Commit Graph

28 Commits

Author SHA1 Message Date
hailin ee6a092a1a fix(authorization-service): 修复授权查询使用错误字段导致省市互斥验证失效
问题:数据库 user_id 列存储的是 accountSequence,但查询时使用 userId.value,
导致查询不到已有授权记录,省市互斥验证被绕过。

修复方法:所有基于 UserId 的查询改为使用 accountSequence 字段:
- findByUserIdAndRoleType
- findByUserIdRoleTypeAndRegion
- findByUserId
- findPendingByUserId
- findAllByUserIdIncludeDeleted

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 10:15:40 -08:00
hailin 8f5b4df3d1 feat(authorization-service): 新增权益考核记录表 BenefitAssessmentRecord
新增独立的权益有效性考核记录表,与火柴人排名(MonthlyAssessment)分离:

Schema & Migration:
- 新增 BenefitAssessmentRecord 表存储权益考核历史
- 新增 BenefitActionType 枚举(ACTIVATED/RENEWED/DEACTIVATED/NO_CHANGE)
- 记录考核月份、目标、完成数、权益状态变化等信息

领域层:
- 新增 BenefitAssessmentRecord 聚合根
- 新增 IBenefitAssessmentRecordRepository 接口

应用层:
- 修改 processExpiredCommunityBenefits 保存考核记录
- 修改 processExpiredCityCompanyBenefits 保存考核记录
- 修改 processExpiredProvinceCompanyBenefits 保存考核记录
- 修改 processExpiredAuthCityBenefits 保存考核记录(新增,原无记录)
- 修改 processExpiredAuthProvinceBenefits 保存考核记录(新增,原无记录)

此改动 100% 不影响原有业务逻辑:
- 原有 MonthlyAssessment 表继续用于火柴人排名
- 仅在权益考核执行完成后追加保存记录到新表

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 04:15:07 -08:00
hailin 8b80e45524 fix(authorization): 火柴人排名过滤已撤销授权的考核记录
- findRankingsByMonthAndRegion 和 findRankingsByMonthAndRoleType 增加过滤条件
- 排除 authorization.status = 'REVOKED' 的记录
- 解决同一用户因有多条授权记录(含已撤销)而重复显示的问题

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-05 19:55:23 -08:00
hailin 0991d5d484 fix(authorization): allow querying REVOKED records despite deletedAt being set
撤销授权时会同时设置 status=REVOKED 和 deletedAt(软删除),
导致 findByStatus(REVOKED) 因为 deletedAt IS NULL 条件永远返回空。
修改为查询 REVOKED 状态时不过滤 deletedAt。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-04 02:52:43 -08:00
hailin af0b9d38c0 Revert "fix(authorization): exclude revoked records when checking existing authorization"
This reverts commit ec528a7226.
2026-01-04 01:08:28 -08:00
hailin ec528a7226 fix(authorization): exclude revoked records when checking existing authorization
The findByAccountSequenceAndRoleType query now excludes REVOKED status,
allowing users to be re-authorized after their authorization was revoked.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-04 00:59:37 -08:00
hailin bf63852a0f feat(authorization): 实现市/省团队自动升级为市/省区域机制
- 添加 findAllActiveAuthProvinceCompanies 和 findAllActiveAuthCityCompanies 仓储方法
- 在认种事件处理中添加 checkAllTeamAutoUpgrade 检查所有已激活团队
- 市团队达到1万棵自动升级为市区域(CITY_COMPANY)
- 省团队达到5万棵自动升级为省区域(PROVINCE_COMPANY)
- 保持原有手动授权功能不变

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-23 03:56:38 -08:00
hailin 2d3891740c feat(authorization): 火柴人排名改为全系统排名,不按区域过滤
- 后端新增 findRankingsByMonthAndRoleType 方法查询全系统排名
- 修改 getStickmanRanking 不再按 regionCode 过滤
- 前端简化加载条件,只要有授权就加载排名
- 添加详细调试日志帮助排查问题

