feat: 固定创建真实采购任务 (#112)

admin/handler/web/others.go

@@ -66,7 +66,7 @@ func (h *Handler) renderSybListWithLoginReason(c *gin.Context, keyword, pageRaw,
 			"读取顺运宝同步记录失败，数据没有被改动。刷新页面重试；一直失败请把这句话报给维护者。")
 		return
 	}
-	assignableClients, err := service.ListAssignableClients(h.db, currentUser(c), h.onlineThreshold)
+	assignableClients, err := service.ListLivePurchaseClients(h.db, currentUser(c), h.onlineThreshold)
 	if err != nil {
 		fail(c, http.StatusInternalServerError, "读取可分配客户端失败，数据没有被改动。")
 		return
@@ -630,12 +630,10 @@ func (h *Handler) SybCreateTask(c *gin.Context) {
 		}
 		requests = append(requests, service.PurchaseTaskRequest{SybID: sybID, MaxPriceCent: cent})
 	}
-	result, err := service.CreatePurchaseTasksWithOptions(h.db, currentUser(c), requests, service.PurchaseTaskOptions{
-		ClientID:         c.PostForm("client_id"),
-		ExecutionMode:    model.TaskExecutionMode(c.PostForm("execution_mode")),
-		LiveAcknowledged: c.PostForm("live_acknowledged") == "1",
-		LiveConfirmation: c.PostForm("live_confirmation"),
-	})
+	result, err := service.CreatePurchaseTasksWithOptions(
+		h.db, currentUser(c), requests,
+		purchaseTaskOptionsFromForm(c, time.Now().UTC().Add(-h.onlineThreshold).Format(model.TimeLayout)),
+	)
 	if err != nil {
 		h.sybRedirect(c, "采购任务没有创建："+err.Error())
 		return
@@ -644,6 +642,18 @@ func (h *Handler) SybCreateTask(c *gin.Context) {
 	h.sybRedirect(c, purchaseTaskResultMessage(result))
 }
 
+func purchaseTaskOptionsFromForm(c *gin.Context, clientSeenAfter string) service.PurchaseTaskOptions {
+	return service.PurchaseTaskOptions{
+		ClientID: c.PostForm("client_id"),
+		// Admin 新建采购任务固定为 live。不能相信浏览器提交的 execution_mode，
+		// 否则篡改表单就能绕过真实采购确认和审计。
+		ExecutionMode:    model.TaskExecutionLive,
+		LiveAcknowledged: c.PostForm("live_acknowledged") == "1",
+		LiveConfirmation: c.PostForm("live_confirmation"),
+		ClientSeenAfter:  clientSeenAfter,
+	}
+}
+
 func purchaseTaskResultMessage(result service.PurchaseTaskResult) string {
 	parts := []string{fmt.Sprintf("已创建 %d 个采购任务", result.Created)}
 	if len(result.Failures) > 0 {