ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

push

Browse Source
This commit is contained in:
Kyaru
2026-06-30 23:11:19 +08:00
parent ccb4c32614
commit 11cb335507
8 changed files with 295 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
routes/contracts.js
View File

@@ -241,7 +241,7 @@ async function update(req, res) {
let checkSql = 'SELECT id, employee_id FROM contracts WHERE id = ?'
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkSql += ' ' + req.scope.sql.replace(/\btype\b/g, 'c.type')
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
@@ -320,7 +320,7 @@ async function remove(req, res) {
let checkSql = 'SELECT id FROM contracts WHERE id = ?'
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkSql += ' ' + req.scope.sql.replace(/\btype\b/g, 'c.type')
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)

45
routes/employees.js
View File

@@ -120,6 +120,27 @@ async function create(req, res) {
return res.status(400).json({ code: 400, message: '员工姓名必填' })
}
// 检查是否是添加总经理办公室的员工
if (department === '总经理办公室') {
const roleLevel = req.user.role_level || 4
const deptName = req.user.departmentName
// 只有信息技术部和人力资源部的部门经理才能添加总经理办公室的员工
if (roleLevel > 2 || !['admin', 'hr'].includes(deptName)) {
return res.status(403).json({ code: 403, message: '只有信息技术部和人力资源部的部门经理才能添加总经理办公室的员工' })
}
// 一般科员不能添加员工到总经理办公室
if (roleLevel === 4) {
return res.status(403).json({ code: 403, message: '一般科员不能添加总经理办公室的员工' })
}
// 只能添加副总经理，总经理是系统预设的
if (position && position !== '副总经理') {
return res.status(400).json({ code: 400, message: '总经理办公室只能添加副总经理，总经理是系统预设的' })
}
}
try {
const [result] = await pool.query(
`INSERT INTO employees (name, gender, age, education, department, entry_date, position, salary, phone, email, status, remark)
@@ -141,11 +162,12 @@ async function create(req, res) {
// 如果中间件 allowUserCreation 要求同步创建用户账号
if (req._createUser) {
const { username, password, department_id } = req._createUser
const { username, password, department_id, role_level } = req._createUser
const hash = await bcrypt.hash(password, 10)
const validRoleLevel = [1, 2, 3, 4].includes(Number(role_level)) ? Number(role_level) : 4
await pool.query(
'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, 1, ?, ?)',
[username, hash, department_id, result.insertId]
'INSERT INTO users (username, password, is_active, department_id, employee_id, role_level) VALUES (?, ?, 1, ?, ?, ?)',
[username, hash, department_id, result.insertId, validRoleLevel]
)
delete req._createUser // 清理，避免影响后续中间件
}
@@ -255,14 +277,23 @@ async function remove(req, res) {
// GET /api/employees/simple —— 简易员工列表（无数据范围限制，用于下拉选择）
async function simpleList(req, res) {
try {
const { department } = req.query
let sql = 'SELECT id, name, department, position FROM employees WHERE status = 1'
const { department, max_role_level } = req.query
// 关联users表获取role_level信息
let sql = `SELECT e.id, e.name, e.department, e.position, COALESCE(u.role_level, 4) as role_level
FROM employees e
LEFT JOIN users u ON e.id = u.employee_id
WHERE e.status = 1`
const params = []
if (department) {
sql += ' AND department = ?'
sql += ' AND e.department = ?'
params.push(department)
}
sql += ' ORDER BY id'
// 过滤角色级别（不能选择比自己职位高的员工）
if (max_role_level) {
sql += ' AND COALESCE(u.role_level, 4) >= ?'
params.push(Number(max_role_level))
}
sql += ' ORDER BY e.id'
const [rows] = await pool.query(sql, params)
res.json({ code: 0, message: 'ok', data: rows })
} catch (e) {

