ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构后端，使其更加权责分明

Browse Source
This commit is contained in:
ChoChoX
2026-06-26 09:44:54 +08:00
parent 764919f69e
commit 89d8505260
11 changed files with 1426 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
routes/users.js
View File

@@ -3,14 +3,14 @@ const jwt = require('jsonwebtoken')
const bcrypt = require('bcryptjs')
const { pool } = require('../db')
// 安全字段：关联查询 roles 和 employees
// 安全字段：关联查询 departments 和 employees
const USER_LIST_SQL = `
SELECT u.id, u.username, u.is_active, u.role_id, u.employee_id, u.department,
SELECT u.id, u.username, u.is_active, u.department_id, u.employee_id,
u.created_at, u.updated_at,
r.name AS role_name, r.description AS role_description,
d.name AS dept_name, d.description AS dept_desc,
e.name AS real_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
LEFT JOIN departments d ON u.department_id = d.id
LEFT JOIN employees e ON u.employee_id = e.id
`
@@ -32,10 +32,10 @@ async function login(req, res) {
try {
const [rows] = await pool.query(
`SELECT u.id, u.username, u.password, u.is_active, u.role_id, u.department, u.employee_id,
r.name AS role_name, e.name AS real_name
`SELECT u.id, u.username, u.password, u.is_active, u.department_id, u.employee_id,
d.name AS dept_name, d.description AS dept_desc, e.name AS real_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
LEFT JOIN departments d ON u.department_id = d.id
LEFT JOIN employees e ON u.employee_id = e.id
WHERE u.username = ?`,
[username]
@@ -56,12 +56,12 @@ async function login(req, res) {
return res.status(400).json({ code: 400, message: '账号或密码错误' })
}
// 查询该角色的所有权限标识
// 查询该部门的所有权限标识
const [perms] = await pool.query(
`SELECT p.name FROM permissions p
JOIN role_permissions rp ON p.id = rp.permission_id
WHERE rp.role_id = ?`,
[user.role_id]
JOIN department_permissions dp ON p.id = dp.permission_id
WHERE dp.department_id = ?`,
[user.department_id]
)
const permissions = perms.map(p => p.name)
@@ -70,9 +70,9 @@ async function login(req, res) {
id: user.id,
username: user.username,
name: user.real_name || user.username,
role_id: user.role_id,
roleName: user.role_name,
department: user.department,
department_id: user.department_id,
departmentName: user.dept_name,
departmentDesc: user.dept_desc,
permissions,
},
process.env.JWT_SECRET,
@@ -88,9 +88,9 @@ async function login(req, res) {
id: user.id,
username: user.username,
name: user.real_name || user.username,
role_id: user.role_id,
roleName: user.role_name,
department: user.department,
department_id: user.department_id,
departmentName: user.dept_name,
departmentDesc: user.dept_desc,
permissions,
},
},
@@ -177,7 +177,7 @@ async function changePassword(req, res) {
async function list(req, res) {
try {
const { page, pageSize, offset } = pagination(req.query)
const { username, real_name, id, role_id, is_active } = req.query
const { username, real_name, id, department_id, is_active } = req.query
let where = 'WHERE 1=1'
const params = []
@@ -194,9 +194,9 @@ async function list(req, res) {
where += ' AND u.id = ?'
params.push(Number(id))
}
if (role_id) {
where += ' AND u.role_id = ?'
params.push(Number(role_id))
if (department_id) {
where += ' AND u.department_id = ?'
params.push(Number(department_id))
}
if (is_active !== undefined && is_active !== '') {
where += ' AND u.is_active = ?'
