feat: align with upstream 1.5.9.9
This commit is contained in:
@@ -0,0 +1,222 @@
|
||||
import { createError, defineEventHandler, readBody } from 'h3'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users, userStatusLogs } from '~/drizzle/schema'
|
||||
import { and, eq, inArray } from 'drizzle-orm'
|
||||
import { getBeijingTime } from '~/utils/timeUtils'
|
||||
import { getStatusText } from '~~/server/utils/user'
|
||||
import { createApiError } from '~~/server/utils/apiError'
|
||||
import { SERVER_ERROR_CODES } from '~~/server/config/constants'
|
||||
|
||||
export default defineEventHandler(async (event) => {
|
||||
try {
|
||||
// 检查认证和权限
|
||||
const user = event.context.user
|
||||
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
|
||||
throw createError({
|
||||
statusCode: 403,
|
||||
message: '没有权限访问'
|
||||
})
|
||||
}
|
||||
|
||||
const body = await readBody(event)
|
||||
const { userIds, status, reason, sourceStatus } = body
|
||||
const sourceStatusFilter = typeof sourceStatus === 'string' ? sourceStatus.trim() : ''
|
||||
|
||||
// 验证必填字段
|
||||
if (!Array.isArray(userIds) || userIds.length === 0) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '用户ID列表不能为空'
|
||||
})
|
||||
}
|
||||
|
||||
if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '状态必须为 active, withdrawn 或 graduate'
|
||||
})
|
||||
}
|
||||
|
||||
// 源状态白名单含 pending（支持按待审核筛选批量处理；同时使下方 pending→active 拦截可达）
|
||||
if (sourceStatusFilter && !['active', 'pending', 'withdrawn', 'graduate'].includes(sourceStatusFilter)) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '前置状态必须为 active, pending, withdrawn 或 graduate'
|
||||
})
|
||||
}
|
||||
|
||||
if (sourceStatusFilter === status) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '前置状态不能与目标状态相同'
|
||||
})
|
||||
}
|
||||
|
||||
// 待审核用户不得通过批量状态接口直接置为 active（须走注册审核流程）
|
||||
if (sourceStatusFilter === 'pending' && status === 'active') {
|
||||
throw createApiError(400, SERVER_ERROR_CODES.USER_NOT_PENDING, '待审核用户需通过注册审核流程处理')
|
||||
}
|
||||
|
||||
if (!reason || reason.trim().length === 0) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '变更原因为必填项'
|
||||
})
|
||||
}
|
||||
|
||||
// 验证用户ID格式
|
||||
const validUserIds = [
|
||||
...new Set(
|
||||
userIds
|
||||
.filter((id) => {
|
||||
const numId = parseInt(id)
|
||||
return !isNaN(numId) && numId > 0
|
||||
})
|
||||
.map((id) => parseInt(id))
|
||||
)
|
||||
]
|
||||
|
||||
if (validUserIds.length === 0) {
|
||||
throw createError({
|
||||
statusCode: 400,
|
||||
message: '没有有效的用户ID'
|
||||
})
|
||||
}
|
||||
|
||||
// 检查用户是否存在
|
||||
const existingUsers = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
username: users.username,
|
||||
status: users.status,
|
||||
role: users.role
|
||||
})
|
||||
.from(users)
|
||||
.where(inArray(users.id, validUserIds))
|
||||
|
||||
const existingUserIds = existingUsers.map((u) => u.id)
|
||||
const nonExistentUserIds = validUserIds.filter((id) => !existingUserIds.includes(id))
|
||||
|
||||
// 筛选出状态需要变更的用户，并加入越权保护，同时记录失败原因
|
||||
const usersToUpdate = []
|
||||
const errors: Array<{ userId: number | string; error: string }> = []
|
||||
|
||||
if (nonExistentUserIds.length > 0) {
|
||||
