-READONLY-1。
/// </summary>
[ApiDescriptionSettings(Order = 306, Description = "过程检验单")]
[Route("api/IpqcInspection")]
[NonUnify]
public class IpqcInspectionService : IDynamicApiController, ITransient
{
    /// <summary>主/系统租户哨兵：超管未选择目标租户时其 JWT TenantId 即此值，拒绝作为业务租户。</summary>
    private const long MainTenantId = 1300000000001L;

    private readonly ISqlSugarClient _db;
    private readonly UserManager _userManager;

    public IpqcInspectionService(ISqlSugarClient db, UserManager userManager)
    {
        _db = db;
        _userManager = userManager;
    }

    /// <summary>
    /// IPQC 只读查询的可信租户解析（严格语义，无任何默认回退、不读前端 tenantId）：
    ///  - 普通租户用户：返回认证后的 JWT TenantId（&gt;0）；
    ///  - 无 Token（TenantId&lt;=0）：拒绝（正常已被认证层 401 拦截，此处为纵深防御）；
    ///  - 超管未选择目标租户（TenantId==主租户）：拒绝，必须先选择目标租户。
    /// 前端传入的 tenantId 一律忽略，绝不作为切换租户的权威来源。
    /// </summary>
    private long ResolveTenantOrThrow()
    {
        var tid = _userManager.TenantId;
        if (tid <= 0)
            throw Oops.Oh("无法确定当前租户，请重新登录或选择目标租户");
        if (_userManager.SuperAdmin && tid == MainTenantId)
            throw Oops.Oh("超级管理员操作前必须选择目标租户");
        return tid;
    }

    /// <summary>
    /// 过程检验单列表（只读分页查询）。
    /// </summary>
    [DisplayName("过程检验单列表")]
    [HttpGet("list")]
    public async Task<object> GetList([FromQuery] IpqcInspectionListInput input)
    {
        var page = input.Page <= 0 ? 1 : input.Page;
        var pageSize = input.PageSize <= 0 ? 10 : input.PageSize;
        var offset = (page - 1) * pageSize;

        var where = new List<string> { "1=1" };
        var pars = new List<SugarParameter>();

        // 强制租户过滤：qms_gcjyd/qms_gcjydzb 全库共享无 tenant，标准层按源 tenant_id 落库。
        // 租户只来自认证后的可信上下文（严格 JWT），忽略前端传入的 input.TenantId，杜绝跨租户可见。
        var tid = ResolveTenantOrThrow();
        where.Add("m.tenant_id = @TenantId");
        pars.Add(new SugarParameter("@TenantId", tid));
        if (!string.IsNullOrWhiteSpace(input.BillNo))
        {
            where.Add("m.bill_no LIKE @BillNo");
            pars.Add(new SugarParameter("@BillNo", $"%{input.BillNo.Trim()}%"));
        }
        if (!string.IsNullOrWhiteSpace(input.ProductionBatchNo))
        {
            where.Add("m.production_batch_no LIKE @ProductionBatchNo");
            pars.Add(new SugarParameter("@ProductionBatchNo", $"%{input.ProductionBatchNo.Trim()}%"));
        }

        var whereSql = string.Join(" AND ", where);

        var total = await _db.Ado.GetIntAsync(
            $"SELECT COUNT(1) FROM mdp_std_ipqc_inspection m WHERE {whereSql}", pars);

        var list = await _db.Ado.SqlQueryAsync<IpqcInspectionListRow>(
            $"""
            SELECT
                m.id                       AS Id,
                m.bill_no                  AS BillNo,
                m.product_model            AS ProductModel,
                m.production_batch_no      AS ProductionBatchNo,
                m.production_work_order    AS ProductionWorkOrder,
                m.result_judgement         AS ResultJudgement,
                m.attachment               AS Attachment,
                m.remark                   AS Remark,
                m.inspector                AS Inspector,
                m.process_code             AS ProcessCode,
                m.process_name             AS ProcessName,
                m.production_person        AS ProductionPerson,
                m.sample_qty               AS SampleQty,
                m.form_no                  AS FormNo,
                m.version_no               AS VersionNo,
                m.effective_date           AS EffectiveDate,
                m.material_code            AS MaterialCode,
                m.material_name            AS MaterialName,
                m.inspec_standard_version  AS InspecStandardVersion,
                m.inspec_standard_code     AS InspecStandardCode,
                CAST(m.source_row_id AS SIGNED) AS SourceRowId
            FROM mdp_std_ipqc_inspection m
            WHERE {whereSql}
            ORDER BY {BuildOrderBy(input.SortField, input.SortOrder)}
            LIMIT {pageSize} OFFSET {offset}
            """,
            pars);

