ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

添加了更多功能

Browse Source
This commit is contained in:
ChoChoX
2026-06-24 22:44:14 +08:00
parent ff7173aa68
commit 56af6ab269
11 changed files with 1416 additions and 359 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
routes/afterSales.js
View File

@@ -1,5 +1,6 @@
// routes/afterSales.js —— 售后管理 CRUD
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
function pagination(query) {
const page = Math.max(Number(query.page) || 1, 1)
@@ -27,6 +28,18 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤
const scope = getDataScope(req.user, 'after_sales')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
// list 查询有 JOIN，需要表别名前缀避免列名歧义
const scopeCol = scope.tableAlias ? scope.where.replace('responsible_user_id', `${scope.tableAlias}.responsible_user_id`) : scope.where
where += ' AND ' + scopeCol
params.push(...scope.values)
}
if (handle_status) {
where += ' AND a.handle_status = ?'
params.push(handle_status)
@@ -69,10 +82,20 @@ async function list(req, res) {
// GET /api/after-sales/:id —— 详情
async function detail(req, res) {
try {
const [rows] = await pool.query(
`${LIST_SELECT} WHERE a.id = ?`,
[req.params.id]
)
let sql = `${LIST_SELECT} WHERE a.id = ?`
const params = [req.params.id]
const scope = getDataScope(req.user, 'after_sales')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
const scopeCol = scope.tableAlias ? scope.where.replace('responsible_user_id', `${scope.tableAlias}.responsible_user_id`) : scope.where
sql += ' AND ' + scopeCol
params.push(...scope.values)
}
const [rows] = await pool.query(sql, params)
if (rows.length === 0) {
return res.status(404).json({ code: 404, message: '售后记录不存在' })
}
@@ -87,7 +110,7 @@ async function detail(req, res) {
async function create(req, res) {
const {
customer_id, feedback, employee_id, handle_method,
handle_status, service_date, remark,
handle_status, service_date, remark, responsible_user_id,
} = req.body || {}
if (!customer_id) {
@@ -111,16 +134,20 @@ async function create(req, res) {
}
}
// 如果没指定负责人，默认设为当前用户
const ownerId = responsible_user_id || req.user.id
const [result] = await pool.query(
`INSERT INTO after_sales
(customer_id, feedback, employee_id, handle_method, handle_status, service_date, remark)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
(customer_id, feedback, employee_id, handle_method, handle_status, service_date, remark, responsible_user_id)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
[customer_id, feedback,
employee_id || null,
handle_method || null,
handle_status || '待处理',
service_date || null,
remark || null]
remark || null,
ownerId]
)
const [rows] = await pool.query(`${LIST_SELECT} WHERE a.id = ?`, [result.insertId])
@@ -136,13 +163,24 @@ async function update(req, res) {
const { id } = req.params
const fields = [
'customer_id', 'feedback', 'employee_id', 'handle_method',
'handle_status', 'service_date', 'remark',
'handle_status', 'service_date', 'remark', 'responsible_user_id',
]
try {
const [existing] = await pool.query('SELECT id FROM after_sales WHERE id = ?', [id])
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'after_sales')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '售后记录不存在' })
return res.status(404).json({ code: 404, message: '售后记录不存在或无权操作' })
}
if (req.body.customer_id) {
@@ -185,9 +223,19 @@ async function update(req, res) {
async function remove(req, res) {
const { id } = req.params
try {
const [existing] = await pool.query('SELECT id FROM after_sales WHERE id = ?', [id])
let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'after_sales')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '售后记录不存在' })
return res.status(404).json({ code: 404, message: '售后记录不存在或无权操作' })
}
await pool.query('DELETE FROM after_sales WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })

