添加了更多功能

routes/customers.js

@@ -1,5 +1,6 @@
 // routes/customers.js —— 客户管理 CRUD
 const { pool } = require('../db')
+const { getDataScope } = require('../middleware/permissions')
 
 // 提取分页参数
 function pagination(query) {
@@ -18,6 +19,16 @@ async function list(req, res) {
     let where = 'WHERE 1=1'
     const params = []
 
+    // 数据范围过滤
+    const scope = getDataScope(req.user, 'customers')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      where += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
     if (name) {
       where += ' AND name LIKE ?'
       params.push(`%${name}%`)
@@ -71,7 +82,19 @@ async function list(req, res) {
 // GET /api/customers/:id —— 详情
 async function detail(req, res) {
   try {
-    const [rows] = await pool.query('SELECT * FROM customers WHERE id = ?', [req.params.id])
+    let sql = 'SELECT * FROM customers WHERE id = ?'
+    const params = [req.params.id]
+
+    const scope = getDataScope(req.user, 'customers')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      sql += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
+    const [rows] = await pool.query(sql, params)
     if (rows.length === 0) {
       return res.status(404).json({ code: 404, message: '客户不存在' })
     }
@@ -86,7 +109,7 @@ async function detail(req, res) {
 async function create(req, res) {
   const {
     name, phone, province, city, district,
-    address, customer_type, email, remark,
+    address, customer_type, email, remark, responsible_user_id,
   } = req.body || {}
 
   if (!name) {
@@ -94,11 +117,14 @@ async function create(req, res) {
   }
 
   try {
+    // 如果没指定负责人，默认设为当前用户
+    const ownerId = responsible_user_id || req.user.id
+
     const [result] = await pool.query(
-      `INSERT INTO customers (name, phone, province, city, district, address, customer_type, email, remark)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT INTO customers (name, phone, province, city, district, address, customer_type, email, remark, responsible_user_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [name, phone || null, province || null, city || null, district || null,
-        address || null, customer_type || 'Normal', email || null, remark || null]
+        address || null, customer_type || 'Normal', email || null, remark || null, ownerId]
     )
     const [rows] = await pool.query('SELECT * FROM customers WHERE id = ?', [result.insertId])
     res.json({ code: 0, message: 'ok', data: rows[0] })
@@ -113,14 +139,24 @@ async function update(req, res) {
   const { id } = req.params
   const fields = [
     'name', 'phone', 'province', 'city', 'district',
-    'address', 'customer_type', 'email', 'remark',
+    'address', 'customer_type', 'email', 'remark', 'responsible_user_id',
   ]
 
   try {
-    // 先确认记录存在
-    const [existing] = await pool.query('SELECT id FROM customers WHERE id = ?', [id])
+    // 确认记录存在且在数据范围内
+    let checkSql = 'SELECT id FROM customers WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'customers')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '客户不存在' })
+      return res.status(404).json({ code: 404, message: '客户不存在或无权操作' })
     }
 
     // 动态构建 SET 子句（只更新传入的字段）
@@ -151,9 +187,19 @@ async function update(req, res) {
 async function remove(req, res) {
   const { id } = req.params
   try {
-    const [existing] = await pool.query('SELECT id FROM customers WHERE id = ?', [id])
+    let checkSql = 'SELECT id FROM customers WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'customers')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '客户不存在' })
+      return res.status(404).json({ code: 404, message: '客户不存在或无权操作' })
     }
     await pool.query('DELETE FROM customers WHERE id = ?', [id])
     res.json({ code: 0, message: 'ok' })