# 下载 fabric-samples 仓库
curl -sSL https://raw.githubusercontent.com/hyperledger/fabric/main/scripts/bootstrap.sh | bash -s -- 2.5.0
cd fabric-samples/test-network

# 启动网络（创建 Org1、Org2 及 Orderer 节点）
./network.sh up

# 创建通道（默认通道名 mychannel）
./network.sh createChannel

# 部署链码（以 fabcar 为例）
./network.sh deployCC -ccn basic -ccp ../asset-transfer-basic/chaincode-go -ccl go

# crypto-config.yaml 片段
OrdererOrgs:
  - Name: Orderer
    Domain: example.com
    Specs:
      - Hostname: orderer

PeerOrgs:
  - Name: Org1
    Domain: org1.example.com
    EnableNodeOUs: true
    Template:
      Count: 2  # 2 个 peer 节点
    Users:
      Count: 1  # 1 个普通用户

crypto-config/
├── ordererOrganizations/
│   └── example.com/
│       ├── msp/       ← 组织级 MSP
│       ├── orderers/  ← Orderer 节点证书
│       └── tlsca/     ← TLS 证书
└── peerOrganizations/
    └── org1.example.com/
        ├── peers/     ← peer0, peer1 节点
        ├── users/     ← Admin, User1
        └── msp/

# 1. 生成系统通道创世块（Orderer 启动所需）
configtxgen -profile TwoOrgsOrdererGenesis -outputBlock ./system-genesis-block/genesis.block -channelID system-channel

# 2. 生成应用通道创建交易
configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID mychannel

# 3. 生成锚节点更新交易
configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ./channel-artifacts/Org1MSPanchors.tx -channelID mychannel -asOrg Org1MSP

# 核心服务
services:
  peer0.org1.example.com:
    image: hyperledger/fabric-peer:2.5
    environment:
      - CORE_PEER_ID=peer0.org1.example.com
      - CORE_PEER_ADDRESS=peer0.org1.example.com:7051
      - CORE_PEER_MSPCONFIGPATH=/etc/hyperledger/fabric/msp
      - CORE_PEER_LOCALMSPID=Org1MSP
    volumes:
      - ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp:/etc/hyperledger/fabric/msp

  orderer.example.com:
    image: hyperledger/fabric-orderer:2.5
    environment:
      - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
      - ORDERER_GENERAL_GENESISMETHOD=file
      - ORDERER_GENERAL_GENESISFILE=/var/hyperledger/orderer/genesis.block

  cli:
    image: hyperledger/fabric-tools:2.5
    tty: true

# 进入 CLI 容器
docker exec -it cli bash

# 加入通道
peer channel join -b mychannel.block

# 安装链码
peer lifecycle chaincode install basic.tar.gz

# 查询已安装链码
peer lifecycle chaincode queryinstalled

# 启动 CA 容器（通常由 docker-compose 管理）

# 登记（Enroll）管理员身份
export FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca-client
fabric-ca-client enroll -u https://admin:adminpw@localhost:7054

# 注册（Register）新用户
fabric-ca-client register --id.name user1 --id.type user --id.affiliation org1 --id.attrs 'hf.Registrar.Roles=*'

# 为新用户登记获取 MSP 证书
fabric-ca-client enroll -u https://user1:user1pw@localhost:7054 -M /etc/hyperledger/fabric-ca-client/user1/msp

type Chaincode interface {
    // 初始化链码状态（通常在实例化或升级时调用一次）
    Init(stub shim.ChaincodeStubInterface) peer.Response
    // 路由所有业务调用
    Invoke(stub shim.ChaincodeStubInterface) peer.Response
}

// 读取键值
value, err := stub.GetState("key")

// 写入或更新键值
err := stub.PutState("key", []byte(jsonData))

// 删除键值
err := stub.DelState("key")

// 范围查询（基于前缀）
resultsIterator, err := stub.GetStateByRange("startKey", "endKey")

