perms-system-server/internal/logic/member/removeMemberLogic.go

package member

import (
	"context"

	"perms-system-server/internal/consts"
	"perms-system-server/internal/loaders"
	authHelper "perms-system-server/internal/logic/auth"
	"perms-system-server/internal/response"
	"perms-system-server/internal/svc"
	"perms-system-server/internal/types"

	"github.com/zeromicro/go-zero/core/logx"
	"github.com/zeromicro/go-zero/core/stores/sqlx"
)

type RemoveMemberLogic struct {
	logx.Logger
	ctx    context.Context
	svcCtx *svc.ServiceContext
}

func NewRemoveMemberLogic(ctx context.Context, svcCtx *svc.ServiceContext) *RemoveMemberLogic {
	return &RemoveMemberLogic{
		Logger: logx.WithContext(ctx),
		ctx:    ctx,
		svcCtx: svcCtx,
	}
}

// RemoveMember 移除产品成员。在事务内同时清理该用户在产品下的角色和个性化权限绑定后移除成员记录。不能移除产品的最后一个 ADMIN。
func (l *RemoveMemberLogic) RemoveMember(req *types.RemoveMemberReq) error {
	member, err := l.svcCtx.SysProductMemberModel.FindOne(l.ctx, req.Id)
	if err != nil {
		return response.ErrNotFound("成员不存在")
	}

	if err := authHelper.CheckManageAccess(l.ctx, l.svcCtx, member.UserId, member.ProductCode); err != nil {
		return err
	}

	if err := l.svcCtx.SysProductMemberModel.TransactCtx(l.ctx, func(ctx context.Context, session sqlx.Session) error {
		locked, err := l.svcCtx.SysProductMemberModel.FindOneForUpdateTx(ctx, session, req.Id)
		if err != nil {
			return response.ErrNotFound("成员不存在")
		}
		if locked.MemberType == consts.MemberTypeAdmin && locked.Status == consts.StatusEnabled {
			// 使用 CountOtherActiveAdminsTx 排除目标自己，返回 0 即目标为最后一个 active admin，
			// 不再依赖"count<=1 包含自己"的反向推理（见审计 L-5）。
			otherAdminCount, err := l.svcCtx.SysProductMemberModel.CountOtherActiveAdminsTx(ctx, session, member.ProductCode, locked.Id)
			if err != nil {
				return err
			}
			if otherAdminCount == 0 {
				return response.ErrBadRequest("不能移除该产品的最后一个管理员")
			}
		}
		if err := l.svcCtx.SysUserRoleModel.DeleteByUserIdForProductTx(ctx, session, member.UserId, member.ProductCode); err != nil {
			return err
		}
		if err := l.svcCtx.SysUserPermModel.DeleteByUserIdForProductTx(ctx, session, member.UserId, member.ProductCode); err != nil {
			return err
		}
		return l.svcCtx.SysProductMemberModel.DeleteWithTx(ctx, session, req.Id)
	}); err != nil {
		return err
	}

	// 审计 L-R13-5 方案 A：移除成员后 UD 里仍有旧 MemberType / Roles / Perms，必须立刻失效；
	// 断连也不能让"已移除"的会话继续活 5 分钟。
	cleanCtx, cancel := loaders.DetachCacheCleanCtx(l.ctx)
	defer cancel()
	l.svcCtx.UserDetailsLoader.Del(cleanCtx, member.UserId, member.ProductCode)
	return nil
}