添加了更多功能

server.js

@@ -10,6 +10,8 @@ const employees = require('./routes/employees')
 const contracts = require('./routes/contracts')
 const afterSales = require('./routes/afterSales')
 const products = require('./routes/products')
+const suppliers = require('./routes/suppliers')
+const { checkPermission } = require('./middleware/permissions')
 
 const app = express()
 app.use(express.json())   // 解析 application/json 请求体
@@ -30,61 +32,60 @@ function auth(req, res, next) {
   }
 }
 
-// ============ 管理员校验中间件 ============
-function requireAdmin(req, res, next) {
-  if (!req.user || req.user.role !== 'admin') {
-    return res.status(403).json({ code: 403, message: '需要管理员权限' })
-  }
-  next()
-}
-
 // ============ 登录/登出/个人信息 ============
 app.post('/api/user/login',        users.login)
 app.get('/api/user/info',          auth, users.info)
 app.post('/api/user/logout',       auth, users.logout)
 app.put('/api/user/password',      auth, users.changePassword)
 
-// ============ 用户管理 CRUD（管理员）/api/users ============
-app.get('/api/users',              auth, requireAdmin, users.list)
-app.get('/api/users/:id',          auth, requireAdmin, users.detail)
-app.post('/api/users',             auth, requireAdmin, users.create)
-app.put('/api/users/:id',          auth, requireAdmin, users.update)
-app.delete('/api/users/:id',       auth, requireAdmin, users.remove)
+// ============ 用户管理 CRUD /api/users（管理员专属） ============
+app.get('/api/users',              auth, checkPermission('user', 'manage'), users.list)
+app.get('/api/users/:id',          auth, checkPermission('user', 'manage'), users.detail)
+app.post('/api/users',             auth, checkPermission('user', 'manage'), users.create)
+app.put('/api/users/:id',          auth, checkPermission('user', 'manage'), users.update)
+app.delete('/api/users/:id',       auth, checkPermission('user', 'manage'), users.remove)
 
-// ============ 客户管理 /api/customers ============
-app.get('/api/customers',          auth, customers.list)
-app.get('/api/customers/:id',      auth, customers.detail)
-app.post('/api/customers',         auth, customers.create)
-app.put('/api/customers/:id',      auth, customers.update)
-app.delete('/api/customers/:id',   auth, customers.remove)
+// ============ 加盟商管理 /api/customers ============
+app.get('/api/customers',          auth, checkPermission('customer', 'read'), customers.list)
+app.get('/api/customers/:id',      auth, checkPermission('customer', 'read'), customers.detail)
+app.post('/api/customers',         auth, checkPermission('customer', 'create'), customers.create)
+app.put('/api/customers/:id',      auth, checkPermission('customer', 'update'), customers.update)
+app.delete('/api/customers/:id',   auth, checkPermission('customer', 'delete'), customers.remove)
 
 // ============ 员工管理 /api/employees ============
-app.get('/api/employees',          auth, employees.list)
-app.get('/api/employees/:id',      auth, employees.detail)
-app.post('/api/employees',         auth, employees.create)
-app.put('/api/employees/:id',      auth, employees.update)
-app.delete('/api/employees/:id',   auth, employees.remove)
+app.get('/api/employees',          auth, checkPermission('employee', 'read'), employees.list)
+app.get('/api/employees/:id',      auth, checkPermission('employee', 'read'), employees.detail)
+app.post('/api/employees',         auth, checkPermission('employee', 'create'), employees.create)
+app.put('/api/employees/:id',      auth, checkPermission('employee', 'update'), employees.update)
+app.delete('/api/employees/:id',   auth, checkPermission('employee', 'delete'), employees.remove)
 
 // ============ 合同管理 /api/contracts ============
-app.get('/api/contracts',          auth, contracts.list)
-app.get('/api/contracts/:id',      auth, contracts.detail)
-app.post('/api/contracts',         auth, contracts.create)
-app.put('/api/contracts/:id',      auth, contracts.update)
-app.delete('/api/contracts/:id',   auth, contracts.remove)
+app.get('/api/contracts',          auth, checkPermission('contract', 'read'), contracts.list)
+app.get('/api/contracts/:id',      auth, checkPermission('contract', 'read'), contracts.detail)
+app.post('/api/contracts',         auth, checkPermission('contract', 'create'), contracts.create)
+app.put('/api/contracts/:id',      auth, checkPermission('contract', 'update'), contracts.update)
+app.delete('/api/contracts/:id',   auth, checkPermission('contract', 'delete'), contracts.remove)
 
 // ============ 售后管理 /api/after-sales ============
-app.get('/api/after-sales',        auth, afterSales.list)
-app.get('/api/after-sales/:id',    auth, afterSales.detail)
-app.post('/api/after-sales',       auth, afterSales.create)
-app.put('/api/after-sales/:id',    auth, afterSales.update)
-app.delete('/api/after-sales/:id', auth, afterSales.remove)
+app.get('/api/after-sales',        auth, checkPermission('after_sale', 'read'), afterSales.list)
+app.get('/api/after-sales/:id',    auth, checkPermission('after_sale', 'read'), afterSales.detail)
+app.post('/api/after-sales',       auth, checkPermission('after_sale', 'create'), afterSales.create)
+app.put('/api/after-sales/:id',    auth, checkPermission('after_sale', 'update'), afterSales.update)
+app.delete('/api/after-sales/:id', auth, checkPermission('after_sale', 'delete'), afterSales.remove)
 
 // ============ 产品管理 /api/products ============
-app.get('/api/products',           auth, products.list)
-app.get('/api/products/:id',       auth, products.detail)
-app.post('/api/products',          auth, products.create)
-app.put('/api/products/:id',       auth, products.update)
-app.delete('/api/products/:id',    auth, products.remove)
+app.get('/api/products',           auth, checkPermission('product', 'read'), products.list)
+app.get('/api/products/:id',       auth, checkPermission('product', 'read'), products.detail)
+app.post('/api/products',          auth, checkPermission('product', 'create'), products.create)
+app.put('/api/products/:id',       auth, checkPermission('product', 'update'), products.update)
+app.delete('/api/products/:id',    auth, checkPermission('product', 'delete'), products.remove)
+
+// ============ 供应商管理 /api/suppliers ============
+app.get('/api/suppliers',          auth, checkPermission('supplier', 'read'), suppliers.list)
+app.get('/api/suppliers/:id',      auth, checkPermission('supplier', 'read'), suppliers.detail)
+app.post('/api/suppliers',         auth, checkPermission('supplier', 'create'), suppliers.create)
+app.put('/api/suppliers/:id',      auth, checkPermission('supplier', 'update'), suppliers.update)
+app.delete('/api/suppliers/:id',   auth, checkPermission('supplier', 'delete'), suppliers.remove)
 
 // ============ 启动 ============
 const PORT = Number(process.env.PORT) || 3000