67
routes/contracts.js
View File

@@ -1,5 +1,6 @@
// routes/contracts.js —— 合同管理 CRUD
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
function pagination(query) {
const page = Math.max(Number(query.page) || 1, 1)
@@ -31,6 +32,16 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
where += ' AND ' + scope.where
params.push(...scope.values)
}
if (status) {
where += ' AND c.status = ?'
params.push(status)
@@ -81,10 +92,19 @@ async function list(req, res) {
// GET /api/contracts/:id —— 详情
async function detail(req, res) {
try {
const [rows] = await pool.query(
`${DETAIL_SELECT} WHERE c.id = ?`,
[req.params.id]
)
let sql = `${DETAIL_SELECT} WHERE c.id = ?`
const params = [req.params.id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
sql += ' AND ' + scope.where
params.push(...scope.values)
}
const [rows] = await pool.query(sql, params)
if (rows.length === 0) {
return res.status(404).json({ code: 404, message: '合同不存在' })
}
@@ -125,8 +145,8 @@ async function create(req, res) {
const [result] = await pool.query(
`INSERT INTO contracts
(customer_id, contract_name, contract_no, contract_content, amount, effective_date, expiry_date, employee_id, status, remark)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
(customer_id, contract_name, contract_no, contract_content, amount, effective_date, expiry_date, employee_id, status, remark, type, responsible_user_id)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
[customer_id, contract_name,
contract_no || null,
contract_content || null,
@@ -135,7 +155,9 @@ async function create(req, res) {
expiry_date || null,
employee_id || null,
status || '生效',
remark || null]
remark || null,
req.body.type || (req.user.roleName === 'procurement_manager' ? 'supply' : 'franchise'),
req.body.responsible_user_id || req.user.id]
)
const [rows] = await pool.query(`${DETAIL_SELECT} WHERE c.id = ?`, [result.insertId])
@@ -151,13 +173,24 @@ async function update(req, res) {
const { id } = req.params
const fields = [
'customer_id', 'contract_name', 'contract_no', 'contract_content',
'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark',
'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark', 'type', 'responsible_user_id',
]
try {
const [existing] = await pool.query('SELECT id FROM contracts WHERE id = ?', [id])
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM contracts WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '合同不存在' })
return res.status(404).json({ code: 404, message: '合同不存在或无权操作' })
}
// 如果更新了 customer_id 或 employee_id，需要校验
@@ -201,9 +234,19 @@ async function update(req, res) {
async function remove(req, res) {
const { id } = req.params
try {
const [existing] = await pool.query('SELECT id FROM contracts WHERE id = ?', [id])
let checkSql = 'SELECT id FROM contracts WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '合同不存在' })
return res.status(404).json({ code: 404, message: '合同不存在或无权操作' })
}
await pool.query('DELETE FROM contracts WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })

68
routes/customers.js
View File

@@ -1,5 +1,6 @@
// routes/customers.js —— 客户管理 CRUD
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
// 提取分页参数
function pagination(query) {
@@ -18,6 +19,16 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
where += ' AND ' + scope.where
params.push(...scope.values)
}
if (name) {
where += ' AND name LIKE ?'
params.push(`%${name}%`)
@@ -71,7 +82,19 @@ async function list(req, res) {
// GET /api/customers/:id —— 详情
async function detail(req, res) {
try {
const [rows] = await pool.query('SELECT * FROM customers WHERE id = ?', [req.params.id])
let sql = 'SELECT * FROM customers WHERE id = ?'
const params = [req.params.id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
sql += ' AND ' + scope.where
params.push(...scope.values)
}
const [rows] = await pool.query(sql, params)
if (rows.length === 0) {
return res.status(404).json({ code: 404, message: '客户不存在' })
}
@@ -86,7 +109,7 @@ async function detail(req, res) {
async function create(req, res) {
const {
name, phone, province, city, district,
address, customer_type, email, remark,
address, customer_type, email, remark, responsible_user_id,
} = req.body || {}
if (!name) {
@@ -94,11 +117,14 @@ async function create(req, res) {
}
try {
// 如果没指定负责人，默认设为当前用户
const ownerId = responsible_user_id || req.user.id
const [result] = await pool.query(
`INSERT INTO customers (name, phone, province, city, district, address, customer_type, email, remark)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
`INSERT INTO customers (name, phone, province, city, district, address, customer_type, email, remark, responsible_user_id)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
[name, phone || null, province || null, city || null, district || null,
address || null, customer_type || 'Normal', email || null, remark || null]
address || null, customer_type || 'Normal', email || null, remark || null, ownerId]
)
const [rows] = await pool.query('SELECT * FROM customers WHERE id = ?', [result.insertId])
res.json({ code: 0, message: 'ok', data: rows[0] })
@@ -113,14 +139,24 @@ async function update(req, res) {
const { id } = req.params
const fields = [
'name', 'phone', 'province', 'city', 'district',
'address', 'customer_type', 'email', 'remark',
'address', 'customer_type', 'email', 'remark', 'responsible_user_id',
]
try {
// 先确认记录存在
const [existing] = await pool.query('SELECT id FROM customers WHERE id = ?', [id])
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM customers WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '客户不存在' })
return res.status(404).json({ code: 404, message: '客户不存在或无权操作' })
}
// 动态构建 SET 子句（只更新传入的字段）
@@ -151,9 +187,19 @@ async function update(req, res) {
async function remove(req, res) {
const { id } = req.params
try {
const [existing] = await pool.query('SELECT id FROM customers WHERE id = ?', [id])
let checkSql = 'SELECT id FROM customers WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '客户不存在' })
return res.status(404).json({ code: 404, message: '客户不存在或无权操作' })
}
await pool.query('DELETE FROM customers WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })

