msumshk/TakeoutSaaS.AdminApi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 修复门店租户写入与跨租户查看

Browse Source
This commit is contained in:
MSuMshk
2026-01-19 20:22:12 +08:00
parent abd5752ad1
commit 30e54e2bea
13 changed files with 192 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Api/TakeoutSaaS.AdminApi/appsettings.Seed.Development.json
View File

@@ -103,6 +103,7 @@
"merchant_category:delete",
"store:create",
"store:read",
"store:read:all",
"store:update",
"store:delete",
"store-table-area:read",
@@ -411,6 +412,7 @@
"merchant_category:delete",
"store:create",
"store:read",
"store:read:all",
"store:update",
"store:delete",
"product:create",

5
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/CalculateStoreFeeQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Application.App.Stores.Services;
@@ -17,6 +18,7 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
public sealed class CalculateStoreFeeQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor,
IStoreFeeCalculationService feeCalculationService)
: IRequestHandler<CalculateStoreFeeQuery, StoreFeeCalculationResultDto>
{
@@ -24,7 +26,8 @@ public sealed class CalculateStoreFeeQueryHandler(
public async Task<StoreFeeCalculationResultDto> Handle(CalculateStoreFeeQuery request, CancellationToken cancellationToken)
{
// 1. 校验门店存在
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var store = await storeRepository.FindByIdAsync(request.StoreId, tenantId, cancellationToken);
if (store is null)
{

7
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/CheckStoreQualificationsQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Domain.Stores.Enums;
@@ -14,14 +15,16 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class CheckStoreQualificationsQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<CheckStoreQualificationsQuery, StoreQualificationCheckResultDto>
{
/// <inheritdoc />
public async Task<StoreQualificationCheckResultDto> Handle(CheckStoreQualificationsQuery request, CancellationToken cancellationToken)
{
// 1. 校验门店存在
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var store = await storeRepository.FindByIdAsync(request.StoreId, tenantId, cancellationToken);
if (store is null)
{

32
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/CreateStoreCommandHandler.cs
View File

@@ -1,8 +1,10 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using TakeoutSaaS.Application.App.Stores;
using TakeoutSaaS.Application.App.Stores.Commands;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Domain.Merchants.Repositories;
using TakeoutSaaS.Domain.Stores.Entities;
using TakeoutSaaS.Domain.Stores.Enums;
using TakeoutSaaS.Domain.Stores.Repositories;
@@ -17,17 +19,30 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class CreateStoreCommandHandler(
IStoreRepository storeRepository,
IMerchantRepository merchantRepository,
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor,
ILogger<CreateStoreCommandHandler> logger)
: IRequestHandler<CreateStoreCommand, StoreDto>
{
/// <inheritdoc />
public async Task<StoreDto> Handle(CreateStoreCommand request, CancellationToken cancellationToken)
{
// 1. 校验门店坐标唯一性（100 米内禁止重复）
// 1. 校验商户存在并解析租户
var currentTenantId = tenantProvider.GetCurrentTenantId();
var allowCrossTenant = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var merchant = allowCrossTenant
? await merchantRepository.FindByIdAsync(request.MerchantId, cancellationToken)
: await merchantRepository.FindByIdAsync(request.MerchantId, currentTenantId, cancellationToken);
if (merchant == null)
{
throw new BusinessException(ErrorCodes.NotFound, "商户不存在");
}
var tenantId = merchant.TenantId;
// 2. (空行后) 校验门店坐标唯一性（100 米内禁止重复）
if (request.Longitude.HasValue && request.Latitude.HasValue)
{
var tenantId = tenantProvider.GetCurrentTenantId();
var isDuplicate = await storeRepository.ExistsStoreWithinDistanceAsync(
request.MerchantId,
tenantId,
@@ -41,16 +56,17 @@ public sealed class CreateStoreCommandHandler(
}
}
// 2. (空行后) 计算审核与经营状态
// 3. (空行后) 计算审核与经营状态
var now = DateTime.UtcNow;
var isSameEntity = request.OwnershipType == StoreOwnershipType.SameEntity;
var auditStatus = isSameEntity ? StoreAuditStatus.Activated : StoreAuditStatus.Draft;
var businessStatus = StoreBusinessStatus.Resting;
DateTime? activatedAt = isSameEntity ? now : null;
// 3. (空行后) 构建实体
// 4. (空行后) 构建实体
var store = new Store
{
TenantId = tenantId,
MerchantId = request.MerchantId,
Code = request.Code.Trim(),
Name = request.Name.Trim(),
@@ -79,10 +95,14 @@ public sealed class CreateStoreCommandHandler(
SupportsQueueing = request.SupportsQueueing
};
// 4. (空行后) 持久化并初始化费用配置
// 5. (空行后) 持久化门店以获取标识
await storeRepository.AddStoreAsync(store, cancellationToken);
await storeRepository.SaveChangesAsync(cancellationToken);
// 6. (空行后) 初始化费用配置
await storeRepository.AddStoreFeeAsync(new StoreFee
{
TenantId = tenantId,
StoreId = store.Id,
MinimumOrderAmount = 0m,
BaseDeliveryFee = 0m,
@@ -92,7 +112,7 @@ public sealed class CreateStoreCommandHandler(
await storeRepository.SaveChangesAsync(cancellationToken);
logger.LogInformation("创建门店 {StoreId} - {StoreName}", store.Id, store.Name);
// 5. (空行后) 返回 DTO
// 7. (空行后) 返回 DTO
return StoreMapping.ToDto(store);
}
}