// 默认策略：两个组织都需要签名
// AND('Org1MSP.peer','Org2MSP.peer')

// 任一组织签名即可
// OR('Org1MSP.peer','Org2MSP.peer')

// 多数规则：3个组织中至少2个签名
// OutOf(2, 'Org1MSP.peer', 'Org2MSP.peer', 'Org3MSP.peer')

package main

import (
    "encoding/json"
    "fmt"
    "github.com/hyperledger/fabric-contract-api-go/contractapi"
)

// Asset 汽车资产结构体
type Asset struct {
    ID              string          `json:"id"`          // VIN码
    Owner           string          `json:"owner"`       // 当前车主
    Model           string          `json:"model"`       // 车型
    Mileage         int             `json:"mileage"`     // 当前里程
    ServiceHistory  []ServiceRecord `json:"serviceHistory"` // 维修历史
}

// ServiceRecord 维修记录
type ServiceRecord struct {
    Date          string `json:"date"`
    Description   string `json:"description"`
    ServiceCenter string `json:"serviceCenter"`
}

// SmartContract 链码结构体
type SmartContract struct {
    contractapi.Contract
}

// RegisterCar 注册新车辆（仅授权经销商调用）
func (s *SmartContract) RegisterCar(ctx contractapi.TransactionContextInterface, vin, owner, model string) error {
    // 检查 VIN 是否已存在
    existing, _ := ctx.GetStub().GetState(vin)
    if existing != nil {
        return fmt.Errorf("car with VIN %s already exists", vin)
    }

    asset := Asset{
        ID:    vin,
        Owner: owner,
        Model: model,
    }

    assetJSON, _ := json.Marshal(asset)
    return ctx.GetStub().PutState(vin, assetJSON)
}

// TransferCar 转移车辆所有权
func (s *SmartContract) TransferCar(ctx contractapi.TransactionContextInterface, vin, newOwner string) error {
    assetJSON, _ := ctx.GetStub().GetState(vin)
    if assetJSON == nil {
        return fmt.Errorf("car %s not found", vin)
    }

    var asset Asset
    json.Unmarshal(assetJSON, &asset)

    // 检查调用者是否为当前车主
    callerID, _ := ctx.GetClientIdentity().GetID()
    // 简化处理：实际应校验 callerID 与 asset.Owner 的匹配关系
    asset.Owner = newOwner

    updatedJSON, _ := json.Marshal(asset)
    return ctx.GetStub().PutState(vin, updatedJSON)
}

// AddServiceRecord 添加维修记录
func (s *SmartContract) AddServiceRecord(ctx contractapi.TransactionContextInterface, vin, date, description, serviceCenter string) error {
    assetJSON, _ := ctx.GetStub().GetState(vin)
    if assetJSON == nil {
        return fmt.Errorf("car %s not found", vin)
    }

    var asset Asset
    json.Unmarshal(assetJSON, &asset)

    record := ServiceRecord{
        Date:          date,
        Description:   description,
        ServiceCenter: serviceCenter,
    }
    asset.ServiceHistory = append(asset.ServiceHistory, record)

    updatedJSON, _ := json.Marshal(asset)
    return ctx.GetStub().PutState(vin, updatedJSON)
}

// QueryCar 查询车辆信息
func (s *SmartContract) QueryCar(ctx contractapi.TransactionContextInterface, vin string) (*Asset, error) {
    assetJSON, _ := ctx.GetStub().GetState(vin)
    if assetJSON == nil {
        return nil, fmt.Errorf("car %s not found", vin)
    }

    var asset Asset
    json.Unmarshal(assetJSON, &asset)
    return &asset, nil
}

// QueryAllCars 查询所有车辆
func (s *SmartContract) QueryAllCars(ctx contractapi.TransactionContextInterface) ([]*Asset, error) {
    resultsIterator, _ := ctx.GetStub().GetStateByRange("", "")
    defer resultsIterator.Close()

    var assets []*Asset
    for resultsIterator.HasNext() {
        queryResponse, _ := resultsIterator.Next()
        var asset Asset
        json.Unmarshal(queryResponse.Value, &asset)
        assets = append(assets, &asset)
    }
    return assets, nil
}

func main() {
    chaincode, _ := contractapi.NewChaincode(&SmartContract{})
    chaincode.Start()
}