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-23 00:20:35 -08:00
hailin f65b0d14b7 feat(authorization): 实现 Outbox 模式事件发布
## 概述
为 authorization-service 实现 Outbox 模式,确保数据库事务和 Kafka 事件发布的原子性。

## 新增表
- OutboxEvent: 事件暂存表,用于事务性事件发布

## 新增组件
- OutboxRepository: Outbox 事件持久化
- OutboxPublisherService: 轮询发布未处理事件到 Kafka

## 支持的事件
- authorization-events: 授权角色创建/更新事件(省公司、市公司授权)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-18 00:30:09 -08:00
hailin d565bb91fa feat(authorization): 添加审计查询方法支持查询已删除记录
- findAllByUserIdIncludeDeleted: 按用户ID查询所有记录(含已删除)
- findAllByAccountSequenceIncludeDeleted: 按账号序列查询所有记录(含已删除)
- findByIdIncludeDeleted: 按ID查询记录(含已删除)

确保撤销的授权记录可审计追溯

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-17 07:53:37 -08:00
hailin 29df9955f9 feat(authorization): 实现软删除支持撤销后重新授权
- 添加 deletedAt 字段到 AuthorizationRole 聚合根和 Prisma schema
- revoke() 方法同时设置 deletedAt,使撤销的记录被软删除
- Repository 所有查询添加 deletedAt: null 过滤条件
- 创建部分唯一索引,只对未删除记录生效 (大厂通用做法)
- 支持撤销授权后重新创建相同角色

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-17 07:43:30 -08:00
hailin 2399cc29d6 fix(authorization): 修正省区域角色唯一性检查逻辑
将省区域角色从"全系统唯一"改为"按省份唯一":
- 修改 grantProvinceCompany 使用 findProvinceCompanyByRegion 检查
- 删除废弃的 findAnyProvinceCompany 方法
- 现在不同省份可以分别授权给不同账户

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-16 17:20:36 -08:00
hailin 4478351f89 fix(authorization): 修复 grantProvinceCompany 业务验证逻辑
- 添加省区域/市区域互斥检查:同一用户不能同时拥有两种身份
- 添加省区域全局唯一性检查:整个系统只允许一个省区域角色被授权
- 添加 findAnyProvinceCompany 仓储方法用于全局唯一性校验
- 移除错误的 validateAuthorizationRequest 调用(该方法只适用于团队角色)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-14 00:15:09 -08:00
hailin 10ce981111 fix(authorization-service): 社区授权唯一性约束
- 一个用户只能拥有一个社区角色
- 社区名称全局唯一,不允许重复
- 添加 findCommunityByName repository 方法

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-14 00:04:24 -08:00
hailin 049a13c97e feat(authorization-service): 市团队授权级联激活/停用及月度考核
- 添加 cascadeActivateParentAuthCities: 当市团队授权激活时级联激活上级市团队
- 添加 cascadeDeactivateAuthCityBenefits: 月度考核失败时级联停用上级市团队
- 添加 processExpiredAuthCityBenefits: 月度考核处理(100棵树/月)
- 添加 findExpiredActiveByRoleType 仓储方法
- 修改 tryActivateBenefit 支持 AUTH_CITY_COMPANY 级联激活
- 定时任务: 每天凌晨4点检查市团队权益过期
- 定时任务: 每月1号存档并重置市团队月度新增树数

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-13 22:04:59 -08:00
hailin 6bd6c6b5be feat(authorization-service): 实现月度考核数据存档机制(方案B)
- 新增 lastMonthTreesAdded 字段,用于存档上月业绩数据
- 新增 archiveAndResetMonthlyTreeCounts 定时任务:每月1日0:00将当月数据存档后重置
- 新增 getTreesForAssessment() 方法:根据 benefitValidUntil 判断使用当月或上月数据
- 修复月度考核时序问题:数据重置(0:00)在考核(3:00)之前执行

业务规则:
- 严格自然月统计,11月的业绩不计入12月
- 激活当月免考核,考核激活当月的下一个月
- 权益有效期在上月末 → 使用 lastMonthTreesAdded
- 权益有效期在当月末 → 使用 monthlyTreesAdded