54
routes/employees.js
View File

@@ -1,5 +1,6 @@
// routes/employees.js —— 员工管理 CRUD
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
function pagination(query) {
const page = Math.max(Number(query.page) || 1, 1)
@@ -17,6 +18,16 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤（部门隔离）
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
where += ' AND ' + scope.where
params.push(...scope.values)
}
if (name) {
where += ' AND name LIKE ?'
params.push(`%${name}%`)
@@ -60,7 +71,19 @@ async function list(req, res) {
// GET /api/employees/:id —— 详情
async function detail(req, res) {
try {
const [rows] = await pool.query('SELECT * FROM employees WHERE id = ?', [req.params.id])
let sql = 'SELECT * FROM employees WHERE id = ?'
const params = [req.params.id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
sql += ' AND ' + scope.where
params.push(...scope.values)
}
const [rows] = await pool.query(sql, params)
if (rows.length === 0) {
return res.status(404).json({ code: 404, message: '员工不存在' })
}
@@ -116,9 +139,20 @@ async function update(req, res) {
]
try {
const [existing] = await pool.query('SELECT id FROM employees WHERE id = ?', [id])
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM employees WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '员工不存在' })
return res.status(404).json({ code: 404, message: '员工不存在或无权操作' })
}
const sets = []
@@ -148,9 +182,19 @@ async function update(req, res) {
async function remove(req, res) {
const { id } = req.params
try {
const [existing] = await pool.query('SELECT id FROM employees WHERE id = ?', [id])
let checkSql = 'SELECT id FROM employees WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '员工不存在' })
return res.status(404).json({ code: 404, message: '员工不存在或无权操作' })
}
await pool.query('DELETE FROM employees WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })

