feat(admin): 优化用户权限分级·统一头像·数据分析面板修复

- fix(DataAnalysisPanel): 活跃用户卡片固定 400px + overflow-y 独立滚动容器，底部渐变遮罩提示滚动；列表项 tooltip 增加 max-height 与 overflow 截断；新增圆形头像显示与 @error 回退首字母 - feat(admin): 新增 getUserAvatarUrl 统一头像策略链（OAuth identity→Gravatar→DiceBear 7.x initials），stats/realtime、active-users、users/index 三处接口返回 avatarUrl - fix(admin): 建立 SUPER_ADMIN(100)>ADMIN(80)>USER(10) 分级常量与 canChangeRoleOf/canResetPasswordFor 等谓词；reset-password、[id].put、index.post 全面应用级别守卫；前端 UserManager 按钮按权限禁用、availableRoles 按操作者级别过滤 SUPER_ADMIN/ADMIN 等高角色
2026-09-12 08:36:45 +08:00
parent 153ee41ef0
commit d09d12828d
10 changed files with 633 additions and 199 deletions
@@ -1,10 +1,10 @@
 import { createError, defineEventHandler, getQuery } from 'h3'
 import { db } from '~/drizzle/db'
-import { songs, users, votes } from '~/drizzle/schema'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
 import { CacheService } from '../../../services/cacheService'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'

 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
  const user = event.context.user
  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
    throw createError({
@@ -18,7 +18,6 @@ export default defineEventHandler(async (event) => {
  const limit = parseInt(query.limit as string) || 20

  try {
-    // 尝试从缓存获取数据
    const cacheService = CacheService.getInstance()
    const cachedStats = await cacheService.getActiveUsersStats(semester, limit)
    if (cachedStats) {
@@ -26,18 +25,24 @@ export default defineEventHandler(async (event) => {
      return cachedStats
    }

-    // 构建查询条件 - 如果没有指定学期或学期为'all'，查询所有用户
    let songWhere = {}
    if (semester && semester !== 'all') {
      songWhere = { semester: semester }
    }

-    // 获取活跃用户数据 - 有投稿歌曲的用户
    const allUsers = await db.select().from(users)
    const allSongs = await db.select().from(songs)
    const allVotes = await db.select().from(votes)
+    const allIdentities = await db.select().from(userIdentities)
+
+    const identitiesMap = new Map<number, typeof allIdentities>()
+    allIdentities.forEach((identity) => {
+      if (!identitiesMap.has(identity.userId)) {
+        identitiesMap.set(identity.userId, [])
+      }
+      identitiesMap.get(identity.userId)!.push(identity)
+    })

-    // 过滤有投稿歌曲的用户
    const activeUsers = allUsers
      .filter((user) => {
        const userSongs = allSongs.filter((song) => {
@@ -65,44 +70,48 @@ export default defineEventHandler(async (event) => {
        }
      })

-    // 如果没有活跃用户，返回空数组
    if (activeUsers.length === 0) {
      const emptyResult = []
-      // 缓存空结果
      await cacheService.setActiveUsersStats(semester, limit, emptyResult)
      console.log('[Cache] 活跃用户统计数据已缓存（空结果）')
      return emptyResult
    }

-    // 计算每个用户的活跃度数据
    const userStats = activeUsers.map((user) => {
      const contributions = user.songs.length
      const likes = user.songs.reduce((total, song) => total + song.votes.length, 0)
-
-      // 活跃度计算：投稿数 * 2 + 点赞数 * 0.5
      const activityScore = Math.round(contributions * 2 + likes * 0.5)
+      const userIdentitiesData = identitiesMap.get(user.id) || []
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        userIdentitiesData
+      )

-      const userStat = {
+      return {
        id: user.id,
-        name: user.name || user.username, // 优先显示真实姓名，如果没有则显示登录名
+        name: user.name || user.username,
        contributions,
        likes,
-        activityScore
+        activityScore,
+        avatarUrl
      }
-
-      return userStat
    })

-    // 按活跃度分数降序排列并限制数量
    const sortedUsers = userStats.sort((a, b) => b.activityScore - a.activityScore).slice(0, limit)

