ChoChoX/backmanager-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构后端，使其更加权责分明

Browse Source
This commit is contained in:
ChoChoX
2026-06-26 09:44:54 +08:00
parent 764919f69e
commit 89d8505260
11 changed files with 1426 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
server.js
View File

@@ -11,7 +11,11 @@ const contracts = require('./routes/contracts')
const afterSales = require('./routes/afterSales')
const products = require('./routes/products')
const suppliers = require('./routes/suppliers')
const { checkPermission } = require('./middleware/permissions')
// 导入中间件
const { checkPermission, dataScope, validateContractType } = require('./middleware/permissions')
const { protectSelfUpdate, protectUserDelete } = require('./middleware/users')
const { allowUserCreation } = require('./middleware/employees')
const app = express()
app.use(express.json()) // 解析 application/json 请求体
@@ -35,7 +39,7 @@ function auth(req, res, next) {
// ============ 登录/登出/个人信息 ============
app.post('/api/user/login', users.login)
app.get('/api/user/info', auth, users.info)
app.get('/api/user/list', auth, checkPermission('user', 'manage'), users.simpleList)
app.get('/api/user/list', auth, users.simpleList)
app.post('/api/user/logout', auth, users.logout)
app.put('/api/user/password', auth, users.changePassword)
@@ -43,37 +47,38 @@ app.put('/api/user/password', auth, users.changePassword)
app.get('/api/users', auth, checkPermission('user', 'manage'), users.list)
app.get('/api/users/:id', auth, checkPermission('user', 'manage'), users.detail)
app.post('/api/users', auth, checkPermission('user', 'manage'), users.create)
app.put('/api/users/:id', auth, checkPermission('user', 'manage'), users.update)
app.delete('/api/users/:id', auth, checkPermission('user', 'manage'), users.remove)
app.put('/api/users/:id', auth, checkPermission('user', 'manage'), protectSelfUpdate, users.update)
app.delete('/api/users/:id', auth, checkPermission('user', 'manage'), protectUserDelete, users.remove)
// ============ 加盟商管理 /api/customers ============
app.get('/api/customers', auth, checkPermission('customer', 'read'), customers.list)
app.get('/api/customers/:id', auth, checkPermission('customer', 'read'), customers.detail)
app.post('/api/customers', auth, checkPermission('customer', 'create'), customers.create)
app.put('/api/customers/:id', auth, checkPermission('customer', 'update'), customers.update)
app.delete('/api/customers/:id', auth, checkPermission('customer', 'delete'), customers.remove)
app.get('/api/customers/simple', auth, checkPermission('customer', 'read'), customers.simpleList)
app.get('/api/customers', auth, checkPermission('customer', 'read'), dataScope('customers'), customers.list)
app.get('/api/customers/:id', auth, checkPermission('customer', 'read'), dataScope('customers'), customers.detail)
app.post('/api/customers', auth, checkPermission('customer', 'create'), customers.create)
app.put('/api/customers/:id', auth, checkPermission('customer', 'update'),dataScope('customers'), customers.update)
app.delete('/api/customers/:id', auth, checkPermission('customer', 'delete'),dataScope('customers'), customers.remove)
// ============ 员工管理 /api/employees ============
app.get('/api/employees/simple', auth, employees.simpleList)
app.get('/api/employees', auth, checkPermission('employee', 'read'), employees.list)
app.get('/api/employees/:id', auth, checkPermission('employee', 'read'), employees.detail)
app.post('/api/employees', auth, checkPermission('employee', 'create'), employees.create)
app.put('/api/employees/:id', auth, checkPermission('employee', 'update'), employees.update)
app.delete('/api/employees/:id', auth, checkPermission('employee', 'delete'), employees.remove)
app.get('/api/employees/simple', auth, employees.simpleList)
app.get('/api/employees', auth, checkPermission('employee', 'read'), dataScope('employees'), employees.list)
app.get('/api/employees/:id', auth, checkPermission('employee', 'read'), dataScope('employees'), employees.detail)
app.post('/api/employees', auth, checkPermission('employee', 'create'),allowUserCreation, employees.create)
app.put('/api/employees/:id', auth, checkPermission('employee', 'update'),dataScope('employees'), employees.update)
app.delete('/api/employees/:id', auth, checkPermission('employee', 'delete'),dataScope('employees'), employees.remove)
// ============ 合同管理 /api/contracts ============
app.get('/api/contracts', auth, checkPermission('contract', 'read'), contracts.list)
app.get('/api/contracts/:id', auth, checkPermission('contract', 'read'), contracts.detail)
app.post('/api/contracts', auth, checkPermission('contract', 'create'), contracts.create)
app.put('/api/contracts/:id', auth, checkPermission('contract', 'update'), contracts.update)
app.delete('/api/contracts/:id', auth, checkPermission('contract', 'delete'), contracts.remove)
app.get('/api/contracts', auth, checkPermission('contract', 'read'), dataScope('contracts'), contracts.list)
app.get('/api/contracts/:id', auth, checkPermission('contract', 'read'), dataScope('contracts'), contracts.detail)
app.post('/api/contracts', auth, checkPermission('contract', 'create'),validateContractType, contracts.create)
app.put('/api/contracts/:id', auth, checkPermission('contract', 'update'),validateContractType,dataScope('contracts'),contracts.update)
app.delete('/api/contracts/:id', auth, checkPermission('contract', 'delete'),dataScope('contracts'), contracts.remove)
// ============ 售后管理 /api/after-sales ============
app.get('/api/after-sales', auth, checkPermission('after_sale', 'read'), afterSales.list)
app.get('/api/after-sales/:id', auth, checkPermission('after_sale', 'read'), afterSales.detail)
app.post('/api/after-sales', auth, checkPermission('after_sale', 'create'), afterSales.create)
app.put('/api/after-sales/:id', auth, checkPermission('after_sale', 'update'), afterSales.update)
app.delete('/api/after-sales/:id', auth, checkPermission('after_sale', 'delete'), afterSales.remove)
app.get('/api/after-sales', auth, checkPermission('after_sale', 'read'), dataScope('after_sales'), afterSales.list)
app.get('/api/after-sales/:id', auth, checkPermission('after_sale', 'read'), dataScope('after_sales'), afterSales.detail)
app.post('/api/after-sales', auth, checkPermission('after_sale', 'create'), afterSales.create)
app.put('/api/after-sales/:id', auth, checkPermission('after_sale', 'update'),dataScope('after_sales'),afterSales.update)
app.delete('/api/after-sales/:id', auth, checkPermission('after_sale', 'delete'),dataScope('after_sales'),afterSales.remove)
// ============ 产品管理 /api/products ============
app.get('/api/products', auth, checkPermission('product', 'read'), products.list)
@@ -83,6 +88,7 @@ app.put('/api/products/:id', auth, checkPermission('product', 'update'), p
app.delete('/api/products/:id', auth, checkPermission('product', 'delete'), products.remove)
// ============ 供应商管理 /api/suppliers ============
app.get('/api/suppliers/simple', auth, checkPermission('supplier', 'read'), suppliers.simpleList)
app.get('/api/suppliers', auth, checkPermission('supplier', 'read'), suppliers.list)
app.get('/api/suppliers/:id', auth, checkPermission('supplier', 'read'), suppliers.detail)
app.post('/api/suppliers', auth, checkPermission('supplier', 'create'), suppliers.create)