# 1. 打包链码
peer lifecycle chaincode package basic.tar.gz \
    --path ./asset-transfer-basic/chaincode-go/ \
    --lang golang \
    --label basic_1.0

# 2. 在 Org1 的 peer 上安装
export CORE_PEER_LOCALMSPID=Org1MSP
export CORE_PEER_ADDRESS=localhost:7051
peer lifecycle chaincode install basic.tar.gz

# 3. 在 Org2 的 peer 上安装
export CORE_PEER_LOCALMSPID=Org2MSP
export CORE_PEER_ADDRESS=localhost:9051
peer lifecycle chaincode install basic.tar.gz

# 4. 查询已安装链码的包 ID
peer lifecycle chaincode queryinstalled
# 输出示例: Package ID: basic_1.0:hash...

# 5. 各组织审批
peer lifecycle chaincode approveformyorg \
    --channelID mychannel \
    --name basic \
    --version 1.0 \
    --package-id basic_1.0:hash... \
    --sequence 1 \
    --signature-policy "AND('Org1MSP.peer','Org2MSP.peer')"

# 6. 提交链码定义（满足审批条件后）
peer lifecycle chaincode commit \
    --channelID mychannel \
    --name basic \
    --version 1.0 \
    --sequence 1 \
    --signature-policy "AND('Org1MSP.peer','Org2MSP.peer')"

# 7. 调用链码：注册车辆
peer chaincode invoke \
    -o localhost:7050 \
    --channelID mychannel \
    --name basic \
    -c '{"Args":["RegisterCar","WBA3A5G50BNT001","Alice","BMW X5"]}'

# 8. 查询车辆信息
peer chaincode query \
    --channelID mychannel \
    --name basic \
    -c '{"Args":["QueryCar","WBA3A5G50BNT001"]}'

#!/bin/bash
# 示例 15-4-1：链码全生命周期部署脚本（Fabric v2.5+）

CHAINCODE_NAME="asset-transfer"
CHAINCODE_VERSION="1.0"
SEQUENCE=1

cd /opt/fabric/test-network

# 1) 打包链码
peer lifecycle chaincode package ${CHAINCODE_NAME}.tar.gz \
  --path ../asset-transfer/chaincode-go \
  --lang golang \
  --label {CHAINCODE_NAME}_{CHAINCODE_VERSION}

# 2) 安装到 Org1 的 peer0
export CORE_PEER_MSPCONFIGPATH=../organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp
export CORE_PEER_ADDRESS=localhost:7051
export CORE_PEER_LOCALMSPID="Org1MSP"
peer lifecycle chaincode install ${CHAINCODE_NAME}.tar.gz

# 3) 安装到 Org2 的 peer0
export CORE_PEER_MSPCONFIGPATH=../organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp
export CORE_PEER_ADDRESS=localhost:9051
export CORE_PEER_LOCALMSPID="Org2MSP"
peer lifecycle chaincode install ${CHAINCODE_NAME}.tar.gz

# 4) Org1 批准链码定义
peer lifecycle chaincode approveformyorg \
  --orderer orderer.example.com:7050 \
  --channelID mychannel \
  --name ${CHAINCODE_NAME} \
  --version ${CHAINCODE_VERSION} \
  --package-id <ORG1_PACKAGE_ID> \
  --sequence ${SEQUENCE} \
  --init-required \
  --signature-policy "OR('Org1MSP.peer','Org2MSP.peer')" \
  --tls --cafile /path/to/tlsca.crt

