push

routes/employees.js

@@ -120,6 +120,27 @@ async function create(req, res) {
     return res.status(400).json({ code: 400, message: '员工姓名必填' })
   }
 
+  // 检查是否是添加总经理办公室的员工
+  if (department === '总经理办公室') {
+    const roleLevel = req.user.role_level || 4
+    const deptName = req.user.departmentName
+
+    // 只有信息技术部和人力资源部的部门经理才能添加总经理办公室的员工
+    if (roleLevel > 2 || !['admin', 'hr'].includes(deptName)) {
+      return res.status(403).json({ code: 403, message: '只有信息技术部和人力资源部的部门经理才能添加总经理办公室的员工' })
+    }
+
+    // 一般科员不能添加员工到总经理办公室
+    if (roleLevel === 4) {
+      return res.status(403).json({ code: 403, message: '一般科员不能添加总经理办公室的员工' })
+    }
+
+    // 只能添加副总经理，总经理是系统预设的
+    if (position && position !== '副总经理') {
+      return res.status(400).json({ code: 400, message: '总经理办公室只能添加副总经理，总经理是系统预设的' })
+    }
+  }
+
   try {
     const [result] = await pool.query(
       `INSERT INTO employees (name, gender, age, education, department, entry_date, position, salary, phone, email, status, remark)
@@ -141,11 +162,12 @@ async function create(req, res) {
 
     // 如果中间件 allowUserCreation 要求同步创建用户账号
     if (req._createUser) {
-      const { username, password, department_id } = req._createUser
+      const { username, password, department_id, role_level } = req._createUser
       const hash = await bcrypt.hash(password, 10)
+      const validRoleLevel = [1, 2, 3, 4].includes(Number(role_level)) ? Number(role_level) : 4
       await pool.query(
-        'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, 1, ?, ?)',
-        [username, hash, department_id, result.insertId]
+        'INSERT INTO users (username, password, is_active, department_id, employee_id, role_level) VALUES (?, ?, 1, ?, ?, ?)',
+        [username, hash, department_id, result.insertId, validRoleLevel]
       )
       delete req._createUser // 清理，避免影响后续中间件
     }
@@ -255,14 +277,23 @@ async function remove(req, res) {
 // GET /api/employees/simple —— 简易员工列表（无数据范围限制，用于下拉选择）
 async function simpleList(req, res) {
   try {
-    const { department } = req.query
-    let sql = 'SELECT id, name, department, position FROM employees WHERE status = 1'
+    const { department, max_role_level } = req.query
+    // 关联users表获取role_level信息
+    let sql = `SELECT e.id, e.name, e.department, e.position, COALESCE(u.role_level, 4) as role_level
+               FROM employees e
+               LEFT JOIN users u ON e.id = u.employee_id
+               WHERE e.status = 1`
     const params = []
     if (department) {
-      sql += ' AND department = ?'
+      sql += ' AND e.department = ?'
       params.push(department)
     }
-    sql += ' ORDER BY id'
+    // 过滤角色级别（不能选择比自己职位高的员工）
+    if (max_role_level) {
+      sql += ' AND COALESCE(u.role_level, 4) >= ?'
+      params.push(Number(max_role_level))
+    }
+    sql += ' ORDER BY e.id'
     const [rows] = await pool.query(sql, params)
     res.json({ code: 0, message: 'ok', data: rows })
   } catch (e) {