添加了更多功能

routes/employees.js

@@ -1,5 +1,6 @@
 // routes/employees.js —— 员工管理 CRUD
 const { pool } = require('../db')
+const { getDataScope } = require('../middleware/permissions')
 
 function pagination(query) {
   const page = Math.max(Number(query.page) || 1, 1)
@@ -17,6 +18,16 @@ async function list(req, res) {
     let where = 'WHERE 1=1'
     const params = []
 
+    // 数据范围过滤（部门隔离）
+    const scope = getDataScope(req.user, 'employees')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      where += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
     if (name) {
       where += ' AND name LIKE ?'
       params.push(`%${name}%`)
@@ -60,7 +71,19 @@ async function list(req, res) {
 // GET /api/employees/:id —— 详情
 async function detail(req, res) {
   try {
-    const [rows] = await pool.query('SELECT * FROM employees WHERE id = ?', [req.params.id])
+    let sql = 'SELECT * FROM employees WHERE id = ?'
+    const params = [req.params.id]
+
+    const scope = getDataScope(req.user, 'employees')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      sql += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
+    const [rows] = await pool.query(sql, params)
     if (rows.length === 0) {
       return res.status(404).json({ code: 404, message: '员工不存在' })
     }
@@ -116,9 +139,20 @@ async function update(req, res) {
   ]
 
   try {
-    const [existing] = await pool.query('SELECT id FROM employees WHERE id = ?', [id])
+    // 确认记录存在且在数据范围内
+    let checkSql = 'SELECT id FROM employees WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'employees')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '员工不存在' })
+      return res.status(404).json({ code: 404, message: '员工不存在或无权操作' })
     }
 
     const sets = []
@@ -148,9 +182,19 @@ async function update(req, res) {
 async function remove(req, res) {
   const { id } = req.params
   try {
-    const [existing] = await pool.query('SELECT id FROM employees WHERE id = ?', [id])
+    let checkSql = 'SELECT id FROM employees WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'employees')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '员工不存在' })
+      return res.status(404).json({ code: 404, message: '员工不存在或无权操作' })
     }
     await pool.query('DELETE FROM employees WHERE id = ?', [id])
     res.json({ code: 0, message: 'ok' })