7
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/GetStoreByIdQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
@@ -13,13 +14,15 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class GetStoreByIdQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<GetStoreByIdQuery, StoreDto?>
{
/// <inheritdoc />
public async Task<StoreDto?> Handle(GetStoreByIdQuery request, CancellationToken cancellationToken)
{
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var store = await storeRepository.FindByIdAsync(request.StoreId, tenantId, cancellationToken);
return store == null ? null : StoreMapping.ToDto(store);
}

7
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/GetStoreFeeQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Domain.Stores.Entities;
@@ -14,14 +15,16 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class GetStoreFeeQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<GetStoreFeeQuery, StoreFeeDto?>
{
/// <inheritdoc />
public async Task<StoreFeeDto?> Handle(GetStoreFeeQuery request, CancellationToken cancellationToken)
{
// 1. 校验门店存在
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var store = await storeRepository.FindByIdAsync(request.StoreId, tenantId, cancellationToken);
if (store is null)
{

8
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/ListStoreBusinessHoursQueryHandler.cs
View File

@@ -1,5 +1,6 @@
using System.Linq;
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Domain.Stores.Repositories;
@@ -12,17 +13,20 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class ListStoreBusinessHoursQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<ListStoreBusinessHoursQuery, IReadOnlyList<StoreBusinessHourDto>>
{
private readonly IStoreRepository _storeRepository = storeRepository;
private readonly ITenantProvider _tenantProvider = tenantProvider;
private readonly IHttpContextAccessor _httpContextAccessor = httpContextAccessor;
/// <inheritdoc />
public async Task<IReadOnlyList<StoreBusinessHourDto>> Handle(ListStoreBusinessHoursQuery request, CancellationToken cancellationToken)
{
// 1. 查询时段列表
var tenantId = _tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(_httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : _tenantProvider.GetCurrentTenantId();
var hours = await _storeRepository.GetBusinessHoursAsync(request.StoreId, tenantId, cancellationToken);
// 2. 映射 DTO

8
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/ListStoreDeliveryZonesQueryHandler.cs
View File

@@ -1,5 +1,6 @@
using System.Linq;
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Domain.Stores.Repositories;
@@ -12,17 +13,20 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class ListStoreDeliveryZonesQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<ListStoreDeliveryZonesQuery, IReadOnlyList<StoreDeliveryZoneDto>>
{
private readonly IStoreRepository _storeRepository = storeRepository;
private readonly ITenantProvider _tenantProvider = tenantProvider;
private readonly IHttpContextAccessor _httpContextAccessor = httpContextAccessor;
/// <inheritdoc />
public async Task<IReadOnlyList<StoreDeliveryZoneDto>> Handle(ListStoreDeliveryZonesQuery request, CancellationToken cancellationToken)
{
// 1. 查询配送区域
var tenantId = _tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(_httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : _tenantProvider.GetCurrentTenantId();
var zones = await _storeRepository.GetDeliveryZonesAsync(request.StoreId, tenantId, cancellationToken);
// 2. 映射 DTO

