chore(init): 初始化解忧商行项目并完成 Phase 0 基座

2026-10-30 11:46:10 +08:00
commit 8d9481c251
689 changed files with 138703 additions and 0 deletions
@@ -0,0 +1,49 @@
+package adminmgr
+
+import (
+	"time"
+
+	"hfb_sys/backend/internal/modules/adminrole"
+)
+
+type AdminUserDTO struct {
+	ID          uint64              `json:"id"`
+	Username    string              `json:"username"`
+	Nickname    string              `json:"nickname"`
+	Status      string              `json:"status"`
+	Roles       []adminrole.RoleDTO `json:"roles"`
+	LastLoginAt *time.Time          `json:"last_login_at"`
+	CreatedAt   time.Time           `json:"created_at"`
+	UpdatedAt   time.Time           `json:"updated_at"`
+}
+
+type PaginatedResult struct {
+	Items    []AdminUserDTO `json:"items"`
+	Total    int64          `json:"total"`
+	Page     int            `json:"page"`
+	PageSize int            `json:"page_size"`
+}
+
+type CreateAdminRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+	Nickname string `json:"nickname"`
+}
+
+type UpdateAdminRequest struct {
+	Nickname string `json:"nickname"`
+	Status   string `json:"status"`
+}
+
+type AssignRolesRequest struct {
+	RoleIDs []uint64 `json:"role_ids"`
+}
+
+type ChangePasswordRequest struct {
+	OldPassword string `json:"old_password" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required"`
+}
+
+type ResetPasswordRequest struct {
+	NewPassword string `json:"new_password" binding:"required"`
+}
@@ -0,0 +1,183 @@
+package adminmgr
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"hfb_sys/backend/internal/middleware"
+	"hfb_sys/backend/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) List(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	result, err := h.service.List(c.Request.Context(), page, pageSize)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) FindByID(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	item, err := h.service.FindByID(c.Request.Context(), id)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Create(c *gin.Context) {
+	var req CreateAdminRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "用户名和密码不能为空")
+		return
+	}
+	item, err := h.service.Create(c.Request.Context(), req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.Created(c, item)
+}
+
+func (h *Handler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req UpdateAdminRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	item, err := h.service.Update(c.Request.Context(), id, req)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, item)
+}
+
+func (h *Handler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	currentAdminID, _ := c.Get(middleware.ContextAdminID)
+	if err := h.service.Delete(c.Request.Context(), id, currentAdminID.(uint64)); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": true})
+}
+
+func (h *Handler) AssignRoles(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req AssignRolesRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请求格式不正确")
+		return
+	}
+	if err := h.service.AssignRoles(c.Request.Context(), id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ChangePassword(c *gin.Context) {
+	h.ChangeOwnPassword(c)
+}
+
+func (h *Handler) ChangeOwnPassword(c *gin.Context) {
+	adminID, ok := currentAdminID(c)
+	if !ok {
+		response.Unauthorized(c, "缺少管理员上下文")
+		return
+	}
+	var req ChangePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "密码不能为空")
+		return
+	}
+	if err := h.service.ChangeOwnPassword(c.Request.Context(), adminID, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ResetPassword(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req ResetPasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "密码不能为空")
+		return
+	}
+	if err := h.service.ResetPassword(c.Request.Context(), id, req); err != nil {
+		writeError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func currentAdminID(c *gin.Context) (uint64, bool) {
+	value, ok := c.Get(middleware.ContextAdminID)