        return new { total, page, pageSize, list };
    }

    /// <summary>
    /// 过程检验单详情（只读：头 + 明细）。查不到返回 null。
    /// </summary>
    [DisplayName("过程检验单详情")]
    [HttpGet("detail")]
    public async Task<IpqcInspectionDetailDto?> GetDetail([FromQuery] long id)
    {
        if (id <= 0) return null;

        // 强制租户过滤（同 GetList）：租户只来自认证后的可信上下文，忽略前端 tenantId，杜绝跨租户读取详情。
        var tid = ResolveTenantOrThrow();
        var headPars = new List<SugarParameter> { new("@Id", id), new("@TenantId", tid) };
        var headWhere = "m.id = @Id AND m.tenant_id = @TenantId";

        var head = await _db.Ado.SqlQuerySingleAsync<IpqcInspectionDetailDto>(
            $"""
            SELECT
                m.id                       AS Id,
                m.bill_no                  AS BillNo,
                m.product_model            AS ProductModel,
                m.production_batch_no      AS ProductionBatchNo,
                m.production_work_order    AS ProductionWorkOrder,
                m.result_judgement         AS ResultJudgement,
                m.attachment               AS Attachment,
                m.remark                   AS Remark,
                m.inspector                AS Inspector,
                m.process_code             AS ProcessCode,
                m.process_name             AS ProcessName,
                m.production_person        AS ProductionPerson,
                m.sample_qty               AS SampleQty,
                m.form_no                  AS FormNo,
                m.version_no               AS VersionNo,
                m.effective_date           AS EffectiveDate,
                m.material_code            AS MaterialCode,
                m.material_name            AS MaterialName,
                m.inspec_standard_version  AS InspecStandardVersion,
                m.inspec_standard_code     AS InspecStandardCode,
                m.inspection_status        AS InspectionStatus,
                CAST(m.source_row_id AS SIGNED) AS SourceRowId
            FROM mdp_std_ipqc_inspection m
            WHERE {headWhere}
            LIMIT 1
            """,
            headPars);

        if (head == null || head.Id <= 0) return null;

        head.Lines = await _db.Ado.SqlQueryAsync<IpqcInspectionDetailLineDto>(
            """
            SELECT
                d.id                     AS Id,
                d.inspection_item        AS InspectionItem,
                d.inspection_basis       AS InspectionBasis,
                d.technical_standard     AS TechnicalStandard,
                d.inspection_method      AS InspectionMethod,
                d.upper_limit            AS UpperLimit,
                d.lower_limit            AS LowerLimit,
                d.process_code           AS ProcessCode,
                d.process_name           AS ProcessName,
                d.measurement_instrument AS MeasurementInstrument,
                d.inspector              AS Inspector,
                d.inspection_time        AS InspectionTime,
                d.sample_qty             AS SampleQty,
                d.inspection_qty         AS InspectionQty,
                d.unqualified_qty        AS UnqualifiedQty,
                d.result_judgement       AS ResultJudgement,
                d.non_numeric_ok         AS NonNumericOk,
                d.non_numeric_ng         AS NonNumericNg,
                d.remark                 AS Remark,
                d.attachment             AS Attachment
            FROM mdp_std_ipqc_inspection_detail d
            WHERE d.std_head_id = @HeadId AND d.tenant_id = @TenantId
            ORDER BY d.id ASC
            """,
            new List<SugarParameter> { new("@HeadId", head.Id), new("@TenantId", tid) });

        return head;
    }

    /// <summary>
    /// 排序白名单：仅允许按已展示列排序，杜绝 SQL 注入。
    /// </summary>
    private static string BuildOrderBy(string? sortField, string? sortOrder)
    {
        var column = sortField switch
        {
            "billNo" => "m.bill_no",
            "effectiveDate" => "m.effective_date",
            _ => "m.effective_date",
        };
        var direction = string.Equals(sortOrder, "asc", StringComparison.OrdinalIgnoreCase) ? "ASC" : "DESC";
        return $"{column} {direction}, m.id DESC";
    }
}