chore(init): 初始化解忧商行项目并完成 Phase 0 基座

2026-10-30 11:46:10 +08:00
commit 8d9481c251
689 changed files with 138703 additions and 0 deletions
@@ -0,0 +1,299 @@
+package adminmgr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"hfb_sys/backend/internal/auditlog"
+	"hfb_sys/backend/internal/logging"
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/adminrole"
+
+	"github.com/redis/go-redis/v9"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type Repository struct {
+	db    *gorm.DB
+	redis *redis.Client
+}
+
+func NewRepository(db *gorm.DB, redis *redis.Client) *Repository {
+	return &Repository{db: db, redis: redis}
+}
+
+func (r *Repository) List(ctx context.Context, page, pageSize int) (*PaginatedResult, error) {
+	db := r.db.WithContext(ctx)
+	var total int64
+	if err := db.Model(&model.AdminUser{}).Count(&total).Error; err != nil {
+		return nil, err
+	}
+	offset := (page - 1) * pageSize
+	var admins []model.AdminUser
+	if err := db.Order("id DESC").Offset(offset).Limit(pageSize).Find(&admins).Error; err != nil {
+		return nil, err
+	}
+	items := make([]AdminUserDTO, 0, len(admins))
+	for _, admin := range admins {
+		roles, _ := r.getAdminRoles(ctx, admin.ID)
+		items = append(items, AdminUserDTO{
+			ID:          admin.ID,
+			Username:    admin.Username,
+			Nickname:    admin.Nickname,
+			Status:      admin.Status,
+			Roles:       roles,
+			LastLoginAt: admin.LastLoginAt,
+			CreatedAt:   admin.CreatedAt,
+			UpdatedAt:   admin.UpdatedAt,
+		})
+	}
+	return &PaginatedResult{Items: items, Total: total, Page: page, PageSize: pageSize}, nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminUserDTO, error) {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	roles, _ := r.getAdminRoles(ctx, admin.ID)
+	dto := AdminUserDTO{
+		ID:          admin.ID,
+		Username:    admin.Username,
+		Nickname:    admin.Nickname,
+		Status:      admin.Status,
+		Roles:       roles,
+		LastLoginAt: admin.LastLoginAt,
+		CreatedAt:   admin.CreatedAt,
+		UpdatedAt:   admin.UpdatedAt,
+	}
+	return &dto, nil
+}
+
+func (r *Repository) Create(ctx context.Context, req CreateAdminRequest) (*AdminUserDTO, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	// 仅部署 bootstrap 首个超级管理员会强制改密；后台新建账号不强制。
+	admin := model.AdminUser{
+		Username:           req.Username,
+		PasswordHash:       string(hash),
+		Nickname:           req.Nickname,
+		Status:             "active",
+		TokenVersion:       1,
+		PasswordMustChange: false,
+	}
+	if err := r.db.WithContext(ctx).Create(&admin).Error; err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, admin.ID)
+}
+
+func (r *Repository) Update(ctx context.Context, id uint64, req UpdateAdminRequest) (*AdminUserDTO, error) {
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, id).Error; err != nil {
+		return nil, err
+	}
+	if req.Nickname != "" {
+		admin.Nickname = req.Nickname
+	}
+	if req.Status != "" {
+		admin.Status = req.Status
+	}
+	if err := db.Save(&admin).Error; err != nil {
+		return nil, err
+	}
+	if req.Status != "" {
+		if err := r.bumpTokenVersion(db, ctx, id, "admin_status_changed"); err != nil {
+			return nil, err
+		}
+		r.invalidatePermCache(ctx, id)
+	}
+	return r.FindByID(ctx, id)
+}
+
+func (r *Repository) Delete(ctx context.Context, id uint64, currentAdminID uint64) error {
+	if id == currentAdminID {
+		return ErrCannotDeleteSelf
+	}
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, id).Error; err != nil {
+		return err
+	}
+	// 检查是否是最后一个 super_admin
+	isLastSuper, err := r.isLastSuperAdmin(ctx, id)
+	if err != nil {
+		return err
+	}
+	if isLastSuper {
+		return ErrLastSuperAdmin
+	}
+	return db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", id).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(&model.AdminUser{}, id).Error; err != nil {
+			return err
+		}
+		r.invalidatePermCache(ctx, id)
+		return nil
+	})
+}
+
+func (r *Repository) AssignRoles(ctx context.Context, adminID uint64, roleIDs []uint64) error {
+	db := r.db.WithContext(ctx)
+	var admin model.AdminUser
+	if err := db.First(&admin, adminID).Error; err != nil {
+		return err
+	}
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("admin_user_id = ?", adminID).Delete(&model.AdminUserRole{}).Error; err != nil {