+	if !ok {
+		return 0, false
+	}
+	adminID, ok := value.(uint64)
+	return adminID, ok
+}
+
+func parseID(c *gin.Context) (uint64, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		response.BadRequest(c, "ID 不正确")
+		return 0, false
+	}
+	return id, true
+}
+
+func writeError(c *gin.Context, err error) {
+	response.RecordError(c, err)
+	switch {
+	case errors.Is(err, ErrDependencyUnavailable):
+		response.ServiceUnavailable(c, "数据库未连接")
+	case errors.Is(err, ErrCannotDeleteSelf):
+		response.BadRequest(c, "不能删除自己的账号")
+	case errors.Is(err, ErrLastSuperAdmin):
+		response.BadRequest(c, "不能删除最后一个超级管理员")
+	case errors.Is(err, ErrWrongPassword):
+		response.BadRequest(c, "原密码错误")
+	case errors.Is(err, ErrWeakPassword):
+		response.BadRequest(c, "密码至少 8 位且需包含字母和数字")
+	case IsNotFound(err):
+		response.Error(c, http.StatusNotFound, "not_found", "管理员不存在")
+	default:
+		response.Error(c, http.StatusInternalServerError, "internal_error", "管理员管理服务暂时不可用")
+	}
+}
@@ -0,0 +1,299 @@
+package adminmgr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"hfb_sys/backend/internal/auditlog"
+	"hfb_sys/backend/internal/logging"
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/adminrole"
+
+	"github.com/redis/go-redis/v9"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db    *gorm.DB
+	redis *redis.Client
+}
+
+func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
+	return &Repository{db: db, redis: redis}
+}
+
+func (r *Repository) List(ctx context.Context, page, pageSize int) (*PaginatedResult, error) {
+	db := r.db.WithContext(ctx)
+	var total int64
+	if err := db.Model(&model.AdminUser{}).Count(&total).Error; err != nil {
+		return nil, err
+	}
+	offset := (page - 1) * pageSize
+	var admins []model.AdminUser
+	if err := db.Order("id DESC").Offset(offset).Limit(pageSize).Find(&admins).Error; err != nil {
+		return nil, err
+	}
+	items := make([]AdminUserDTO, 0, len(admins))
+	for _, admin := range admins {
+		roles, _ := r.getAdminRoles(ctx, admin.ID)
+		items = append(items, AdminUserDTO{
+			ID:          admin.ID,
+			Username:    admin.Username,
+			Nickname:    admin.Nickname,
+			Status:      admin.Status,
+			Roles:       roles,
+			LastLoginAt: admin.LastLoginAt,
+			CreatedAt:   admin.CreatedAt,
+			UpdatedAt:   admin.UpdatedAt,
+		})
+	}
+	return &PaginatedResult{Items: items, Total: total, Page: page, PageSize: pageSize}, nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	roles, _ := r.getAdminRoles(ctx, admin.ID)
+	dto := AdminUserDTO{
+		ID:          admin.ID,
+		Username:    admin.Username,
+		Nickname:    admin.Nickname,
+		Status:      admin.Status,
+		Roles:       roles,
+		LastLoginAt: admin.LastLoginAt,
+		CreatedAt:   admin.CreatedAt,
+		UpdatedAt:   admin.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(ctx context.Context, req CreateAdminRequest) (*AdminUserDTO, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	// 仅部署 bootstrap 首个超级管理员会强制改密；后台新建账号不强制。
+	admin := model.AdminUser{
+		Username:           req.Username,
+		PasswordHash:       string(hash),
+		Nickname:           req.Nickname,
+		Status:             "active",
+		TokenVersion:       1,
+		PasswordMustChange: false,
+	}
+	if err := r.db.WithContext(ctx).Create(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, admin.ID)
+}
+
+func (r *Repository) Update(ctx context.Context, id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if req.Nickname != "" {
+		admin.Nickname = req.Nickname
+	}
+	if req.Status != "" {
+		admin.Status = req.Status
+	}
+	if err := db.Save(&admin).Error; err != nil {
+		return nil, err
+	}
+	if req.Status != "" {
+		if err := r.bumpTokenVersion(db, ctx, id, "admin_status_changed"); err != nil {
+			return nil, err
+		}
+		r.invalidatePermCache(ctx, id)
+	}
+	return r.FindByID(ctx, id)
+}
+
+func (r *Repository) Delete(ctx context.Context, id uint64, currentAdminID uint64) error {
