xiaoshu-app/scripts/cloud/store-scope.js

// Store requests use an explicit capability list; new headquarters endpoints
// stay closed until their ownership rules have been reviewed.
const STORE_OPERATIONS = new Set([
 'ops/store/home','ops/dashboard/schedule-trend','ops/live/versions','ops/users/list','ops/users/detail','ops/users/create',
 'ops/users/update-profile','ops/users/reset-password','ops/users/save-note','ops/users/notes',
 'ops/users/audit','ops/users/export','ops/users/reveal-mobile','ops/users/change-status',
 'ops/users/credit-accounts','ops/users/credit-preview','ops/users/adjust-balance','ops/users/credit-ledger',
 'ops/stores/credit-accounts','ops/stores/credit-ledger',
 'ops/coaches/list','ops/coaches/detail','ops/coaches/create','ops/coaches/update','ops/coaches/delete',
 'ops/coach-availability/list','ops/coach-availability/save','ops/coach-availability/delete',
 'ops/lessons/list','ops/lessons/detail','ops/learning-reports/list','ops/learning-reports/detail','ops/learning-reports/export',
 'ops/support-requests/list','ops/support-requests/process',
 'ops/payroll/overview','ops/payroll/preview','ops/payroll/list','ops/payroll/detail','ops/payroll/export','ops/payroll/coaches',
 'ops/payroll/create','ops/payroll/refresh','ops/payroll/review','ops/payroll/mark-paid','ops/payroll/add-adjustment','ops/payroll/exclude-line',
 'ops/payroll/review-rewards','ops/payroll/cutoff','ops/pay-rates/list','ops/teaching-rules/list',
 'ops/course-bindings/list','ops/course-bindings/options','ops/course-bindings/save',
 'ops/course-bindings/recycle','ops/course-bindings/restore','ops/appointments/list',
 'ops/schedule/calendar','ops/appointments/preflight','ops/appointments/create',
 'ops/appointments/update','ops/appointments/cancel','ops/appointments/restore'
]);
function storeOwns(context,row) {
 return !context.storeId || (pointerId(row.company)||row.company)===pointerId(context.company) &&
   number(legacyOf(row).ParentUserID)===context.storeId && row.identityType==='member' && row.isDeleted!==true;
}
async function storeAssertMember(context,input,id,objectId=false) {
 if(!context.storeId)return;
 const row=await Psql.oneOrNone('SELECT "objectId",company,"identityType","isDeleted","legacyUserData" FROM "_User" WHERE company=$1 AND '+(objectId?'"objectId"=$2':'"legacyUserId"::text=$2'),[pointerId(context.company),text(id)]);
 if(!row||!storeOwns(context,row))fail(404,'学生不存在或不属于本店');
}
async function storeAssertObject(context,input,className,target) {
 if(!context.storeId)return;
 if(className==='_User'){if(text(input.operation).startsWith('ops/coaches/'))return storeAssertCoach(context,target.id,true);return storeAssertMember(context,input,target.id,true);}
 if(className==='CoachAvailability')return storeAssertCoach(context,target.get('coachId'));
 if(className!=='CommonModel')fail(403,'门店无权访问此类记录');
 const map={54:['CourseAppointment','szyh'],58:['CourseBinding','yhid']},entry=map[number(target.get('modelId'))];
 if(!entry)fail(403,'门店无权操作此类记录');
 const row=await Psql.oneOrNone('SELECT "'+entry[1]+'" AS uid FROM "'+entry[0]+'" WHERE company=$1 AND id::text=$2::text',[pointerId(context.company),target.get('itemId')]);
 if(!row)fail(404,'记录不存在');await storeAssertMember(context,input,row.uid);
}
async function prepareStoreRequest(context,input,payload) {
 if(!STORE_OPERATIONS.has(text(input.operation)))fail(403,'门店账号无权访问此功能');
 if(input.companyId&&text(input.companyId)!==pointerId(context.company))fail(403,'不能切换其他帐套');
 // Private scope values are overwritten, never trusted from browser filters.