147
routes/suppliers.js Normal file
View File

@@ -0,0 +1,147 @@
// routes/suppliers.js —— 供应商管理 CRUD
const { pool } = require('../db')
function pagination(query) {
const page = Math.max(Number(query.page) || 1, 1)
const pageSize = Math.min(Math.max(Number(query.pageSize) || 10, 1), 100)
const offset = (page - 1) * pageSize
return { page, pageSize, offset }
}
// GET /api/suppliers —— 列表
async function list(req, res) {
try {
const { page, pageSize, offset } = pagination(req.query)
const { name, type, status } = req.query
let where = 'WHERE 1=1'
const params = []
if (name) {
where += ' AND name LIKE ?'
params.push(`%${name}%`)
}
if (type) {
where += ' AND type LIKE ?'
params.push(`%${type}%`)
}
if (status !== undefined && status !== '') {
where += ' AND status = ?'
params.push(Number(status))
}
const [[{ total }]] = await pool.query(
`SELECT COUNT(*) AS total FROM suppliers ${where}`,
params
)
const [rows] = await pool.query(
`SELECT * FROM suppliers ${where} ORDER BY id DESC LIMIT ? OFFSET ?`,
[...params, pageSize, offset]
)
res.json({
code: 0,
message: 'ok',
data: {
list: rows,
total,
page,
pageSize,
totalPages: Math.ceil(total / pageSize),
},
})
} catch (e) {
console.error('[suppliers list] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
// GET /api/suppliers/:id —— 详情
async function detail(req, res) {
try {
const [rows] = await pool.query('SELECT * FROM suppliers WHERE id = ?', [req.params.id])
if (rows.length === 0) {
return res.status(404).json({ code: 404, message: '供应商不存在' })
}
res.json({ code: 0, message: 'ok', data: rows[0] })
} catch (e) {
console.error('[suppliers detail] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
// POST /api/suppliers —— 新增
async function create(req, res) {
const { name, contact, phone, address, type, content, status } = req.body || {}
if (!name) {
return res.status(400).json({ code: 400, message: '供应商名称必填' })
}
try {
const [result] = await pool.query(
`INSERT INTO suppliers (name, contact, phone, address, type, content, status)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
[name, contact || null, phone || null, address || null,
type || null, content || null, status !== undefined ? status : 1]
)
const [rows] = await pool.query('SELECT * FROM suppliers WHERE id = ?', [result.insertId])
res.json({ code: 0, message: 'ok', data: rows[0] })
} catch (e) {
console.error('[suppliers create] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
// PUT /api/suppliers/:id —— 更新
async function update(req, res) {
const { id } = req.params
const fields = ['name', 'contact', 'phone', 'address', 'type', 'content', 'status']
try {
const [existing] = await pool.query('SELECT id FROM suppliers WHERE id = ?', [id])
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '供应商不存在' })
}
const sets = []
const params = []
for (const f of fields) {
if (req.body[f] !== undefined) {
sets.push(`${f} = ?`)
params.push(req.body[f])
}
}
if (sets.length === 0) {
return res.status(400).json({ code: 400, message: '没有需要更新的字段' })
}
params.push(id)
await pool.query(`UPDATE suppliers SET ${sets.join(', ')} WHERE id = ?`, params)
const [rows] = await pool.query('SELECT * FROM suppliers WHERE id = ?', [id])
res.json({ code: 0, message: 'ok', data: rows[0] })
} catch (e) {
console.error('[suppliers update] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
// DELETE /api/suppliers/:id —— 删除
async function remove(req, res) {
const { id } = req.params
try {
const [existing] = await pool.query('SELECT id FROM suppliers WHERE id = ?', [id])
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '供应商不存在' })
}
await pool.query('DELETE FROM suppliers WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })
} catch (e) {
console.error('[suppliers delete] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
module.exports = { list, detail, create, update, remove }