-    // 缓存结果
    await cacheService.setActiveUsersStats(semester, limit, sortedUsers)
    console.log('[Cache] 活跃用户统计数据已缓存')

    return sortedUsers
  } catch (error) {
-    // 返回空数组而不是抛出错误，避免前端显示错误
+    console.error('[Stats] 获取活跃用户失败:', error)
    return []
  }
 })
@@ -1,12 +1,24 @@
 import { createError, defineEventHandler } from 'h3'
 import { db } from '~/drizzle/db'
 import { CacheService } from '../../../services/cacheService'
-import { songs, users, votes } from '~/drizzle/schema'
-import { count, eq, gte } from 'drizzle-orm'
+import { songs, users, votes, userIdentities } from '~/drizzle/schema'
+import { count, eq, gte, inArray } from 'drizzle-orm'
 import { getBeijingHour, getBeijingStartOfDay } from '~/utils/timeUtils'
+import { getUserAvatarUrl } from '../../../utils/user-avatar'
+
+function formatRelativeTime(date: Date | null | undefined): string {
+  if (!date) return '未知'
+  const now = new Date()
+  const diff = now.getTime() - new Date(date).getTime()
+  const minutes = Math.floor(diff / 60000)
+  if (minutes < 1) return '刚刚'
+  if (minutes < 60) return `${minutes}分钟前`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}小时前`
+  return `${Math.floor(hours / 24)}天前`
+}

 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
  const user = event.context.user
  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
    throw createError({
@@ -16,97 +28,172 @@ export default defineEventHandler(async (event) => {
  }

  try {
-    // 尝试从缓存获取数据
    const cacheService = CacheService.getInstance()
    const cachedStats = await cacheService.getRealtimeStats()
    if (cachedStats) {
      console.log('[Cache] 实时统计数据缓存命中')
      return cachedStats
    }
-    // 获取当前时间相关的日期
    const now = new Date()
-    const today = getBeijingStartOfDay() // 使用北京时间的一天开始
+    const today = getBeijingStartOfDay()
    const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000)
    const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)

-    // 并行获取实时统计数据
    const [activeUsersData, todayRequests, popularGenres, peakHours] = await Promise.all([
-      // 活跃用户数和用户列表 (最近1小时点歌、登录或点赞的用户)
      (async () => {
        try {
-          // 获取最近1小时内点歌的用户
          const recentSongUsers = await db
            .select({
              requesterId: songs.requesterId,
              requesterName: users.name,
              requesterUsername: users.username,
-              requesterId2: users.id
+              requesterId2: users.id,
+              requesterLastActive: songs.createdAt,
+              requesterAvatarProvider: users.avatarProvider,
+              requesterAvatarProviderUserId: users.avatarProviderUserId,
+              requesterEmail: users.email
            })
            .from(songs)
            .innerJoin(users, eq(songs.requesterId, users.id))
            .where(gte(songs.createdAt, oneHourAgo))
-            .groupBy(songs.requesterId, users.id, users.name, users.username)
+            .groupBy(songs.requesterId, users.id, users.name, users.username, users.lastLogin, users.avatarProvider, users.avatarProviderUserId, users.email, songs.createdAt)

-          // 获取最近1小时内登录的用户
          const recentLoginUsers = await db
            .select({
              id: users.id,
              username: users.username,
-              name: users.name
+              name: users.name,
+              lastLogin: users.lastLogin,
+              avatarProvider: users.avatarProvider,
+              avatarProviderUserId: users.avatarProviderUserId,
+              email: users.email
            })
            .from(users)
            .where(gte(users.lastLogin, oneHourAgo))

-          // 获取最近1小时内点赞过歌曲的用户
          const recentVoteUsers = await db
            .select({
              userId: votes.userId,
              userName: users.name,
              userUsername: users.username,
-              userId2: users.id
+              userId2: users.id,
+              voteCreatedAt: votes.createdAt,
+              userAvatarProvider: users.avatarProvider,
+              userAvatarProviderUserId: users.avatarProviderUserId,
+              userEmail: users.email
            })
            .from(votes)
            .innerJoin(users, eq(votes.userId, users.id))
            .where(gte(votes.createdAt, oneHourAgo))
-            .groupBy(votes.userId, users.id, users.name, users.username)
+            .groupBy(votes.userId, users.id, users.name, users.username, users.avatarProvider, users.avatarProviderUserId, users.email, votes.createdAt)

-          // 合并并去重用户列表
-          const userMap = new Map()
+          const userMap = new Map<number, any>()

-          // 添加点歌用户
          recentSongUsers.forEach((song) => {
-            userMap.set(song.requesterId2, {
-              id: song.requesterId2,
+            const id = song.requesterId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(song.requesterLastActive)
+                ? existing.lastActive
+                : song.requesterLastActive
+              : song.requesterLastActive
+            userMap.set(id, {
+              id,
              username: song.requesterUsername,
-              name: song.requesterName
+              name: song.requesterName,
+              email: song.requesterEmail,
+              avatarProvider: song.requesterAvatarProvider,
+              avatarProviderUserId: song.requesterAvatarProviderUserId,
+              lastActive
            })
          })