 input.companyId=pointerId(context.company);input._storeId=context.storeId;input.storeId=context.storeId;input.refresh=false;input.legacyRefresh=false;
 input.filters={...(input.filters||{}),parentUserId:context.storeId,storeId:context.storeId};input.source='database';
 if(['ops/stores/credit-accounts','ops/stores/credit-ledger'].includes(input.operation)){
  if(text(input.objectId||input.targetId)!==(context.store||context.current).id)fail(404,'门店不存在');
 }
 if(['ops/users/create','ops/users/update-profile','ops/coaches/create','ops/coaches/update','ops/coaches/delete'].includes(input.operation)){
  if(number(payload.parentUserId)&&number(payload.parentUserId)!==context.storeId)fail(403,'不能将学生归属其他门店');
  payload.parentUserId=context.storeId;
 }
 if(input.operation==='ops/users/credit-preview'||input.operation==='ops/users/adjust-balance'){
  if(!['add','deduct'].includes(text(payload.direction)||'add'))fail(403,'门店只能划拨或按原单退回额度');
  if(payload.sourceTransactionId){const row=await Psql.oneOrNone('SELECT "storeId" FROM "CreditTransaction" WHERE company=$1 AND "objectId"=$2',[pointerId(context.company),text(payload.sourceTransactionId)]);if(!row||number(row.storeId)!==context.storeId)fail(404,'原单不属于本店');}
 }
 if(input.operation.startsWith('ops/coaches/')&&text(input.objectId||input.targetId))await storeAssertCoach(context,input.objectId||input.targetId,true);
 if(input.operation==='ops/coach-availability/list'&&input.filters.coachId)await storeAssertCoach(context,input.filters.coachId);
 if(input.operation==='ops/stores/detail'&&text(input.objectId||input.targetId)!==(context.store||context.current).id)fail(404,'门店不存在');
 for(const id of [input.studentId,payload.studentId])if(id!==undefined&&id!==null&&id!=='')await storeAssertMember(context,input,id);
 // Check target before idempotent replay as well as before any mutation.
 if(input.operation.startsWith('ops/users/')&&text(input.objectId||input.targetId))await storeAssertMember(context,input,input.objectId||input.targetId,true);
 if(['ops/appointments/preflight','ops/appointments/update','ops/appointments/cancel','ops/appointments/restore','ops/course-bindings/recycle','ops/course-bindings/restore'].includes(input.operation)&&input.targetId)await scopedObject('CommonModel',text(input.targetId),context,input);
 if(number(payload.coachId)&&!await userByLegacyId(context,input,payload.coachId,3))fail(404,'陪练老师不存在或不属于本店');
}
function storePublicSchedule(data) {
 return {...data,appointments:data.appointments.map(({teacherPaySnapshot,...row})=>row),courses:data.courses||[],workflowIssues:[]};
}
async function storeSchedule(context,input) {
 const from=text(input.dateFrom)||businessDate(),to=text(input.dateTo)||from;
 const [members,appointments,coachRows,summary]=await Promise.all([
  queryUsers(context,input),storeAppointmentRows(context,input,from,to),
  Psql.query('SELECT "objectId","legacyUserId","realName",nickname,username FROM "_User" WHERE company=$1 AND "identityType"=\'coach\' AND "legacyUserData"->>\'ParentUserID\'=$2 AND COALESCE("isDisabled",false)=false AND COALESCE("isDeleted",false)=false ORDER BY "legacyUserId"',[pointerId(context.company),String(context.storeId)]),
  Psql.one('SELECT count(*)::int total,min(left(a.yysj,10)) first,max(left(a.yysj,10)) last FROM "CourseAppointment" a JOIN "_User" s ON s.company=a.company AND s."legacyUserId"::text=a.szyh::text WHERE a.company=$1 AND s."identityType"=\'member\' AND s."legacyUserData"->>\'ParentUserID\'=$2 AND COALESCE(s."isDeleted",false)=false',[pointerId(context.company),String(context.storeId)])
