ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构后端，使其更加权责分明

Browse Source
This commit is contained in:
ChoChoX
2026-06-26 09:44:54 +08:00
parent 764919f69e
commit 89d8505260
11 changed files with 1426 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
routes/employees.js
View File

@@ -1,6 +1,6 @@
// routes/employees.js —— 员工管理 CRUD
// routes/employees.js —— 员工管理 CRUD（纯数据库操作，权限由中间件层控制）
const { pool } = require('../db')
const { getDataScope } = require('../middleware/permissions')
const bcrypt = require('bcryptjs')
// 格式化日期为 YYYY-MM-DD
function formatDate(dateStr) {
@@ -36,14 +36,10 @@ async function list(req, res) {
let where = 'WHERE 1=1'
const params = []
// 数据范围过滤（部门隔离）
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
where += ' AND ' + scope.where
params.push(...scope.values)
// 数据范围过滤（由中间件注入 req.scope）
if (req.scope && req.scope.sql) {
where += ' ' + req.scope.sql
params.push(...req.scope.params)
}
if (id) {
@@ -96,13 +92,10 @@ async function detail(req, res) {
let sql = 'SELECT * FROM employees WHERE id = ?'
const params = [req.params.id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
sql += ' AND ' + scope.where
params.push(...scope.values)
// 数据范围过滤（由中间件注入 req.scope）
if (req.scope && req.scope.sql) {
sql += ' ' + req.scope.sql
params.push(...req.scope.params)
}
const [rows] = await pool.query(sql, params)
@@ -145,6 +138,18 @@ async function create(req, res) {
remark || null]
)
const [rows] = await pool.query('SELECT * FROM employees WHERE id = ?', [result.insertId])
// 如果中间件 allowUserCreation 要求同步创建用户账号
if (req._createUser) {
const { username, password, department_id } = req._createUser
const hash = await bcrypt.hash(password, 10)
await pool.query(
'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, 1, ?, ?)',
[username, hash, department_id, result.insertId]
)
delete req._createUser // 清理，避免影响后续中间件
}
res.json({ code: 0, message: 'ok', data: rows[0] })
} catch (e) {
console.error('[employees create] error:', e)
@@ -163,14 +168,10 @@ async function update(req, res) {
try {
// 确认记录存在且在数据范围内
let checkSql = 'SELECT id FROM employees WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {
@@ -197,11 +198,6 @@ async function update(req, res) {
params.push(id)
await pool.query(`UPDATE employees SET ${sets.join(', ')} WHERE id = ?`, params)
// 同步 department 到关联的 users 表
if (req.body.department !== undefined) {
await pool.query('UPDATE users SET department = ? WHERE employee_id = ?', [req.body.department, id])
}
const [rows] = await pool.query('SELECT * FROM employees WHERE id = ?', [id])
res.json({ code: 0, message: 'ok', data: rows[0] })
} catch (e) {
@@ -215,14 +211,10 @@ async function remove(req, res) {
const { id } = req.params
try {
let checkSql = 'SELECT id FROM employees WHERE id = ?'
const checkParams = [id]
const scope = getDataScope(req.user, 'employees')
if (scope.deny) {
return res.status(403).json({ code: 403, message: '无权访问此资源' })
}
if (scope.where) {
checkSql += ' AND ' + scope.where
checkParams.push(...scope.values)
let checkParams = [id]
if (req.scope && req.scope.sql) {
checkSql += ' ' + req.scope.sql
checkParams.push(...req.scope.params)
}
const [existing] = await pool.query(checkSql, checkParams)
if (existing.length === 0) {