-          // 添加登录用户
-          recentLoginUsers.forEach((user) => {
-            userMap.set(user.id, {
-              id: user.id,
-              username: user.username,
-              name: user.name
+          recentLoginUsers.forEach((u) => {
+            const existing = userMap.get(u.id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(u.lastLogin)
+                ? existing.lastActive
+                : u.lastLogin
+              : u.lastLogin
+            userMap.set(u.id, {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              email: u.email,
+              avatarProvider: u.avatarProvider,
+              avatarProviderUserId: u.avatarProviderUserId,
+              lastActive
            })
          })

-          // 添加点赞用户
          recentVoteUsers.forEach((vote) => {
-            userMap.set(vote.userId2, {
-              id: vote.userId2,
+            const id = vote.userId2
+            const existing = userMap.get(id)
+            const lastActive = existing?.lastActive
+              ? new Date(existing.lastActive) > new Date(vote.voteCreatedAt)
+                ? existing.lastActive
+                : vote.voteCreatedAt
+              : vote.voteCreatedAt
+            userMap.set(id, {
+              id,
              username: vote.userUsername,
-              name: vote.userName
+              name: vote.userName,
+              email: vote.userEmail,
+              avatarProvider: vote.userAvatarProvider,
+              avatarProviderUserId: vote.userAvatarProviderUserId,
+              lastActive
            })
          })

-          const activeUsersList = Array.from(userMap.values())
+          const userIds = Array.from(userMap.keys())
+          let identitiesData: any[] = []
+          if (userIds.length > 0) {
+            try {
+              identitiesData = await db
+                .select()
+                .from(userIdentities)
+                .where(inArray(userIdentities.userId, userIds))
+            } catch (e) {
+              identitiesData = []
+            }
+          }
+
+          const identitiesMap = new Map<number, any[]>()
+          identitiesData.forEach((identity) => {
+            if (!identitiesMap.has(identity.userId)) {
+              identitiesMap.set(identity.userId, [])
+            }
+            identitiesMap.get(identity.userId)!.push(identity)
+          })
+
+          const activeUsersList = Array.from(userMap.values()).map((u) => {
+            const userIdentitiesData = identitiesMap.get(u.id) || []
+            const avatarUrl = getUserAvatarUrl(
+              {
+                id: u.id,
+                name: u.name,
+                username: u.username,
+                email: u.email,
+                avatarProvider: u.avatarProvider,
+                avatarProviderUserId: u.avatarProviderUserId
+              },
+              userIdentitiesData
+            )
+            return {
+              id: u.id,
+              username: u.username,
+              name: u.name,
+              avatarUrl,
+              lastActive: formatRelativeTime(u.lastActive)
+            }
+          })

          return {
            count: activeUsersList.length,
            users: activeUsersList
          }
        } catch (error) {
+          console.error('[Realtime] 获取活跃用户失败:', error)
          return {
            count: 0,
            users: []
@@ -114,7 +201,6 @@ export default defineEventHandler(async (event) => {
        }
      })(),

-      // 今日点歌数
      (async () => {
        try {
          const todayCountResult = await db
@@ -127,12 +213,10 @@ export default defineEventHandler(async (event) => {
        }
      })(),

-      // 热门流派 (Song模型中没有genre字段，返回空数组)
      (async () => {
        return []
      })(),

-      // 高峰时段 (最近7天的小时统计)
      (async () => {
        try {
          const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
@@ -143,7 +227,6 @@ export default defineEventHandler(async (event) => {
            .from(songs)
            .where(gte(songs.createdAt, sevenDaysAgo))

-          // 按小时统计
          const hourCount = songsData.reduce(
            (acc, song) => {
              const hour = getBeijingHour(song.createdAt)
@@ -153,7 +236,6 @@ export default defineEventHandler(async (event) => {
            {} as Record<number, number>
          )

-          // 返回前3个高峰时段
          return Object.entries(hourCount)
            .sort(([, a], [, b]) => b - a)
            .slice(0, 3)
@@ -177,12 +259,12 @@ export default defineEventHandler(async (event) => {
      timestamp: now.toISOString()
    }

