Henry_Du/BYW-VoiceHub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 迁移自定义功能至 1.5.9.9 版本

Browse Source 
包含音乐源限制、CI 防 OOM 优化、数据库连接池优化、管理端权限及 UI 细节定制等功能
This commit is contained in:
Henry_Du
2026-09-12 19:26:42 +08:00
parent 34f0679117
commit 1106aeea6c
161 changed files with 18963 additions and 27900 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/admin/users/[id].delete.ts
+19 -6
View File
@@ -10,7 +10,7 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
@@ -27,7 +27,7 @@ export default defineEventHandler(async (event) => {
if (!existingUser) {
throw createError({
statusCode: 404,
message: '用户不存在'
statusMessage: '用户不存在'
})
}
@@ -35,7 +35,7 @@ export default defineEventHandler(async (event) => {
if (existingUser.id === 1) {
throw createError({
statusCode: 403,
message: '无法删除系统初始超级管理员'
statusMessage: '无法删除系统初始超级管理员'
})
}
@@ -44,7 +44,7 @@ export default defineEventHandler(async (event) => {
if (String(existingUser.id) === String(user.id)) {
throw createError({
statusCode: 400,
message: '不能删除自己的账户'
statusMessage: '不能删除自己的账户'
})
}
@@ -53,13 +53,26 @@ export default defineEventHandler(async (event) => {
if (existingUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
throw createError({
statusCode: 403,
message: '权限不足：普通管理员无法删除超级管理员'
statusMessage: '权限不足：普通管理员无法删除超级管理员'
})
}
// 删除用户
await db.delete(users).where(eq(users.id, parseInt(userId)))
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
await cache.deletePattern('songs:*')
await cache.deletePattern('schedules:*')
await cache.deletePattern('stats:*')
// 清除该用户的认证缓存
await cache.delete(`auth:user:${existingUser.id}`)
console.log('[Cache] 歌曲、排期、统计和用户认证缓存已清除（用户删除）')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
message: '用户删除成功'
@@ -73,7 +86,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '删除用户失败：' + error.message
statusMessage: '删除用户失败: ' + error.message
})
}
})
server/api/admin/users/[id].put.ts
+72 -124
View File
@@ -3,27 +3,7 @@ import { db } from '~/drizzle/db'
import { users, userStatusLogs } from '~/drizzle/schema'
import { eq } from 'drizzle-orm'
import { updateUserPassword } from '~~/server/services/userService'
import { createSystemNotification } from '~~/server/services/notificationService'
import {
PASSWORD_AUDIT_ACTIONS,
getPasswordAuditContext
} from '~~/server/services/passwordSecurityService'
import { createApiError } from '~~/server/utils/apiError'
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
const normalizeRequiredText = (value: unknown) => String(value || '').trim()
const normalizeOptionalText = (value: unknown) => {
const normalized = String(value || '').trim()
return normalized || null
}
const roleNames: Record<string, string> = {
USER: '用户',
SONG_ADMIN: '歌曲管理员',
ADMIN: '管理员',
SUPER_ADMIN: '超级管理员'
}
import { getRoleLevel, canChangeRoleOf, canResetPasswordFor } from '~~/server/utils/permissions'
export default defineEventHandler(async (event) => {
try {
@@ -32,175 +12,145 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
const userId = getRouterParam(event, 'id')
const userIdNum = Number.parseInt(String(userId), 10)
if (!Number.isInteger(userIdNum) || userIdNum <= 0) {
const body = await readBody(event)
const { name, username, password, role, grade, class: userClass, status } = body
// 验证必填字段
if (!name || !username) {
throw createError({
statusCode: 400,
message: '无效的用户ID'
statusMessage: '姓名和用户名为必填项'
})
}
const body = await readBody(event)
const { name, username, password, role, grade, class: userClass, status } = body || {}
const normalizedName = normalizeRequiredText(name)
const normalizedUsername = normalizeRequiredText(username)
// 验证必填字段
if (!normalizedName || !normalizedUsername) {
// 验证姓名和用户名只能包含汉字
const chineseRegex = /^[\u4e00-\u9fa5]+$/
if (!chineseRegex.test(name) || !chineseRegex.test(username)) {
throw createError({
statusCode: 400,
message: '姓名和用户名为必填项'
statusMessage: '姓名和用户名只能包含汉字'
})
}
// 检查用户是否存在
const existingUser = await db.select().from(users).where(eq(users.id, userIdNum)).limit(1)
const existingUser = await db
.select()
.from(users)
.where(eq(users.id, parseInt(userId)))
.limit(1)
if (existingUser.length === 0) {
throw createError({
statusCode: 404,
message: '用户不存在'
statusMessage: '用户不存在'
})
}
const targetUser = existingUser[0]!
const targetUser = existingUser[0]
const currentLevel = getRoleLevel(user.role)
const targetLevel = getRoleLevel(targetUser.role)
// 1. 禁止修改系统初始超级管理员 (ID: 1)
if (targetUser.id === 1) {
throw createError({
statusCode: 403,
message: '无法修改系统初始超级管理员'
statusMessage: '无法修改系统初始超级管理员'
})
}
// 2. 禁止对自身进行任何用户管理操作（包括角色、资料、状态、密码等）
// 使用 String 转换确保 ID 比较的准确性
if (String(userId) === String(user.id)) {
throw createError({
statusCode: 400,
message: '禁止在用户管理中修改自己的账户'
statusMessage: '禁止在用户管理中修改自己的账户'
})
}
// 3. 越级修改保护
// 如果目标用户是 SUPER_ADMIN，操作者必须是 SUPER_ADMIN
if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
// 3. 非超级管理员必须严格高于目标角色级别
if (user.role !== 'SUPER_ADMIN' && currentLevel <= targetLevel) {
throw createError({
statusCode: 403,
message: '权限不足：普通管理员无法修改超级管理员信息'
statusMessage: `权限不足：${user.role} 无法操作同级或更高角色的用户`
})
}
// 检查用户名是否被其他用户使用
if (normalizedUsername !== targetUser.username) {
if (username !== targetUser.username) {
const duplicateUser = await db
.select()
.from(users)
.where(eq(users.username, normalizedUsername))
.where(eq(users.username, username))
.limit(1)
if (duplicateUser.length > 0) {
throw createError({
statusCode: 400,
message: '用户名已被其他用户使用'
statusMessage: '用户名已被其他用户使用'
})
}
}
// 角色权限控制
// 角色权限控制（统一使用 canChangeRoleOf 语义化检查）
let validRole = targetUser.role
if (role) {
if (!['USER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(role)) {
throw createError({
statusCode: 400,
message: '无效的用户角色'
})
}
}
if (role && role !== targetUser.role) {
// 超级管理员可以设置任何角色
if (user.role === 'SUPER_ADMIN') {
validRole = role
}
// 管理员只能设置管理员以下的角色（USER, SONG_ADMIN）
else if (user.role === 'ADMIN') {
if (['USER', 'SONG_ADMIN'].includes(role)) {
validRole = role
} else {
throw createError({
statusCode: 403,
message: '管理员只能设置用户和歌曲管理员角色'
})
}
}
// 其他角色不能设置角色
else {
if (!canChangeRoleOf(user, targetUser, role)) {
throw createError({
statusCode: 403,
message: '没有权限设置用户角色'
statusMessage: user.role === 'SUPER_ADMIN'
? '超级管理员不能将目标用户提升为 SUPER_ADMIN'
: `权限不足：${user.role} 无法将用户角色更改为 ${role}`
})
}
validRole = role
}
// 如果请求中包含密码更新，校验密码重置权限
