feat(ops): 总部可按百分比限制接口放行并开关企微通知

线上需要按账户、用户和功能控制登录与加载成功率，同时单独停发订单、核销和账单通知。

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/ops/admin-api-access.controller.ts

@@ -0,0 +1,67 @@
+import { Body, Controller, Delete, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
+import type { ApiAccessGlobalItem, ApiAccessNotifyItem, ApiAccessOverrideCreate } from '@dukang/shared-types';
+import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
+import { HqPermissionGuard, RequireHqPermissions } from '../../common/guards/hq-permission.guard';
+import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
+import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
+import { parseBigIntParam } from '../../common/parse-bigint';
+import { ApiAccessService } from '../../common/api-access/api-access.service';
+
+@Controller('admin/api-access')
+@UseGuards(HqAuthGuard, HqPermissionGuard)
+@RequireHqPermissions('api_access')
+export class AdminApiAccessController {
+  constructor(private readonly apiAccess: ApiAccessService) {}
+
+  @Get()
+  getForm() {
+    return this.apiAccess.getForm();
+  }
+
+  @Get('actors')
+  searchActors(@Query('scope') scope?: string, @Query('q') q?: string) {
+    return this.apiAccess.searchActors(scope || '', q || '');
+  }
+
+  @Put('globals')
+  @HqOperation({
+    action: HqOperationAction.API_ACCESS_UPDATE,
+    refType: 'API_ACCESS',
+    batch: true,
+    includeBody: true,
+  })
+  updateGlobals(@Body() body: { items?: ApiAccessGlobalItem[] }) {
+    return this.apiAccess.updateGlobals(body?.items ?? []);
+  }
+
+  @Put('notifies')
+  @HqOperation({
+    action: HqOperationAction.API_ACCESS_UPDATE,
+    refType: 'API_ACCESS',
+    batch: true,
+    includeBody: true,
+  })
+  updateNotifies(@Body() body: { items?: ApiAccessNotifyItem[] }) {
+    return this.apiAccess.updateNotifies(body?.items ?? []);
+  }
+
+  @Post('overrides')
+  @HqOperation({
+    action: HqOperationAction.API_ACCESS_UPDATE,
+    refType: 'API_ACCESS',
+    includeBody: true,
+  })
+  createOverride(@Body() body: ApiAccessOverrideCreate) {
+    return this.apiAccess.createOverride(body);
+  }
+
+  @Delete('overrides/:id')
+  @HqOperation({
+    action: HqOperationAction.API_ACCESS_UPDATE,
+    refType: 'API_ACCESS',
+    refIdField: 'id',
+  })
+  deleteOverride(@Param('id') id: string) {
+    return this.apiAccess.deleteOverride(parseBigIntParam(id, '规则'));
+  }
+}

server/dukang-api/src/modules/ops/admin-stores.service.ts

@@ -921,7 +921,10 @@ export class AdminStoresService {
         action: '新建',
         storeId: store.id.toString(),
       },
-      { handlePath: `/stores?storeId=${store.id.toString()}` },
+      {
+        handlePath: `/stores?storeId=${store.id.toString()}`,
+        accessSubject: { accountType: 'HQ', accountId: actorId.toString() },
+      },
     );
 
     return this.detailStore(store.id, actorId);

server/dukang-api/src/modules/ops/ops.module.ts

@@ -65,6 +65,7 @@ import { AdminHqPermissionsService } from './admin-hq-permissions.service';
 import { AdminDeployController } from './admin-deploy.controller';
 import { AdminDeployService } from './admin-deploy.service';
 import { AdminSystemConfigController } from './admin-system-config.controller';
+import { AdminApiAccessController } from './admin-api-access.controller';
 import { AdminWecomBotsController } from './admin-wecom-bots.controller';
 import { AdminWecomBotsService } from './admin-wecom-bots.service';
 import { AdminWecomMessagePushesController } from './admin-wecom-message-pushes.controller';
@@ -130,6 +131,7 @@ import { PartnerActivityPostersController } from './partner-activity-posters.con
     AdminWechatBindingsController,
     AdminHqPermissionsController,
     AdminSystemConfigController,
+    AdminApiAccessController,
     AdminWecomBotsController,
     AdminWecomMessagePushesController,
     AdminWecomApiPluginsController,

server/dukang-api/src/modules/store/store.service.ts

@@ -99,6 +99,7 @@ export class StoreService {
     submitter?: string | null;
     submitType: '新建' | '重提';
     handlePath?: string;
+    partnerAccountId: bigint;
   }) {
     void this.wecomPush.dispatchEvent(
       'store.audit_pending',
@@ -113,6 +114,7 @@ export class StoreService {
       {
         handlePath:
           opts.handlePath || `/stores?auditStatus=PENDING&storeId=${opts.storeId.toString()}`,
+        accessSubject: { accountType: 'PARTNER', accountId: opts.partnerAccountId.toString() },
       },
     );
   }
@@ -654,6 +656,7 @@ export class StoreService {
         submitter,
         partnerLabel,
         submitType: '新建',
+        partnerAccountId,
       });
     }
 
@@ -825,6 +828,7 @@ export class StoreService {
         submitter,
         partnerLabel,
         submitType: '重提',
+        partnerAccountId,
       });
     }
 
@@ -951,6 +955,7 @@ export class StoreService {
         submitter,
         partnerLabel,
         submitType: '重提',
+        partnerAccountId,
       });
     }