feat(oapi): 办件进度/流程图token出图/托管撤回 + CAS直嵌示意图（两会话产物合入）

2026-09-17 01:03:57 +08:00
parent b8441065d0
commit 6afc7d7b92
10 changed files with 978 additions and 1 deletions
@@ -21,7 +21,12 @@ import java.util.List;
 * - GET  /oapi/flow/{flowGuid}?schId=                    → data={flowGuid,name,version,nodeSummary}
 * - POST /oapi/flow/apply                                → data={instanceId,duplicated}
 * - GET  /oapi/flow/instance?bizType=&bizId=&schId=      → data={status,version,instanceId,nodeSummary,traceJson,…}
+ * - POST /oapi/flow/instance/{instanceId}/withdraw?schId=&submitterId= → data=null（提交人复核后撤回）
+ * - GET  /oapi/flow/progress?instanceId=|bizType=&bizId=&schId=        → data={status,steps:[…]}
+ * - GET  /oapi/flow/diagram/url?instanceId=|flowGuid=&mode=&schId=     → data={imgUrl,expiresIn}
 * - POST /oapi/flow/callback/reg?schId=                  → data={secret}
+ * 刻意不提供审批动作（同意/拒绝/退回/移交/催办）：那是"人"的决策，必须带登录身份走 CAS 用户面，
+ * 应用间签名不得代签——谁办理谁负责，审计链不能断在应用上。
 */
@RestController
@RequestMapping("/oapi/flow")
@@ -54,6 +59,42 @@ public class OapiFlowController {
        return flowService.instanceByBiz(schId, bizType, bizId);
    }

+    /**
+     * 办件进度（结构化轨迹，SDK FlowProgress 契约）：instanceId 或 bizType/bizId 定位。
+     * 消费方渲染时间线（发起申请→各节点办理人行），SDK com.yunhai.platform.openapi.flow.model 同构。
+     */
+    @GetMapping("/progress")
+    public OapiModels.ProgressVo progress(@RequestParam(value = "instanceId", required = false) Long instanceId,
+                                          @RequestParam(value = "bizType", required = false) String bizType,
+                                          @RequestParam(value = "bizId", required = false) String bizId,
+                                          @RequestParam("schId") Long schId) {
+        return flowService.progress(schId, instanceId, bizType, bizId);
+    }
+
+    /**
+     * 流程图换图（token 模式，"CAS 验证码式嵌入"）：img 标签带不了签名，本端点在 app-sign 保护下
+     * 签发短时 token，返回可直接放 {@code <img src>} 的免签路径 {@code /open/flow/diagram/img?token=}。
+     * 口径：instanceId=办件运行时状态图；flowGuid=最高已发布版定义图。
+     */
+    @GetMapping("/diagram/url")
+    public OapiModels.DiagramUrlVo diagramUrl(@RequestParam(value = "instanceId", required = false) Long instanceId,
+                                              @RequestParam(value = "flowGuid", required = false) String flowGuid,
+                                              @RequestParam(value = "mode", required = false) String mode,
+                                              @RequestParam("schId") Long schId) {
+        return flowService.diagramUrl(schId, instanceId, flowGuid, mode);
+    }
+
+    /**
+     * 撤回（提交人本人；仅尚无任务被办理时）。submitterId 由业务应用按其办件归属传入，
+     * 本端与办件提交人复核——应用签名不替代"谁在撤"的身份证明。
+     */
+    @PostMapping("/instance/{instanceId}/withdraw")
+    public void withdraw(@RequestParam("schId") Long schId,
+                         @RequestParam("submitterId") Integer submitterId,
+                         @PathVariable("instanceId") Long instanceId) {
+        flowService.withdraw(schId, instanceId, submitterId);
+    }
+
    @PostMapping("/callback/reg")
    public OapiModels.CallbackRegResultVo registerCallback(
            @RequestParam("schId") Long schId,