+	if id == currentAdminID {
+		return ErrCannotDeleteSelf
+	}
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	// 检查是否是最后一个 super_admin
+	isLastSuper, err := r.isLastSuperAdmin(ctx, id)
+	if err != nil {
+		return err
+	}
+	if isLastSuper {
+		return ErrLastSuperAdmin
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(&model.AdminUser{}, id).Error; err != nil {
+			return err
+		}
+		r.invalidatePermCache(ctx, id)
+		return nil
+	})
+}
+
+func (r *Repository) AssignRoles(ctx context.Context, adminID uint64, roleIDs []uint64) error {
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, adminID).Error; err != nil {
+		return err
+	}
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", adminID).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		for _, rid := range roleIDs {
+			aur := model.AdminUserRole{AdminID: adminID, RoleID: rid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&aur).Error; err != nil {
+				return err
+			}
+		}
+		return r.bumpTokenVersion(tx, ctx, adminID, "roles_changed")
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidatePermCache(ctx, adminID)
+	return nil
+}
+
+func (r *Repository) ChangeOwnPassword(ctx context.Context, id uint64, oldPwd, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(oldPwd)); err != nil {
+		return ErrWrongPassword
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&admin).Updates(map[string]any{
+			"password_hash":        string(hash),
+			"password_must_change": false,
+		}).Error; err != nil {
+			return err
+		}
+		return r.bumpTokenVersion(tx, ctx, id, "password_changed")
+	})
+}
+
+func (r *Repository) ResetPassword(ctx context.Context, id uint64, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return err
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	// 管理员重置密码后直接可用，不再二次强制改密（强制改密仅用于 bootstrap 初始账号）。
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&admin).Updates(map[string]any{
+			"password_hash":        string(hash),
+			"password_must_change": false,
+		}).Error; err != nil {
+			return err
+		}
+		return r.bumpTokenVersion(tx, ctx, id, "password_reset")
+	})
+}
+
+func (r *Repository) GetPermissionCodes(ctx context.Context, adminID uint64) ([]string, error) {
+	var codes []string
+	err := r.db.WithContext(ctx).Table("admin_user_roles aur").
+		Select("DISTINCT p.code").
+		Joins("JOIN role_permissions rp ON rp.role_id = aur.role_id").
+		Joins("JOIN permissions p ON p.id = rp.permission_id").
+		Where("aur.admin_user_id = ?", adminID).
+		Pluck("code", &codes).Error
+	return codes, err
+}
+
+func (r *Repository) getAdminRoles(ctx context.Context, adminID uint64) ([]adminrole.RoleDTO, error) {
+	var roles []model.Role
+	err := r.db.WithContext(ctx).Table("roles").
+		Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
+		Where("aur.admin_user_id = ?", adminID).
+		Find(&roles).Error
+	if err != nil {
+		return nil, err
+	}
+	result := make([]adminrole.RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		result = append(result, adminrole.RoleDTO{
+			ID: role.ID, Code: role.Code, Name: role.Name, Description: role.Description,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) isLastSuperAdmin(ctx context.Context, adminID uint64) (bool, error) {
+	var superRole model.Role
+	db := r.db.WithContext(ctx)
+	if err := db.Where("code = ?", "super_admin").First(&superRole).Error; err != nil {
+		return false, nil // 没有 super_admin 角色，不限制
+	}
+	var count int64
+	err := db.Model(&model.AdminUserRole{}).
+		Where("role_id = ? AND admin_user_id != ?", superRole.ID, adminID).
+		Count(&count).Error
+	return count == 0, err
+}
+
+func (r *Repository) invalidatePermCache(ctx context.Context, adminID uint64) {
+	if r.redis == nil {
+		return
+	}
+	r.redis.Del(ctx, permCacheKey(adminID))
+}
+
+func (r *Repository) bumpTokenVersion(db *gorm.DB, ctx context.Context, adminID uint64, reason string) error {
+	if err := db.Model(&model.AdminUser{}).
