ERP/oa-backend/src/main/java/com/kaidi/oa/web/InternalControlMatrixController.java

package com.kaidi.oa.web;

import com.kaidi.oa.common.ApiException;
import com.kaidi.oa.common.ApiResp;
import com.kaidi.oa.common.NotFoundException;
import com.kaidi.oa.domain.InternalControlMatrix;
import com.kaidi.oa.repository.InternalControlMatrixRepository;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PatchMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.time.Instant;
import java.time.LocalDate;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;

/**
 * 法务合规·内控矩阵。把关键风险点映射到业务流程的控制措施，并定期测试控制有效性。
 * 含控制点登记、控制有效性测试（记录最近测试日 + 有效性结论）、按控制类型/流程的有效性统计。
 *
 * 读口含内部控制治理信息，已登记进 SENSITIVE_READ_PREFIXES；写口受 default-deny 保护。
 */
@RestController
@RequestMapping("/api/oa/control-matrices")
public class InternalControlMatrixController {

    private final InternalControlMatrixRepository repo;

    public InternalControlMatrixController(InternalControlMatrixRepository repo) {
        this.repo = repo;
    }

    @GetMapping
    public ApiResp<List<InternalControlMatrix>> list(@RequestParam(required = false) String controlType,
                                                     @RequestParam(required = false) String effectiveness) {
        if (controlType != null && !controlType.isBlank()) {
            return ApiResp.ok(repo.findByControlType(controlType));
        }
        if (effectiveness != null && !effectiveness.isBlank()) {
            return ApiResp.ok(repo.findByEffectiveness(effectiveness));
        }
        return ApiResp.ok(repo.findAll());
    }

    @GetMapping("/{id}")
    public ApiResp<InternalControlMatrix> get(@PathVariable Long id) {
        return ApiResp.ok(repo.findById(id)
                .orElseThrow(() -> new NotFoundException("control matrix not found: " + id)));
    }

    public record ControlRequest(
            String code, String process, String riskPoint, String controlMeasure, String controlType,
            String frequency, String owner, String effectiveness, String lastTestDate, String remark) {
    }

    @PostMapping
    public ApiResp<InternalControlMatrix> create(@RequestBody ControlRequest req) {
        if (req.process() == null || req.process().isBlank()) {
            throw new ApiException(400, "业务流程(process) 不能为空");
        }
        if (req.controlMeasure() == null || req.controlMeasure().isBlank()) {
            throw new ApiException(400, "控制措施(controlMeasure) 不能为空");
        }
        InternalControlMatrix c = new InternalControlMatrix();
        c.setCode(req.code() == null || req.code().isBlank()
                ? "NKJZ-" + (repo.count() + 1) : req.code());
        c.setProcess(req.process());
        c.setRiskPoint(req.riskPoint());
        c.setControlMeasure(req.controlMeasure());
        c.setControlType(req.controlType() == null || req.controlType().isBlank() ? "预防" : req.controlType());
        c.setFrequency(req.frequency());
        c.setOwner(req.owner());
        c.setEffectiveness(req.effectiveness() == null || req.effectiveness().isBlank() ? "未测试" : req.effectiveness());
        c.setLastTestDate(req.lastTestDate());
        c.setRemark(req.remark());
        c.setCreatedAt(Instant.now());
        return ApiResp.ok(repo.save(c));
    }

    @PatchMapping("/{id}")
    public ApiResp<InternalControlMatrix> update(@PathVariable Long id, @RequestBody ControlRequest req) {
        InternalControlMatrix c = repo.findById(id)
                .orElseThrow(() -> new NotFoundException("control matrix not found: " + id));
        if (req.process() != null && !req.process().isBlank()) c.setProcess(req.process());
        if (req.riskPoint() != null) c.setRiskPoint(req.riskPoint());
        if (req.controlMeasure() != null && !req.controlMeasure().isBlank()) c.setControlMeasure(req.controlMeasure());
        if (req.controlType() != null && !req.controlType().isBlank()) c.setControlType(req.controlType());
        if (req.frequency() != null) c.setFrequency(req.frequency());
        if (req.owner() != null) c.setOwner(req.owner());
        if (req.effectiveness() != null && !req.effectiveness().isBlank()) c.setEffectiveness(req.effectiveness());
        if (req.lastTestDate() != null) c.setLastTestDate(req.lastTestDate());
        if (req.remark() != null) c.setRemark(req.remark());
        return ApiResp.ok(repo.save(c));
    }

    @DeleteMapping("/{id}")
    public ApiResp<Void> delete(@PathVariable Long id) {
        if (!repo.existsById(id)) {
            throw new NotFoundException("control matrix not found: " + id);
        }
        repo.deleteById(id);
        return ApiResp.ok(null);
    }

    // ---------- 控制有效性测试 ----------

    public record TestRequest(String effectiveness, String testDate, String remark) {
    }

    /**
     * 记录一次控制有效性测试：回填测试结论(有效/部分有效/失效)与测试日。未传日期默认今天。
     */
    @PostMapping("/{id}/test")
    public ApiResp<InternalControlMatrix> test(@PathVariable Long id, @RequestBody TestRequest req) {
        InternalControlMatrix c = repo.findById(id)
                .orElseThrow(() -> new NotFoundException("control matrix not found: " + id));
        if (req.effectiveness() == null || req.effectiveness().isBlank()) {
            throw new ApiException(400, "测试结论(effectiveness) 不能为空");
        }
        c.setEffectiveness(req.effectiveness());
        c.setLastTestDate(req.testDate() == null || req.testDate().isBlank()
                ? LocalDate.now().toString() : req.testDate());
        if (req.remark() != null && !req.remark().isBlank()) {
            c.setRemark(req.remark());
        }
        return ApiResp.ok(repo.save(c));
    }

    // ---------- 有效性统计 ----------

    public record EffectivenessSummary(int total, Map<String, Integer> byEffectiveness,
                                       Map<String, Integer> byControlType, int untested) {
    }

    /**
     * 内控矩阵有效性概览：按有效性结论、按控制类型分桶计数，并给未测试控制点数（用于驱动控制测试计划）。
     */
    @GetMapping("/stats/effectiveness")
    public ApiResp<EffectivenessSummary> effectivenessStats() {
        List<InternalControlMatrix> all = repo.findAll();
        Map<String, Integer> byEff = new LinkedHashMap<>();
        Map<String, Integer> byType = new LinkedHashMap<>();
        int untested = 0;
        for (InternalControlMatrix c : all) {
            String eff = c.getEffectiveness() == null || c.getEffectiveness().isBlank() ? "未测试" : c.getEffectiveness();
            String type = c.getControlType() == null || c.getControlType().isBlank() ? "未分类" : c.getControlType();
            byEff.merge(eff, 1, Integer::sum);
            byType.merge(type, 1, Integer::sum);
            if ("未测试".equals(eff)) {
                untested++;
            }
        }
        return ApiResp.ok(new EffectivenessSummary(all.size(), byEff, byType, untested));
    }
}