7
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/ListStoreQualificationsQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
using TakeoutSaaS.Domain.Stores.Repositories;
@@ -13,14 +14,16 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class ListStoreQualificationsQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<ListStoreQualificationsQuery, IReadOnlyList<StoreQualificationDto>>
{
/// <inheritdoc />
public async Task<IReadOnlyList<StoreQualificationDto>> Handle(ListStoreQualificationsQuery request, CancellationToken cancellationToken)
{
// 1. 校验门店存在
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var store = await storeRepository.FindByIdAsync(request.StoreId, tenantId, cancellationToken);
if (store is null)
{

8
src/Application/TakeoutSaaS.Application/App/Stores/Handlers/SearchStoresQueryHandler.cs
View File

@@ -1,4 +1,5 @@
using MediatR;
using Microsoft.AspNetCore.Http;
using TakeoutSaaS.Application.App.Stores;
using TakeoutSaaS.Application.App.Stores.Dto;
using TakeoutSaaS.Application.App.Stores.Queries;
@@ -13,13 +14,15 @@ namespace TakeoutSaaS.Application.App.Stores.Handlers;
/// </summary>
public sealed class SearchStoresQueryHandler(
IStoreRepository storeRepository,
ITenantProvider tenantProvider)
ITenantProvider tenantProvider,
IHttpContextAccessor httpContextAccessor)
: IRequestHandler<SearchStoresQuery, PagedResult<StoreDto>>
{
/// <inheritdoc />
public async Task<PagedResult<StoreDto>> Handle(SearchStoresQuery request, CancellationToken cancellationToken)
{
var tenantId = tenantProvider.GetCurrentTenantId();
var ignoreTenantFilter = StoreTenantAccess.ShouldIgnoreTenantFilter(httpContextAccessor);
var tenantId = ignoreTenantFilter ? 0 : tenantProvider.GetCurrentTenantId();
var stores = await storeRepository.SearchAsync(
tenantId,
request.MerchantId,
@@ -28,6 +31,7 @@ public sealed class SearchStoresQueryHandler(
request.BusinessStatus,
request.OwnershipType,
request.Keyword,
ignoreTenantFilter,
cancellationToken);
var sorted = ApplySorting(stores, request.SortBy, request.SortDescending);

45
src/Application/TakeoutSaaS.Application/App/Stores/StoreTenantAccess.cs Normal file
View File

@@ -0,0 +1,45 @@
using Microsoft.AspNetCore.Http;
using System;
using System.Linq;
namespace TakeoutSaaS.Application.App.Stores;
internal static class StoreTenantAccess
{
private const string PermissionClaimType = "permission";
private const string ViewAllStoresPermission = "store:read:all";
private static readonly string[] PlatformRoleCodes =
{
"super-admin",
"SUPER_ADMIN",
"PlatformAdmin",
"platform-admin"
};
public static bool ShouldIgnoreTenantFilter(IHttpContextAccessor httpContextAccessor)
{
var httpContext = httpContextAccessor.HttpContext;
if (httpContext == null)
{
return false;
}
var user = httpContext.User;
if (user?.Identity?.IsAuthenticated != true)
{
return false;
}
if (PlatformRoleCodes.Any(user.IsInRole))
{
return true;
}
var permissions = user.FindAll(PermissionClaimType)
.Select(c => c.Value?.Trim())
.Where(value => !string.IsNullOrWhiteSpace(value))
.ToHashSet(StringComparer.OrdinalIgnoreCase);
return permissions.Contains(ViewAllStoresPermission);
}
}

1
src/Domain/TakeoutSaaS.Domain/Stores/Repositories/IStoreRepository.cs
View File

