ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构后端，使其更加权责分明

Browse Source
This commit is contained in:
ChoChoX
2026-06-26 09:44:54 +08:00
parent 764919f69e
commit 89d8505260
11 changed files with 1426 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
routes/contracts.js
View File

@@ -1,6 +1,5 @@
// routes/contracts.js —— 合同管理 CRUD
// routes/contracts.js —— 合同管理 CRUD（纯数据库操作，权限由中间件层控制）
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
// 格式化日期为 YYYY-MM-DD
function formatDate(dateStr) {
@@ -55,16 +54,10 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤（列表查询使用表别名 c，需要加前缀）
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
// 给 scope.where 中的字段加上表别名 c.
const scopedWhere = scope.where.replace(/\b(responsible_user_id|type)\b/g, 'c.$1')
where += ' AND ' + scopedWhere
params.push(...scope.values)
// 数据范围过滤（由中间件注入 req.scope，无别名；list/detail 需机械加 c. 前缀）
if (req.scope && req.scope.sql) {
where += ' ' + req.scope.sql.replace(/\btype\b/g, 'c.type')
params.push(...req.scope.params)
}
if (id) {
@@ -139,15 +132,10 @@ async function detail(req, res) {
let sql = `${DETAIL_SELECT} WHERE c.id = ?`
const params = [req.params.id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
// detail 查询使用表别名 c，需要给 scope.where 加上前缀
const scopedWhere = scope.where.replace(/\b(responsible_user_id|type)\b/g, 'c.$1')
sql += ' AND ' + scopedWhere
params.push(...scope.values)
// 数据范围过滤（由中间件注入 req.scope，无别名；detail 需机械加 c. 前缀）
if (req.scope && req.scope.sql) {
sql += ' ' + req.scope.sql.replace(/\btype\b/g, 'c.type')
params.push(...req.scope.params)
}
const [rows] = await pool.query(sql, params)
@@ -168,14 +156,8 @@ async function create(req, res) {
amount, effective_date, expiry_date, employee_id, status, remark,
} = req.body || {}
// 根据角色限制合同类型
const contractType = req.body.type || (req.user.roleName === 'procurement_manager' ? 'supply' : 'franchise')
if (req.user.roleName === 'procurement_manager' && contractType !== 'supply') {
return res.status(403).json({ code: 403, message: '采购经理只能创建采购合同' })
}
if (req.user.roleName === 'franchise_manager' && contractType !== 'franchise') {
return res.status(403).json({ code: 403, message: '招商经理只能创建加盟合同' })
}
// 合同类型默认值（类型校验由中间件层控制）
const contractType = req.body.type || 'franchise'
if (contractType === 'supply' && !supplier_id) {
return res.status(400).json({ code: 400, message: '采购合同必须选择供应商' })
@@ -202,12 +184,18 @@ async function create(req, res) {
return res.status(400).json({ code: 400, message: '关联供应商不存在' })
}
}
// 校验业务员（如果填了）
// 校验业务员（如果填了），并通过 employee_id 自动推导负责人
let responsibleUserId = req.user.id
if (employee_id) {
const [emp] = await pool.query('SELECT id FROM employees WHERE id = ?', [employee_id])
if (emp.length === 0) {
return res.status(400).json({ code: 400, message: '关联业务员不存在' })
}
// 业务员即负责人：查找该员工对应的系统用户
const [userRows] = await pool.query('SELECT id FROM users WHERE employee_id = ? LIMIT 1', [employee_id])
if (userRows.length > 0) {
responsibleUserId = userRows[0].id
}
}
const [result] = await pool.query(
@@ -224,7 +212,7 @@ async function create(req, res) {
status || '生效中',
remark || null,
contractType,
req.body.responsible_user_id || req.user.id]
responsibleUserId]
)
const [rows] = await pool.query(`${DETAIL_SELECT} WHERE c.id = ?`, [result.insertId])
@@ -240,20 +228,17 @@ async function update(req, res) {
const { id } = req.params
const fields = [
'customer_id', 'supplier_id', 'contract_name', 'contract_no', 'contract_content',
'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark', 'type', 'responsible_user_id',
'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark', 'type',
'responsible_user_id',
]
try {
// 确认记录存在且在数据范围内（detail/update/delete 不用表别名）
let checkSql = 'SELECT id FROM contracts WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkSql = 'SELECT id, employee_id FROM contracts WHERE id = ?'
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
@@ -273,6 +258,22 @@ async function update(req, res) {
return res.status(400).json({ code: 400, message: '关联业务员不存在' })
}
}
// 业务员即负责人：当 employee_id 变更时自动推导 responsible_user_id
if (req.body.employee_id !== undefined) {
if (req.body.employee_id) {
const [userRows] = await pool.query('SELECT id FROM users WHERE employee_id = ? LIMIT 1', [req.body.employee_id])
if (userRows.length > 0) {
req.body.responsible_user_id = userRows[0].id
} else {
// 该员工无对应系统用户时，设为当前登录用户
req.body.responsible_user_id = req.user.id
}
} else {
// 业务员被清空时，清空负责人
req.body.responsible_user_id = null
}
}
if (req.body.supplier_id) {
const [sup] = await pool.query('SELECT id FROM suppliers WHERE id = ?', [req.body.supplier_id])
if (sup.length === 0) {
@@ -313,14 +314,10 @@ async function remove(req, res) {
const { id } = req.params
try {
let checkSql = 'SELECT id FROM contracts WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'contracts')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {