feat: 增强管理员功能与数据处理

- 在多个控制器中引入 agent_node_id，以支持基于代理节点的权限和数据过滤。 - 更新 AdminRole 和 AdminUser 模型，新增角色范围和代理节点相关功能，提升角色管理的灵活性。 - 在请求验证中添加 agent_node_id 字段，确保 API 接口支持代理节点的相关操作。 - 优化 LotterySettings 服务，支持批量写入设置，提升配置管理的效率。 - 更新仪表板和报告服务，增强数据统计功能，确保管理员能够获取更全面的统计信息。
2026-06-02 14:36:58 +08:00
parent d5232c756f
commit 0841fbed32
96 changed files with 5004 additions and 182 deletions
--- a/app/Support/AgentRoleAuthorization.php
+++ b/app/Support/AgentRoleAuthorization.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Support;
+
+use App\Models\AdminRole;
+use App\Models\AdminUser;
+use App\Models\AgentNode;
+use Illuminate\Validation\ValidationException;
+
+final class AgentRoleAuthorization
+{
+    public static function roleVisibleTo(AdminUser $admin, AdminRole $role): bool
+    {
+        if ($admin->isSuperAdmin()) {
+            return true;
+        }
+
+        if ($role->scope_type !== AdminRole::SCOPE_AGENT || $role->owner_agent_id === null) {
+            return false;
+        }
+
+        $owner = AgentNode::query()->find((int) $role->owner_agent_id);
+        if ($owner === null) {
+            return false;
+        }
+
+        return AdminAgentScope::nodeVisibleTo($admin, $owner);
+    }
+
+    public static function roleManageableBy(AdminUser $admin, AdminRole $role): bool
+    {
+        if ($role->delegated_from_role_id !== null) {
+            return false;
+        }
+
+        if (! self::roleVisibleTo($admin, $role)) {
+            return false;
+        }
+
+        return $admin->isSuperAdmin() || $admin->hasAdminPermission('prd.agent.role.manage');
+    }
+
+    /**
+     * @param  list<string>  $permissionSlugs
+     */
+    public static function assertSlugsWithinActor(AdminUser $actor, array $permissionSlugs): void
+    {
+        if ($actor->isSuperAdmin()) {
+            return;
+        }
+
+        $allowed = $actor->adminPermissionSlugs();
+        $invalid = array_values(array_diff($permissionSlugs, $allowed));
+        if ($invalid !== []) {
+            throw ValidationException::withMessages([
+                'permission_slugs' => ['permission_exceeds_actor: '.implode(', ', $invalid)],
+            ]);
+        }
+    }
+
+    /**
+     * @param  list<string>  $permissionSlugs
+     */
+    public static function assertSlugsForAgentRole(
+        AdminUser $actor,
+        AgentNode $ownerAgent,
+        array $permissionSlugs,
+    ): void {
+        if ($actor->isSuperAdmin()) {
+            return;
+        }
+
+        self::assertSlugsWithinActor($actor, $permissionSlugs);
+        AgentDelegationAuthorization::assertRoleSlugsWithinAgentCeiling($ownerAgent, $permissionSlugs, $actor);
+    }
+
+    public static function denyUnlessRoleManageable(AdminUser $admin, AdminRole $role): ?\Illuminate\Http\JsonResponse
+    {
+        if (self::roleManageableBy($admin, $role)) {
+            return null;
+        }
+
+        return ApiMessage::errorResponse(
+            request(),
+            'admin.agent_role_manage_denied',
+            \App\Lottery\ErrorCode::AdminForbidden->value,
+            null,
+            403,
+        );
+    }
+}