if (password && !canResetPasswordFor(user, targetUser)) {
throw createError({
statusCode: 403,
statusMessage: `权限不足：${user.role} 无法重置目标用户的密码`
})
}
// 验证status字段的有效性
if (status && !['active', 'withdrawn', 'graduate'].includes(status)) {
throw createError({
statusCode: 400,
message: '用户状态只能是 active, withdrawn 或 graduate'
statusMessage: '用户状态只能是 active, withdrawn 或 graduate'
})
}
// 待审核用户不得通过编辑接口直接置为 active（须走注册审核流程）
if (targetUser.status === 'pending' && status === 'active') {
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '待审核用户需通过注册审核流程处理')
}
// 准备更新数据
const updateData = {
name: normalizedName,
username: normalizedUsername,
name,
username,
role: validRole,
grade: normalizeOptionalText(grade),
class: normalizeOptionalText(userClass),
...(status && status !== targetUser.status
? {
status,
statusChangedAt: new Date(),
statusChangedBy: user.id
}
: {})
grade,
class: userClass
}
// 如果提供了status，则更新状态相关字段
if (status && status !== existingUser[0].status) {
updateData.status = status
updateData.statusChangedAt = new Date()
updateData.statusChangedBy = user.id
}
// 如果提供了密码，则使用统一服务更新密码
if (password) {
const trimmedPassword = String(password).trim()
// 管理员重置为临时密码且 forceReset 强制用户登录后修改，仅做基础校验不要求完整复杂度
const violation = getAdminPasswordViolation(trimmedPassword)
if (violation) {
throw createApiError(400, violation.code, violation.message)
}
await updateUserPassword(targetUser.id, trimmedPassword, {
forceReset: true,
auditContext: {
action: PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
actorId: user.id,
...getPasswordAuditContext(event)
}
})
await updateUserPassword(parseInt(userId), password, true)
}
// 更新用户其他信息
const updatedUser = await db
.update(users)
.set(updateData)
.where(eq(users.id, userIdNum))
.where(eq(users.id, parseInt(userId)))
.returning({
id: users.id,
name: users.name,
@@ -219,35 +169,33 @@ export default defineEventHandler(async (event) => {
})
// 如果状态发生变更，记录到状态变更日志
if (status && status !== targetUser.status) {
if (status && status !== existingUser[0].status) {
await db.insert(userStatusLogs).values({
userId: targetUser.id,
oldStatus: targetUser.status,
userId: parseInt(userId),
oldStatus: existingUser[0].status,
newStatus: status,
reason: `管理员${user.name || user.username}修改用户状态`,
operatorId: user.id
})
}
if (validRole !== targetUser.role) {
const oldRoleName = roleNames[targetUser.role] || targetUser.role
const newRoleName = roleNames[validRole] || validRole
const notification = await createSystemNotification(
targetUser.id,
'权限变更通知',
`您的账户权限已由系统更新：${oldRoleName} → ${newRoleName}`
)
if (!notification) {
console.warn(`未向用户 ${targetUser.id} 发送权限变更通知`)
}
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
await cache.deletePattern('songs:*')
// 清除该用户的认证缓存（角色或权限可能已变更）
await cache.delete(`auth:user:${parseInt(userId)}`)
console.log('[Cache] 歌曲和用户认证缓存已清除（用户更新）')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
user: updatedUser[0]!,
user: updatedUser[0],
message: '用户更新成功'
}
} catch (error: any) {
} catch (error) {
console.error('更新用户失败:', error)
if (error.statusCode) {
@@ -256,7 +204,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '更新用户失败: ' + error.message
statusMessage: '更新用户失败: ' + error.message
})
}
})
server/api/admin/users/[id].ts
+122
View File
@@ -0,0 +1,122 @@
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { eq } from 'drizzle-orm'
export default defineEventHandler(async (event) => {
// 检查认证和权限
const user = event.context.user
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
})
}
// 安全获取ID参数
const params = event.context.params || {}
const id = parseInt(params.id || '')
if (isNaN(id)) {
throw createError({
statusCode: 400,
message: '无效的用户ID'
})
}
// 处理PUT请求 - 更新用户
if (event.method === 'PUT') {
const body = await readBody(event)
if (!body.name) {
throw createError({
statusCode: 400,
message: '姓名不能为空'
})
}
try {
const updatedUserResult = await db
.update(users)
.set({
name: body.name,
role: body.role,
grade: body.grade,
class: body.class
})
.where(eq(users.id, id))
.returning({
id: users.id,
name: users.name,
role: users.role,
createdAt: users.createdAt,
updatedAt: users.updatedAt,
grade: users.grade,
class: users.class,
username: users.username,
passwordChangedAt: users.passwordChangedAt
})
const updatedUser = updatedUserResult[0]
return updatedUser
} catch (error) {
console.error('更新用户失败:', error)
throw createError({
statusCode: 500,
message: '更新用户失败'
})
}
}
// 处理DELETE请求 - 删除用户
if (event.method === 'DELETE') {
try {
const existingUserResult = await db.select().from(users).where(eq(users.id, id)).limit(1)
if (existingUserResult.length === 0) {
throw createError({
statusCode: 404,
message: '用户不存在'
})
}
const existingUser = existingUserResult[0]
// 1. 禁止删除 ID 为 1 的用户 (系统初始超级管理员)
if (existingUser.id === 1) {
throw createError({
statusCode: 403,
message: '无法删除系统初始超级管理员'
})
}
// 2. 确保不能删除自己
if (String(existingUser.id) === String(user.id)) {
throw createError({
statusCode: 400,
message: '不能删除当前登录的用户'
})
}
// 3. 越级删除保护
if (existingUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
throw createError({
statusCode: 403,
message: '权限不足：普通管理员无法删除超级管理员'
})
}
await db.delete(users).where(eq(users.id, id))
return { success: true }
} catch (error) {
console.error('删除用户失败:', error)
throw createError({
statusCode: 500,
message: '删除用户失败'
})
}
}
throw createError({
statusCode: 405,
message: '不支持的请求方法'
})
})
server/api/admin/users/[id]/reset-password.post.ts
+46 -58
View File
@@ -1,26 +1,18 @@
import { eq } from 'drizzle-orm'
import { updateUserPassword } from '~~/server/services/userService'
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { updateUserPassword } from '~~/server/services/userService'
import {
PASSWORD_AUDIT_ACTIONS,
getPasswordAuditContext,
recordPasswordAudit
} from '~~/server/services/passwordSecurityService'
import { createApiError } from '~~/server/utils/apiError'
import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
import { eq } from 'drizzle-orm'
import { canResetPasswordFor, getRoleLevel } from '~~/server/utils/permissions'
export default defineEventHandler(async (event) => {
// 检查认证和权限
const user = event.context.user
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
const currentUser = event.context.user
if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
})
}
// 安全获取ID参数
const params = event.context.params || {}
const id = parseInt(params.id || '')
