feat: align with upstream 1.5.9.9
This commit is contained in:
@@ -0,0 +1,197 @@
|
||||
import { defineEventHandler, getRouterParam, readBody } from 'h3'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users, userStatusLogs } from '~/drizzle/schema'
|
||||
import { eq, and } from 'drizzle-orm'
|
||||
import { getServerDate } from '~~/server/utils/serverTime'
|
||||
import { createApiError } from '~~/server/utils/apiError'
|
||||
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
|
||||
import { validateGradeClassPair } from '~~/server/utils/register-validation'
|
||||
import { isGradeClassValid } from '~~/server/utils/grade-class-options'
|
||||
import { SmtpService } from '~~/server/services/smtpService'
|
||||
|
||||
// 审核通过邮件通知（异步，失败不影响主流程）
|
||||
async function notifyApproved(name, email) {
|
||||
try {
|
||||
const smtpService = SmtpService.getInstance()
|
||||
if (await smtpService.ensureInitialized()) {
|
||||
await smtpService.renderAndSend(email, 'register-approved', {
|
||||
title: '注册审核已通过',
|
||||
message: `${name}，您的注册申请已通过审核，现在可以使用账号登录了。`
|
||||
})
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('审核通过邮件发送失败:', error)
|
||||
}
|
||||
}
|
||||
|
||||
// 审核拒绝邮件通知（用户已删除，用快照 email 发信；异步，失败不影响主流程）
|
||||
async function notifyRejected(name, email, reason) {
|
||||
try {
|
||||
const smtpService = SmtpService.getInstance()
|
||||
if (await smtpService.ensureInitialized()) {
|
||||
await smtpService.renderAndSend(email, 'register-rejected', {
|
||||
title: '注册申请未通过审核',
|
||||
message: `${name}，您的注册申请未通过审核${reason ? `，原因：${reason}` : ''}。如有疑问请联系管理员。`
|
||||
})
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('审核拒绝邮件发送失败:', error)
|
||||
}
|
||||
}
|
||||
|
||||
// 注册审核：approve 通过（可修改注册信息），reject 拒绝（删除账户并记录理由与用户快照）
|
||||
export default defineEventHandler(async (event) => {
|
||||
// 检查认证和权限
|
||||
const operator = event.context.user
|
||||
if (!operator || !['ADMIN', 'SUPER_ADMIN'].includes(operator.role)) {
|
||||
throw createApiError(403, SERVER_ERROR_CODES.COMMON_INSUFFICIENT_PERMISSION, '没有权限访问')
|
||||
}
|
||||
|
||||
const userId = getRouterParam(event, 'id')
|
||||
const body = await readBody(event)
|
||||
const { action, reason } = body
|
||||
|
||||
if (!action || !['approve', 'reject'].includes(action)) {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, 'action 必须为 approve 或 reject')
|
||||
}
|
||||
|
||||
// 目标用户必须存在且处于待审核状态
|
||||
const userIdNumber = Number(userId)
|
||||
if (!Number.isInteger(userIdNumber) || userIdNumber <= 0) {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, '无效的用户 ID')
|
||||
}
|
||||
|
||||
const targetResult = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
username: users.username,
|
||||
name: users.name,
|
||||
status: users.status,
|
||||
email: users.email
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.id, userIdNumber))
|
||||
.limit(1)
|
||||
|
||||
if (targetResult.length === 0) {
|
||||
throw createApiError(404, SERVER_ERROR_CODES.COMMON_TARGET_NOT_FOUND, '用户不存在')
|
||||
}
|
||||
|
||||
const targetUser = targetResult[0]
|
||||