+			return err
+		}
+		for _, rid := range roleIDs {
+			aur := model.AdminUserRole{AdminID: adminID, RoleID: rid}
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&aur).Error; err != nil {
+				return err
+			}
+		}
+		return r.bumpTokenVersion(tx, ctx, adminID, "roles_changed")
+	})
+	if err != nil {
+		return err
+	}
+	r.invalidatePermCache(ctx, adminID)
+	return nil
+}
+
+func (r *Repository) ChangeOwnPassword(ctx context.Context, id uint64, oldPwd, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(oldPwd)); err != nil {
+		return ErrWrongPassword
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&admin).Updates(map[string]any{
+			"password_hash":        string(hash),
+			"password_must_change": false,
+		}).Error; err != nil {
+			return err
+		}
+		return r.bumpTokenVersion(tx, ctx, id, "password_changed")
+	})
+}
+
+func (r *Repository) ResetPassword(ctx context.Context, id uint64, newPwd string) error {
+	var admin model.AdminUser
+	if err := r.db.WithContext(ctx).First(&admin, id).Error; err != nil {
+		return err
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	// 管理员重置密码后直接可用，不再二次强制改密（强制改密仅用于 bootstrap 初始账号）。
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&admin).Updates(map[string]any{
+			"password_hash":        string(hash),
+			"password_must_change": false,
+		}).Error; err != nil {
+			return err
+		}
+		return r.bumpTokenVersion(tx, ctx, id, "password_reset")
+	})
+}
+
+func (r *Repository) GetPermissionCodes(ctx context.Context, adminID uint64) ([]string, error) {
+	var codes []string
+	err := r.db.WithContext(ctx).Table("admin_user_roles aur").
+		Select("DISTINCT p.code").
+		Joins("JOIN role_permissions rp ON rp.role_id = aur.role_id").
+		Joins("JOIN permissions p ON p.id = rp.permission_id").
+		Where("aur.admin_user_id = ?", adminID).
+		Pluck("code", &codes).Error
+	return codes, err
+}
+
+func (r *Repository) getAdminRoles(ctx context.Context, adminID uint64) ([]adminrole.RoleDTO, error) {
+	var roles []model.Role
+	err := r.db.WithContext(ctx).Table("roles").
+		Joins("JOIN admin_user_roles aur ON aur.role_id = roles.id").
+		Where("aur.admin_user_id = ?", adminID).
+		Find(&roles).Error
+	if err != nil {
+		return nil, err
+	}
+	result := make([]adminrole.RoleDTO, 0, len(roles))
+	for _, role := range roles {
+		result = append(result, adminrole.RoleDTO{
+			ID: role.ID, Code: role.Code, Name: role.Name, Description: role.Description,
+		})
+	}
+	return result, nil
+}
+
+func (r *Repository) isLastSuperAdmin(ctx context.Context, adminID uint64) (bool, error) {
+	var superRole model.Role
+	db := r.db.WithContext(ctx)
+	if err := db.Where("code = ?", "super_admin").First(&superRole).Error; err != nil {
+		return false, nil // 没有 super_admin 角色，不限制
+	}
+	var count int64
+	err := db.Model(&model.AdminUserRole{}).
+		Where("role_id = ? AND admin_user_id != ?", superRole.ID, adminID).
+		Count(&count).Error
+	return count == 0, err
+}
+
+func (r *Repository) invalidatePermCache(ctx context.Context, adminID uint64) {
+	if r.redis == nil {
+		return
+	}
+	r.redis.Del(ctx, permCacheKey(adminID))
+}
+
+func (r *Repository) bumpTokenVersion(db *gorm.DB, ctx context.Context, adminID uint64, reason string) error {
+	if err := db.Model(&model.AdminUser{}).
+		Where("id = ?", adminID).
+		UpdateColumn("token_version", gorm.Expr("token_version + 1")).Error; err != nil {
+		return err
+	}
+	bizID := adminID
+	return auditlog.Append(db, auditlog.Entry{
+		ActorType: "admin",
+		ActorID:   logging.AdminIDFromContext(ctx),
+		Action:    "auth.token_version.bump",
+		BizType:   "admin_user",
+		BizID:     &bizID,
+		Meta:      auditlog.Meta{RequestID: logging.RequestIDFromContext(ctx)},
+		Detail: map[string]any{
+			"target_admin_id": adminID,
+			"reason":          reason,
+		},
+	})
+}
+
+func permCacheKey(adminID uint64) string {
+	return fmt.Sprintf("admin:perms:%d", adminID)
+}
+
+var (
+	ErrCannotDeleteSelf = errors.New("cannot delete self")
+	ErrLastSuperAdmin   = errors.New("cannot delete the last super admin")
+	ErrWrongPassword    = errors.New("wrong password")
+)
+
+func IsNotFound(err error) bool {
+	return errors.Is(err, gorm.ErrRecordNotFound)
+}