@@ -31,39 +23,38 @@ export default defineEventHandler(async (event) => {
})
}
const body = await readBody<Record<string, unknown> | null>(event)
const newPassword = typeof body?.newPassword === 'string' ? body.newPassword.trim() : ''
const body = await readBody(event)
// 管理员重置为临时密码且 forceReset 强制用户登录后修改，仅做基础校验不要求完整复杂度
const violation = getAdminPasswordViolation(newPassword)
if (violation) {
throw createApiError(400, violation.code, violation.message)
if (!body.newPassword) {
throw createError({
statusCode: 400,
message: '新密码不能为空'
})
}
try {
// 查询目标用户用于越级保护
const targetUsers = await db
.select({ id: users.id, role: users.role })
.from(users)
.where(eq(users.id, id))
.limit(1)
const targetUser = targetUsers[0]
if (!targetUser) {
throw createError({
statusCode: 404,
message: '用户不存在'
})
}
// 禁止对自身进行密码重置（通过用户管理界面）
if (id === user.id) {
if (id === currentUser.id) {
throw createError({
statusCode: 400,
message: '禁止在用户管理中重置自己的密码'
})
}
// 禁止重置系统初始超级管理员 (ID: 1)
const targetUserResult = await db
.select({ id: users.id, role: users.role, username: users.username })
.from(users)
.where(eq(users.id, id))
.limit(1)
if (targetUserResult.length === 0) {
throw createError({
statusCode: 404,
message: '用户不存在'
})
}
const targetUser = targetUserResult[0]
if (targetUser.id === 1) {
throw createError({
statusCode: 403,
@@ -71,39 +62,36 @@ export default defineEventHandler(async (event) => {
})
}
// 越级保护：目标用户是 SUPER_ADMIN 时，操作者必须是 SUPER_ADMIN
if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
const currentLevel = getRoleLevel(currentUser.role)
const targetLevel = getRoleLevel(targetUser.role)
if (currentUser.role !== 'SUPER_ADMIN') {
if (currentLevel <= targetLevel) {
throw createError({
statusCode: 403,
message: '权限不足：不能重置角色级别大于等于自己的用户密码'
})
}
}
if (!canResetPasswordFor(currentUser, targetUser)) {
throw createError({
statusCode: 403,
message: '权限不足：普通管理员无法重置超级管理员密码'
message: '权限不足：当前角色无法重置该用户的密码'
})
}
// 使用统一服务重置密码 (forceReset = true)
await updateUserPassword(id, newPassword, {
forceReset: true,
auditContext: {
action: PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
actorId: user.id,
...getPasswordAuditContext(event)
}
})
await updateUserPassword(id, body.newPassword, true)
return {
success: true,
message: '密码重置成功'
}
} catch (error) {
await recordPasswordAudit(
event,
id,
PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
false,
error instanceof Error ? error.message : '管理员重置密码失败',
user.id
)
console.error('重置密码失败:', error)
if (error && typeof error === 'object' && 'statusCode' in error) throw error
console.error('[ResetPassword] 失败:', error)
if (error.statusCode) {
throw error
}
throw createError({
statusCode: 500,
message: '重置密码失败'
server/api/admin/users/[id]/songs.get.ts
+6 -7
View File
@@ -9,7 +9,7 @@ export default defineEventHandler(async (event) => {
if (!currentUser) {
throw createError({
statusCode: 401,
message: '未授权访问'
statusMessage: '未授权访问'
})
}
@@ -18,16 +18,16 @@ export default defineEventHandler(async (event) => {
if (!allowedRoles.includes(currentUser.role)) {
throw createError({
statusCode: 403,
message: '权限不足'
statusMessage: '权限不足'
})
}
// 获取用户 ID
// 获取用户ID
const userId = parseInt(getRouterParam(event, 'id') as string)
if (!userId || isNaN(userId)) {
throw createError({
statusCode: 400,
message: '无效的用户 ID'
statusMessage: '无效的用户ID'
})
}
@@ -49,7 +49,7 @@ export default defineEventHandler(async (event) => {
if (!user) {
throw createError({
statusCode: 404,
message: '用户不存在'
statusMessage: '用户不存在'
})
}
@@ -60,7 +60,6 @@ export default defineEventHandler(async (event) => {
title: songs.title,
artist: songs.artist,
semester: songs.semester,
durationSeconds: songs.durationSeconds,
createdAt: songs.createdAt,
played: songs.played
})
@@ -267,7 +266,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '服务器内部错误'
statusMessage: '服务器内部错误'
})
}
})
server/api/admin/users/[id]/status-logs.get.ts
+5 -5
View File
@@ -11,7 +11,7 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
@@ -19,12 +19,12 @@ export default defineEventHandler(async (event) => {
const query = getQuery(event)
const { page = '1', limit = '20' } = query
// 验证用户 ID
// 验证用户ID
const numUserId = parseInt(userId)
if (isNaN(numUserId) || numUserId <= 0) {
throw createError({
statusCode: 400,
message: '无效的用户 ID'
statusMessage: '无效的用户ID'
})
}
@@ -42,7 +42,7 @@ export default defineEventHandler(async (event) => {
if (existingUser.length === 0) {
throw createError({
statusCode: 404,
message: '用户不存在'
statusMessage: '用户不存在'
})
}
@@ -117,7 +117,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '获取用户状态变更日志失败：' + error.message
statusMessage: '获取用户状态变更日志失败: ' + error.message
})
}
})
server/api/admin/users/[id]/status.put.ts
+16 -14
View File
@@ -4,8 +4,6 @@ import { users, userStatusLogs } from '~/drizzle/schema'
import { eq } from 'drizzle-orm'
import { getBeijingTime } from '~/utils/timeUtils'
import { getStatusText } from '~~/server/utils/user'
import { createApiError } from '~~/server/utils/apiError'
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
export default defineEventHandler(async (event) => {
try {
@@ -14,7 +12,7 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
@@ -26,14 +24,14 @@ export default defineEventHandler(async (event) => {
if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
throw createError({
statusCode: 400,
message: '状态必须为 active, withdrawn 或 graduate'
statusMessage: '状态必须为 active, withdrawn 或 graduate'
})
}
if (!reason || reason.trim().length === 0) {
throw createError({
statusCode: 400,
message: '变更原因为必填项'
statusMessage: '变更原因为必填项'
})
}
@@ -53,22 +51,17 @@ export default defineEventHandler(async (event) => {
if (existingUser.length === 0) {
throw createError({
statusCode: 404,
message: '用户不存在'
statusMessage: '用户不存在'
})
}
const targetUser = existingUser[0]
// 待审核用户不得通过状态接口直接置为 active（须走注册审核流程）
if (targetUser.status === 'pending' && status === 'active') {
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '待审核用户需通过注册审核流程处理')
}
// 检查是否为学生用户
if (targetUser.role !== 'USER') {
throw createError({
statusCode: 400,
message: '只能修改学生用户的状态'
statusMessage: '只能修改学生用户的状态'
})
}
@@ -76,7 +69,7 @@ export default defineEventHandler(async (event) => {
if (targetUser.status === status) {
throw createError({
statusCode: 400,
message: '用户状态未发生变化'
statusMessage: '用户状态未发生变化'
})
}
@@ -106,6 +99,15 @@ export default defineEventHandler(async (event) => {