147
routes/users.js
View File

@@ -3,8 +3,16 @@ const jwt = require('jsonwebtoken')
const bcrypt = require('bcryptjs')
const { pool } = require('../db')
// 安全字段：不返回密码哈希
const SAFE_FIELDS = 'id, username, real_name, role, status, created_at, updated_at'
// 安全字段：关联查询 roles 和 employees
const USER_LIST_SQL = `
SELECT u.id, u.username, u.is_active, u.role_id, u.employee_id, u.department,
u.created_at, u.updated_at,
r.name AS role_name, r.description AS role_description,
e.name AS real_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
LEFT JOIN employees e ON u.employee_id = e.id
`
function pagination(query) {
const page = Math.max(Number(query.page) || 1, 1)
@@ -24,18 +32,22 @@ async function login(req, res) {
try {
const [rows] = await pool.query(
'SELECT id, username, password, real_name, role, status FROM users WHERE username = ?',
`SELECT u.id, u.username, u.password, u.is_active, u.role_id, u.department, u.employee_id,
r.name AS role_name, e.name AS real_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
LEFT JOIN employees e ON u.employee_id = e.id
WHERE u.username = ?`,
[username]
)
// 用户不存在或密码错，统一提示避免枚举
if (rows.length === 0) {
return res.status(400).json({ code: 400, message: '账号或密码错误' })
}
const user = rows[0]
// 检查账号是否被禁用
if (user.status === 0) {
if (user.is_active === 0) {
return res.status(403).json({ code: 403, message: '账号已被禁用，请联系管理员' })
}
@@ -44,8 +56,25 @@ async function login(req, res) {
return res.status(400).json({ code: 400, message: '账号或密码错误' })
}
// 查询该角色的所有权限标识
const [perms] = await pool.query(
`SELECT p.name FROM permissions p
JOIN role_permissions rp ON p.id = rp.permission_id
WHERE rp.role_id = ?`,
[user.role_id]
)
const permissions = perms.map(p => p.name)
const token = jwt.sign(
{ id: user.id, username: user.username, role: user.role },
{
id: user.id,
username: user.username,
name: user.real_name || user.username,
role_id: user.role_id,
roleName: user.role_name,
department: user.department,
permissions,
},
process.env.JWT_SECRET,
{ expiresIn: process.env.JWT_EXPIRES_IN || '2h' }
)
@@ -58,8 +87,11 @@ async function login(req, res) {
userInfo: {
id: user.id,
username: user.username,
real_name: user.real_name,
role: user.role,
name: user.real_name || user.username,
role_id: user.role_id,
roleName: user.role_name,
department: user.department,
permissions,
},
},
})
@@ -73,7 +105,7 @@ async function login(req, res) {
async function info(req, res) {
try {
const [rows] = await pool.query(
`SELECT ${SAFE_FIELDS} FROM users WHERE id = ?`,
`${USER_LIST_SQL} WHERE u.id = ?`,
[req.user.id]
)
if (rows.length === 0) {
@@ -126,35 +158,35 @@ async function changePassword(req, res) {
// ========== 用户管理 CRUD（管理员） ==========
// GET /api/users —— 用户列表（管理员）
// GET /api/users —— 用户列表
async function list(req, res) {
try {
const { page, pageSize, offset } = pagination(req.query)
const { username, role, status } = req.query
const { username, role_id, is_active } = req.query
let where = 'WHERE 1=1'
const params = []
if (username) {
where += ' AND username LIKE ?'
where += ' AND u.username LIKE ?'
params.push(`%${username}%`)
}
if (role) {
where += ' AND role = ?'
params.push(role)
if (role_id) {
where += ' AND u.role_id = ?'
params.push(Number(role_id))
}
if (status !== undefined && status !== '') {
where += ' AND status = ?'
params.push(Number(status))
if (is_active !== undefined && is_active !== '') {
where += ' AND u.is_active = ?'
params.push(Number(is_active))
}
const [[{ total }]] = await pool.query(
`SELECT COUNT(*) AS total FROM users ${where}`,
`SELECT COUNT(*) AS total FROM users u ${where}`,
params
)
const [rows] = await pool.query(
`SELECT ${SAFE_FIELDS} FROM users ${where} ORDER BY id DESC LIMIT ? OFFSET ?`,
`${USER_LIST_SQL} ${where} ORDER BY u.id DESC LIMIT ? OFFSET ?`,
[...params, pageSize, offset]
)
@@ -175,11 +207,11 @@ async function list(req, res) {
}
}
// GET /api/users/:id —— 用户详情（管理员）
// GET /api/users/:id —— 用户详情
async function detail(req, res) {
try {
const [rows] = await pool.query(
`SELECT ${SAFE_FIELDS} FROM users WHERE id = ?`,
`${USER_LIST_SQL} WHERE u.id = ?`,
[req.params.id]
)
if (rows.length === 0) {
@@ -192,9 +224,9 @@ async function detail(req, res) {
}
}
// POST /api/users —— 创建用户（管理员）