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-13 20:39:16 -08:00
hailin 2af44e5854 feat(authorization-service): 实现社区权益月度考核及级联激活/停用功能
- 新增 benefitValidUntil、lastAssessmentMonth、monthlyTreesAdded 字段追踪月度考核
- 实现级联激活:当社区权益激活时,自动激活所有上级社区的权益
- 实现级联停用:当月度考核不达标时,级联停用该社区及所有上级社区
- 新增定时任务:每天凌晨3点检查过期社区权益,每月1号凌晨重置月度树数
- 权益有效期为当前月+下月末

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-13 07:23:46 -08:00
hailin 4be9c1fb82 refactor!: 重构账户序列号格式 (BREAKING CHANGE)
将 accountSequence 从数字类型改为字符串类型,新格式为:
- 普通用户: D + YYMMDD + 5位序号 (例: D2512120001)
- 系统账户: S + 10位序号 (例: S0000000001)

主要变更:
- identity-service: AccountSequence 值对象改为字符串类型
- identity-service: 序列号生成器改为按日期重置计数
- 所有服务: Prisma schema 字段类型从 BigInt/Int 改为 String
- 所有服务: DTO、Command、Event 中的类型定义更新
- Flutter 前端: 相关数据模型类型更新

涉及服务:
- identity-service (核心变更)
- referral-service
- authorization-service
- wallet-service
- reward-service
- blockchain-service
- backup-service
- planting-service
- mpc-service
- admin-service
- mobile-app (Flutter)

注意: 此为破坏性变更,需要清空数据库并重新运行 migration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-12 09:11:18 -08:00
hailin f60d4eac87 feat(authorization): remove region matching requirement for team rewards
省团队(AUTH_PROVINCE_COMPANY)和市团队(AUTH_CITY_COMPANY)收益分配不再要求
认种者选择的省市与被授权用户的省市一致,只要在推荐链上有授权即可获得收益。

省区域(PROVINCE_COMPANY)和市区域(CITY_COMPANY)收益仍保持省市匹配要求。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-12 03:04:55 -08:00
hailin fc55afb7b9 fix(authorization): show parent community without requiring benefitActive
Changed findActiveCommunityByAccountSequences to not require benefitActive=true.
This allows communities that haven't passed assessment to still be shown as
parent communities in the UI, while reward distribution logic remains unchanged.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-11 18:39:22 -08:00
hailin 16d95999de feat(backend): implement assessment rules for reward distribution
Add proper assessment/考核 logic for all 5 benefit types:
- Community (80 USDT): 10-tree initial assessment, splits rewards between
  current community and parent/headquarters based on progress
- Province Team (20 USDT): 500-tree initial assessment for AUTH_PROVINCE_COMPANY
- Province Area (15 USDT + 1%): 50000-tree target for PROVINCE_COMPANY,
  routes to system account until target reached
- City Team (40 USDT): 100-tree initial assessment for AUTH_CITY_COMPANY
- City Area (35 USDT + 2%): 10000-tree target for CITY_COMPANY,
  routes to system account until target reached

Changes:
- authorization-service: Add 4 new distribution API endpoints and application
  service methods for province/city team/area reward distribution
- authorization-service: Add repository methods for querying authorizations
  including benefitActive=false records
- reward-service: Update client to call new distribution APIs
- reward-service: Modify calculation methods to return multiple reward entries
  based on assessment distribution plan

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-11 07:54:55 -08:00
hailin 6f46a8633f feat(reward): add internal APIs for reward distribution
- Add /referral/chain/{userId} API in referral-service for getting referral chain with hasPlanted status
- Add internal authorization APIs in authorization-service:
  - GET /authorization/nearest-community: find nearest community in referral chain
  - GET /authorization/nearest-province: find nearest province company in referral chain
  - GET /authorization/nearest-city: find nearest city company in referral chain
- Add repository methods for finding active authorizations by accountSequence
- Update reward-service client to use accountSequence parameter

These APIs enable reward-service to correctly distribute:
- 分享权益 (share benefit): to referrer with hasPlanted=true
- 社区权益 (community benefit): to nearest community leader
- 省团队权益 (province team benefit): to nearest province company
- 市团队权益 (city team benefit): to nearest city company