 ]);
 const selected=appointments.filter(row=>!number(input.filters?.coachId)||row.coachId===number(input.filters.coachId));
 const coaches=coachRows.map(row=>({objectId:row.objectId,userId:number(row.legacyUserId),displayName:displayName(row),mobile:'',mobileMasked:'',status:'active',statusLabel:'正常',todayAppointments:selected.filter(a=>a.coachId===number(row.legacyUserId)&&!a.cancelled).length,availabilityConfigured:false}));
 return storePublicSchedule(await enrollmentSchedule(context,input,{dateFrom:from,dateTo:to,members,coaches,appointments:selected,unassigned:selected.filter(a=>!a.coachId&&!a.cancelled),totalAppointments:summary.total,dataDateFrom:text(summary.first),dataDateTo:text(summary.last),refreshedAt:new Date().toISOString(),source:'database',liveSourceAvailable:true,liveSourceMessage:'本店排课',sync:{state:'synced',label:'本店数据'}}));
}
async function storeHome(context,input) {
 const members=await queryUsers(context,input),store=context.store||context.current;
 return {storeId:context.storeId,storeObjectId:store.id,storeName:storeNameOf(store.toJSON()),summary:memberSummary(members),refreshedAt:new Date().toISOString()};
}
function storeSafeRules(context,value) {
 if(!context.storeId)return value;
 // Retain teaching costs required for enrollment, omit headquarters pay data.
 const clean=item=>{if(Array.isArray(item))return item.map(clean);if(!item||typeof item!=='object')return item;return Object.fromEntries(Object.entries(item).filter(([key])=>!['teacherPay','teacherPaySnapshot','operatorId'].includes(key)).map(([key,v])=>[key,clean(v)]));};
 const result=clean(value);if(result.conflicts)result.conflicts=result.conflicts.map(({targetId,...row})=>row);return result;
}

async function storeAssertCoach(context,id,objectId=false) {
 const row=await Psql.oneOrNone('SELECT "objectId","legacyUserId" FROM "_User" WHERE company=$1 AND '+(objectId?'"objectId"=$2':'"legacyUserId"::text=$2')+' AND "identityType"=\'coach\' AND "legacyUserData"->>\'ParentUserID\'=$3 AND NOT COALESCE("isDeleted",false)',[pointerId(context.company),text(id),String(context.storeId)]);
 if(!row)fail(404,'陪练老师不存在或不属于本店');return row;
}
async function storeCoachRows(context,input) {
 const co=companyIdOf(context,input),store=context.store||context.current,month=/^\d{4}-(0[1-9]|1[0-2])$/.test(text(input.month))?text(input.month):businessDate().slice(0,7),monthEnd=new Date(Date.UTC(Number(month.slice(0,4)),Number(month.slice(5)),0)).toISOString().slice(0,10);
 const [users,schedule,payroll,availability]=await Promise.all([
  Psql.query('SELECT * FROM "_User" WHERE company=$1 AND "identityType"=\'coach\' AND "legacyUserData"->>\'ParentUserID\'=$2 AND NOT COALESCE("isDeleted",false) ORDER BY "legacyUserId"',[co,String(context.storeId)]),
  storeAppointmentRows(context,input,month+'-01',monthEnd),payrollPreviewData(context,input,month,true,false,{forDashboard:true}),storeAvailability(context,input)
 ]);