})
})
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
await cache.delete(`auth:user:${parseInt(userId)}`)
console.log('[Cache] 用户认证缓存已清除（状态更新）')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
message: `用户状态已更新为${getStatusText(status)}`,
@@ -126,7 +128,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '更新用户状态失败: ' + error.message
statusMessage: '更新用户状态失败: ' + error.message
})
}
})
server/api/admin/users/batch-grade-update.post.ts
+29 -55
View File
@@ -1,4 +1,5 @@
import { db } from '~/drizzle/db'
import { CacheService } from '~~/server/services/cacheService'
import { users } from '~/drizzle/schema'
import { inArray } from 'drizzle-orm'
@@ -8,7 +9,7 @@ export default defineEventHandler(async (event) => {
if (event.node.req.method !== 'POST') {
throw createError({
statusCode: 405,
message: 'Method Not Allowed'
statusMessage: 'Method Not Allowed'
})
}
@@ -20,33 +21,21 @@ export default defineEventHandler(async (event) => {
if (!userIds || !Array.isArray(userIds) || userIds.length === 0) {
throw createError({
statusCode: 400,
message: 'userIds is required and must be a non-empty array'
})
}
// 对输入的 userIds 进行去重和类型转换
const uniqueUserIds = [
...new Set(userIds.map((id) => parseInt(id)).filter((id) => !isNaN(id) && id > 0))
]
if (uniqueUserIds.length === 0) {
throw createError({
statusCode: 400,
message: '没有有效的用户ID'
statusMessage: 'userIds is required and must be a non-empty array'
})
}
if (!targetGrade || typeof targetGrade !== 'string') {
throw createError({
statusCode: 400,
message: 'targetGrade is required and must be a string'
statusMessage: 'targetGrade is required and must be a string'
})
}
if (typeof keepClass !== 'boolean') {
throw createError({
statusCode: 400,
message: 'keepClass is required and must be a boolean'
statusMessage: 'keepClass is required and must be a boolean'
})
}
@@ -56,7 +45,7 @@ export default defineEventHandler(async (event) => {
if (!currentUser) {
throw createError({
statusCode: 401,
message: 'Authentication required'
statusMessage: 'Authentication required'
})
}
@@ -64,7 +53,7 @@ export default defineEventHandler(async (event) => {
if (!['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
throw createError({
statusCode: 403,
message: 'Insufficient permissions'
statusMessage: 'Insufficient permissions'
})
}
@@ -75,50 +64,26 @@ export default defineEventHandler(async (event) => {
name: users.name,
username: users.username,
grade: users.grade,
class: users.class,
role: users.role
class: users.class
})
.from(users)
.where(inArray(users.id, uniqueUserIds))
.where(inArray(users.id, userIds))
const existingUserIds = existingUsers.map((user) => user.id)
const nonExistentUserIds = uniqueUserIds.filter((id) => !existingUserIds.includes(id))
const nonExistentUserIds = userIds.filter((id) => !existingUserIds.includes(id))
let updated = 0
let failed = 0
const errors: Array<{ userId: number | string; error: string }> = []
const errors: string[] = []
// 记录不存在的用户ID
if (nonExistentUserIds.length > 0) {
failed += nonExistentUserIds.length
nonExistentUserIds.forEach((id) => {
errors.push({ userId: id, error: '用户不存在' })
})
}
// 过滤出有权限修改的用户
const validExistingUserIds: number[] = []
for (const user of existingUsers) {
if (user.id === 1) {
failed++
errors.push({ userId: user.id, error: '无法修改系统初始超级管理员' })
continue
}
if (user.id === currentUser.id) {
failed++
errors.push({ userId: user.id, error: '禁止在用户管理中批量更新自己的账户' })
continue
}
if (user.role === 'SUPER_ADMIN' && currentUser.role !== 'SUPER_ADMIN') {
failed++
errors.push({ userId: user.id, error: '权限不足：普通管理员无法修改超级管理员信息' })
continue
}
validExistingUserIds.push(user.id)
errors.push(`用户ID ${nonExistentUserIds.join(', ')} 不存在`)
}
// 批量更新存在的用户
if (validExistingUserIds.length > 0) {
if (existingUserIds.length > 0) {
try {
const updateData: any = {
grade: targetGrade,
@@ -131,16 +96,25 @@ export default defineEventHandler(async (event) => {
const updateResult = await db
.update(users)
.set(updateData)
.where(inArray(users.id, validExistingUserIds))
.where(inArray(users.id, existingUserIds))
.returning({ id: users.id })
updated = updateResult.length
} catch (error) {
console.error('批量更新失败:', error)
failed += validExistingUserIds.length
validExistingUserIds.forEach((id) => {
errors.push({ userId: id, error: '批量更新操作失败' })
})
failed += existingUserIds.length
errors.push('批量更新操作失败')
}
}
// 如果有用户更新成功，清除相关缓存
if (updated > 0) {
try {
const cacheService = CacheService.getInstance()
await cacheService.clearSongsCache()
console.log('批量年级更新后缓存清除成功')
} catch (cacheError) {
console.error('批量年级更新后缓存清除失败:', cacheError)
}
}
@@ -159,7 +133,7 @@ export default defineEventHandler(async (event) => {
failed,
errors,
details: {
totalRequested: uniqueUserIds.length,
totalRequested: userIds.length,
existingUsers: existingUsers.length,
nonExistentUsers: nonExistentUserIds.length,
targetGrade,
@@ -175,7 +149,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: 'Internal Server Error'
statusMessage: 'Internal Server Error'
})
}
})
server/api/admin/users/batch-status.put.ts
+36 -100
View File
@@ -4,8 +4,6 @@ import { users, userStatusLogs } from '~/drizzle/schema'
import { and, eq, inArray } from 'drizzle-orm'
import { getBeijingTime } from '~/utils/timeUtils'
import { getStatusText } from '~~/server/utils/user'
import { createApiError } from '~~/server/utils/apiError'
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
export default defineEventHandler(async (event) => {
try {
@@ -14,76 +12,51 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
const body = await readBody(event)
const { userIds, status, reason, sourceStatus } = body
const sourceStatusFilter = typeof sourceStatus === 'string' ? sourceStatus.trim() : ''
const { userIds, status, reason } = body
// 验证必填字段
if (!Array.isArray(userIds) || userIds.length === 0) {
throw createError({
statusCode: 400,
message: '用户ID列表不能为空'
statusMessage: '用户ID列表不能为空'
})
}
if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
throw createError({
statusCode: 400,
message: '状态必须为 active, withdrawn 或 graduate'
statusMessage: '状态必须为 active, withdrawn 或 graduate'
})
}
// 源状态白名单含 pending（支持按待审核筛选批量处理；同时使下方 pending→active 拦截可达）
if (sourceStatusFilter && !['active', 'pending', 'withdrawn', 'graduate'].includes(sourceStatusFilter)) {
throw createError({
statusCode: 400,
message: '前置状态必须为 active, pending, withdrawn 或 graduate'
