chore: checkpoint 第一版

internal/saas/device_binding_service.go

@@ -9,6 +9,7 @@ import (
 
 	"data-terminal-cloud/internal/audit"
 	"data-terminal-cloud/internal/database"
+	"data-terminal-cloud/internal/deviceactivation"
 	"data-terminal-cloud/internal/identity"
 
 	"github.com/jackc/pgx/v5"
@@ -106,6 +107,22 @@ func (s *Service) ChangeDeviceBinding(ctx context.Context, principal identity.Pr
 			result.BindingID = &newBindingID
 			result.HouseholdID = &targetAccess.householdPublicID
 			result.SubjectID = &input.TargetSubjectID
+		} else {
+			var activationState string
+			if err := tx.QueryRow(ctx, `SELECT activation_state FROM device WHERE id=$1::uuid AND tenant_id=$2::uuid FOR UPDATE`, access.deviceID, access.tenantID).Scan(&activationState); err != nil {
+				return fmt.Errorf("read unbound device activation: %w", err)
+			}
+			if activationState == string(deviceactivation.Bound) || activationState == string(deviceactivation.Provisioning) ||
+				activationState == string(deviceactivation.Active) || activationState == string(deviceactivation.Lost) {
+				if _, err := deviceactivation.Apply(ctx, tx, deviceactivation.Input{DeviceID: access.deviceID, TenantID: access.tenantID,
+					Target: deviceactivation.Claimable, Reason: "用户解除设备绑定", Source: "user-unbind", ActorType: "user",
+					ActorPublicID: &access.userPublicID, RequestID: requestID}); err != nil {
+					return fmt.Errorf("transition unbound device activation: %w", err)
+				}
+			}
+			if _, err := tx.Exec(ctx, `UPDATE hardware_agent_provider_credential SET status='SUSPENDED',updated_at=now() WHERE device_id=$1::uuid AND status='ACTIVE'`, access.deviceID); err != nil {
+				return fmt.Errorf("suspend unbound device provider credential: %w", err)
+			}
 		}
 		return s.audit.Record(ctx, tx, audit.Event{
 			TenantID: strPtr(access.tenantID), ActorType: "user", ActorPublicID: strPtr(access.userPublicID),