 const history=appointmentHistory(schedule),today=businessDate(),rows=users.map(u=>{const uid=number(u.legacyUserId),pay=payroll.coachItems.find(p=>p.coachId===uid),appts=schedule.filter(a=>a.coachId===uid&&!a.cancelled);return{objectId:u.objectId,userId:uid,username:u.username,displayName:displayName(u),mobile:mobileOf(u),mobileMasked:maskMobile(mobileOf(u)),parentUserId:context.storeId,storeName:storeNameOf(store.toJSON()),status:u.isDisabled?'disabled':'active',statusLabel:u.isDisabled?'已停用':'正常',todayAppointments:appts.filter(a=>businessDate(a.startsAt)===today).length,pendingAppointments:appts.filter(a=>a.statusCode<30&&businessDate(a.startsAt)>=today).length,...(history.byCoach.get(uid)||{totalAppointments:0,lastAppointmentAt:'',nextAppointmentAt:''}),monthLessons:pay?.lessonCount||0,monthHours:pay?.totalHours||0,estimatedPay:pay?.payableAmount||0,averageScore:pay?.averageScore||0,lastLessonAt:pay?.latestLessonAt||'',availabilityConfigured:availability.some(a=>a.coachId===uid),updatedAt:dateIso(u.updatedAt),readOnly:false,sourceLabel:'本店老师'};});
 return {rows,payroll,schedule,availability,month,history};
}
async function storeCoachPage(context,input) {
 const d=await storeCoachRows(context,input),store=context.store||context.current,status=text(input.filters?.status||'all');
 return{...pageRows(searchRows(d.rows.filter(r=>status==='all'||r.status===status),input).sort(coachActivityCompare),input),canManage:true,summary:{total:d.rows.length,active:d.rows.filter(r=>r.status==='active').length,disabled:d.rows.filter(r=>r.status==='disabled').length,monthActive:d.rows.filter(r=>r.monthLessons>0).length,liveOnly:0},stores:[{objectId:store.id,userId:context.storeId,displayName:storeNameOf(store.toJSON())}],payrollMonth:d.month,payrollSourceStatus:d.payroll.sourceStatus,payrollRefreshedAt:d.payroll.refreshedAt,liveSourceAvailable:true,liveSourceMessage:'本店陪练与排课',dataDateFrom:d.history.dataDateFrom,dataDateTo:d.history.dataDateTo};
}
async function storeCoachDetail(context,input) {
 await storeAssertCoach(context,input.objectId,true);const d=await storeCoachRows(context,input),coach=d.rows.find(r=>r.objectId===input.objectId);if(!coach)fail(404,'陪练不存在');
 const lines=d.payroll.lines.filter(l=>l.coachId===coach.userId),totals=payrollResult(d.month,lines,d.payroll.sourceStatus,{}),current=totals.coachItems[0]||{coachId:coach.userId,coachName:coach.displayName,...totals,type30Count:0,type60Count:0,trialCount:0,type4Count:0,averageScore:0};
 const [review,stored,batches]=await Promise.all([
  Psql.one('SELECT COUNT(*)::int total FROM "MemoryPracticeRecord" WHERE company=$1 AND plid::text=$2',[companyIdOf(context,input),String(coach.userId)]),
  Psql.query('SELECT l.* FROM "PayrollLine" l JOIN "PayrollBatch" b ON b."objectId"=l."batchId" AND b.company=l.company WHERE l.company=$1 AND b."scopeStoreId"=$2 AND l."coachId"=$3 AND b.month=$4',[companyIdOf(context,input),context.storeId,coach.userId,d.month]),
  storePayrollPage(context,{...input,month:d.month,page:1,pageSize:100})
 ]);
 const history=batches.items.map(b=>{const own=stored.filter(l=>l.batchId===b.objectId&&!l.excluded).map(payrollLine);return own.length?{...b,...payrollResult(d.month,own,d.payroll.sourceStatus,{})}:null;}).filter(Boolean);
 return{coach,profile:{username:coach.username,mobile:coach.mobile,storeName:coach.storeName,statusLabel:coach.statusLabel,sourceLabel:'本店老师'},currentPayroll:current,availability:d.availability.filter(a=>a.coachId===coach.userId),appointments:d.schedule.filter(a=>a.coachId===coach.userId),lessons:lines,reviews:lines.filter(l=>l.score||l.comment),payrolls:[{...totals,objectId:'preview:'+d.month,statusLabel:'本月预估'},...history],reviewTaskCount:number(review.total),payrollMonth:d.month,payrollSourceStatus:d.payroll.sourceStatus,refreshedAt:d.payroll.refreshedAt,dataDateFrom:d.history.dataDateFrom,dataDateTo:d.history.dataDateTo};