# 5) Org2 批准链码定义（修改环境变量后执行同上命令，package-id 可不同）
# ...

# 6) 查询通道内各组织的批准就绪状态
peer lifecycle chaincode checkcommitreadiness \
  --channelID mychannel \
  --name ${CHAINCODE_NAME} \
  --version ${CHAINCODE_VERSION} \
  --sequence ${SEQUENCE} \
  --signature-policy "OR('Org1MSP.peer','Org2MSP.peer')" \
  --output json

# 7) 任意组织完成提交
peer lifecycle chaincode commit \
  --orderer orderer.example.com:7050 \
  --channelID mychannel \
  --name ${CHAINCODE_NAME} \
  --version ${CHAINCODE_VERSION} \
  --sequence ${SEQUENCE} \
  --init-required \
  --signature-policy "OR('Org1MSP.peer','Org2MSP.peer')" \
  --tls --cafile /path/to/tlsca.crt

# 8) 初始化（若链码包含 Init 函数）
peer chaincode invoke -o orderer.example.com:7050 -C mychannel \
  -n ${CHAINCODE_NAME} --isInit -c '{"function":"InitLedger","Args":[]}'

# 示例 15-4-2：升级脚本（只展示关键差异）
SEQUENCE=2
CHAINCODE_VERSION="1.1"

# 重新打包安装（省略安装命令，与首次相同）
peer lifecycle chaincode package ${CHAINCODE_NAME}_v2.tar.gz \
  --path ../asset-transfer/chaincode-go \
  --lang golang \
  --label {CHAINCODE_NAME}_{CHAINCODE_VERSION}

# 各组织 approveformyorg，注意 --sequence 2、--version 1.1
# 提交后旧版本逻辑不再收到新调用

// 示例 15-4-3：Go 链码中的兼容性检查
import "github.com/hyperledger/fabric-contract-api-go/contractapi"

type SmartContract struct {
    contractapi.Contract
}

func (s *SmartContract) TransferAsset(ctx contractapi.TransactionContextInterface,
    id, newOwner string) error {
    assetJSON, err := ctx.GetStub().GetState(id)
    if err != nil {
        return fmt.Errorf("查询状态失败: %w", err)
    }
    if assetJSON == nil {
        // 兼容升级场景：旧数据不存在时返回明确错误，而非 panic
        return fmt.Errorf("资产 %s 不存在，可能因升级后数据未迁移", id)
    }
    // ... 反序列化并更新 owner
    return ctx.GetStub().PutState(id, updatedJSON)
}

// 示例 15-5-1：基于 Fabric Gateway 的 Node.js 后端服务模板
import { connect, Contract, Gateway, Network } from '@hyperledger/fabric-gateway';
import { GrpcClient } from '@hyperledger/fabric-gateway/dist/client';
import * as grpc from '@grpc/grpc-js';
import * as fs from 'fs';
import * as path from 'path';

const CONNECTION_PROFILE_PATH = './connection-profile.yaml';
const MSP_ID = 'Org1MSP';
const CHANNEL_NAME = 'mychannel';
const CHAINCODE_NAME = 'asset-transfer';
const KEY_PATH = '/path/to/wallet/appUser/key.pem';
const CERT_PATH = '/path/to/wallet/appUser/cert.pem';

async function newGateway(): Promise<Gateway> {
  // 读取 X.509 证书与私钥
  const tlsRootCert = fs.readFileSync('/path/to/tlsca.crt');
  const key = fs.readFileSync(KEY_PATH);
  const cert = fs.readFileSync(CERT_PATH);

  // 建立 gRPC 连接
  const client = new grpc.Client('localhost:7051', grpc.credentials.createSsl(tlsRootCert));

  // 建议使用 org1 的 peer0 作为 Gateway
  const gateway = connect({
    client,
    identity: { mspId: MSP_ID, credentials: cert },
    signer: async (digest) => {
      // 简化版签名器，生产环境请使用 HSM 或更安全的私钥管理
      const crypto = require('crypto');
      const privateKey = crypto.createPrivateKey(key);
      return crypto.sign(null, digest, privateKey);
    },
  });
  return gateway;
}

// 统一查询（只读）
export async function evaluate(func: string, ...args: string[]): Promise<string> {
  const gateway = await newGateway();
  try {
    const network: Network = await gateway.getNetwork(CHANNEL_NAME);
    const contract: Contract = network.getContract(CHAINCODE_NAME);
    const resultBytes = await contract.evaluateTransaction(func, ...args);
    return new TextDecoder().decode(resultBytes);
  } finally {
    gateway.close();
  }
}

// 统一提交（写操作）
export async function submit(func: string, ...args: string[]): Promise<string> {
  const gateway = await newGateway();
  try {
    const network: Network = await gateway.getNetwork(CHANNEL_NAME);
    const contract: Contract = network.getContract(CHAINCODE_NAME);
    const result = await contract.submitTransaction(func, ...args);
    return new TextDecoder().decode(result);
  } finally {
    gateway.close();
  }
}

// 使用示例
(async () => {
  const asset = await evaluate('GetAsset', 'asset-001');
  console.log('查询结果:', asset);
  const txId = await submit('RegisterAsset', 'asset-002', 'Org1', '{"color":"blue"}');
  console.log('写交易已提交，txId:', txId);
})();

# 示例 15-5-2：connection-profile.yaml
name: "test-network"
version: "1.0"
channels:
  mychannel:
    orderers:
      - orderer.example.com
    peers:
      peer0.org1.example.com:
        endorsingPeer: true
        chaincodeQuery: true
      peer0.org2.example.com:
        endorsingPeer: true
organizations:
  Org1:
    mspid: Org1MSP
    peers:
      - peer0.org1.example.com
  Org2:
    mspid: Org2MSP
    peers:
      - peer0.org2.example.com
orderers:
  orderer.example.com:
    url: grpcs://localhost:7050
    tlsCACerts:
      path: /path/to/crypto-config/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem
peers:
  peer0.org1.example.com:
    url: grpcs://localhost:7051
    tlsCACerts:
      path: /path/to/crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
  peer0.org2.example.com:
    url: grpcs://localhost:9051
    tlsCACerts:
      path: /path/to/crypto-config/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem

// 示例 15-5-3：异常处理与重试中间件
import { EndorseError, SubmitError } from '@hyperledger/fabric-gateway';

async function submitWithRetry(func: string, args: string[], maxRetries = 3): Promise<string> {
  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    try {
      return await submit(func, ...args);
    } catch (error) {
      // 背书策略满足失败：立即重试通常无意义，应检查配置
      if (error instanceof EndorseError) {
        console.error(`背书失败，检查策略: ${error.message}`);
        throw error;
      }
      // 超时或 MVCC 冲突：指数退避后重试
      if (error instanceof SubmitError || (error as any).code === 'MVCC_READ_CONFLICT') {
        if (attempt === maxRetries) throw error;
        const delay = 2 ** attempt * 1000; // 2s, 4s, 8s
        console.warn(`提交失败，第 ${attempt} 次重试，等待${delay}ms`);
        await new Promise(r => setTimeout(r, delay));
      } else {
        throw error;
      }
    }
  }
  throw new Error('提交失败：超过最大重试次数');
}

// 示例 15-6-1：Express 路由设计（TypeScript）
import express, { Request, Response, NextFunction } from 'express';
import { z } from 'zod';
import { evaluate, submit }       from './fabric-gateway-service';

const app = express();
app.use(express.json());

// 请求体验证 schema
const CreateAssetSchema = z.object({
  id: z.string().min(1),
  owner: z.string(),
  metadata: z.string().optional(),
});

// 注册资产（写操作）
app.post('/api/assets', async (req: Request, res: Response, next: NextFunction) => {
  try {
    const body = CreateAssetSchema.parse(req.body);
    const result = await submit('CreateAsset', body.id, body.owner, body.metadata || '{}');
    // 异步确认：返回 txId，后续通过 /api/transactions/:txId 轮询状态
    return res.status(202).json({ success: true, txId: result, message: '交易已提交' });
  } catch (err) {
    next(err);
  }
});

