wangziqi/tiku-backend.net
1
0
Fork 0
forked from gongxuegit/tiku-backend.net
Code Pull Requests Activity

feat: harden SaaS authentication and authorization

Browse Source
This commit is contained in:
xiong
2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
Tiku.Infrastructure/Growth/CommissionService.cs
View File

@@ -4,6 +4,7 @@ using System.Text;
using System.Text.Json;
using Microsoft.EntityFrameworkCore;
using Tiku.Application.Growth;
using Tiku.Application.Security;
using Tiku.Domain.Commerce;
using Tiku.Domain.Common;
using Tiku.Domain.Growth;
@@ -13,7 +14,9 @@ using Tiku.Infrastructure.Persistence;
namespace Tiku.Infrastructure.Growth;
public sealed class CommissionService(TikuDbContext dbContext) : ICommissionService
public sealed class CommissionService(
TikuDbContext dbContext,
ICurrentAccessContext currentAccessContext) : ICommissionService
{
public async Task<CommissionSettingsItem> GetSettingsAsync(CommissionAdminActor actor, CancellationToken cancellationToken = default)
{
@@ -40,11 +43,20 @@ public sealed class CommissionService(TikuDbContext dbContext) : ICommissionServ
var member = await dbContext.TenantMemberships
.FirstOrDefaultAsync(item => item.TenantId == actor.TenantId && item.UserId == command.UserId, cancellationToken)
?? throw new CommissionException("Commission member was not found.", "commission_member_not_found");
member.Permissions = JsonSerializer.SerializeToElement(new
var settings = await GetSettingsCoreAsync(actor.TenantId, cancellationToken);
var config = settings.Config.ValueKind == JsonValueKind.Object
? JsonSerializer.Deserialize<Dictionary<string, JsonElement>>(settings.Config.GetRawText()) ?? []
: [];
var memberRates = config.TryGetValue("memberRates", out var existingRates) && existingRates.ValueKind == JsonValueKind.Object
? JsonSerializer.Deserialize<Dictionary<string, JsonElement>>(existingRates.GetRawText()) ?? []
: [];
memberRates[member.UserId.ToString("N")] = JsonSerializer.SerializeToElement(new
{
commissionRate = command.CommissionRate,
commissionConfig = command.CommissionConfig
});
config["memberRates"] = JsonSerializer.SerializeToElement(memberRates);
settings.Config = JsonSerializer.SerializeToElement(config);
await dbContext.SaveChangesAsync(cancellationToken);
return new { member.UserId, commissionRate = command.CommissionRate, commissionConfig = command.CommissionConfig };
}
@@ -265,7 +277,7 @@ public sealed class CommissionService(TikuDbContext dbContext) : ICommissionServ
foreach (var row in orders)
{
if (query.ReferrerUserId.HasValue && row.lead.ReferrerUserId != query.ReferrerUserId) continue;
var rate = GetMemberRate(await GetMembershipPermissionsAsync(tenantId, row.lead.ReferrerUserId!.Value, cancellationToken)) ?? settings.DefaultRate;
var rate = GetMemberRate(settings.Config, row.lead.ReferrerUserId!.Value) ?? settings.DefaultRate;
var settled = existing.FirstOrDefault(item => item.SourceType == CommissionSourceType.Order && item.SourceId == row.order.Id)?.SettlementId;
result.Add(new SourceCandidate(CommissionSourceType.Order, row.order.Id, row.order.OrderNo, row.lead.ReferrerUserId.Value, row.order.UserId, row.order.AmountCents, rate, (int)Math.Round(row.order.AmountCents * rate), CommissionRateSource.Member, settled, row.order.PaidAt, "protected_lead"));
}
@@ -282,7 +294,7 @@ public sealed class CommissionService(TikuDbContext dbContext) : ICommissionServ
if (!row.code.AgentUserId.HasValue) continue;
var agentUserId = row.code.AgentUserId.Value;
if (query.ReferrerUserId.HasValue && agentUserId != query.ReferrerUserId) continue;
var rate = row.batch?.CommissionRate ?? GetMemberRate(await GetMembershipPermissionsAsync(tenantId, agentUserId, cancellationToken)) ?? settings.DefaultRate;
var rate = row.batch?.CommissionRate ?? GetMemberRate(settings.Config, agentUserId) ?? settings.DefaultRate;
var sourceAmount = row.code.UnitPriceCents ?? row.batch?.DefaultUnitPriceCents ?? 0;
var settled = existing.FirstOrDefault(item => item.SourceType == CommissionSourceType.ActivationCode && item.SourceId == row.code.Id)?.SettlementId;
result.Add(new SourceCandidate(CommissionSourceType.ActivationCode, row.code.Id, row.code.Code, agentUserId, row.code.UsedBy, sourceAmount, rate, (int)Math.Round(sourceAmount * rate), row.batch?.CommissionRate is null ? CommissionRateSource.Member : CommissionRateSource.Batch, settled, row.code.UsedAt, "activation_code_agent"));
@@ -290,11 +302,22 @@ public sealed class CommissionService(TikuDbContext dbContext) : ICommissionServ
return result.OrderBy(item => item.SourcePaidAt).ToArray();
}
private async Task<JsonElement> GetMembershipPermissionsAsync(Guid tenantId, Guid userId, CancellationToken cancellationToken) =>
await dbContext.TenantMemberships.AsNoTracking().Where(item => item.TenantId == tenantId && item.UserId == userId).Select(item => item.Permissions).FirstOrDefaultAsync(cancellationToken);
private static decimal? GetMemberRate(JsonElement config, Guid userId)
{
if (config.ValueKind != JsonValueKind.Object ||
!config.TryGetProperty("memberRates", out var memberRates) ||
memberRates.ValueKind != JsonValueKind.Object ||
!memberRates.TryGetProperty(userId.ToString("N"), out var memberRate) ||
memberRate.ValueKind != JsonValueKind.Object ||
!memberRate.TryGetProperty("commissionRate", out var value) ||
value.ValueKind != JsonValueKind.Number ||
!value.TryGetDecimal(out var rate))
{
return null;
}
private static decimal? GetMemberRate(JsonElement permissions) =>
permissions.ValueKind == JsonValueKind.Object && permissions.TryGetProperty("commissionRate", out var value) && value.ValueKind == JsonValueKind.Number && value.TryGetDecimal(out var rate) ? rate : null;
return rate;
}
private async Task<TenantCommissionSetting> GetSettingsCoreAsync(Guid tenantId, CancellationToken cancellationToken)
{
@@ -311,8 +334,14 @@ public sealed class CommissionService(TikuDbContext dbContext) : ICommissionServ
private async Task AssertAdminAsync(CommissionAdminActor actor, CancellationToken cancellationToken)
{
var ok = await dbContext.TenantMemberships.AnyAsync(item => item.TenantId == actor.TenantId && item.UserId == actor.UserId && item.Status == MembershipStatus.Active && (item.Role == TenantRole.PlatformAdmin || item.Role == TenantRole.TenantOwner || item.Role == TenantRole.TenantAdmin), cancellationToken);
if (!ok) throw new CommissionException("Commission admin access was denied.", "commission_access_denied");
var access = await currentAccessContext.GetAsync(cancellationToken);
if (!access.IsCurrentTenantMember ||
access.TenantId != actor.TenantId ||
access.UserId != actor.UserId ||
!access.HasTenantPermission(BackendPermissions.TenantCommissionManage))
{
throw new CommissionException("Commission admin access was denied.", "commission_access_denied");
}
}
private async Task AddAuditAsync(CommissionAdminActor actor, string action, string targetType, Guid targetId, object details, CancellationToken cancellationToken)