49 lines
1.6 KiB
JavaScript
49 lines
1.6 KiB
JavaScript
|
// middleware/users.js —— users 路由的纯业务规则中间件
|
|||
|
|
// 与权限/认证无关，只是保护操作者自身不被误操作
|
|||
|
|
const { pool } = require('../db')
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 更新用户时的自保护：
|
|||
|
|
* - 不能修改自己的部门
|
|||
|
|
* - 不能禁用自己
|
|||
|
|
*/
|
|||
|
|
function protectSelfUpdate(req, res, next) {
|
|||
|
|
if (Number(req.params.id) === req.user.id) {
|
|||
|
|
if (req.body.department_id !== undefined && req.body.department_id !== req.user.department_id) {
|
|||
|
|
return res.status(400).json({ code: 400, message: '不能修改自己的部门' })
|
|||
|
|
}
|
|||
|
|
if (req.body.is_active === 0) {
|
|||
|
|
return res.status(400).json({ code: 400, message: '不能禁用自己' })
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
next()
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* 删除用户时的自保护：
|
|||
|
|
* - 不能删除自己
|
|||
|
|
* - 不能删除最后一个管理员
|
|||
|
|
*/
|
|||
|
|
async function protectUserDelete(req, res, next) {
|
|||
|
|
if (Number(req.params.id) === req.user.id) {
|
|||
|
|
return res.status(400).json({ code: 400, message: '不能删除自己' })
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
const [rows] = await pool.query('SELECT department_id FROM users WHERE id = ?', [req.params.id])
|
|||
|
|
if (rows.length > 0) {
|
|||
|
|
const [adminDept] = await pool.query('SELECT id FROM departments WHERE name = ?', ['admin'])
|
|||
|
|
if (adminDept.length > 0 && rows[0].department_id === adminDept[0].id) {
|
|||
|
|
const [[{ cnt }]] = await pool.query(
|
|||
|
|
'SELECT COUNT(*) AS cnt FROM users WHERE department_id = ?',
|
|||
|
|
[adminDept[0].id]
|
|||
|
|
)
|
|||
|
|
if (cnt <= 1) {
|
|||
|
|
return res.status(400).json({ code: 400, message: '不能删除最后一个管理员' })
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
next()
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
module.exports = { protectSelfUpdate, protectUserDelete }
|