ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构后端，使其更加权责分明

Browse Source
This commit is contained in:
ChoChoX
2026-06-26 09:44:54 +08:00
parent 764919f69e
commit 89d8505260
11 changed files with 1426 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
routes/customers.js
View File

@@ -1,6 +1,5 @@
// routes/customers.js —— 客户管理 CRUD
// routes/customers.js —— 客户管理 CRUD（纯数据库操作，权限由中间件层控制）
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
// 提取分页参数
function pagination(query) {
@@ -19,14 +18,10 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
where += ' AND ' + scope.where
params.push(...scope.values)
// 数据范围过滤（由中间件注入 req.scope）
if (req.scope && req.scope.sql) {
where += ' ' + req.scope.sql
params.push(...req.scope.params)
}
if (id) {
@@ -56,12 +51,10 @@ async function list(req, res) {
params
)
// 查分页数据（JOIN users+employees 获取负责人姓名）
// 查分页数据
const [rows] = await pool.query(
`SELECT c.*, e.name AS responsible_user_name
`SELECT c.*
FROM customers c
LEFT JOIN users u ON c.responsible_user_id = u.id
LEFT JOIN employees e ON u.employee_id = e.id
${where} ORDER BY c.id DESC LIMIT ? OFFSET ?`,
[...params, pageSize, offset]
)
@@ -89,13 +82,9 @@ async function detail(req, res) {
let sql = 'SELECT * FROM customers WHERE id = ?'
const params = [req.params.id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
sql += ' AND ' + scope.where
params.push(...scope.values)
if (req.scope && req.scope.sql) {
sql += ' ' + req.scope.sql
params.push(...req.scope.params)
}
const [rows] = await pool.query(sql, params)
@@ -113,7 +102,7 @@ async function detail(req, res) {
async function create(req, res) {
const {
name, phone, province, city, district,
address, email, remark, responsible_user_id,
address, email, remark,
} = req.body || {}
if (!name) {
@@ -121,14 +110,11 @@ async function create(req, res) {
}
try {
// 如果没指定负责人，默认设为当前用户
const ownerId = responsible_user_id || req.user.id
const [result] = await pool.query(
`INSERT INTO customers (name, phone, province, city, district, address, email, remark, responsible_user_id)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
`INSERT INTO customers (name, phone, province, city, district, address, email, remark)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
[name, phone || null, province || null, city || null, district || null,
address || null, email || null, remark || null, ownerId]
address || null, email || null, remark || null]
)
const [rows] = await pool.query('SELECT * FROM customers WHERE id = ?', [result.insertId])
res.json({ code: 0, message: 'ok', data: rows[0] })
@@ -143,20 +129,16 @@ async function update(req, res) {
const { id } = req.params
const fields = [
'name', 'phone', 'province', 'city', 'district',
'address', 'email', 'remark', 'responsible_user_id',
'address', 'email', 'remark',
]
try {
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM customers WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkParams = [id] // let, 后续可能 push scope.params
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
@@ -192,14 +174,10 @@ async function remove(req, res) {
const { id } = req.params
try {
let checkSql = 'SELECT id FROM customers WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'customers')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
@@ -216,4 +194,17 @@ async function remove(req, res) {
}
}
module.exports = { list, detail, create, update, remove }
// GET /api/customers/simple —— 简易加盟商列表（无数据范围限制，用于下拉选择）
async function simpleList(req, res) {
try {
const [rows] = await pool.query(
'SELECT id, name FROM customers ORDER BY id'
)
res.json({ code: 0, message: 'ok', data: rows })
} catch (e) {
console.error('[customers simpleList] error:', e)
res.status(500).json({ code: 500, message: e.message })
}
}
module.exports = { list, detail, create, update, remove, simpleList }