if (targetUser.status !== 'pending') {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '仅待审核用户可执行审核操作')
|
||||
}
|
||||
|
||||
const currentTime = getServerDate()
|
||||
|
||||
if (action === 'approve') {
|
||||
// 年级与班级必须成对修改（或全部不修改）
|
||||
const gradeClassError = validateGradeClassPair(body.grade, body.class)
|
||||
if (gradeClassError) {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, gradeClassError.message)
|
||||
}
|
||||
|
||||
// 提交了年级班级组合时须为配置内组合（与注册校验同源）
|
||||
if (typeof body.grade === 'string' && typeof body.class === 'string' && body.grade.trim() && body.class.trim()) {
|
||||
const grade = body.grade.trim()
|
||||
const classValue = body.class.trim()
|
||||
const isValid = await isGradeClassValid(grade, classValue)
|
||||
if (!isValid) {
|
||||
throw createApiError(
|
||||
400,
|
||||
SERVER_ERROR_CODES.COMMON_INVALID_PARAMS,
|
||||
'所选年级班级不在可选项内，请检查配置'
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// 审核通过，可同步修改注册信息（未提供的字段保持不变）
|
||||
const updateData: Record<string, unknown> = {
|
||||
status: 'active',
|
||||
statusChangedAt: currentTime,
|
||||
statusChangedBy: operator.id
|
||||
}
|
||||
if (typeof body.name === 'string') {
|
||||
const trimmedName = body.name.trim()
|
||||
if (!trimmedName) {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.COMMON_INVALID_PARAMS, '姓名不能为空')
|
||||
}
|
||||
updateData.name = trimmedName
|
||||
}
|
||||
if (typeof body.grade === 'string') {
|
||||
updateData.grade = body.grade.trim() || null
|
||||
}
|
||||
if (typeof body.class === 'string') {
|
||||
updateData.class = body.class.trim() || null
|
||||
}
|
||||
if (typeof body.remark === 'string') {
|
||||
updateData.remark = body.remark.trim() || null
|
||||
}
|
||||
|
||||
await db.transaction(async (tx) => {
|
||||
// 并发防护：仅当用户仍处于 pending 时才通过（防止另一管理员已处理后重复写入）
|
||||
const updated = await tx
|
||||
.update(users)
|
||||
.set(updateData)
|
||||
.where(and(eq(users.id, userIdNumber), eq(users.status, 'pending')))
|
||||
.returning({ id: users.id })
|
||||
if (updated.length === 0) {
|
||||
throw createApiError(409, SERVER_ERROR_CODES.USER_NOT_PENDING, '该用户已不在待审核状态，请刷新后重试')
|
||||
}
|
||||
await tx.insert(userStatusLogs).values({
|
||||
userId: userIdNumber,
|
||||
username: targetUser.username,
|
||||
name: targetUser.name,
|
||||
oldStatus: 'pending',
|
||||
newStatus: 'active',
|
||||
reason: typeof reason === 'string' && reason.trim() ? reason.trim() : '注册审核通过',
|
||||
operatorId: operator.id,
|
||||
createdAt: currentTime
|
||||
})
|
||||
})
|
||||
|
||||
// 审核通过邮件通知（异步，失败不影响主流程）
|
||||
if (targetUser.email) {
|
||||
notifyApproved(targetUser.name, targetUser.email)
|
||||
}
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: '注册审核通过'
|
||||
}
|
||||
}
|
||||
|
||||
// 拒绝：删除账户，日志保存用户快照（用户删除后审计仍可追溯）
|
||||
const rejectReason = typeof reason === 'string' && reason.trim() ? reason.trim() : '注册审核拒绝'
|
||||
|
||||
await db.transaction(async (tx) => {
|
||||
// 并发防护：仅当用户仍处于 pending 时才删除（防止删除已被其他管理员处理的用户）
|
||||
const deleted = await tx
|
||||
.delete(users)
|
||||
.where(and(eq(users.id, userIdNumber), eq(users.status, 'pending')))
|
||||
.returning({ id: users.id })
|
||||