-    // 缓存结果
    await cacheService.setRealtimeStats(result)
    console.log('[Cache] 实时统计数据已缓存')

    return result
  } catch (error) {
+    console.error('[Realtime] 获取失败:', error)
    throw createError({
      statusCode: 500,
      message: '获取实时统计数据失败'
@@ -3,6 +3,7 @@ import { db } from '~/drizzle/db'
 import { users, userStatusLogs } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
 import { updateUserPassword } from '~~/server/services/userService'
+import { getRoleLevel, canChangeRoleOf, canResetPasswordFor } from '~~/server/utils/permissions.js'

 export default defineEventHandler(async (event) => {
  try {
@@ -51,6 +52,8 @@ export default defineEventHandler(async (event) => {
    }

    const targetUser = existingUser[0]
+    const currentLevel = getRoleLevel(user.role)
+    const targetLevel = getRoleLevel(targetUser.role)

    // 1. 禁止修改系统初始超级管理员 (ID: 1)
    if (targetUser.id === 1) {
@@ -61,7 +64,6 @@ export default defineEventHandler(async (event) => {
    }

    // 2. 禁止对自身进行任何用户管理操作（包括角色、资料、状态、密码等）
-    // 使用 String 转换确保 ID 比较的准确性
    if (String(userId) === String(user.id)) {
      throw createError({
        statusCode: 400,
@@ -69,12 +71,11 @@ export default defineEventHandler(async (event) => {
      })
    }

-    // 3. 越级修改保护
-    // 如果目标用户是 SUPER_ADMIN，操作者必须是 SUPER_ADMIN
-    if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
+    // 3. 非超级管理员必须严格高于目标角色级别
+    if (user.role !== 'SUPER_ADMIN' && currentLevel <= targetLevel) {
      throw createError({
        statusCode: 403,
-        statusMessage: '权限不足：普通管理员无法修改超级管理员信息'
+        statusMessage: `权限不足：${user.role} 无法操作同级或更高角色的用户`
      })
    }

@@ -94,31 +95,26 @@ export default defineEventHandler(async (event) => {
      }
    }

-    // 角色权限控制
-    let validRole = 'USER'
-    if (role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(role)) {
-      // 超级管理员可以设置任何角色
-      if (user.role === 'SUPER_ADMIN') {
-        validRole = role
-      }
-      // 管理员只能设置管理员以下的角色（USER, SONG_ADMIN）
-      else if (user.role === 'ADMIN') {
-        if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(role)) {
-          validRole = role
-        } else {
-          throw createError({
-            statusCode: 403,
-            statusMessage: '管理员只能设置用户、教师和歌曲管理员角色'
-          })
-        }
-      }
-      // 其他角色不能设置角色
-      else {
+    // 角色权限控制（统一使用 canChangeRoleOf 语义化检查）
+    let validRole = targetUser.role
+    if (role && role !== targetUser.role) {
+      if (!canChangeRoleOf(user, targetUser, role)) {
        throw createError({
          statusCode: 403,
-          statusMessage: '没有权限设置用户角色'
+          statusMessage: user.role === 'SUPER_ADMIN'
+            ? '超级管理员不能将目标用户提升为 SUPER_ADMIN'
+            : `权限不足：${user.role} 无法将用户角色更改为 ${role}`
        })
      }
+      validRole = role
+    }
+
+    // 如果请求中包含密码更新，校验密码重置权限
+    if (password && !canResetPasswordFor(user, targetUser)) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: `权限不足：${user.role} 无法重置目标用户的密码`
+      })
    }

    // 验证status字段的有效性
@@ -1,16 +1,18 @@
 import { updateUserPassword } from '~~/server/services/userService'
+import { db } from '~/drizzle/db'
+import { users } from '~/drizzle/schema'
+import { eq } from 'drizzle-orm'
+import { canResetPasswordFor, getRoleLevel } from '../../../utils/permissions.js'

 export default defineEventHandler(async (event) => {
-  // 检查认证和权限
-  const user = event.context.user
-  if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+  const currentUser = event.context.user
+  if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
    throw createError({
      statusCode: 403,
      message: '没有权限访问'
    })
  }

-  // 安全获取ID参数
  const params = event.context.params || {}
  const id = parseInt(params.id || '')

