彻底重构-3

2026-04-09 12:24:14 +08:00
parent 606ef875e2
commit 60054adcc4
37 changed files with 1324 additions and 3630 deletions
@@ -0,0 +1,84 @@
+import { requireAdminRole, verifyAdminSessionToken } from '../../services/admin/admin-auth-service.js'
+import { writeAdminAuditLog } from '../../services/admin/admin-audit-service.js'
+import { buildSuccessPayload, createHttpError, sendRouteError } from '../../utils/http.js'
+import { logWarn } from '../../utils/logger.js'
+
+export function createJsonHandler(action, { successMessage = 'ok', errorMessage, scope, audit } = {}) {
+  return async (req, res) => {
+    try {
+      const data = await action(req, res)
+      await recordAdminAudit(req.adminSession, req, data, audit)
+      res.json(buildSuccessPayload(data, successMessage))
+    } catch (error) {
+      sendRouteError(res, error, errorMessage, scope)
+    }
+  }
+}
+
+export function createFileHandler(action, { errorMessage, scope } = {}) {
+  return async (req, res) => {
+    try {
+      const filePath = await action(req, res)
+      res.sendFile(filePath)
+    } catch (error) {
+      sendRouteError(res, error, errorMessage, scope)
+    }
+  }
+}
+
+export async function requireAdminSession(req, res, next) {
+  try {
+    req.adminSession = await verifyAdminSessionToken(extractBearerToken(req))
+    next()
+  } catch (error) {
+    sendRouteError(res, error, '后台鉴权失败', '[admin/auth]')
+  }
+}
+
+export function requireAdminRoles(allowedRoles) {
+  return (req, res, next) => {
+    try {
+      requireAdminRole(req.adminSession, allowedRoles)
+      next()
+    } catch (error) {
+      sendRouteError(res, error, '后台鉴权失败', '[admin/auth/role]')
+    }
+  }
+}
+
+async function recordAdminAudit(session, req, data, audit) {
+  if (!audit) {
+    return
+  }
+
+  const payload = typeof audit === 'function' ? audit(req, data) : audit
+
+  if (!payload) {
+    return
+  }
+
+  try {
+    await writeAdminAuditLog(session, payload)
+  } catch (error) {
+    logWarn('[admin/audit]', '后台审计日志写入失败，已跳过', {
+      action: payload.action,
+      targetType: payload.targetType,
+      targetId: payload.targetId,
+      error,
+    })
+  }
+}
+
+export function extractBearerToken(req) {
+  const authorization = String(req.headers.authorization || '').trim()
+  const matched = authorization.match(/^Bearer\s+(.+)$/i)
+
+  if (!matched) {
+    throw createHttpError('未登录或登录已失效', {
+      statusCode: 401,
+      errorCode: 'admin_auth_required',
+    })
+  }
+
+  return matched[1]
+}