if (deleted.length === 0) {
|
||||
throw createApiError(409, SERVER_ERROR_CODES.USER_NOT_PENDING, '该用户已不在待审核状态，请刷新后重试')
|
||||
}
|
||||
await tx.insert(userStatusLogs).values({
|
||||
userId: userIdNumber,
|
||||
username: targetUser.username,
|
||||
name: targetUser.name,
|
||||
oldStatus: 'pending',
|
||||
newStatus: 'rejected',
|
||||
reason: rejectReason,
|
||||
operatorId: operator.id,
|
||||
createdAt: currentTime
|
||||
})
|
||||
})
|
||||
|
||||
// 审核拒绝邮件通知（用户已删除，用快照 email 发信）
|
||||
if (targetUser.email) {
|
||||
notifyRejected(targetUser.name, targetUser.email, rejectReason)
|
||||
}
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: '注册申请已拒绝'
|
||||
}
|
||||
})
|
||||
@@ -0,0 +1,112 @@
|
||||
import { eq } from 'drizzle-orm'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users } from '~/drizzle/schema'
|
||||
import { updateUserPassword } from '~~/server/services/userService'
|
||||
import {
|
||||
PASSWORD_AUDIT_ACTIONS,
|
||||
getPasswordAuditContext,
|
||||
recordPasswordAudit
|
||||
} from '~~/server/services/passwordSecurityService'
|
||||
import { createApiError } from '~~/server/utils/apiError'
|
||||
import { getAdminPasswordViolation } from '~~/server/utils/admin-password-policy'
|
||||
|
||||
export default defineEventHandler(async (event) => {
|
||||
// 检查认证和权限
|
||||
const user = event.context.user
|
||||
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '没有权限访问'
|
||||
})
|
||||
}
|
||||
|
||||
// 安全获取ID参数
|
||||
const params = event.context.params || {}
|
||||
const id = parseInt(params.id || '')
|
||||
|
||||
if (isNaN(id)) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '无效的用户ID'
|
||||
})
|
||||
}
|
||||
|
||||
const body = await readBody<Record<string, unknown> | null>(event)
|
||||
const newPassword = typeof body?.newPassword === 'string' ? body.newPassword.trim() : ''
|
||||
|
||||
// 管理员重置为临时密码且 forceReset 强制用户登录后修改，仅做基础校验不要求完整复杂度
|
||||
const violation = getAdminPasswordViolation(newPassword)
|
||||
if (violation) {
|
||||
throw createApiError(400, violation.code, violation.message)
|
||||
}
|
||||
|
||||
try {
|
||||
// 查询目标用户用于越级保护
|
||||
const targetUsers = await db
|
||||
.select({ id: users.id, role: users.role })
|
||||
.from(users)
|
||||
.where(eq(users.id, id))
|
||||
.limit(1)
|
||||
const targetUser = targetUsers[0]
|
||||
if (!targetUser) {
|
||||
throw createError({
|
||||
statusCode: 404,
|
||||
message: '用户不存在'
|
||||
})
|
||||
}
|
||||
|
||||
// 禁止对自身进行密码重置（通过用户管理界面）
|
||||
if (id === user.id) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '禁止在用户管理中重置自己的密码'
|
||||
})
|
||||
}
|
||||
|
||||
// 禁止重置系统初始超级管理员 (ID: 1)
|
||||
if (targetUser.id === 1) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '无法重置系统初始超级管理员的密码'
|
||||
})
|
||||
}
|
||||
|
||||
// 越级保护：目标用户是 SUPER_ADMIN 时，操作者必须是 SUPER_ADMIN
|
||||
if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '权限不足：普通管理员无法重置超级管理员密码'
|
||||
})
|
||||
}
|
||||
|
||||
// 使用统一服务重置密码 (forceReset = true)
|
||||
await updateUserPassword(id, newPassword, {
|
||||
forceReset: true,
|
||||
auditContext: {
|
||||
action: PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