@@ -31,15 +33,54 @@ export default defineEventHandler(async (event) => {
  }

  try {
-    // 禁止对自身进行密码重置（通过用户管理界面）
-    if (id === user.id) {
+    if (id === currentUser.id) {
      throw createError({
        statusCode: 400,
        message: '禁止在用户管理中重置自己的密码'
      })
    }
-    
-    // 使用统一服务重置密码 (forceReset = true)
+
+    const targetUserResult = await db
+      .select({ id: users.id, role: users.role, username: users.username })
+      .from(users)
+      .where(eq(users.id, id))
+      .limit(1)
+
+    if (targetUserResult.length === 0) {
+      throw createError({
+        statusCode: 404,
+        message: '用户不存在'
+      })
+    }
+
+    const targetUser = targetUserResult[0]
+
+    if (targetUser.id === 1) {
+      throw createError({
+        statusCode: 403,
+        message: '无法重置系统初始超级管理员的密码'
+      })
+    }
+
+    const currentLevel = getRoleLevel(currentUser.role)
+    const targetLevel = getRoleLevel(targetUser.role)
+
+    if (currentUser.role !== 'SUPER_ADMIN') {
+      if (currentLevel <= targetLevel) {
+        throw createError({
+          statusCode: 403,
+          message: '权限不足：不能重置角色级别大于等于自己的用户密码'
+        })
+      }
+    }
+
+    if (!canResetPasswordFor(currentUser, targetUser)) {
+      throw createError({
+        statusCode: 403,
+        message: '权限不足：当前角色无法重置该用户的密码'
+      })
+    }
+
    await updateUserPassword(id, body.newPassword, true)

    return {
@@ -47,7 +88,10 @@ export default defineEventHandler(async (event) => {
      message: '密码重置成功'
    }
  } catch (error) {
-    console.error('重置密码失败:', error)
+    console.error('[ResetPassword] 失败:', error)
+    if (error.statusCode) {
+      throw error
+    }
    throw createError({
      statusCode: 500,
      message: '重置密码失败'
@@ -96,26 +96,36 @@ export default defineEventHandler(async (event) => {
        meowNickname: true,
        meowBoundAt: true,
        createdAt: true,
-        updatedAt: true
+        updatedAt: true,
+        avatarProvider: true,
+        avatarProviderUserId: true,
+        email: true
      },
      with: {
-        identities: {
-          columns: {
-            provider: true,
-            providerUsername: true
-          },
-          where: (identities, { eq }) => eq(identities.provider, 'github')
-        }
+        identities: true
      }
    })

-    // 处理用户列表，添加头像字段
-    const formattedUsers = usersList.map((user) => ({
-      ...user,
-      avatar: user.identities?.[0]?.providerUsername
-        ? `https://github.com/${user.identities[0].providerUsername}.png`
-        : null
-    }))
+    const { getUserAvatarUrl } = await import('../../../utils/user-avatar')
+
+    const formattedUsers = usersList.map((user) => {
+      const avatarUrl = getUserAvatarUrl(
+        {
+          id: user.id,
+          name: user.name,
+          username: user.username,
+          email: user.email,
+          avatarProvider: user.avatarProvider,
+          avatarProviderUserId: user.avatarProviderUserId
+        },
+        user.identities || []
+      )
+      return {
+        ...user,
+        avatar: avatarUrl,
+        avatarUrl
+      }
+    })

    // 计算分页信息
    const totalPages = Math.ceil(total / limitNum)
@@ -2,6 +2,7 @@ import bcrypt from 'bcryptjs'
 import { db } from '~/drizzle/db'
 import { users } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
+import { getRoleLevel, isRoleHigher, canManageUserRole } from '~~/server/utils/permissions.js'

 export default defineEventHandler(async (event) => {
  // 检查认证和权限
@@ -51,31 +52,21 @@ export default defineEventHandler(async (event) => {
    // 加密密码
    const hashedPassword = await bcrypt.hash(body.password, 10)

-    // 角色权限控制
+    // 角色权限控制（统一使用 canManageUserRole 数值化级别检查）
    let validRole = 'USER'
-    if (body.role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(body.role)) {
-      // 超级管理员可以创建任何角色的用户
-      if (user.role === 'SUPER_ADMIN') {
-        validRole = body.role
-      }
-      // 管理员只能创建管理员以下的角色（USER, SONG_ADMIN）
-      else if (user.role === 'ADMIN') {
-        if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(body.role)) {
-          validRole = body.role
-        } else {
-          throw createError({
-            statusCode: 403,
-            message: '管理员只能创建用户、教师和歌曲管理员角色'
-          })
-        }
-      }
-      // 其他角色不能创建用户
-      else {
+    const requestedRole = body.role
+    if (requestedRole) {
+      if (!canManageUserRole(user, requestedRole)) {
+        const currentLevel = getRoleLevel(user.role)
+        const targetLevel = getRoleLevel(requestedRole)
        throw createError({
          statusCode: 403,
-          message: '没有权限创建用户'
+          message: isRoleHigher(requestedRole, user.role) || currentLevel <= targetLevel
+            ? `权限不足：${user.role} 无法创建级别高于或等于自身的角色（${requestedRole}）`
+            : `没有权限创建 ${requestedRole} 角色的用户`
        })
      }
+      validRole = requestedRole
    }

    // 状态验证