})
}
if (sourceStatusFilter === status) {
throw createError({
statusCode: 400,
message: '前置状态不能与目标状态相同'
})
}
// 待审核用户不得通过批量状态接口直接置为 active（须走注册审核流程）
if (sourceStatusFilter === 'pending' && status === 'active') {
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '待审核用户需通过注册审核流程处理')
}
if (!reason || reason.trim().length === 0) {
throw createError({
statusCode: 400,
message: '变更原因为必填项'
statusMessage: '变更原因为必填项'
})
}
// 验证用户ID格式
const validUserIds = [
...new Set(
userIds
.filter((id) => {
const numId = parseInt(id)
return !isNaN(numId) && numId > 0
})
.map((id) => parseInt(id))
)
]
const validUserIds = userIds
.filter((id) => {
const numId = parseInt(id)
return !isNaN(numId) && numId > 0
})
.map((id) => parseInt(id))
if (validUserIds.length === 0) {
throw createError({
statusCode: 400,
message: '没有有效的用户ID'
statusMessage: '没有有效的用户ID'
})
}
// 检查用户是否存在
// 检查用户是否存在且为学生角色
const existingUsers = await db
.select({
id: users.id,
@@ -93,69 +66,23 @@ export default defineEventHandler(async (event) => {
role: users.role
})
.from(users)
.where(inArray(users.id, validUserIds))
.where(and(inArray(users.id, validUserIds), eq(users.role, 'USER')))
const existingUserIds = existingUsers.map((u) => u.id)
const nonExistentUserIds = validUserIds.filter((id) => !existingUserIds.includes(id))
// 筛选出状态需要变更的用户，并加入越权保护，同时记录失败原因
const usersToUpdate = []
const errors: Array<{ userId: number | string; error: string }> = []
if (nonExistentUserIds.length > 0) {
nonExistentUserIds.forEach((id) => {
errors.push({ userId: id, error: '用户不存在' })
if (existingUsers.length === 0) {
throw createError({
statusCode: 404,
statusMessage: '没有找到可更新的学生用户'
})
}
for (const u of existingUsers) {
if (u.id === 1) {
errors.push({ userId: u.id, error: '无法修改系统初始超级管理员' })
continue
}
if (u.id === user.id) {
errors.push({ userId: u.id, error: '禁止在用户管理中批量更新自己的账户' })
continue
}
if (u.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
errors.push({ userId: u.id, error: '权限不足：普通管理员无法修改超级管理员信息' })
continue
}
if (u.role !== 'USER' && user.role !== 'SUPER_ADMIN') {
errors.push({ userId: u.id, error: '权限不足：普通管理员无法批量修改其他管理员状态' })
continue
}
if (sourceStatusFilter && u.status !== sourceStatusFilter) {
errors.push({
userId: u.id,
error: `前置状态不匹配：当前为${getStatusText(u.status)}，仅更新${getStatusText(sourceStatusFilter)}`
})
continue
}
// 待审核用户不得通过批量状态接口直接置为 active（须走注册审核流程；即使未传 sourceStatus 也按实际状态拦截）
if (status === 'active' && u.status === 'pending') {
errors.push({ userId: u.id, error: '待审核用户需通过注册审核流程处理' })
continue
}
if (u.status === status) {
errors.push({ userId: u.id, error: '用户状态无需变更' })
continue
}
usersToUpdate.push(u)
}
// 筛选出状态需要变更的用户
const usersToUpdate = existingUsers.filter((u) => u.status !== status)
if (usersToUpdate.length === 0) {
return {
success: false,
message: '没有可更新的合法用户',
errors,
data: {
totalRequested: validUserIds.length,
totalUpdated: 0,
updatedUsers: [],
sourceStatus: sourceStatusFilter || null
}
}
throw createError({
statusCode: 400,
statusMessage: '所选用户的状态均无需变更'
})
}
const currentTime = getBeijingTime()
@@ -194,15 +121,24 @@ export default defineEventHandler(async (event) => {
}
})
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
for (const userId of usersToUpdate.map((u) => u.id)) {
await cache.delete(`auth:user:${userId}`)
}
console.log('[Cache] 批量用户认证缓存已清除（状态更新）')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
message: `成功更新 ${results.length} 个用户的状态为${getStatusText(status)}`,
errors,
data: {
totalRequested: validUserIds.length,
totalUpdated: results.length,
updatedUsers: results,
sourceStatus: sourceStatusFilter || null,
changedAt: currentTime,
changedBy: user.name
}
@@ -216,7 +152,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '批量更新用户状态失败: ' + error.message
statusMessage: '批量更新用户状态失败: ' + error.message
})
}
})
server/api/admin/users/batch-update.post.ts
+22 -31
View File
@@ -1,5 +1,6 @@
import { z } from 'zod'
import { db } from '~/drizzle/db'
import { CacheService } from '~~/server/services/cacheService'
import { users, userStatusLogs } from '~/drizzle/schema'
import { and, eq, inArray, ne } from 'drizzle-orm'
@@ -27,7 +28,7 @@ export default defineEventHandler(async (event) => {
if (!currentUser) {
throw createError({
statusCode: 401,
message: 'Authentication required'
statusMessage: 'Authentication required'
})
}
@@ -35,7 +36,7 @@ export default defineEventHandler(async (event) => {
if (!['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
throw createError({
statusCode: 403,
message: 'Insufficient permissions'
statusMessage: 'Insufficient permissions'
})
}
@@ -46,7 +47,8 @@ export default defineEventHandler(async (event) => {
if (!validationResult.success) {
throw createError({
statusCode: 400,
message: '请求参数无效: ' + validationResult.error.issues.map((e) => e.message).join(', ')
statusMessage:
'请求参数无效: ' + validationResult.error.errors.map((e) => e.message).join(', ')
})
}
@@ -55,7 +57,7 @@ export default defineEventHandler(async (event) => {
// 获取所有要更新的用户ID
const userIds = updates.map((update) => update.userId)
// 验证用户是否存在
// 验证用户是否存在且为学生角色
const existingUsers = await db
.select({
id: users.id,
@@ -65,38 +67,25 @@ export default defineEventHandler(async (event) => {
status: users.status
})
.from(users)
.where(inArray(users.id, userIds))
.where(and(inArray(users.id, userIds), eq(users.role, 'USER')))
// 检查是否所有用户都存在
// 检查是否所有用户都存在且为学生
const existingUserIds = new Set(existingUsers.map((user) => user.id))
const missingUserIds = userIds.filter((id) => !existingUserIds.has(id))
if (missingUserIds.length > 0) {
throw createError({
statusCode: 400,
message: `以下用户ID不存在: ${missingUserIds.join(', ')}`
statusMessage: `以下用户ID不存在或不是学生: ${missingUserIds.join(', ')}`
})
}
// 执行批量更新
const updateResults = []
const errors = []
const userMap = new Map(existingUsers.map((u) => [u.id, u]))
for (const update of updates) {
try {
const targetUser = userMap.get(update.userId)
if (!targetUser) continue
// 保护系统初始超级管理员
if (targetUser.id === 1) {
errors.push({
userId: update.userId,
error: '无法修改系统初始超级管理员'
})
continue
}
// 禁止批量更新包含当前操作者自身
if (update.userId === currentUser.id) {
errors.push({
@@ -105,15 +94,6 @@ export default defineEventHandler(async (event) => {
})
continue
}
// 越级修改保护
if (targetUser.role === 'SUPER_ADMIN' && currentUser.role !== 'SUPER_ADMIN') {
errors.push({
userId: update.userId,
error: '权限不足：普通管理员无法修改超级管理员信息'