+		Where("id = ?", adminID).
+		UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error; err != nil {
+		return err
+	}
+	bizID := adminID
+	return auditlog.Append(db, auditlog.Entry{
+		ActorType: "admin",
+		ActorID:   logging.AdminIDFromContext(ctx),
+		Action:    "auth.token_version.bump",
+		BizType:   "admin_user",
+		BizID:     &bizID,
+		Meta:      auditlog.Meta{RequestID: logging.RequestIDFromContext(ctx)},
+		Detail: map[string]any{
+			"target_admin_id": adminID,
+			"reason":          reason,
+		},
+	})
+}
+
+func permCacheKey(adminID uint64) string {
+	return fmt.Sprintf("admin:perms:%d", adminID)
+}
+
+var (
+	ErrCannotDeleteSelf = errors.New("cannot delete self")
+	ErrLastSuperAdmin   = errors.New("cannot delete the last super admin")
+	ErrWrongPassword    = errors.New("wrong password")
+)
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}
@@ -0,0 +1,108 @@
+package adminmgr
+
+import (
+	"context"
+	"errors"
+	"unicode"
+)
+
+var (
+	ErrDependencyUnavailable = errors.New("dependency unavailable")
+	ErrWeakPassword          = errors.New("weak password")
+)
+
+type Service struct {
+	repo *Repository
+}
+
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+func (s *Service) List(ctx context.Context, page, pageSize int) (*PaginatedResult, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if page < 1 {
+		page = 1
+	}
+	if pageSize < 1 || pageSize > 100 {
+		pageSize = 20
+	}
+	return s.repo.List(ctx, page, pageSize)
+}
+
+func (s *Service) FindByID(ctx context.Context, id uint64) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.FindByID(ctx, id)
+}
+
+func (s *Service) Create(ctx context.Context, req CreateAdminRequest) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	if !passwordStrongEnough(req.Password) {
+		return nil, ErrWeakPassword
+	}
+	return s.repo.Create(ctx, req)
+}
+
+func (s *Service) Update(ctx context.Context, id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	if s.repo == nil {
+		return nil, ErrDependencyUnavailable
+	}
+	return s.repo.Update(ctx, id, req)
+}
+
+func (s *Service) Delete(ctx context.Context, id uint64, currentAdminID uint64) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.Delete(ctx, id, currentAdminID)
+}
+
+func (s *Service) AssignRoles(ctx context.Context, adminID uint64, req AssignRolesRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	return s.repo.AssignRoles(ctx, adminID, req.RoleIDs)
+}
+
+func (s *Service) ChangeOwnPassword(ctx context.Context, adminID uint64, req ChangePasswordRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	if !passwordStrongEnough(req.NewPassword) {
+		return ErrWeakPassword
+	}
+	return s.repo.ChangeOwnPassword(ctx, adminID, req.OldPassword, req.NewPassword)
+}
+
+func (s *Service) ResetPassword(ctx context.Context, id uint64, req ResetPasswordRequest) error {
+	if s.repo == nil {
+		return ErrDependencyUnavailable
+	}
+	if !passwordStrongEnough(req.NewPassword) {
+		return ErrWeakPassword
+	}
+	return s.repo.ResetPassword(ctx, id, req.NewPassword)
+}
+
+func passwordStrongEnough(value string) bool {
+	if len([]rune(value)) < 8 {
+		return false
+	}
+	hasLetter := false
+	hasDigit := false
+	for _, r := range value {
+		if unicode.IsLetter(r) {
+			hasLetter = true
+		}
+		if unicode.IsDigit(r) {
+			hasDigit = true
+		}
+	}
+	return hasLetter && hasDigit
+}