// POST /api/users —— 创建用户
async function create(req, res) {
const { username, password, real_name = null, role = 'user', status = 1 } = req.body || {}
const { username, password, role_id, employee_id, department, is_active = 1 } = req.body || {}
if (!username || !password) {
return res.status(400).json({ code: 400, message: '用户名和密码必填' })
@@ -205,19 +237,36 @@ async function create(req, res) {
if (typeof password !== 'string' || password.length < 6) {
return res.status(400).json({ code: 400, message: '密码至少 6 位' })
}
if (!['admin', 'user'].includes(role)) {
return res.status(400).json({ code: 400, message: '角色只能为 admin 或 user' })
// 校验 role_id 是否存在
if (role_id) {
const [role] = await pool.query('SELECT id FROM roles WHERE id = ?', [role_id])
if (role.length === 0) {
return res.status(400).json({ code: 400, message: '指定的角色不存在' })
}
}
// 校验 employee_id 是否存在
if (employee_id) {
const [emp] = await pool.query('SELECT id, department FROM employees WHERE id = ?', [employee_id])
if (emp.length === 0) {
return res.status(400).json({ code: 400, message: '指定的员工不存在' })
}
// 如果没传 department，自动从员工表同步
if (!department) {
req.body.department = emp[0].department
}
}
try {
const hash = await bcrypt.hash(password, 10)
const [result] = await pool.query(
'INSERT INTO users (username, password, real_name, role, status) VALUES (?, ?, ?, ?, ?)',
[username, hash, real_name, role, status]
'INSERT INTO users (username, password, is_active, role_id, employee_id, department) VALUES (?, ?, ?, ?, ?, ?)',
[username, hash, is_active, role_id || null, employee_id || null, req.body.department || department || null]
)
const [rows] = await pool.query(
`SELECT ${SAFE_FIELDS} FROM users WHERE id = ?`,
`${USER_LIST_SQL} WHERE u.id = ?`,
[result.insertId]
)
res.json({ code: 0, message: 'ok', data: rows[0] })
@@ -230,38 +279,52 @@ async function create(req, res) {
}
}
// PUT /api/users/:id —— 更新用户（管理员）
// PUT /api/users/:id —— 更新用户
async function update(req, res) {
const { id } = req.params
const fields = ['username', 'real_name', 'role', 'status']
const fields = ['username', 'role_id', 'employee_id', 'department', 'is_active']
try {
const [existing] = await pool.query('SELECT id, role FROM users WHERE id = ?', [id])
const [existing] = await pool.query('SELECT id, role_id, is_active FROM users WHERE id = ?', [id])
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '用户不存在' })
}
const targetUser = existing[0]
// 不允许修改自己的角色或禁用自己
if (Number(id) === req.user.id) {
if (req.body.role !== undefined && req.body.role !== req.user.role) {
if (req.body.role_id !== undefined && req.body.role_id !== req.user.role_id) {
return res.status(400).json({ code: 400, message: '不能修改自己的角色' })
}
if (req.body.status === 0) {
if (req.body.is_active === 0) {
return res.status(400).json({ code: 400, message: '不能禁用自己' })
}
}
// 校验 role_id
if (req.body.role_id) {
const [role] = await pool.query('SELECT id FROM roles WHERE id = ?', [req.body.role_id])
if (role.length === 0) {
return res.status(400).json({ code: 400, message: '指定的角色不存在' })
}
}
// 校验 employee_id
if (req.body.employee_id) {
const [emp] = await pool.query('SELECT id, department FROM employees WHERE id = ?', [req.body.employee_id])
if (emp.length === 0) {
return res.status(400).json({ code: 400, message: '指定的员工不存在' })
}
// 自动同步 department
if (req.body.department === undefined) {
req.body.department = emp[0].department
}
}
const sets = []
const params = []
for (const f of fields) {
if (req.body[f] !== undefined) {
// role 字段只允许 admin / user
if (f === 'role' && !['admin', 'user'].includes(req.body[f])) {
return res.status(400).json({ code: 400, message: '角色只能为 admin 或 user' })
}
sets.push(`${f} = ?`)
params.push(req.body[f])
}
@@ -285,7 +348,7 @@ async function update(req, res) {
await pool.query(`UPDATE users SET ${sets.join(', ')} WHERE id = ?`, params)
const [rows] = await pool.query(
`SELECT ${SAFE_FIELDS} FROM users WHERE id = ?`,
`${USER_LIST_SQL} WHERE u.id = ?`,
[id]
)
res.json({ code: 0, message: 'ok', data: rows[0] })
@@ -298,7 +361,7 @@ async function update(req, res) {
}
}
// DELETE /api/users/:id —— 删除用户（管理员）
// DELETE /api/users/:id —— 删除用户
async function remove(req, res) {
const { id } = req.params
try {