})
continue
}
// 构建更新数据
const updateData: any = {}
@@ -162,7 +142,7 @@ export default defineEventHandler(async (event) => {
}
let updatedUser
// 使用事务确保更新和日志记录的原子性
await db.transaction(async (tx) => {
// 更新用户信息
@@ -225,6 +205,17 @@ export default defineEventHandler(async (event) => {
response.message = `批量更新部分完成，成功更新 ${updateResults.length} 个用户，${errors.length} 个用户更新失败`
}
// 如果有用户更新成功，清除相关缓存
if (updateResults.length > 0) {
try {
const cacheService = CacheService.getInstance()
await cacheService.clearSongsCache()
console.log('批量用户更新后缓存清除成功')
} catch (cacheError) {
console.error('批量用户更新后缓存清除失败:', cacheError)
}
}
return response
} catch (error) {
console.error('批量更新用户失败:', error)
@@ -237,7 +228,7 @@ export default defineEventHandler(async (event) => {
// 未知错误
throw createError({
statusCode: 500,
message: '批量更新用户失败: ' + error.message
statusMessage: '批量更新用户失败: ' + error.message
})
}
})
server/api/admin/users/batch.post.ts
+65 -155
View File
@@ -1,28 +1,8 @@
import bcrypt from 'bcryptjs'
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { eq, inArray } from 'drizzle-orm'
import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
interface UserData {
name: string
username: string
password: string
role?: string
status?: 'active' | 'withdrawn' | 'graduate'
grade?: string | null
class?: string | null
}
interface ValidUserData extends UserData {
index: number
}
const normalizeRequiredText = (value: unknown) => String(value || '').trim()
const normalizeOptionalText = (value: unknown) => {
const normalized = String(value || '').trim()
return normalized || null
}
import { eq } from 'drizzle-orm'
import { cacheService } from '../../../services/cacheService'
export default defineEventHandler(async (event) => {
// 检查认证和权限
@@ -46,129 +26,56 @@ export default defineEventHandler(async (event) => {
const results = {
created: 0,
failed: 0,
total: body.users.length,
errors: [] as Array<{ index: number; username?: string; name?: string; reason: string }>
total: body.users.length
}
// 1. 预处理数据：过滤必填字段，提取要查询的用户名
const validUsers: ValidUserData[] = []
const usernamesToQuery: string[] = []
const usernamesInBatch = new Set<string>()
// 批量添加用户
for (let i = 0; i < body.users.length; i++) {
const userData = body.users[i]
const normalizedUserData = {
...userData,
name: normalizeRequiredText(userData.name),
username: normalizeRequiredText(userData.username),
grade: normalizeOptionalText(userData.grade),
class: normalizeOptionalText(userData.class)
}
if (
!normalizedUserData.name ||
!normalizedUserData.username ||
typeof userData.password !== 'string' ||
!userData.password
) {
results.failed++
results.errors.push({
index: i,
username: userData.username,
name: userData.name,
reason: '缺少必填字段（姓名、账号或密码）'
})
continue
}
try {
// 验证必填字段
if (!userData.name || !userData.username || !userData.password) {
results.failed++
continue
}
const passwordViolation = getAdminPasswordViolation(userData.password)
if (passwordViolation) {
results.failed++
results.errors.push({
index: i,
username: normalizedUserData.username,
name: normalizedUserData.name,
reason: passwordViolation.message
})
continue
}
const chineseRegex = /^[\u4e00-\u9fa5]+$/
if (!chineseRegex.test(userData.name) || !chineseRegex.test(userData.username)) {
results.failed++
continue
}
if (usernamesInBatch.has(normalizedUserData.username)) {
results.failed++
results.errors.push({
index: i,
username: normalizedUserData.username,
name: normalizedUserData.name,
reason: '批处理中存在重复的账号'
})
continue
}
// 检查用户名是否已存在
const existingUser = await db
.select()
.from(users)
.where(eq(users.username, userData.username))
.limit(1)
usernamesInBatch.add(normalizedUserData.username)
// 限制单次查询 inArray 的长度，如果需要的话。前端分批已经是 50，所以没问题
validUsers.push({ index: i, ...normalizedUserData })
usernamesToQuery.push(normalizedUserData.username)
}
if (existingUser.length > 0) {
results.failed++
continue
}
if (validUsers.length === 0) {
return results
}
// 加密密码
const hashedPassword = await bcrypt.hash(userData.password, 10)
// 2. 批量查询已存在的用户名，减少数据库交互
let existingUsernames = new Set<string>()
try {
const existingUsersList = await db
.select({ username: users.username })
.from(users)
.where(inArray(users.username, usernamesToQuery))
existingUsernames = new Set(existingUsersList.map((u) => u.username))
} catch (error: any) {
console.error('批量查询用户失败:', error)
throw createError({
statusCode: 500,
message: '数据库查询错误'
})
}
// 3. 过滤掉已存在的用户
const usersToInsertData: ValidUserData[] = []
for (const userData of validUsers) {
if (existingUsernames.has(userData.username)) {
results.failed++
results.errors.push({
index: userData.index,
username: userData.username,
name: userData.name,
reason: '账号已存在'
})
continue
}
usersToInsertData.push(userData)
}
if (usersToInsertData.length === 0) {
return results
}
try {
// 4. 并发加密密码 (由于使用 bcrypt.hash 异步方法，使用 Promise.all 并发处理可以显著提速)
const hashedPasswords = await Promise.all(
usersToInsertData.map((userData) => bcrypt.hash(userData.password, 10))
)
// 5. 准备批量插入的数据
const insertValues = usersToInsertData.map((userData, idx) => {
// 角色权限控制
let validRole = 'USER' // 默认角色
if (userData.role) {
const rolePermissions: Record<string, string[]> = {
SUPER_ADMIN: ['USER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'],
ADMIN: ['USER', 'SONG_ADMIN']
}
const allowedRoles = rolePermissions[user.role]
if (allowedRoles?.includes(userData.role)) {
validRole = userData.role
if (user.role === 'SUPER_ADMIN') {
// 超级管理员可以设置任何角色
const allowedRoles = ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN']
if (allowedRoles.includes(userData.role)) {
validRole = userData.role
}
} else if (user.role === 'ADMIN') {
// 普通管理员只能设置 USER 和 SONG_ADMIN 角色
const allowedRoles = ['USER', 'TEACHER', 'SONG_ADMIN']
if (allowedRoles.includes(userData.role)) {
validRole = userData.role
}
}
}
@@ -178,31 +85,34 @@ export default defineEventHandler(async (event) => {
validStatus = userData.status
}
return {
name: userData.name,
username: userData.username,
password: hashedPasswords[idx]!,
role: validRole,
status: validStatus as 'active' | 'withdrawn' | 'graduate',
grade: userData.grade,
class: userData.class
}
})
// 创建用户
const newUser = await db
.insert(users)
.values({
name: userData.name,
username: userData.username,
password: hashedPassword,
role: validRole,
status: validStatus as 'active' | 'withdrawn' | 'graduate',
grade: userData.grade,
