push

routes/users.js

@@ -5,7 +5,7 @@ const { pool } = require('../db')
 
 // 安全字段：关联查询 departments 和 employees
 const USER_LIST_SQL = `
-  SELECT u.id, u.username, u.is_active, u.department_id, u.employee_id,
+  SELECT u.id, u.username, u.is_active, u.department_id, u.employee_id, u.role_level,
          u.created_at, u.updated_at,
          d.name AS dept_name, d.description AS dept_desc,
          e.name AS real_name
@@ -32,7 +32,7 @@ async function login(req, res) {
 
   try {
     const [rows] = await pool.query(
-      `SELECT u.id, u.username, u.password, u.is_active, u.department_id, u.employee_id,
+      `SELECT u.id, u.username, u.password, u.is_active, u.department_id, u.employee_id, u.role_level,
               d.name AS dept_name, d.description AS dept_desc, e.name AS real_name
        FROM users u
          LEFT JOIN departments d ON u.department_id = d.id
@@ -74,6 +74,7 @@ async function login(req, res) {
         department_id: user.department_id,
         departmentName: user.dept_name,
         departmentDesc: user.dept_desc,
+        role_level: user.role_level || 4,
         permissions,
       },
       process.env.JWT_SECRET,
@@ -93,6 +94,7 @@ async function login(req, res) {
           department_id: user.department_id,
           departmentName: user.dept_name,
           departmentDesc: user.dept_desc,
+          role_level: user.role_level || 4,
           permissions,
         },
       },
@@ -253,7 +255,7 @@ async function detail(req, res) {
 
 // POST /api/users —— 创建用户
 async function create(req, res) {
-  const { username, password, department_id, employee_id, is_active = 1 } = req.body || {}
+  const { username, password, department_id, employee_id, is_active = 1, role_level = 4 } = req.body || {}
 
   if (!username || !password) {
     return res.status(400).json({ code: 400, message: '用户名和密码必填' })
@@ -267,10 +269,31 @@ async function create(req, res) {
 
   // 校验 department_id 是否存在
   if (department_id) {
-    const [dept] = await pool.query('SELECT id FROM departments WHERE id = ?', [department_id])
+    const [dept] = await pool.query('SELECT id, name FROM departments WHERE id = ?', [department_id])
     if (dept.length === 0) {
       return res.status(400).json({ code: 400, message: '指定的部门不存在' })
     }
+
+    // 检查是否是添加总经理办公室的用户
+    if (dept[0].name === 'general_manager') {
+      const operatorLevel = req.user.role_level || 4
+      const operatorDept = req.user.departmentName
+
+      // 只有信息技术部和人力资源部的部门经理才能添加总经理办公室的用户
+      if (operatorLevel > 2 || !['admin', 'hr'].includes(operatorDept)) {
+        return res.status(403).json({ code: 403, message: '只有信息技术部和人力资源部的部门经理才能添加总经理办公室的用户' })
+      }
+
+      // 一般科员不能添加总经理办公室的用户
+      if (operatorLevel === 4) {
+        return res.status(403).json({ code: 403, message: '一般科员不能添加总经理办公室的用户' })
+      }
+
+      // 只能添加副总经理（role_level=2），总经理是系统预设的
+      if (role_level && Number(role_level) !== 2) {
+        return res.status(400).json({ code: 400, message: '总经理办公室只能添加副总经理(角色级别2)，总经理是系统预设的' })
+      }
+    }
   }
 
   // 校验 employee_id 是否存在
@@ -283,9 +306,11 @@ async function create(req, res) {
 
   try {
     const hash = await bcrypt.hash(password, 10)
+    // 验证role_level范围
+    const validRoleLevel = [1, 2, 3, 4].includes(Number(role_level)) ? Number(role_level) : 4
     const [result] = await pool.query(
-      'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, ?, ?, ?)',
-      [username, hash, is_active, department_id || null, employee_id || null]
+      'INSERT INTO users (username, password, is_active, department_id, employee_id, role_level) VALUES (?, ?, ?, ?, ?, ?)',
+      [username, hash, is_active, department_id || null, employee_id || null, validRoleLevel]
     )
 
     const [rows] = await pool.query(
@@ -305,7 +330,7 @@ async function create(req, res) {
 // PUT /api/users/:id —— 更新用户
 async function update(req, res) {
   const { id } = req.params
-  const fields = ['username', 'department_id', 'employee_id', 'is_active']
+  const fields = ['username', 'department_id', 'employee_id', 'is_active', 'role_level']
 
   try {
     const [existing] = await pool.query('SELECT id, department_id, is_active, employee_id FROM users WHERE id = ?', [id])