@@ -29,6 +29,7 @@ public interface IStoreRepository
StoreBusinessStatus? businessStatus,
StoreOwnershipType? ownershipType,
string? keyword,
bool ignoreTenantFilter = false,
CancellationToken cancellationToken = default);
/// <summary>

94
src/Infrastructure/TakeoutSaaS.Infrastructure/App/Repositories/EfStoreRepository.cs
View File

@@ -19,9 +19,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
/// <inheritdoc />
public Task<Store?> FindByIdAsync(long storeId, long tenantId, CancellationToken cancellationToken = default)
{
return context.Stores
.AsNoTracking()
.Where(x => x.TenantId == tenantId && x.Id == storeId)
var query = context.Stores.AsNoTracking();
if (tenantId <= 0)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
return query
.Where(x => x.Id == storeId)
.FirstOrDefaultAsync(cancellationToken);
}
@@ -44,11 +54,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
StoreBusinessStatus? businessStatus,
StoreOwnershipType? ownershipType,
string? keyword,
bool ignoreTenantFilter = false,
CancellationToken cancellationToken = default)
{
var query = context.Stores
.AsNoTracking()
.Where(x => x.TenantId == tenantId);
var query = context.Stores.AsNoTracking();
if (ignoreTenantFilter)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
if (merchantId.HasValue)
{
@@ -153,9 +171,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
/// <inheritdoc />
public async Task<IReadOnlyList<StoreBusinessHour>> GetBusinessHoursAsync(long storeId, long tenantId, CancellationToken cancellationToken = default)
{
var hours = await context.StoreBusinessHours
.AsNoTracking()
.Where(x => x.TenantId == tenantId && x.StoreId == storeId)
var query = context.StoreBusinessHours.AsNoTracking();
if (tenantId <= 0)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
var hours = await query
.Where(x => x.StoreId == storeId)
.OrderBy(x => x.DayOfWeek)
.ThenBy(x => x.StartTime)
.ToListAsync(cancellationToken);
@@ -166,9 +194,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
/// <inheritdoc />
public Task<StoreFee?> GetStoreFeeAsync(long storeId, long tenantId, CancellationToken cancellationToken = default)
{
return context.StoreFees
.AsNoTracking()
.Where(x => x.TenantId == tenantId && x.StoreId == storeId)
var query = context.StoreFees.AsNoTracking();
if (tenantId <= 0)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
return query
.Where(x => x.StoreId == storeId)
.FirstOrDefaultAsync(cancellationToken);
}
@@ -188,9 +226,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
/// <inheritdoc />
public async Task<IReadOnlyList<StoreQualification>> GetQualificationsAsync(long storeId, long tenantId, CancellationToken cancellationToken = default)
{
var qualifications = await context.StoreQualifications
.AsNoTracking()
.Where(x => x.TenantId == tenantId && x.StoreId == storeId)
var query = context.StoreQualifications.AsNoTracking();
if (tenantId <= 0)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
var qualifications = await query
.Where(x => x.StoreId == storeId)
.OrderBy(x => x.SortOrder)
.ThenBy(x => x.QualificationType)
.ToListAsync(cancellationToken);
@@ -259,9 +307,19 @@ public sealed class EfStoreRepository(TakeoutAppDbContext context) : IStoreRepos
/// <inheritdoc />
public async Task<IReadOnlyList<StoreDeliveryZone>> GetDeliveryZonesAsync(long storeId, long tenantId, CancellationToken cancellationToken = default)
{
var zones = await context.StoreDeliveryZones
.AsNoTracking()
.Where(x => x.TenantId == tenantId && x.StoreId == storeId)
var query = context.StoreDeliveryZones.AsNoTracking();
if (tenantId <= 0)
{
query = query.IgnoreQueryFilters()
.Where(x => x.DeletedAt == null);
}
else
{
query = query.Where(x => x.TenantId == tenantId);
}
var zones = await query
.Where(x => x.StoreId == storeId)
.OrderBy(x => x.SortOrder)
.ToListAsync(cancellationToken);