AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP/MaterialWarehouse/IncomingInspectionApplicationService.cs

using Admin.NET.Plugin.AiDOP.MaterialWarehouse.Dto;

namespace Admin.NET.Plugin.AiDOP.MaterialWarehouse;

/// <summary>
/// S5 来料检验申请列表 服务（只读）。
///
/// 数据源：主库 aidopdev 表 qms_qcp_inspecapplyn（贴源 QMS 申请主表）。
/// 一期降级方案②：仅查询/展示表内可直接真实渲染的字段
///   FBILLNO 单据编号 / FBILLTYPE 单据类型(原值) / FAPPLYTIME 申请时间 / FCOMMENT 备注。
/// 不查询 FORGID / FBIZTYPE / FAPPLYUSER —— 名称解析源（bos_org / qcbd_biztype / bos_user）
/// 当前不在 aidopdev，不做脑补 join、不显示裸 ID。
///
/// 租户：qms_qcp_inspecapplyn 已补 tenant_id 列，按严格可信租户过滤（需认证，租户仅取认证后 JWT，忽略前端 tenantId）；
/// 无 domain / factory 列，不新增前端 factory 选择，亦不脑补工厂维度。
///
/// 本接口只读：仅 SELECT，无新增/编辑/删除/任务拆分/状态回写。
/// </summary>
[ApiDescriptionSettings(Order = 305, Description = "来料检验申请")]
[Route("api/IncomingInspection")]
[NonUnify]
public class IncomingInspectionApplicationService : IDynamicApiController, ITransient
{
    /// <summary>主/系统租户哨兵：超管未选择目标租户时其 JWT TenantId 即此值，拒绝作为业务租户。</summary>
    private const long MainTenantId = 1300000000001L;

    private readonly ISqlSugarClient _db;
    private readonly UserManager _userManager;

    public IncomingInspectionApplicationService(ISqlSugarClient db, UserManager userManager)
    {
        _db = db;
        _userManager = userManager;
    }

    /// <summary>严格可信租户解析：只来自认证后 JWT；无 Token(&lt;=0) 或超管未选主租户 → 拒绝；不读前端 tenantId、无默认回退。</summary>
    private long ResolveTenantOrThrow()
    {
        var tid = _userManager.TenantId;
        if (tid <= 0)
            throw Oops.Oh("无法确定当前租户，请重新登录或选择目标租户");
        if (_userManager.SuperAdmin && tid == MainTenantId)
            throw Oops.Oh("超级管理员操作前必须选择目标租户");
        return tid;
    }

    /// <summary>
    /// 来料检验申请列表（只读分页查询）。
    /// </summary>
    [DisplayName("来料检验申请列表")]
    [HttpGet("application/list")]
    public async Task<object> GetList([FromQuery] IncomingInspectionApplicationListInput input)
    {
        var page = input.Page <= 0 ? 1 : input.Page;
        var pageSize = input.PageSize <= 0 ? 10 : input.PageSize;
        var offset = (page - 1) * pageSize;

        // 同库分租户：qms_qcp_inspecapplyn 已补 tenant_id 列，按严格可信租户（仅认证后 JWT，忽略前端 tenantId）过滤，杜绝匿名跨租户读。
        var tenantId = ResolveTenantOrThrow();
        var where = new List<string> { "m.tenant_id = @TenantId" };
        var pars = new List<SugarParameter> { new("@TenantId", tenantId) };

        if (!string.IsNullOrWhiteSpace(input.BillNo))
        {
            where.Add("m.FBILLNO LIKE @BillNo");
            pars.Add(new SugarParameter("@BillNo", $"%{input.BillNo.Trim()}%"));
        }
        if (!string.IsNullOrWhiteSpace(input.ApplyTimeStart))
        {
            where.Add("m.FAPPLYTIME >= @ApplyTimeStart");
            pars.Add(new SugarParameter("@ApplyTimeStart", $"{input.ApplyTimeStart.Trim()} 00:00:00"));
        }
        if (!string.IsNullOrWhiteSpace(input.ApplyTimeEnd))
        {
            where.Add("m.FAPPLYTIME <= @ApplyTimeEnd");
            pars.Add(new SugarParameter("@ApplyTimeEnd", $"{input.ApplyTimeEnd.Trim()} 23:59:59"));
        }

        var whereSql = string.Join(" AND ", where);

        var total = await _db.Ado.GetIntAsync(
            $"SELECT COUNT(1) FROM qms_qcp_inspecapplyn m WHERE {whereSql}", pars);

        var list = await _db.Ado.SqlQueryAsync<IncomingInspectionApplicationListRow>(
            $"""
            SELECT
                m.id          AS Id,
                m.FBILLNO     AS FBillNo,
                m.FBILLTYPE   AS FBillType,
                m.FAPPLYTIME  AS FApplyTime,
                m.FCOMMENT    AS FComment
            FROM qms_qcp_inspecapplyn m
            WHERE {whereSql}
            ORDER BY {BuildOrderBy(input.SortField, input.SortOrder)}
            LIMIT {pageSize} OFFSET {offset}
            """,
            pars);

        return new { total, page, pageSize, list };
    }

    /// <summary>
    /// 排序白名单：仅允许按已展示列排序，杜绝 SQL 注入。
    /// </summary>
    private static string BuildOrderBy(string? sortField, string? sortOrder)
    {
        var column = sortField switch
        {
            "fBillNo" => "m.FBILLNO",
            "fApplyTime" => "m.FAPPLYTIME",
            _ => "m.FAPPLYTIME",
        };
        var direction = string.Equals(sortOrder, "asc", StringComparison.OrdinalIgnoreCase) ? "ASC" : "DESC";
        return $"{column} {direction}, m.id DESC";
    }
}