// 查询单个资产（只读）
app.get('/api/assets/:id', async (req, res, next) => {
  try {
    const result = await evaluate('GetAsset', req.params.id);
    res.json({ success: true, data: JSON.parse(result) });
  } catch (err) {
    next(err);
  }
});

// 查询资产历史（只读）
app.get('/api/assets/:id/history', async (req, res, next) => {
  try {
    const result = await evaluate('GetAssetHistory', req.params.id);
    res.json({ success: true, data: JSON.parse(result) });
  } catch (err) {
    next(err);
  }
});

// 统一错误响应
app.use((err: any, _req: Request, res: Response, _next: NextFunction) => {
  const status = err.status || 500;
  res.status(status).json({ success: false, error: err.message || 'Internal Server Error' });
});

app.listen(3000, () => console.log('REST API 服务已启动: http://localhost:3000'));

#!/bin/bash
# 示例 15-6-4：cURL 快速验证脚本

BASE="http://localhost:3000/api"

# 1. 注册资产
echo "==> 注册资产"
curl -s -X POST ${BASE}/assets \
  -H "Content-Type: application/json" \
  -d '{"id":"vin-8888","owner":"Org1","metadata":"{\"model\":\"Tesla-ModelY\"}"}' | jq .

# 2. 查询资产
echo -e "\n==> 查询资产"
curl -s ${BASE}/assets/vin-8888 | jq .data

# 3. 转移资产
echo -e "\n==> 转移资产"
TX=$(curl -s -X POST${BASE}/assets/vin-8888/transfer \
  -H "Content-Type: application/json" \
  -d '{"newOwner":"Org2"}' | jq -r '.txId')
echo "交易 ID: ${TX}"

# 4. 查询历史（溯源时间线）
echo -e "\n==> 查询资产全生命周期历史"
curl -s ${BASE}/assets/vin-8888/history | jq .data

package main

import (
    "fmt"
    "github.com/hyperledger/fabric-chaincode-go/shim"
    "github.com/hyperledger/fabric-contract-api-go/contractapi"
)

// SmartContract 提供私有数据集合操作
type SmartContract struct {
    contractapi.Contract
}

// collectionName 定义私有数据集合名称
type collectionName string

const (
    Org1Private collectionName = "Org1MSPPrivateCollection"
    Org2Private collectionName = "Org2MSPPrivateCollection"
)

// WritePrivateData 将敏感数据写入指定的私有数据集合
func (s *SmartContract) WritePrivateData(
    ctx contractapi.TransactionContextInterface,
    collection string,
    key string,
    value string,
) error {
    stub := ctx.GetStub()
    
    // 使用 PutPrivateData 将数据写入指定集合
    err := stub.PutPrivateData(collection, key, []byte(value))
    if err != nil {
        return fmt.Errorf("写入私有数据失败: %v", err)
    }
    return nil
}

// ReadPrivateData 从私有数据集合中读取数据
// 只有被 collection 策略授权的组织才能成功调用
func (s *SmartContract) ReadPrivateData(
    ctx contractapi.TransactionContextInterface,
    collection string,
    key string,
) (string, error) {
    stub := ctx.GetStub()
    
    // 使用 GetPrivateData 读取私有数据明文
    data, err := stub.GetPrivateData(collection, key)
    if err != nil {
        return "", fmt.Errorf("读取私有数据失败: %v", err)
    }
    if data == nil {
        return "", fmt.Errorf("指定键值不存在: %s", key)
    }
    return string(data), nil
}

// VerifyPrivateData 通过公开哈希验证私有数据完整性
// 任何组织的节点都可以调用，用于争议仲裁
func (s *SmartContract) VerifyPrivateData(
    ctx contractapi.TransactionContextInterface,
    collection string,
    key string,
    purportedValue string,
) (bool, error) {
    stub := ctx.GetStub()
    