}
async function storeAvailability(context,input) {
 const rows=await Psql.query('SELECT a.* FROM "CoachAvailability" a JOIN "_User" u ON u.company=a.company AND u."legacyUserId"=a."coachId" WHERE a.company=$1 AND u."identityType"=\'coach\' AND u."legacyUserData"->>\'ParentUserID\'=$2 AND NOT COALESCE(u."isDeleted",false)',[companyIdOf(context,input),String(context.storeId)]);
 return rows.map(r=>({...r,coachId:number(r.coachId),updatedAt:dateIso(r.updatedAt)}));
}
async function storeModuleRequest(context,input,payload) {
 const op=input.operation;
 if(op==='ops/support-requests/list')return supportRequestsPage(context,input);
 if(op==='ops/support-requests/process')return supportRequestProcess(context,input);
 if(op==='ops/lessons/list')return lessonHistoryPage(context,input);
 if(op==='ops/lessons/detail')return lessonHistoryDetail(context,input);
 if(op==='ops/coaches/list')return storeCoachPage(context,input);
 if(op==='ops/coaches/detail')return storeCoachDetail(context,input);
 if(op==='ops/coach-availability/list')return pageRows((await storeAvailability(context,input)).filter(a=>!number(input.filters?.coachId)||a.coachId===number(input.filters.coachId)),input);
 if(op==='ops/payroll/review-rewards'){const d=await reviewRewardPage(companyIdOf(context,input),input);return{...d,items:d.items.map(r=>({...r,canCorrect:false,canConfirm:false}))};}
 if(op==='ops/payroll/cutoff'){const d=await payrollCutoff(context,input,payload);return{...d,conflicts:[],datasets:[],message:'结算来源由总部统一核验，本店沿用已核验的来源。'};}
}

async function storeAppointmentRows(context,input,dateFrom,dateTo) { const companyId=companyIdOf(context,input),from=text(dateFrom),to=text(dateTo);if(!/^\d{4}-\d{2}-\d{2}$/.test(from)||!/^\d{4}-\d{2}-\d{2}$/.test(to)||from>to)fail(400,'排课日期范围无效');const raw=await Psql.query('SELECT c."objectId" AS "targetId",c."generalId",c."status" AS "commonStatus",c."updatedAt" AS "commonUpdatedAt",a.*,s."objectId" AS "studentObjectId",s."realName" AS "studentRealName",s."nickname" AS "studentNickname",s."username" AS "studentUsername",s."legacyUserData" AS "studentLegacy",p."objectId" AS "coachObjectId",p."realName" AS "coachRealName",p."nickname" AS "coachNickname",p."username" AS "coachUsername",p."legacyUserData" AS "coachLegacy",n."nodeName" AS "courseTitle" FROM "CommonModel" c JOIN "CourseAppointment" a ON a."company"=c."company" AND a."id"=c."itemId" LEFT JOIN "_User" s ON s."company"=c."company" AND COALESCE(CAST(s."legacyUserId" AS text),s."legacyUserData"->>\'UserID\')=CAST(a."szyh" AS text) LEFT JOIN "_User" p ON p."company"=c."company" AND COALESCE(CAST(p."legacyUserId" AS text),p."legacyUserData"->>\'UserID\')=COALESCE(NULLIF(CAST(a."pl" AS text),\'\'),CAST(a."fxpl" AS text)) LEFT JOIN "Node" n ON n."company"=c."company" AND CAST(n."nodeId" AS text)=CAST(a."kcid" AS text) WHERE ($1::text IS NULL OR c."company"=$1) AND c."modelId"=54 AND LEFT(REPLACE(COALESCE(NULLIF(CAST(a."yysj" AS text),\'\'),NULLIF(CAST(a."bxrq" AS text),\'\')),\'/\',\'-\'),10) BETWEEN $2 AND $3 AND ($4::text=\'\' OR (s."identityType"=\'member\' AND s."legacyUserData"->>\'ParentUserID\'=$4 AND COALESCE(s."isDeleted",false)=false)) ORDER BY COALESCE(NULLIF(CAST(a."yysj" AS text),\'\'),NULLIF(CAST(a."bxrq" AS text),\'\')) ASC,c."updatedAt" DESC LIMIT 10000',[companyId,from,to,context.storeId?String(context.storeId):'']);return raw.map(appointmentProjection);}