class: userData.class
})
.returning()
// 6. 执行批量插入
await db.insert(users).values(insertValues)
results.created += insertValues.length
} catch (error: any) {
console.error(`批量插入用户失败:`, error)
// 如果批量插入整体失败，则全部标记为失败
for (const userData of usersToInsertData) {
results.created++
} catch (error) {
console.error(`用户创建失败:`, error)
results.failed++
results.errors.push({
index: userData.index,
username: userData.username,
name: userData.name,
reason: error.message || '数据库批量写入失败'
})
}
}
// 如果有用户创建成功，清除相关缓存
if (results.created > 0) {
try {
await cacheService.clearSongsCache()
console.log('批量用户创建后缓存清除成功')
} catch (cacheError) {
console.error('批量用户创建后缓存清除失败:', cacheError)
}
}
server/api/admin/users/index.get.ts
+28 -60
View File
@@ -1,48 +1,25 @@
import { createError, defineEventHandler, getQuery } from 'h3'
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { and, asc, desc, count, eq, ilike, inArray, isNull, notInArray, or, sql } from 'drizzle-orm'
import { resolveAvatarSource } from '~~/server/utils/user-avatar'
import { ARCHIVED_USER_STATUSES, resolveArchivedFilter } from '~~/server/utils/user-archive'
const UNSET_FILTER_VALUE = '__UNSET__'
import { and, asc, desc, count, eq, ilike, or, sql } from 'drizzle-orm'
export default defineEventHandler(async (event) => {
try {
// 检查用户是否为管理员
const user = event.context.user
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '只有系统管理员可以访问用户列表'
})
}
// 获取查询参数
const query = getQuery(event)
const { grade, class: className, search, page = '1', limit = '50', role, status, sortBy = 'id', sortOrder = 'asc', archived } = query
const { grade, class: className, search, page = '1', limit = '50', role, status, sortBy = 'id', sortOrder = 'asc' } = query
// 构建筛选条件
const whereConditions = []
// 年级筛选
if (grade && typeof grade === 'string' && grade.trim()) {
const gradeFilter = grade.trim()
whereConditions.push(
gradeFilter === UNSET_FILTER_VALUE
? or(isNull(users.grade), eq(users.grade, ''))
: eq(users.grade, gradeFilter)
)
whereConditions.push(eq(users.grade, grade.trim()))
}
// 班级筛选
if (className && typeof className === 'string' && className.trim()) {
const classFilter = className.trim()
whereConditions.push(
classFilter === UNSET_FILTER_VALUE
? or(isNull(users.class), eq(users.class, ''))
: eq(users.class, classFilter)
)
whereConditions.push(eq(users.class, className.trim()))
}
// 角色筛选
@@ -52,18 +29,7 @@ export default defineEventHandler(async (event) => {
// 状态筛选
if (status && typeof status === 'string' && status.trim()) {
const statusFilter = status.trim()
if (['active', 'pending', 'withdrawn', 'graduate'].includes(statusFilter)) {
whereConditions.push(eq(users.status, statusFilter as 'active' | 'pending' | 'withdrawn' | 'graduate'))
}
}
// 归档筛选：archived=1 仅查已归档（graduate/withdrawn）；archived=0 排除已归档；缺省不限制
const archivedFilter = resolveArchivedFilter(archived)
if (archivedFilter === 'archived') {
whereConditions.push(inArray(users.status, [...ARCHIVED_USER_STATUSES]))
} else if (archivedFilter === 'unarchived') {
whereConditions.push(notInArray(users.status, [...ARCHIVED_USER_STATUSES]))
whereConditions.push(eq(users.status, status.trim()))
}
// 搜索功能（姓名、用户名或IP地址）
@@ -82,12 +48,12 @@ export default defineEventHandler(async (event) => {
// 分页参数
const pageNum = Math.max(1, parseInt(page as string) || 1)
const limitNum = Math.min(Math.max(1, parseInt(limit as string) || 50), 1000)
const limitNum = Math.max(1, parseInt(limit as string) || 50)
const skip = (pageNum - 1) * limitNum
// 获取总数
const totalResult = await db.select({ count: count() }).from(users).where(whereClause)
const total = totalResult[0]?.count || 0
const total = totalResult[0].count
// 排序逻辑
let orderByClause
@@ -129,33 +95,35 @@ export default defineEventHandler(async (event) => {
forcePasswordChange: true,
meowNickname: true,
meowBoundAt: true,
email: true,
emailVerified: true,
remark: true,
createdAt: true,
updatedAt: true,
avatarProvider: true,
avatarProviderUserId: true
avatarProviderUserId: true,
email: true
},
with: {
identities: {
columns: {
provider: true,
providerUsername: true,
providerUserId: true,
avatar: true,
createdAt: true
}
}
identities: true
}
})
// 处理用户列表，添加头像字段
const { getUserAvatarUrl } = await import('~~/server/utils/user-avatar')
const formattedUsers = usersList.map((user) => {
const avatarSource = resolveAvatarSource(user, user.identities || [])
const avatarUrl = getUserAvatarUrl(
{
id: user.id,
name: user.name,
username: user.username,
email: user.email,
avatarProvider: user.avatarProvider,
avatarProviderUserId: user.avatarProviderUserId
},
user.identities || []
)
return {
...user,
avatar: avatarSource?.url ?? null
avatar: avatarUrl,
avatarUrl
}
})
@@ -183,11 +151,11 @@ export default defineEventHandler(async (event) => {
search: search || null
}
}
} catch (error: any) {
} catch (error) {
console.error('获取用户列表失败:', error)
throw createError({
statusCode: 500,
message: '获取用户列表失败: ' + error.message
statusMessage: '获取用户列表失败: ' + error.message
})
}
})
server/api/admin/users/index.post.ts
+38 -47
View File
@@ -2,14 +2,7 @@ import bcrypt from 'bcryptjs'
import { db } from '~/drizzle/db'
import { users } from '~/drizzle/schema'
import { eq } from 'drizzle-orm'
import { createApiError } from '~~/server/utils/apiError'
import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
const normalizeRequiredText = (value: unknown) => String(value || '').trim()
const normalizeOptionalText = (value: unknown) => {
const normalized = String(value || '').trim()
return normalized || null
}
import { getRoleLevel, isRoleHigher, canManageUserRole } from '~~/server/utils/permissions'
export default defineEventHandler(async (event) => {
// 检查认证和权限
@@ -22,21 +15,22 @@ export default defineEventHandler(async (event) => {
}
const body = await readBody(event)
const normalizedName = normalizeRequiredText(body.name)
const normalizedUsername = normalizeRequiredText(body.username)
const initialPassword = typeof body.password === 'string' ? body.password : ''
// 验证必填字段
if (!normalizedName || !normalizedUsername || !initialPassword) {
if (!body.name || !body.username || !body.password) {
throw createError({
statusCode: 400,
message: '姓名、用户名和密码不能为空'
message: '姓名、账号名和密码不能为空'
})
}
const violation = getAdminPasswordViolation(initialPassword)
if (violation) {
throw createApiError(400, violation.code, violation.message)
// 验证姓名和用户名只能包含汉字
