feat: 固定创建真实采购任务 (#112)

admin/handler/web/others.go

@@ -66,7 +66,7 @@ func (h *Handler) renderSybListWithLoginReason(c *gin.Context, keyword, pageRaw,
 			"读取顺运宝同步记录失败，数据没有被改动。刷新页面重试；一直失败请把这句话报给维护者。")
 		return
 	}
-	assignableClients, err := service.ListAssignableClients(h.db, currentUser(c), h.onlineThreshold)
+	assignableClients, err := service.ListLivePurchaseClients(h.db, currentUser(c), h.onlineThreshold)
 	if err != nil {
 		fail(c, http.StatusInternalServerError, "读取可分配客户端失败，数据没有被改动。")
 		return
@@ -630,12 +630,10 @@ func (h *Handler) SybCreateTask(c *gin.Context) {
 		}
 		requests = append(requests, service.PurchaseTaskRequest{SybID: sybID, MaxPriceCent: cent})
 	}
-	result, err := service.CreatePurchaseTasksWithOptions(h.db, currentUser(c), requests, service.PurchaseTaskOptions{
-		ClientID:         c.PostForm("client_id"),
-		ExecutionMode:    model.TaskExecutionMode(c.PostForm("execution_mode")),
-		LiveAcknowledged: c.PostForm("live_acknowledged") == "1",
-		LiveConfirmation: c.PostForm("live_confirmation"),
-	})
+	result, err := service.CreatePurchaseTasksWithOptions(
+		h.db, currentUser(c), requests,
+		purchaseTaskOptionsFromForm(c, time.Now().UTC().Add(-h.onlineThreshold).Format(model.TimeLayout)),
+	)
 	if err != nil {
 		h.sybRedirect(c, "采购任务没有创建："+err.Error())
 		return
@@ -644,6 +642,18 @@ func (h *Handler) SybCreateTask(c *gin.Context) {
 	h.sybRedirect(c, purchaseTaskResultMessage(result))
 }
 
+func purchaseTaskOptionsFromForm(c *gin.Context, clientSeenAfter string) service.PurchaseTaskOptions {
+	return service.PurchaseTaskOptions{
+		ClientID: c.PostForm("client_id"),
+		// Admin 新建采购任务固定为 live。不能相信浏览器提交的 execution_mode，
+		// 否则篡改表单就能绕过真实采购确认和审计。
+		ExecutionMode:    model.TaskExecutionLive,
+		LiveAcknowledged: c.PostForm("live_acknowledged") == "1",
+		LiveConfirmation: c.PostForm("live_confirmation"),
+		ClientSeenAfter:  clientSeenAfter,
+	}
+}
+
 func purchaseTaskResultMessage(result service.PurchaseTaskResult) string {
 	parts := []string{fmt.Sprintf("已创建 %d 个采购任务", result.Created)}
 	if len(result.Failures) > 0 {

admin/handler/web/others_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"github.com/gin-gonic/gin"
+
+	"cmautobuy/admin/model"
 )
 
 func sybPostContext(t *testing.T, values url.Values) (*gin.Context, *httptest.ResponseRecorder) {
@@ -147,3 +149,23 @@ func TestSybHistoryPartialPagination_翻页继续使用片段路由(t *testing.T
 		}
 	}
 }
+
+func TestPurchaseTaskOptionsFromForm_忽略篡改模式并固定Live(t *testing.T) {
+	context, _ := sybPostContext(t, url.Values{
+		"client_id":         {"CLIENT-LIVE"},
+		"execution_mode":    {"dry_run"},
+		"live_acknowledged": {"1"},
+		"live_confirmation": {"创建未付款订单"},
+	})
+
+	options := purchaseTaskOptionsFromForm(context, "2026-08-10T09:00:00Z")
+	if options.ExecutionMode != model.TaskExecutionLive {
+		t.Fatalf("篡改 execution_mode 不得创建演练任务，实际 %q", options.ExecutionMode)
+	}
+	if options.ClientID != "CLIENT-LIVE" || !options.LiveAcknowledged || options.LiveConfirmation != "创建未付款订单" {
+		t.Fatalf("真实采购确认字段读取错误: %+v", options)
+	}
+	if options.ClientSeenAfter != "2026-08-10T09:00:00Z" {
+		t.Fatalf("在线截止时间未传给服务层: %+v", options)
+	}
+}