Files
BYW-VoiceHub/server/api/admin/users/batch-status.put.ts
T
Henry_Du cd6e235848 fix(users): 状态大小写不敏感 + 彻底修掉「无法编辑其它用户」
站长反馈仍然无法编辑其它用户。上一版只把**小程序端**的状态改成小写,
但如果小程序没重新编译(或用的还是旧版本),发上来的仍是 `ACTIVE`,
服务端 `['active','withdrawn','graduate'].includes(status)` 依旧不通过 → 400
「用户状态只能是 active, withdrawn 或 graduate」——编辑任何用户都会失败。

这版把容忍度放到**服务端**,与客户端版本解耦:

- 新增 server/utils/user-status.ts:
  · USER_STATUSES = ['active','withdrawn','graduate']
  · normalizeUserStatus() 大小写不敏感('ACTIVE' / ' Active ' → 'active'),认不出返回 null
  · USER_STATUS_RULE_MESSAGE 统一文案
- [id].put.ts:状态改用归一化值;另修正"自己只能改姓名"里的状态比较也忽略大小写
- [id]/status.put.ts、batch-status.put.ts:同样归一化;
  并修掉一个我自己引入的隐患(把归一化结果赋回 const 变量 → TypeError),
  batch-status 之前被误写成不存在的 statusesRaw,一并改正

效果:无论小程序是否重新编译,管理员都能编辑其它用户(含历史拼音账号只改年级)。
2026-09-30 23:49:40 +08:00

161 lines
4.3 KiB
TypeScript

import { createError, defineEventHandler, readBody } from 'h3'
import { db } from '~/drizzle/db'
import { users, userStatusLogs } from '~/drizzle/schema'
import { and, eq, inArray } from 'drizzle-orm'
import { getBeijingTime } from '~/utils/timeUtils'
import { getStatusText } from '~~/server/utils/user'
export default defineEventHandler(async (event) => {
try {
// 检查认证和权限
const user = event.context.user
if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
throw createError({
statusCode: 403,
statusMessage: '没有权限访问'
})
}
const body = await readBody(event)
const { userIds, status: rawStatus, reason } = body
// 验证必填字段
if (!Array.isArray(userIds) || userIds.length === 0) {
throw createError({
statusCode: 400,
statusMessage: '用户ID列表不能为空'
})
}
// 状态:大小写不敏感(客户端历史版本发的是大写 ACTIVE)
const status = normalizeUserStatus(rawStatus)
if (!status) {
throw createError({
statusCode: 400,
statusMessage: USER_STATUS_RULE_MESSAGE
})
}
if (!reason || reason.trim().length === 0) {
throw createError({
statusCode: 400,
statusMessage: '变更原因为必填项'
})
}
// 验证用户ID格式
const validUserIds = userIds
.filter((id) => {
const numId = parseInt(id)
return !isNaN(numId) && numId > 0
})
.map((id) => parseInt(id))
if (validUserIds.length === 0) {
throw createError({
statusCode: 400,
statusMessage: '没有有效的用户ID'
})
}
// 检查用户是否存在且为学生角色
const existingUsers = await db
.select({
id: users.id,
name: users.name,
username: users.username,
status: users.status,
role: users.role
})
.from(users)
.where(and(inArray(users.id, validUserIds), eq(users.role, 'USER')))
if (existingUsers.length === 0) {
throw createError({
statusCode: 404,
statusMessage: '没有找到可更新的学生用户'
})
}
// 筛选出状态需要变更的用户
const usersToUpdate = existingUsers.filter((u) => u.status !== status)
if (usersToUpdate.length === 0) {
throw createError({
statusCode: 400,
statusMessage: '所选用户的状态均无需变更'
})
}
const currentTime = getBeijingTime()
const results = []
// 开始事务
await db.transaction(async (tx) => {
for (const targetUser of usersToUpdate) {
// 更新用户状态
await tx
.update(users)
.set({
status: status,
statusChangedAt: currentTime,
statusChangedBy: user.id
})
.where(eq(users.id, targetUser.id))
// 记录状态变更日志
await tx.insert(userStatusLogs).values({
userId: targetUser.id,
oldStatus: targetUser.status,
newStatus: status,
reason: reason.trim(),
operatorId: user.id,
createdAt: currentTime
})
results.push({
userId: targetUser.id,
name: targetUser.name,
username: targetUser.username,
oldStatus: targetUser.status,
newStatus: status
})
}
})
// 清除相关缓存
try {
const { cache } = await import('~~/server/utils/cache-helpers')
for (const userId of usersToUpdate.map((u) => u.id)) {
await cache.delete(`auth:user:${userId}`)
}
console.log('[Cache] 批量用户认证缓存已清除(状态更新)')
} catch (cacheError) {
console.warn('[Cache] 清除缓存失败:', cacheError)
}
return {
success: true,
message: `成功更新 ${results.length} 个用户的状态为${getStatusText(status)}`,
data: {
totalRequested: validUserIds.length,
totalUpdated: results.length,
updatedUsers: results,
changedAt: currentTime,
changedBy: user.name
}
}
} catch (error) {
console.error('批量更新用户状态失败:', error)
if (error.statusCode) {
throw error
}
throw createError({
statusCode: 500,
statusMessage: '批量更新用户状态失败: ' + error.message
})
}
})