const chineseRegex = /^[\u4e00-\u9fa5]+$/
if (!chineseRegex.test(body.name) || !chineseRegex.test(body.username)) {
throw createError({
statusCode: 400,
message: '姓名和账号名只能包含汉字'
})
}
try {
@@ -44,45 +38,35 @@ export default defineEventHandler(async (event) => {
const existingUserResult = await db
.select()
.from(users)
.where(eq(users.username, normalizedUsername))
.where(eq(users.username, body.username))
.limit(1)
const existingUser = existingUserResult[0]
if (existingUser) {
throw createError({
statusCode: 400,
message: '用户名已存在'
message: '账号名已存在'
})
}
// 加密密码
const hashedPassword = await bcrypt.hash(initialPassword, 10)
const hashedPassword = await bcrypt.hash(body.password, 10)
// 角色权限控制
// 角色权限控制（统一使用 canManageUserRole 数值化级别检查）
let validRole = 'USER'
if (body.role && ['USER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(body.role)) {
// 超级管理员可以创建任何角色的用户
if (user.role === 'SUPER_ADMIN') {
validRole = body.role
}
// 管理员只能创建管理员以下的角色（USER, SONG_ADMIN）
else if (user.role === 'ADMIN') {
if (['USER', 'SONG_ADMIN'].includes(body.role)) {
validRole = body.role
} else {
throw createError({
statusCode: 403,
message: '管理员只能创建用户和歌曲管理员角色'
})
}
}
// 其他角色不能创建用户
else {
const requestedRole = body.role
if (requestedRole) {
if (!canManageUserRole(user, requestedRole)) {
const currentLevel = getRoleLevel(user.role)
const targetLevel = getRoleLevel(requestedRole)
throw createError({
statusCode: 403,
message: '没有权限创建用户'
message: isRoleHigher(requestedRole, user.role) || currentLevel <= targetLevel
? `权限不足：${user.role} 无法创建级别高于或等于自身的角色（${requestedRole}）`
: `没有权限创建 ${requestedRole} 角色的用户`
})
}
validRole = requestedRole
}
// 状态验证
@@ -95,13 +79,13 @@ export default defineEventHandler(async (event) => {
const newUserResult = await db
.insert(users)
.values({
name: normalizedName,
username: normalizedUsername,
name: body.name,
username: body.username,
password: hashedPassword,
role: validRole,
status: validStatus as 'active' | 'withdrawn' | 'graduate',
grade: normalizeOptionalText(body.grade),
class: normalizeOptionalText(body.class)
grade: body.grade,
class: body.class
})
.returning({
id: users.id,
@@ -116,16 +100,23 @@ export default defineEventHandler(async (event) => {
})
const newUser = newUserResult[0]
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
await cache.deletePattern('songs:*')
await cache.deletePattern('stats:*')
console.log('[Cache] 歌曲和统计缓存已清除（用户创建）')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
user: newUser,
message: '用户创建成功'
}
} catch (error: any) {
} catch (error) {
console.error('创建用户失败:', error)
if (error?.statusCode) {
throw error
}
throw createError({
statusCode: 500,
message: '创建用户失败'
server/api/admin/users/status-logs.get.ts
+16 -18
View File
@@ -1,7 +1,7 @@
import { createError, defineEventHandler, getQuery } from 'h3'
import { db } from '~/drizzle/db'
import { users, userStatusLogs } from '~/drizzle/schema'
import { and, count, desc, eq, ilike, inArray, or, sql } from 'drizzle-orm'
import { and, count, desc, eq, ilike, or } from 'drizzle-orm'
import { getStatusText } from '~~/server/utils/user'
export default defineEventHandler(async (event) => {
@@ -11,7 +11,7 @@ export default defineEventHandler(async (event) => {
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
message: '没有权限访问'
statusMessage: '没有权限访问'
})
}
@@ -46,14 +46,15 @@ export default defineEventHandler(async (event) => {
.select({
id: userStatusLogs.id,
userId: userStatusLogs.userId,
// 优先快照列（用户删除后审计可追溯）；存量旧日志快照为 NULL 时回退 join 的用户名
userName: sql`COALESCE(${userStatusLogs.name}, ${users.name})`,
userUsername: sql`COALESCE(${userStatusLogs.username}, ${users.username})`,
userName: users.name,
userUsername: users.username,
oldStatus: userStatusLogs.oldStatus,
newStatus: userStatusLogs.newStatus,
reason: userStatusLogs.reason,
createdAt: userStatusLogs.createdAt,
operatorId: userStatusLogs.operatorId
operatorId: userStatusLogs.operatorId,
operatorName: users.name,
operatorUsername: users.username
})
.from(userStatusLogs)
.leftJoin(users, eq(userStatusLogs.userId, users.id))
@@ -66,13 +67,15 @@ export default defineEventHandler(async (event) => {
.select({
id: userStatusLogs.id,
userId: userStatusLogs.userId,
userName: sql`COALESCE(${userStatusLogs.name}, ${users.name})`,
userUsername: sql`COALESCE(${userStatusLogs.username}, ${users.username})`,
userName: users.name,
userUsername: users.username,
oldStatus: userStatusLogs.oldStatus,
newStatus: userStatusLogs.newStatus,
reason: userStatusLogs.reason,
createdAt: userStatusLogs.createdAt,
operatorId: userStatusLogs.operatorId
operatorId: userStatusLogs.operatorId,
operatorName: users.name,
operatorUsername: users.username
})
.from(userStatusLogs)
.leftJoin(users, eq(userStatusLogs.userId, users.id))
@@ -80,9 +83,6 @@ export default defineEventHandler(async (event) => {
and(
whereClause,
or(
ilike(userStatusLogs.name, `%${searchTerm}%`),
ilike(userStatusLogs.username, `%${searchTerm}%`),
// 存量旧日志快照列为 NULL，回退 join 的用户名列以便可搜
ilike(users.name, `%${searchTerm}%`),
ilike(users.username, `%${searchTerm}%`),
ilike(userStatusLogs.reason, `%${searchTerm}%`)
@@ -106,8 +106,6 @@ export default defineEventHandler(async (event) => {
and(
whereClause,
or(
ilike(userStatusLogs.name, `%${searchTerm}%`),
ilike(userStatusLogs.username, `%${searchTerm}%`),
ilike(users.name, `%${searchTerm}%`),
ilike(users.username, `%${searchTerm}%`),
ilike(userStatusLogs.reason, `%${searchTerm}%`)
@@ -137,7 +135,7 @@ export default defineEventHandler(async (event) => {
username: users.username
})
.from(users)
.where(inArray(users.id, operatorIds))
.where(eq(users.id, operatorIds[0])) // 这里需要用inArray，但先简化处理
const operatorMap = new Map()
for (const op of operators) {
@@ -166,8 +164,8 @@ export default defineEventHandler(async (event) => {
createdAt: log.createdAt,
operator: {
id: log.operatorId,
name: operatorMap.get(log.operatorId)?.name || '未知操作员',
username: operatorMap.get(log.operatorId)?.username || 'unknown'
name: operatorMap.get(log.operatorId)?.name || log.operatorName || '未知操作员',
username: operatorMap.get(log.operatorId)?.username || log.operatorUsername || 'unknown'
}
})),
pagination: {
@@ -193,7 +191,7 @@ export default defineEventHandler(async (event) => {
throw createError({
statusCode: 500,
message: '获取状态变更日志失败: ' + error.message
statusMessage: '获取状态变更日志失败: ' + error.message
})
}
})