|
||||
actorId: user.id,
|
||||
...getPasswordAuditContext(event)
|
||||
}
|
||||
})
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: '密码重置成功'
|
||||
}
|
||||
} catch (error) {
|
||||
await recordPasswordAudit(
|
||||
event,
|
||||
id,
|
||||
PASSWORD_AUDIT_ACTIONS.RESET_PASSWORD,
|
||||
false,
|
||||
error instanceof Error ? error.message : '管理员重置密码失败',
|
||||
user.id
|
||||
)
|
||||
console.error('重置密码失败:', error)
|
||||
if (error && typeof error === 'object' && 'statusCode' in error) throw error
|
||||
throw createError({
|
||||
statusCode: 500,
|
||||
message: '重置密码失败'
|
||||
})
|
||||
}
|
||||
})
|
||||
@@ -0,0 +1,273 @@
|
||||
import { db } from '~/drizzle/db'
|
||||
import { schedules, songReplayRequests, songs, users, votes } from '~/drizzle/schema'
|
||||
import { and, count, desc, eq, inArray } from 'drizzle-orm'
|
||||
|
||||
export default defineEventHandler(async (event) => {
|
||||
try {
|
||||
// 使用认证中间件提供的用户信息
|
||||
const currentUser = event.context.user
|
||||
if (!currentUser) {
|
||||
throw createError({
|
||||
statusCode: 401,
|
||||
message: '未授权访问'
|
||||
})
|
||||
}
|
||||
|
||||
// 检查是否为管理员、歌曲管理员或超级管理员
|
||||
const allowedRoles = ['ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN']
|
||||
if (!allowedRoles.includes(currentUser.role)) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '权限不足'
|
||||
})
|
||||
}
|
||||
|
||||
// 获取用户 ID
|
||||
const userId = parseInt(getRouterParam(event, 'id') as string)
|
||||
if (!userId || isNaN(userId)) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '无效的用户 ID'
|
||||
})
|
||||
}
|
||||
|
||||
// 验证用户是否存在
|
||||
const userResult = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
username: users.username,
|
||||
grade: users.grade,
|
||||
class: users.class
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.id, userId))
|
||||
.limit(1)
|
||||
|
||||
const user = userResult[0]
|
||||
|
||||
if (!user) {
|
||||
throw createError({
|
||||
statusCode: 404,
|
||||
message: '用户不存在'
|
||||
})
|
||||
}
|
||||
|
||||
// 获取用户投稿的歌曲
|
||||
const submittedSongs = await db
|
||||
.select({
|
||||
id: songs.id,
|
||||
title: songs.title,
|
||||
artist: songs.artist,
|
||||
semester: songs.semester,
|
||||
durationSeconds: songs.durationSeconds,
|
||||
createdAt: songs.createdAt,
|
||||
played: songs.played
|
||||
})
|
||||
.from(songs)
|
||||
.where(eq(songs.requesterId, userId))
|
||||
.orderBy(desc(songs.createdAt))
|
||||
|
||||
// 获取投稿歌曲的投票数
|
||||
const submittedSongIds = submittedSongs.map((song) => song.id)
|
||||
const submittedVoteCountsMap = new Map()
|
||||
if (submittedSongIds.length > 0) {
|
||||
const submittedVoteCountsResult = await db
|
||||
.select({
|
||||
songId: votes.songId,
|
||||
voteCount: count(votes.id)
|
||||
})
|
||||
.from(votes)
|
||||
.where(inArray(votes.songId, submittedSongIds))
|
||||
.groupBy(votes.songId)
|
||||
|
||||
submittedVoteCountsResult.forEach((item) => {
|
||||
submittedVoteCountsMap.set(item.songId, item.voteCount)
|
||||
})
|
||||
}
|
||||
|
||||
// 获取用户投票的歌曲
|
||||
const votedSongs = await db
|
||||
.select({
|
||||