    // 获取链上存储的数据哈希（所有组织均可读取）
    hashOnChain, err := stub.GetPrivateDataHash(collection, key)
    if err != nil {
        return false, fmt.Errorf("获取数据哈希失败: %v", err)
    }
    if hashOnChain == nil {
        return false, fmt.Errorf("指定键值无哈希记录: %s", key)
    }
    
    // 计算声称数据的 SHA-256 哈希
    import "crypto/sha256"
    hashComputed := sha256.Sum256([]byte(purportedValue))
    
    // 比较链上哈希与计算哈希
    for i := range hashOnChain {
        if hashOnChain[i] != hashComputed[i] {
            return false, nil
        }
    }
    return true, nil
}

package main

import (
    "fmt"
    "github.com/hyperledger/fabric-chaincode-go/pkg/cid"
    "github.com/hyperledger/fabric-contract-api-go/contractapi"
)

type ABACContract struct {
    contractapi.Contract
}

// checkAdminRole 校验调用者是否具有管理员角色
func checkAdminRole(ctx contractapi.TransactionContextInterface) error {
    ok, err := cid.HasAttribute(ctx.GetStub(), "role", "admin")
    if err != nil {
        return fmt.Errorf("属性校验失败: %v", err)
    }
    if !ok {
        return fmt.Errorf("权限不足: 仅管理员可执行此操作")
    }
    return nil
}

// checkManagerOrg1 校验调用者是否属于 Org1 的 manager 角色
func checkManagerOrg1(ctx contractapi.TransactionContextInterface) error {
    mspID, err := cid.GetMSPID(ctx.GetStub())
    if err != nil {
        return fmt.Errorf("获取 MSP ID 失败: %v", err)
    }
    if mspID != "Org1MSP" {
        return fmt.Errorf("权限不足: 仅 Org1 成员可执行此操作，当前为 %s", mspID)
    }

    role, ok, err := cid.GetAttributeValue(ctx.GetStub(), "role")
    if err != nil {
        return fmt.Errorf("获取角色属性失败: %v", err)
    }
    if !ok || role != "manager" {
        return fmt.Errorf("权限不足: 需要 manager 角色，当前角色为 %s", role)
    }
    return nil
}

// CreateSensitiveAsset 仅允许 Org1 的 manager 创建敏感资产
// 同时写入公共状态和 Org1 的私有数据集合
func (ac *ABACContract) CreateSensitiveAsset(
    ctx contractapi.TransactionContextInterface,
    assetID string,
    publicDesc string,
    privateDetails string,
) error {
    if err := checkManagerOrg1(ctx); err != nil {
        return err
    }

    stub := ctx.GetStub()
    
    // 写入公共状态（所有组织可见）
    err := stub.PutState(assetID, []byte(publicDesc))
    if err != nil {
        return fmt.Errorf("写入公共状态失败: %v", err)
    }
    
    // 写入私有数据集合（仅 Org1 可见）
    err = stub.PutPrivateData("Org1MSPPrivateCollection", assetID, []byte(privateDetails))
    if err != nil {
        return fmt.Errorf("写入私有数据失败: %v", err)
    }
    return nil
}

// DeleteAsset 仅允许 admin 角色删除资产
func (ac *ABACContract) DeleteAsset(
    ctx contractapi.TransactionContextInterface,
    assetID string,
) error {
    if err := checkAdminRole(ctx); err != nil {
        return err
    }

    stub := ctx.GetStub()
    
    // 同时删除公共状态和私有数据
    err := stub.DelState(assetID)
    if err != nil {
        return fmt.Errorf("删除公共状态失败: %v", err)
    }
    
    // 尝试删除私有数据（如果存在）
    _ = stub.DelPrivateData("Org1MSPPrivateCollection", assetID)
    
    return nil
}