@@ -251,7 +251,7 @@ async function detail(req, res) {
// POST /api/users —— 创建用户
async function create(req, res) {
const { username, password, role_id, employee_id, department, is_active = 1 } = req.body || {}
const { username, password, department_id, employee_id, is_active = 1 } = req.body || {}
if (!username || !password) {
return res.status(400).json({ code: 400, message: '用户名和密码必填' })
@@ -263,31 +263,27 @@ async function create(req, res) {
return res.status(400).json({ code: 400, message: '密码至少 6 位' })
}
// 校验 role_id 是否存在
if (role_id) {
const [role] = await pool.query('SELECT id FROM roles WHERE id = ?', [role_id])
if (role.length === 0) {
return res.status(400).json({ code: 400, message: '指定的角色不存在' })
// 校验 department_id 是否存在
if (department_id) {
const [dept] = await pool.query('SELECT id FROM departments WHERE id = ?', [department_id])
if (dept.length === 0) {
return res.status(400).json({ code: 400, message: '指定的部门不存在' })
}
}
// 校验 employee_id 是否存在
if (employee_id) {
const [emp] = await pool.query('SELECT id, department FROM employees WHERE id = ?', [employee_id])
const [emp] = await pool.query('SELECT id FROM employees WHERE id = ?', [employee_id])
if (emp.length === 0) {
return res.status(400).json({ code: 400, message: '指定的员工不存在' })
}
// 如果没传 department，自动从员工表同步
if (!department) {
req.body.department = emp[0].department
}
}
try {
const hash = await bcrypt.hash(password, 10)
const [result] = await pool.query(
'INSERT INTO users (username, password, is_active, role_id, employee_id, department) VALUES (?, ?, ?, ?, ?, ?)',
[username, hash, is_active, role_id || null, employee_id || null, req.body.department || department || null]
'INSERT INTO users (username, password, is_active, department_id, employee_id) VALUES (?, ?, ?, ?, ?)',
[username, hash, is_active, department_id || null, employee_id || null]
)
const [rows] = await pool.query(
@@ -307,42 +303,30 @@ async function create(req, res) {
// PUT /api/users/:id —— 更新用户
async function update(req, res) {
const { id } = req.params
const fields = ['username', 'role_id', 'employee_id', 'department', 'is_active']
const fields = ['username', 'department_id', 'employee_id', 'is_active']
try {
const [existing] = await pool.query('SELECT id, role_id, is_active FROM users WHERE id = ?', [id])
const [existing] = await pool.query('SELECT id, department_id, is_active FROM users WHERE id = ?', [id])
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '用户不存在' })
}
// 不允许修改自己的角色或禁用自己
if (Number(id) === req.user.id) {
if (req.body.role_id !== undefined && req.body.role_id !== req.user.role_id) {
return res.status(400).json({ code: 400, message: '不能修改自己的角色' })
}
if (req.body.is_active === 0) {
return res.status(400).json({ code: 400, message: '不能禁用自己' })
}
}
// 不允许修改自己的部门或禁用自己（此检查已移至中间件 protectSelfUpdate）
// 校验 role_id
if (req.body.role_id) {
const [role] = await pool.query('SELECT id FROM roles WHERE id = ?', [req.body.role_id])
if (role.length === 0) {
return res.status(400).json({ code: 400, message: '指定的角色不存在' })
// 校验 department_id
if (req.body.department_id) {
const [dept] = await pool.query('SELECT id FROM departments WHERE id = ?', [req.body.department_id])
if (dept.length === 0) {
return res.status(400).json({ code: 400, message: '指定的部门不存在' })
}
}
// 校验 employee_id
if (req.body.employee_id) {
const [emp] = await pool.query('SELECT id, department FROM employees WHERE id = ?', [req.body.employee_id])
const [emp] = await pool.query('SELECT id FROM employees WHERE id = ?', [req.body.employee_id])
if (emp.length === 0) {
return res.status(400).json({ code: 400, message: '指定的员工不存在' })
}
// 自动同步 department
if (req.body.department === undefined) {
req.body.department = emp[0].department
}
}
const sets = []
@@ -390,24 +374,12 @@ async function update(req, res) {
async function remove(req, res) {
const { id } = req.params
try {
if (Number(id) === req.user.id) {
return res.status(400).json({ code: 400, message: '不能删除自己' })
}
const [existing] = await pool.query('SELECT id, role_id FROM users WHERE id = ?', [id])
// 不能删除自己/最后一个管理员（此检查已移至中间件 protectUserDelete）
const [existing] = await pool.query('SELECT id FROM users WHERE id = ?', [id])
if (existing.length === 0) {
return res.status(404).json({ code: 404, message: '用户不存在' })
}
// 禁止删除最后一个管理员
const [adminRole] = await pool.query('SELECT id FROM roles WHERE name = ?', ['admin'])
if (adminRole.length > 0 && existing[0].role_id === adminRole[0].id) {
const [[{ cnt }]] = await pool.query('SELECT COUNT(*) AS cnt FROM users WHERE role_id = ?', [adminRole[0].id])
if (cnt <= 1) {
return res.status(400).json({ code: 400, message: '不能删除最后一个管理员' })
}
}
await pool.query('DELETE FROM users WHERE id = ?', [id])
res.json({ code: 0, message: 'ok' })
} catch (e) {