id: votes.id,
|
||||
createdAt: votes.createdAt,
|
||||
songId: votes.songId,
|
||||
songTitle: songs.title,
|
||||
songArtist: songs.artist,
|
||||
songSemester: songs.semester,
|
||||
songPlayed: songs.played,
|
||||
requesterName: users.name,
|
||||
requesterGrade: users.grade,
|
||||
requesterClass: users.class
|
||||
})
|
||||
.from(votes)
|
||||
.leftJoin(songs, eq(votes.songId, songs.id))
|
||||
.leftJoin(users, eq(songs.requesterId, users.id))
|
||||
.where(eq(votes.userId, userId))
|
||||
.orderBy(desc(votes.createdAt))
|
||||
|
||||
// 获取投票歌曲的投票数
|
||||
const votedSongIds = votedSongs.map((vote) => vote.songId).filter((id) => id !== null)
|
||||
const votedVoteCountsMap = new Map()
|
||||
if (votedSongIds.length > 0) {
|
||||
const votedVoteCountsResult = await db
|
||||
.select({
|
||||
songId: votes.songId,
|
||||
voteCount: count(votes.id)
|
||||
})
|
||||
.from(votes)
|
||||
.where(inArray(votes.songId, votedSongIds))
|
||||
.groupBy(votes.songId)
|
||||
|
||||
votedVoteCountsResult.forEach((item) => {
|
||||
votedVoteCountsMap.set(item.songId, item.voteCount)
|
||||
})
|
||||
}
|
||||
|
||||
// 获取投稿歌曲的排期状态
|
||||
// 只查询已发布的排期，草稿不算作已排期
|
||||
const submittedScheduleMap = new Map()
|
||||
if (submittedSongIds.length > 0) {
|
||||
const submittedScheduleResult = await db
|
||||
.select({
|
||||
songId: schedules.songId
|
||||
})
|
||||
.from(schedules)
|
||||
.where(and(inArray(schedules.songId, submittedSongIds), eq(schedules.isDraft, false)))
|
||||
|
||||
submittedScheduleResult.forEach((item) => {
|
||||
submittedScheduleMap.set(item.songId, true)
|
||||
})
|
||||
}
|
||||
|
||||
// 获取投票歌曲的排期状态
|
||||
// 只查询已发布的排期，草稿不算作已排期
|
||||
const votedScheduleMap = new Map()
|
||||
if (votedSongIds.length > 0) {
|
||||
const votedScheduleResult = await db
|
||||
.select({
|
||||
songId: schedules.songId
|
||||
})
|
||||
.from(schedules)
|
||||
.where(and(inArray(schedules.songId, votedSongIds), eq(schedules.isDraft, false)))
|
||||
|
||||
votedScheduleResult.forEach((item) => {
|
||||
votedScheduleMap.set(item.songId, true)
|
||||
})
|
||||
}
|
||||
|
||||
// 获取用户申请重播的歌曲
|
||||
const replayRequestedSongs = await db
|
||||
.select({
|
||||
id: songReplayRequests.id,
|
||||
createdAt: songReplayRequests.createdAt,
|
||||
songId: songReplayRequests.songId,
|
||||
songTitle: songs.title,
|
||||
songArtist: songs.artist,
|
||||
songSemester: songs.semester,
|
||||
songPlayed: songs.played,
|
||||
requesterName: users.name,
|
||||
requesterGrade: users.grade,
|
||||
requesterClass: users.class
|
||||
})
|
||||
.from(songReplayRequests)
|
||||
.leftJoin(songs, eq(songReplayRequests.songId, songs.id))
|
||||
.leftJoin(users, eq(songs.requesterId, users.id))
|
||||
.where(eq(songReplayRequests.userId, userId))
|
||||
.orderBy(desc(songReplayRequests.createdAt))
|
||||
|
||||
// 获取重播申请歌曲的总申请数
|
||||
const replaySongIds = replayRequestedSongs.map((req) => req.songId).filter((id) => id !== null)
|
||||
const replayRequestCountsMap = new Map()
|
||||
if (replaySongIds.length > 0) {
|
||||
const replayRequestCountsResult = await db
|
||||
.select({
|
||||