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-10 21:49:13 -08:00
hailin 9cf8b5305b feat(authorization): add community hierarchy API
- Add internal referral-chain API in referral-service for getting ancestor path and team members
- Extend ReferralServiceClient to call referral-chain API
- Add findActiveCommunityByAccountSequences repository method
- Add getCommunityHierarchy application service method
- Add GET /authorizations/my/community-hierarchy endpoint
- Update frontend with CommunityHierarchy model and getMyCommunityHierarchy method

API returns:
- myCommunity: user's own community authorization (if any)
- parentCommunity: nearest parent community (defaults to 总部社区 if none)
- childCommunities: nearest child communities in user's team

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-10 18:18:49 -08:00
hailin 300fe211c8 fix: add accountSequence to all services and fix compilation errors
- reward-service: add accountSequence to aggregates, services, tests
- authorization-service: fix UserId/AdminUserId to accept accountSequence, add findByAccountSequence to repositories
- referral-service: fix test files for accountSequence changes
- Add migration files for reward-service and authorization-service

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-10 14:14:06 -08:00
hailin 034fb53674 refactor: use accountSequence as unified user identifier across all services
- planting-service: extract accountSequence from JWT, pass to referral-service
- referral-service: query by accountSequence instead of userId
- reward-service: add accountSequence field to schema and all layers
- wallet-service: prioritize accountSequence lookup over userId
- authorization-service: change userId from String to BigInt, add accountSequence

This change ensures consistent cross-service user identification using
accountSequence (8-digit unique business ID) instead of internal database IDs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-10 13:55:03 -08:00
hailin 781721a659 feat(withdrawal): implement withdrawal order and fund allocation system
- Add SystemAccount domain in authorization-service for managing regional/company accounts
- Implement fund allocation service in planting-service with multi-tier distribution
- Add WithdrawalOrder aggregate in wallet-service with full lifecycle management
- Create internal wallet controller for cross-service fund allocation
- Add Kafka event publishing for withdrawal requests
- Implement unit-of-work pattern for transactional consistency
- Update Prisma schemas with withdrawal order and system account tables

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-09 02:35:27 -08:00
hailin 747e4ae8ef refactor(mpc-system): migrate to party-driven architecture with PartyID-based routing
- Remove Address field from PartyEndpoint (parties connect to router themselves)
- Update K8s Discovery to only manage PartyID and Role labels
- Add Party registration and SessionEvent protobuf definitions
- Implement PartyRegistry and SessionEventBroadcaster domain logic
- Add RegisterParty and SubscribeSessionEvents gRPC handlers
- Prepare infrastructure for party-driven MPC coordination

This is the first phase of migrating from coordinator-driven to party-driven
architecture following international MPC system design patterns.
2025-12-05 08:11:28 -08:00
Developer ea03df9059 feat(authorization-service): Implement complete authorization service with DDD architecture
## Features
- Province/City Company authorization (省代/市代授权)
- Community authorization (社区授权)
- Monthly assessment with ladder targets (月度阶梯考核)
- Team validation for referral chain conflicts (推荐链授权冲突检测)
- First place ranking rewards (区域第一名奖励)

## Architecture
- Domain Layer: Aggregates, Entities, Value Objects, Domain Events, Services
- Application Layer: Commands, Services, Schedulers
- Infrastructure Layer: Prisma ORM, Redis Cache, Kafka Events
- API Layer: Controllers, DTOs, Guards

## Testing
- Unit tests: 33 tests (aggregates, entities, value objects)
- Integration tests: 30 tests (domain services)
- E2E tests: 6 tests (API endpoints)
- Docker test environment with PostgreSQL, Redis, Kafka

## Documentation
- ARCHITECTURE.md: System design and DDD patterns
- API.md: REST API endpoints reference
- DEVELOPMENT.md: Development guide
- TESTING.md: Testing strategies and examples
- DEPLOYMENT.md: Docker/Kubernetes deployment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-01 06:30:07 -08:00