nonExistentUserIds.forEach((id) => {
|
||||
errors.push({ userId: id, error: '用户不存在' })
|
||||
})
|
||||
}
|
||||
|
||||
for (const u of existingUsers) {
|
||||
if (u.id === 1) {
|
||||
errors.push({ userId: u.id, error: '无法修改系统初始超级管理员' })
|
||||
continue
|
||||
}
|
||||
if (u.id === user.id) {
|
||||
errors.push({ userId: u.id, error: '禁止在用户管理中批量更新自己的账户' })
|
||||
continue
|
||||
}
|
||||
if (u.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
|
||||
errors.push({ userId: u.id, error: '权限不足：普通管理员无法修改超级管理员信息' })
|
||||
continue
|
||||
}
|
||||
if (u.role !== 'USER' && user.role !== 'SUPER_ADMIN') {
|
||||
errors.push({ userId: u.id, error: '权限不足：普通管理员无法批量修改其他管理员状态' })
|
||||
continue
|
||||
}
|
||||
if (sourceStatusFilter && u.status !== sourceStatusFilter) {
|
||||
errors.push({
|
||||
userId: u.id,
|
||||
error: `前置状态不匹配：当前为${getStatusText(u.status)}，仅更新${getStatusText(sourceStatusFilter)}`
|
||||
})
|
||||
continue
|
||||
}
|
||||
// 待审核用户不得通过批量状态接口直接置为 active（须走注册审核流程；即使未传 sourceStatus 也按实际状态拦截）
|
||||
if (status === 'active' && u.status === 'pending') {
|
||||
errors.push({ userId: u.id, error: '待审核用户需通过注册审核流程处理' })
|
||||
continue
|
||||
}
|
||||
if (u.status === status) {
|
||||
errors.push({ userId: u.id, error: '用户状态无需变更' })
|
||||
continue
|
||||
}
|
||||
usersToUpdate.push(u)
|
||||
}
|
||||
|
||||
if (usersToUpdate.length === 0) {
|
||||
return {
|
||||
success: false,
|
||||
message: '没有可更新的合法用户',
|
||||
errors,
|
||||
data: {
|
||||
totalRequested: validUserIds.length,
|
||||
totalUpdated: 0,
|
||||
updatedUsers: [],
|
||||
sourceStatus: sourceStatusFilter || null
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const currentTime = getBeijingTime()
|
||||
const results = []
|
||||
|
||||
// 开始事务
|
||||
await db.transaction(async (tx) => {
|
||||
for (const targetUser of usersToUpdate) {
|
||||
// 更新用户状态
|
||||
await tx
|
||||
.update(users)
|
||||
.set({
|
||||
status: status,
|
||||
statusChangedAt: currentTime,
|
||||
statusChangedBy: user.id
|
||||
})
|
||||
.where(eq(users.id, targetUser.id))
|
||||
|
||||
// 记录状态变更日志
|
||||
await tx.insert(userStatusLogs).values({
|
||||
userId: targetUser.id,
|
||||
oldStatus: targetUser.status,
|
||||
newStatus: status,
|
||||
reason: reason.trim(),
|
||||
operatorId: user.id,
|
||||
createdAt: currentTime
|
||||
})
|
||||
|
||||
results.push({
|
||||
userId: targetUser.id,
|
||||
name: targetUser.name,
|
||||
username: targetUser.username,
|
||||
oldStatus: targetUser.status,
|
||||
newStatus: status
|
||||
})
|
||||
}
|
||||
})
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: `成功更新 ${results.length} 个用户的状态为${getStatusText(status)}`,
|
||||
errors,
|
||||
data: {
|
||||
totalRequested: validUserIds.length,
|
||||
totalUpdated: results.length,
|
||||
updatedUsers: results,
|
||||
sourceStatus: sourceStatusFilter || null,
|
||||
changedAt: currentTime,
|
||||
changedBy: user.name
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('批量更新用户状态失败:', error)
|
||||
|
||||
if (error.statusCode) {
|
||||
throw error
|
||||
}
|
||||
|
||||
throw createError({
|
||||
statusCode: 500,
|
||||
message: '批量更新用户状态失败: ' + error.message
|
||||
})
|
||||
}
|
||||
})
|
||||
Reference in New Issue
Block a user