songId: songReplayRequests.songId,
|
||||
requestCount: count(songReplayRequests.id)
|
||||
})
|
||||
.from(songReplayRequests)
|
||||
.where(inArray(songReplayRequests.songId, replaySongIds))
|
||||
.groupBy(songReplayRequests.songId)
|
||||
|
||||
replayRequestCountsResult.forEach((item) => {
|
||||
replayRequestCountsMap.set(item.songId, item.requestCount)
|
||||
})
|
||||
}
|
||||
|
||||
// 获取重播申请歌曲的排期状态
|
||||
const replayScheduleMap = new Map()
|
||||
if (replaySongIds.length > 0) {
|
||||
const replayScheduleResult = await db
|
||||
.select({
|
||||
songId: schedules.songId
|
||||
})
|
||||
.from(schedules)
|
||||
.where(and(inArray(schedules.songId, replaySongIds), eq(schedules.isDraft, false)))
|
||||
|
||||
replayScheduleResult.forEach((item) => {
|
||||
replayScheduleMap.set(item.songId, true)
|
||||
})
|
||||
}
|
||||
|
||||
return {
|
||||
user: {
|
||||
id: user.id,
|
||||
name: user.name,
|
||||
username: user.username,
|
||||
grade: user.grade,
|
||||
class: user.class
|
||||
},
|
||||
submittedSongs: submittedSongs.map((song) => ({
|
||||
id: song.id,
|
||||
title: song.title,
|
||||
artist: song.artist,
|
||||
semester: song.semester,
|
||||
createdAt: song.createdAt,
|
||||
played: song.played,
|
||||
scheduled: submittedScheduleMap.has(song.id),
|
||||
voteCount: submittedVoteCountsMap.get(song.id) || 0
|
||||
})),
|
||||
votedSongs: votedSongs.map((vote) => ({
|
||||
id: vote.songId,
|
||||
title: vote.songTitle,
|
||||
artist: vote.songArtist,
|
||||
semester: vote.songSemester,
|
||||
played: vote.songPlayed,
|
||||
scheduled: votedScheduleMap.has(vote.songId),
|
||||
voteCount: votedVoteCountsMap.get(vote.songId) || 0,
|
||||
votedAt: vote.createdAt,
|
||||
requester: {
|
||||
name: vote.requesterName,
|
||||
grade: vote.requesterGrade,
|
||||
class: vote.requesterClass
|
||||
}
|
||||
})),
|
||||
replayRequestedSongs: replayRequestedSongs.map((req) => ({
|
||||
id: req.songId,
|
||||
title: req.songTitle,
|
||||
artist: req.songArtist,
|
||||
semester: req.songSemester,
|
||||
played: req.songPlayed,
|
||||
scheduled: replayScheduleMap.has(req.songId),
|
||||
requestCount: replayRequestCountsMap.get(req.songId) || 0,
|
||||
requestedAt: req.createdAt,
|
||||
requester: {
|
||||
name: req.requesterName,
|
||||
grade: req.requesterGrade,
|
||||
class: req.requesterClass
|
||||
}
|
||||
}))
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('获取用户歌曲信息失败:', error)
|
||||
|
||||
if (error.statusCode) {
|
||||
throw error
|
||||
}
|
||||
|
||||
throw createError({
|
||||
statusCode: 500,
|
||||
message: '服务器内部错误'
|
||||
})
|
||||
}
|
||||
})
|
||||
@@ -0,0 +1,123 @@
|
||||
import { createError, defineEventHandler, getQuery, getRouterParam } from 'h3'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users, userStatusLogs } from '~/drizzle/schema'
|
||||
import { count, desc, eq } from 'drizzle-orm'
|
||||
import { getStatusText } from '~~/server/utils/user'
|
||||
|
||||
export default defineEventHandler(async (event) => {
|
||||
try {
|
||||
// 检查认证和权限
|
||||
const user = event.context.user
|
||||
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '没有权限访问'
