Agent-System/internal/projectinstance/document_access.go

package projectinstance

import (
	"context"
)

const (
	DocAccessActionView    = "view"
	DocAccessActionEdit    = "edit"
	DocAccessActionSubmit  = "submit"
	DocAccessActionReview  = "review"
	DocAccessActionApprove = "approve"
	DocAccessActionRun     = "run"

	AccessCodeDocTaskDisabled = "DOC_TASK_DISABLED"
	AccessCodeNotCurrentStage = "DOC_TASK_NOT_IN_ACTIVE_STAGE"
	AccessCodeForbiddenDuty   = "DOC_DUTY_FORBIDDEN"
	AccessCodeDutyNotManaged  = "DOC_DUTY_NOT_MANAGED"
	AccessCodeInstanceClosed  = "WORKFLOW_INSTANCE_CLOSED"
)

// DocAccessDecision 统一文档任务访问判定结果。
type DocAccessDecision struct {
	Allowed bool   `json:"allowed"`
	Code    string `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
}

// CheckDocTaskAccess 对治理实例下的文档任务做判定。
//
// GetGoverningInstanceForAccess：从未激活 → 允许（legacy）；completed/terminated → InstanceClosed；
// 存储错误 fail-closed；live 下对非职责/非活动阶段拒绝 run/edit。
func (s *Service) CheckDocTaskAccess(
	ctx context.Context,
	projectID int64,
	userID int64,
	taskKey string,
	action string,
	isCreator bool,
) DocAccessDecision {
	allow := DocAccessDecision{Allowed: true}
	if s == nil || s.store == nil || projectID <= 0 || userID <= 0 || taskKey == "" {
		return allow
	}

	gov, err := s.store.GetGoverningInstanceForAccess(ctx, projectID)
	if err != nil {
		return DocAccessDecision{Allowed: false, Code: AccessCodeInstanceClosed, Message: "工作流实例不可用"}
	}
	if gov == nil {
		return allow
	}
	if IsClosedInstanceStatus(gov.Status) {
		return DocAccessDecision{
			Allowed: false,
			Code:    AccessCodeInstanceClosed,
			Message: "工作流实例已结束",
		}
	}

	detail, err := s.store.GetInstanceByID(ctx, gov.ID)
	if err != nil || detail == nil {
		return DocAccessDecision{Allowed: false, Code: AccessCodeInstanceClosed, Message: "工作流实例不可用"}
	}

	var docInst *DocTaskInstance
	var stageKey string
	for _, st := range detail.Stages {
		for i := range st.DocTasks {
			if st.DocTasks[i].TaskKey == taskKey {
				copyDoc := st.DocTasks[i]
				docInst = &copyDoc
				stageKey = st.StageKey
				break
			}
		}
		if docInst != nil {
			break
		}
	}
	if docInst == nil {
		return allow
	}

	if docInst.Status == "skipped_disabled" {
		return DocAccessDecision{
			Allowed: false,
			Code:    AccessCodeDocTaskDisabled,
			Message: "该文档已被创建者禁用",
		}
	}

	if stageKey != "" && stageKey != detail.ActiveStageKey {
		if action != DocAccessActionView {
			return DocAccessDecision{
				Allowed: false,
				Code:    AccessCodeNotCurrentStage,
				Message: "文档不在当前活动阶段",
			}
		}
	}

	if action == DocAccessActionView {
		return allow
	}

	planTask := findDocTaskPlan(gov.ConfigSnapshot, taskKey)
	if planTask == nil || !planTask.Enabled {
		return DocAccessDecision{
			Allowed: false,
			Code:    AccessCodeDocTaskDisabled,
			Message: "该文档已被创建者禁用",
		}
	}

	if classifyDocDuty(planTask.Duties) == DutyModeNone {
		switch action {
		case DocAccessActionRun, DocAccessActionEdit:
			if isCreator {
				return allow
			}
			return DocAccessDecision{
				Allowed: false,
				Code:    AccessCodeForbiddenDuty,
				Message: "未纳入人工审批的文档仅创建者可编辑或执行",
			}
		case DocAccessActionReview, DocAccessActionApprove, DocAccessActionSubmit:
			return DocAccessDecision{
				Allowed: false,
				Code:    AccessCodeDutyNotManaged,
				Message: "该文档未纳入人工审批，不能审核、批准或提交审批",
			}
		}
	}

	if isCreator {
		return allow
	}
	if docTaskDutyForUser(*planTask, userID) {
		return allow
	}
	return DocAccessDecision{
		Allowed: false,
		Code:    AccessCodeForbiddenDuty,
		Message: "当前用户不是该文档职责人",
	}
}

func findDocTaskPlan(plan WorkflowPlan, taskKey string) *DocTaskPlan {
	for _, st := range plan.Stages {
		for i := range st.DocTasks {
			if st.DocTasks[i].TaskKey == taskKey {
				return &st.DocTasks[i]
			}
		}
	}
	return nil
}