39
routes/users.js
View File

@@ -5,7 +5,7 @@ const { pool } = require('../db')
// 安全字段：关联查询 departments 和 employees
const USER_LIST_SQL = `
SELECT u.id, u.username, u.is_active, u.department_id, u.employee_id,
SELECT u.id, u.username, u.is_active, u.department_id, u.employee_id, u.role_level,
u.created_at, u.updated_at,
d.name AS dept_name, d.description AS dept_desc,
e.name AS real_name
@@ -32,7 +32,7 @@ async function login(req, res) {
try {
const [rows] = await pool.query(
`SELECT u.id, u.username, u.password, u.is_active, u.department_id, u.employee_id,
`SELECT u.id, u.username, u.password, u.is_active, u.department_id, u.employee_id, u.role_level,
d.name AS dept_name, d.description AS dept_desc, e.name AS real_name
FROM users u
LEFT JOIN departments d ON u.department_id = d.id
@@ -74,6 +74,7 @@ async function login(req, res) {
department_id: user.department_id,
departmentName: user.dept_name,
departmentDesc: user.dept_desc,
role_level: user.role_level || 4,
permissions,
},
process.env.JWT_SECRET,
@@ -93,6 +94,7 @@ async function login(req, res) {
department_id: user.department_id,
departmentName: user.dept_name,
departmentDesc: user.dept_desc,
role_level: user.role_level || 4,
permissions,
},
},
@@ -253,7 +255,7 @@ async function detail(req, res) {
// POST /api/users —— 创建用户
async function create(req, res) {
const { username, password, department_id, employee_id, is_active = 1 } = req.body || {}
const { username, password, department_id, employee_id, is_active = 1, role_level = 4 } = req.body || {}
if (!username || !password) {
return res.status(400).json({ code: 400, message: '用户名和密码必填' })
@@ -267,10 +269,31 @@ async function create(req, res) {
// 校验 department_id 是否存在
if (department_id) {
const [dept] = await pool.query('SELECT id FROM departments WHERE id = ?', [department_id])
const [dept] = await pool.query('SELECT id, name FROM departments WHERE id = ?', [department_id])
if (dept.length === 0) {
return res.status(400).json({ code: 400, message: '指定的部门不存在' })
}
// 检查是否是添加总经理办公室的用户
if (dept[0].name === 'general_manager') {
const operatorLevel = req.user.role_level || 4
const operatorDept = req.user.departmentName
// 只有信息技术部和人力资源部的部门经理才能添加总经理办公室的用户
if (operatorLevel > 2 || !['admin', 'hr'].includes(operatorDept)) {
return res.status(403).json({ code: 403, message: '只有信息技术部和人力资源部的部门经理才能添加总经理办公室的用户' })
}
// 一般科员不能添加总经理办公室的用户
if (operatorLevel === 4) {
return res.status(403).json({ code: 403, message: '一般科员不能添加总经理办公室的用户' })
}
// 只能添加副总经理（role_level=2），总经理是系统预设的
if (role_level && Number(role_level) !== 2) {
return res.status(400).json({ code: 400, message: '总经理办公室只能添加副总经理(角色级别2)，总经理是系统预设的' })
}
}
}
// 校验 employee_id 是否存在
@@ -283,9 +306,11 @@ async function create(req, res) {
try {
const hash = await bcrypt.hash(password, 10)
// 验证role_level范围
const validRoleLevel = [1, 2, 3, 4].includes(Number(role_level)) ? Number(role_level) : 4
const [result] = await pool.query(
'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, ?, ?, ?)',
[username, hash, is_active, department_id || null, employee_id || null]
'INSERT INTO users (username, password, is_active, department_id, employee_id, role_level) VALUES (?, ?, ?, ?, ?, ?)',
[username, hash, is_active, department_id || null, employee_id || null, validRoleLevel]
)
const [rows] = await pool.query(
@@ -305,7 +330,7 @@ async function create(req, res) {
// PUT /api/users/:id —— 更新用户
async function update(req, res) {
const { id } = req.params
const fields = ['username', 'department_id', 'employee_id', 'is_active']
const fields = ['username', 'department_id', 'employee_id', 'is_active', 'role_level']
try {
const [existing] = await pool.query('SELECT id, department_id, is_active, employee_id FROM users WHERE id = ?', [id])