|
||||
})
|
||||
}
|
||||
|
||||
const userId = getRouterParam(event, 'id')
|
||||
const query = getQuery(event)
|
||||
const { page = '1', limit = '20' } = query
|
||||
|
||||
// 验证用户 ID
|
||||
const numUserId = parseInt(userId)
|
||||
if (isNaN(numUserId) || numUserId <= 0) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '无效的用户 ID'
|
||||
})
|
||||
}
|
||||
|
||||
// 检查用户是否存在
|
||||
const existingUser = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
username: users.username
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.id, numUserId))
|
||||
.limit(1)
|
||||
|
||||
if (existingUser.length === 0) {
|
||||
throw createError({
|
||||
statusCode: 404,
|
||||
message: '用户不存在'
|
||||
})
|
||||
}
|
||||
|
||||
// 分页参数
|
||||
const pageNum = Math.max(1, parseInt(page as string) || 1)
|
||||
const limitNum = Math.max(1, parseInt(limit as string) || 20)
|
||||
const skip = (pageNum - 1) * limitNum
|
||||
|
||||
// 获取总数
|
||||
const totalResult = await db
|
||||
.select({ count: count() })
|
||||
.from(userStatusLogs)
|
||||
.where(eq(userStatusLogs.userId, numUserId))
|
||||
const total = totalResult[0].count
|
||||
|
||||
// 获取状态变更日志列表
|
||||
const logs = await db
|
||||
.select({
|
||||
id: userStatusLogs.id,
|
||||
oldStatus: userStatusLogs.oldStatus,
|
||||
newStatus: userStatusLogs.newStatus,
|
||||
reason: userStatusLogs.reason,
|
||||
createdAt: userStatusLogs.createdAt,
|
||||
operatorId: userStatusLogs.operatorId,
|
||||
operatorName: users.name,
|
||||
operatorUsername: users.username
|
||||
})
|
||||
.from(userStatusLogs)
|
||||
.leftJoin(users, eq(userStatusLogs.operatorId, users.id))
|
||||
.where(eq(userStatusLogs.userId, numUserId))
|
||||
.orderBy(desc(userStatusLogs.createdAt))
|
||||
.limit(limitNum)
|
||||
.offset(skip)
|
||||
|
||||
// 计算分页信息
|
||||
const totalPages = Math.ceil(total / limitNum)
|
||||
const hasNextPage = pageNum < totalPages
|
||||
const hasPrevPage = pageNum > 1
|
||||
|
||||
return {
|
||||
success: true,
|
||||
user: existingUser[0],
|
||||
logs: logs.map((log) => ({
|
||||
id: log.id,
|
||||
oldStatus: log.oldStatus,
|
||||
newStatus: log.newStatus,
|
||||
oldStatusDisplay: getStatusText(log.oldStatus || ''),
|
||||
newStatusDisplay: getStatusText(log.newStatus || ''),
|
||||
reason: log.reason,
|
||||
createdAt: log.createdAt,
|
||||
operator: {
|
||||
id: log.operatorId,
|
||||
name: log.operatorName || '未知操作员',
|
||||
username: log.operatorUsername || 'unknown'
|
||||
}
|
||||
})),
|
||||
pagination: {
|
||||
total,
|
||||
page: pageNum,
|
||||
limit: limitNum,
|
||||
totalPages,
|
||||
hasNextPage,
|
||||
hasPrevPage
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('获取用户状态变更日志失败:', error)
|
||||
|
||||
if (error.statusCode) {
|
||||
throw error
|
||||
}
|
||||
|
||||
throw createError({
|
||||
statusCode: 500,
|
||||
message: '获取用户状态变更日志失败：' + error.message
|
||||
})
|
||||
}
|
||||
})
|
||||
@@ -0,0 +1,132 @@
|
||||
import { createError, defineEventHandler, getRouterParam, readBody } from 'h3'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users, userStatusLogs } from '~/drizzle/schema'
|
||||
import { eq } from 'drizzle-orm'
|
||||
import { getBeijingTime } from '~/utils/timeUtils'
|
||||
import { getStatusText } from '~~/server/utils/user'
|
||||
import { createApiError } from '~~/server/utils/apiError'
|
||||
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
|
||||
|
||||
export default defineEventHandler(async (event) => {
|
||||
try {
|
||||
// 检查认证和权限
|
||||
const user = event.context.user
|
||||
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '没有权限访问'
|
||||
})
|
||||
}
|
||||
|
||||
const userId = getRouterParam(event, 'id')
|
||||
const body = await readBody(event)
|
||||
const { status, reason } = body
|
||||
|
||||
// 验证必填字段
|
||||
if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '状态必须为 active, withdrawn 或 graduate'
|
||||
})
|
||||
}
|
||||
|
||||
if (!reason || reason.trim().length === 0) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '变更原因为必填项'
|
||||
})
|
||||
}
|
||||
|
||||
// 检查用户是否存在
|
||||
const existingUser = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
username: users.username,
|
||||
status: users.status,
|
||||
role: users.role
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.id, parseInt(userId)))
|
||||
.limit(1)
|
||||
|
||||
if (existingUser.length === 0) {
|
||||
throw createError({
|
||||
statusCode: 404,
|
||||
message: '用户不存在'
|
||||
})
|
||||
}
|
||||
|
||||
const targetUser = existingUser[0]
|
||||
|
||||
// 待审核用户不得通过状态接口直接置为 active（须走注册审核流程）
|
||||
if (targetUser.status === 'pending' && status === 'active') {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '待审核用户需通过注册审核流程处理')
|
||||
}
|
||||
|
||||
// 检查是否为学生用户
|
||||
if (targetUser.role !== 'USER') {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '只能修改学生用户的状态'
|
||||
})
|
||||
}
|
||||
|
||||
// 检查状态是否有变化
|
||||
if (targetUser.status === status) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '用户状态未发生变化'
|
||||
})
|
||||
}
|
||||
|
||||
const currentTime = getBeijingTime()
|
||||
const oldStatus = targetUser.status
|
||||
|
||||
// 开始事务
|
||||
await db.transaction(async (tx) => {
|
||||
// 更新用户状态
|
||||
await tx
|
||||
.update(users)
|
||||
.set({
|
||||
status: status,
|
||||
statusChangedAt: currentTime,
|
||||
statusChangedBy: user.id
|
||||
})
|
||||
.where(eq(users.id, parseInt(userId)))
|
||||
|
||||
// 记录状态变更日志
|
||||
await tx.insert(userStatusLogs).values({
|
||||
userId: parseInt(userId),
|
||||
oldStatus: oldStatus,
|
||||
newStatus: status,
|
||||
reason: reason.trim(),
|
||||
operatorId: user.id,
|
||||
createdAt: currentTime
|
||||
})
|
||||
})
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: `用户状态已更新为${getStatusText(status)}`,
|
||||
data: {
|
||||
userId: parseInt(userId),
|
||||
oldStatus,
|
||||
newStatus: status,
|
||||
changedAt: currentTime,
|
||||
changedBy: user.name
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('更新用户状态失败:', error)
|
||||
|
||||
if (error.statusCode) {
|
||||
throw error
|
||||
}
|
||||
|
||||
throw createError({
|
||||
statusCode: 500,
|
||||
message: '更新用户状态失败: ' + error.message
|
||||
})
|
||||
}
|
||||
})
|
||||
Reference in New Issue
Block a user